Extreme Networks AP3917E Wireless 802.11 a/ac+b/g/n Access Point User Manual WiNG 5 9 1 System Reference Guide Part 1

Extreme Networks, Inc. Wireless 802.11 a/ac+b/g/n Access Point WiNG 5 9 1 System Reference Guide Part 1

UserManual.wiki >

Extreme Networks >

AP3917E User Manual >

WiNG 5.9.1 System Reference Guide Part 1

WiNG™ 5.9.1Wireless Controller and Service PlatformSystem Reference GuidePublished September 20179035204Published September 2017 9035204

iWireless Controller and Service Platform System Reference GuideTable of ContentsAbout This GuideChapter 1, Overview1.1 Distributed Intelligence ................................................................................................................................................................................................1-21.2 High Availability Networks .........................................................................................................................................................................................1-21.3 Gap Free Security ..........................................................................................................................................................................................................1-21.4 Outdoor Wireless and Mesh Networking .............................................................................................................................................................1-21.5 Network Services, Routing and Switching ..........................................................................................................................................................1-31.6 Management, Deployment and Troubleshooting ............................................................................................................................................1-3Chapter 2, Web UI Features2.1 Accessing the Web UI ..................................................................................................................................................................................................2-12.1.1 Browser and System Requirements ...........................................................................................................................................................2-12.1.2 Connecting to the Web UI .............................................................................................................................................................................2-12.2 Glossary of Icons Used ..............................................................................................................................................................................................2-22.2.1 Global Icons .........................................................................................................................................................................................................2-32.2.2 Dialog Box Icons ..............................................................................................................................................................................................2-32.2.3 Table Icons ........................................................................................................................................................................................................ 2-42.2.4 Status Icons ...................................................................................................................................................................................................... 2-42.2.5 Configurable Objects .................................................................................................................................................................................... 2-52.2.6 Configuration Objects ...................................................................................................................................................................................2-72.2.7 Configuration Operation Icons .................................................................................................................................................................. 2-82.2.8 Access Type Icons .......................................................................................................................................................................................... 2-82.2.9 Administrative Role Icons ........................................................................................................................................................................... 2-92.2.10 Device Icons .................................................................................................................................................................................................... 2-9Chapter 3, Quick Start3.1 Using the Initial Setup Wizard ..................................................................................................................................................................................3-1Chapter 4, Dashboard4.1 Summary .......................................................................................................................................................................................................................... 4-14.1.1 Device Listing ..................................................................................................................................................................................................... 4-24.2 System Screen ............................................................................................................................................................................................................. 4-34.2.1 Health ................................................................................................................................................................................................................... 4-34.2.2 Inventory ............................................................................................................................................................................................................ 4-54.3 RF Domain Screen .....................................................................................................................................................................................................4-64.3.1 RF Domain Health ........................................................................................................................................................................................... 4-74.3.2 RF Domain Inventory ....................................................................................................................................................................................4-94.4 Controller .......................................................................................................................................................................................................................4-114.4.1 Controller Health .............................................................................................................................................................................................4-114.4.2 Controller Inventory .....................................................................................................................................................................................4-134.4.3 T5 Controller Dashboard ..........................................................................................................................................................................4-154.4.4 EX3500 Switch Dashboard .....................................................................................................................................................................4-214.5 Access Point Screen ................................................................................................................................................................................................4-244.5.1 Access Point Health .....................................................................................................................................................................................4-244.5.2 Access Point Inventory ..............................................................................................................................................................................4-264.6 Network View ............................................................................................................................................................................................................4-274.7 Debug Wireless Clients ..........................................................................................................................................................................................4-29

Table of ContentsWireless Controller and Service Platform System Reference Guide v10.2.4 Network Service Alias ............................................................................................................................................................................. 10-2710.2.5 EX3500 ACL Standard ...........................................................................................................................................................................10-2910.2.6 EX3500 ACL Extended ........................................................................................................................................................................... 10-3110.3 Wireless Client Roles ........................................................................................................................................................................................... 10-3310.3.1 Configuring a Client’s Role Policy .......................................................................................................................................................10-3410.4 Device Fingerprinting .........................................................................................................................................................................................10-4710.5 Intrusion Prevention ............................................................................................................................................................................................. 10-5110.5.1 Configuring a WIPS Policy ..................................................................................................................................................................... 10-5210.5.2 Configuring a WIPS Device Categorization Policy ....................................................................................................................... 10-6110.5.3 Intrusion Detection Deployment Considerations ........................................................................................................................10-6410.6 EX3500 Time Range ...........................................................................................................................................................................................10-64Chapter 11, Services11.1 Configuring Captive Portal Policies ...................................................................................................................................................................... 11-111.1.1 Configuring a Captive Portal Policy .......................................................................................................................................................... 11-211.1.2 Creating DNS Whitelists ..............................................................................................................................................................................11-1311.1.3 Captive Portal Deployment Considerations ....................................................................................................................................... 11-1411.2 Setting the Guest Management Configuration .............................................................................................................................................11-1511.2.1 Email ....................................................................................................................................................................................................................11-1711.2.2 SMS .....................................................................................................................................................................................................................11-1811.2.3 SMS SMTP ...................................................................................................................................................................................................... 11-2011.2.4 DB Export ........................................................................................................................................................................................................11-2211.3 Setting the DHCP Configuration ....................................................................................................................................................................... 11-2411.3.1 Defining DHCP Pools .................................................................................................................................................................................. 11-2611.3.2 Defining DHCP Server Global Settings ................................................................................................................................................11-3511.3.3 DHCP Class Policy Configuration ..........................................................................................................................................................11-3711.3.4 DHCP Deployment Considerations ......................................................................................................................................................11-3811.4 Setting the Bonjour Gateway Configuration ............................................................................................................................................... 11-3911.4.1 Configuring a Bonjour Discovery Policy ............................................................................................................................................. 11-3911.4.2 Configuring a Bonjour Forwarding Policy ......................................................................................................................................... 11-4111.5 DHCPv6 Server Policy ........................................................................................................................................................................................... 11-4311.5.1 Defining DHCPv6 Options ........................................................................................................................................................................ 11-4511.5.2 DHCPv6 Pool Configuration ................................................................................................................................................................... 11-4611.6 Setting the RADIUS Configuration ................................................................................................................................................................... 11-4911.6.1 Creating RADIUS Groups .......................................................................................................................................................................... 11-5011.6.2 Defining User Pools .....................................................................................................................................................................................11-5311.6.3 Configuring RADIUS Server Policies ....................................................................................................................................................11-5711.6.4 RADIUS Deployment Considerations ................................................................................................................................................. 11-6811.7 URL Lists ..................................................................................................................................................................................................................... 11-6911.7.1 Adding or Editing URL Lists ..................................................................................................................................................................... 11-69Chapter 12, Management Access12.1 Viewing Management Access Policies .............................................................................................................................................................. 12-112.1.1 Adding or Editing a Management Access Policy .............................................................................................................................. 12-312.2 EX3500 Management Policies ......................................................................................................................................................................... 12-1912.2.1 EX3500 User Groups ................................................................................................................................................................................ 12-2012.2.2 EX3500 Authentication ...........................................................................................................................................................................12-2212.2.3 EX3500 Exec Password Management ..............................................................................................................................................12-2312.2.4 EX3500 System Settings ........................................................................................................................................................................12-2512.2.5 EX3500 SNMP Management ................................................................................................................................................................ 12-2612.2.6 EX3500 SNMP Users ............................................................................................................................................................................... 12-3012.3 Hierarchical Tree .....................................................................................................................................................................................................12-32

Table of ContentsWireless Controller and Service Platform System Reference Guide vi12.4 Management Access Deployment Considerations ................................................................................................................................. 12-36Chapter 13, Diagnostics13.1 Fault Management ..................................................................................................................................................................................................... 13-113.2 Crash Files ................................................................................................................................................................................................................... 13-513.3 Advanced Diagnostics ...........................................................................................................................................................................................13-613.3.1 UI Debugging ..................................................................................................................................................................................................13-613.3.2 Viewing UI Logs ............................................................................................................................................................................................ 13-713.3.3 Viewing UI Sessions ....................................................................................................................................................................................13-8Chapter 14, Operations14.1 Device Operations .....................................................................................................................................................................................................14-114.1.1 Operations Summary ....................................................................................................................................................................................14-114.1.2 Adopted Device Upgrades .......................................................................................................................................................................14-414.1.3 Using the File Management Browser ..................................................................................................................................................14-1014.1.4 Restarting Adopted Devices .................................................................................................................................................................. 14-1314.1.5 Captive Portal Configuration ................................................................................................................................................................. 14-1414.1.6 Crypto CMP Certificate ........................................................................................................................................................................... 14-1814.1.7 RAID Operations ......................................................................................................................................................................................... 14-1914.1.8 Re-elect Controller ..................................................................................................................................................................................... 14-2114.2 Certificates ............................................................................................................................................................................................................... 14-2214.2.1 Certificate Management .......................................................................................................................................................................... 14-2314.2.2 RSA Key Management ............................................................................................................................................................................. 14-3114.2.3 Certificate Creation .................................................................................................................................................................................. 14-3614.2.4 Generating a Certificate Signing Request ...................................................................................................................................... 14-3814.3 Smart RF ...................................................................................................................................................................................................................14-4014.3.1 Managing Smart RF for an RF Domain .............................................................................................................................................. 14-41Chapter 15, Statistics15.1 System Statistics ....................................................................................................................................................................................................... 15-115.1.1 Health ..................................................................................................................................................................................................................15-215.1.2 Inventory ..........................................................................................................................................................................................................15-415.1.3 Adopted Devices ...........................................................................................................................................................................................15-515.1.4 Pending Adoptions ......................................................................................................................................................................................15-615.1.5 Offline Devices ............................................................................................................................................................................................... 15-715.1.6 Device Upgrade .............................................................................................................................................................................................15-915.1.7 Licenses ........................................................................................................................................................................................................... 15-1015.1.8 WIPS Summary .............................................................................................................................................................................................15-1215.2 RF Domain Statistics ............................................................................................................................................................................................. 15-1415.2.1 Health ................................................................................................................................................................................................................15-1515.2.2 Inventory ....................................................................................................................................................................................................... 15-1815.2.3 Devices .......................................................................................................................................................................................................... 15-2015.2.4 AP Detection .................................................................................................................................................................................................15-2115.2.5 Wireless Clients ...........................................................................................................................................................................................15-2315.2.6 Device Upgrade ..........................................................................................................................................................................................15-2515.2.7 Wireless LANs ............................................................................................................................................................................................ 15-2615.2.8 Radios ............................................................................................................................................................................................................ 15-2815.2.9 Bluetooth ........................................................................................................................................................................................................15-3115.2.10 Mesh ...............................................................................................................................................................................................................15-3315.2.11 Mesh Point .................................................................................................................................................................................................. 15-3415.2.12 SMART RF .................................................................................................................................................................................................. 15-49

Table of ContentsWireless Controller and Service Platform System Reference Guide vii15.2.13 WIPS ............................................................................................................................................................................................................ 15-5415.2.14 Captive Portal .......................................................................................................................................................................................... 15-5615.2.15 Application Visibility (AVC) ............................................................................................................................................................... 15-5815.2.16 Coverage Hole Summary ..................................................................................................................................................................... 15-6115.2.17 Coverage Hole Details .......................................................................................................................................................................... 15-6215.3 Controller Statistics .............................................................................................................................................................................................. 15-6415.3.1 Health .............................................................................................................................................................................................................. 15-6515.3.2 Device ............................................................................................................................................................................................................ 15-6715.3.3 Cluster Peers ................................................................................................................................................................................................15-7115.3.4 Web-Filtering ..............................................................................................................................................................................................15-7215.3.5 Application Visibility (AVC) .................................................................................................................................................................. 15-7415.3.6 Application Policy ......................................................................................................................................................................................15-7715.3.7 Device Upgrade ......................................................................................................................................................................................... 15-7915.3.8 Mirroring .......................................................................................................................................................................................................15-8015.3.9 Adoption ........................................................................................................................................................................................................ 15-8115.3.10 AP Detection ........................................................................................................................................................................................... 15-8515.3.11 Guest User .................................................................................................................................................................................................. 15-8615.3.12 Wireless LANs ......................................................................................................................................................................................... 15-8715.3.13 Policy Based Routing ............................................................................................................................................................................ 15-8815.3.14 Radios .........................................................................................................................................................................................................15-9015.3.15 Mesh ............................................................................................................................................................................................................. 15-9315.3.16 Interfaces ................................................................................................................................................................................................... 15-9415.3.17 Border Gateway Protocol (BGP) Statistics .................................................................................................................................15-10515.3.18 RAID Statistics .........................................................................................................................................................................................15-11415.3.19 Power Status ............................................................................................................................................................................................15-11615.3.20 PPPoE ........................................................................................................................................................................................................ 15-11815.3.21 OSPF ...........................................................................................................................................................................................................15-12015.3.22 L2TPv3 ....................................................................................................................................................................................................... 15-13115.3.23 VRRP ..........................................................................................................................................................................................................15-13315.3.24 Critical Resources ................................................................................................................................................................................. 15-13715.3.25 LDAP Agent Status ..............................................................................................................................................................................15-13815.3.26 Mint Links .................................................................................................................................................................................................15-13915.3.27 Guest Users ..............................................................................................................................................................................................15-14115.3.28 GRE Tunnels ...........................................................................................................................................................................................15-14315.3.29 Dot1x ..........................................................................................................................................................................................................15-14415.3.30 Network ..................................................................................................................................................................................................15-14615.3.31 DHCPv6 Relay & Client ........................................................................................................................................................................15-16515.3.32 DHCP Server ...........................................................................................................................................................................................15-16715.3.33 Firewall ....................................................................................................................................................................................................15-17015.3.34 VPN ............................................................................................................................................................................................................15-18015.3.35 Viewing Certificate Statistics ...........................................................................................................................................................15-18315.3.36 WIPS Statistics ......................................................................................................................................................................................15-18615.3.37 Sensor Server ........................................................................................................................................................................................15-18815.3.38 Bonjour Services ...................................................................................................................................................................................15-18915.3.39 Captive Portal Statistics ................................................................................................................................................................... 15-19015.3.40 Network Time ........................................................................................................................................................................................15-19215.4 Access Point Statistics .......................................................................................................................................................................................15-19515.4.1 Health .............................................................................................................................................................................................................15-19615.4.2 Device ...........................................................................................................................................................................................................15-19715.4.3 Web-Filtering ............................................................................................................................................................................................15-20115.4.4 Application Visibility (AVC) ...............................................................................................................................................................15-20315.4.5 Device Upgrade ...................................................................................................................................................................................... 15-20615.4.6 Adoption ................................................................................................................................................................................................... 15-20815.4.7 AP Detection .............................................................................................................................................................................................. 15-212

Table of ContentsWireless Controller and Service Platform System Reference Guide viii15.4.8 Guest User .................................................................................................................................................................................................. 15-21315.4.9 Wireless LANs ...........................................................................................................................................................................................15-21415.4.10 Policy Based Routing ..........................................................................................................................................................................15-21615.4.11 Radios ......................................................................................................................................................................................................... 15-21715.4.12 Mesh ............................................................................................................................................................................................................ 15-22115.4.13 Interfaces ................................................................................................................................................................................................. 15-22215.4.14 RTLS .......................................................................................................................................................................................................... 15-23215.4.15 PPPoE ....................................................................................................................................................................................................... 15-23315.4.16 Bluetooth .................................................................................................................................................................................................15-23515.4.17 OSPF ..........................................................................................................................................................................................................15-23615.4.18 L2TPv3 Tunnels .....................................................................................................................................................................................15-24615.4.19 VRRP .........................................................................................................................................................................................................15-24815.4.20 Critical Resources ...............................................................................................................................................................................15-25015.4.21 LDAP Agent Status .............................................................................................................................................................................. 15-25115.4.22 Mint Links ................................................................................................................................................................................................ 15-25215.4.23 Guest Users .............................................................................................................................................................................................15-25415.4.24 GRE Tunnels ..........................................................................................................................................................................................15-25615.4.25 Dot1x ......................................................................................................................................................................................................... 15-25715.4.26 Network ..................................................................................................................................................................................................15-25915.4.27 DHCPv6 Relay & Client .....................................................................................................................................................................15-27615.4.28 DHCP Server .........................................................................................................................................................................................15-27815.4.29 Firewall .....................................................................................................................................................................................................15-28115.4.30 VPN ............................................................................................................................................................................................................15-29115.4.31 Certificates ..............................................................................................................................................................................................15-29415.4.32 WIPS .........................................................................................................................................................................................................15-29715.4.33 Sensor Servers ......................................................................................................................................................................................15-29915.4.34 Bonjour Services ................................................................................................................................................................................ 15-30015.4.35 Captive Portal ........................................................................................................................................................................................15-30115.4.36 Network Time .......................................................................................................................................................................................15-30215.4.37 Load Balancing .....................................................................................................................................................................................15-30515.4.38 Environmental Sensors (AP8132 Models Only) ......................................................................................................................15-30715.5 Wireless Client Statistics ...................................................................................................................................................................................15-31015.5.1 Health .............................................................................................................................................................................................................. 15-31115.5.2 Details ........................................................................................................................................................................................................... 15-31315.5.3 Traffic ............................................................................................................................................................................................................ 15-31715.5.4 WMM TSPEC ..............................................................................................................................................................................................15-31915.5.5 Association History ................................................................................................................................................................................15-32015.5.6 Graph ............................................................................................................................................................................................................ 15-32115.6 Guest Access Statistics ..................................................................................................................................................................................... 15-32215.6.1 Guest Access Cumulative Statistics ................................................................................................................................................. 15-32315.6.2 Social Media Statistics ........................................................................................................................................................................... 15-32515.6.3 Reports ........................................................................................................................................................................................................15-32615.6.4 Notifications .............................................................................................................................................................................................. 15-32715.6.5 Guest Access Database ........................................................................................................................................................................15-32915.7 Analytics Developer Interface ........................................................................................................................................................................ 15-33215.7.1 Download REST API Toolkit ................................................................................................................................................................ 15-33215.7.2 API Assessment ....................................................................................................................................................................................... 15-335Chapter 16, Analytics16.1 System Analytics ........................................................................................................................................................................................................16-116.2 RF Domain Analytics ..............................................................................................................................................................................................16-816.3 Wireless Controller Analytics ............................................................................................................................................................................ 16-1216.4 Access Point Analytics ......................................................................................................................................................................................... 16-13

Table of ContentsWireless Controller and Service Platform System Reference Guide ix16.5 Analytic Event Monitoring .................................................................................................................................................................................. 16-16Chapter 17, WiNG Events17.1 Event Messages ........................................................................................................................................................................................................... 17-1Appendix A, PUBLICLY AVAILABLE SOFTWAREA.1 General Information ....................................................................................................................................................................................................A-1A.2 Open Source Software Used .................................................................................................................................................................................A-2A.3 OSS Licenses ............................................................................................................................................................................................................ A-15A.3.1 Apache License, Version 2.0 .................................................................................................................................................................... A-15A.3.2 The BSD License ........................................................................................................................................................................................... A-17A.3.3 Creative Commons Attribution-ShareAlike License, version 3.0 ............................................................................................. A-18A.3.4 DropBear License ....................................................................................................................................................................................... A-23A.3.5 GNU General Public License, version 2 .............................................................................................................................................. A-25A.3.6 GNU GENERAL PUBLIC LICENSE ........................................................................................................................................................ A-26A.3.7 GNU Lesser General Public License 2.1 ..............................................................................................................................................A-30A.3.8 CCO 1.0 Universal ........................................................................................................................................................................................ A-37A.3.9 GNU General Public License, version 3 ..............................................................................................................................................A-39A.3.10 ISC License ...................................................................................................................................................................................................A-48A.3.11 GNU Lesser General Public License, version 3.0 ...........................................................................................................................A-48A.3.12 GNU General Public License 2.0 .......................................................................................................................................................... A-51A.3.13 GNU Lesser General Public License, version 2.0 .......................................................................................................................... A-57A.3.14 GNU Lesser General Public License, version 2.1 ............................................................................................................................A-63A.3.15 GNU LESSER GENERAL PUBLIC LICENSE .....................................................................................................................................A-65A.3.16 MIT License ..................................................................................................................................................................................................A-69A.3.17 Mozilla Public License, version 2 .........................................................................................................................................................A-70A.3.18 The Open LDAP Public License ...........................................................................................................................................................A-74A.3.19 OpenSSL License ....................................................................................................................................................................................... A-75A.3.20 WU-FTPD Software License ................................................................................................................................................................ A-76A.3.21 zlib License ................................................................................................................................................................................................... A-77A.3.22 Python License, Version 2 (Python-2.0) ......................................................................................................................................... A-78A.3.23 BEOPEN.COM LICENSE AGREEMENT FOR PYTHON 2.0 ....................................................................................................... A-78A.3.24 CNRI OPEN SOURCE LICENSE AGREEMENT (for Python 1.6b1) ......................................................................................... A-79A.3.25 CWI LICENSE AGREEMENT FOR PYTHON 0.9.0 THROUGH 1.2 ..........................................................................................A-80A.3.26 Zope Public License (ZPL) Version 2.0 ............................................................................................................................................ A-81A.3.27 Zope Public License (ZPL) Version 2.1 ............................................................................................................................................. A-82

xiWireless Controller and Service Platform System Reference GuideAbout This GuideThis manual supports the following Access Point, controller and service platform models:•Wireless Controllers – RFS4000, RFS6000•Service Platforms - NX5500, NX5500E, NX7500, NX75XX, NX7510E, NX9500, NX9510, NX9600, NX9610, VX9000, VX9000E•Access Points – AP6522, AP6532, AP6562, AP7161, AP7502, AP7522, AP7532, AP7562, AP7602, AP7612, AP7622, AP7632, AP7662, AP8122, AP8132, AP8163, AP8232, AP8432 and AP8533.This section is organized into the following:•Document Convention•Notational Conventions•End-User Software License AgreementNOTE: Throughout this guide, unless specific model references are needed, AP8122, AP8132, AP8163 models are referred to as AP81XX.

About This GuideWireless Controller and Service Platform System Reference Guide xiiDocument ConventionThe following conventions are used in this manual to draw your attention to important information: Notational ConventionsThe following notational conventions are used in this document:•Italics are used to highlight specific items in the general text, and to identify chapters and sections in this and related documents• Bullets (•) indicate:- lists of alternatives- lists of required steps that are not necessarily sequential-action items• Sequential lists (those describing step-by-step procedures) appear as numbered listsNOTE: Indicates tips or special requirements.CAUTION: Indicates conditions that can cause equipment damage or data loss.WARNING! Indicates a condition or procedure that could result in personal injury or equipment damage.Switch Note: Indicates caveats unique to a particular RFS series controller or NX se-ries service platform.!

About This GuideWireless Controller and Service Platform System Reference Guide xiiiEnd-User Software License AgreementThis document is an agreement (“Agreement”) between You, the end user, and Extreme Networks, Inc., on behalf of itself and its Affiliates (“Extreme”) that sets forth your rights and obligations with respect to the “Licensed Materials”. BY INSTALLING SOFTWARE AND/OR THE LICENSE KEY FOR THE SOFTWARE (“License Key”) (collectively, “Licensed Software”), IF APPLICABLE, COPYING, OR OTHERWISE USING THE LICENSED SOFTWARE AND/OR ANY OF THE LICENSED MATERIALS UNDER THIS AGREEMENT, YOU ARE AGREEING TO BE BOUND BY THE TERMS OF THIS AGREEMENT, WHICH INCLUDES THE LICENSE(S) AND THE LIMITATION(S) OF WARRANTY AND DISCLAIMER(S)/LIMITATION(S) OF LIABILITY. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, RETURN THE LICENSE KEY (IF APPLICABLE) TO EXTREME OR YOUR DEALER, IF ANY, OR DO NOT USE THE LICENSED SOFTWARE AND/OR LICENSED MATERIALS AND CONTACT EXTREME OR YOUR DEALER WITHIN TEN (10) DAYS FOLLOWING THE DATE OF RECEIPT TO ARRANGE FOR A REFUND. IF YOU HAVE ANY QUESTIONS ABOUT THIS AGREEMENT, CONTACT EXTREME, Attn: LegalTeam@extremenetworks.com.1 DEFINITIONS. “Affiliates” means any person, partnership, corporation, limited liability company, or other form of enterprise that directly or indirectly through one or more intermediaries, controls, or is controlled by, or is under common control with the party specified. “Server Application” means the software application associated to software authorized for installation (per License Key, if applicable) on one or more of Your servers as further defined in the Ordering Documentation. “Client Application” shall refer to the application to access the Server Application. “Network Device” for purposes of this Agreement shall mean a physical computer device, appliance, appliance component, controller, wireless access point, or virtual appliance as further described within the applicable product documentation, which includes the Order Documentation. “Licensed Materials” means the Licensed Software (including the Server Application and Client Application), Network Device (if applicable), Firmware, media embodying software, and the accompanying documentation. “Concurrent User” shall refer to any of Your individual employees who You provide access to the Server Application at any one time. “Firmware” refers to any software program or code embedded in chips or other media. “Standalone” software is software licensed for use independent of any hardware purchase as identified in the Ordering Documentation. “Licensed Software” collectively refers to the software, including Standalone software, Firmware, Server Application, Client Application or other application licensed with conditional use parameters as defined in the Ordering Documentation. “Ordering Documentation” shall mean the applicable price quotation, corresponding purchase order, relevant invoice, order acknowledgement, and accompanying documentation or specifications for the products and services purchased, acquired or licensed hereunder from Extreme either directly or indirectly.2TERM. This Agreement is effective from the date on which You accept the terms and conditions of this Agreement via click-through, commence using the products and services or upon delivery of the License Key if applicable, and shall be effective until terminated. In the case of Licensed Materials offered on a subscription basis, the term of “licensed use” shall be as defined within Your Ordering Documentation.3 GRANT OF LICENSE. Extreme will grant You a non-transferable, non-sublicensable, non-exclusive license to use the Licensed Materials and the accompanying documentation for Your own business purposes subject to the terms and conditions of this Agreement, applicable licensing restrictions, and any term, user server networking device, field of use, or other restrictions as set forth in Your Ordering Documentation. If the Licensed Materials are being licensed on a subscription and/or capacity basis, the applicable term and/or capacity limit of the license shall be specified in Your Ordering Documentation. You may install and use the Licensed Materials as permitted by the license type purchased as described below in License Types. The license type purchased is specified on the invoice issued to You by Extreme or Your dealer, if any. YOU MAY NOT USE, COPY, OR MODIFY THE LICENSED MATERIALS, IN WHOLE OR IN PART, EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT.4LICENSE TYPES.

About This GuideWireless Controller and Service Platform System Reference Guide xiv•Single User, Single Network Device. Under the terms of this license type, the license granted to You by Extreme authorizes You to use the Licensed Materials as bundled with a single Network Device as identified by a unique serial number for the applicable Term, if and as specified in Your Ordering Documentation, or any replacement for that network device for that same Term, for internal use only. A separate license, under a separate License Agreement, is required for any other network device on which You or another individual, employee or other third party intend to use the Licensed Materials. A separate license under a separate License Agreement is also required if You wish to use a Client license (as described below).•Single User, Multiple Network Device. Under the terms of this license type, the license granted to You by Extreme authorizes You to use the Licensed Materials with a defined amount of Network Devices as defined in the Ordering Documentation.•Client. Under the terms of the Client license, the license granted to You by Extreme will authorize You to install the License Key for the Licensed Materials on your server and allow the specific number of Concurrent Users as ordered by you and is set forth in Your Ordering Documentation. A separate license is required for each additional Concurrent User.•Standalone. Software or other Licensed Materials licensed to You for use independent of any Network Device.•Subscription. Licensed Materials, and inclusive Software, Network Device or related appliance updates and maintenance services, licensed to You for use during a subscription period as defined in Your applicable Ordering Documentation.•Capacity. Under the terms of this license, the license granted to You by Extreme authorizes You to use the Licensed Materials up to the amount of capacity or usage as defined in the Ordering Documentation.5AUDIT RIGHTS. You agree that Extreme may audit Your use of the Licensed Materials for compliance with these terms and Your License Type at any time, upon reasonable notice. In the event that such audit reveals any use of the Licensed Materials by You other than in full compliance with the license granted and the terms of this Agreement, Extreme reserves the right to charge You for all reasonable expenses related to such audit in addition to any other liabilities and overages applicable as a result of such non-compliance, including but not limited to additional fees for Concurrent Users, excess capacity or usage over and above those specifically granted to You. From time to time, the Licensed Materials may upload information about the Licensed Materials and the associated usage to Extreme. This is to verify the Licensed Materials are being used in accordance with a valid license and/or entitlement. By using the Licensed Materials, you consent to the transmission of this information.6 RESTRICTION AGAINST COPYING OR MODIFYING LICENSED MATERIALS. Except as expressly permitted in this Agreement, You may not copy or otherwise reproduce the Licensed Materials. In no event does the limited copying or reproduction permitted under this Agreement include the right to decompile, disassemble, electronically transfer, or reverse engineer the Licensed Materials, including the Licensed Software, or to translate the Licensed Materials into another computer language. The media embodying the Licensed Materials may be copied by You, in whole or in part, into printed or machine readable form, in sufficient numbers only for backup or archival purposes, or to replace a worn or defective copy. However, You agree not to have more than two (2) copies of the Licensed Software in whole or in part, including the original media, in your possession for said purposes without Extreme’ prior written consent, and in no event shall You operate more copies of the Licensed Software than the specific licenses granted to You. You may not copy or reproduce the documentation. You agree to maintain appropriate records of the location of the original media and all copies of the Licensed Software, in whole or in part, made by You. Any portion of the Licensed Software included in any such modular work shall be used only on a single computer for internal purposes and shall remain subject to all the terms and conditions of this Agreement. You agree to include any copyright or other proprietary notice set forth on the label of the media embodying the Licensed Software on any copy of the Licensed Software in any form, in whole or in part, or on any modification of the Licensed Software or any such modular work containing the Licensed Software or any part thereof.7 TITLE AND PROPRIETARY RIGHTS

About This GuideWireless Controller and Service Platform System Reference Guide xva The Licensed Materials are copyrighted works and are the sole and exclusive property of Extreme, any company or a division thereof which Extreme controls or is controlled by, or which may result from the merger or consolidation with Extreme (its “Affiliates”), and/or their suppliers. This Agreement conveys a limited right to operate the Licensed Materials and shall not be construed to convey title to the Licensed Materials to You. There are no implied rights. You shall not sell, lease, transfer, sublicense, dispose of, or otherwise make available the Licensed Materials or any portion thereof, to any other party.bYou further acknowledge that in the event of a breach of this Agreement, Extreme shall suffer severe and irreparable damages for which monetary compensation alone will be inadequate. You therefore agree that in the event of a breach of this Agreement, Extreme shall be entitled to monetary damages and its reasonable attorney’s fees and costs in enforcing this Agreement, as well as injunctive relief to restrain such breach, in addition to any other remedies available to Extreme.8 PROTECTION AND SECURITY. In the performance of this Agreement or in contemplation thereof, You and your employees and agents may have access to private or confidential information owned or controlled by Extreme relating to the Licensed Materials supplied hereunder including, but not limited to, product specifications and schematics, and such information may contain proprietary details and disclosures. All information and data so acquired by You or your employees or agents under this Agreement or in contemplation hereof shall be and shall remain Extreme’ exclusive property, and You shall use all commercially reasonable efforts to keep, and have your employees and agents keep, any and all such information and data confidential, and shall not copy, publish, or disclose it to others, without Extreme’ prior written approval, and shall return such information and data to Extreme at its request. Nothing herein shall limit your use or dissemination of information not actually derived from Extreme or of information which has been or subsequently is made public by Extreme, or a third party having authority to do soYou agree not to deliver or otherwise make available the Licensed Materials or any part thereof, including without limitation the object or source code (if provided) of the Licensed Software, to any party other than Extreme or its employees, except for purposes specifically related to your use of the Licensed Materials on a single computer as expressly provided in this Agreement, without the prior written consent of Extreme. You acknowledge that the Licensed Materials contain valuable confidential information and trade secrets, and that unauthorized use, copying and/or disclosure thereof are harmful to Extreme or its Affiliates and/or its/their software suppliers.9 MAINTENANCE AND UPDATES. Except as otherwise defined below, updates and certain maintenance and support services, if any, shall be provided to You pursuant to the terms of an Extreme Service and Maintenance Agreement, if Extreme and You enter into such an agreement. Except as specifically set forth in such agreement, Extreme shall not be under any obligation to provide updates, modifications, or enhancements, or maintenance and support services for the Licensed Materials to You. If you have purchased Licensed Materials on a subscription basis then the applicable service terms for Your Licensed Materials are as provided in Your Ordering Documentation. Extreme will perform the maintenance and updates in a timely and professional manner, during the Term of Your subscription, using qualified and experienced personnel. You will cooperate in good faith with Extreme in the performance of the support services including, but not limited to, providing Extreme with: (a) access to the Extreme Licensed Materials (and related systems); and (b) reasonably requested assistance and information. Further information about the applicable maintenance and updates terms can be found on Extreme’s website at http://www.extremenetworks.com/company/legal/terms-of-support10 DEFAULT AND TERMINATION. In the event that You shall fail to keep, observe, or perform any obligation under this Agreement, including a failure to pay any sums due to Extreme, or in the event that you become insolvent or seek protection, voluntarily or involuntarily, under any bankruptcy law, Extreme may, in addition to any other remedies it may have under law, terminate the License and any other agreements between Extreme and You.a Immediately after any termination of the Agreement, Your licensed subscription term, or if You have for any reason discontinued use of Licensed Materials, You shall return to Extreme the original and any copies of the Licensed Materials and remove the Licensed Materials, including an Licensed Software, from any modular

About This GuideWireless Controller and Service Platform System Reference Guide xviworks made pursuant to Section 3, and certify in writing that through your best efforts and to the best of your knowledge the original and all copies of the terminated or discontinued Licensed Materials have been returned to Extremeb Sections 1, 7, 8, 10, 11, 12, 13, 14 and 15 shall survive termination of this Agreement for any reason.11 EXPORT REQUIREMENTS. You are advised that the Licensed Materials, including the Licensed Software is of United States origin and subject to United States Export Administration Regulations; diversion contrary to United States law and regulation is prohibited. You agree not to directly or indirectly export, import or transmit the Licensed Materials, including the Licensed Software to any country, end user or for any Use that is prohibited by applicable United States regulation or statute (including but not limited to those countries embargoed from time to time by the United States government); or contrary to the laws or regulations of any other governmental entity that has jurisdiction over such export, import, transmission or Use12 UNITED STATES GOVERNMENT RESTRICTED RIGHTS. The Licensed Materials (i) were developed solely at private expense; (ii) contain “restricted computer software” submitted with restricted rights in accordance with section 52.227-19 (a) through (d) of the Commercial Computer Software-Restricted Rights Clause and its successors, and (iii) in all respects is proprietary data belonging to Extreme and/or its suppliers. For Department of Defense units, the Licensed Materials are considered commercial computer software in accordance with DFARS section 227.7202-3 and its successors, and use, duplication, or disclosure by the U.S. Government is subject to restrictions set forth herein.13 LIMITED WARRANTY AND LIMITATION OF LIABILITY. Extreme warrants to You that (a) the initially-shipped version of the Licensed Materials will materially conform to the Documentation; and (b) the media on which the Licensed Software is recorded will be free from material defects for a period of ninety (90) days from the date of delivery to You or such other minimum period required under applicable law. Extreme does not warrant that Your use of the Licensed Materials will be error-free or uninterrupted.NEITHER EXTREME NOR ITS AFFILIATES MAKE ANY OTHER WARRANTY OR REPRESENTATION, EXPRESS OR IMPLIED, WITH RESPECT TO THE LICENSED MATERIALS, WHICH ARE LICENSED "AS IS". THE LIMITED WARRANTY AND REMEDY PROVIDED ABOVE ARE EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, WHICH ARE EXPRESSLY DISCLAIMED, AND STATEMENTS OR REPRESENTATIONS MADE BY ANY OTHER PERSON OR FIRM ARE VOID. IN NO EVENT WILL EXTREME OR ANY OTHER PARTY WHO HAS BEEN INVOLVED IN THE CREATION, PRODUCTION OR DELIVERY OF THE LICENSED MATERIALS BE LIABLE FOR SPECIAL, DIRECT, INDIRECT, RELIANCE, INCIDENTAL OR CONSEQUENTIAL DAMAGES, INCLUDING LOSS OF DATA OR PROFITS OR FOR INABILITY TO USE THE LICENSED MATERIALS, TO ANY PARTY EVEN IF EXTREME OR SUCH OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT SHALL EXTREME OR SUCH OTHER PARTY'S LIABILITY FOR ANY DAMAGES OR LOSS TO YOU OR ANY OTHER PARTY EXCEED THE LICENSE FEE YOU PAID FOR THE LICENSED MATERIALS.Some states do not allow limitations on how long an implied warranty lasts and some states do not allow the exclusion or limitation of incidental or consequential damages, so the above limitation and exclusion may not apply to You. This limited warranty gives You specific legal rights, and You may also have other rights which vary from state to state.14 JURISDICTION. The rights and obligations of the parties to this Agreement shall be governed and construed in accordance with the laws and in the State and Federal courts of the State of California, without regard to its rules with respect to choice of law. You waive any objections to the personal jurisdiction and venue of such courts. None of the 1980 United Nations Convention on the Limitation Period in the International Sale of Goods, and the Uniform Computer Information Transactions Act shall apply to this Agreement15 FREE AND OPEN SOURCE SOFTWARE. Portions of the Software (Open Source Software) provided to you may be subject to a license that permits you to modify these portions and redistribute the modifications (an Open Source License). Your use, modification and redistribution of the Open Source Software are governed by the

About This GuideWireless Controller and Service Platform System Reference Guide xviiterms and conditions of the applicable Open Source License. More details regarding the Open Source Software and the applicable Open Source Licenses are available at www.extremenetworks.com/services/SoftwareLicensing.aspx. Some of the Open Source software may be subject to the GNU General Public License v.x (GPL) or the Lesser General Public Library (LGPL), copies of which are provided with the Licensed Materials and are further available for review at www.extremenetworks.com/services/SoftwareLicensing.aspx, or upon request as directed herein. In accordance with the terms of the GPL and LGPL, you may request a copy of the relevant source code. See the Software Licensing web site for additional details. This offer is valid for up to three years from the date of original download of the software.16 GENERAL.a This Agreement is the entire agreement between Extreme and You regarding the Licensed Materials, and all prior agreements, representations, statements, and undertakings, oral or written, are hereby expressly superseded and canceled.b This Agreement may not be changed or amended except in writing signed by both parties hereto.c You represent that You have full right and/or authorization to enter into this Agreement.d This Agreement shall not be assignable by You without the express written consent of Extreme. The rights of Extreme and Your obligations under this Agreement shall inure to the benefit of Extreme’ assignees, licensors, and licensees.e Section headings are for convenience only and shall not be considered in the interpretation of this Agreementf The provisions of the Agreement are severable and if any one or more of the provisions hereof are judicially determined to be illegal or otherwise unenforceable, in whole or in part, the remaining provisions of this Agreement shall nevertheless be binding on and enforceable by and between the parties heretog Extreme’s waiver of any right shall not constitute waiver of that right in future. This Agreement constitutes the entire understanding between the parties with respect to the subject matter hereof, and all prior agreements, representations, statements and undertakings, oral or written, are hereby expressly superseded and canceled. No purchase order shall supersede this Agreement.h Should You have any questions regarding this Agreement, You may contact Extreme at the address set forth below. Any notice or other communication to be sent to Extreme must be mailed by certified mail to the following address:Extreme Networks, Inc.16480 Via Del San Jose, CA 95119 United StatesTel: +1 408-579-2800Toll-free: +1 888-257-3000

1 - 1Wireless Controller and Service Platform System Reference Guide1OverviewExtreme Networks’ WiNG 5 operating system is the next generation in the evolution of WLAN architectures. WiNG 5 OS is designed to scale efficiently from the smallest networks to large, geographically dispersed deployments. The co-operative, distributed control plane innovation in the WiNG 5 architecture offers a software-defined networking (SDN)-ready operating system that can distribute controller functionality to every Access Point in your network. Now, every Access Point is network aware, providing the intelligence required to truly unleash optimal performance, all wireless LAN infrastructure can work together to ensure every transmission is routed through the most efficient path, every time.WiNG 5 brings you the resiliency of a standalone Access Point network without the vulnerability of a centralized controller, with advancements that take performance, reliability, security, scalability and manageability to a new level. The result? Maximum network uptime and security with minimal management. And true seamless and dependable mobility for your users.WiNG 5 advances the following technology:Comprehensive Wi-Fi support - WiNG supports all Wi-Fi protocols, including 802.11a/b/g/n/ac, allowing you to create a cost-effective migration plan based on the needs of your business.Extraordinary scalability - With WiNG, you can build any size network, from a small WLAN network in a single location to a large multi-site network that reaches all around the globe.Extraordinary flexibility - No matter what type of infrastructure you deploy, WiNG 5 delivers intelligence to all: standalone independent Access Points or adaptive Access Points that can be adopted by a controller but can switch to independent mode; virtual controllers; physical controllers in branch offices, the network operating center (NOC) or the cloud.The power of distributed intelligence - WiNG distributes intelligence right to the network edge, empowering every controller and Access Point with the intelligence needed to be network-aware, able to identify and dynamically route traffic over the most efficient path available at that time.Extraordinary network flexibility and site survivability - WiNG provides the best of both worlds: true hierarchical management that delivers a new level of management simplicity and resiliency by enabling controllers to adopt and manage other controllers and Access Points, while allowing adopted infrastructure to also stand on its own.Gap-free security - When it comes to security, there can be no compromises. WiNG’s comprehensive security capabilities keep your network and your data safe, ensuring compliance with PCI, HIPAA and other government and industry security regulations.Connectivity for the largest indoor and outdoor spaces - In addition to enabling a robust indoor WLAN, our patented MeshConnex™ technology enables the extension of Wi-Fi networks to the largest of outdoor spaces from an expansive outdoor campus environment to an entire city.Powerful centralized management - With WiNG you get complete control over every aspect of your WLAN. This single powerful windowpane enables zero touch infrastructure deployment, rich analytics that can help you recognize and correct brewing issues before they impact service quality and user connectivity, along with centralized and remote troubleshooting and issue resolution of the entire network.Application Visibility and Control - With WiNG you get visibility & control over Layer-7 applications with an embedded DPI engine at the Access Point. Extreme Networks’ NSight (an add-on module to WiNG)

OverviewWireless Controller and Service Platform System Reference Guide 1 - 2provides real-time visibility and in-depth insight into every dimension of the network including layer-7 application visibility, client devices, device & OS types and users. At a glance the administrator can discern the top applications by usage or by count at every level of the network from site level to Access Points and clients. This is achieved by Deep Packet Inspection (DPI) of every flow of every user at the Access Point. The embedded DPI engine in the WiNG OS can detect and identify thousands of applications real time and report to NSight. In addition to detection, firewall and QOS policies can leverage the application context to enforce policies.1.1 Distributed IntelligenceWiNG 5 enables all WLAN infrastructure with the intelligence required to work together to determine the most efficient path for every transmission. The need to route all traffic through a controller is eliminated, along with the resulting congestion and latency, resulting in higher throughput and superior network performance. Since all features are available at the access layer, they remain available even when the controller is offline, for example, due to a WAN outage, ensuring site survivability and extraordinary network resilience. In addition, you get unprecedented scalability, large networks can support as many as 10,000 nodes without impacting throughput or manageability, providing unprecedented scalability.1.2 High Availability NetworksWiNG 5 enables the creation of highly reliable networks, with several levels of redundancy and failover mechanisms to ensure continuous network service in case of outages. APs in remote sites coordinate with each other to provide optimized routing and self-healing, delivering a superior quality of experience for business critical applications. Even when WiNG 5 site survivable APs lose communication with the controller, they continue to function, able to bridge traffic while still enforcing QoS and security policies, including stateful inspection of Layer2 (locally bridged) or Layer 3 traffic.1.3 Gap Free SecurityWhen it comes to wireless security, one size does not fit all. A variety of solutions are required to meet the varying needs and demands of different types of organizations. Regardless of the size of your WLAN or your security requirements, our tiered approach to security allows you to deploy the features you need to achieve the right level of security for your networks and your data. And where a hub-and-spoke architecture can’t stop threats until they reach the controller inside your network, WiNG 5 distributes security features to every access point, including those at the very edge of your network, creating an around-the-clock constant network perimeter guard that prevents threats from entering your network for unprecedented gap free security.1.4 Outdoor Wireless and Mesh NetworkingWhen you need to extend your wireless LAN to outdoor spaces, our patented MeshConnex technology combines with comprehensive mesh networking features to enable you to create secure, high performance, flexible and scalable mesh networks. With our mesh technology, you can cover virtually any area without installing cabling, enabling the creation of cost-effective outdoor wireless networks that can provide

OverviewWireless Controller and Service Platform System Reference Guide 1 - 3coverage to enterprise workers in vast campus-style environments as well as public safety personnel in patrol cars.1.5 Network Services, Routing and SwitchingWiNG 5 integrates network services like built-in DHCP server, AAA server and routing protocols like policy based routing and OSPF, Layer 2 protocols like MSTP and Link Aggregation. Integration of services and routing/ switching protocols eliminates the need for additional servers or other networking gear in small offices thereby reducing Total Cost of Ownership (TCO). In large networks, where such services are deployed on a dedicated server/ router at the NOC, this provides a backup solution for remote sites when the WAN link to the NOC is temporarily lost. Integrating also provides the added benefit of coordination across these services on failover from primary to standby, assisting a more meaningful behavior, rather than when each fails over independently of the other for the same root cause.1.6 Management, Deployment and TroubleshootingWiNG’s comprehensive end-to-end management capabilities cover deployment through day-to-day management. You get true zero-touch deployment for access points located anywhere in the world, the simplicity of a single window into the entire network, plus the ability to remotely troubleshoot and resolve issues. And since our management technology is manufacturer-agnostic, you can manage your Extreme Networks WLAN infrastructure as well as any legacy equipment from other manufacturers, allowing you to take advantage of our advanced WLAN infrastructure without requiring a costly rip and replace of your existing WLAN.

2 - 1Wireless Controller and Service Platform System Reference Guide2Web UI FeaturesThe WiNG software contains a Web UI allowing network administrators to manage and view Access Point, controller and service platform settings, configuration data and status. This Graphical User Interface (GUI) allows full control of all administration features.Access Points, controllers and service platforms also share a Command Line Interface (CLI) for managing and viewing settings, configuration and status. For more information on the command line interface and a full list of available commands, refer to the Wireless Services CLI Reference Guide available at www.extremenetworks.com/support.For information on how to access and use the Web UI, see:•Accessing the Web UI•Glossary of Icons Used2.1 Accessing the Web UIAccess Points, controllers and service platforms use a UI accessed using any supported Web browser on a client connected to the subnet the Web UI is configured on. 2.1.1 Browser and System RequirementsTo access the GUI, a browser supporting Flash Player 11 is recommended. The system accessing the GUI should have a minimum of 1 GB of RAM for the UI to display and function properly, with the exception of NX service platforms which require 4 GB of RAM. The Web UI is based on Flex, and does not use Java as the underlying UI framework. A resolution of 1280 x 1024 pixels for the GUI is recommended.The following browsers are required to access the WiNG Web UI:• Firefox 3.5 or higher• Internet Explorer 7 or higher• Google Chrome 2.0 or higher• Safari 3 and higher• Opera 9.5 and higher2.1.2 Connecting to the Web UI1 Connect one end of an Ethernet cable to a LAN port on the front of the controller or service platform and connect the other end to a computer with a working Web browser.2 Set the computer to use an IP address between 192.168.0.10 and 192.168.0.250 on the connected port. Set a subnet/network mask of 255.255.255.0.Once the computer has an IP address, point the browser to: https://192.168.0.1/ and the following login screen will display.NOTE: Throughout the Web UI leading and trailing spaces are not allowed in any text fields. In addition, the “?” character is also not supported in text fields.

Web UI FeaturesWireless Controller and Service Platform System Reference Guide 2 -2Figure 2-1 Web UI Login Screen3 Enter the default username admin in the Username field.Enter the default password admin123 in the Password field.4 Click the Login button to load the management interface.5 If this is the first time the UI has been accessed on RFS4011 model controllers, a dialogue displays to begin an initial setup wizard. For more information on using the initial setup wizard on these models see Using the Initial Setup Wizard.2.2 Glossary of Icons UsedThe UI uses a number of icons used to interact with the system, gather information, and obtain status for the entities managed by the system. This chapter is a compendium of the icons used. This chapter is organized as follows:•Global Icons•Dialog Box Icons•Table Icons•Status Icons•Configurable Objects•Configuration Objects•Configuration Operation Icons•Access Type Icons•Administrative Role Icons•Device Icons

Web UI FeaturesWireless Controller and Service Platform System Reference Guide 2 -6Bridging Policy – Indicates a bridging policy configuration has been impacted. A bridging policy defines which VLANs are bridged, and how local VLANs are bridged between the wired and wireless sides of the network.RF Domain – States an RF Domain configuration has been impacted. Firewall Policy – Indicates a firewall policy has been impacted. Firewalls provide a barrier that prevents unauthorized access to resources while allowing authorized access to external and internal resources.IP Firewall Rules – Indicates an IP firewall rule has been applied. An IP based firewall rule implements restrictions based on the IP address in a received packet.MAC Firewall Rules – States a MAC based firewall rule has been applied. A MAC based firewall rule implements network allowance restrictions based on the MAC address in a received data packet.Wireless Client Role – Indicates a wireless client role has been applied to a managed client. The role could be either sensor or client.WIPS Policy – States the conditions of a WIPS policy have been invoked. WIPS prevents unauthorized access to the network by checking for (and removing) rogue Access Points and wireless clients.Device Categorization – Indicates a device categorization policy has been applied. This is used by the intrusion prevention system to categorize Access Points or wireless clients as either sanctioned or unsanctioned devices. This enables devices to bypass the intrusion prevention system.Captive Portals – States a captive portal is being applied. Captive portal is used to provide temporary controller, service platform or Access Point access to requesting wireless clients.DNS Whitelist – A DNS whitelist is used in conjunction with captive portal to provide access to requesting wireless clients.DHCP Server Policy – Indicates a DHCP server policy is being applied. DHCP provides IP addresses to wireless clients. A DHCP server policy configures how DHCP provides IP addresses.RADIUS Group – Indicates the configuration of RADIUS group has been defined and applied. A RADIUS group is a collection of RADIUS users with the same set of permissions.

Web UI FeaturesWireless Controller and Service Platform System Reference Guide 2 - 72.2.6 Configuration ObjectsGlossary of Icons UsedThese configuration icons are used to define the following:RADIUS User Pools – States a RADIUS user pool has been applied. RADIUS user pools are a set of IP addresses that can be assigned to an authenticated RADIUS user.RADIUS Server Policy – Indicates a RADIUS server policy has been applied. A RADIUS server policy is a set of configuration attributes used when a RADIUS server is configured for AAA.Management Policy – Indicates a management policy has been applied. Management policies configure access control, authentication, traps and administrator permissions.BGP – Border Gateway Protocol (BGP) is an inter-ISP routing protocol which establishes routing between ISPs. ISPs use BGP to exchange routing and reachability information between Autonomous Systems (AS) on the Internet. BGP makes routing decisions based on paths, network policies and/or rules configured by network administrators.Configuration – Indicates an item capable of being configured by an interface. View Events / Event History – Defines a list of events. Click this icon to view events or view the event history.Core Snapshots – Indicates a core snapshot has been generated. A core snapshot is a file that records status events when a process fails on a wireless controller or Access Point.Panic Snapshots – Indicates a panic snapshot has been generated. A panic snapshot is a file that records status when a wireless controller or Access Point fails without recovery.UI Debugging – Select this icon/link to view current NETCONF messages.View UI Logs – Select this icon/link to view the different logs generated by the UI, FLEX and the error logs.

Web UI FeaturesWireless Controller and Service Platform System Reference Guide 2 -82.2.7 Configuration Operation IconsGlossary of Icons UsedThe following operations icons are used to define configuration operations:2.2.8 Access Type IconsGlossary of Icons UsedThe following icons display a user access type: Revert – When selected, any unsaved changes are reverted to their last saved configuration settings.Commit – When selected, all changes made to the configuration are written to the system. Once committed, changes cannot be reverted.Commit and Save – When selected, changes are saved to the configuration.Web UI – Defines a Web UI access permission. A user with this permission is permitted to access an associated device’s Web UI.Telnet – Defines a TELNET access permission. A user with this permission is permitted to access an associated device using TELNET.SSH – Indicates a SSH access permission. A user with this permission is permitted to access an associated device using SSH.Console – Indicates a console access permission. A user with this permission is permitted to access an associated device using the device’s serial console.

Web UI FeaturesWireless Controller and Service Platform System Reference Guide 2 - 92.2.9 Administrative Role IconsGlossary of Icons UsedThe following icons identify the different administrative roles allowed on the system: 2.2.10 Device IconsGlossary of Icons UsedThe following icons represent the different device types managed by the system:Superuser – Indicates superuser privileges. A superuser has complete access to all configuration aspects of the connected device.System – States system user privileges. A system user is allowed to configure general settings, such as boot parameters, licenses, auto install, image upgrades etc.Network – Indicates network user privileges. A network user is allowed to configure wired and wireless parameters, such as IP configuration, VLANs, L2/L3 security, WLANs and radios.Security – Indicates security user privileges. A security level user is allowed to configure all security related parameters.Monitor – Defines a monitor role. This role provides no configuration privileges. A user with this role can view the system configuration but cannot modify it.Help Desk – Indicates help desk privileges. A help desk user is allowed to use troubleshooting tools like sniffers, execute service commands, view or retrieve logs and reboot the controller or service platform.Web User – Indicates a web user privilege. A Web user is allowed accessing the device’s Web UI.System – This icon represents the entire WiNG supported system, and all of its member controller, service platform or Access Points that may be interacting at any one time.Cluster – This icon represents a cluster. A cluster is a set of wireless controllers or service platforms working collectively to provide redundancy and load sharing amongst its members.

Web UI FeaturesWireless Controller and Service Platform System Reference Guide 2 -10Service Platform – This icon indicates an NX5500, NX7500, or NX9000 series service platform that’s part of the managed networkWireless Controller – This icon indicates a RFS6000 wireless controller that’s part of the managed network.Wireless Controller – This icon indicates a RFS6000 wireless controller that’s part of the managed network. Access Point – This icon lists any Access Point that’s part of the managed network.Wireless Client – This icon defines any wireless client connection within the network.

3 - 1Wireless Controller and Service Platform System Reference Guide3Quick StartWiNG controllers and service platforms utilize an initial setup wizard to streamline getting on the network for the first time. This wizard configures location, network and WLAN settings and assists in the discovery of Access Points and their connected clients. 3.1 Using the Initial Setup WizardOnce deployed and powered on, complete the following to get the controller or service platform up and running and access more advanced user interface functions:1 Connect one end of an Ethernet cable to a port on the front of the controller or service platform, and connect the other end to a computer with a working Web browser.2 Set the computer to use an IP address between 192.168.0.10 and 192.168.0.250 on the connected port. Set a subnet/network mask of 255.255.255.0.3 Once the computer has an IP address, point the Web browser to: https://192.168.0.1/. The following login screen displays.Figure 3-1 Web UI Login Screen4 Enter the default username admin in the Username field.5 Enter the default password admin123 in the Password field.6 Select the preferred language to display for the graphical user interface (GUI).7 Select the Login button to load the management interface.NOTE: When logging in for the first time, you are prompted to change the password to enhance device security in subsequent logins.NOTE: If you get disconnected when running the wizard, you can connect again and resume the wizard setup.

Quick StartWireless Controller and Service Platform System Reference Guide 3 - 2Figure 3-2 Initial Setup Wizard - IntroductionThe Introduction screen displays first (on the right-hand side of the screen), and lists the various actions that can be performed using the setup wizard.The wizard displays a Navigation Panel on the left-hand side of each screen to assist the administrator in assessing which tasks still require completion before the controller or service-platform can be deployed.

Quick StartWireless Controller and Service Platform System Reference Guide 3 - 3Figure 3-3 Initial Setup Wizard - Navigation PanelA green checkmark to the left of an item in the Navigation Panel defines the task as having its minimum required configuration set correctly. A red X defines a task as still requiring at least one parameter be defined correctly.8Select Save/Commit within each page to save the updates made to that page's configuration. 9Select Next to proceed to the next page listed in the Navigation Panel. 10 Select Back to revert to the previous screen in the Navigation Panel without saving your updates. Selecting Cancel closes the wizard without committing any updates.11 Select Next. The wizard displays the Networking Mode screen to define routing or bridging functionality.NOTE: While you can scroll to any page in the Navigation Panel at any time, you cannot complete the wizard until each task in the Navigation Panel has a green checkmark displayed to the left of the task.

Quick StartWireless Controller and Service Platform System Reference Guide 3 - 4Figure 3-4 Initial Setup Wizard - Networking Mode12 Select one of the following network mode options:•Router Mode - In Router Mode, connected Access Points route traffic between the local network (LAN) and the Internet or external network (WAN). Router mode is recommended in a deployment supported by just a single Access Point. When Router Mode is selected, an additional WAN screen is available in wizard screen flow to configure interface settings for an Access Point’s WAN port.•Bridge Mode - In Bridge Mode, connected Access Points depend on an external router for routing LAN and WAN traffic. Routing is generally used on one device, whereas bridging is typically used in a larger network. Thus, select Bridge Mode when deploying numerous peer Access Points supporting clients on both the 2.4 and 5GHz radio bands. 13 Select Next. The wizard displays the LAN Configuration screen to set the LAN interface configuration.

Quick StartWireless Controller and Service Platform System Reference Guide 3 - 5Figure 3-5 Initial Setup Wizard - LAN Configuration14 Set the following DHCP information for the LAN interface:•Use DHCP - Select Use DHCP to enable an automatic network address configuration using local DHCP server resources.•Static IP Address/Subnet - Enter an IP Address and a subnet for the LAN interface. If Use DHCP is selected, this field is not available. When selecting this option, define the following DHCP Server and Domain Name Server (DNS) resources, as those fields are enabled on the bottom portion of the screen.-Use on-board DHCP server to assign IP addresses to wireless clients - Select this option to enable the DHCP server to provide IP and DNS support to requesting clients on the LAN interface.-Range - Enter a starting and ending IP Address range for client assignments on the LAN interface. Avoid assigning IP addresses from x.x.x.1 - x.x.x.10 and x.x.x.255, as they are often reserved for standard network services. This is a required parameter.-Default Gateway - Define a default an address for use with the default gateway. This is a required parameter.•DNS Forwarding - Select this option to allow a DNS server to translate domain names into IP addresses. If this option is not selected, a primary and secondary DNS resource must be specified. DNS forwarding is useful when a request for a domain name is made but the DNS server, responsible for converting the name into its corresponding IP address, cannot locate the matching IP address. - Primary DNS - Enter an IP Address for the main Domain Name Server providing DNS services for the LAN interface.- Secondary DNS - Enter an IP Address for the backup Domain Name Server providing DNS services for the LAN interface.

Quick StartWireless Controller and Service Platform System Reference Guide 3 - 615 Select Next. If Router was selected as the Access Point mode the wizard displays the WAN Configuration screen. If Bridge was selected, the wizard proceeds to the Wireless LAN Setting screen.Figure 3-6 Initial Setup Wizard - WAN Configuration16 Set the following DHCP and Static IP Address/Subnet information to define how traffic is routed between the local network (LAN) and the Internet or external network (WAN).•Use DHCP - Select Use DHCP to enable an automatic network address configuration using local DHCP server resources.•Static IP Address/Subnet - Enter an IP Address/Subnet and gateway for the WAN interface. These are required fields-Default Gateway -Enter an IP Address for the default gateway on the WAN interface. If Use DHCP is enabled, this field is not configurable.-VLAN ID for the WAN Interface - Set the VLAN ID (virtual interface) to associate with the physical WAN Interface. The default setting is VLAN 2100.-Port for External Network - Select the physical port connected to the WAN interface. The list of available ports varies based on the controller or service platform model.-Enable NAT on the WAN Interface - Select the option to allow traffic to pass between WAN and LAN interfaces. 17 Select Next. The wizard displays the Wireless LAN Setting screen to define up to four WLAN configurations for the controller or service platform.

$Quick StartWireless Controller and Service Platform System Reference Guide 3 - 7Figure 3-7 Initial Setup Wizard - Wireless LAN Settings18 Set the following parameters for up to four WLAN configurations:•SSID - Enter or modify the Services Set Identification (SSID) associated with the WLAN. The WLAN name is auto-generated using the SSID until changed by the administrator. The maximum number of characters is 32. Do not use any of these characters (< > | " & \ ? ,).•WLAN Type - Select a basic authentication and encryption scheme for the WLAN. Available options include:-No Authentication and No Encryption (provides no security at all)-Captive Portal Authentication and No Encryption-PSK authentication, WPA2 encryption-EAP Authentication and WPA2 Encryption19 Select Next. The wizard displays the System Information screen to set device deployment, administrative contact and system time information. The system time can either be set manually or be supplied by a dedicated Network Time Protocol (NTP) resource.$

Quick StartWireless Controller and Service Platform System Reference Guide 3 - 8Figure 3-8 Initial Setup Wizard - System Information20 Refer to the Country and Time Zone field to set the following deployment information:•Password - Enter and confirm a system password used to login into the controller or service platform on subsequent login attempts.Changing the default system password is strongly recommended to secure the proprietary configuration data maintained on the controller or service platform.•Location - Define the location of the controller or service platform deployment.•Contact - Specify the contact information for the administrator. The credentials provided should accurately reflect the individual responding to service queries.•Country - Select the country where the controller or service platform is deployed. The controller or service platform prompts for the correct country code on the first login. A warning message also displays stating an incorrect country setting may result in illegal radio operation. Selecting the correct country is central to legal operation. Each country has its own regulatory restrictions concerning electromagnetic emissions and the maximum RF signal strength that can be transmitted.•Time Zone - Set the time zone where the controller or service platform is deployed. This is a required parameter. The setting should be complimentary with the selected deployment country.Refer to the Select protocols that will be enabled for device access area and enable those controller or service platform interfaces for accessing the controller or service platform. HTTP and Telnet are considered relatively insecure and only should be enabled is necessary. 21 Select Next. The wizard displays the Summary and Commit screen to summarize the screens (pages) and settings updated using the wizard.

Quick StartWireless Controller and Service Platform System Reference Guide 3 - 9Figure 3-9 Initial Setup Wizard - Summary and CommitNo user intervention or additional settings are required within this screen. Its an additional means of validating the Access Point’s updated configuration before it’s deployed. However, if a screen displays settings not intended as part of the initial configuration, the any screen can be selected again from within the Navigation Panel and its settings modified accordingly.22 If the configuration displays as intended, select Save/Commit to implement these settings to the controller or service platform configuration. If additional changes are warranted based on the summary, either select the target page from the Navigational Panel, or use the Back and Next buttons to scroll to the target screen.

4 - 1Wireless Controller and Service Platform System Reference Guide4DashboardThe dashboard enables administrators to review and troubleshoot network device operation. Additionally, the dashboard allows an administrative review of the network’s topology, an assessment of network’s component health and a diagnostic review of device performance.By default, the Dashboard displays the System screen, which is the top level in the device hierarchy. To view information for Access Points, RF Domains or Controllers select the associated item in the tree.For more information, refer to the following:•Summary•System Screen•RF Domain Screen•Controller•Access Point Screen•Network View•Debug Wireless Clients•Debug Captive Portal Clients•Packet Capture4.1 SummaryThe Dashboard displays information organized by device association and inter-connectivity between the connected Access Points and wireless clients. 1 To review dashboard information, select Dashboard.2 Select Summary if it’s not already selected by default.The Dashboard displays the Health tab by default.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 2Figure 4-1 System Dashboard screen - Health tab4.1.1 Device ListingSummaryThe device menu displays information as a hierarchical tree, comprised of system, controller/service platform and Access Point connection relationships.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 3Figure 4-2 Dashboard Menu TreeThe Search option, at the bottom of the screen, enables you to filter (search amongst) RF Domains. The By drop-down menu refines the search. You can further refine a search using the following:•Auto – The search is automatically set to device type.•Name – The search is performed for the device name specified in the Search text box.•WLAN – The search is performed for the WLAN specified in the Search text box.•IP Address – The search is performed for the IP Address specified in the Search text box.•MAC Address – The search is performed for the MAC Address specified in the Search text box.4.2 System ScreenThe System screen displays system-wide network status. The screen is partitioned into the following tabs:•Health – The Health tab displays information about the state of the WiNG device managed system.•Inventory – The Inventory tab displays information on the physical devices managed within the WiNG wireless network.4.2.1 HealthHealthThe Health tab displays device performance status for managed devices, and includes their RF Domain memberships.To assess system health:1Select Dashboard.2Select Summary if it’s not already selected by default.3Select System. The Health tab displays by default.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 4Figure 4-3 System Dashboard screen - Health tabThe Health screen is partitioned into the following fields:•The Devices field displays a ratio of offline versus online devices within the system. The information is displayed in pie chart format to illustrate device support ratios.•The Device Type field displays a numerical representation of the different controller, service platform and Access Point models in the current system. Their online and offline device connections are also displayed. Does this device distribution adequately support the number and types of Access Point radios and their client load requirements.•The Offline Devices field displays a table of supported RF Domains within the system, with each RF Domain listing the number offline devices within that RF Domain. Listed RF Domains display as individual links that can be selected to RF Domain information in greater detail.•The RF Quality Index displays RF quality per RF Domain. It's a measure of the overall effectiveness of the RF environment displayed in percentage. It's a function of the connect rate in both directions, retry rate and error rate.The RF Quality field displays an average quality index supporting each RF Domain. The table lists the bottom five (5) RF quality values for RF Domains. Listed RF Domains display as individual links that can be selected to RF Domain information in greater detail. Use this diagnostic information to determine what measures can be taken to improve radio performance in respect to wireless client load and the radio bands supported.The quality is measured as:•0-20 – Very poor quality

DashboardWireless Controller and Service Platform System Reference Guide 4 - 5•20-40 – Poor quality•40-60 – Average quality• 60-100 – Good qualityThe System Security field displays RF intrusion prevention stats and their associated threat level. The greater the number of unauthorized devices, the greater the associated threat level. The System Security field displays a list of up to five RF Domains in relation to the number of associated wireless clients. The RF Domains appear as links that can be selected to display RF Domain information in greater detail.4.2.2 InventorySystem ScreenThe system screen’s Inventory tab displays granular data on specific devices supported within the network. The screen provides a complete overview of the number and state WiNG managed devices. Information is displayed in easy to read tables and graphs. This screen also provides links for more detailed information. To assess the system inventory:1Select Dashboard.2Select Summary if it’s not already selected by default.3Select System.4 Select the Inventory tab.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 6Figure 4-4 System screen - Inventory tabThe information within the Inventory tab is partitioned into the following fields:•The Devices field displays a ratio of peer controllers and service platforms as well as their managed Access Point radios. The information is displayed in pie chart format. The Device Type field displays a numerical representation of the different controller models and connected Access Points in the current system.•The Radios field displays top performing radios, their RF Domain memberships and a status time stamp. RF Domain information can be selected to review RF Domain membership information in greater detail. Information in the Radio area is presented in two tables. The first lists the total number of Radios managed by this system, the second lists the top five RF Domains in terms of the number of available radios.•The wireless Clients field lists the top five RF Domains with the highest total number of clients managed by connected devices in this system. RF Domain information can be selected to review RF Domain membership information in greater detail. Select Refresh to update the screen to its latest values.4.3 RF Domain ScreenRF Domains allow administrators to assign configuration data to multiple devices deployed in a common coverage area, such as in a floor, building or site. Each RF Domain contains policies that can determine a Smart RF or WIPS configuration.RF Domains enable administrators to override WLAN SSID name and VLAN assignments. This enables the deployment of a global WLAN across multiple sites and unique SSID name or VLAN assignments to

DashboardWireless Controller and Service Platform System Reference Guide 4 - 7groups of Access Points servicing the global WLAN. This WLAN override technique eliminates the requirement for defining and managing a large number of individual WLANs and profiles.A configuration contains (at a minimum) one default RF Domain and can optionally use additional user defined RF Domains:• Default RF Domain - Automatically assigned to each controller or service platform and associated Access Point by default.• User Defined RF Domains - Created by administrators and manually assigned to individual controller or service platforms, but can be automatically assigned to Access Points using adoption policies.Each controller and service platform is assigned to only one RF Domain at a time. However, a user defined RF Domain can be assigned to multiple controllers or service platforms as required. User defined RF Domains can be manually assigned or automatically assigned to Access Points using an AP provisioning policy.The RF Domain screen displays system-wide network status. The screen is partitioned into the following tabs:•RF Domain Health – The Health tab displays information about the state of the RF Domain and network performance as tallied from its collective device members.•RF Domain Inventory – The Inventory tab displays information on the physical devices comprising the RF Domain. 4.3.1 RF Domain HealthThe Health tab displays the status of the RF Domain’s device membership. To assess the RF Domain health:1Select Dashboard.2Select Summary if it’s not already selected by default.3Expand the System node to display RF Domains.4Select a RF Domain. The Health tab displays by default.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 8Figure 4-5 RF Domain screen - Health tabRefer to the following RF Domain health information for member devices:•The Domain field lists the RF Domain manager reporting utilization statistics. The MAC address displays as a link that can be selected to display RF Domain information in at more granular level. A RF Domain manager can retain and store new firmware images for RF Domain member Access Points.•The Devices field displays the total number of devices and the status of the devices in the network as a graph. This area displays the total device count managed by this device and their status (online vs. offline) as a pie graph.•The Radio Quality table displays a table of RF quality on a per radio basis. It is a measure of the overall effectiveness of the RF environment displayed in percentage. It is a function of the transmit retry rate in both directions and the error rate. This area of the screen displays the average quality index across all the defined RF Domain on the wireless controller. The table lists worst five of the RF quality values of all the radios defined on the wireless controller. The quality is measured as:-0-20 - Very poor quality- 20-40 - Poor quality-40-60 - Average quality- 60-100 - Good quality5Select a Radio Id to view all the statistics for the selected radio in detail.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 9• The Client Quality table displays RF quality for the worst five performing clients.It is a function of the transmit retry rate in both directions and the error rate. This area of the screen displays the average quality index across all the defined RF Domain on the wireless controller. The quality is measured as:•0-20 - Very poor quality• 20-40 - Poor quality•40-60 - Average quality• 60-100 - Good quality6 Select a client to view its statistics in greater detail.•WLAN Utilization displays how efficiently the WLANs are used. Traffic utilization is defined as the percentage of current throughput relative to the maximum possible throughput for the WLAN. The total number of WLANs is displayed above the table. The table displays a list of the top five WLANs in terms of overall traffic utilization. It displays the utilization level names, WLAN name and SSIDs for each of the top five WLANs.•Radio Traffic Utilization displays how efficiently the RF medium is used. Traffic utilization is defined as the percentage of current throughput relative to the maximum possible throughput for the RF Domain. The Traffic Index area displays an overall quality level for radio traffic and the Max User Rate displays the maximum data rate of associated radios. The table displays a list of the top five radios in terms of overall traffic utilization quality. It displays the radio names, MAC Addresses and radio types for each of the top five radios.•Client Traffic Utilization displays how efficiently the RF medium is utilized for connected clients. Traffic utilization is defined as the percentage of current throughput relative to the maximum possible throughput for the clients in the RF Domain. The table displays a list of the top five performing clients in respect to overall traffic utilization. It displays the client names, MAC Addresses and vendor for each of the top five clients.•Wireless Security displays the overall threat index for the system. This index is based on the number of Rogue/Unsanctioned APs and Wireless Intrusion Protection System (WIPS) events detected. The index is in the range 0 - 5 where 0 indicates there are no detected threats. An index of 5 indicates a large number of intrusion detection events or rogue/unsanctioned APs detected.•Traffic Statistics include transmit and receive values for Total Bytes, Total Packets, User Data Rate, Broadcast/Multicast Packets, Management Packets, Tx Dropped Packets and Rx Errors.4.3.2 RF Domain InventoryRefer to the following RF Domain inventory data collected by member controllers, service platforms or Access Points:To review the RF Domain inventory:1Select Dashboard.2Select Summary if it’s not already selected by default.3Expand the System node to display RF Domains.4Select a RF Domain. 5 Select the Inventory tab.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 10Figure 4-6 RF Domain screen - Inventory tab•The Inventory tab displays information on the devices managed by RF Domain member devices in the controller, service platform or Access Point managed network. The Inventory screen enables an administrator to overview of the number and state of the devices in the selected RF Domain. Information is displayed in easy to read tables and graphs. •The Device Types table displays the devices types populating the RF Domain. The Device Type area displays an exploded pie chart that displays the type of device and their numbers in the RF Domain.•The Radios by Band table displays a bar graph of RF Domain member device radios classified by their radio band or sensor dedication. Review this information to assess whether RF Domain member radios adequately support client device traffic requirements.•The Radios by Channel table displays pie charts of the different channels utilized by RF Domain member radios. These dedicated channels should be as segregated as possible from one another to avoid interference. If too many radios are utilizing a single channel, consider off-loading radios to non utilized channels to improve RF Domain performance.•The Top 5 Radios by Clients table displays a list of radios with the highest number of clients. This list displays the radio IDs as links that can be selected to display individual radio information in greater detail.•The WLANs table displays a list of WLANs utilized by RF Domain member devices. The table is ordered by WLAN member device radio count and their number of connected clients. Use this information to assess whether the WLAN is overly populated by radios and clients contributing to congestion.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 11•The Clients by Band table displays the radio band utilization of connected RF Domain member clients. Assess whether the client band utilization adequately supports the intended radio deployment objectives of the connected RF Domain member Access Point radios.•The Clients of Channel table displays a bar-graph of wireless clients classified by their frequency. Information for each channel is further classified by their 802.11x band. In the 5GHz channel, information is displayed classified under 802.11a and 802.11an bands. In the 2.4 GHz channel, information is displayed classified under 802.11b, 802.11bg, and 802.11bgn band.4.4 ControllerThe Wireless Controller screen displays system collected network status for controllers and service platforms. The screen is partitioned into two tabs:•Controller Health – The Health tab displays information about the state of the controller or service platform managed wireless network.•Controller Inventory – The Inventory tab displays information on the physical devices managed by the controller or service platform.4.4.1 Controller HealthTo assess the controller or service platform’s network health:1Select Dashboard.2Select Summary if it’s not already selected by default.3Expand the System node to display RF Domains.4 Select and expand a RF Domain to expose its member controllers or service platforms.5 Select a controller or service platform. The Health tab display by default.NOTE: A T5 controller can also be selected from the dashboard’s controller level to display a set of unique T5 dashboard screens. A T5 controller uses a different operating system to manage its connected radio devices, as opposed to the WiNG operating used by RFS controllers and NX service platforms. However, a T5 controller, once enabled as a supported external device, can provide data to WiNG to assist in a T5’s management within a WiNG supported subnet populated by both types of devices. For information on enabling controller adoption of external devices (for T5 support specifically) refer to, Adoption Overrides (Controllers Only) on page 5-48.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 12Figure 4-7 Wireless Controller screen - Health tabRefer to the Device Details table for information about the selected controller or service platform The following information is displayed:•Hostname - Lists the administrator assigned name of the controller or service platform.•Device MAC - Lists the factory encoded MAC address of the controller or service platform.•Type - Indicates the type of controller or service platform. An icon representing the RFS controller or NX service platform device type is displayed along with the model number.•RF Domain Name - Lists the RF Domain to which the controller or service platform belongs. The RF Domain displays as a link that’s selectable to display RF Domain data in greater detail.•Model Number - Lists the model number and hardware SKU information of the selected controller or service platform to refine its intended deployment region.•Version - Lists the firmware version currently running on the controller or service platform. Compare this version against the version currently on the support site to ensure the controller or service platform has the latest feature set available.•Uptime - Displays the duration the controller or service platform has been running since it was last restarted.•CPU - Displays the CPU installed on this controller or service platform.•RAM - Displays the amount of RAM available for use in this system.•System Clock - Displays the current time set on the controller or service platform.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 13The Adopted Devices Health (w/ cluster members) displays a graph of Access Points in the system with the available Access Points in green and unavailable Access Points in red.The Radio RF Quality Index provides a table of RF quality on a per radio basis. It is a measure of the overall effectiveness of the RF environment displayed in percentage. It is a function of the connect rate in both directions, the retry rate and the error rate. The screen displays the average quality index within the Access Point single radio. The table lists bottom five (5) of the RF quality values by Access Point radio. The quality is measured as:•0-20 - Very poor quality•20-40 - Poor quality•40-60 - Average quality• 60-100 - Good quality6 Select a radio Id to view statistics in greater detail.The Radio Utilization table displays how efficiently the RF medium is used. Radio utilization is defined as the percentage of current throughput relative to the maximum possible throughput for the radio. The Radio Utilization table displays the Access Point radios in terms of the number of associated wireless clients and the percentage of utilization. It also displays a table of packets types transmitted and received.The Client RF Quality Index displays a table of RF quality on a per client basis. It is a measure of the overall effectiveness of the RF environment displayed in percentage. It is a function of the connect rate in both directions, the retry rate and the error rate. This area of the screen displays the average quality index for a client. The table lists bottom five (5) of the RF quality values by a client. Quality is measured as:•0-20 - Very poor quality•20-40 - Poor quality•40-60 - Average quality• 60-100 - Good quality7 Select a client MAC to view all the statistics for the selected client in greater detail.4.4.2 Controller InventoryThe Inventory tab displays information for the devices managed by the system. This screen enables a system administrator to have a complete overview of the number and state of managed devices. Information is displayed in easy to read tables and graphs. The Inventory screen also provides links for the system administrator to get more detailed information.To assess the controller or service platform inventory:1Select Dashboard.2Select Summary if it’s not already selected by default.3Expand the System node to display RF Domains.4 Select and expand a RF Domain to expose its member controllers or service platforms.5 Select a controller or service platform.6 Select the Inventory tab.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 14Figure 4-8 Wireless Controller screen - Inventory tabThe Inventory tab displays information on the devices managed by the controller or service platform. The Inventory screen enables an administrator to overview of the number and state of controller or service platform managed devices and their utilization. Refer to the following Inventory data:•The Device Types field displays a ratio of devices managed by this controller or service platform in pie chart format. The Device Type area displays an exploded pie chart that displays the type of device and their numbers in the current system.•The Radios Type field displays the total number of radios managed by this controller or service platform. The graph lists the number of radios in both the 2.4 GHz and 5 GHz radio bands.•The Wireless Clients table lists clients managed by this controller or service platform by connected client count. Information is presented in two (2) tables and a graph. The first table lists the total number of clients managed by the listed controller or service platform. The second lists the top five (5) radios in terms of the number of connected clients. The graph just below the table lists the number of clients by radio type.•The WLAN Utilization table displays utilization statistics for controller or service platform WLAN configurations. Information displays in two tables. The first table lists the total number of WLANs managed by this system. The second table lists the top five (5) WLANs in terms of the usage percentage along with the name and network identifying SSID.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 154.4.3 T5 Controller Dashboard A T5 controller can be selected from the dashboard’s controller level to display a set of unique T5 dashboard screens. A T5 controller uses a different operating system to manage its connected radio devices, as opposed to the WiNG operating used by RFS controllers and NX service platforms. However, a T5 controller, once enabled as a supported external device, can provide data to WiNG to assist in a T5’s management within a WiNG supported subnet populated by both types of devices.To review a T5’s controller dashboard:1Select Dashboard.2Select Summary if it’s not already selected by default.3Expand the System node to display RF Domains.4 Select and expand a RF Domain to expose its member controllers or service platforms.5 Select a T5 controller from amongst the devices listed at the dashboard’s controller level. T5 devices will not appear at any other level in the dashboard’s device tree.Figure 4-9 T5 Dashboard tab6 Refer to the following T5 specific dashboard stats to assess whether a CPE’s DLS connection is problematic and has excessive device rests (rendering the T5 device temporarily offline).

DashboardWireless Controller and Service Platform System Reference Guide 4 - 16The Customer Premises Equipment (CPEs) are the T5 managed radio devices. These CPEs use Digital Subscriber Line (DSL) as their high speed Internet access mechanism using the CPE’s physical wallplate connection and phone jack.7 Select a T5 device from amongst the devices listed in the dashboard’s controller level, and right click the arrow to the right to list an additional menu of diagnostic activities that can be administrated for the selected T5 device.Figure 4-10 T5 Dashboard Menu PathUse these additional T5 configuration items to optionally upgrade T5 managed device firmware, reload configurations, upgrade the T5 CPE and manage T5 managed device LED status.8Select Firmware Upgrade to conduct firmware updates for T5 managed devices.DSL Average Response TimeLists each CPE’s DSL name and its average response time in microseconds. Use this data to assess whether a specific DSL is experiencing response latency negatively impacting performance.DSL Downstream Coding ViolationsDisplays each listed DSL’s number of coding violations as a measure of erroneous data degrading the DSL’s performance within the T5’s network coverage area.DSL Utilization Lists each CPE’s DSL name and its transmit utilization by percentage of overall load.DSL Downstream Severely Eroded SecondsDisplays each listed DSL’s eroded seconds, as a negative measure of delivery latency degrading the DSL’s performance within the T5’s network coverage area.DSL Status Lists the name of the DSL utilized on T5 managed CPE devices, and their downstream (transmit) data rate (in Mbps) and downstream throughput margin (in dB).CPE Reset The a selected CPE’s number of resets. A reset renders the CPE offline until completed, and consequently should be carefully tracked to ensure consistent online availability amongst CPEs in the same radio coverage area.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 22When adopted to a managing controller or service platform, an EX3500 switch can display a unique dashboard helpful to administrators to better assess the interoperability of the selected EX3500 with its connected controller or service platform.To review an EX3500 switch dashboard:1Select Dashboard.2Select Summary if it’s not already selected by default.3Expand the System node to display RF Domains.4 Select and expand a RF Domain to expose its member controllers or service platforms.5 Select an EX3500 switch from amongst the devices listed. Figure 4-17 EX3500 DashboardNOTE: To enable the adoption of an EX3500 switch, the Allow Adoption of External Devices option must be enabled. For more information, refer to Adoption Overrides (Controllers Only) on page 5-48.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 236 Refer to the following System information to assess dashboard information for the selected EX3500 switch.7 Refer to the Upgrade field to assess the EX3500’s current firmware and upgrade configuration status.System Name Displays the administrator assigned system name of the selected EX3500 switch.System Object ID Lists the numeric ID used to determine the monitoring capabilities of the EX3500 switch. System Contact Lists the EX3500 switch administrative contact assigned to respond to events created by, or impacting, this selected EX3500 switch and the RF Domain devices it helps support.System Description Displays the administrator defined system description provided by the administrator upon initial deployment of this particular EX3500 switch.System Location Lists a 255 character maximum EX3500 switch location reflecting the switch’s physical deployment location.System Up Time Displays the cumulative time since this EX3500 was last rebooted or lost power.MAC Address (Unit 1)Lists the factory encoded MAC address of the selected EX3500 as its hardware identifier.Web Server Port Displays the Web server port the EX3500 is using. Port 80 is the default port the Web server expects to listen to. Web Server Lists whether the Web server facility is enabled/disabled between this selected EX3500 switch and its connected controller or service platform. A Web server is a program using a client/server model and the Hypertext Transfer Protocol (HTTP) to serve files forming Web pages to Web resource requesting clients.Web Secure Server PortLists the numeric virtual server port providing secure Web resources with the selected EX3500. Any system with multiple open ports, multiple services and multiple scripting languages is vulnerable simply because it has so many points of entry to watch. The secure open port has been specifically designated and utilizes the latest security patches and updates.Web Secure Server Lists whether the secure Web server functionality has been enabled or disabled for the selected EX3500’s management session with the WiNG controller or service platform.Jumbo Frame Lists whether support for jumbo Ethernet frames with more than 1500 bytes of payload has been enabled or disabled. Jumbo frames support up to 9000 bytes, but variations must be accounted for. Many Gigabit Ethernet switches and Gigabit Ethernet network interface cards support jumbo frames. Some Fast Ethernet switches and Fast Ethernet network interface cards also support jumbo frames.Telnet Server Port Lists the numeric Telnet server port used with the selected EX3500’s session with the WiNG controller or service platform to test for open ports. The listed port is the port number where the server is listening.Telnet Server Displays whether Telnet functionality is currently enabled or disabled for the selected EX3500 switch. Filename Lists the target firmware file queued for subsequent uploads to the selected EX3500 switch.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 24Periodically select Refresh to update the statistics counters to their latest values.4.5 Access Point ScreenThe Access Point screen displays system-wide network status for standalone or controller connected Access Points. The screen is partitioned into the following tabs:•Access Point Health – The Health tab displays information about the state of the Access Point managed network.•Access Point Inventory – The Inventory tab displays information on the physical devices managed within the Access Point managed network.4.5.1 Access Point HealthTo assess Access Point network health:1Select Dashboard.2Select Summary if it’s not already selected by default.3Expand the System node to display RF Domains.4 Select and expand a RF Domain to expose its member controllers or service platforms.5 Select a controller or service platform and expand the menu item to display connected Access Points.6 Select an Access Point. The Health tab display by default.Path Lists the complete relative path to the EX3500 switch firmware file defined for subsequent upgrades.Status‘ Lists whether a device firmware upgrade is currently enabled and queued for the selected EX3500 or is currently disabled.Reload Status Displays the selected EX3500’s current firmware reload status.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 25Figure 4-18 Access Point screen - Health tabThe Device Detail field displays the following information about the selected Access Point:•Hostname - Lists the administrator assigned name of the selected Access Point.•Device MAC - Lists the factory encoded MAC address of the selected Access Point.•Primary IP Address - Lists the IP address assigned to the Access Point as a network identifier.•Type - Indicates the Access Point model type. An icon representing the Access Point is displayed along with the model number.•RF Domain Name - Lists the RF Domain to which the Access Point belongs. The RF Domain displays as a link that can be selected to display Access Point RF Domain membership data in greater detail.•Model Number - Lists the specific model number of the Access Point.•Version - Lists the version of the firmware running on the Access Point. Compare this version against the version currently on the support site to ensure the Access Point has the latest feature set available.•Uptime - Displays the duration the Access Point has been running from the time it was last restarted.•CPU - Displays the CPU installed on this Access Point.•RAM - Displays the amount of RAM available for use in this system.•System Clock - Displays the current time on the Access Point.•The Radio RF Quality Index displays a table of RF quality per radio. It is a measure of the overall effectiveness of the RF environment displayed in percentage. It is a function of the connect rate in both directions, the retry rate and error rate. The quality is measured as:

DashboardWireless Controller and Service Platform System Reference Guide 4 - 26-0-20 - Very poor quality-20-40 - Poor quality-40-60 - Average quality- 60-100 - Good quality•The Radio Utilization Index area displays how efficiently the RF medium is used. Radio utilization is defined as the percentage of current throughput relative to the maximum possible throughput for the radio. The Radio Utilization displays radios in terms of the number of associated wireless clients and percentage of utilization. It also lists packets types transmitted and received.•The Client RF Quality Index displays a table of RF quality on a per client basis. It is a measure of the overall effectiveness of the RF environment displayed in percentage. It is a function of the connect rate in both directions, the retry rate and the error rate. This area of the screen displays the average quality index for a client. The table lists bottom five (5) of the RF quality values by client. The quality is measured as:-0-20 - Very poor quality-20-40 - Poor quality-40-60 - Average quality- 60-100 - Good quality4.5.2 Access Point InventoryThe Access Point Inventory tab displays granular data on devices managed by the selected Access Point. Information is displayed in easy to read tables and graphs. To assess Access Point network health:1Select Dashboard.2Select Summary if it’s not already selected by default.3Expand the System node to display RF Domains.4 Select and expand a RF Domain to expose its member controllers or service platforms.5 Select a controller or service platform and expand the menu item to display connected Access Points.6Select an Access Point. 7 Select the Inventory tab.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 27Figure 4-19 Access Point screen - Inventory tabThe information within the Inventory tab is partitioned into the following fields:•The Radios Type field displays the total number of radios utilized by this Access Point. The graph lists the number of radios in the 2.4 GHz and 5 GHz radio bands and funtioning as a sensor.•The WLAN Utilization table displays utilization statistics for controller or service platform WLAN configurations. Information displays in two tables. The first table lists the total number of WLANs managed by this system. The second table lists the top five (5) WLANs in terms of the usage percentage along with their name and network identifying SSID. •The Wireless Clients table lists clients managed by this Access Point by connected client count. Information is presented in two (2) tables and a graph. The first table lists the total number of clients managed by the listed Access Point. The second lists the top five (5) radios in terms of the number of connected clients. The graph just below the table lists the number of clients by radio type.4.6 Network ViewThe Network View functionality displays device association connectivity amongst controllers, service platforms, Access Point radios and wireless clients. This association is represented by a number of different graphs.To review the wireless controller’s Network Topology, select Dashboard > Network View.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 28Figure 4-20 Network View Topology• The screen displays icons for the different views available to the system. Apart from device specific icons, the following three icons are available:•default – Displays information about the default RF Domain.•system – Displays information about the current system.•cluster – Displays information about clusters managed by this system.Use the icons to navigate quickly within top level groupings.The middle field displays a Network View, or graphical representation of the network. Nodes display whether or not they are members of a cluster or mesh domain. Use this information to assess whether the topology of the network has changed in such a manner that devices need to be added or moved. This field changes to display a graphical network map.Use the Lock / Unlock icon in the upper right of the screen to prevent users from moving APs around within the specified area.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 294.7 Debug Wireless ClientsAn administrator has the ability to select a RF Domain and capture connected client debug messages at an administrator assigned interval and location. Client debug information can either be collected historically or in real-time.To troubleshoot issues with wireless client connectivity within a controller, service platform or Access Point managed RF Domain: 1Select Dashboard.2Expand the System node to display controller, service platform or Access Point managed RF Domains.3 Select and expand a RF Domain and click on the down arrow to the right of the RF Domain’s name4Select Troubleshooting.5Select Debug Wireless Clients.Figure 4-21 Debug Wireless Clients screen 6 Refer to the following remote debug information for RF Domain member connected wireless clients:RF Domain Displays the administrator assigned name of the selected RF Domain used for wireless client debugging. RF Domains allow administrators to assign configuration data to multiple devices deployed in a common coverage area, such as in a floor, building or site.Send Data To Use the Send Data To drop-down menu to select where wireless client debug messages are collected. If Screen is selected the wireless client debug information is sent to the Live Wireless Debug Events window at the bottom of the dialog window. If File is selected, the file location must be specified in the File Location section of the window.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 30When all configuration fields are complete, select Start to start the wireless client debug capture. If information is being sent to the screen it displays in the Live Wireless Debug Events section. If the data is being sent to a file, Select Debug MessagesSelect All Debug Messages, to display all wireless client debug information for the selected wireless clients on the current RF Domain. Choose Selected Debug Messages to specify which types of wireless client debug messages to display. If the Selected Debug Messages radio button is selected, you can display information for any combination of the following:- 802.11 Management- EAP- Flow Migration- RADIUS- System Internal- WPA/WPA2Wireless Clients Select All Wireless Clients to display debug information for all wireless clients currently associated to the current RF Domain. Choose Selected Wireless Clients to display information only for specific wireless clients (between 1 and 3). If the Selected Wireless Clients radio button is selected enter the MAC address for up to three wireless clients. The information displayed or logged to the file will only be from the specified wireless clients.Duration of Message CaptureUse the spinner controls to select how long to capture wireless client debug information. This can range between 1 second and 24 hours, with the default value being 1 minute.Maximum Events Per Wireless ClientUse the spinner controls to select the maximum number of debug messages displayed per wireless client. Set the number of messages from 1 - 9999 events with the default value being 100 events.File Location When the Send Data To field is set to File, the File Location configuration displays below the configuration section. If Basic is selected, enter the URL in the following format:URL Syntax:tftp://<hostname|IP>[:port]/path/fileftp://<user>:<passwd>@<hostname|IP>[:port]/path/file IPv6 URL Syntax:tftp://<hostname|[IPv6]>[:port]/path/fileftp://<user>:<passwd>@<hostname|[IPv6]>[:port]/path/fileIf Advanced is selected, configure the Target, Port, Host/IP, User, Password and optionally the path for the wireless client debug log file you wish to create.Live Wireless Debug EventsWhen the Send Data To field is set to Screen, this area displays live debug information for connected wireless clients in the selected RF Domain.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 31that file populates with remote debug information. If you have set a long message capture duration and wish to end the capture early, select Stop.4.8 Debug Captive Portal ClientsAn administrator can select a RF Domain and capture captive portal client and authentication debug messages at an administrator assigned interval and location. Captive portal debug information can either be collected historically or in real-time.To troubleshoot captive portal client debug messages: 1Select Dashboard.2Expand the System node to display controller, service platform or Access Point managed RF Domains.3 Select and expand a RF Domain and click on the down arrow to the right of the RF Domain’s name4Select Troubleshooting.5Select Captive Portal Clients.Figure 4-22 Debug Wireless Clients screen 6Use the Send Data To drop-down menu to select where captive portal debug messages are collected. If Screen is selected, information is sent to the Live Wireless Debug Events window at the bottom of the screen. If File is selected, the file location must be specified in the File Location field.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 327Select Debug Message settings to refine how captive portal client debug messages are trended:8Set Captive Portal Clients filter options to refine which clients are included in the debug messages.9 Define the following captive portal client Settings to determine how messages are trended:10 When all configuration fields are complete, select Start to start the captive portal client debug message capture. Information sent to the screen displays in the Live Captive Portal Debug Events field. If you have set a long message capture duration and wish to end the capture early, select Stop.4.9 Packet CaptureAn administrator can capture connected client packet data based on the packet’s address type or port on which received. Dropped client packets can also be trended to assess RF Domain client connectivity health.To administrate RF Domain packet captures:1Select Dashboard.2Expand the System node to display controller, service platform or Access Point managed RF Domains.3 Select and expand a RF Domain and click on the down arrow to the right of the RF Domain’s name4Select Troubleshooting.5Select Packet Capture.All Debug Messages Select this option to capture all captive portal client and captive portal authentication request events collectively without filtering by type. Select Debug MessagesChoose Selected Debug Messages to specify the type of captive portal event messages to display. Options include captive portal client events and events specific to captive portal authentication requests.All Captive Portal ClientsSelect All Captive Portal Clients to display debug information for each client utilizing a captive portal for network access within the selected RF Domain.Select Captive Portal Clients (up to 3)Optionally display captive portal debug messages for specific clients (1 - 3). Enter the MAC address for up to three wireless clients. The information displayed or logged to the file is only from the specified wireless clients. Change the client MAC addresses as needed when clients are no longer utilizing the RF Domain’s captive portal resources.Duration of Message CaptureUse the spinner controls to set the message capture interval for captive portal debug information. This can range between 1 second and 24 hours.Maximum Events Per Captive Portal ClientUse the spinner controls to select the maximum number of captive portal event messages displayed per RF Domain member client. Set the number of messages from 1 - 9999 events with the default value being 100 events.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 33Figure 4-23 Packet Capture screen 6 Refer to the following packet capture data for RF Domain member connected wireless clients:RF Domain Displays the administrator assigned name of the selected RF Domain used for wireless client packet captures. RF Domains allow administrators to assign configuration data to multiple devices deployed in a common coverage area, such as in a floor, building or site.Send Data To Use the Send Data To drop-down menu to select where wireless client packet capture messages are collected. If Screen is selected client packet capture data is sent to the Live Wireless Debug Events window at the bottom of the dialog window. If File is selected, the file location must be specified in the File Location section of the window.Dropped Select Dropped to create an event entry each time a packet is dropped from a client connected to a RF Domain member device. Use this information to assess whether a particular RF Domain is experiencing high levels of dropped packets that may require administration to distribute client connections more evenly.Interface Select Interface to specify packet capture on a specific interface on the current RF Domain. If Interface is selected, specify the interface name and number and specify a Packet DirectionOn a Radio (802.11) Select On a Radio (802.11) to capture packets only on 802.11 radios. If selecting this option, specify which radios should be used and specify a Packet Direction.

DashboardWireless Controller and Service Platform System Reference Guide 4 - 347Select Start to begin the packet capture. Information sent to the screen displays in the lower portion of the window. If the data is being sent to a file, that file populates with the packet capture information. If you have set a long message capture duration and wish to end the capture early, select Stop.Filter (MAC, IP, Protocol, Port)Filter packet captures based on specific criteria. Select one or more of the following and specify the relevant information:- Filter by MAC- Filter By IP- IP Protocol- PortMaximum Packet Count Set the Maximum Packet Count to limit the number of packets captured for trending. Set this value between 1 - 10000 packets, with a default value of 200.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 75.2.1 License ConfigurationBasic Device ConfigurationLicenses are purchased directly for the number of permissible adoptions per controller, service platform or managed cluster.Managing infrastructure devices requires a license key to enable software functionality or define the number of adoptable devices permitted. My Licenses is a Web based online application enabling you to request a license key for license certificates for products.The Licenses screen also contains a facility where new licenses can be applied to increase the number of device adoptions permitted, or to allow the use of the advanced security features.Each controller and service platform family has multiple models to choose from that range from zero licenses to the maximum number that can be loaded for that specific SKU. To configure a device’s a license configuration:1 Select the Configuration tab from the Web UI.2Select Devices from the Configuration tab.The Device Configuration screen displays a list of managed devices or peer controllers, service platforms or Access Points.3 Select a target device (by double-clicking it) from amongst those displayed within the Device Configuration screen. Devices can also be selected directly from the Device Browser in the lower, left-hand, side of the UI.4Select Licenses from the Device menu options.NOTE: The Licenses screen is only available to wireless controllers capable of sustaining device connections, and thus requires license support to set the maximum number of allowed device connections. The License screen is not available for Access Points.NOTE: For detailed instructions on using My Licenses to add hardware or software licenses and register certificates, refer to the My Licenses Users Guide, available at www.extremenetworks.com/support.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 8Figure 5-4 Device Licenses screenThe License screen displays the Device Serial Number of the controller or service platform generating the license key.NOTE: When assessing lent and borrowed license information, its important to distinguish between site controllers and NOC controllers. NOC controllers are NX9000, NX9500, NX9510, NX7500 and RFS6000.Site controllers are NX5500, NX7500, RFS4000 and RFS6000.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 95Review the AP Licenses table to assess the specific number of adoptions permitted, as dictated by the terms of the current license. The Native tab displays by default. Select the Guest tab to display guest licenses.AP Adoptions The Device column Lists the total number of AP adoptions made by the controller or service platform. If the installed license count is 10 APs and the number of AP adoptions is 5, 5 additional APs can still be adopted under the terms of the license. The total number of APs adoptions varies by platform, as well as the terms of the license. The Cluster column lists the total number of AP adoptions made by the cluster membership (all members). If the installed license count is 100 APs and the number of AP adoptions is 50, 50 additional APs can still be adopted under the terms of the AP licenses, pooled by the cluster members. AP Licenses The Device column lists the number of APs available for adoption under the restrictions of the license. This number applies to dependent mode adaptive APs only, and not independent mode APs. The Cluster column lists the number of APs available for adoption by cluster members under the restrictions of the licenses, as pooled amongst the cluster members. AP Lent Licenses Lent licenses are the total number of AP licenses the NOC controller lends (if needed) to its site controllers so site controllers can adopt APs in excess of its own installed AP license count. AP lent licenses can be non-zero only in controllers currently configured as the NOC (NOC controller). Lent Licenses is always zero in controllers configured as the site (site controller).AP Borrowed LicensesBorrowed licenses are the total number of AP licenses borrowed by the site controller from the NOC controller (NOC controllers if a NOC controller is in a cluster). AP borrowed licenses are always zero in the NOC controller. AAP borrowed licenses can be non-zero only on site controllers.AP Total Licenses Lists the cumulative number of both Device and Cluster AP licenses supported by the listed controller or service platform.NOTE: The following is a licensing example: Assume there are two site controllers (S1 and S2) adopted to a NOC controller (N1). S1 has 3 installed AP licenses, and S2 has 4 installed AP licenses. Eight APs seek to adopt on S1, and ten APs seek to adopt on S2. N1 has 1024 installed licenses. N1 lends 5 (8-3) AP licenses to S1, and 6 (10-4) AP licenses to S2. N1 displays the following in the Device column: AP Adoptions: 2 (site controllers S1 and S2) AP Licenses: 1024 AP Lent Licenses: 11 (5 to S1 + 6 to S2) AP Borrowed Licenses: 0 AP Total Licenses: 1013 (1024 – 11 lent) S1 displays the following in the Device column: AP Adoptions: 8 AP Licenses: 3 AP Lent Licenses: 0 AP Borrowed Licenses: 5 AP Total Licenses: 8 (3 + 5 borrowed). S2 displays the following in the Device column: AP Adoptions: 10 AP Licenses: 4 AP Lent Licenses: 0 AP Borrowed Licenses: 6 AP Total Licenses: 10 (4 + 6 borrowed).

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 106Review the AAP Licenses table to assess the specific number of adoptions permitted, as dictated by the terms of the current license.7 Refer to the Feature Licenses field to apply licenses and provision advanced security and analytics features:8 Refer to the Web Filtering License field if required to provide a 256 character maximum license string for the Web filtering feature. Web filtering is used to restrict access to specific resources on the Internet.9Select OK to save the changes made to the applied licenses. Selecting Reset reverts the screen to its last saved configuration.5.2.2 Assigning CertificatesBasic Device ConfigurationA certificate links identity information with a public key enclosed in the certificate. A certificate authority (CA) is a network authority that issues and manages security credentials and public keys for message encryption. The CA signs all digital certificates it issues with its own private key. The corresponding public key is contained within the AAP Adoptions The Device column Lists the total number of AAP adoptions made by the controller or service platform. If the installed license count is 10 APs and the number of AAP adoptions is 5, 5 additional AAPs can still be adopted under the terms of the license. The total number of AAPs adoptions varies by platform, as well as the terms of the license. The Cluster column lists the total number of AAP adoptions made by the cluster membership (all members). If the installed license count is 100 APs and the number of AAP adoptions is 50, 50 additional AAPs can still be adopted under the terms of the AAP licenses, pooled by the cluster members. AAP Licenses The Device column lists the number of AAPs available for adoption under the restrictions of the license. This number applies to dependent mode adaptive AAPs only, and not independent mode AAPs. The Cluster column lists the number of AAPs available for adoption by cluster members under the restrictions of the licenses, as pooled amongst the cluster members. AAP Lent Licenses Lent licenses are the total number of AAP licenses the NOC controller lends (if needed) to its site controllers so site controllers can adopt adaptive APs in excess of its own installed AAP license count. AAP lent licenses can be non-zero only in controllers currently configured as the NOC (NOC controller). Lent Licenses is always zero in controllers configured as the site (site controller). AAP Borrowed LicensesBorrowed licenses are the total number of AAP licenses borrowed by the site controller from the NOC controller (NOC controllers if a NOC controller is in a cluster). AAP borrowed licenses are always zero in the NOC controller. AAP borrowed licenses can be non-zero only on site controllers.AAP Total Licenses Lists the cumulative number of both Device and Cluster AAP licenses supported by the listed controller or service platform.Advanced Security Enter the provided license key required to install the Role Based Firewall feature and increase the number of IPSec VPN tunnels. The number of IPSec tunnels varies by platform. Analytics Licenses Enter the provided license key required to install Analytics (an enhanced statistical management tool) for NX7500 and NX9000 series service platforms.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 11certificate and is called a CA certificate. A browser must contain the CA certificate in its Trusted Root Library so it can trust certificates signed by the CA's private key.Depending on the public key infrastructure, the digital certificate includes the owner's public key, the certificate expiration date, the owner's name and other public key owner information. Each certificate is digitally signed by a trustpoint. The trustpoint signing the certificate can be a certificate authority, corporation or individual. A trustpoint represents a CA/identity pair containing the identity of the CA, CA-specific configuration parameters, and an association with an enrolled identity certificate.SSH keys are a pair of cryptographic keys used to authenticate users instead of, or in addition to, a username/password. One key is private and the other is public key. Secure Shell (SSH) public key authentication can be used by a requesting client to access resources, if properly configured. A RSA key pair must be generated on the client. The public portion of the key pair resides with the controller or service platform, while the private portion remains on a secure local area of the client. To configure certificate usage:1 Select the Configuration tab from the Web UI.2Select Devices from the Configuration tab.The Device Configuration screen displays a list of managed devices or peer controllers, service platforms or Access Points. 3Select Certificates from the Device menu.Figure 5-5 Device Certificates screen4 Set the following Management Security certificate configurations:SSH RSA Key Either use the default_rsa_key or select the Stored radio button to enable a drop-down menu where an existing certificate can be used. To leverage an existing key, select the Launch Manager button. For more information, see RSA Key Management on page 5-21.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 125 Set the following RADIUS Security certificate configurations:6 Refer to the CMP Certificate field to optionally use Certificate Management Protocol (CMP) as an Internet protocol to obtain and manage digital certificates in a Public Key Infrastructure (PKI) network. A Certificate Authority (CA) issues the certificates using the defined CMP. Using CMP, a device can communicate to a CMP supported CA server, initiate a certificate request and download the required certificates from the CA server. CMP supports multiple request options through for device communicating to a CMP supported CA server. The device can initiate a request for getting the certificates from the server. It can also auto update the certificates which are about to expire. Either use the server default-trustpoint or select the Stored radio button to enable a drop-down menu where an existing certificate/trustpoint can be selected. To leverage an existing trustpoint, select the Launch Manager button.7Select OK to save the changes made to the certificate configurations. Selecting Reset reverts the screen to its last saved configuration.For more information on the certification activities supported, refer to the following:•Certificate Management•RSA Key Management•Certificate Creation•Generating a Certificate Signing Request5.2.2.1 Certificate ManagementAssigning CertificatesA stored certificate can be leveraged from a different managed device if not wanting to use an existing certificate or key. Device certificates can be imported and exported to and from the controller or service platform to a secure remote location for archive and retrieval as required for other managed devices.To configure trustpoints for use with certificates:NOTE: Pending trustpoints and RSA keys are typically not verified as existing on a device.RADIUS Certificate AuthorityEither use the default-trustpoint or select the Stored radio button to enable a drop-down menu where an existing certificate can be leveraged. To leverage an existing certificate, select the Launch Manager button. RADIUS Server Certificate Either use the default-trustpoint or select the Stored radio button to enable a drop-down menu where an existing certificate/trustpoint can be used. To leverage an existing trustpoint, select the Launch Manager button.RADIUS Certificate Authority LDAPSEither use the LDAP server default-trustpoint or select the Stored radio button to enable a drop-down menu where an existing certificate can be leveraged. To leverage an existing certificate, select the Launch Manager button. Radius Server LDAPS TrustpointEither use the LDAP server default-trustpoint or select the Stored radio button to enable a drop-down menu where an existing certificate/trustpoint can be used. To leverage an existing trustpoint, select the Launch Manager button.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 131Select Launch Manager from either the HTTPS Trustpoint, SSH RSA Key, RADIUS Certificate Authority or RADIUS Server Certificate parameters.Figure 5-6 Certificate Management - Manage Certificates screenThe Certificate Management screen displays with the Manage Certificates tab displayed by default. 2 Select a device from amongst those displayed to review its certificate information. 3 Refer to the All Certificates Details to review the certificate’s properties, self-signed credentials, validity duration and CA information. 4 To optionally import a certificate, select the Import button from the Certificate Management screen.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 14Figure 5-7 Certificate Management - Import New Trustpoint screen5 Define the following configuration parameters required for the Import of the trustpoint.Trustpoint Name Enter the 32 character maximum name assigned to the target trustpoint. The trustpoint signing the certificate can be a certificate authority, corporation or individual. URL Provide the complete URL to the location of the trustpoint. If needed, select Advanced to expand the dialog to display network address information to the location of the target trustpoint. The number of additional fields that populate the screen is also dependent on the selected protocol.Protocol Select the protocol used for importing the target trustpoint. Available options include:tftpftpsftphttpcfusb1-4Port Use the spinner control to set the port. This option is not valid for cf and usb1-4.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 156Select OK to import the defined trustpoint. Select Cancel to revert the screen to its last saved configuration.7 To optionally import a CA certificate, select the Import CA button from the Certificate Management screen.A CA is a network authority that issues and manages security credentials and public keys for message encryption. The CA signs all digital certificates it issues with its own private key. The corresponding public key is contained within the certificate and is called a CA certificate.Figure 5-8 Certificate Management - Import CA Certificate screenHost Provide the hostname string or numeric IP address of the server used to import the trustpoint. Hostnames cannot include an underscore character. This option is not valid for cf and usb1-4. Select IPv4 Address to use an IPv4 formatted address as the host. Select IPv6 Address to use an IPv6 formatted address as the host. IPV6 provides enhanced identification and location information for computers on networks routing traffic across the Internet. IPv6 addresses are composed of eight groups of four hexadecimal digits separated by colons. Path/File Specify the path to the trustpoint file. Enter the complete relative path to the file on the server.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 17Figure 5-9 Certificate Management - Import CRL screen11 Define the following configuration parameters required for the Import of the CRLTrustpoint Name Enter the 32 character maximum name assigned to the target trustpoint signing the certificate. A trustpoint represents a CA/identity pair containing the identity of the CA, CA-specific configuration parameters, and an association with an enrolled identity certificate. From Network Select the From Network radio button to provide network address information to the location of the target CRL. The number of additional fields that populate the screen is also dependent on the selected protocol. This is the default setting.URL Provide the complete URL to the location of the CRL. If needed, select Advanced to expand the dialog to display network address information to the location of the CRL. The number of additional fields that populate the screen is also dependent on the selected protocol.Protocol Select the protocol used for importing the CRL. Available options include:tftpftpsftphttpcfusb1-4Port Use the spinner control to set the port. This option is not valid for cf and usb1-4.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 1812 Select OK to import the CRL. Select Cancel to revert the screen to its last saved configuration.13 To import a signed certificate, select the Import Signed Cert button from the Certificate Management screen.Signed certificates (or root certificates) avoid the use of public or private CAs. A self-signed certificate is an identity certificate signed by its own creator, thus the certificate creator also signs off on its legitimacy. The lack of mistakes or corruption in the issuance of self signed certificates is central.Self-signed certificates cannot be revoked which may allow an attacker who has already gained access to monitor and inject data into a connection to spoof an identity if a private key has been compromised. However, CAs have the ability to revoke a compromised certificate, preventing its further use.Figure 5-10 Certificate Management - Import Signed Cert screenHost Provide the hostname string or numeric IP address of the server used to import the CRL. Hostnames cannot include an underscore character. This option is not valid for cf and usb1-4.Select IPv4 Address to use an IPv4 formatted address as the host. Select IPv6 Address to use an IPv6 formatted address as the host. IPV6 provides enhanced identification and location information for computers on networks routing traffic across the Internet. IPv6 addresses are composed of eight groups of four hexadecimal digits separated by colons. Path/File Specify the path to the CRL file. Enter the complete relative path to the file on the server.Cut and Paste Select the Cut and Paste radio button to simply copy an existing CRL into the cut and paste field. When pasting, no additional network address information is required.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 1914 Define the following parameters required for the Import of the CA certificate:15 Select OK to import the signed certificate. Select Cancel to revert the screen to its last saved configuration.16 To optionally export a trustpoint to a remote location, select the Export button from the Certificate Management screen.Once a certificate has been generated on the controller or service platform’s authentication server, export the self signed certificate. A digital CA certificate is different from a self signed certificate. The CA certificate contains the public and private key pairs. The self certificate only contains a public key. Export the self certificate for publication on a Web server or file server for certificate deployment or export it in to an active directory group policy for automatic root certificate deployment.Certificate Name Enter the 32 character maximum trustpoint name with which the certificate should be associated.From Network Select the From Network radio button to provide network address information to the location of the signed certificate. The number of additional fields that populate the screen is dependent on the selected protocol. From Network is the default setting.URL Provide the complete URL to the location of the signed certificate. If needed, select Advanced to expand the dialog to display network address information to the location of the signed certificate. The number of additional fields populating the screen is dependent on the selected protocol.Protocol Select the protocol for importing the signed certificate. Available options include:tftpftpsftphttpcfusb1-4Port Use the spinner control to set the port. This option is not valid for cf and usb1-4.Host Provide the hostname string or numeric IP address of the server used to import the signed certificate. Hostnames cannot include an underscore character. This option is not valid for cf and usb1-4.Select IPv4 Address to use an IPv4 formatted address as the host. Select IPv6 Address to use an IPv6 formatted address as the host. IPV6 provides enhanced identification and location information for computers on networks routing traffic across the Internet. IPv6 addresses are composed of eight groups of four hexadecimal digits separated by colons. Path/File Specify the path to the signed certificate file. Enter the complete relative path to the file on the server.Cut and Paste Select the Cut and Paste radio button to simply copy an existing certificate into the cut and paste field. When pasting, no additional network address information is required.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 2017 Additionally export the key to a redundant RADIUS server so it can be imported without generating a second key. If there’s more than one RADIUS authentication server, export the certificate and don’t generate a second key unless you want to deploy two root certificates.Figure 5-11 Certificate Management - Export Trustpoint screen18 Define the following configuration parameters required for the Export of the trustpoint.Trustpoint Name Enter the 32 character maximum name assigned to the trustpoint. The trustpoint signing the certificate can be a certificate authority, corporation or individual. URL Provide the complete URL to the location of the trustpoint. If needed, select Advanced to expand the dialog to display network address information to the location of the trustpoint. The number of additional fields that populate the screen is dependent on the selected protocol.Protocol Select the protocol used for exporting the target trustpoint. Available options include:tftpftpsftphttpcfusb1-4Port Use the spinner control to set the port. This option is not valid for cf and usb1-4.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 2119 Select OK to export the defined trustpoint. Select Cancel to revert the screen to its last saved configuration.20 To optionally delete a trustpoint, select the Delete button from within the Certificate Management screen. Provide the trustpoint name within the Delete Trustpoint screen and optionally select Delete RSA Key to remove the RSA key along with the trustpoint. Select OK to proceed with the deletion, or Cancel to revert to the Certificate Management screen5.2.2.2 RSA Key ManagementAssigning CertificatesRefer to the RSA Keys screen to review existing RSA key configurations that have been applied to managed devices. If an existing key does not meet the needs of a pending certificate request, generate a new key or import/export an existing key to and from a remote location.Rivest, Shamir, and Adleman (RSA) is an algorithm for public key cryptography. It’s an algorithm that can be used for certificate signing and encryption. When a device trustpoint is created, the RSA key is the private key used with the trustpoint.To review existing device RSA key configurations, generate additional keys or import/export keys to and from remote locations:1 Select the Launch Manager button from either the SSH RSA Key, RADIUS Certificate Authority or RADIUS Server Certificate parameters (within the Certificate Management screen).2Select RSA Keys from the Certificate Management screen. Host Provide the hostname string or numeric IP address of the server used to export the trustpoint. Hostnames cannot include an underscore character. This option is not valid for cf and usb1-4.Select IPv4 Address to use an IPv4 formatted address as the host. Select IPv6 Address to use an IPv6 formatted address as the host. IPV6 provides enhanced identification and location information for computers on networks routing traffic across the Internet. IPv6 addresses are composed of eight groups of four hexadecimal digits separated by colons. Path/File Specify the path to the signed trustpoint file. Enter the complete relative path to the file on the server.Cut and Paste Select the Cut and Paste radio button to simply copy an existing trustpoint into the cut and paste field. When pasting, no additional network address information is required.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 22Figure 5-12 Certificate Management - RSA Keys screen3 Select a listed device to review its current RSA key configuration.Each key can have its size and character syntax displayed. Once reviewed, optionally generate a new RSA key, import a key from a selected device, export a key to a remote location or delete a key from a selected device.4Select Generate Key to create a new key with a defined size.Figure 5-13 Certificate Management - Generate RSA Keys screen5 Define the following configuration parameters required for the Import of the key: 6Select OK to generate the RSA key. Select Cancel to revert the screen to its last saved configuration.Key Name Enter the 32 character maximum name assigned to the RSA key. Key Size Set the size of the key as either 2048 (bits) or 4096 (bits). Leaving this value at the default setting of 2048 is recommended to ensure optimum functionality.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 237 To optionally import a CA certificate, select the Import button from the Certificate Management > RSA Keys screen.Figure 5-14 Certificate Management - Import New RSA Key screen8 Define the following parameters required for the Import of the RSA key:Key Name Enter the 32 character maximum name assigned to identify the RSA key. Key Passphrase Define the key used by both the controller or service platform and the server (or repository) of the target RSA key. Select the Show to expose the actual characters used in the passphrase. Leaving the Show unselected displays the passphrase as a series of asterisks “*”.URL Provide the complete URL to the location of the RSA key. If needed, select Advanced to expand the dialog to display network address information to the location of the target key. The number of additional fields that populate the screen is dependent on the selected protocol.Advanced or Basic Select either the Advanced or Basic link to switch between a basic URL and an advanced location to specify key location.Protocol Select the protocol used for importing the target key. Available options include:tftpftpsftphttpcfusb1-4Port Use the spinner control to set the port. This option is not valid for cf and usb1-4.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 249Select OK to import the defined RSA key. Select Cancel to revert the screen to its last saved configuration.10 To optionally export a RSA key to a remote location, select the Export button from the Certificate Management > RSA Keys screen.Export the key to a redundant RADIUS server to import it without generating a second key. If there’s more than one RADIUS authentication server, export the certificate and don’t generate a second key unless you want to deploy two root certificates.Figure 5-15 Certificate Management - Export RSA Key screen11 Define the following configuration parameters required for the Export of the RSA key.Host Provide a text string hostname or numeric IP address of the server used to import the RSA key. Hostnames cannot include an underscore character. This option is not valid for cf and usb1-4.Select IPv4 Address to use an IPv4 formatted address as the host. Select IPv6 Address to use an IPv6 formatted address as the host. IPV6 provides enhanced identification and location information for computers on networks routing traffic across the Internet. IPv6 addresses are composed of eight groups of four hexadecimal digits separated by colons. Path/File Specify the path to the RSA key. Enter the complete relative path to the key on the server.Key Name Enter the 32 character maximum name assigned to the RSA key. Key Passphrase Define the key passphrase used by both the controller or service platform and the server. Select Show to expose the actual characters used in the passphrase. Leaving the Show unselected displays the passphrase as a series of asterisks “*”.URL Provide the complete URL to the location of the key. If needed, select Advanced to expand the dialog to display network address information to the location of the target key. The number of additional fields that populate the screen is dependent on the selected protocol.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 2512 Select OK to export the defined RSA key. Select Cancel to revert the screen to its last saved configuration.13 To optionally delete a key, select the Delete button from within the Certificate Management > RSA Keys screen. Provide the key name within the Delete RSA Key screen and select Delete Certificates to remove the certificate. Select OK to proceed with the deletion, or Cancel to revert back to the Certificate Management screen.5.2.2.3 Certificate CreationAssigning CertificatesThe Certificate Management screen provides the facility for creating new self-signed certificates. Self signed certificates (often referred to as root certificates) do not use public or private CAs. A self signed certificate is a certificate signed by its own creator, with the certificate creator responsible for its legitimacy.To create a self-signed certificate that can be applied to a managed device:1 Select the Launch Manager button from either the SSH RSA Key, RADIUS Certificate Authority or RADIUS Server Certificate parameters (within the Certificate Management screen).2Select Create Certificate from the upper, left-hand, side of the Certificate Management screen. Protocol Select the protocol used for exporting the RSA key. Available options include:tftpftpsftphttpcfusb1-4Port Use the spinner control to set the port. This option is not valid for cf and usb1-4.Host Provide a text string hostname or numeric IP address of the server used to export the RSA key. Hostnames cannot include an underscore character. This option is not valid for cf and usb1-4.Select IPv4 Address to use an IPv4 formatted address as the host. Select IPv6 Address to use an IPv6 formatted address as the host. IPV6 provides enhanced identification and location information for computers on networks routing traffic across the Internet. IPv6 addresses are composed of eight groups of four hexadecimal digits separated by colons. Path / File Specify the path to the key. Enter the complete relative path to the key on the server.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 26Figure 5-16 Certificate Management - Create Certificate screen3 Define the following configuration parameters required to Create New Self-Signed Certificate:Certificate Name Enter the 32 character maximum name assigned to identify the name of the trustpoint associated with the certificate. A trustpoint represents a CA/identity pair containing the identity of the CA, CA-specific configuration parameters, and an association with an enrolled identity certificate.RSA Key Select a radio button and use the drop-down menu to set the key used by both the controller or service platform and the server (or repository) of the target RSA key. Optionally select Create New and enter a 32 character name used to identify the RSA key. Set the size of the key to either 2,048 or 4,096 bits. Leaving this value at the default setting of 2,048 is recommended to ensure optimum functionality.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 274 Set the following Certificate Subject Name parameters required for the creation of the certificate: 5 Select the following Additional Credentials required for the generation of the self signed certificate:6 Select the Generate Certificate button at the bottom of the Certificate Management > Create Certificate screen to produce the certificate. 5.2.2.4 Generating a Certificate Signing RequestAssigning CertificatesA certificate signing request (CSR) is a request to a certificate authority to apply for a digital identity certificate. The CSR is a block of encrypted text generated on the server the certificate is used on. It contains the organization name, common name (domain name), locality and country. A RSA key must be either created or applied to the certificate request before the certificate can be generated. A private key is not included in the CSR, but is used to digitally sign the completed request. The certificate created with a particular CSR only works with the private key generated with it. If the private key is lost, the certificate is no longer functional.The CSR can be accompanied by other identity credentials required by the certificate authority, and the certificate authority maintains the right to contact the applicant for additional information.If the request is successful, the CA sends an identity certificate digitally signed with the private key of the CA.To create a CSR:Certificate Subject NameSelect either auto-generate to automatically create the certificate's subject credentials or user-configurable to manually enter the credentials of the self signed certificate. The default setting is auto-generate.Country (C) Define the Country used in the certificate. The field can be modified by the user to other values. This is a required field and must not exceed 2 characters.State (ST) Enter a State/Prov. for the state or province name used in the certificate. This is a required field.City (L) Enter a City to represent the city used in the certificate. This is a required field.Organization (O) Define an Organization for the organization represented in the certificate. This is a required field.Organizational Unit (OU)Enter an Org. Unit for the organization unit represented in the certificate. This is a required field. Common Name (CN) If there’s a common name (IP address) for the organizational unit issuing the certificate, enter it here.Email Address Provide an Email Address used as the contact address for issues relating to this certificate request.Domain Name Enter a fully qualified domain name (FQDN) is an unambiguous domain name that specifies the node's position in the DNS tree hierarchy absolutely. To distinguish an FQDN from a regular domain name, a trailing period is added. For example, somehost.example.com. An FQDN differs from a regular domain name by its absoluteness, since a suffix is not added.IP Address Specify the IP address used as the destination for certificate requests.Only IPv4 formatted IP addresses are permitted, not IPv6 formatted addresses.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 281 Select the Launch Manager button from either the SSH RSA Key, RADIUS Certificate Authority or RADIUS Server Certificate parameters (within the Certificate Management screen).2Select Create CSR from the upper, left-hand, side of the Certificate Management screen. Figure 5-17 Certificate Management - Create CSR screen3 Define the following configuration parameters required to Create New Certificate Signing Request (CSR):4 Set the following Certificate Subject Name parameters required for the creation of the certificate: RSA Key Select a radio button and use the drop-down menu to set the key used by both the controller or service platform and the server (or repository) of the target RSA key. Optionally select Create New to use new RSA key and provide a 32 character name used to identify the RSA key. Set the size of the key to either 2,048 or 4,096 bits. Leaving this value at the default setting of 2,048 is recommended to ensure optimum functionality. Certificate Subject NameSelect either the auto-generate radio button to automatically create the certificate's subject credentials or user-configurable to manually enter the credentials of the self signed certificate. The default setting is auto-generate.Country (C) Define the Country used in the CSR. The field can be modified by the user to other values. This is a required field and must not exceed 2 characters.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 295 Select the following Additional Credentials required for the generation of the CSR:6 Select the Generate CSR button to produce the CSR. 5.2.3 Port Mirroring (NX4524 and NX6524 Service Platforms only)Basic Device ConfigurationNX4524 and NX6524 model service platforms have the ability to mirror data packets transmitted or received on any of their GE ports (GE port 1 - 24). Both transmit and receive packets can be mirrored from a source to a destination port as needed to provide traditional spanning functionality on the 24 GE ports. To set a NX4524 or NX6524 service platform port mirror configuration:1 Select the Configuration tab from the Web UI.2Select Devices from the Configuration tab.The Device Configuration screen displays a list of managed devices or peer controllers, service platforms or Access Points.3 Select a target device (by double-clicking it) from amongst those displayed within the Device Configuration screen. Devices can also be selected directly from the Device Browser in the lower, left-hand, side of the UI.4Select Mirroring from the Device menu options.State (ST) Enter a State/Prov. for the state or province name represented in the CSR. This is a required field.City (L) Enter a City represented in the CSR. This is a required field.Organization (O) Define the Organization represented in the CSR. This is a required field.Organizational Unit (OU)Enter the Org. Unit represented in the CSR. This is a required field. Common Name (CN) If there’s a common name (IP address) for the organizational unit issuing the certificate, enter it here.Email Address Provide an email address used as the contact address for issues relating to this CSR.Domain Name Enter a fully qualified domain name (FQDN) is an unambiguous domain name that specifies the node's position in the DNS tree hierarchy absolutely. To distinguish an FQDN from a regular domain name, a trailing period is added. ex: somehost.example.com. An FQDN differs from a regular domain name by its absoluteness; as a suffix is not added.IP Address Specify the IP address used as the destination for certificate requests.Only IPv4 formatted IP addresses are permitted, not IPv6 formatted addresses.NOTE: Port mirroring is not supported on NX4500 or NX6500 models, as they only utilize GE ports 1 - 2. Additionally, port mirroring is not supported on uplink (up) ports or wired ports on any controller or service platform model.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 30Figure 5-18 Port Mirroring screen5 Set the following Port Mirroring values to define the ports and directions data is spanned on the NX4524 or NX6524 model service platform:6Select + Add Row to add different sources, destinations and directions for additional GE port spanning configurations.7Select OK to save the changes made to the NX4524 or NX6524 port mirroring configuration. Selecting Reset reverts the screen to its last saved configuration.5.2.4 Wired 802.1x ConfigurationBasic Device Configuration802.1X is an IEEE standard for media-level (Layer 2) access control, providing the capability to permit or deny connectivity based on user or device identity. 802.1X allows port based access using authentication. An 802.1X enabled port can be dynamically enabled or disabled depending on user identity or device connection.Source Select the GE port (1 - 24) used as the data source to span packets to the selected destination port. The packets spanned from the selected source to the destination depend on whether Inbound, Outbound or Any is selected as the direction. A source port cannot be a destination port.Destination Select the GE port (1 - 24) used as the port destination to span packets from the selected source. The destination port serves as a duplicate image of the source port and can be used to send packets to a network diagnostic without disrupting the behavior on the original port. The destination port transmits only mirrored traffic and does not forward received traffic. Additionally, address learning is disabled on the destination port.Direction Define the direction data packets are spanned from the selected source to the defined destination. Packets spanned from the source to the destination depend on whether Inbound (received packets only), Outbound (transmitted packets only) or Any (packets in either direction) is selected.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 31Before authentication, the endpoint is unknown, and traffic is blocked. Upon authentication, the endpoint is known and traffic is allowed. The controller or service platform uses source MAC filtering to ensure only the authenticated endpoint is allowed to send traffic.To configure a device’s wired 802.1x configuration:1 Select the Configuration tab from the Web UI.2Select Devices from the Configuration tab.The Device Configuration screen displays a list of managed devices or peer controllers, service platforms or Access Points.3 Select a device (by double-clicking it) from amongst those displayed within the Device Configuration screen. Devices can also be selected directly from the Device Browser in the lower, left-hand, side of the UI.4Select Wired 802.1x from the Device menu options.Figure 5-19 Device Wired 802.1x screen5Review the Wired 802.1x Settings area to configure the following parameters:Dot1x Authentication ControlSelect this option to globally enable 802.1x authentication. 802.1x authentication is disabled by default.Dot1x AAA Policy Use the drop-down menu to select a AAA policy to associate with wired 802.1x traffic. If a suitable AAA policy does not exist, select the Create icon to create a new policy or the Edit icon to modify an existing policy. Dot1x Guest VLAN ControlSelect this option to globally enable the use of 802.1x guest VLANs.Dot1x Hold Time Set a hold time value (after the last hello packet) in either Seconds (0 - 600) or Minutes (0 - 10). When exceeded, the controller’s 802.1X enabled port and its destination end-point connection is defined as lost and the connection must be re-established.MAC Authentication AAA PolicyUse the drop-down menu to select an AAA authentication policy for MAC address authentication. If a suitable MAC AAA policy does not exist, click the Create icon to create a new policy or the Edit icon to modify an existing policy.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 326Select OK to save the changes made to the 802.1x configurations. Selecting Reset reverts the screen to its last saved configuration.5.2.5 RF Domain OverridesBasic Device ConfigurationUse RF Domain Overrides to define configurations overriding the configuration set by the target device’s original RF Domain assignment.RF Domains allow administrators to assign configuration data to multiple devices deployed in a common coverage area (floor, building or site). In such instances, there’s many configuration attributes these devices share, since their general client support roles are quite similar. However, device configurations may need periodic refinement from their original RF Domain administered design. A controller or service platform configuration contains (at a minimum) one default RF Domain, but can optionally use additional user defined RF Domains:•Default RF Domain - Automatically assigned to each controller, service platform and associated Access Points by default. A default RF Domain is unique to a specific model.•User Defined RF Domains - Created by administrators and manually assigned to individual controllers, service platforms or Access Points, but can be automatically assigned to Access Points using adoption policies.Each controller, service platform and Access Point is assigned one RF Domain at a time. However, a user defined RF Domain can be assigned to multiple devices as required. User defined RF Domains can be manually assigned or automatically assigned to Access Points using an auto provisioning policy. The more devices assigned a single RF Domain, the greater the likelihood one of the device’s configurations will require an override deviating that device’s configuration from the original RF Domain assignment shared by the others.To review the RF Domain’s original configuration requirements and the options available for a target device, refer to Managing RF Domains on page 9-2.To define a device’s RF Domain override configuration:1 Select the Configuration tab from the Web UI.2Select Devices from the Configuration tab.The Device Configuration screen displays a list of managed devices or peer controllers, service platforms or Access Points.3 Select a device (by double-clicking it) from amongst those displayed within the Device Configuration screen. Devices can also be selected directly from the Device Browser in the lower, left-hand, side of the UI.4Expand the RF Domain Overrides menu option to display its sub-menu options.5Select RF Domain.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 33Figure 5-20 RF Domain Overrides - Basic Configuration screen6 Refer to the Basic Configuration field to review the basic settings defined for the target device’s RF Domain configuration, and optionally assign/remove overrides to and from specific parameters.NOTE: A blue override icon (to the left of a parameter) defines the parameter as having an override applied. To remove an override go to the Basic Configuration section of the device and click the Clear Overrides button. This removes all overrides from the device.Location Provide the 64 character maximum deployment location set for the controller or service platform as part of its RF Domain configuration. Contact Enter the 64 character maximum administrative contact for the controller or service platform as part of its RF Domain configuration. Time Zone Set the time zone utilized by the selected device as part of its RF Domain configuration. Country Code Set the country code utilized by the device as part of its RF Domain configuration. Selecting the correct country is central to legal operation. Each country has its own regulatory restrictions concerning electromagnetic emissions and the maximum RF signal strength that can be transmitted.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 347 Refer to the Smart RF section to configure Smart RF policy and dynamic channel settings.8 Refer to the Smart Scan section to configure Smart RF policy and dynamic channel settings.9Use the WIPS Policy drop-down menu to apply a WIPS policy to the RF Domain.The Wireless Intrusion Protection System (WIPS) provides continuous protection against wireless threats and act as an additional layer of security complementing wireless VPNs and encryption and authentication policies. Controllers and service platforms support WIPS through the use of dedicated sensor devices, designed to actively detect and locate unauthorized AP devices. After detection, they use mitigation techniques to block devices using manual termination, air lockdown or port suppression.Select the Create icon to define a new WIPS policy that can be applied to the RF Domain, or select the Edit icon to modify or override an existing WIPS policy. For an overview of WIPS and instructions on how to create a WIPS policy that can be used with a RF Domain, see Intrusion Prevention on page 10-51.10 Use the Licenses drop-down menu to obtain and leverage feature licenses from RF Domain member devices.11 Select OK to save the changes and overrides made to the RF Domain configuration. Selecting Reset reverts the screen to its last saved configuration.12 Select Sensor from within the expanded RF Domain Overrides menu to define ADSP server credentials for WiNG controller or service platform data exchanges.Controllers and service platforms support dedicated sensor devices, designed to actively detect and locate unauthorized AP devices. After detection, they use mitigation techniques to block devices using manual termination, air lockdown or port suppression.2.4 GHz Radios Select an override group of channels Smart RF can use for channel compensation adjustments in the 2.4 GHz band.5 GHz Radios Select an override group of channels Smart RF can use for channel compensation adjustments in the 5 GHz band.Enable Dynamic Channel Select this option to enable dynamic channel switching for Smart RF radios. 2.4 GHz Channels Select legal channels (device radios transmit in specific channels unique to their country of operation) from the drop-down menu for 2.4GHz Smart RF radios. 5 GHz Channels Select legal channels (device radios transmit in specific channels unique to their country of operation) from the drop-down menu for 5GHz Smart RF radios.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 35Figure 5-21 RF Domain - Sensor screen13 Select the + Add Row button to populate the Server Appliance Configuration field with up to three rows for ADSP server credentials:14 Select OK to save the changes to the ADSP appliance sensor configuration, or select Reset to revert to the last saved configuration.15 Select Client Name from within the expanded RF Domain Overrides:Server Id Use the spinner control to assign a numerical ID for up to three WIPS server resources. The server with the lowest defined ID is the first reached by the controller or service platform. The default ID is 1.IP Address/Hostname Provide the numerical (non DNS) IP address or hostname of each server used as a WIPS sensor server by RF Domain member devices. A hostname cannot exceed 64 characters or contain an underscore.Port Use the spinner control to specify the port of each WIPS sensor server utilized by RF member devices. The default port is 443.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 36Figure 5-22 Client Name screen16 Click + Add Row to add client name information to the table.17 Select OK to save the changes and overrides made to the Client Name Configuration. Selecting Reset reverts the screen to its last saved configuration.18 Select WLAN Override from within the expanded RF Domain Overrides menu.MAC Address Enter the MAC address of the device assigned a client name for controller, service platform or Access Point management.Name Enter the name assigned to this client.NOTE: The WLAN Override option does not appear as a sub menu option under RF Domain Overrides for either controllers or service platforms, just Access Points.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 37Figure 5-23 WLAN Override screen - Override SSID tabThe WLAN Override screen displays with the Override SSID tab displayed by default.19 Optionally define up to 3 overrides for the listed WLAN SSID assignment:20 Select the Add Row button as needed to add additional WLAN SSID overrides.21 Select OK to save the changes and overrides. Selecting Reset reverts the screen to its last saved configuration.22 Select the Override VLAN tab to review any VLAN assignment overrides that may have been or optionally add or edit override configurations.WLAN Optionally use the drop-down menu to change the WLAN assignment for the listed Access Point. Select either the Create icon to define a new WLAN configuration, or select the Edit icon to modify an existing WLAN configuration.SSID Optionally change the SSID associated with the WLAN. The WLAN name is auto-generated using the SSID until changed (overridden). The maximum number of characters used for the SSID is 32.NOTE: A blue override icon (to the left of a parameter) defines the parameter as having an override applied. To remove an override go to the Basic Configuration section of the device and click the Clear Overrides button. This removes all overrides from the device.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 49Figure 5-29 Controller Adoption Override screen5Within the Controller Group field, use the Group item to set provide the controller group this controller or service platform belongs to. A preferred group can also be selected for the adoption of this controller or service platform. The name of the preferred group cannot exceed 64 characters.6 Set the following Auto Provisioning Policy parameters:Use NOC Auto-Provisioning PolicySelect this option to use the NOC’s auto provisioning policy instead of the policy local to the controller or service platform. The NOC is an elected controller or service platform capable of provisioning all of its peer controllers, service platforms and adopted devices. This setting is disabled by default.Auto-Provisioning PolicySelect an auto provisioning policy from the drop-down menu. To create a new auto provisioning policy, select the Create icon or modify an existing one by selecting the Edit icon.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 507 Set the following Controller Adoption Settings settings:8Enter Controller Hostnames as needed to define resources for adoption.9Select + Add Row as needed to populate the table with IP Addresses or Hostnames used as Access Point adoption resources into the managed network.Learn and Save Network ConfigurationSelect this option to enable allow the controller tor service platform to maintain a local configuration records of devices requesting adoption and provisioning. This feature is enabled by default.Rerun Policy Rules Every Time AP AdoptedEnabling this feature applies adoption rules on Access Points each time they’re subsequently adopted, not just the first time. This setting is disabled by default.Allow Adoption of DevicesSelect either Access Points or Controllers (or both) to refine whether this controller or service platform can adopt just networked Access Points or peer controller devices as well.Allow Adoption of External DevicesSelect this option to enable this controller or service platform to adopt T5 model devices or EX3500 model switches.Allow Monitoring of External DevicesSelect this option to enable monitoring only of T5 model devices or EX3500 model switches by this controller or service platform. When enabled, WiNG does not configure EX3500 switches or a T5, it only monitors those devices for statistics and events.Allow Adoption of this ControllerSelect this option to enable this controller or service platform to be capable of adoption by other controllers or service platforms. This setting is disabled by default, and must be selected to allow peer adoptions and enable the four settings directly below it.Preferred Group If Allow Adoption of this Controller is selected, provide the controller group preferred as the adopting entity for this controller or service platform. If utilizing this feature, ensure the appropriate group is provided within the Controller Group field.Hello Interval Select this option to define the hello packet exchange interval (from 1 - 120 seconds) between the controller or service platform and an adoption requesting Access Point. Adjacency Hold Time Select this option to set a hold time interval (from 2 - 600 seconds) for the transmission of hello packets. Offline Duration Use the spinner control to define a timeout (from 5 - 43,200 minutes) to detect whether an adopted device is offline. The default setting is 10 minutes.Host Use the drop-down menu to specify whether the adoption resource is defined as a (non DNS) IP Address or a Hostname. Once defined, provide the numerical IP or Hostname. A Hostname cannot exceed 64 characters or contain an underscore.Pool Use the spinner control to set a pool of either 1 or 2. This is the pool the target controller or service platform belongs to.Routing Level Define a routing level (either 1 or 2) for the link between adopting devices. The default setting is 1.IPSec Secure Enable this option to provide IPSec secure peer authentication on the connection (link) between the adopting devices. This option is disabled by default.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 5921 Refer to the Trust field to define or override the following:22 Set the following IPv6 Settings:23 Set the following 802.1X Settings:Trust ARP Responses Select this option to enable ARP trust on this port. ARP packets received on this port are considered trusted, and the information from these packets is used to identify rogue devices within the network. The default value is disabled.Trust DHCP Responses Select this option to enable DHCP trust on this port. If enabled, only DHCP responses are trusted and forwarded on this port, and a DHCP server can be connected only to a DHCP trusted port. The default value is enabled.ARP header Mismatch ValidationSelect this option to enable a mismatch check for the source MAC in both the ARP and Ethernet header. The default value is enabled.Trust 802.1p COS valuesSelect this option to enable 802.1p COS values on this port. The default value is enabled.Trust IP DSCP Select this option to enable IP DSCP values on this port. The default value is enabled.NOTE: Some vendor solutions with VRRP enabled send ARP packets with Ethernet SMAC as a physical MAC and inner ARP SMAC as VRRP MAC. If this configuration is enabled, a packet is allowed, despite a conflict existing.Trust ND Requests Select this option to enable the trust of neighbor discovery requests required on an IPv6 network on this Ethernet port. This setting is disabled by default.Trust DHCPv6 ResponsesSelect this option to enable the trust all DHCPv6 responses on this Ethernet port. DHCPv6 is a networking protocol for configuring IPv6 hosts with IP addresses, IP prefixes or other configuration attributes required on an IPv6 network. This setting is enabled by default.ND Header Mismatch ValidationSelect this option to enable a mismatch check for the source MAC within the ND header and Link Layer Option. This setting is disabled by default.RA Guard Select this option to enable router advertisements or ICMPv6 redirects from this Ethernet port. This setting is disabled by default.Host Mode Use the drop-down menu to select the host mode configuration to apply to this port. Options include single-host or multi-host. The default setting is single-host.Guest VLAN Specify a guest VLAN for this port from 1 - 4094. This is the VLAN traffic is bridged on if this port is unauthorized and the guest VLAN is globally enabled.Port Control Use the drop-down menu to set the port control state to apply to this port. Options include force-authorized, force-unauthorized and automatic. The default setting is port-authorized.Re Authenticate Select this setting to force clients to reauthenticate on this port. The default setting is disabled, thus clients do not need to reauthenticate for connection over this port until this setting is enabled.Max Reauthenticate CountSet the maximum reauthentication attempts (1 - 10) before this port is moved to unauthorized. The default setting is 2.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 6127 Set or override the following parameters for the port’s MSTP Configuration: 28 Refer to the Spanning Tree Port Cost table.Define or override an Instance Index using the spinner control and set the Cost. The default path cost depends on the user defined speed of the port.The cost helps determine the role of the port in the MSTP network. The designated cost is the cost for a packet to travel from this port to the root in the MSTP configuration. The slower the media, the higher the cost.Enable as Edge Port Select this option to define this port as an edge port. Using an edge (private) port, you can isolate devices to prevent connectivity over this port.Link Type Select either the Point-to-Point or Shared radio button. Selecting Point-to-Point indicates the port should be treated as connected to a point-to-point link. Selecting Shared indicates this port should be treated as having a shared connection. A port connected to a hub is on a shared link, while one connected to a controller or service platform is a point-to-point link.Cisco MSTP InteroperabilitySelect either the Enable or Disable radio buttons. This enables interoperability with Cisco’s version of MSTP over the port, which is incompatible with standard MSTP.Force Protocol VersionSets the protocol version to either STP(0), Not Supported(1), RSTP(2) or MSTP(3). MSTP is the default setting.Guard Determines whether the port enforces root bridge placement. Setting the guard to Root ensures the port is a designated port. Typically, each guard root port is a designated port, unless two or more ports (within the root bridge) are connected together. If the bridge receives superior BPDUs on a guard root-enabled port, the guard root moves the port to a root-inconsistent STP state. This state is equivalent to a listening state. No data is forwarded across the port. Thus, the guard root enforces the root bridge position.Enable PortFast Select this option to enable drop-down menus for both the Enable Portfast BPDU Filter and Enable Portfast BPDU guard options for the port.Enable PortFast BPDU FilterEnable PortFast to invoke a BPDU filter for this portfast enabled port. Enabling the BPDU filter feature ensures this PortFast enabled port does not transmit or receive BPDUs.Enable PortFast BPDU GuardEnable PortFast to invoke a BPDU guard for this portfast enabled port. Enabling the BPDU Guard feature means this portfast-enabled port will shutdown on receiving a BPDU.Speed Default Path Cost<=100000 bits/sec 200000000<=1000000 bits/sec 20000000<=10000000 bits/sec 2000000<=100000000 bits/sec 200000<=1000000000 bits/sec 20000<=10000000000 bits/sec 2000

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 6512 Set the following DHCPv6 Client Configuration. The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) provides a framework for passing configuration information.13 Set the Bonjour Gateway settings for the virtual interface.Bonjour is Apple’s implementation of zero-configuration networking (Zeroconf). Zeroconf is a group of technologies that include service discovery, address assignment and hostname resolution. Bonjour locates devices such as printers, other computers and services that these computers offer over a local network. Bonjour provides a general method to discover services on a local area network (LAN). It allows users to set up a network without any configuration. Services such as printers, scanners and file-sharing servers can be found using Bonjour. Bonjour only works within a single broadcast domain. However, with special DNS configuration, it can be extended to find services across broadcast domains.14 Select the Bonjour Gateway discover policy from the drop-down menu. Select the Create icon to define a new Bonjour Gateway policy configuration or select the Edit icon to modify an existing Bonjour Gateway policy configuration.15 Set the following MTU settings for the virtual interface:16 Within the ICMP field, define whether ICMPv6 redirect messages are sent. Redirect requests data packets be sent on an alternative route. This setting is enabled by default.17 Within the Address Autoconfiguration field, define whether to configure IPv6 addresses on this virtual interface based on the prefixes received in router advertisement messages. Router advertisements contain prefixes used for link determination, address configuration and maximum hop limits. This setting is enabled by default.Stateless DHCPv6 ClientSelect this option to request information from the DHCPv6 server using stateless DHCPv6. DHCPv6 is a networking protocol for configuring IPv6 hosts with IP addresses, IP prefixes or other configuration attributes required on an IPv6 network. This setting is disabled by default.Prefix Delegation ClientSpecify a 32 character maximum request prefix for prefix delegation from a DHCPv6 server over this virtual interface. Devices use prefixes to distinguish destinations that reside on-link from those reachable using a router.Request DHCPv6 OptionsSelect this option to request DHCPv6 options on this virtual interface. DHCPv6 options provide configuration information for a node that must be booted using the network rather than locally. This setting is disabled by default.Maximum Transmission Unit (MTU)Set the PPPoE client maximum transmission unit (MTU) from 500 - 1,492. The MTU is the largest physical packet size in bytes a network can transmit. Any messages larger than the MTU are divided into smaller packets before being sent. A PPPoE client should be able to maintain its point-to-point connection for this defined MTU size. The default MTU is 1,492. IPv6 MTU Set an IPv6 MTU for this virtual interface from 1,280 - 1,500. A larger MTU provides greater efficiency because each packet carries more user data while protocol overheads, such as headers or underlying per-packet delays, remain fixed; the resulting higher efficiency means a slight improvement in bulk protocol throughput. A larger MTU results in the processing of fewer packets for the same amount of data. The default is 1,500.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 6618 Set the following Router Advertisement Processing settings for the virtual interface. Router advertisements are periodically sent to hosts or sent in response to solicitation requests. The advertisement includes IPv6 prefixes and other subnet and host information.19 Select OK to save the changes. Select Reset to revert to the last saved configuration.20 Select the IPv4 tab to set IPv4 settings for this virtual interface.IPv4 is a connectionless protocol. It operates on a best effort delivery model that does not guarantee delivery or assures proper sequencing or avoidance of duplicate delivery (unlike TCP).Accept RA Enable this option to allow router advertisements over this virtual interface. IPv6 hosts can configure themselves automatically when connected to an IPv6 network using the neighbor discovery protocol via ICMPv6 router discovery messages. When first connected to a network, a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to such a request with a router advertisement packet that contains Internet layer configuration parameters.This setting is enabled by default.No Default Router Select this option to consider routers unavailable on this interface for default router selection. This setting is disabled by default.No MTU Select this option to not use the existing MTU setting for router advertisements on this virtual interface. If the value is set to zero no MTU options are sent. This setting is disabled by default.No Hop Count Select this option to not use the hop count advertisement setting for router advertisements on this virtual interface. This setting is disabled by default.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 67Figure 5-36 Virtual Interfaces - Basic Configuration screen - IPv4 tab21 Set the following network information from within the IPv4 Addresses field:Enable Zero ConfigurationZero configuration can be a means of providing a primary or secondary IP addresses for the virtual interface. Zero configuration (or zero config) is a wireless connection utility included with Microsoft Windows XP and later as a service dynamically selecting a network to connect based on a user's preferences and various default settings. Zero config can be used instead of a wireless network utility from the manufacturer of a computer's wireless networking device. This value is set to None by default.Primary IP Address Define the IP address for the VLAN associated Virtual Interface.Use DHCP to Obtain IPSelect this option to allow DHCP to provide the IP address for the Virtual Interface. Selecting this option disables the Primary IP address field. Use DHCP to obtain Gateway/DNS ServersSelect this option to allow DHCP to obtain a default gateway address and DNS resource for one virtual interface. This setting is disabled by default and only available when the Use DHCP to Obtain IP option is selected.Secondary Addresses Use the Secondary Addresses parameter to define additional IP addresses to associate with VLAN IDs. The address provided in this field is used if the primary IP address is unreachable.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 6822 Refer to the DHCP Relay field to set the DHCP relay server configuration used with the Virtual Interface.23 Select OK to save the changes to the IPv4 configuration. Select Reset to revert to the last saved configuration.24 Select the IPv6 tab to set IPv6 settings for this virtual interface.IPv6 is the latest revision of the Internet Protocol (IP) designed to replace IPv4. IPV6 provides enhanced identification and location information for computers on networks routing traffic across the Internet. IPv6 addresses are composed of eight groups of four hexadecimal digits separated by colons. IPv6 hosts can configure themselves automatically when connected to an IPv6 network using the neighbor discovery protocol via ICMPv6 router discovery messages. When first connected to a network, a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to such a request with a router advertisement packet that contains Internet layer configuration parameters.Figure 5-37 Virtual Interfaces - Basic Configuration screen - IPv6 tabRespond to DHCP Relay PacketsSelect this option to allow the onboard DHCP server to respond to relayed DHCP packets on this interface. This setting is disabled by default.DHCP Relay Provide IP addresses for DHCP server relay resources. DHCP relays exchange messages between a DHCPv6 server and client. A client and relay agent exist on the same link. When A DHCP request is received from the client, the relay agent creates a relay forward message and sends it to a specified server address. If no addresses are specified, the relay agent forwards the message to all DHCP server relay multicast addresses. The server creates a relay reply and sends it back to the relay agent. The relay agent then sends back the response to the client.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 6925 Refer to the IPv6 Addresses field to define how IP6 addresses are created and utilized.26 Enable the Enforce Duplicate Address option to enforce duplicate address protection when any wired port is connected and in a forwarding state. This option is enabled by default.27 Refer to the IPv6 Address Prefix from Provider table to create IPv6 format prefix shortcuts as supplied by an ISP.28 Select + Add Row to launch a sub screen wherein a new delegated prefix name and host ID can be defined.Figure 5-38 Virtual Interfaces - Basic Configuration screen - IPv6 tab - Add Address Prefix from ProviderIPv6 Mode Select this option to enable IPv6 support on this virtual interface. IPv6 is disabled by default.IPv6 Address Static Define up to 15 global IPv6 IP addresses that can created statically. IPv6 addresses are represented as eight groups of four hexadecimal digits separated by colons.IPv6 Address Static using EUI64Optionally set up to 15 global IPv6 IP addresses (in the EUI-64 format) that can created statically. The IPv6 EUI-64 format address is obtained through a 48-bit MAC address. The MAC is initially separated into two 24-bits, with one being an OUI (Organizationally Unique Identifier) and the other being client specific. A 16-bit 0xFFFE is then inserted between the two 24-bits for the 64-bit EUI address. IEEE has chosen FFFE as a reserved value which can only appear in EUI-64 generated from the an EUI-48 MAC address. IPv6 Address Link LocalProvide the IPv6 local link address. IPv6 requires a link local address assigned to every interface the IPv6 protocol is enabled, even when one or more routable addresses are assigned.Delegated Prefix NameEnter a 32 character maximum name for the IPv6 address prefix from provider. Host ID Define the subnet ID, host ID and prefix length.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 7029 Select OK to save the changes to the new IPv6 prefix from provider. Select Exit to close the screen without saving the updates.30 Refer to the IPv6 Address Prefix from Provider EUI64 table to set an (abbreviated) IP address prefix in EUI64 format.31 Select + Add Row to launch a sub screen wherein a new delegated prefix name and host ID can be defined in EUI64 format.Figure 5-39 Virtual Interfaces - Basic Configuration screen - IPv6 tab - Add Address Prefix from Provider EUI64 32 Select OK to save the changes to the new IPv6 prefix from provider in EUI64 format. Select Exit to close the screen without saving the updates.33 Refer to the DHCPv6 Relay table to set the address and interface of the DHCPv6 relay.The DHCPv6 relay enhances an extended DHCP relay agent by providing support in IPv6. DHCP relays exchange messages between a DHCPv6 server and client. A client and relay agent exist on the same link. When A DHCP request is received from the client, the relay agent creates a relay forward message and sends it to a specified server address. If no addresses are specified, the relay agent forwards the message to all DHCP server relay multicast addresses. The server creates a relay reply and sends it back to the relay agent. The relay agent then sends back the response to the client.34 Select + Add Row to launch a sub screen wherein a new DHCPv6 relay address and interface VLAN ID can be set.Delegated Prefix NameEnter a 32 character maximum name for the IPv6 prefix from provider in EUI format. Using EUI64, a host can automatically assign itself a unique 64-bit IPv6 interface identifier without manual configuration or DHCP. Host ID Define the subnet ID and prefix length.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 71Figure 5-40 Virtual Interfaces - Basic Configuration screen - IPv6 tab - Add DHCPv6 Relay 35 Select OK to save the changes to the DHCPv6 relay configuration. Select Exit to close the screen without saving the updates.36 Select the IPv6 RA Prefixes tab.Address Enter an address for the DHCPv6 relay. These DHCPv6 relay receive messages from DHCPv6 clients and forward them to DHCPv6 servers. The DHCPv6 server sends responses back to the relay, and the relay then sends these responses to the client on the local network.Interface Select this option to enable a spinner control to define a VLAN ID from 1 - 4,094 used as the virtual interface for the DHCPv6 relay. The interface designation is only required for link local and multicast addresses. A local link address is a locally derived address designed for addressing on a single link for automatic address configuration, neighbor discovery or when no routing resources are available.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 72Figure 5-41 Virtual Interfaces - Basic Configuration screen - IPv6 RA Prefixes tab37 Use the Router Advertisement Policy drop-down menu to select and apply a policy to the virtual interface.Router advertisements are periodically sent to hosts or sent in response to solicitation requests. The advertisement includes IPv6 prefixes and other subnet and host information.38 Review the configurations of existing IPv6 advertisement policies. If needed select + Add Row to define the configuration of an additional IPv6 RA prefix.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 73Figure 5-42 Virtual Interfaces - Basic Configuration screen - Add IPv6 RA Prefix39 Set the following IPv6 RA Prefix settings:Prefix Type Set the prefix delegation type used with this configuration. Options include, Prefix, and prefix-from-provider. The default setting is Prefix. A prefix allows an administrator to associate a user defined name to an IPv6 prefix. A provider assigned prefix is made available from an Internet Service Provider (ISP) to automate the process of providing and informing the prefixes used.Prefix or ID Set the actual prefix or ID used with the IPv6 router advertisement. Site Prefix The site prefix is added into a router advertisement prefix. The site address prefix signifies the address is only on the local link.Valid Lifetime Type Set the lifetime for the prefix's validity. Options include External (fixed), decrementing and infinite. If set to External (fixed), just the Valid Lifetime Sec setting is enabled to define the exact time interval for prefix validity. If set to decrementing, use the lifetime date and time settings to refine the prefix expiry period. If the value is set for infinite, no additional date or time settings are required for the prefix and the prefix will not expire. The default setting is External (fixed).Valid Lifetime Sec If the lifetime type is set to External (fixed), set the Seconds, Minutes, Hours or Days value used to measurement criteria for the prefix's expiration. 30 days, 0 hours, 0 minutes and 0 seconds is the default lifetime.Valid Lifetime Date If the lifetime type is set to External (fixed), set the date in MM/DD/YYYY format for the expiration of the prefix.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 7440 Select OK to save the changes to the IPv6 RA prefix configuration. Select Exit to close the screen without saving the updates.41 Select OK to save the changes and overrides. Select Reset to revert to the last saved configuration.42 Select the Security tab.Valid Lifetime Time If the lifetime type is set to decrementing, set the time for the prefix's validity.Preferred Lifetime TypeSet the administrator preferred lifetime for the prefix's validity. Options include External (fixed), decrementing and infinite. If set to External (fixed), just the Valid Lifetime Sec setting is enabled to define the exact time interval for prefix validity. If set to decrementing, use the lifetime date and time settings to refine the prefix expiry period. If the value is set for infinite, no additional date or time settings are required for the prefix and the prefix will not expire. The default setting is External (fixed).Preferred Lifetime SecIf the administrator preferred lifetime type is set to External (fixed), set the Seconds, Minutes, Hours or Days value used to measurement criteria for the prefix's expiration. 30 days, 0 hours, 0 minutes and 0 seconds is the default lifetime.Preferred Lifetime DateIf the administrator preferred lifetime type is set to External (fixed), set the date in MM/DD/YYYY format for the expiration of the prefix.Preferred Lifetime TimeIf the preferred lifetime type is set to decrementing, set the time for the prefix's validity.Autoconfig Autoconfiguration includes generating a link-local address, global addresses via stateless address autoconfiguration and duplicate address detection to verify the uniqueness of the addresses on a link. This setting is enabled by default.On Link Select this option to keep the IPv6 RA prefix on the local link. The default setting is enabled.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 7910 Use the Port Channel Load Balance drop-down menu from the Client Load Balancing section to define whether port channel load balancing is conducted using a Source/Destination IP or a Source/Destination MAC. Source/Destination IP is the default setting.11 Define or override the following Switching Mode parameters to apply to the port channel configuration:Speed Select the speed at which the port channel can receive and transmit data. Select either 10 Mbps, 100 Mbps or 1000 Mbps to establish a 10, 100 or 1000 Mbps data transfer rate for the selected half duplex or full duplex transmission. These options are not available if Auto is selected. Select Automatic to allow the port channel to automatically exchange information about data transmission speeds and duplex capabilities. Auto negotiation is helpful in an environment where different devices are connected and disconnected on a regular basis. Automatic is the default setting.Duplex Select either half, full or automatic as the duplex option. Select Half duplex to send data over the port channel, then immediately receive data from the same direction in which the data was transmitted. Like a full-duplex transmission, a half-duplex transmission can carry data in both directions, just not at the same time. Select Full duplex to transmit data to and from the port channel at the same time. Using full duplex, the port channel can send data while receiving data as well. Select Automatic to enable to the controller or service platform to dynamically duplex as port channel performance needs dictate. Automatic is the default setting.Mode Select either the Access or Trunk radio button to set the VLAN switching mode over the port channel. If Access is selected, the port channel accepts packets only from the native VLAN. Frames are forwarded untagged with no 802.1Q header. All frames received on the port are expected as untagged and are mapped to the native VLAN. If the mode is set to Trunk, the port channel allows packets from a list of VLANs you add to the trunk. A port channel configured as Trunk supports multiple 802.1Q tagged VLANs and one Native VLAN which can be tagged or untagged. Access is the default setting.Native VLAN Use the spinner control to define a numerical Native VLAN ID from 1 - 4094. The native VLAN allows an Ethernet device to associate untagged frames to a VLAN when no 802.1Q frame is included in the frame. Additionally, the native VLAN is the VLAN untagged traffic will be directed over when using trunk mode. The default value is 1.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 8324 Set or override the following MSTP Configuration parameters for the port channel:25 Refer to the Spanning Tree Port Cost table.26 Define or override an Instance Index using the spinner control and then set the Cost. The default path cost depends on the user defined port speed. The cost helps determine the role of the port channel in the MSTP network. The designated cost is the cost for a packet to travel from this port to the root in the MSTP configuration. The slower the media, the higher the cost.27 Refer to the Spanning Tree Port Priority table.Define or override an Instance Index using the spinner control, then set the Priority. The lower the priority, the greater likelihood of the port becoming a designated port.Enable as Edge Port Select this option to define this port as an edge port. Using an edge (private) port, you can isolate devices to prevent connectivity over this port channel. This setting is disabled by default.Link Type Select either the Point-to-Point or Shared radio button. Selecting Point-to-Point indicates the port should be treated as connected to a point-to-point link. Selecting Shared indicates this port should be treated as having a shared connection. A port connected to a hub is on a shared link, while one connected to a controller or service platform is a point-to-point link. Point-to-Point is the default setting.Cisco MSTP InteroperabilitySelect either the Enable or Disable radio buttons. This enables interoperability with Cisco’s version of MSTP, which is incompatible with standard MSTP. This setting is disabled by default.Force Protocol Version Sets the protocol version to either STP(0), Not Supported(1), RSTP(2) or MSTP(3). MSTP is the default setting.Guard Determines whether the port channel enforces root bridge placement. Setting the guard to Root ensures the port is a designated port. Typically, each guard root port is a designated port, unless two or more ports (within the root bridge) are connected together. If the bridge receives superior (BPDUs) on a guard root-enabled port, the guard root moves the port to a root-inconsistent STP state. This state is equivalent to a listening state. No data is forwarded across the port. Thus, the guard root enforces the root bridge position.Speed Default Path Cost<=100000 bits/sec 200000000<=1000000 bits/sec 20000000<=10000000 bits/sec 2000000<=100000000 bits/sec 200000<=1000000000 bits/sec 20000<=10000000000 bits/sec 2000<=100000000000 bits/sec200<=1000000000000 bits/sec20>1000000000000 bits/sec2

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 8710 Define or override the following Switching Mode parameters to apply to the VM Interface configuration:11 Select OK to save the changes and overrides to the VM interface basic configuration. Select Reset to revert to the last saved configuration.12 Select the Security tab.Mode Select either the Access or Trunk radio button to set the VLAN switching mode over the VM interface. If Access is selected, the VM interface accepts packets only from the native VLAN. Frames are forwarded untagged with no 802.1Q header. All frames received on the VMIF port are expected as untagged and are mapped to the native VLAN. If the mode is set to Trunk, the VM interface allows packets from a list of VLANs you add to the trunk. A VM interface configured as Trunk supports multiple 802.1Q tagged VLANs and one Native VLAN which can be tagged or untagged. Access is the default setting.Native VLAN Use the spinner control to define a numerical Native VLAN ID from 1 - 4094. The native VLAN allows an Ethernet device to associate untagged frames to a VLAN when no 802.1Q frame is included in the frame. Additionally, the native VLAN is the VLAN untagged traffic will be directed over when using trunk mode. The default value is 1.Tag the Native VLAN Select this option to tag the native VLAN. Service platforms support the IEEE 802.1Q specification for tagging frames and coordinating VLANs between devices. IEEE 802.1Q adds four bytes to each frame identifying the VLAN ID for upstream VMIF that the frame belongs. If the upstream VMIF does not support IEEE 802.1Q tagging, it does not interpret the tagged frames. When VLAN tagging is required between VM interface ports, both VM interfaces must support tagging and be configured to accept tagged VLANs. When a frame is tagged, a 12 bit frame VLAN ID is added to the 802.1Q header, so upstream VM interfaces know which VLAN ID the frame belongs to. The 12 bit VLAN ID is read and the frame is forwarded to the appropriate VLAN. When a frame is received with no 802.1Q header, the upstream VMIF classifies the frame using the default or native VLAN assigned to the Trunk port. The native VLAN allows a VM interface to associate untagged frames to a VLAN when no 802.1Q frame is included in the frame. This setting is disabled by default.Allowed VLANs Selecting Trunk as the mode enables the Allowed VLANs parameter. Add VLANs that exclusively send packets over the VM interface. The available range is from 1 - 4094. The maximum number of entries is 256.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 93DFS Duration Set the DFS duration between 30 to 3,600 minutes. This is the duration for which the radio stays in the in the new channel. The default value is 90 minutes.Transmit Power Set the transmit power of the selected Access Point radio. If using a dual or three radio model Access Point, each radio should be configured with a unique transmit power in respect to its intended client support function. Select the Smart RF option to let Smart RF determine the transmit power. A setting of 0 defines the radio as using Smart RF to determine its output power. 20 dBm is the default value. Antenna Gain Set the antenna between 0.00 - 15.00 dBm. The access point’s Power Management Antenna Configuration File (PMACF) automatically configures the access point’s radio transmit power based on the antenna type, its antenna gain (provided here) and the deployed country’s regulatory domain restrictions. Once provided, the access point calculates the power range. Antenna gain relates the intensity of an antenna in a given direction to the intensity that would be produced ideally by an antenna that radiates equally in all directions (isotropically), and has no losses. Although the gain of an antenna is directly related to its directivity, its gain is a measure that takes into account the efficiency of the antenna as well as its directional capabilities. Only a professional installer should set the antenna gain. The default value is 0.00.Antenna Mode Set the number of transmit and receive antennas on the Access Point. 1x1 is used for transmissions over just the single “A” antenna, 1x3 is used for transmissions over the “A” antenna and all three antennas for receiving. 2x2 is used for transmissions and receipts over two antennas for dual antenna models. The default setting is dynamic based on the Access Point model deployed and its transmit power settings.Enable Antenna DiversitySelect this option to enable antenna diversity on supported antennas. Antenna diversity uses two or more antennas to increase signal quality and strength. This option is disabled by default.Adaptivity Recovery Select this option to switch channels when an Access Point‘s radio is in adaptivity mode. In adaptivity mode, an Access Point monitors interference on its set channel and stops functioning when the radio’s defined interference tolerance level is exceeded. When the defined adaptivity timeout is exceeded, the radio resumes functionality on a different channel. This option is enabled by default.Adaptivity Timeout Set the adaptivity timeout from 30 to 3,600 minutes. The default setting is 90 minutes. Wireless Client PowerSelect this option to specify the transmit power on supported wireless clients. If this is enabled set a client power level between 0 to 20 dBm. This option is disabled by default.Dynamic Chain SelectionSelect this option for the radio to dynamically change the number of transmit chains. This option is enabled by default.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 94Rate Use the Select button to set rate options depending on the 802.11 protocols selected. If the radio band is set to Sensor or Detector, the Data Rates drop-down menu is not enabled, as the rates are fixed and not user configurable. If 2.4 GHz is selected as the radio band, select separate 802.11b, 802.11g and 802.11n rates and define how they are used in combination. If 5 GHz is selected as the radio band, select separate 802.11a and 802.11n rates then define how they are used together. When using 802.11n (in either the 2.4 or 5 GHz band), Set a MCS (modulation and coding scheme) in respect to the radio’s channel width and guard interval. A MCS defines (based on RF channel conditions) an optimal combination of 8 data rates, bonded channels, multiple spatial streams, different guard intervals and modulation types. Clients can associate as long as they support basic MCS (as well as non-11n basic rates).If dedicating an AP81XX model radio to either 2.4 or 5 Ghz support, a Custom Rates option is available to set a modulation and coding scheme (MCS) in respect to the radio’s channel width and guard interval. A MCS defines (based on RF channel conditions) an optimal combination of rates, bonded channels, multiple spatial streams, different guard intervals and modulation types. Clients can associate as long as they support basic MCS (as well as non-11n basic rates). If Basic is selected within the 802.11n Rates field, the MCS0-7 option is auto selected as a Supported rate and that option is greyed out. If Basic is not selected, any combination of MCS0-7, MCS8-15 and MCS16-23 can be supported, including a case where MCS0-7 and MCS16-23 are selected and not MCS8-15. The MCS0-7 and MCS8-15 options are available to each support Access Point. However, the MCS16-23 option is only available to AP81XX model Access Points and its ability to provide 3x3x3 MIMO support.Radio Placement Use the drop-down menu to specify whether the radio is located Indoors or Outdoors. The placement should depend on the country of operation selected and its regulatory domain requirements for radio emissions. The default setting is Indoors.Max Clients Use the spinner control to set a maximum permissible number of clients to connect with this radio. The available range is from 0 - 256 clients. The default is 256.Rate Selection MethodsSpecify a radio selection method for the radio. The selection methods are:Standard - standard monotonic radio selection method will be used.Opportunistic - sets opportunistic radio link adaptation (ORLA) as the radio selection method. This mode uses opportunistic data rate selection to provide the best throughput. The ORLA rate selection mode is supported only on the AP7161 and AP8163 model Access Points.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 9818 Refer to the Preferred Peer Devices table to add mesh peers. For each peer being added enter its MAC Address and a Priority from 1 - 6. The lower the priority number assigned, the higher the priority it’s given when connecting to the mesh infrastructure.19 Select the + Add Row button to add preferred peer devices for the radio to connect to in mesh mode.20 Select the Client Bridge Settings tab to configure the selected radio as a client-bridge. Note, before configuring the client-bridge parameters, set the radio's rf-mode to bridge.An Access Point's radio can be configured to form a bridge between its wireless/wired clients and an infrastructure WLAN. The bridge radio authenticates and associates with an infrastructure WLAN Access Point. After successful association, the Access Point switches frames between its bridge radio and wired/wireless client(s) connected either to its GE port(s) or to the other radio, there by providing the clients access to the infrastructure WLAN resources. This feature is supported only on the AP6522, AP6562, AP7602, AP7532, AP7562, AP7602, and AP7622 model Access Points.Mesh Links Specify the number of mesh links allowed by the radio. The radio can have from 1- 6 mesh links when the radio is configured as a Portal.Mesh PSK Provide the encryption key in either ASCII or Hex format. Administrators must ensure this key is configured on the Access Point when staged for mesh, added to the mesh client and to the portal Access Point’s configuration on the controller or service platform. Select Show to expose the characters used in the PSK.NOTE: Only single hop mesh links are supported at this time.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 10022 Refer to the EAP Parameters field and define the following EAP authentication parameters:23 Refer to the Channel Lists field and define the list of channels the client-bridge radio scans when scanning for an infrastructure WLAN.24 Refer to the Keepalive Parameters field and define the following configurations:Channel Dwell Time Set the channel-dwell time from 50 to 2000 milliseconds. This is the time the client-bridge radio dwells on each channel (configured in the list of channels) when scanning for an infrastructure WLAN. The default is 150 milliseconds.Authentication Set the mode of authentication with the infrastructure WLAN. The authentication mode specified here should be the same as that configured on the infrastructure WLAN. The options are None and EAP. If selecting EAP, specify the EAP authentication parameters. The default setting in None.For information on WLAN authentication, see Configuring WLAN Security.Encryption Set the packet encryption mode. The encryption mode specified here should be the same as that configured on the infrastructure WLAN. The options are None, CCMP and TKIP. The default setting is None. For information on WLAN encryption, see Configuring WLAN Security.Type Use the drop-down menu to select the EAP authentication method used by the supplicant. The options are TLS and PEAP-MS-CHAPv2. The default EAP type is PEAP-MS-CHAPv2.Username Set the 32 character maximum user name for an EAP authentication credential exchange.Password Set the 32 character maximum password for the EAP user name specified above.Pre-shared Key Set the pre-shared key (PSK) used with EAP. Note, the authenticating algorithm and PSK configured should be same as that on the infrastructure WLAN.Handshake Basic RateSet the basic rate of exchange of handshake packets between the client-bridge and infrastructure WLAN Access Points. The options are highest and normal. The default value is highest.Band A Define a list of channels for scanning across all the channels in the 5.0 GHz radio band.Band BG Define a list of channels for scanning across all the channels in the 2.4 GHz radio band.Keepalive Type Set the keepalive frame type exchanged between the client-bridge and infrastructure Access Points. This is the type of packets exchanged between the client-bridge and infrastructure Access Points, at specified intervals, to keep the client-bridge link up and active. The options are null-data and WNMP packets. The default value is null-data.

Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 10125 Refer to the Radio Link Behaviour field and define the following configurations:26 Refer to the Roam Criteria field and define the following configuration:27 Select OK to save or override the changes to the Client Bridge Settings screen. Select Reset to revert to the last saved configuration.28 Select the Advanced Settings tab.Keepalive Interval Set the keepalive interval from 0 - 86,400 seconds. This is the interval between two successive keepalive frames exchanged between the client-bridge and infrastructure Access Points. The default value is 300 seconds.Inactivity Timeout Set the inactivity timeout for each bridge MAC address from 0 - 8,64,000 seconds. This is the time for which the client-bridge access point waits before deleting a wired/wireless client’s MAC address from which a frame has not been received for more than the time specified here. For example, if the inactivity time is set at 120 seconds, and if no frames are received from a client (MAC address) for 120 seconds, it is deleted. The default value is 600 seconds.Shutdown Other Radio when Link Goes DownSelect this option to enable shutting down of the non-client bridge radio (this is the radio to which wireless-clients associate) when the link between the client-bridge and infrastructure access points is lost. When enabled, wireless clients associated with the non-client bridge radio are pushed to search for and associate with other access points having backhaul connectivity. This option is disabled by default.If enabling this option, specify the time for which the non-client bridge radio is shut down. Use the spinner to specify a time from 1 - 1,800 seconds.Refresh VLAN Interface when Link Comes UpSelect this option to enable the SVI to refresh on re-establishing client bridge link to the infrastructure Access Point. And, if using a DHCP assigned IP address, it also causes a DHCP renew. This option is enabled by default.Seconds for Missed BeaconsSet this interval from 0 to 60 seconds. This is the time for which the client-bridge Access Point waits, after missing a beacon from the associated infrastructure WLAN Access Point, before roaming to another infrastructure Access Point. For example, if the Seconds for Missed Beacon is set to 30 seconds, and if more than 30 seconds have passed since the last beacon received from the infrastructure Access Point, the client-bridge Access Point resumes scanning for another infrastructure Access Point. The default value s 20 seconds.Minimum Signal StrengthSet the minimum signal-strength threshold for signals received from the infrastructure Access Point. Specify a value from -128 to -40 dBm. If the RSSI value of signals received from the infrastructure access point falls below the value specified here, the client-bridge access point resumes scanning for another infrastructure access point. The default is -75 dBm.

$Device ConfigurationWireless Controller and Service Platform System Reference Guide 5 - 10331 Use the Airtime Fairness fields to optionally prioritize wireless access to devices.Select Enable Fair Access to enable this feature and provide equal access client access to radio resources. Select Prefer High Throughput Clients to prioritize clients with higher throughput (802.11n clients) over clients with slower throughput (802.11 a/b/g) clients. Use the spinner control to set a weight for the higher throughput clients.32 Set or override the following Miscellaneous advanced radio settings: 33 Set or override the following Aeroscout Properties: RIFS Mode Define a RIFS mode to determine whether interframe spacing is applied to Access Point transmissions or received packets, both, or neither The default mode is Transmit and Receive. Interframe spacing is an interval between two consecutive Ethernet frames to enable a brief recovery between packets and allow target devices to prepare for the reception of the next packet. Consider setting this value to None for high priority traffic to reduce packet delay.STBC Mode Select a space–time block coding (STBC) option to transmit multiple data stream copies across Access Point antennas to improve signal reliability. An Access Point’s transmitted signal traverses a problematic environment, with scattering, reflection and refraction all prevalent. The signal can be further corrupted by noise at the receiver. Consequently, some of the received data copies are less corrupt and better than others. This redundancy means there’s a greater chance of using one, or more, of the received copies to successfully decode the signal. STBC effectively combines all the signal copies to extract as much information from each as possible.Transmit BeamformingEnable beamforming to steer signals to peers in a specific direction to enhance signal strength and improve throughput amongst meshed devices (not clients). Each Access Point radio support up to 16 beamforming capable mesh peers. When enabled, a beamformer steers its wireless signals to its peers. A beamformee device assists the beamformer with channel estimation by providing a feedback matrix. The feedback matrix is a set of values sent by the beamformee to assist the beamformer in computing a steering matrix. A steering matrix is an additional set of values used to steer wireless signals at the beamformer so constructive signals arrive at the beamformee for better SNR and throughput. Any beamforming capable mesh peer connecting to a radio whose capacity is exhausted cannot enable beamforming itself. Transmit beamforming is available on AP81XX (AP8122, AP8132 and AP8163) model Access Points only, and is disabled by default.Forwarding Host Specify the Aeroscout engine’s IP address. When specified, the AP forwards Aeroscout beacons directly to the Aeroscout locationing engine without proxying through the controller or RF Domain manager.Note: Aeroscout beacon forwarding is supported only on the AP6532, AP7502, AP7522, AP7532, AP7562, AP8432, AP8533 model Access Points.Forwarding Port Use the spinner control to set the port on which the Aeroscout engine is reachable.MAC to be forwarded Specify the MAC address to be forwarded.$