Siemens Communications AP36V1B HiPath Wireless Access Point, Altitude 450, Altitude 451 User Manual User s guide
Siemens Communications, Inc. HiPath Wireless Access Point, Altitude 450, Altitude 451 User s guide
UserManual.wiki
>
Siemens Communications
>
AP36V1B User Manual
>
User's guide
Contents
1.
User Manual Part 1
2.
User Manual Part 2
3.
User's Guide
4.
User's guide
5.
users guide
User's guide
Navigation menu
Upload a User Manual
Namespaces
Wiki Guide
HTML
PDF
Info
Views
User Manual
Discussion / Help
Navigation
![hwc_pref.fmAbout this GuideAdditional documentation9034530-02, March 2010HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide 5 •Bold text is used to identify components of the management interface, such as menu items and section of pages, as well as the names of buttons and text boxes.For example: Click Logout.•Monospace font is used in code examples and to indicate text that you type.For example: Type https://<hwc-address>[:mgmt-port>]•The following notes are used to draw your attention to additional information:Note: Notes identify useful information, such as reminders, tips, or other ways to perform a task.Caution: Cautionary notes identify essential information, which if ignored can adversely affect the operation of your equipment or software.Warning: Warning notes identify essential information, which if ignored can lead to personal injury or harm.1.4 Additional documentationFor additional HiPath Wireless documentation, see the HiPath Wireless documentation athttp://www.enterasys.com/support/manuals1.5 Getting HelpFor additional support related to the product or this document, contact Enterasys Networks using one of the following methods:World Wide Web www.enterasys.com/supportPhone 1-800-872-8440 (toll-free in U.S. and Canada) or 1-978-684-1000To find the Enterasys Networks Support toll-free number in your country: www.enterasys.com/supportInternet mail support@enterasys.comTo expedite your message, type HiPath Wireless in the subject line](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-5.png)
![hwc_startup.fmConfiguring the HiPath Wireless ControllerSystem configuration overview9034530-02, March 2010HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide 41 Configure for remote accessIn addition, the first time setup also involves configuring the HiPath Wireless Controller for remote access, which includes:•Setting up an administration station (laptop) on subnet 192.168.10.0/24. By default, the HiPath Wireless Controller's Management interface is configured with the static IP address 192.168.10.1.•Configuring the HiPath Wireless Controller’s management interface.•Configuring the data interfaces.Set up the HiPath Wireless Controller on the network by configuring the physical data ports.•Configure the routing table.Configure static routes or OSPF parameters, if appropriate to the network.For more information, see Section 3.4, “Configuring the HiPath Wireless Controller for the first time”, on page 50.Step 5 – Configure the TopologiesConfigure the traffic topologies your network must support. Topologies represent the Controller’s points of network attachment, therefore VLANs and port assignments need to be coordinated with the corresponding network switch ports. For more information, see Section 6.8, “Configuring a Topology”, on page 296.Step 6 – Configure PoliciesPolicies are typically bound to Topologies. Policy application assigns user traffic to the corresponding network point.•Policies define user access rights (filtering or ACL)•Polices reference user's rate control profile.For more information, see Section 6.10, “Configuring Policy”, on page 350.Step 7 – Configure WLAN Services•Define SSID and privacy settings for the wireless link.•Select the set of APs/Radios on which the service is present.•Configure the method of credential authentication for wireless users (None, Internal CP, External CP, GuestPortal, 802.1x[EAP]) For more information, see Section 6.9, “Configuring WLAN Services”, on page 308.](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-41.png)
![Configuring the HiPath Wireless Controllerhwc_startup.fmConfiguring the HiPath Wireless Controller for the first time 9034530-02, March 201068 HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide Locally at Controller, will no longer be able to target ESA0 to gain management access to the system. In order to allow access for users connected on such a topology, the given topology configuration itself must have allow management traffic enabled and users will only be able to target the topology interface specifically.On the HiPath Wireless Controller’s L3 interfaces (associated with either physical, Routed, or Bridged Locally at Controller topologies), the built-in exception filter prohibits invoking SSH, HTTPS, or SNMP. However, such traffic is allowed, by default, on the management port.If management traffic is explicitly enabled for any interface, access is implicitly extended to that interface through any of the other interfaces (VNS). Only traffic specifically allowed by the interface’s exception filter is allowed to reach the HiPath Wireless Controller itself. All other traffic is dropped. Exception filters are dynamically configured and regenerated whenever the system's interface topology changes (for example, a change of IP address for any interface). Enabling management traffic on an interface adds additional rules to the exception filter, which opens up the well-known IP(TCP/UDP) ports, corresponding to the HTTPS, SSH, and SNMP applications.The interface-based built-in exception filtering rules, in the case of traffic from wireless users, are applicable to traffic targeted directly for the topology L3 interface. For example, a filter specified by a Policy may be generic enough to allow traffic access to the HiPath Wireless Controller's management (for example, Allow All [*.*.*.*]). Exception filter rules are evaluated after the user's assigned filter policy, as such, it is possible that the policy allows the access to management functions that the exception filter denies. These packets are dropped. To enable SSH, HTTPS, or SNMP access through a physical data interface:1. From the main menu, click Wireless Controller Configuration. The HiPath Wireless Controller Configuration screen is displayed.2. In the left pane, click Topology. The Topologies tab is displayed.](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-68.png)
![Virtual Network Services conceptshwc_vnsintro.fmFiltering 9034530-02, March 2010238 HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide • Authentication by captive portal The non-authenticated filter will apply before authentication. Specific network access can be defined. The filter should also include a rule to allow all users to get as far as the Captive Portal Web page where the user can enter login identification for authentication. When authentication is returned, the filter ID determines what Policy, and therefore filters, are applied. If no filter ID matches are found, then the default filter is applied. The filter ID is an optional behavior specification. If a filter ID is not returned, or an invalid one is returned, the default filter is applied. • Authentication by 802.1xWhen authentication by 802.1x is configured, user authentication is completed using the 802.1x/EAP protocol before a user is granted access to a network resource. Therefore, the enforcement of non-authenticated traffic rules is not applicable. When authentication is returned, then the filter ID determines what Policy, and therefore filters, are applied to the user.The following is a high-level description of how HiPath Wireless Controller filters traffic:Step One – The HiPath Wireless Controller attempts to match each packet of a VNS to the filtering rules (that is, Policy) that apply to the wireless device user.Step Two – If a filtering rule is matched, the operation to allow or deny is executed.Step Three – The next packet is fetched for filtering.5.6.3 Legacy compatibility with Policy-based filtering and VNS assignmentPrior to V7.0, policy re-assignments were made through the return of special attributes in the RADIUS Accept message. These attributes included:•“Login-Lat-Group” and “Tunnel-Private-Group-ID” to assign the user to a child VNS context•“Filter ID” to assign the user to a specified Filter Group.At V7.0, the upgrade process converts and generates the necessary relationships for all elements of a VNS.Each Filter Group definition for a VNS becomes a new Policy, with the Policy name determined by VNS hierarchy. The Policy name is created by adding the internal context to the RADIUS-returned attributes. For example:Policy name = <parent VNS>[ :<Login-Lat-Group>] : FilterID | “Default”](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-238.png)
![Configuring a VNShwc_vnsconfiguration.fmHigh level VNS configuration flow 9034530-02, March 2010244 HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide You can use the VNS Creation Wizard to guide you through the necessary steps to create a virtual network service (and the necessary subcomponents during the process). The end result is a fully resolved set of elements and an active service.The recommended order of configuration events is:1. Before you begin, draft out the type of services the system is expected to provide – wireless services, encryption types, infrastructure mapping (VLANs), and connectivity points (switch ports). Switch port VLAN configuration/trunks must match the controller's.2. Set up basic controller services such as NTP, Routing, DNS, and RADIUS Servers, using one of the following methods:•Run the Basic Configuration Wizard, or•Manually define the necessary infrastructure components such as RADIUS Servers. RADIUS Servers are defined via the VNS Configuration > Global > Authentication tab.3. Define Topologies. Topologies represent the controller’s points of network attachment. Therefore, VLANs and port assignments need to be coordinated with the corresponding switch ports.4. Define Policies. Policies are typically bound to Topologies. Policy application assigns user traffic to the corresponding network point of attachment.•Policies define mobile user access rights by filtering.•Polices reference the mobile user's traffic rate control profiles. 5. Define the WLAN Service.•Define SSID and privacy settings for the wireless link. •Select the set of APs and Radios on which the service is present.•Configure the method of credential authentication for wireless users (None, Internal CP, External CP, GuestPortal, 802.1x[EAP]). 6. Create a VNS that binds the WLAN Service to the Policy that will be used for default assignment upon user network attachment. The VNS configuration page in turn allows for in-place creation of any dependencies it may require. For example:•Create a new WLAN Service.•Create a new Policy.– Create a new Topology.– Create new ingress and egress rate control policies.](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-244.png)
![hwc_vnsconfiguration.fmConfiguring a VNSConfiguring Policy9034530-02, March 2010HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide 357 Note: For external Captive Portal, an additional rule to Allow (in/out) access to the external Captive Portal authentication/Web server is required.If you place URLs in the header and footer of the Captive Portal page, you must explicitly allow access to any URLs mentioned in the authentication's server page, such as:• Internal Captive Portal – URLs referenced in a header or footer• External Captive Portal – URLs mentioned in the page definitionHere is another example of a non-authenticated filter that adds two more filtering rules. The two additional rules do the following: •Deny access to a specific IP address.•Allows only HTTP traffic.Once a wireless device user has logged in on the Captive Portal page, and has been authenticated by the RADIUS server, then the following filters will apply:• Policy filters – If a filter ID associated with this user was returned by the authentication server, then the Policy with the same name as the filter ID will be applied.In Out Allow IP / Port Descriptionx x x IP address of default gateway (VNS Interface IP)Allow all incoming wireless devices access to the default gateway of the VNS.x x x IP address of the DNS ServerAllow all incoming wireless devices access to the DNS server of the VNS.x x *.*.*.* Deny everything else.Table 28 Non-authenticated filter example AIn Out Allow IP / Port Descriptionx x x IP address of the default gatewayAllow all incoming wireless devices access to the default gateway of the VNS.x x x IP address of the DNS ServerAllow all incoming wireless devices access to the DNS server of the VNS.x x [a specific IP address, or address plus range]Deny all traffic to a specific IP address, or to a specific IP address range (such as:0/24).x x x *.*.*.*:80 Allow all port 80 (HTTP) traffic.x x *.*.*.* Deny everything else. Table 29 Non-authenticated filter example B](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-357.png)
![Configuring a VNShwc_vnsconfiguration.fmConfiguring Policy 9034530-02, March 2010358 HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide • Default filter – If no matching filter ID was returned from the authentication server.6.10.3.2 Authenticated filter examplesBelow are two examples of possible filtering rules for authenticated users. The first example disallows some specific access before allowing everything else.The second example does the opposite of the first example. It allows some specific access and denies everything else. 6.10.4 ICMP Type enforcementICMP filter rules can now be constrained to ICMP type/range. You can define the ICMP type/range in the Port field using the TCP/UDP port definition nomenclature. That is, define the rule as a normal IP/subnet:port signature (10.0.0.0/24:8), where the ICMP type is entered in the Port field.This feature allows for tighter granularity over enforcement of ICMP restrictions. You can allow redirects and DF/MTU indications, and deny ICMP Echo (pings) for users.6.10.5 Filtering rules for a default filterAfter authentication of the wireless device user, the default filter will apply only after:•No match is found for the Exception filter rules.In Out Allow IP / Port Descriptionx x *.*.*.*:22-23 SSH and telnet sessionsx x [specific IP address, range]Deny all traffic to a specific IP address or address rangex x x *.*.*.*. Allow everything elseTable 30 Filtering rules example AIn Out Allow IP / Port Descriptionx x x [specific IP address, range]Allow traffic to a specific IP address or address range.x x *.*.*.*. Deny everything else.Table 31 Filtering rules example B](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-358.png)
![Configuring a VNShwc_vnsconfiguration.fmConfiguring Policy 9034530-02, March 2010360 HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide 6.10.6 Defining filter rules for Wireless APsYou can also apply filter rules on the Wireless AP. Applying filter rules at the Wireless AP helps restrict unwanted traffic at the edge of your network. The Wireless APs can support up to a maximum of 32 filters rules per group. Filtering at the Wireless AP can be configured with the following Topology types:• Bridge Traffic Locally at the AP – If filtering at the Wireless AP is enabled on a Bridge Traffic Locally at the AP topology, the filtering is applied to traffic in both the uplink and downlink direction — the uplink direction is from the wireless device to the network, and downlink direction is from the network to the wireless device.•Routed and Bridge Traffic Locally at the HWC – If filtering at the Wireless AP is enabled on a Routed or Bridge Traffic Locally at the HWC topoloty, the filtering is applied only to traffic in the UL direction. The filters applied in the UL direction at the Wireless AP can be the same or different from filters applied at the HiPath Wireless Controller.Wireless AP filteringWhen filtering at the Wireless AP is enabled, Wireless APs obtain client filter information from the HiPath Wireless Controller. In addition, direct inter-Wireless AP communication allow Wireless APs to exchange client filter information as clients roam from one Wireless AP to another. This allows the system to achieve a very fast roaming time. To take advantage of inter-Wireless AP communication, you should configure the network so that Wireless APs in the mobility domain can communicate with each other through the Wireless AP's Ethernet interface. Also, multicast traffic with an IP address of 224.0.1.178 should be allowed between Wireless APs.To define filter rules to be applied by Wireless APs:1. From the main menu, click Virtual Network Configuration. The Virtual Network Configuration screen is displayed.2. In the left pane expand the Policies pane and click the Policy you want to edit, or click the New button to create a new Policy. The Policy tab is displayed.In Out Allow IP / Port Descriptionx x x [Intranet IP] Allow access to the Gateway IP address of the VNS onlyx x [Intranet IP, range] Deny all access to the VNS subnet range (such as 0/24)x x x *.*.*.*. Allow everything elseTable 34 Rules between two wireless devices](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-360.png)
![hwc_fastfailover.fmAvailability and session availabilitySession availability9034530-02, March 2010HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide 401 3. Check the statement at the top of the screen. If the statement reads Availability link is up, the availability feature is configured correctly. If the statement reads Availability link is down, check the configuration error in logs. For more information on logs, see the HiPath Wireless Controller, Access Points and Convergence Software Maintenance Guide.7.4.2.3 To verify synchronizationTo verify that all elements have been synchronized correctly, navigate to the VNS tab on both the primary and secondary HiPath Wireless Controllers, and confirm that the topologies, WLAN services, policies and desired VNSs aredisplayed as [synchronized]. This can be verified by selecting the apropriate tabs and then inspecting the Synchronized flags or by navigating to VNS Configuration, Global, and then Sync Summary page.](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-401.png)
![Performing system administrationhwc_ongoing.fmDefining HiPath Wireless Assistant administrators and login groups 9034530-02, March 2010454 HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide • GuestPortal managers – Users assigned to this login group can only manage GuestPortal user accounts. Any user who logs on to the HiPath Wireless Controller and is assigned to this group can only access the GuestPortal Guest Administration page of the HiPath Wireless Assistant. Note: When adding or modifying a user, note the following password character constraints:• Allowed characters include A-Z a-z 0-9 ~!@#$%^&*()_+|-=\{}[];<>?,.• Characters not allowed include / ` ' " : and space is not valid.To add a HiPath Wireless Controller administrator to a login group:1. From the main menu, click Wireless Controller Configuration. The Wireless Controller Configuration screen is displayed.2. In the left pane, click Login Management. The Local Authentication tab is displayed.3. In the Group drop-down list, click one of the following:• Full Administrator – Users assigned to this login group have full administrator access rights on the HiPath Wireless Controller. Full administrators can manage GuestPortal user accounts.• Read-only Administrator – Users assigned to this login group have read-only access rights on the HiPath Wireless Controller.Read-only administrators have read access to the GuestPortal user accounts.](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-454.png)
![Glossaryhwc_glossary.fmNetworking terms and abbreviations 9034530-02, March 2010472 HiPath Wireless Controller, Access Points and Convergence Software V7.11, User Guide ELA (OPSEC) Event Logging API (Application Program Interface) for OPSEC, a module in Check Point used to enable third-party applications to log events into the Check Point VPN-1/FireWall-1 management system. Encapsulation See tunnelling.ESS Extended Service Set (ESS). Several Basic Service Sets (BSSs) can be joined together to form one logical WLAN segment, referred to as an extended service set (ESS). The SSID is used to identify the ESS. (See BSS and SSID.)FHSS Frequency-Hopping Spread Spectrum. A transmission technology used in Local Area Wireless Network (LAWN) transmissions where the data signal is modulated with a narrowband carrier signal that ‘hops’ in a random but predictable sequence from frequency to frequency as a function of time over a wide band of frequencies. This technique reduces interference. If synchronized properly, a single logical channel is maintained. (Compare DSSS)Fit, thin and fat APs A thin AP architecture uses two components: an access point that is essentially a stripped-down radio and a centralized management controller that handles the other WLAN system functions. Wired network switches are also required. A fit AP, a variation of the thin AP, handles the RF and encryption, while the central management controller, aware of the wireless users' identities and locations, handles secure roaming, quality of service, and user authentication. The central management controller also handles AP configuration and management. A fat (or thick) AP architecture concentrates all the WLAN intelligence in the access point. The AP handles the radio frequency (RF) communication, as well as authenticating users, encrypting communications, secure roaming, WLAN management, and in some cases, network routing. FQDN Fully Qualified Domain Name. A ‘friendly’ designation of a computer, of the general form computer.[subnetwork.].organization.domain. The FQDN names must be translated into an IP address in order for the resource to be found on a network, usually performed by a Domain Name Server.FTM Forwarding Table ManagerFTP File Transfer ProtocolGateway In the wireless world, an access point with additional software capabilities such as providing NAT and DHCP. Gateways may also provide VPN support, roaming, firewalls, various levels of security, etc. Gigabit Ethernet The high data rate of the Ethernet standard, supporting data rates of 1 gigabit (1,000 megabits) per second.GUI Graphical User InterfaceHeartbeat message A heartbeat message is a UDP data packet used to monitor a data connection, polling to see if the connection is still alive.In general terms, a heartbeat is a signal emitted at regular intervals by software to demonstrate that it is still alive. In networking, a heartbeat is the signal emitted by a Level 2 Ethernet transceiver at the end of every packet to show that the collision-detection circuit is still connected.Host (1) A computer (usually containing data) that is accessed by a user working on a remote terminal, connected by modems and telephone lines. (2) A computer that is connected to a TCP/IP network, including the Internet. Each host has a unique IP address.Term Explanation](https://usermanual.wiki/Siemens-Communications/AP36V1B.User-s-guide/User-Guide-1252792-Page-472.png)
