Cambium Networks XR2425H 802.11abgn (2x2) access point for outdoor installations User Manual xirrus PDF

Xirrus, Inc. 802.11abgn (2x2) access point for outdoor installations xirrus PDF

ArrayOS XR_User Guide_Rel_6.7a_RevJ (1of2)

High Performance Wireless NetworksWireless Arrays and Access PointsUSER’S GUIDEXR Series November 26, 2013 Release 6.7

All rights reserved. This document may not be reproduced or disclosed in whole or in part by any means without the written consent of Xirrus, Inc.Part Number: 800-0022-001(Revision J) Wireless Arrays™ and Access PointsXR Series

Wireless ArrayiTable of ContentsList of Figures.................................................................................... xiiiIntroduction ......................................................................................... 1The Xirrus Family of Products ............................................................................... 1Nomenclature .................................................................................................... 2Why Choose the Xirrus Wireless Array? .............................................................. 3Wireless Array Product Overview ........................................................................ 4XR Wireless Array Product Family ................................................................ 6XR-500 Series Access Points ..................................................................... 6XR-600 Series Access Points ..................................................................... 7XR-1000 ....................................................................................................... 8XR-2000 Series Arrays ............................................................................... 9XR-4000 Series Arrays ............................................................................. 10XR-6000 Series Arrays ............................................................................. 11Enterprise Class Security ............................................................................... 12Deployment Flexibility .................................................................................. 12Power over Gigabit Ethernet (PoGE) .................................................... 13Enterprise Class Management ...................................................................... 14Key Features and Benefits ..................................................................................... 15High Capacity and High Performance ........................................................ 15Extended Coverage ......................................................................................... 16Non-Overlapping Channels .......................................................................... 16SDMA Optimization ...................................................................................... 16Fast Roaming ................................................................................................... 16Ease of Deployment ........................................................................................ 16Powerful Management ................................................................................... 17Secure Wireless Access .................................................................................. 17Applications Enablement .............................................................................. 17Advanced Feature Sets .......................................................................................... 17Xirrus Advanced RF Performance Manager (RPM) .................................. 17Xirrus Advanced RF Security Manager (RSM) .......................................... 18Xirrus Advanced RF Analysis Manager (RAM) ......................................... 19Xirrus Application Control ............................................................................ 20

Wireless ArrayiiAbout this User’s Guide ........................................................................................ 21Organization .................................................................................................... 21Notes and Cautions ........................................................................................ 23Screen Images .................................................................................................. 23Product Specifications ........................................................................................... 24Installing the Wireless Array........................................................... 25Installation Prerequisites ...................................................................................... 25Optional Network Components ................................................................... 27Client Requirements ....................................................................................... 27Planning Your Installation .................................................................................... 28General Deployment Considerations .......................................................... 28Coverage and Capacity Planning ................................................................. 30Placement .................................................................................................. 30RF Patterns ................................................................................................ 31Capacity and Cell Sizes ........................................................................... 32Fine Tuning Cell Sizes ............................................................................. 33Roaming Considerations ........................................................................ 34Allocating Channels ................................................................................ 34IEEE 802.11n Deployment Considerations ................................................. 37MIMO (Multiple-In Multiple-Out) ........................................................ 38Multiple Data Streams — Spatial Multiplexing ................................... 39Channel Bonding ..................................................................................... 40Improved MAC Throughput ................................................................. 41Short Guard Interval ............................................................................... 41Obtaining Higher Data Rates ................................................................. 42802.11n Capacity ...................................................................................... 43Failover Planning ............................................................................................ 43Switch Failover Protection ..................................................................... 45Power Planning ............................................................................................... 46Power over Gigabit Ethernet ................................................................. 46Security Planning ............................................................................................ 47Wireless Encryption ................................................................................ 47Authentication ......................................................................................... 47Port Requirements .......................................................................................... 49Network Management Planning .................................................................. 53WDS Planning ................................................................................................. 54

Wireless ArrayiiiCommon Deployment Options .................................................................... 57Installation Workflow ........................................................................................... 58Installing Your Wireless Array ............................................................................ 60Choosing a Location ....................................................................................... 60Wiring Considerations ............................................................................ 61Mounting and Connecting the Array ......................................................... 63Dismounting the Array .................................................................................. 63Powering Up the Wireless Array ......................................................................... 64Array LED Operating Sequences ................................................................. 65LED Boot Sequence ................................................................................. 65LED Operation when Array is Running .............................................. 66Establishing Communication .............................................................................. 67Zero-Touch Setup Using Mobilize ............................................................... 67User Interfaces (CLI, WMI) ........................................................................... 68Using the Serial Port ....................................................................................... 70Using the Ethernet Ports ................................................................................ 70Starting the WMI ............................................................................................. 71Logging In ........................................................................................................ 71Licensing ................................................................................................................. 71Performing the Express Setup Procedure ........................................................... 72Securing Low Level Access to the Array ..................................................... 73The Web Management Interface ................................................... 77XMS-Managed Arrays Restrict Local Management ......................................... 78An Overview .......................................................................................................... 80Structure of the WMI ............................................................................................. 82User Interface ......................................................................................................... 84Utility Buttons .......................................................................................... 87Logging In ............................................................................................................... 88Applying Configuration Changes ....................................................................... 88Character Restrictions .................................................................................... 89Viewing Status on the Wireless Array ........................................... 91Array Status Windows .......................................................................................... 92Array Summary .............................................................................................. 92Content of the Array Summary Window ............................................ 93Array Information .......................................................................................... 98

Wireless ArrayivArray Configuration ....................................................................................... 99Admin History .............................................................................................. 100Network Status Windows ................................................................................... 100Network ......................................................................................................... 101Network Map ................................................................................................ 102Content of the Network Map Window .............................................. 103Spanning Tree Status .................................................................................... 105Routing Table ................................................................................................ 106ARP Table ...................................................................................................... 106DHCP Leases ................................................................................................. 107Connection Tracking/NAT ......................................................................... 107CDP Neighbors ............................................................................................. 108Network Assurance ...................................................................................... 109Undefined VLANs ........................................................................................ 110RF Monitor Windows .......................................................................................... 111IAPs ................................................................................................................. 112Spectrum Analyzer ...................................................................................... 113Intrusion Detection ...................................................................................... 116Channel History ............................................................................................ 118Radio Assurance ........................................................................................... 120Station Status Windows ...................................................................................... 122Stations ........................................................................................................... 123Location Map ................................................................................................. 125RSSI ................................................................................................................. 129Signal-to-Noise Ratio (SNR) ........................................................................ 130Noise Floor ..................................................................................................... 132Max by IAP .................................................................................................... 134Station Assurance ......................................................................................... 135Statistics Windows ............................................................................................... 137IAP Statistics Summary ................................................................................ 137Per-IAP Statistics ........................................................................................... 138Network Statistics ......................................................................................... 140VLAN Statistics ............................................................................................. 141WDS Statistics ................................................................................................ 142IDS Statistics .................................................................................................. 143Filter Statistics ............................................................................................... 144Station Statistics ............................................................................................ 145

Wireless ArrayvPer-Station Statistics ..................................................................................... 146Application Control Windows ........................................................................... 147About Application Control ......................................................................... 147Application Control ...................................................................................... 149Stations (Application Control) .................................................................... 153System Log Window ........................................................................................... 154IDS Event Log Window ...................................................................................... 155Configuring the Wireless Array.................................................... 157Express Setup ........................................................................................................ 159Network ................................................................................................................. 165Network Interfaces ...................................................................................... 167Network Interface Ports ........................................................................ 168Network Bonds ............................................................................................. 171DNS Settings .................................................................................................. 177CDP Settings .................................................................................................. 178Services .................................................................................................................. 180Time Settings (NTP) ..................................................................................... 181NetFlow .......................................................................................................... 184Wi-Fi Tag ....................................................................................................... 185Location .......................................................................................................... 186System Log ..................................................................................................... 188About Using the Splunk Application for Xirrus Arrays .................. 191SNMP .............................................................................................................. 193DHCP Server ................................................................................................. 196VLANs ................................................................................................................... 199Understanding Virtual Tunnels .......................................................... 199VLAN Management ..................................................................................... 201Tunnels .................................................................................................................. 204About Xirrus Tunnels ........................................................................... 204Tunnel Management .................................................................................... 205SSID Assignments ......................................................................................... 207Security .................................................................................................................. 208Understanding Security ........................................................................ 209Certificates and Connecting Securely to the WMI ............................ 212Using the Array’s Default Certificate ................................................. 212Using an External Certificate Authority ............................................. 213

Wireless ArrayviAdmin Management .................................................................................... 214Admin Privileges .......................................................................................... 216Admin RADIUS ............................................................................................ 218About Creating Admin Accounts on the RADIUS Server ............. 218Management Control ................................................................................... 221Access Control List ....................................................................................... 228Global Settings .............................................................................................. 230External Radius ............................................................................................. 234About Creating User Accounts on the RADIUS Server .................. 235Internal Radius .............................................................................................. 238Rogue Control List ........................................................................................ 241OAuth 2.0 Management ............................................................................... 243SSIDs ...................................................................................................................... 245Understanding SSIDs ............................................................................ 246Understanding QoS Priority on the Wireless Array ........................ 247High Density 2.4G Enhancement—Honeypot SSID ......................... 252SSID Management ........................................................................................ 253SSID List (top of page) .......................................................................... 254SSID Limits ............................................................................................. 258Web Page Redirect Configuration Settings ....................................... 260Whitelist Configuration for Web Page Redirect .............................. 264WPA Configuration Settings .............................................................. 265RADIUS Configuration Settings ......................................................... 265Active IAPs .................................................................................................... 266Per-SSID Access Control List ...................................................................... 267Groups ................................................................................................................... 269Understanding Groups ......................................................................... 269Using Groups ......................................................................................... 270Group Management ..................................................................................... 271Group Limits .......................................................................................... 274IAPs ........................................................................................................................ 276Understanding Fast Roaming .............................................................. 278IAP Settings ................................................................................................... 279Global Settings (IAP) ................................................................................... 285Beacon Configuration ........................................................................... 287Station Management ............................................................................. 288Advanced Traffic Optimization .......................................................... 289

Wireless ArrayviiGlobal Settings .11an .................................................................................... 298Global Settings .11bgn .................................................................................. 303Global Settings .11n ...................................................................................... 309Global Settings .11ac ..................................................................................... 312Global Settings .11u ...................................................................................... 314Understanding 802.11u ......................................................................... 314Advanced RF Settings .................................................................................. 320About Standby Mode ............................................................................ 321RF Monitor .............................................................................................. 321RF Resilience .......................................................................................... 322RF Power & Sensitivity ......................................................................... 323RF Spectrum Management ................................................................... 324Station Assurance .................................................................................. 327Hotspot 2.0 ..................................................................................................... 329Understanding Hotspot 2.0 .................................................................. 329NAI Realms .................................................................................................... 331Understanding NAI Realm Authentication ....................................... 331NAI EAP ......................................................................................................... 332Intrusion Detection ....................................................................................... 334DoS Attacks ............................................................................................ 335Impersonation Attacks .......................................................................... 336About Blocking Rogue APs .................................................................. 337RF Intrusion Detection and Auto Block Mode .................................. 338DoS Attack Detection Settings ............................................................. 339Impersonation Detection Settings ....................................................... 340LED Settings .................................................................................................. 340DSCP Mappings ............................................................................................ 341Roaming Assist .............................................................................................. 342WDS ....................................................................................................................... 345About Configuring WDS Links ........................................................... 345Long Distance Links .............................................................................. 347WDS Client Links .......................................................................................... 347Filters ..................................................................................................................... 351Filter Lists ...................................................................................................... 352Filter Management ....................................................................................... 354Clusters .................................................................................................................. 360Cluster Definition ........................................................................................ 361

Wireless ArrayviiiCluster Management ................................................................................... 362Cluster Operation ........................................................................................ 363Mobile .................................................................................................................... 366AirWatch ........................................................................................................ 366User Procedure for Wireless Access ................................................... 368Using Tools on the Wireless Array............................................... 371System Tools ......................................................................................................... 372About Licensing and Upgrades ........................................................... 373System ..................................................................................................... 374Automatic Updates from Remote Image or Configuration File .... 376Configuration ......................................................................................... 377Diagnostics ............................................................................................. 380Application Control Signature File Management ............................. 381Web Page Redirect ................................................................................. 382Network Tools ........................................................................................ 383Progress and Status Frames ................................................................. 385CLI ......................................................................................................................... 385API Documentation ............................................................................................. 387Status/Settings ....................................................................................... 388GET Requests ......................................................................................... 389Trying a GET Request ........................................................................... 389API Documentation Toolbar ................................................................ 391Options .................................................................................................................. 392Logout .................................................................................................................... 395The Command Line Interface...................................................... 397Establishing a Secure Shell (SSH) Connection ................................................. 398Getting Started with the CLI .............................................................................. 399Inputting Commands ................................................................................... 399Getting Help .................................................................................................. 399Top Level Commands ......................................................................................... 401Root Command Prompt ............................................................................... 401configure Commands ................................................................................... 402show Commands .......................................................................................... 405statistics Commands ..................................................................................... 408Configuration Commands .................................................................................. 410

Wireless Arrayixacl .................................................................................................................... 410admin .............................................................................................................. 411auth ................................................................................................................. 412cdp ................................................................................................................... 412clear ................................................................................................................. 414cluster ............................................................................................................. 416contact-info .................................................................................................... 417date-time ........................................................................................................ 418dhcp-server .................................................................................................... 419dns ................................................................................................................... 420file .................................................................................................................... 421filter ................................................................................................................. 425Air Cleaner ............................................................................................. 426group .............................................................................................................. 429hostname ........................................................................................................ 429interface .......................................................................................................... 430load ................................................................................................................. 430location ........................................................................................................... 431location-reporting ......................................................................................... 432management .................................................................................................. 433mdm ................................................................................................................ 434more ................................................................................................................ 435netflow ............................................................................................................ 436no ..................................................................................................................... 437quick-config ................................................................................................... 439quit .................................................................................................................. 440radius-server .................................................................................................. 440reboot .............................................................................................................. 441reset ................................................................................................................. 441restore ............................................................................................................. 442roaming-assist ............................................................................................... 443run-tests .......................................................................................................... 444security ........................................................................................................... 446snmp ............................................................................................................... 447ssid .................................................................................................................. 448syslog .............................................................................................................. 449tunnel .............................................................................................................. 450

Wireless Arrayxuptime ............................................................................................................. 451vlan .................................................................................................................. 451wifi-tag ........................................................................................................... 452Sample Configuration Tasks .............................................................................. 454Configuring a Simple Open Global SSID .................................................. 455Configuring a Global SSID using WPA-PEAP ......................................... 456Configuring an SSID-Specific SSID using WPA-PEAP ........................... 457Enabling Global IAPs ................................................................................... 458Disabling Global IAPs .................................................................................. 459Enabling a Specific IAP ................................................................................ 460Disabling a Specific IAP ............................................................................... 461Setting Cell Size Auto-Configuration for All IAPs .................................. 462Setting the Cell Size for All IAPs ................................................................ 463Setting the Cell Size for a Specific IAP ....................................................... 464Configuring VLANs on an Open SSID ...................................................... 465Configuring Radio Assurance Mode (Loopback Tests) .......................... 466Appendices..................................................................................... 469Appendix A: Quick Reference Guide ............................................................... 471Factory Default Settings ...................................................................................... 471Host Name ..................................................................................................... 471Network Interfaces ....................................................................................... 471Serial ........................................................................................................ 471Gigabit 1 and Gigabit 2 ......................................................................... 472Server Settings ............................................................................................... 472NTP .......................................................................................................... 472Syslog ...................................................................................................... 472SNMP ...................................................................................................... 473DHCP .............................................................................................................. 473Default SSID .................................................................................................. 474Security .......................................................................................................... 474Global Settings - Encryption ............................................................... 474External RADIUS (Global) .................................................................. 475Internal RADIUS .................................................................................... 476Administrator Account and Password ...................................................... 476Management .................................................................................................. 476Keyboard Shortcuts ............................................................................................. 477

Wireless ArrayxiAppendix B: FAQ and Special Topics ............................................................... 479General Hints and Tips ....................................................................................... 479Frequently Asked Questions .............................................................................. 480Multiple SSIDs ............................................................................................... 480Security ........................................................................................................... 482VLAN Support .............................................................................................. 485Array Monitor and Radio Assurance Capabilities .......................................... 488Enabling Monitoring on the Array ..................................................... 488How Monitoring Works ............................................................................... 488Radio Assurance ........................................................................................... 489Radio Assurance Options ..................................................................... 490RADIUS Vendor Specific Attribute (VSA) for Xirrus ..................................... 491Location Service Data Formats .......................................................................... 492Euclid Location Server ................................................................................. 492Non-Euclid Location Server ........................................................................ 492Upgrading the Array via CLI ............................................................................. 494Sample Output for the Upgrade Procedure: ............................................. 495Contact Information ............................................................................................ 499Appendix C: Notices (Arrays except XR-500/600 and Models Ending in H) ............501Notices ................................................................................................................... 501EU Directive 1999/5/EC Compliance Information ........................................ 505Compliance Information (Non-EU) ................................................................... 512Safety Warnings ................................................................................................... 513Translated Safety Warnings ............................................................................... 514Software License and Product Warranty Agreement ..................................... 515Hardware Warranty Agreement ....................................................................... 521Appendix D: Notices (XR500/600 Series Only) ............................................. 523Notices ................................................................................................................... 523EU Directive 1999/5/EC Compliance Information ........................................ 527Compliance Information (Non-EU) ................................................................... 534Safety Warnings ................................................................................................... 535Translated Safety Warnings ............................................................................... 536Software License and Product Warranty Agreement ..................................... 537Hardware Warranty Agreement ....................................................................... 543

Wireless ArrayxiiAppendix E: Medical Usage Notices ................................................................ 545Glossary of Terms.......................................................................... 551Index................................................................................................ 563

Wireless ArrayList of Figures xiiiList of FiguresFigure 1. Xirrus Arrays: XR Series............................................................................ 1Figure 2. Wireless Array (XR Series) ........................................................................ 4Figure 3. Wireless Coverage Patterns .................................................................... 12Figure 4. XP8 - Power over Ethernet Usage .......................................................... 13Figure 5. WMI: Array Status.................................................................................... 14Figure 6. Layout of IAPs (XR-7630)........................................................................ 15Figure 7. Wall Thickness Considerations .............................................................. 29Figure 8. Unit Placement.......................................................................................... 30Figure 9. Full (Normal) Coverage........................................................................... 31Figure 10. Adjusting RF Patterns.............................................................................. 31Figure 11. Custom Coverage ..................................................................................... 32Figure 12. Connection Rate vs. Distance ................................................................. 32Figure 13. Transmit Power......................................................................................... 33Figure 14. Overlapping Cells..................................................................................... 34Figure 15. Allocating Channels Manually............................................................... 36Figure 16. Classic 802.11 Signal Transmission........................................................ 38Figure 17. MIMO Signal Processing......................................................................... 38Figure 18. Spatial Multiplexing................................................................................. 39Figure 19. Channel Bonding...................................................................................... 40Figure 20. MAC Throughput Improvements.......................................................... 41Figure 21. Computing 802.11n Data Rates .............................................................. 42Figure 22. Port Failover Protection........................................................................... 43Figure 23. Switch Failover Protection ..................................................................... 45Figure 24. Port Requirements for XMS .................................................................... 49Figure 25. WDS Link................................................................................................... 54Figure 26. A Multiple Hop WDS Connection ......................................................... 55Figure 27. WDS Failover Protection ......................................................................... 55Figure 28. Installation Workflow .............................................................................. 58Figure 29. Array Placement ....................................................................................... 60Figure 30. LED Locations........................................................................................... 64Figure 31. Network Interface Ports—XR-520 (left); XR-1000 Series (right) ....... 68Figure 32. Network Interfaces—XR-2000 Series (left); XR-2005 Series (right) ... 69Figure 33. Network Interface Ports—XR-4000 Series ............................................ 69Figure 34. Network Interface Ports—XR-6000 Series ............................................ 69

Wi-Fi Arrayxiv List of FiguresFigure 35. Notice for XMS-Managed Array ............................................................ 78Figure 36. Web Management Interface—Option = New Style............................. 80Figure 37. Web Management Interface—New Style (Default)............................. 80Figure 38. Web Management Interface—Option = Classic Style ......................... 81Figure 39. Web Management Interface—Classic Style.......................................... 81Figure 40. WMI: Frames............................................................................................. 84Figure 41. Major Menu Sections Collapsed (on left).............................................. 85Figure 42. WMI: Utility Buttons................................................................................ 87Figure 43. Logging In to the Wireless Array........................................................... 88Figure 44. Array Summary ........................................................................................ 92Figure 45. Disabled IAP (Partial View).................................................................... 95Figure 46. IAP Cells .................................................................................................... 95Figure 47. Network Assurance and Operating Status........................................... 96Figure 48. Array Information .................................................................................... 98Figure 49. Show Configuration ................................................................................. 99Figure 50. Admin Login History............................................................................. 100Figure 51. Network Settings .................................................................................... 101Figure 52. Network Map.......................................................................................... 102Figure 53. Spanning Tree Status.............................................................................. 105Figure 54. Routing Table.......................................................................................... 106Figure 55. ARP Table ................................................................................................ 106Figure 56. DHCP Leases........................................................................................... 107Figure 57. Connection Tracking.............................................................................. 107Figure 58. CDP Neighbors....................................................................................... 108Figure 59. Network Assurance................................................................................ 109Figure 60. Undefined VLANs.................................................................................. 110Figure 61. RF Monitor — IAPs ................................................................................. 112Figure 62. RF Monitor — IAPs ................................................................................. 112Figure 63. RF Spectrum Analyzer........................................................................... 114Figure 64. Intrusion Detection/Rogue AP List..................................................... 116Figure 65. RF Monitor — Channel History............................................................. 118Figure 66. RF Monitor — Channel History (Rotated) ........................................... 119Figure 67. RF Monitor — Channel History (Text) ................................................. 119Figure 68. Radio Assurance..................................................................................... 120Figure 69. Stations..................................................................................................... 123Figure 70. Location Map........................................................................................... 125Figure 71. Controls for Location Map.................................................................... 126

Wireless ArrayList of Figures xvFigure 72. Station RSSI Values ............................................................................... 129Figure 73. Station RSSI Values — Colorized Graphical View ............................ 129Figure 74. Station Signal-to-Noise Ratio Values .................................................. 130Figure 75. Station SNR Values — Colorized Graphical View.............................. 131Figure 76. Station Noise Floor Values ................................................................... 132Figure 77. Station Noise Floor Values — Colorized Graphical View ................ 133Figure 78. Max by IAP.............................................................................................. 134Figure 79. Station Assurance ................................................................................... 135Figure 80. IAP Statistics Summary Page................................................................ 137Figure 81. Individual IAP Statistics Page ............................................................. 139Figure 82. Network Statistics................................................................................... 140Figure 83. VLAN Statistics....................................................................................... 141Figure 84. WDS Statistics ......................................................................................... 142Figure 85. IDS Statistics Page ................................................................................. 143Figure 86. Filter Statistics ......................................................................................... 144Figure 87. Station Statistics ...................................................................................... 145Figure 88. Individual Station Statistics Page......................................................... 146Figure 89. Application Control ............................................................................... 149Figure 90. Application Control (Pie Charts).......................................................... 151Figure 91. Application Control (Station Traffic)................................................... 151Figure 92. Stations (Application Control).............................................................. 153Figure 93. System Log (Alert Level Highlighted) ................................................ 154Figure 94. IDS Event Log ........................................................................................ 155Figure 95. WMI: Express Setup............................................................................... 159Figure 96. LEDs are Switched On........................................................................... 164Figure 97. Network Interfaces................................................................................. 165Figure 98. Network Settings .................................................................................... 168Figure 99. Network Interface Ports......................................................................... 168Figure 100. Network Bonds ....................................................................................... 171Figure 101. Port Modes (a, b)..................................................................................... 173Figure 102. Port Modes (c) ......................................................................................... 174Figure 103. Port Modes (d) ........................................................................................ 174Figure 104. Mirroring Traffic..................................................................................... 176Figure 105. DNS Settings............................................................................................ 177Figure 106. CDP Settings............................................................................................ 178Figure 107. Services..................................................................................................... 180Figure 108. Time Settings (Manual Time)................................................................ 181

Wi-Fi Arrayxvi List of FiguresFigure 109. Time Settings (NTP Time Enabled)...................................................... 182Figure 110. NetFlow.................................................................................................... 184Figure 111. Wi-Fi Tag.................................................................................................. 185Figure 112. Location.................................................................................................... 186Figure 113. System Log .............................................................................................. 188Figure 114. SNMP ....................................................................................................... 193Figure 115. DHCP Management............................................................................... 196Figure 116. VLANs...................................................................................................... 199Figure 117. VLAN Management............................................................................... 201Figure 118. Tunnel Summary.................................................................................... 204Figure 119. Tunnel Management .............................................................................. 205Figure 120. Tunnel SSID Assignments..................................................................... 207Figure 121. Security..................................................................................................... 208Figure 122. Import Xirrus Certificate Authority..................................................... 212Figure 123. Admin Management .............................................................................. 214Figure 124. Admin Privileges.................................................................................... 216Figure 125. Admin RADIUS...................................................................................... 219Figure 126. Management Control ............................................................................. 221Figure 127. Pre-login Banner ..................................................................................... 222Figure 128. Access Control List................................................................................. 229Figure 129. Global Settings (Security) ...................................................................... 230Figure 130. External RADIUS Server ....................................................................... 234Figure 131. Internal RADIUS Server ........................................................................ 238Figure 132. Rogue Control List ................................................................................. 241Figure 133. OAuth 2.0 Management - Token List .................................................. 243Figure 134. SSIDs......................................................................................................... 245Figure 135. Four Traffic Classes................................................................................ 248Figure 136. Priority Level—IEEE 802.1p (Layer 2)................................................. 248Figure 137. Priority Level—DSCP (DiffServ - Layer 3) ......................................... 249Figure 138. SSID Management.................................................................................. 253Figure 139. SSID Management—Encryption, Authentication, Accounting ....... 256Figure 140. WPR Internal Splash Page Fields (SSID Management)..................... 260Figure 141. Customizing an Internal Login or Splash Page.................................. 263Figure 142. Whitelist Configuration for WPR......................................................... 264Figure 143. Setting Active IAPs per SSID ................................................................ 266Figure 144. Per-SSID Access Control List................................................................ 267Figure 145. Groups...................................................................................................... 269

Wireless ArrayList of Figures xviiFigure 146. Group Management ............................................................................... 271Figure 147. IAPs........................................................................................................... 276Figure 148. Source of Channel Setting ..................................................................... 277Figure 149. IAP Settings ............................................................................................. 279Figure 150. Global Settings (IAPs)............................................................................ 285Figure 151. Global Settings .11an.............................................................................. 298Figure 152. Global Settings .11bgn ........................................................................... 303Figure 153. Global Settings .11n................................................................................ 309Figure 154. Global Settings .11ac .............................................................................. 312Figure 155. 802.11u Global Settings.......................................................................... 315Figure 156. Advanced RF Settings............................................................................ 320Figure 157. Station Assurance (Advanced RF Settings) ........................................ 327Figure 158. Hotspot 2.0 Settings................................................................................ 330Figure 159. NAI Realms ............................................................................................. 331Figure 160. NAI EAP .................................................................................................. 332Figure 161. Intrusion Detection Settings.................................................................. 334Figure 162. LED Settings............................................................................................ 340Figure 163. DSCP Mappings...................................................................................... 342Figure 164. Roaming Assist ....................................................................................... 344Figure 165. WDS.......................................................................................................... 345Figure 166. Configuring a WDS Link....................................................................... 346Figure 167. WDS Client Links ................................................................................... 347Figure 168. Filters........................................................................................................ 351Figure 169. Filter Lists ................................................................................................ 352Figure 170. Filter Management ................................................................................. 354Figure 171. Filter Category or Application.............................................................. 358Figure 172. Clusters .................................................................................................... 360Figure 173. Cluster Definition ................................................................................... 361Figure 174. Cluster Management.............................................................................. 362Figure 175. Cluster Mode Operation........................................................................ 363Figure 176. Cluster Mode Activation ....................................................................... 363Figure 177. Viewing Statistics in Cluster Mode...................................................... 364Figure 178. AirWatch Settings................................................................................... 366Figure 179. System Tools............................................................................................ 372Figure 180. Saving the Diagnostic Log..................................................................... 380Figure 181. Managing Application Control Signature files .................................. 381Figure 182. Managing WPR Splash/Login page files............................................ 382

Wi-Fi Arrayxviii List of FiguresFigure 183. System Command (Ping)....................................................................... 383Figure 184. Radius Ping Output................................................................................ 384Figure 185. CLI Window............................................................................................ 385Figure 186. API Documentation................................................................................ 387Figure 187. API — Settings Requests List................................................................ 388Figure 188. API — GET Request Details ................................................................. 389Figure 189. API — GET Request Response ............................................................. 390Figure 190. API Documentation Toolbar................................................................. 391Figure 191. WMI Display Options............................................................................ 392Figure 192. iPhone Style Option................................................................................ 393Figure 193. Login Window ........................................................................................ 395Figure 194. Logging In................................................................................................ 398Figure 195. Help Window.......................................................................................... 399Figure 196. Full Help .................................................................................................. 400Figure 197. Partial Help.............................................................................................. 400Figure 198. Air Cleaner Filter Rules ......................................................................... 427Figure 199. Configuring a Simple Open Global SSID............................................ 455Figure 200. Configuring a Global SSID using WPA-PEAP................................... 456Figure 201. Configuring an SSID-Specific SSID using WPA-PEAP..................... 457Figure 202. Enabling Global IAPs............................................................................. 458Figure 203. Disabling Global IAPs............................................................................ 459Figure 204. Enabling a Specific IAP.......................................................................... 460Figure 205. Disabling a Specific IAP......................................................................... 461Figure 206. Setting the Cell Size for All IAPs.......................................................... 462Figure 207. Setting the Cell Size for All IAPs.......................................................... 463Figure 208. Setting the Cell Size for a Specific IAP ................................................ 464Figure 209. Configuring VLANs on an Open SSID................................................ 465Figure 210. Configuring Radio Assurance Mode (Loopback Testing)................ 467

Wireless ArrayIntroduction 1IntroductionThese topics introduce the Xirrus Wireless Array, including an overview of its key features and benefits. z“The Xirrus Family of Products” on page 1.z“Why Choose the Xirrus Wireless Array?” on page 3.z“Wireless Array Product Overview” on page 4.z“Key Features and Benefits” on page 15.z“Advanced Feature Sets” on page 17.z“About this User’s Guide” on page 21.The Xirrus Family of ProductsFigure 1. Xirrus Arrays: XR Series The Xirrus family of products includes the following:zThe XR Series of Xirrus Wireless Arrays The newest Xirrus Wireless Arrays have been completely redesigned to provide distributed intelligence, integrated switching capacity of up to 10 Gbps, application-level intelligence, increased bandwidth, and smaller size. The radios support IEEE802.11 ac, a, b, g, and n clients, and feature the capacity and performance needed to replace switched Ethernet to the desktop. Modular radios allow you to increase the number of radios, upgrade to more powerful radios, or even upgrade later to future technologies like 802.11ac and 802.11.ad as they are introduced.

Wireless Array2 IntroductionzXirrus Management System (XMS)XMS is used for managing large Array deployments from a centralized Web-based interface. Xirrus offers XMS Cloud—a software as a service option for XMS, capable of managing all aspects of your Xirrus network, including automatic software and firmware upgrades for the network. For XMS Cloud customers, all Array management is performed via the cloud. Access to Arrays via CLI and Web Management Interface is disabled. For other XMS customers, write access to Arrays via CLI and Web Management Interface is typically disabled.Users start the XMS client simply by entering the URL of the XMS server on a web browser. If you need detailed information about this product, refer to the XMS User’s Guide.zXirrus-supplied Power over Gigabit Ethernet (PoGE) Injectors and POE+ SwitchesXirrus offers 24- and 48-port enterprise-class L2+ gigabit managed access switches with IEEE802.3at PoE+, four 1G/10G SFP+ ports, and stacking. One-, two-, and eight-port PoGE injectors are also available for a range of Array power requirements. NomenclatureThroughout this User’s Guide, Xirrus Wireless Arrays and Access Points are referred to as simply Arrays. In some instances, the terms product and unit are also used. When discussing specific products from the Xirrus family, the product name is used (for example, XR-4830). The Wireless Array’s operating system is referred to as the ArrayOS. The Web Management Interface for browser-based management of the Array is referred to as WMI. The XR Series Arrays have very flexible radio capabilities — each of the radios may be independently configured to support IEEE802.11a, 11b, 11g, or 11n clients or a combination of client types. One radio is typically assigned as the RF monitorradio, supporting intrusion detection and prevention, self-monitoring, and other services. Radios support both 2.4GHz and 5 GHz, and are named iap1, iap2, ... iapn.

Wireless ArrayIntroduction 3The Xirrus Management System is referred to as XMS. The Power over Gigabit Ethernet system may be referred to as PoGE.Why Choose the Xirrus Wireless Array?The deployment of wireless is a necessity as businesses strive for greater flexibility in the workplace and the need for employee mobility rises. The user community is placing spiraling and often unanticipated demands on the wireless network, with the rapid proliferation of devices such as iPads and wireless enabled phones. Xirrus Wireless Arrays have the capability to support the large number of user devices present in today’s environments, with superior range and coverage. Wireless has come a long way in the past few years and now offers the performance, reliability and security that Enterprise customers have come to expect from their networks. The technology is being driven by these major IEEE standards:z802.11acOperates in the 5 GHz range, using a number of advanced techniques to achieve a maximum speed of 1.3 Gbps. These techniques include improvements on the methods used for 802.11n, below. z802.11nUses multiple antennas per radio to boost transmission speed as high as450Mbps, increasing throughput, range, and maximum number of users. 802.11n is backwards compatible with 802.11a/b/g.z802.11aOperates in the 5 GHz range with a maximum speed of 54 Mbps.z802.11bOperates in the 2.4 GHz range with a maximum speed of 11 Mbps. z802.11gSupports a higher transmission speed of 54 Mbps in the 2.4 GHz range and is backwards compatible with 802.11b.

Wireless Array4 IntroductionWhether you have just a handful of users or thousands of users, the Xirrus Array has the scalability and flexibility to serve your needs.See AlsoKey Features and BenefitsWireless Array Product OverviewThe Xirrus Family of ProductsWireless Array Product OverviewPart of the family of Xirrus products, the Wireless Array is a high capacity, multi-mode device designed with up to four times the coverage and eight times the bandwidth and user density compared with legacy thin access point wireless products. Its distributed intelligence eliminates the use of separate controllers and their accompanying bottlenecks. Each radio, with its directional high-gain antennas, can achieve up to 1.3 Gbps throughput .Figure 2. Wireless Array (XR Series) The Wireless Array (regardless of the product model) is Wi-Fi® compliant and simultaneously supports 802.11ac, 802.11a, 802.11b, 802.11g, and 802.11n clients. The multi-state design allows you to assign radios to 2.4 GHz and 5 GHz bands(or both) in any desired arrangement. Integrated switching and active enterprise class features such as VLAN support and multiple SSID capability enable robust network compatibility and a high level of scalability and system control. The optional Xirrus Management System (XMS) allows global management of hundreds of Arrays from a central location.

Wireless ArrayIntroduction 5Multiple versions of the Array with different numbers of Integrated Access Points (IAPs) support a variety of deployment applications.

Wireless Array6 IntroductionXR Wireless Array Product FamilyXR-500 Series Access PointsThese Access Points have one Gigabit Ethernet port and two radios—one multi-state radio (2.4GHz or 5GHz) and one 5GHz radio. They support 300Mbps, connecting up to 240 users at one time. The XR-500 provides flexibility for delivering wireless service in low-to-medium user density scenarios, in challenging deployments in areas with high RF attenuation, and in isolated or physically separated locations. Like XR Arrays, these models have an integrated controller, firewall, threat sensor and spectrum analyzer. Unlike other XR Arrays, these models have omni-directional antennas rather than directional antennas.Feature XR-520No. radios: 802.11 a/b/g/n/monitor 2Radio type 2x2Integrated omni-directional antennas 4Integrated wireless switch ports 2 Integrated RF spectrum analyzer, threat sensors YesGigabit Uplink Port 1Wireless bandwidth 300 MbpsUsers supported 240

Wireless ArrayIntroduction 7XR-600 Series Access PointsThe XR-600 Series provides robust wireless service in low-to-medium user density scenarios. These Access Points have two Gigabit Ethernet ports and two multi-state radios (2.4GHz or 5GHz). Each of the XR-630’s 3x3 802.11ac radios supports 1.3Gbps, connecting up to 240 users at one time with 2.6Gbps total Wi-Fi bandwidth.Like XR Arrays, these models have an integrated controller, firewall, threat sensor spectrum analyzer, and application-level intelligence. Unlike larger XR Arrays, these models have omni-directional antennas rather than directional antennas.The XR-630 supports ACExpress™ which optimizes wireless performance by automatically segmenting faster 802.11ac clients from slower Wi-Fi clients. Since Wi-Fi is a shared medium, this separation ensures slower 802.11a/b/g/n clients do not slow down 802.11ac clients from achieving high performance.Feature XR-620 XR-630No. radios: 802.11 ac/a/b/g/n/monitor 22Radio type 2x2 3x3Integrated omni-directional antennas 46Integrated wireless switch ports 2 2 Integrated RF spectrum analyzer, threat sensors Yes YesGigabit Uplink Ports 2 2Wireless bandwidth 1.7 Gbps 2.6 GbpsUsers supported 240 240

Wireless Array8 IntroductionXR-1000 These Arrays include models with one Gigabit Ethernet port and two multi-state radios (2.4GHz or 5GHz) that can support 300Mbps or 450Mbps, connecting up to 480 users at one time. The Xirrus XR-1000 Series Wireless Array is a two slot chassis available in a two multi-state (2.4GHz or 5GHz) radio configuration with up to 900Mbps of bandwidth (up to 450 Mbps per radio). The XR-1000 provides flexibility for delivering wireless service in low user density scenarios, challenging deployments in areas with high RF attenuation, and in isolated or physically separated locations. The elliptical-shaped coverage pattern produced by its directional antennas is ideal for covering facilities with central hallways and adjacent rooms commonly found in office buildings, hotels, and dormitories.Like larger XR Arrays, these models integrate multi-state radios with high gain directional antennas, an onboard multi-gigabit switch, controller, firewall, threat sensor and spectrum analyzer all built on a modular chassis designed for future extensibility. Feature XR-1220 XR-1230No. radios: 802.11 a/b/g/n/monitor 22Radio type 2x2 3x3Integrated antennas 4 6Integrated wireless switch ports 22Integrated RF spectrum analyzer, threat sensors Yes YesGigabit Uplink Port 1 1Wireless bandwidth 600 Mbps 900 MbpsUsers supported 480 480

Wireless ArrayIntroduction 9XR-2000 Series ArraysThese Arrays include models with one or two Gigabit Ethernet ports and two or four multi-state radios (2.4GHz or 5GHz) that can support 300Mbps or 450Mbps, connecting up to 960 users at one time. The Xirrus XR-2000 Series Wireless Array is a four slot chassis available in a four multi-state (2.4GHz or 5GHz) radio configuration supporting up to 1.8Gbps of bandwidth. These models support a range of low to high-performance applications, including offices, hospitals, campuses and classrooms, and hotels. Like larger XR Arrays, these models integrate multi-state radios with high gain directional antennas, an onboard multi-gigabit switch, controller, firewall, threat sensor and spectrum analyzer all built on a modular chassis designed for future extensibility. Note that XR-2000 Series Arrays ending in “0” have one Gigabit POE port and a Console port. Those ending in “5” have no console port, but have two Gigabit FeatureXR-2220XR-2225XR-2230XR-2235XR-2420XR-2425XR-2430XR-2435No. radios: 802.11 a/b/g/n/monitor 22224444Radio type 2x2 2x2 3x3 3x3 2x2 2x2 3x3 3x3Integrated antennas 4 4 6 6 8 8 12 12Integrated wireless switch ports 44444444Integrated RF spectrum analyzer, threat sensorsYes Yes Yes Yes Yes Yes Yes YesGigabit Uplink Ports 12121212Wireless bandwidth 600 Mbps 600 Mbps 900 Mbps 900 Mbps 1.2 Gbps 1.2 Gbps 1.8 Gbps 1.8 GbpsUsers supported 480 480 480 480 960 960 960 960

Wireless Array10 Introductionports, one of which accepts POE+ power supplied by a Xirrus-supplied power injector or an IEEE802.3at powered switch. XR-4000 Series ArraysThese Arrays include models with two Gigabit Ethernet ports and four or eight radios (IAPs), connecting up to 1920 users at one time and offering a maximum wireless bandwidth of 3.6 Gbps (up to 450 Mbps per radio). Smaller models may be upgraded to eight radios later when your needs change. Feature XR-4420 XR-4430 XR-4820 XR-4830Number of radios:802.11a/b/g/n/monitor 4488Radio type 2x2 3x3 2x2 3x3Integrated antennas 8 12 16 24Integrated wireless switch ports 8888Integrated RF spectrum analyzer, threat sensors Yes Yes Yes Yes1 Gigabit Uplink Ports 2 2 2 2Wireless bandwidth 1.2 Gbps 1.8 Gbps 2.4 Gbps 3.6 GbpsUsers supported 960 960 1920 1920

Wireless ArrayIntroduction 11XR-6000 Series ArraysThese Arrays include models with four Gigabit Ethernet ports and up to sixteen radios, connecting up to 1792 users at one time and offering a maximum wireless bandwidth of 7.2 Gbps (up to 450 Mbps per radio). Smaller models may be upgraded to sixteen radios later when your needs change. A 10 Gigabit modular Ethernet expansion port (DVI connector) is available to meet high traffic demands. It is used only with an optional Xirrus 10 Gig fiber optics adapter. See AlsoKey Features and BenefitsWireless Array Product OverviewPower over Gigabit Ethernet (PoGE)FeatureXR-6820XR-6830XR-7220XR-7230XR-7620XR-7630Number of radios:802.11a/b/g/n/monitor 8 8 12 12 16 16Radio type 2x2 3x3 2x2 3x3 2x2 3x3Number of integrated antennas 16 24 24 36 32 48Integrated wireless switch ports 16 16 16 16 16 16Integrated RF spectrum analyzer, threat sensors YesYesYesYesYesYes1 Gigabit Uplink Ports 444444External 10 Gigabit Modular Expansion Port 111111Wireless bandwidth (Gbps) 2.4 3.6 3.6 5.4 4.8 7.2Users supported 896 896 1344 1344 1792 1792

Wireless Array12 IntroductionWhy Choose the Xirrus Wireless Array?Enterprise Class SecurityThe latest and most effective wireless encryption security standards, including WPA (Wireless Protected Access) and WPA2 with 802.11i AES (Advanced Encryption Standard) are available on the Wireless Array. In addition, the use of an embedded RADIUS server (or 802.1x with an external RADIUS server) ensures user authentication — multiple Arrays can authenticate to the optional XMS, ensuring only authorized Arrays become part of the wireless network. With the Xirrus Advanced Feature Sets, intrusion detection and prevention, site monitoring, and RF spectrum analysis are performed in the background by the Array automatically.Deployment FlexibilityXirrus’ unique multi-radio architecture (on all Arrays except the XR-500 Series) generates 360 degrees of sectored high-gain 802.11a/b/g/n coverage that provides extended range and the highest possible data rates for a large volume of clients. Each sector can be adjusted automatically or manually, creating a pattern of wireless coverage perfectly tailored to individual customer needs. For example:Figure 3. Wireless Coverage PatternsFigure 3 depicts the following two scenarios:zFull pattern coverageoutside wall

Wireless ArrayIntroduction 13All radios are activated with coverage spanning 360 degrees. If within range, clients will always receive coverage regardless of their geographic position relative to the Array. Radios may be assigned to 2.4 GHz and/or 5.0 GHz bands in any desired pattern.zPartial pattern coverageIf desired, the Wireless Array can be deployed close to an exterior wall. In this case, half of all available radios have been deactivated to prevent redundant signals from “bleeding” beyond the site’s perimeter wall. This configuration may also be used in those cases where you want to restrict wireless coverage to selected areas of the building’s interior.Power over Gigabit Ethernet (PoGE) Some smaller Arrays and APs (XR-500/600 and XR-2005 Series) are compatible with IEEE802.3af and/or IEEE802.3at PoE+, and may be connected to appropriate powered switches. For example, the Xirrus XT-5024 and XT-5048 are 24-and 48-port 802.3at POE+ managed switches. See the Quick Installation Guide for the Array/AP for compatible injectors or powered switches.The Xirrus-supplied XP1, XP2, and XP8 Power over Gigabit Ethernet modules provide power to Arrays over the same Cat 5e or Cat 6 cable used for data. Managed modules provide the ability to control power using XMS.Figure 4. XP8 - Power over Ethernet Usage

Wireless Array14 IntroductionSpecific models of the Array are compatible with specific PoGE modules. Enterprise Class Management The Wireless Array can be used with its default settings, or using zero touch cloud-based automated provisioning. Settings may also be customized using the Array’s embedded Web Management Interface (WMI). The WMI enables easy configuration and control from a graphical console, plus a full complement of troubleshooting tools and statistics. Figure 5. WMI: Array Status In addition, a fully featured Command Line Interface (CLI) offers IT professionals a familiar management and control environment. SNMP (Simple Network

Wireless ArrayIntroduction 15Management Protocol) is also supported to allow management from an SNMP compliant management tool, such as the optional Xirrus Management System.Key Features and BenefitsThis section describes some of the key product features and the benefits you can expect when deploying the Wireless Array (the XR-7630 product is used as an example in this section). High Capacity and High Performance Figure 6. Layout of IAPs (XR-7630) The XR-7630 version of the Wireless Array (Figure 6) enables wireless connectivity and easily handles time-sensitive traffic such as voice. This model includes four Gigabit uplink ports for connection to the wired network. Its sixteen IAPs (radios) provide a maximum wireless capacity of 7.2 Gbps, which offers ample reserves for the high demands of current and future applications. Of the sixteen IAPs, fifteen operate as radios which may be set up to serve your choice of client types — any or all of 802.11a/b/g/n (5 GHz or 2.4 GHz bands), providing backwards compatibility with 802.11b and 802.11g.#For deployments of more than five Arrays, we recommend that you use the on-premise or cloud-based Xirrus Management System (XMS). XMS offers a rich set of features for fine control over large deployments.

Wireless Array16 IntroductionIn the recommended configuration, one IAP is configured in RF monitoring and intrusion detection/prevention mode.Extended CoverageOne XR-7630 solution enables you to replace fifteen access points (including one omnidirectional IAP for monitoring the network). Fifteen IAP radios with integrated directional antennas provide increased wireless range and enhanced data rates in all directions. With a Wireless Array deployed, far fewer access points are needed and wired-like resiliency is delivered throughout your wireless network. Your Wireless Array deployment ensures:zContinuous connectivity if an IAP (radio) fails.zContinuous connectivity if an Array fails.zContinuous connectivity if a WDS link or switch fails.zContinuous connectivity if a Gigabit uplink or switch fails.Non-Overlapping ChannelsComplete use of non-overlapping channels limits interference and delivers maximum capacity. On the XR-7630, up to 16 non-overlapping channels are fully utilized across the 5GHz and 2.4GHz spectrums.SDMA OptimizationSDMA (Spatial Division Multiple Access) technology provides full 360° coverage while allowing independent channel and power output customization. Also supports fast inter-zone handoffs for time-sensitive applications and roaming.Fast RoamingUtilizes the Xirrus Roaming Protocol (XRP) ensuring fast and seamless roaming capabilities between IAPs or Arrays at both Layer 2 and Layer 3.Ease of DeploymentThe Xirrus Mobilize service simplifies and speeds deployment of the wireless network by automatically setting up each Array’s license, software image, and initial configuration. When the Array is installed and has Internet connectivity, it contacts the Mobilize server, which performs these initialization tasks.

Wireless ArrayIntroduction 17Powerful ManagementThe Xirrus Management System (XMS) offers real time monitoring and management capabilities for the wireless network. Secure Wireless AccessMultiple layers of authentication and encryption ensure secure data transmissions. The Wireless Array is 802.11i compliant with line-rate encryption support for 40 and 128 bit WEP, WPA and WPA2 with TKIP and AES encryption. Authentication is provided via 802.1x, including PEAP, EAP-TLS, EAP-TTLS, EAP-SIM, EAP-GTC, EAP-AKA, EAP-AKA-Prime, and LEAP (Lightweight Extensible Authentication Protocol) passthrough. Intrusion detection and prevention provide proactive monitoring of the environment for threats. Applications EnablementThe Wireless Array’s QoS (Quality of Service) functionality combined with true switch capabilities enable high density video and Voice over Wireless LAN deployments. Compliant with 802.1p and 802.1Q standards. See AlsoWireless Array Product OverviewPower over Gigabit Ethernet (PoGE)Why Choose the Xirrus Wireless Array?Advanced Feature Sets The Wireless Array offers a family of powerful functionality packages, including the RF Performance Manager (RPM), RF Security Manager (RSM), RF Analysis Manager (RAM), and Application Control. These four packages are separately licensed for operation on your Array. RPM, RSM, and RAM are automatically included as part of all XR Arrays. Application Control is an optional feature.Xirrus Advanced RF Performance Manager (RPM)The Xirrus RPM optimizes the bandwidth usage and station performance of 802.11n wireless networks. Leveraging the multiple integrated access point (multi-radio) design of the Xirrus Wireless Array, RPM manages the allocation of

Wireless Array18 Introductionwireless bandwidth to wireless stations across multiple RF channels. The result maximizes overall network performance with superior flexibility and capacity. Today's wireless infrastructure is faced with ever increasing numbers and variations of wireless enabled clients, whether in the form of notebooks, netbooks, smart phones, IP phones, printers, projectors, cameras, RFID tags, etc. The advent of higher speed 802.11n wireless and its increased use of the 5GHz spectrum adds to the number of variables today's wireless networks must accommodate. Backwards compatibility with older clients is crucial, however their operation in a wireless network can significantly hinder the performance of faster clients. As an example, 802.11b wireless stations communicate more than 10 times slower than 802.11n stations. With each of the Array’s multiple radios operating on a different channel, RPM selects the ideal radio for each station. High-speed stations are grouped together on radios with other high speed stations, while lower speed stations are combined with other lower speed stations. This ensures optimal performance for high-speed 802.11n stations without compromise. The complete feature set of the RPM package includes: zWDS (Wireless Distribution System) for point-to-point communicationzWireless Mode per IAPzSharp Cell technologyzWireless Data Rate OptimizationzWireless Traffic ShapingzWireless Voice Call Admission ControlzFast Layer 2 and 3 Roaming zStandby Mode Xirrus Advanced RF Security Manager (RSM)The Xirrus RSM improves security and minimizes the risk in deploying 802.11n wireless networks. Leveraging an integrated 24/7 threat sensor and hardware-based encryption/decryption in each Array, RSM secures the wireless network

Wireless ArrayIntroduction 19from multiple types of threats. The result delivers uncompromised overall network security with superior flexibility and performance. Wireless networks face a number of potential security threats in the form of rogue access points, ad-hoc clients, unauthorized clients, wireless-based attacks, eavesdropping, etc. As 802.11n is increasingly adopted in enterprise networks, defending against these threats becomes more critical. With the Array’s dedicated threat sensor radio scanning all channels in the 2.4GHz and 5GHz spectrums, RSM searches for security threats and automatically mitigates them. High performance encryption/decryption in the enterprise wireless network is a must. The wireless network needs to support each client using the highest level of encryption (WPA2 Enterprise/128 bit AES) and without degrading the overall performance of the network. Xirrus incorporates hardware-based encryption/decryption into each Array, delivering line-rate encryption at the edge of the network instead of at a choke point within a centralized controller. The complete feature set of the RSM package includes: zWireless IDS/IPS (Intrusion Detection/Prevention System)zWireless stateful firewallzUser group policieszAuthenticated guest access gatewayzNAC integrationXirrus Advanced RF Analysis Manager (RAM)The RF Advanced Analysis Manager (RAM) tests and troubleshoots 802.11n wireless networks. The deployment of 802.11n presents a set of unique challenges based on technology differences with legacy 802.11a/b/g networks, both on the wireless infrastructure and client side. Xirrus' RAM equips each Wireless Array with a powerful set of tools and features to optimally tune and verify an 802.11n installation, as well as give IT administrators the ability to troubleshoot issues that may occur within the wireless environment. The 802.11n standard will continue to evolve over the next several years with additional performance and optional functions, along with ongoing stream of IEEE 802.11 amendments. This changing wireless landscape mandates that

Wireless Array20 Introductionappropriate tools are available to the user to analyze, optimize, and troubleshoot their changing environments. The distributed architecture of the Array enables the execution of powerful wireless and networking analysis at the edge of the network where packets traverse the wireless-to-wired boundary. The Array includes an embedded wireless controller with the necessary computing and memory resources to provide these functions securely at the network's edge. The key elements of the RAM package include: zRF Analysis – An embedded Spectrum Analyzer leverages the dedicated threat sensor radio in each Wireless Array to provide a continual view of utilization, interference, and errors across all available wireless channels.zPacket Analysis – Integrated packet capture provides filterable views of all traffic traversing on the wired and wireless interfaces of the Array.zPerformance Analysis – Embedded traffic generation enables the throughput of the Array’s wireless or wired interfaces to be analyzed.zFailure Recovery – Radio Assurance provides an automatic self-test and self healing mechanism that ensures continuous system operation.zNetflow SupportzNetwork Tools: ping, RADIUS ping, tracerouteXirrus Application ControlThe Application Control feature is available on XR Arrays to provide real-time visibility of application usage by users across the wireless network. Network usage has changed enormously in the last few years, with the increase in smartphone and tablet usage stressing networks. The Array uses Deep Packet Inspection (DPI) to determine what applications are being used and by whom, and how much bandwidth they are consuming. These applications are rated by their degree of risk and productiveness. The results are presented to you both graphically and in tables. Filters may then be put in place to implement per-application policies that keep network usage focused on productive uses, eliminating risky and non-business-oriented applications such as BitTorrent. You can increase the priority of mission-critical applications like

Wireless ArrayIntroduction 21VoIP and WebEx. See “Application Control Windows” on page 147 for more information.About this User’s GuideThis User’s Guide provides detailed information and procedures that will enable wireless network administrators to install, configure and manage the Wireless Array so that end users can take full advantage of the product’s features and functionality without technical assistance.OrganizationTopics and procedures are organized by function under the following chapter headings: zIntroductionProvides a brief introduction to wireless technology, an overview of the product, including its key features and benefits, and presents the product specifications.zInstalling the Wireless ArrayDefines prerequisites for deploying and installing the Array and provides instructions to help you plan and complete a successful installation.zThe Web Management InterfaceOffers an overview of the product’s embedded Web Management Interface, including its content and structure. It emphasizes what you need to do to ensure that any configuration changes you make are applied, and provides a list of restricted characters. It also includes instructions for logging in to the Array with your Web browser.zViewing Status on the Wireless ArrayDescribes the status and statistics displays available on the Array using its embedded Web Management Interface. zConfiguring the Wireless ArrayContains procedures for configuring the Array using its embedded Web Management Interface.

Wireless Array22 IntroductionzUsing Tools on the Wireless ArrayContains procedures for using utility tools provided in the Web Management Interface. It includes procedures for upgrading the system firmware, uploading and downloading configurations and other files, using diagnostic tools, and resetting the Array to its factory defaults.zThe Command Line InterfaceIncludes the commands and the command structure used by the Wireless Array’s Command Line Interface (CLI), and provides a procedure for establishing a Telnet connection to the Array. This chapter also includes some sample key configuration tasks using the CLI.zAppendix A: Quick Reference Guide Contains the product’s factory default settings.zAppendix B: FAQ and Special TopicsOffers guidance to resolve technical issues, including general hints and tips to enhance your product experience, and a procedure for isolating problems within an Array-enabled wireless network. Also includes Frequently Asked Questions (FAQs) and Xirrus contact information.zAppendix C: Notices (Arrays except XR-500/600 and Models Ending in H)Contains the legal notices, licensing, and compliance statements for the Array. Please read this section carefully. zAppendix D: Notices (XR500/600 Series Only)Contains the legal notices, licensing, and compliance statements for the XR500 Series Access Points. Please read this section carefully if you are using these models. zGlossary of TermsProvides an explanation of terms directly related to Xirrus product technology, organized alphabetically.

Wireless ArrayIntroduction 23zIndexThe index is a valuable information search tool. Use the index to locate specific topics discussed in this User’s Guide. Simply click on any page number in the index to jump to the referenced topic.Notes and CautionsThe following symbols are used throughout this User’s Guide: Screen ImagesSome screen images of the Web Management Interface have been modified for clarity. For example, an image may have been cropped to highlight a specific area of the screen, and/or sample data may be included in some fields.#This symbol is used for general notes that provide useful supplemental information.!This symbol is used for cautions. Cautions provide critical information that may adversely affect the performance of the product.

Wireless Array24 IntroductionProduct SpecificationsPlease refer to the Xirrus web site for the latest specifications for these Arrays—www.xirrus.com

Wireless ArrayInstalling the Wireless Array 25Installing the Wireless ArrayThe instructions for completing a successful installation include the following topics: z“Installation Prerequisites” on page 25.z“Planning Your Installation” on page 28.z“Installation Workflow” on page 58.z“Installing Your Wireless Array” on page 60.z“Powering Up the Wireless Array” on page 64.z“Establishing Communication” on page 67.z“Performing the Express Setup Procedure” on page 72.Installation PrerequisitesYour Wireless Array deployment requires the presence of hardware and services in the host wired/wireless network, including:zPower Source Xirrus Arrays and APs are powered via Xirrus-supplied Power over Gigabit Ethernet. PoGE supplies power over the same Cat 5e or Cat 6 cable used for data, thus reducing cabling and installation effort. PoGE power injector modules are available in 1-, 2-, and 8-port configurations and are typically placed near your Gigabit Ethernet switch. An AC outlet is required for each injector module. Some smaller Arrays and APs are compatible with IEEE802.3af and/or IEEE802.3at, and may be connected to appropriate powered switches. For example, the Xirrus XT-5024 is a 24-port 802.3at POE+ managed switch. See the Quick Installation Guide for the Array/AP for compatible injectors or powered switches. zEthernet ports You need at least one 100/1000 BaseT port to establish wired Gigabit Ethernet connectivity. XR Series Arrays have one, two, or four Gigabit

Wireless Array26 Installing the Wireless Arrayports, depending on the model (see “XR Wireless Array Product Family” on page 6). zSecure Shell (SSH) utilityTo establish secure remote command line access to the Array, you need a Secure Shell (SSH) utility, such as PuTTY. The utility must be configured to use SSH-2, since the Array will only allow SSH-2 connections. zSecure Web browserXirrus supports the latest version of the following Browsers: Internet Explorer, Mozilla Firefox, Chrome, or Safari. A secure Web browser is required for Web-based management of the Array. The browser must be on the same subnet as the Array, or you must set a static route for management as described in the warning above. zSerial connection capabilityTo connect directly to the console port on the Array (all models except XR-500 and XR-1000 Series and some XR-2000 models, where Xircon can be used instead—see the Xircon User’s Guide), your computer must be equipped with a male 9-pin serial port and terminal emulation software (for example, HyperTerminal). The Xirrus Array only supports serial cable lengths up to 25’ per the RS-232 specification. Use the following settings when establishing a serial connection:!The Array’s Ethernet ports should be connected to an Ethernet switch, not an Ethernet hub — if a hub is used, we recommend that you do not bond-pair Ethernet ports.Bits per second 115,200Data bits 8Parity NoneStop bits 1Flow control None

Wireless ArrayInstalling the Wireless Array 27Optional Network ComponentsThe following network components are optional.zXirrus Management System (XMS)The optional XMS offers powerful management features for small or large Wireless Array deployments.zExternal RADIUS serverAlthough your Array comes with an embedded RADIUS server, for 802.1x authentication in large deployments you may want to add an external RADIUS server.Client RequirementsThe Wireless Array should only be used with Wi-Fi certified client devices.See AlsoCoverage and Capacity PlanningFailover PlanningPlanning Your Installation

Wireless Array28 Installing the Wireless ArrayPlanning Your InstallationThis section provides guidelines and examples to help you plan your Xirrus Wireless Array deployment to achieve the best overall coverage and performance. We recommend you conduct a site survey to determine the best location and settings for each Array you install.The following topics are discussed:z“General Deployment Considerations” on page 28z“Coverage and Capacity Planning” on page 30z“IEEE 802.11n Deployment Considerations” on page 37z“Failover Planning” on page 43z“Power Planning” on page 46z“Security Planning” on page 47z“Port Requirements” on page 49z“Network Management Planning” on page 53z“WDS Planning” on page 54z“Common Deployment Options” on page 57General Deployment ConsiderationsThe Wireless Array’s unique multi-radio architecture generates 360 degrees of sectored high-gain 802.11a/b/g/n coverage that provides extended range. (Note that XR-500 Series radios are omni-directional rather than sectored.) However, the number, thickness and location of walls, ceilings or other objects that the wireless signals must pass through may affect the range. Typical ranges vary depending #For a complete discussion of implementing Voice over Wi-Fi on the Array, see the Xirrus Voice over Wireless Application Note in the Xirrus Resource Center. #For optimal placement of Arrays, we recommend that a site survey be performed by a qualified Xirrus partner.

$Wireless ArrayInstalling the Wireless Array 29on the types of materials and background RF (radio frequency) noise at your location. To maximize wireless range, follow these basic guidelines:1. Keep the number of walls and ceilings between the Array and your receiving devices to a minimum — each wall or ceiling can reduce the wireless range from between 3 and 90 feet (1 to 30 meters). Position your devices so that the number of walls or ceilings is minimized.2. Be aware of the direct line between each device. For example, a wall that is 1.5 feet thick (half a meter) at 90° is actually almost 3 feet thick (or 1 meter) when viewed at a 45° angle. At an acute 2° degree angle the same wall is over 42 feet (or 14 meters) thick! For best reception, try to ensure that your wireless devices are positioned so that signals will travel straight through a wall or ceiling.Figure 7. Wall Thickness Considerations3. Try to position wireless client devices so that the signal passes through drywall (between studs) or open doorways and not other materials that can adversely affect the wireless signal.See AlsoCoverage and Capacity PlanningCommon Deployment OptionsInstallation Prerequisites90° 45°1.5 feet/.5 m~ 3 feet/1 m> 42 feet\14 m2°$

Wireless Array30 Installing the Wireless ArrayCoverage and Capacity PlanningThis section considers coverage and capacity for your deployment(s), including placement options, RF patterns and cell sizes, area calculations, roaming considerations, and channel allocations.PlacementUse the following guidelines when considering placement options:1. The best placement option for the Array is ceiling-mounted within an open plan environment (cubicles rather than fixed walls).2. Keep the Array away from electrical devices or appliances that generate RF noise. Because the Array is generally mounted on ceilings, be aware of its position relative to lighting (especially fluorescent lighting) — we recommend maintaining a distance of at least 3 to 6 feet (1 to 2 meters).Figure 8. Unit Placement3. If using multiple Arrays in the same area, maintain a distance of at least 100ft/30m between Arrays if there is direct line-of-sight between units, or at least 50ft/15m if a wall or other barrier exists between units.#XR-500 Series radios are omni-directional rather than directional (sectored), and discussions involving sectored radios are not applicable to these Arrays.100 ft/ 30m100 ft/ 30 m100 ft/30 m

Wireless ArrayInstalling the Wireless Array 31RF PatternsThe Wireless Array allows you to control — automatically or manually — the pattern of wireless coverage that best suits your deployment needs. You can choose to operate with full coverage, half coverage, or custom coverage (by enabling or disabling individual sectors).Full (Normal) CoverageIn normal operation, the Array provides a full 360 degrees of coverage.Figure 9. Full (Normal) CoverageHalf CoverageFigure 10. Adjusting RF PatternsIf installing a unit close to an exterior wall, you can deactivate half of the radios to prevent redundant signals from “bleeding” beyond the wall and extending service into public areas. The same principle applies if you want to restrict service to an adjacent room within the site.outside wall

Wireless Array32 Installing the Wireless ArrayCustom CoverageWhere there are highly reflective objects in proximity to the Array, you can turn off specific radios to avoid interference and feedback.Figure 11. Custom CoverageCapacity and Cell SizesCell sizes should be estimated based on the number of users, the applications being used (for example, data/video/voice), and the number of Arrays available at the location. The capacity of a cell is defined as the minimum data rate desired for each sector multiplied by the total number of sectors being used.Figure 12. Connection Rate vs. Distance Figure 12 shows relative connection rates for 802.11n vs. 802.11a/g and 802.11b, and the effect of distance on the connection rates. Wireless environments can vary greatly so the actual rates may be different depending on the specific network deployment. objectreflective

Wireless ArrayInstalling the Wireless Array 33Fine Tuning Cell SizesAdjusting the transmit power allows you to fine tune cell sizes. There are four standard sizes — Small, Medium, Large, or Max (the default is Max). There is also an Auto setting that automatically determines the best cell size, and a Manual setting that allows you to choose your power settings directly. Figure 13. Transmit PowerAuto Cell Size is an automatic, self-tuning mechanism that balances cell size between Arrays to guarantee coverage while limiting the RF energy that could extend beyond the organizational boundary. Auto Cell uses communication between Arrays to dynamically set radio power so that complete coverage is provided to all areas, yet at the minimum power level required. This helps to minimize potential interference with neighboring networks. Additionally, Arrays running Auto Cell automatically detect and compensate for coverage gaps caused by system interruptions. To enable the Auto Cell Size feature, go to “RF Power & Sensitivity” on page 323. For a complete discussion of the Auto Cell size feature, see the Xirrus Auto Cell Application Note in the Xirrus Resource Center. If you are installing many units in proximity to each other, we recommend that you use Auto Cell Size; otherwise, reduce the transmit power using manual settings to avoid excessive interference with other Arrays or installed APs. See also, “Coverage and Capacity Planning” on page 30.LargeMediumSmall

Wireless Array34 Installing the Wireless ArraySharp CellThis patented Xirrus RF management option automatically creates more intelligently defined cells and improves performance by creating smaller, high-throughput cells. By dynamically limiting each cell to a defined boundary (cell size), the trailing edge bleed of RF energy is reduced, thus minimizing interference between neighboring Wireless Arrays or other Access Points. To enable the Sharp Cell feature, go to “RF Power & Sensitivity” on page 323. For more information about this feature, see the Xirrus Sharp Cell Application Note in the Xirrus Resource Center. Roaming ConsiderationsCells should overlap approximately 10 - 15% to accommodate client roaming.Figure 14. Overlapping CellsAllocating ChannelsBecause the Wireless Array is a multi-channel device, allocating the best channels to radios is important if peak performance is to be maintained.Automatic Channel SelectionWe recommend that you allow the Array to make intelligent channel allocation decisions automatically. In the automatic mode, channels are allocated dynamically, driven by changes in the environment. Auto Channel assignment is performed by scanning the surrounding area for RF activity on all channels, then ROAMING10 - 15% overlap

Wireless ArrayInstalling the Wireless Array 35automatically selecting and setting channels on the Array to the best channels available. This function is typically executed when initially installing Arrays in a new location and may optionally be configured to execute periodically to account for changes in the RF environment over time. Auto Channel selection has significant advantages, including: zAllows the Array to come up for the first time and not interfere with existing equipment that may be already running, thereby limiting co-channel interference.zMore accurately tunes the RF characteristics of a wireless installation than manual configuration since the radios themselves are scanning the environment from their physical location. zMay be configured to run periodically. To set up the automatic channel selection feature, go to “Advanced RF Settings” on page 320.

Wireless Array36 Installing the Wireless ArrayManual Channel SelectionYou can manually assign channels on a per radio basis, though manual selection is not recommended (and not necessary).Figure 15. Allocating Channels ManuallySee AlsoFailover PlanningInstallation Prerequisites#To avoid co-channel interference, do not select adjacent channels for radios that are physically next to each other.Maintain channel separation

Wireless ArrayInstalling the Wireless Array 37IEEE 802.11n Deployment ConsiderationsThe Xirrus Arrays support IEEE 802.11n on all IAPs, in both 2.4 GHz and 5 GHz bands. Use of 802.11n offers significant benefits: zHigher data rateszHigher throughput zSupports more userszMore robust connectionszIncreased coverage areazMore secure connections — supports WPA2 (Wi-Fi Protected Access 2)These benefits result in better support for a wide range of applications such as voice and video, intensive usage such as CAD/CAM and backups, dense user environments, and for manufacturing and warehousing environments. The techniques that 802.11n uses to realize these performance improvements, and the results that can be expected are discussed in:z“MIMO (Multiple-In Multiple-Out)” on page 38z“Multiple Data Streams — Spatial Multiplexing” on page 39z“Channel Bonding” on page 40z“Improved MAC Throughput” on page 41z“Short Guard Interval” on page 41z“Obtaining Higher Data Rates” on page 42z“802.11n Capacity” on page 43Two very important techniques to consider are Channel Bonding and Multiple Data Streams — Spatial Multiplexing because they contribute a large portion of 802.11n’s speed improvements and because they are optional and configurable, as opposed to the parts of 802.11n that are fixed. While the settings for 802.11n IAPs come pre-configured on the Array for robust performance in typical usage, you #While 802.11n increases coverage area by almost doubling the reach, you must consider the legacy wireless devices in your network. Wireless stations connecting using 802.11a/b/g will still be subject to a reach of up to 100 feet, depending on the environment.

Wireless Array38 Installing the Wireless Arrayshould review the settings for your deployment, especially channel bonding. A global setting is provided to enable or disable 802.11n mode. See “Global Settings .11n” on page 309 to configure 802.11n operation. MIMO (Multiple-In Multiple-Out) MIMO (Multiple-In Multiple-Out) signal processing is one of the core technologies of 802.11n. It mitigates interference and maintains broadband performance even with weak signals.Prior to 802.11n, a data stream was transmitted via one antenna. At the receiving end, the antenna with the best signal was selected to receive data. (Figure 16)Figure 16. Classic 802.11 Signal TransmissionMIMO signal processing uses multiple antennas to send and receive data. It takes advantage of multipath reflections to improve signal coherence and greatly increase receiver sensitivity (Figure 17). Figure 17. MIMO Signal ProcessingFrequency Across SubcarriersAttenuationAntenna 1 SignalMIMO Processed SignalAntenna 2 SignalAntenna 3 SignalReceiver

Wireless ArrayInstalling the Wireless Array 39Multipath signals were considered to be interference by 802.11a/b/g radios, and degraded performance. In 802.11n, these signals are used to enhance performance. This extra sensitivity can be used for greater range or higher data rates. The enhanced signal is the processed sum of individual antennas. Signal processing eliminates nulls and fading that any one antenna would see. MIMO signal processing is sophisticated enough to discern multiple spatial streams (see Multiple Data Streams — Spatial Multiplexing). There are no settings to configure for MIMO.Multiple Data Streams — Spatial MultiplexingSpatial Multiplexing transmits completely separate data streams on different antennas (in the same channel) that are recombined to produce new 802.11n data rates. Higher data rates are achieved by splitting the original data stream into separate data streams. Each separate stream is transmitted on a different antenna (using its own RF chain). MIMO signal processing at the receiver can detect and recover each stream. Streams are then recombined, yielding higher data rates. Figure 18. Spatial MultiplexingSpatial multiplexing can double, triple, or quadruple the date rate, depending on the number of transmit antennas used. You can configure the number of chains (i.e., streams) separately for transmitting and receiving. By default, the Array uses three chains for transmitting and receiving (see “Global Settings .11n” on page 309). MRx 1Rx 2Rx MMTransmitterData Stream Data StreamReceiverTx 1Tx 2Tx N

Wireless Array40 Installing the Wireless ArrayChannel BondingChannel bonding increases data rates by combining two adjacent 20 MHz channels into one 40 MHz channel. This increases the data rate to slightly more than double. A bonded 40 MHz channel is specified in terms of the Primary channel and the adjacent channel to Bond. The Bond channel is represented by +1 to use the channel above the Primary channel, or -1 to use the channel below. In the example shown, Channel 40 is the Primary channel and it is bonded to Channel 36, the channel below it, by specifying -1. Be aware that Channel Bonding can make channel planning more difficult, since you are using two channels for an IAP. We recommend the use of the 5 GHz band, since it has many more channels than the 2.4 GHz band, and thus more channels are available for bonding. The Array provides an Automatic Channel Bonding setting that will automatically select the best channel for bonding on each IAP. If you enable this option, you may select whether bonding will be dynamic (the bonded channel changes in response to environmental conditions) or static (the bonded channel will not be changed. See “Global Settings .11n” on page 309. To configure channel bonding manually, on a per-IAP basis, see “IAP Settings” on page 279. Figure 19. Channel BondingCh# Ch#4020 MHz 20 MHz3640 MHz(40, -1)Standard 802.11 channels are effectively 20MHz wide. Channel bonding combines two adjacent 20MHz channels into a single 40MHz channel providing increased throughput.

Wireless ArrayInstalling the Wireless Array 41Improved MAC ThroughputThese changes make 802.11n transmission of MAC frames 40% more efficient than legacy transmission:zMAC data frames are combined and given a single PHY header.zImplicit Block ACK acknowledges all data frames within a combined frame. zSpacing between frames is reduced. Figure 20. MAC Throughput ImprovementsShort Guard IntervalThis option reduces the wait time between symbols (the smallest unit of data transfer) that are being sent out over the air. The guard interval provides immunity to propagation delays and reflections, and is normally 800 ns (long). By using a short guard interval (400 ns), the data rate is increased by approximately 11%. The short interval may be used in many environments (especially indoors). If the short guard interval is used in an inappropriate environment, the signal NACK FrameNData Frame2Data FramePHY HeaderMAC HeaderData Frame PayloadACK Frame PayloadLegacy OperationHigh Throughput OperationData Framessssss sss1Data Frame Block ACK Frame1122NNACK Frame1 2ACK FrameNNData FrameSIFSSIFSSIFSRIFS RIFSLegacy OperationHigh Throughput OperationData Frame ACK Framesssssssss11 2Data Frame Data Frame Data FrameBlock ACKRequestFrameBlock ACKResponseFrame12 N1 2 22Data Frame ACK FrameNACK FrameRIFS Usage (Reduced Inter-Frame Spacing)Frame Aggregation

Wireless Array42 Installing the Wireless Arrayquality will suffer and throughput will decrease. See “Global Settings .11n” on page 309 to configure the guard interval. Obtaining Higher Data Rates The data rate increase obtained by using 802.11n on an Array is incremental, based on the technologies that are applied and the options that you select:zHigher encoding rates (Mandatory in 802.11n)zSpatial Streams (Mandatory, but multiplier varies directly with number of streams selected.)zChannel Bonding (Mandatory in 802.11n, apply multiplier to IAP if it is bonded.)zShort Guard Interval (Optional)See Figure 21 to see the 802.11n data rate increase for an IAP. Apply this increase to the 802.11 a, b or g data rates selected for the Array.Figure 21. Computing 802.11n Data Rates OptionallyMultiply By 2.077to BondTwo 20MHzChannelsOptionallyMultiply by 1.11 for Shorter Guard Interval to Increase Symbol RateOptionallyMultiply by 2, 3, 4for the Number of AdditionalSpatial StreamsChoose New Base Encoding + ModulationBPSK (6.5)QPSK (13, 19.5)QAM-16 (26, 39)QAM-64 (58.5, 65)New 11nData Ratexxx =

Wireless ArrayInstalling the Wireless Array 43802.11n Capacity802.11n offers major increases in capacity over previous 802.11 standards, as shown in the table below. Failover PlanningThis section discusses failover protection at the unit and port levels. To ensure that service is continued in the event of a port failure, you can utilize two Gigabit Ethernet ports simultaneously as a bonded pair (on Arrays with two or more Gigabit ports).Figure 22. Port Failover Protection 802.11 Mode # Channels Max Theoretical Capacity802.11 a/n: 3 Streams 23 23 * 450 Mbps = 10.2 Gbps802.11 a/n: 2 Streams 23 23 * 300 Mbps = 6.8 Gbps802.11 a/n: 1 Stream 23 23 * 150 Mbps = 3.4 Gbps802.11 a 23 23 * 54 Mbps = 1.2 Gbps802.11 g/n: 3 Streams 3 3 * 450 Mbps = 1.35 Gbps(1 or 2 streams have proportionally lower capacity)802.11 g 3 3 * 54 Mbps = 162 Mbps802.11 b 3 3 * 11 Mbps = 33 MbpsEthernet switchMultiple port connections

Wireless Array44 Installing the Wireless ArrayIn addition, the Array has full failover protection between the bonded-pair Gigabit ports (see following table).The Wireless Array Gigabit Ethernet ports actually support a number of modes:z802.3ad Link AggregationzLoad BalancingzBroadcastzLink BackupzMirroredFor more details on Gigabit port modes and their configuration, please see“Network Bonds” on page 171. Interface Bridges Data?Bridges Management Traffic?Fails Over To: IP addressGigabit port Yes Yes Bonded port DHCP or staticBonded Gigabit port Yes Yes Bonded port Same

Wireless ArrayInstalling the Wireless Array 45Switch Failover ProtectionTo ensure that service is continued in the event of a switch failure, you can connect Arrays having multiple Gigabit ports to more than one Ethernet switch (not a hub).Figure 23. Switch Failover Protection See AlsoCoverage and Capacity PlanningInstallation PrerequisitesNetwork Management PlanningPlanning Your InstallationPower PlanningSecurity Planning#Gigabit Ethernet connections must be on the same subnet.Ethernet switch Backup switchEthernet connections

Wireless Array46 Installing the Wireless ArrayPower Planning All XR Series Array models support Power over Gigabit Ethernet (PoGE) with an integrated splitter. Power over Gigabit EthernetTo deliver power to the Array, you must use Xirrus-supplied Power over Gigabit Ethernet (PoGE) modules or powered switches. They provide power over Cat 5e or Cat 6 cables to the Array without running power cables — see Figure 4 on page 13. Specific models of the Array are compatible with specific PoGE modules. Fordetails, please see the Power over Gigabit Ethernet Installation and User Guide. See AlsoCoverage and Capacity PlanningFailover PlanningNetwork Management PlanningSecurity Planning#When using Cat 5e or Cat 6 cable, power can be provided up to a distance of 100m.Certain Xirrus models (XR-520 and XR--520H) also accept IEEE802.3af and IEEE802.3at powered switch ports.

Wireless ArrayInstalling the Wireless Array 47Security PlanningThis section offers some useful guidelines for defining your preferred encryption and authentication method. For additional information, see “Understanding Security” on page 209 and the Security section of “Frequently Asked Questions” on page 480. Wireless EncryptionEncryption ensures that no user can decipher another user’s data transmitted over the airwaves. There are three encryption options available to you, including:zWEP-40bit or WEP-128bitBecause WEP is vulnerable to cracks, we recommend that you only use this for legacy devices that cannot support a stronger encryption type.zWi-Fi Protected Access (WPA)This is much more secure than WEP and uses TKIP for encryption.zWi-Fi Protected Access (WPA2) with AES This is government-grade encryption — available on most new client adapters — and uses the AES–CCM encryption mode (Advanced Encryption Standard–Counter Mode).AuthenticationAuthentication ensures users are who they say they are, and occurs when users attempt to join the wireless network and periodically thereafter. The following authentication methods are available with the Wireless Array:zRADIUS 802.1x 802.1x uses a remote RADIUS server to authenticate large numbers of clients, and can handle different authentication methods (EAP-TLS, EAP-TTLS, EAP-PEAP, and EAP-LEAP Passthrough). Administrators may also be authenticated via RADIUS when preferred, or to meet particular security standards. zXirrus Internal RADIUS serverRecommended for smaller numbers of users (about 100 or less). Supports EAP-PEAP only

Wireless Array48 Installing the Wireless ArrayzPre-Shared KeyUses a pass-phrase or key that is manually distributed to all authorized users. The same passphrase is given to client devices and entered into each Array.zMAC Access Control Lists (ACLs)MAC access control lists provide a list of client adapter MAC addresses that are allowed or denied access to the wireless network, and can be used in addition to any of the above authentication methods. ACLs are good for embedded devices, like printers and bar-code scanners (though MAC addresses can be spoofed). The Array supports 1,000 global ACL entries. You may also define per-SSID access control lists, with up to 1000 entries each.See AlsoFailover PlanningNetwork Management PlanningPower Planning

Wireless ArrayInstalling the Wireless Array 49Port Requirements A number of ports are used by various Array features and by the Xirrus Management System (XMS). The Port Requirements table on page 50 lists ports and the features that require them (XMS port requirements are included in the table for your convenience). If you are using a feature, please make sure that the ports that it requires are not blocked by firewalls or other policies, and that they do not conflict with any other port assignments.As an example, XMS port requirements are illustrated in Figure 24. XMS requires ports 161, 162, and 443 to be passed between Arrays and the XMS server. Similarly, port 9443 is required for communication between the XMS server and XMS clients, and port 25 is typically used by the XMS server to access an SMTP server to send email notifications. Figure 24. Port Requirements for XMSFirewallXMS Server XMS Client*L2 Switching InfrastructureSMTP Server*InternalResourcesExternal Network /InternetPorts:9090, 9091Ports:161, 162, 443SSID Trafc onVLANs A, B, etc.Management overNative VLANTrafc from ArraysVLAN BTrafc from ArraysVLAN ATrunked 802.1qVLAN ConnectionPorts:25* XMS Client and SMTP Server may be internal or external resources.

Wireless Array50 Installing the Wireless ArrayThe following table lists port requirements for the Array and for XMS, how they are used, and whether they may be changed.Port Application Peer ConfigurableArray icmp Ping XMS Server No20 tcp21 tcp FTP Client Yes22 tcp SSH Client Yes23 tcp Telnet Client Yes25 tcp SMTP Mail Server No69 udp TFTP TFTP Server No123 udp NTP NTP Server No161 udp SNMP XMS Server No162 udp SNMP Traphost Note - Up to four Traphosts may be configured.XMS ServerYes - but required by XMS443 tcp HTTPS (WMI,WPR) Client Yes514 udp Syslog Syslog Server No1812, 1645 udpRADIUS (some servers use 1645) RADIUS Server Yes1813, 1646 udpRADIUS Accounting(some servers still use 1646)RADIUS Accounting Server Yes2055 udp Netflow Client Yes5000 tcp Virtual Tunnel VTUN Server Yes22610 udp XRP (Xirrus Roaming) Arrays Yes22612 udp Xircon (Console Utility) Admin Workstation Yes

Wireless ArrayInstalling the Wireless Array 51XMSicmp Ping Arrays No22 tcp SSH Arrays Yes25 tcp SMTP Mail Server Yes123 udp NTP NTP Server No161 udp SNMP Arrays No162 udp SNMP Traphost 1 Arrays Via XMS config file443 tcp HTTPS Arrays No514 udp Resident Syslog server Internal* Via XMS config file1099 tcp RMI Registry Internal* No2000 tcp XMS Back-end Server Internal* No3306 tcp MySQL Database Internal* No8001 tcp Status Viewer Internal* No8007 tcp Tomcat Shutdown Internal* During installation8009 tcp Web Container Internal* During installation9090 tcp XMS Webserver XMS client During installation9091 tcp XMS Client Server XMS client Via XMS config file9092 tcp XMS Client Server XMS client Via XMS config file9443 tcp XMS WMI SSL XMS web client Yes* Internal to XMS Server, no ports need to be unblocked on other network devices Port Application Peer Configurable

Wireless Array52 Installing the Wireless ArraySee AlsoManagement ControlExternal RadiusServicesVLAN Management

Wireless ArrayInstalling the Wireless Array 53Network Management PlanningNetwork management can be performed using any of the following methods:zCommand Line Interface, using an SSH (Secure Shell) utility, like PuTTY. The utility must be set up to use SSH-2, since the Array will only allow SSH-2 connections. zWeb-based management, using the Array’s embedded Web Management Interface (WMI). This method provides configuration and basic monitoring tools, and is good for small deployments (one or two units).zCentralized Web-based management, using the optional Xirrus Management System (XMS), which can be run on a dedicated Xirrus appliance or your own server. The XMS is used for managing large Wireless Array deployments from a centralized Web-based interface and offers the following features: Globally manage large numbers of Arrays Seamless view of the entire wireless network Easily configure large numbers of Arrays  Rogue AP monitoring Easily manage system-wide firmware updates  Monitor performance and trendsAggregation of alerts and alarmsSee AlsoFailover PlanningPower PlanningSecurity Planning

Wireless Array54 Installing the Wireless ArrayWDS PlanningWDS (Wireless Distribution System) creates wireless backhauls between Arrays, allowing your wireless network to be expanded using multiple Arrays without the need for a wired backbone to link them (see Figure 25). WDS features include:zOne to three IAPs may be used to form a single WDS link, yielding up to 1350 Mbps bandwidth per link. Up to three different WDS links may be created on a single Array. zAutomatic IAP Load Balancing zIf desired, you may allow clients to associate to a BSS on the same radio interface used for a WDS Host Link. This will take bandwidth from the WDS link. Figure 25. WDS LinkzMultiple links per Array allow you to configure multi-hop connections.

Wireless ArrayInstalling the Wireless Array 55Figure 26. A Multiple Hop WDS ConnectionzMultiple WDS links can provide link redundancy (failover capability - see Figure 27). A network protocol (Spanning Tree Protocol — STP) prevents Arrays from forming network loops. Figure 27. WDS Failover Protection

Wireless Array56 Installing the Wireless ArrayWDS links have a Host/Client relationship similar to the usual IAP/station pattern for Arrays:zA WDS Client Link associates/authenticates to a host (target) Array in the same way that a station associates to an IAP. The client side of the link must be configured with the root MAC address of the target (host) Array.zA WDS Host Link acts like an IAP by allowing one WDS Client Link to associate to it. An Array may have both client and host links.WDS configuration is performed only on the client-side Array. See “WDS” on page 345. Note that both Arrays must be configured with the same SSID name.

Wireless ArrayInstalling the Wireless Array 57Common Deployment OptionsThe following table lists some typical and recommended deployment options for a number of the features that have been discussed in this chapter. See AlsoCoverage and Capacity PlanningNetwork Management PlanningPlanning Your InstallationPower PlanningSecurity PlanningFunctionNumber of Wireless ArraysOne or Two Three or MorePower Power over Gigabit Ethernet Power over Gigabit EthernetUPS backup(recommended)Failover Recommended Highly recommendedVLANs Optional Optional use,Can be used to put all APs on one VLAN or map to existing VLAN schemeEncryption WPA2 with AES (recommended)PSK or 802.1x WPA2 with AES (recommended)802.1x keyingAuthentication Internal RADIUS serverEAP-PEAPPre-Shared KeyExternal RADIUS serverManagement Internal WMIInternal CLI (via SSHv2)Cloud XMS orXMS (Enterprise-hosted)

Wireless Array58 Installing the Wireless ArrayInstallation WorkflowThis workflow illustrates the steps that are required to install and configure your Wireless Array successfully. Review this flowchart before attempting to install the unit on a customer’s network. Cloud XMS customers will skip the last two steps.Figure 28. Installation Workflow See AlsoCoverage and Capacity PlanningCommon Deployment OptionsDetermine the number of Arrays neededChoose the location(s) for your Wireless ArraysInstall the mounting plateConnect the cables and turn on the powerVerify that the Ethernet link and radio LEDs are functioning correctlyReview the Array ConfigurationRun Ethernet cables for PoGE(<100m total distance from switch)Log in to WMI

Wireless ArrayInstalling the Wireless Array 59Failover PlanningInstallation PrerequisitesPlanning Your InstallationPower PlanningWireless Array Product OverviewSecurity Planning

Wireless Array60 Installing the Wireless ArrayInstalling Your Wireless ArrayThis section provides information about the physical installation of your Xirrus Wireless Array. For complete instructions, please see the Quick Installation Guide (QIG) for your model of Array or Access Point. Choosing a LocationBased on coverage, capacity and deployment examples previously discussed, choose a location for the Array that will provide the best results for your needs. The Wireless Array was designed to be mounted on a ceiling where the unit is unobtrusive and wireless transmissions can travel unimpeded throughout open plan areas.You also have the option of mounting the Array on a wall, using the optional wall mount assembly kit.Choose a location that is central to your users (see the following diagram for correct placement.Figure 29. Array PlacementWRONGCORRECTRORRERORRECWRONGGGOONRORONONRORON

Wireless ArrayInstalling the Wireless Array 61Wiring ConsiderationsBefore using the Xirrus-supplied Power over Gigabit Ethernet modules (PoGE) to distribute power, see “Power over Gigabit Ethernet (PoGE)” on page 13. Once you have determined the best location for your Wireless Array, you must run cables to the location for the following services:PowerzNo separate power cable to the Array is required when using PoGE modules. The PoGE module requires a dedicated AC power outlet (100 - 240 VAC).NetworkzGigabit POE1 — the total of all Cat 5e or Cat 6 cable segments from the Gigabit Ethernet switch to an Array Ethernet port must be less than 100m long. The Array must be connected to PoGE networks without routing cabling to the outside plant, to ensure that cabling is not exposed to lightning strikes or possible high voltage crossover.zGigabit POE2—For Arrays with a second POE port, the same restrictions listed above apply.zSerial cable (optional) — cable lengths up to 25’ per the RS-232 specification.Important Notes About Network ConnectionsRead the following notes before making any network connections.#When the unit’s IP address is unknown or a network connection has not been established, the serial cable is used for connecting directly with the Command Line Interface (CLI) via HyperTerminal. When a network connection is established, the Array can be managed from any of the available network connections, either Gigabit 1 or Gigabit 2. For models with no console port, such as the XR-500, XR-1000, and some XR-2000 models, the Xirrus Xircon utility may be used locally to set up an IP address if necessary.

Wireless Array62 Installing the Wireless ArraySee AlsoFailover PlanningInstallation PrerequisitesInstallation WorkflowMounting and Connecting the ArrayPower over Gigabit Ethernet (PoGE)!The Array’s Ethernet ports should be plugged into an Ethernet switch, not an Ethernet hub — if a hub is used, we recommend that you connect only one Ethernet port.

Wireless ArrayInstalling the Wireless Array 63Mounting and Connecting the Array A number of options are available for mounting Arrays, depending on the model:zCeiling mountzWall mountzSecure mount in a locking indoor enclosurezI-Beam mount in a protective enclosure (gymnasium mount)zFactory enclosureA detailed Quick Installation Guide is available at support.xirrus.com for the mounting option that you selected when ordering your Array. Please follow the provided instructions carefully. Data and power connections to the Array are detailed in the Quick Installation Guide for the Array or Access Point model, also available at support.xirrus.com. Please follow the cabling and connection instructions carefully. Dismounting the Array For all Array models, push up on the Array (i.e., push it against the mounting plate). Then turn the Array to the left to remove it. This is similar to dismounting a smoke detector.

Wireless Array64 Installing the Wireless ArrayPowering Up the Wireless ArrayWhen powering up, the Array follows a specific sequence of LED patterns showing the boot progress, and following a successful boot will provide extensive status information.Figure 30. LED LocationsArray LED settings may be altered or disabled entirely for diagnostic purposes or for personal preference. Changes are made via the Array’s Command Line Interface or the Web Management Interface — refer to “LED Settings” on page 340. Ethernet Activity and Status LEDsIAP LEDs

Wireless ArrayInstalling the Wireless Array 65Array LED Operating SequencesUse the following tables to review the operating sequences of the Array’s LEDs. z“LED Boot Sequence” on page 65z“LED Operation when Array is Running” on page 66LED Boot SequenceThe normal boot LED sequence is as follows:Array Activity Status LED IAP LEDsPower ON Blinking GREEN All OFFBoot loader power ON self-testBlinking GREEN All ONImage load from compact FLASHBlinking GREEN Spinning pattern (rotate all to ON, then all to OFF)Image load failure Blinking ORANGE All OFFHand off to ArrayOS Solid GREEN All OFFSystem software initializationSolid GREEN Walking pattern — (LED rotating one position per second)Up and running Solid GREEN ON for IAPs that are up:OFF for IAPs that are down.Green or orange per table on the next page.Behavior may be changed using “LED Settings” on page 340.

Wireless Array66 Installing the Wireless ArrayLED Operation when Array is RunningThe normal LED operation when the Array is running is shown in the table below. Note that behavior may be modified using “LED Settings” on page 340 or via the CLI.LED Status ReasonIAP LED is OFF IAP is downIAP LED is solid ON IAP is up, but no associations and no trafficIAP LED heartbeat IAP is up, with stations associated but no trafficIAP LED flashingFlashing at 10 HzFlashing at 5 HzFlashing at 2.5 HzIAP is up, passing trafficTraffic > 1500 packets/secTraffic > 150 packets/secTraffic > 1 packet/sec IAP LED is GREEN IAP is operating in the 2.4 GHz bandIAP LED is ORANGE IAP is operating in the 5 GHz bandIAP LED flashing ORANGE to GREEN at 1 HzThe radio is in monitor mode(standard intrude detect)STATUS LED is GREEN *** Array is operational GIG (Ethernet) LEDs are dual colorEthernet LED is ORANGEEthernet LED is GREENTransferring data at 1 GbpsTransferring data at 10/100 Mbps *** NOTE: On an XR-2000 Series Array model ending an a 5, there is a combined GIG2/STS LED. If the GIG2 port is not connected, the LED behaves as a Status LED. If the GIG2 port is connected, the LED behaves as a GIG2 LED.

Wireless Array68 Installing the Wireless Arraysettings for each Array before deployment. Settings may be duplicated from one Array to the next or entered in bulk. Please see the Xirrus Mobilize User’s Guide. Mobilize sets up an initial software image and configuration upon deployment of the Array. The Array will continue to check for further updates during a grace period after deployment (typically two weeks). After the grace period Mobilize does not provide continuing software and configuration updates. For ease of ongoing management, Xirrus recommends using XMS. Please see “Xirrus Management System (XMS)” on page 2. Note that your Xirrus wireless equipment will continue to be able to fetch and activate license updates to which you are entitled. See “License Key/Auto-provisioning:” on page 375. User Interfaces (CLI, WMI)With the zero-touch setup provided by Mobilize, your Xirrus network is ready for use a few minutes after deployment. We recommend that you use the Xirrus Management System (XMS) for ongoing monitoring and fine-tuning of the network. Should you wish to check the configuration of individual Arrays locally, Array settings may be viewed or configured through the Command Line Interface (CLI) using SSH, or on a browser with the Web Management Interface (WMI). You may use the CLI via the serial management port (console—on all Arrays except the XR-500 and XR-1000 Series and some XR-2000 models) or any of the Gigabit Ethernet ports. You can use the WMI via any of the Array’s Ethernet ports. Note that Arrays that are managed via XMS may only allow local access in read-only mode (see “XMS-Managed Arrays Restrict Local Management” on page 78 for details). Figure 31. Network Interface Ports—XR-520 (left); XR-1000 Series (right) Gigabit POE (gig1)

Wireless ArrayInstalling the Wireless Array 69Figure 32. Network Interfaces—XR-2000 Series (left); XR-2005 Series (right)Figure 33. Network Interface Ports—XR-4000 Series Figure 34. Network Interface Ports—XR-6000 Series#The Xirrus Xircon utility may also be used to communicate with Arrays locally as an alternative to using a serial connection to the console. This is especially useful for the XR-500 and XR-1000 Series and some XR-2000 models, which do not have a console port. See “Securing Low Level Access to the Array” on page 73. GIGABIT1 POE /GIGABIT1 POE+GIGABIT2CONSOLESerial (Console)Gigabit POE (gig1)Gigabit 2 (gig2)Serial (Console)Gigabit POE1 (gig1)Gigabit POE2 (gig2)Gigabit 3 (gig3)Gigabit 4 (gig4)

Wireless Array70 Installing the Wireless ArrayUsing the Serial PortIf using the serial port to make your connection, use serial settings of 8 bits, no parity, no flow control, 1 stop bit (8N1) and a speed setting of 115200 baud. Use the communication package of your choice. You may use the serial port to change settings on the Array, even if the Array’s gigabit interfaces are in XMS managed mode (i.e., read-only mode, see “XMS-Managed Arrays Restrict Local Management” on page 78). Using the Ethernet PortsBy default, the Array's Ethernet interfaces use DHCP to obtain an IP address. If the Array is booted and does not receive DHCP addresses on Gigabit Ethernet ports, then both Gigabit1 and its bonded pair port (if any) will default to 10.0.2.1 with a mask of 255.255.255.0. If the Array is connected to a network that provides DHCP addresses, the IP address can be determined by the following three methods:1. The simplest way to address the Array is using its default hostname which is the Array’s serial number (for example, XR40123091CACD). If your network provides DHCP and DNS, then you can use this hostname.2. Otherwise, examine the DHCP tables on the server and find the addresses assigned to the Array (Xirrus MAC addresses begin with 000F7D).3. Alternatively, you may query the Array using the CLI via the console port (on all models except the XR-500, XR-1000, and some XR-2000 models). Log in using the default user name admin and password admin. Use the show ethernet command to view the IP addresses assigned to each port.4. If the Array cannot obtain an IP address via DHCP, the factory default uses a static IP address of 10.0.2.1 with a mask of 255.255.255.0 on its Gigabit POE port. To connect to the Array, you must set your laptop to be in the same subnet as the Array: set your laptop’s IP address to be in the 10.0.2.xx #Take care to ensure that your network is not using the 10.0.2.1 IP address prior to connecting the Array to the network.

Wireless ArrayInstalling the Wireless Array 71subnet, and set its subnet mask to 255.255.255.0. If this subnet is already in use on your network, you may connect your laptop directly to the Array by connecting the laptop to the power injector’s IN port temporarily (this port may be called the SWITCH port or the DATA port on your injector). Starting the WMIUse this procedure to log in to the WMI via your Web browser. 1. Establish a network connection and open your Web browser.2. Connect to the Wireless Array using its host name or IP address as described in the previous section.Logging InWhen logging in to the Array, use the default user name and password — the default user name is admin, and the default password is admin.See AlsoInstallation WorkflowPerforming the Express Setup ProcedurePowering Up the Wireless ArrayLicensingWhen a newly deployed Array boots up, it automatically contacts Xirrus with its serial number and MAC address and obtains its license key, software image, and initial configuration. Any unlicensed Array will update in this way after it boots up, if it has Internet connectivity. A license is needed to enable the full functionality of the Array. Without a license, the Array can be powered up and will only have a basic wireless network configuration including just one operating radio. The Array’s license determines some of the features that are available on the Array. For example, the Application Control feature on XR Arrays requires a

Wireless Array72 Installing the Wireless Arraylicense. The Array’s license is not installed at the factory. The Array must have a license before providing wireless service. If you need to enter the license manually, use the following procedure. It describes entering the license key using the WMI. If you are using the Xirrus Management System (XMS), you may use it to manage and upgrade large numbers of licenses for the wireless network. XMS Cloud will perform these functions for you automatically.1. This procedure assumes that you have pointed a browser to the Array’s IP address to start WMI, and that you have logged in with the default username and password above. 2. In the left hand frame, in the Configuration section, click Express Setup. 3. License Key: Enter the key that was provided for the Array. The key was provided to you in an email as an attachment in the form of an Excel file (.xls). Enter the key exactly as it appears in the file. Click the Applybutton to apply the key. 4. Now you may verify the features provided by the key. In the Statussection of the left hand frame, click Array and then click Information. Check the items listed in the License Features row. Performing the Express Setup ProcedureThe Express Setup procedure establishes global configuration settings that enable basic Array functionality. Changes made in this window will affect all radios. If you are not using Mobilize to perform your initial configuration, please see “Express Setup” on page 159. Also see “Zero-Touch Setup Using Mobilize” on page 67. See AlsoEstablishing CommunicationInstallation PrerequisitesInstallation WorkflowLogging InMultiple SSIDs

Wireless ArrayInstalling the Wireless Array 73SecuritySecuring Low Level Access to the ArrayMost local management of the Xirrus Array is done via the Web Management Interface (WMI) or CLI—see “The Command Line Interface” on page 397. The Array also has a lower level interface: XBL (Xirrus Boot Loader), which allows access to more primitive commands. You won’t normally use XBL unless instructed to do so by Xirrus Customer Support. For proper security, you should replace the default XBL login username and password with your own, as instructed below. XBL has its own username and password, separate from the ArrayOS Admin User and Password (used for logging in to the WMI and CLI)that you may change on the Express Setup page (see Step 5 on page 163). Xirrus also provides the Xircon utility for connecting to Xirrus XR Arrays that are not reachable via the normal access methods (such as SSH or WMI) and that do not have a physical console port (XR-500 and XR-1000 Series Arrays and some XR-2000 models), or whose console port is not accessible. Xircon discovers Arrays on your network subnet by sending IP/UDP broadcast packets. Once an Array is discovered, Xircon can establish an encrypted console session to the Array via the network even if the Array IP configuration is incorrect. Xircon allows you to manage the Array using CLI, just as you would if connected to the console port. Xircon also has an option for easily accessing XBL.In normal circumstances Xirrus Arrays should be configured and managed through secure shell (SSH) or via the Web Management Interface (WMI). A connection is established using either the Array hostname or DHCP-assigned IP address, or via the other options described in “Using the Ethernet Ports” on page 70. Xircon may be needed in special circumstances as directed by Xirrus Customer Support for troubleshooting Array problems or IP connectivity. (In this case, see the Xircon User Guide for detailed information.) Xircon access to the Array may be controlled:zYou may enable or disable all Xircon access to the Array as instructed in the procedure below. There are also options to allow access only to CLI (i.e., ArrayOS access) or only to XBL.

Wireless Array74 Installing the Wireless ArrayzSince XR-500 and XR-1000 and some XR-2000 models do not have a console port, these models have Xircon access to both XBL and CLI enabled by default. For Arrays that do not have a console port, to avoid potentially being locked out of the Array, Xircon should always be enabled at the XBL level at least.zOn all other Array models (those with a console port), Xircon access to both XBL and CLI is disabled by default. If Xircon is not going to be used to access an Array, we recommend leaving Xircon access disabled.Procedure for Securing Low Level Array AccessUse the following steps to replace the default XBL username and password, and optionally to change the type of Xircon management access that is allowed. These steps use CLI commands. 1. To access CLI via the WMI, click CLI under the Tools section on the left (for detailed instructions see “CLI” on page 385). Skip to Step 4 on page 75.To access CLI via SSH, see “Establishing a Secure Shell (SSH) Connection” on page 398. Then proceed to the next step. 2. At the login as prompt, log in to CLI using the username and password that you set in Step 5 on page 163, or the default value of admin/admin if you have not changed them. login as: jsmithjsmith@xr4012802207c's password:Xirrus Wi-Fi ArrayArrayOS Version 6.1.2-3299Copyright (c) 2005-2012 Xirrus, Inc.http://www.xirrus.com!If you disable Xircon access to both XBL and CLI on models with no console port, you must ensure that you do not lose track of the username and password to log in to CLI/WMI! In this situation, there is no way to recover from a lost password, other than returning the Array to Xirrus. If you have Xircon access to XBL enabled, you can reset the password, but this recovery will require setting the unit to factory defaults with loss of all configuration data.

Wireless ArrayInstalling the Wireless Array 75Array42#3. Type configure to enter the CLI config mode.Array42#configure4. If Xircon access at the XBL level is to be allowed, use the following three commands to change the XBL username and password from the default values of admin/admin. In the example below, replace newusernameand newpassword with your desired entries. Note that these entries are case-sensitive. Array42#(config)#boot-envArray42#(config-boot)#set username newusernameArray42#(config-boot)#set password newpasswordArray42#(config-boot)#saveSaving boot environment .... OKArray42(config-boot)# exit5. Enter the following commands if you wish to change Xircon access permission: Array42#(config)# managementArray42#(config-mgmt)# xircon <management-status>Array42#(config-mgmt)# saveArray42#(config-mgmt)# exitArray42#(config)#<management-status> may be one of :zon enables both CLI and XBL accesszoff disables both CLI and XBL accesszaos-only enables only CLI (i.e. ArrayOS) accesszboot-only enables only XBL accessNote that there is a WMI setting for changing Xircon access, timeout period, and the UDP port used. This may be used instead of CLI if you wish. See “Management Control” on page 221. Note that you cannot change the XBL username and password via the WMI.

Wireless Array76 Installing the Wireless Array

Wireless ArrayThe Web Management Interface 77The Web Management InterfaceThis topic provides an overview of the Xirrus Wireless Array’s embedded Web Management Interface (WMI), used for establishing your network’s configuration settings and wireless operating parameters. It also includes login instructions. The following topics are discussed: zXMS-Managed Arrays Restrict Local Management zAn Overview zStructure of the WMI zUser InterfacezLogging InzApplying Configuration Changes#If you are a Cloud XMS customer, then Arrays are managed via the cloud, and local Array management interfaces are inaccessible. If the Array is being managed by your own server for XMS Release 6.5 or above, and if the Array has been assigned to a named network in XMS, you will be restricted to read-only Array access. See “XMS-Managed Arrays Restrict Local Management” on page 78.

Wireless ArrayThe Web Management Interface 79only for the duration of the user session. At the next login by this user, privileges revert to read-only. There is no equivalent override command for the WMI, and it is not possible to use the WMI to make changes to the Array settings at all when the Array is in XMS managed mode. Overriding XMS managed mode still allows XMS operations to proceed. For example: •XMS continues polling for statistics.•You may still make configuration changes to the Array via XMS, and those changes will be made on the Array. Similarly, changes made to an XMS Network (XMS Release 6.5 and later) that includes this Array will still be “pushed” to this Array—this will entirely replace the Array’s configuration with XMS settings, replacing any local settings that you made on the Array. XMS will be unaware of changes to Array settings that are made locally using the xms-override CLI command until the next XMS refresh cycle (typically daily), resulting in the Array’s settings being out of synchronization with XMS. In XMS, you may go to the Monitor > Arraysor Configure > Arrays page, select the Array, and click the Refreshbutton to synchronize XMS with your change,. This causes XMS to read the current configuration of the Array and update the XMS database with these values.XMS Non-Managed Mode:zThe Array operates in this mode by default, and stays in this mode if it is not put into XMS managed mode as described above. zA user with administrator privileges (read-write) has normal unrestricted access to modify settings via the WMI and CLI, as determined by the user account write privileges. #For troubleshooting or emergency purposes, write access to the Array is always available via the serial (console) port. You can also use Xircon for this purpose, if so instructed by Xirrus Customer Support.

Wireless Array80 The Web Management InterfaceAn OverviewThe WMI is an easy-to-use graphical interface to your Wireless Array. It allows you to configure the product to suit your individual requirements and ensure that the unit functions efficiently and effectively. Options allow you to choose among different appearances for the WMI. See “Options” on page 392.Figure 36. Web Management Interface—Option = New StyleFigure 37. Web Management Interface—New Style (Default)

Wireless ArrayThe Web Management Interface 81Figure 38. Web Management Interface—Option = Classic StyleFigure 39. Web Management Interface—Classic Style

Wireless Array82 The Web Management InterfaceStructure of the WMI The content of the WMI is organized by function and hierarchy, shown in the following table. Click on any item below to jump to the referenced destination.Status WindowsArray Status WindowsArray SummaryArray InformationArray ConfigurationAdmin HistoryNetwork Status WindowsNetwork MapSpanning Tree StatusRouting TableARP TableDHCP LeasesConnection Tracking/NATCDP NeighborsNetwork AssuranceRF Monitor WindowsIAPsSpectrum AnalyzerIntrusion DetectionChannel HistoryRadio AssuranceStation Status WindowsStationsLocation MapRSSISignal-to-Noise Ratio (SNR)Noise FloorMax by IAPStation AssuranceStatistics WindowsIAP Statistics SummaryPer-IAP StatisticsNetwork StatisticsVLAN StatisticsWDS StatisticsIDS StatisticsFilter StatisticsStation StatisticsPer-Station StatisticsApplication Control WindowsSystem Log WindowIDS Event Log Window

Wireless ArrayThe Web Management Interface 83Configuration WindowsExpress SetupNetworkNetwork InterfacesNetwork BondsDNS SettingsCDP SettingsServicesTime Settings (NTP)NetFlowWi-Fi TagLocationSystem LogSNMPDHCP ServerVLANsVLAN ManagementTunnelsTunnel ManagementSecurityAdmin ManagementAdmin PrivilegesAdmin RADIUSManagement ControlAccess Control ListGlobal SettingsExternal RadiusInternal RadiusRogue Control ListAirWatchSSIDsSSID ManagementActive IAPsPer-SSID Access Control ListGroupsGroup ManagementConfiguration Windows (cont’d)IAPsIAP SettingsGlobal Settings (IAP)Global Settings .11an Global Settings .11bgnGlobal Settings .11nGlobal Settings .11uAdvanced RF SettingsHotspot 2.0NAI RealmsNAI EAPIntrusion DetectionLED SettingsDSCP Mappings Roaming Assist WDSWDS Client LinksFiltersFilter ListsFilter ManagementClustersCluster DefinitionCluster ManagementCluster OperationTool WindowsSystem ToolsCLIOptionsLogout

Wireless Array84 The Web Management InterfaceUser Interface Figure 40. WMI: Frames Left frame Right frame Array infoClick to configure IAP/view statisticsLog Message countersTop level menuHelpPull-down menu(expand/collapse)

Wireless ArrayThe Web Management Interface 85The WMI has been designed with simplicity in mind, making navigation quick and easy. In the following example, you’ll see that windows are divided into left and right frames. The left frame contains three main elements:zMenu organized by function (for example, Network, SSIDs, Security, etc.). Click a heading, such as Network, to display a summary of its current configuration, as well as an associated pull-down menu. The three major menu sections (Status, Configuration, Tool s) may each be collapsed down to hide the headings under them. Click again to display the headings. (Figure 41 ) zThree Log Messages counters are located at the bottom of the menu. They provide a running total of messages generated by the ArrayOS Syslog subsystem during your session — organized into Critical, Warning, and General messages. Click on a counter to display the associated Syslog messages. Messages at the selected level or higher will be shown. For more information, please see “System Log Window” on page 154. zThe Array representation contains shortcut links. Click a radio to view statistics for it. Click the center of the Array to display the IAP Settings window, which allows you to configure the Array’s radios. Figure 41. Major Menu Sections Collapsed (on left)

Wireless Array86 The Web Management InterfaceThe right frame displays the status information or configuration parameters for the Wireless Array. This is where you review the Array’s current status and activity or input data (if you want to make changes). The green Array information bar at the top of the frame describes the Array — the Name and IP address allow you to quickly confirm that WMI is connected to the correct Array. The current Uptime since the last reboot is also shown.Note that WMI provides options which allow you to change its appearance and behavior. You may change:zStyle — changes the colors and appearance of WMI (i.e., its “skin”).zRefresh Interval — the refresh time when automatic refresh is selected.zClose menu section when deselected — changes the behavior of the menu in the left frame.zClear screen when loading new page.See “Options” on page 392 for more information.#Some settings are only available if the Array’s license includes appropriate Xirrus Advanced Feature Sets. If a setting is unavailable (grayed out), then your license does not support the feature. See “About Licensing and Upgrades” on page 373.

Wireless ArrayThe Web Management Interface 87Utility ButtonsAt the bottom of each window you will find a set of useful buttons — a Feedbackbutton, a Print button and a Help button. Figure 42. WMI: Utility ButtonszClick on the Feedback button to generate a Web page that allows you to submit your comments to Xirrus, Inc. zClick on the Print button to send a print file of the active window to your local printer.zClick on the Help button to access the Array’s online help system.Submitting Your CommentsWhen submitting comments via the Feedback button (ensure that you provide as much detail as possible, including your contact information, the product model number that the comment relates to, and the ArrayOS software version (if known). When finished, click on the Submit button to submit your comment.Print buttonHelp buttonFeedback button

Wireless Array88 The Web Management InterfaceLogging InUse this procedure to log in to the WMI via your Web browser. 1. Establish a network connection and open your Web browser.2. If your network supports DHCP and DNS, enter the Array’s default host name in the browser’s URL. The default host name is simply the Array’s serial number (for example, XR0823091CACD). Otherwise, enter the Array’s IP address. This may be determined as described in “Using the Ethernet Ports” on page 70. 3. To log in to the Array’s Web Management Interface, enter admin for both the user name and password.Figure 43. Logging In to the Wireless ArrayApplying Configuration ChangesIn most of the WMI configuration windows, your changes to settings are applied to the Array as you make them. In most cases, there is no separate Apply button to click to make the changes take effect. There are a few exceptions to this rule. In #If you are a Cloud XMS customer, then Arrays are managed via the cloud, and local Array management interfaces are inaccessible. If the Array is being managed by your own server for XMS Release 6.5 or above, and if the Array has been assigned to a named network in XMS, you will be restricted to read-only Array access. See “XMS-Managed Arrays Restrict Local Management” on page 78.

$Wireless ArrayThe Web Management Interface 89these cases, a particular section of a page may have its own Apply Settingsbutton right below the settings. In both cases described above, the changes that you have made are not saved to the latest configuration file in the Array’s flash memory, so they will not be restored after a reboot. Click the Save changes to flash button (located on the upper right of each page) in order to make sure that these changes will be applied after rebooting. This will save the entire current configuration, not only the changes on current WMI page. Character RestrictionsWhen inputting strings in the WMI (for example, assigning SSIDs, host name, password, etc.), use common alphanumeric characters. Some of the fields in the WMI will not accept special characters, so use of the following characters should typically be avoided: &<>' “/ \$