Cambium Networks XS3700A XS-3700 Wireless LAN Array User Manual xirrus array userguide2

Xirrus, Inc. XS-3700 Wireless LAN Array xirrus array userguide2

Contents

Users Manual Part 2

Wireless LAN Array106 Configuring the Xirrus ArrayStatistics (for all radios)This page provides a detailed statistical summary of the performance of all radios,displayed either numerically or by percentage (your choice). The following imageshows an example from the XS-3700 product.The default Statistics Type is NUMERIC, but you can change this toPERCENTAGE from the pull-down menu at the top of the page. In addition, youcan Refresh or Clear the data on this page at any time by clicking on theappropriate button.Figure 74. WMI: Statistics for All IAPs Page (XS-3700)
Wireless LAN ArrayConfiguring the Xirrus Array 107SSIDThis is a status only page that allows you to review SSID (Service Set IDentifier)assignments. It includes the SSID name, whether or not an SSID is visible on thenetwork, any security and QoS parameters defined for each SSID, associatedVLAN IDs, and radio availability per SSID. There are no configuration optionsavailable on this page, but if you are experiencing problems or reviewing SSIDmanagement parameters, you may want to print this page for your records.For information to help you understand SSIDs and how multiple SSIDs aremanaged by the XS-3900, go to the Multiple SSIDs section of “Frequently AskedQuestions” on page 222.Figure 75. WMI: SSID Page
Wireless LAN Array108 Configuring the Xirrus ArrayUnderstanding SSIDsThe SSID (Service Set Identifier) is a unique identifier that wireless networkingdevices use to establish and maintain wireless connectivity. Multiple access pointson a network or sub-network can use the same SSIDs. SSIDs are case-sensitiveand can contain up to 32 alphanumeric characters (do not include spaces whendefining SSIDs).Multiple SSIDsA BSSID (Basic SSID) refers to an individual access point radio and its associatedclients. The identifier is the MAC address of the access point radio that forms theBSS. A group of BSSs can be formed to allow stations in one BSS to communicateto stations in another BSS by way of a backbone that interconnects each accesspoint.The Extended Service Set (ESS) refers to the group of BSSIDs that are groupedtogether to form one ESS. The ESSID (often referred to as SSID or “wirelessnetwork name”) identifies the Extended Service Set. Clients must associate to asingle ESS at any given time. Clients ignore traffic from other Extended ServiceSets that do not have the same SSID.Legacy access points typically support one SSID per access point. Xirrus WirelessLAN Arrays support the ability for multiple SSIDs to be defined and usedsimultaneously.Using SSIDsThe creation of different wireless network names allows system administrators toseparate types of users with different requirements. The following policies can betied to an SSID:zThe wireless security mode needed to join this SSID.zThe wireless Quality of Service (QoS) desired for this SSID.zThe wired VLAN associated with this SSID.
Wireless LAN ArrayConfiguring the Xirrus Array 109As an example, one SSID named accounting might require the highest level ofsecurity, while another SSID named guests might have low security requirements.Another example may define an SSID named voice that supports voice overWireless LAN phones with the highest possible Quality of Service (QoS)definition. This type of SSID might also forward traffic to specific VLANs on thewired network.SSID ManagementThis page allows you to manage SSIDs (create, edit and delete), and assignsecurity parameters and VLANs on a per SSID basis. When finished, click on theSave button to save your changes, otherwise your changes will not take effect.Figure 76. WMI: SSID Management Page
Wireless LAN Array110 Configuring the Xirrus ArrayProcedure for Managing SSIDs1. New SSID: Enter a new SSID definition.2. Security: From the pull-down list, choose the securitythat will be required by users for this SSID, eitherOpen, WEP or WPA. The Open option provides nosecurity and is not recommended. For an overview ofthe security options, go to “Security Planning” onpage 35.3. Qos Priority: From the pull-down list, select a Quality of Service (QoS)setting. The QoS setting you define here will prioritize wireless traffic forthis SSID over other SSID wireless traffic. This step is optional.4. VLAN ID: From the pull-down list, select a VLAN that you want thistraffic to be forwarded to on the wired network. This step is optional.5. Band Association: The Array allows you to choose which wireless bandthe SSID will be beaconed on. Select either 802.11a,802.11b/g or Both.6. Click on the Create button to create this SSID. The SSID you just createdwill appear in the SSID List below.Editing SSIDs7. SSID: Choose the SSID that you want to edit or delete from the list. If youare deleting a selected SSID, click on the Delete SSID button, otherwisego to Step 2.8. Broadcast SSID: Click on the Enable button to make the selected SSIDvisible to all clients on the network. Although the XS-3900 will notbroadcast SSIDs that are hidden, clients can still associate to a hiddenSSID if they know the SSID name to connect to it. Choose Disable if youdo not want this SSID to be visible on the network.
Wireless LAN ArrayConfiguring the Xirrus Array 1119. Security: From the pull-down list, choose the securitythat will be required by users for the selected SSID—either Open, WEP or WPA. The Open optionprovides no security and is not recommended. For anoverview of the security options, go to “SecurityPlanning” on page 35.10. QoS Priority: From the pull-down list, select a Quality of Service (QoS)setting. The QoS setting you define here will prioritize wireless traffic forthe selected SSID over other SSID wireless traffic. This step is optional.11. VLAN ID: From the pull-down list, select a VLAN that you want thistraffic to be forwarded to on the wired network. This step is optional.12. Band Association: The Array allows you to choose which wireless bandto associate with each SSID. Select either 802.11a,802.11b/g or Both.13. Click on the Modify button to edit the selected SSID.14. Click on the Save button to save your changes (otherwise your newsettings will not take effect).
Wireless LAN Array112 Configuring the Xirrus ArraySecurityThis is a status only page that allows you to review the Array’s securityparameters. It includes the assigned network administration accounts, AccessControl List (ACL) values, WEP and WPA status, and RADIUS configurationsettings. There are no configuration options available on this page, but if you areexperiencing issues with security, you may want to print this page for yourrecords.For additional information about wireless network security, refer to:z“Security Planning” on page 35.zThe Security section of “Frequently Asked Questions” on page 222.Figure 77. WMI: Security Page
Wireless LAN ArrayConfiguring the Xirrus Array 113Security ManagementThis page allows you to establish the security parameters for your wirelessnetwork, including WEP, WPA and RADIUS authentication. When finished, clickon the Apply button to apply the new settings to this session, then click on theSave button to save your changes.For additional information about wireless network security, refer to “SecurityPlanning” on page 35.Figure 78. WMI: Security Management Page
Wireless LAN Array114 Configuring the Xirrus ArrayUnderstanding SecurityThe Xirrus Wireless LAN Array incorporates many security features thatadministrators can configure. After initially installing an Array, always changethe default administrator password (the default is admin), and choose a strongreplacement password (a strong password contains letters, numbers and specialcharacters). When appropriate, issue read only administrator accounts.Other security considerations include:zSSH versus Telnet: Be aware that Telnet is not secure over networkconnections and should be used only with a direct serial port connection.When connecting to the unit’s Command Line Interface over a networkconnection, you must use a Secure SHell (SSH) utility. The mostcommonly used freeware providing SSH tools is PuTTY.zConfiguration auditing: The optional Xirrus Wireless ManagementSystem (XM-3300) offers powerful management features for small orlarge Xirrus Wireless LAN deployments, and can audit yourconfiguration settings automatically. In addition, using the XM-3300eliminates the need for an FTP server.zChoosing an encryption method: Wireless data encryption preventseavesdropping on data being transmitted or received over the airwaves.The Array allows you to establish the following data encryptionconfiguration options:zOpen—this option offers no data encryption and is notrecommended, though you might choose this option if clients arerequired to use a VPN connection through a secure SSH utility,like PuTTy.zWEP (Wired Equivalent Privacy)—this option provides minimalprotection (though much better than using an open network). Anearly standard for wireless data encryption and supported by allWi-Fi certified equipment, WEP is vulnerable to hacking and istherefore not recommended for use by Enterprise networks.
Wireless LAN ArrayConfiguring the Xirrus Array 115zWPA (Wi-Fi Protected Access)—this is a much strongerencryption mode than WEP and uses TKIP (Temporal KeyIntegrity Protocol) or AES (Advanced Encryption Standard) toencrypt data.WPA solves security issues with WEP. It also allows you toestablish encryption keys on a per-user-basis, with key rotationfor added security. In addition, TKIP provides Message IntegrityCheck (MIC) functionality and prevents active attacks on thewireless network.AES is the strongest encryption standard and is used bygovernment agencies; however, old legacy hardware may not becapable of supporting the AES mode (it probably won’t work onolder wireless clients). Because AES is the strongest encryptionstandard currently available, it is highly recommended forEnterprise networks.Any of the above encryption modes can be used, but only one may beused per SSID. If multiple security methods are needed, you must definemultiple SSIDs.zChoosing an authentication method: User authentication ensures thatusers are who they say they are. For this purpose, the Array allows you tochoose between the following user authentication methods:zPre-Shared Key—users must manually enter a key (passphrase)on the client side of the wireless network that matches the keystored by the administrator in the Array.This method should be used only for smaller networks when aRADIUS server is unavailable. If PSK must be used, choose astrong passphrase containing between 8 and 63 characters (20 ispreferred). Always use a combination of letters, numbers andspecial characters. Never use English words separated by spaces.
Wireless LAN Array116 Configuring the Xirrus ArrayzRADIUS 802.1x with EAP—802.1x uses a RADIUS server toauthenticate large numbers of clients, and can handle differentEAP (Extensible Authentication Protocol) authenticationmethods, including EAP-TLS, EAP-TTLS and EAP-PEAP. TheRADIUS server can be internal (provided by the XS-3900) orexternal. An external RADIUS server offers more functionalityand security, and is recommended for large deployments. Whenusing this method, user names and passwords must be enteredinto the RADIUS server for user authentication.The Xirrus Wireless LAN Array will accept up to 512 ACLentries.zMAC Address ACLs (Access Control Lists)—MAC addressACLs provide a list of client adapter MAC addresses that areallowed or denied access to the wireless network. Access ControlLists work well when there are a limited number of users—in thiscase, enter the MAC addresses of each user in the Allow list. Inthe event of a lost or stolen MAC adapter, enter the affected MACaddress in the Deny list.Procedure for Configuring Network Security1. WPA Enabled: Choose Yes to enable WPA (Wi-Fi Protected Access), orchoose No to disable WPA.2. WPA2 Enabled: Choose Yes to enable WPA2 (Wi-Fi Protected Access 2),or choose No to disable WPA2.3. TKIP Enabled: Choose Yes to enable TKIP (Temporal Key IntegrityProtocol), or choose No to disable TKIP.4. AES Enabled: Choose Yes to enable AES (Advanced EncryptionStandard), or choose No to disable AES.5. WPA Group Rekey Time (in seconds): Enter a value to specify the grouprekey time (in seconds). The default is 600.
Wireless LAN ArrayConfiguring the Xirrus Array 1176. PSK Authentication: Choose Yes to enable PSK (Pre-Shared Key)authentication, or choose No to disable PSK.7. WPA Preshared Key / Verify Key: If you enabled PSK, enter a passphrasehere, then re-enter the passphrase to verify that you typed it correctly.8. EAP Authentication: Choose Yes to enable EAP (ExtensibleAuthentication Protocol) or choose No to disable EAP.9. WEP Enabled: Choose Yes to enable WEP (Wired Equivalent Privacy) orchoose No to disable WEP.10. Key Length / Mode: If you enabled WEP, choose the desired key length(either 40 or 128) and the mode (either ASCII or Hex) from the pull-downlists. You must now provide the encryption key(s).a. Encryption Key 1 / Verify Key 1: Enter an encryption key of thelength specified (either 10 hex or 26 hex characters), then re-enter thekey to verify that you typed it correctly—hexadecimal characters aredefined as ABCDEF and 0-9.b. Encryption Key 2 / Verify Key 2 (optional): If desired, enter a secondencryption key, then re-enter the key to verify that you typed itcorrectly.c. Encryption Key 3 / Verify Key 3 (optional): If desired, enter a thirdencryption key, then re-enter the key to verify that you typed itcorrectly.d. Encryption Key 4 / Verify Key 4 (optional): If desired, enter a fourthencryption key, then re-enter the key to verify that you typed itcorrectly.11. Default Key: Choose which key you want to assign as the default key.Make your selection from the pull-down list.12. Click on the Apply button to apply the new settings to this session.#A RADIUS server must be defined to use EAP.
Wireless LAN Array118 Configuring the Xirrus Array13. Click on the Save button to save your changes.Radius ServerThis page allows you to set up the Array’s internal RADIUS server, or define theuse of an external RADIUS server for user authentication.When finished, click on the Apply button to apply the new settings to thissession, then click on the Save button to save your changes.Figure 79. WMI: Radius Server Page#After configuring network security, the configuration must beapplied to an SSID for the new functionality to take effect.#The internal RADIUS server will only authenticate wireless clients thatwant to associate to the Array. This can be useful if an external RADIUSserver is not available.
Wireless LAN ArrayConfiguring the Xirrus Array 119Procedure for Configuring Radius Servers1. Radius Server Mode: Choose Internal if you want to use the XS-3900’sinternal RADIUS server, or choose External to use an external RADIUSserver.2. Primary IP Address: If you are using an external RADIUS server, enterthe primary server’s IP address.3. Primary Port Number: If you are using an external RADIUS server, enterthe primary port number.4. Secondary IP Address (optional): If desired, enter the secondary RADIUSserver’s IP address.If the primary RADIUS server becomes off-line, the Array will “failover”to the secondary RADIUS server (defined here).5. Secondary Port Number: If desired, enter the secondary port number.6. Timeout: Define the maximum idle time (in seconds) before the RADIUSsession times out. The default is 600 seconds.7. Primary Shared Secret / Verify Secret: If you are using RADIUS, enterthe primary shared secret, then re-enter the primary shared secret toverify that you typed it correctly.8. Secondary Shared Secret / Verify Secret: If you are using RADIUS, enterthe secondary shared secret, then re-enter the secondary shared secret toverify that you typed it correctly.9. Click on the Apply button to apply the new settings to this session.10. Click on the Save button to save your changes (otherwise your newsettings will not take effect).
Wireless LAN Array120 Configuring the Xirrus ArrayRadius UserThis page allows you to manage local RADIUS user accounts (create, modify anddelete). When finished, click on the Save button to save your changes.Figure 80. WMI: Radius User Page
Wireless LAN ArrayConfiguring the Xirrus Array 121Procedure for Configuring Radius Users1. New User Name: Enter a new RADIUS user name.2. User Password: Enter a password for this user.3. Verify Password: Re-enter the user password to verify that you typed itcorrectly.4. SSID (Network Name): Choose an SSID from the pull-down list (this willbe the only SSID a user can associate to).5. Click on the Create User button to add this user to the list.Editing Radius Users6. User Management: If you want to edit an existing RADIUS user account,select the user from the list. You must now enter the user password andselect an SSID.a. User Password: Enter the password of the user account you want toedit.b. Verify Password: Re-enter the password to verify that you typed itcorrectly.c. SSID (Network Name): Choose an SSID from the pull-down list.When you have finished making your edits, click on the Modify button toapply the changes.7. Alternatively, you can delete users by selecting the user from the list andclicking on the Delete button.8. Click on the Save button to save your changes (otherwise your newsettings will not take effect).
Wireless LAN Array122 Configuring the Xirrus ArrayMAC Access ListThis page allows you to create new MAC access lists, delete existing lists, andadd/remove MAC addresses. When finished, click on the Save button to saveyour changes.Figure 81. WMI: MAC Access List Page
Wireless LAN ArrayConfiguring the Xirrus Array 123Procedure for Configuring MAC Access Lists1. MAC Access List Type: Select the MAC Access List type—eitherDisabled,Allow List or Deny List, then click on the Modify button toapply your changes.zAllow List: Only allows these MAC addresses to associate to theArray.zDeny List: Allows all MAC addresses except the addressesdefined in this list.2. New MAC Address: If you want to add a MAC address to the ACL, enterthe new MAC address here, then click on the Add button. The MACaddress is added to the ACL.3. MAC Access List Management: You can delete a MAC Access List byselecting the list you want to delete then clicking on the Delete button.4. Click on the Save button to save your changes (otherwise your newsettings will not take effect).#In addition to these lists, other authentication methods (forexample, RADIUS) are still enforced for users.
Wireless LAN Array124 Configuring the Xirrus ArrayAdmin ManagementThis page allows you to manage network administrator accounts (create, modifyand delete). It also allows you to limit account access to a read only status. Whenfinished, click on the Save button to save your changes.Figure 82. WMI: Admin Management Page
Wireless LAN ArrayConfiguring the Xirrus Array 125Procedure for Creating Network Administrator Accounts1. New Admin ID: Enter a meaningful description for this new networkadministrator ID.2. Privilege Level: Choose Read to restrict this administrator ID to readonly status, or choose Read/Write if you want to give this administratorID full read/write privileges. In the read only mode, administratorscannot save changes to configurations.3. Admin Password: Enter a password for this ID.4. Verify Password: Re-enter the password in this field to verify that youtyped the password correctly. If you do not re-enter the correct password,an error message is displayed).5. Click on the Create button to add this administrator ID to the list.Editing Network Administrator Accounts6. Admin ID: Choose the administrator ID you want to edit or delete fromthe list. If you are deleting the selecting administrator ID, click on theDelete button, otherwise go to Step 7.7. Privilege Level: Choose Read to restrict the selected administrator ID toread only status, or choose Read/Write if you want to give thisadministrator ID full privileges.8. Admin Password: Enter the password for the selected administrator ID.9. Verify Password: Re-enter the password in the right field (this field mustmatch the Admin Password field).10. Click on the Modify button to apply the new settings to this session.11. Click on the Save button to save your changes (otherwise your newsettings will not take effect).
Wireless LAN Array126 Configuring the Xirrus ArrayManagement ControlThis page allows the Array management interfaces to be enabled and disabledand their inactivity time-outs set. The supported range is 300 (default) to 100,000seconds.Figure 83. Management Control
Wireless LAN ArrayConfiguring the Xirrus Array 127Rogue AP ListThis page displays rogue APs, according to the list you select (either Unknown,Known or Approved). In addition, you can sort the results based on the followingparameters:zSSIDzBSSIDzChannelzRSSIzSecurityzIP AddresszDiscoveredzLast ActiveYou can refresh the list at any time by clicking on the Refresh button.Figure 84. WMI: Rogue AP List Page
Wireless LAN Array128 Configuring the Xirrus ArrayRogue Control ListThis page allows you to set up a control list for rogue APs, based on a type thatyou define. When finished, click on the Save button to save your changes.Figure 85. WMI: Rogue Control List Page
Wireless LAN ArrayConfiguring the Xirrus Array 129Procedure for Establishing Rogue AP Control1. New Rogue SSID: Enter the SSID for the new rogue AP.2. Rogue Control Type: Define the type, either Known or Approved.3. Click on the Create button to add this rogue AP to the Rogue Control List.4. Rogue Control List: If you want to edit the control type for a rogue AP,select the rogue from the list.a. After selecting the rogue, redefine whether this rogue is Known,Approved or Unknown, then click on the Modify button to applyyour change.5. Alternatively, if you want to delete the selected rogue AP from the list,click on the Delete button.6. Click on the Save button to save your changes (otherwise your newsettings will not take effect).
Wireless LAN Array130 Configuring the Xirrus ArrayStationsThis page displays stations (clients) that are currently associated with the Array.You can sort the results based on the following parameters:zMAC AddresszManufacturerzIP AddresszNetbios NamezIAPzSSIDzVLANzRSSIzTimeFigure 86. WMI: Stations Page
Wireless LAN ArrayConfiguring the Xirrus Array 131RSSIAn alternative display is given on the RSSI page, which shows each associatedstation and their RSSI value (signal strength) as seen by the WLAN Array.Figure 87. RSSI Page
Wireless LAN Array132 Configuring the Xirrus ArrayServicesThis is a status only page that allows you to review the current status of syslogand SNMP services. There are no configuration options available on this page, butif you are experiencing issues with network services, you may want to print thispage for your records.Figure 88. WMI: Services Page
Wireless LAN ArrayConfiguring the Xirrus Array 133Time SettingsThis page allows you to manage the Array’s time settings, includingsynchronizing the Array’s clock with a universal clock from an NTP (NetworkTime Protocol) server. Synchronizing the Array’s clock with an NTP serverensures that syslog time-stamping is maintained across all units.Figure 89. WMI: Time Settings Page
Wireless LAN Array134 Configuring the Xirrus ArrayProcedure for Managing the Time SettingsManual Time1. Adjust Time: Check this box to allow manual adjustment of the time inhours, minutes and seconds (hrs:min:sec).2. Adjust Date: Check this box to allow manual adjustment of the date(day/month/year).3. Auto Adjust Daylight Savings: Check this box if you want the system toautomatically adjust the time for daylight savings.4. Time Zone: Select the time zone you want to use (normally your localtime zone) from the pull-down list.Using an NTP Server5. Enable NTP Server: Check this box if you want to use an NTP (NetworkTime Protocol) server to synchronize the Array’s clock. Without an NTPserver assigned (no universal clock), each Array will use its own internalclock and stamp times accordingly, which may result in discrepancies.When this box is checked, the NTP Server 1 Address and NTP 2 Server 2Address fields become active. If you don’t want to use an NTP server,leave this box unchecked (default), otherwise enter the IP address or DNSname of the NTP server(s).6. NTP Server 1 Address: Enter the IP address or DNS name of the primaryNTP server.7. NTP Server 2 Address: Enter the IP address or DNS name of thesecondary NTP server.8. Click on the Apply button to apply the new settings to this session.9. Click on the Save button to save your changes (otherwise your newsettings will not take effect).
Wireless LAN ArrayConfiguring the Xirrus Array 135System LogThis page allows you to enable or disable the Syslog server, define the server’s IPaddress, and set the level for Syslog reporting—the Syslog service will sendSyslog messages to the defined Syslog server. When finished, click on the Applybutton to apply the new settings to this session, then click on the Save button tosave your changes.Figure 90. WMI: System Log Page
Wireless LAN Array136 Configuring the Xirrus ArrayProcedure for Configuring Syslog1. Enable Syslog Server: Choose Yes to enable Syslog functionality, orchoose No to disable this feature.2. Server IP Address: If you enabled Syslog, enter the IP address of theSyslog server.3. Syslog Server Level: Choose the level of Syslogreporting from the pull-down list. Levelsinclude:zEmergencyzAlertszCriticalzErrorzWarningzNotificationzInformationzDebugThe default level is Information.4. Maximum Syslog Records: Enter a value in this field to define how manysyslog records are processed (up to a maximum of 500).5. Click on the Apply button to apply the new settings to this session.6. Click on the Save button to save your changes (otherwise your newsettings will not take effect).
Wireless LAN ArrayConfiguring the Xirrus Array 137SNMPThis page allows you to enable or disable SNMP and define the SNMPparameters. SNMP allows remote management of the Array by the XirrusManagement System (XM-3300), or other SNMP-based management system.When finished, click on the Apply button to apply the new settings to thissession, then click on the Save button to save your changes.Figure 91. WMI: SNMP Page
Wireless LAN Array138 Configuring the Xirrus ArrayProcedure for Configuring SNMP1. Enable SNMP: Choose Yes to enable SNMP functionality, or choose Noto disable this feature.2. SNMP Link IP Address: Enter the IP address of the SNMP link.3. Trap Port: Enter the trap port.4. Community String: Enter the community string.5. Send Auth Failure Traps: Choose Yes to log authentication failure trapsor No to disable.6. Click on the Apply button to apply the new settings to this session.7. Click on the Save button to save your changes (otherwise your newsettings will not take effect).#SNMP must be enabled on each array when used with the XM-3300 Management Platform.
Wireless LAN ArrayConfiguring the Xirrus Array 139Array InfoThis is a status only page that allows you to review the current status of the Array.There are no configuration options available on this page, but if you areexperiencing issues with network services, you may want to print this page foryour records.Figure 92. WMI: Array Info Page
Wireless LAN Array140 Configuring the Xirrus ArrayToolsThis page allows you to reset the system’s configuration parameters to theirfactory default values, reboot the system, and ping other IP addresses fordiagnostic purposes.Figure 93. WMI: Tools Page
Wireless LAN ArrayConfiguring the Xirrus Array 141Procedure for Configuring System Tools1. System Configuration Reset: Click on the Reset button to reset thesystem’s current configuration settings to the factory default values—allprevious configuration settings will be lost.2. System Reboot: Click on the Reboot button to reboot the system—youmust reboot the Array.3. Software Upgrade: Enter the filename and directory location (or click onthe Browse button to locate the software upgrade file), then click on theUpload button to upload the new file to the Array.4. Config Update: This field allows you to define the path to a configurationfile (one that you previously saved—see next step). Click on the Browsebutton if you need to browse for the location of the file, then click on theUpload button to update your configuration settings.5. Config Download: Click on this link to save the Array’s currentconfiguration settings to a file (that you can upload at a later date). Thesystem will prompt you for a destination for the file.6. System Tools: Choose Trace Route or Ping.7. IP Address: Enter the IP address of the target device.8. Timeout: Enter a value (in seconds) before the action times out.9. Click on the Execute button to perform the test. Results are displayed inthe Output frame.
Wireless LAN Array142 Configuring the Xirrus ArrayShow ConfigThis page allows you to display the configuration settings for the Array, based onthe following sort options:zRunning—Displays the current configuration (the one running now).zSaved—Displays the saved configuration from this session.zStartup—Displays the configuration at start up.zFactory—Displays the configuration established at the factory.Figure 94. WMI: Show Config PageIf you want to see just the differences between the Running, Saved, Startup, andFactory configurations, you can do this by choosing a configuration from theSelect Config pull-down menu then selecting an alternative configuration fromthe Select Diff pull-down menu.You also have the option of including the default configuration settings. To dothis, choose your configuration then click in the Include Defaults check box.
Wireless LAN ArrayConfiguring the Xirrus Array 143Event LogThis is a status only page that allows you to review the event log, where systemalerts and messages are displayed. Although there are no configuration optionsavailable on this page, you do have the choice of deciding how the eventmessages are sorted (Time Stamp, Priority, or Message). The displayed messages may also be filtered by using the Filter Priority setting,which allows control of the minimum displayed priority. For example, you maychoose (under Services/System Log) to log messages at the Debug level but todisplay only messages of Information level and above.zTime Stamp—sorts the list based on the time the event occurred.zPriority—sorts the list based on the priority assigned to the message.zMessage—sorts the list based on the message category.Figure 95. WMI: Event Log Page
Wireless LAN Array144 Configuring the Xirrus ArrayClick on the Refresh button to refresh the messages, or click on the Clear buttonto delete all messages. If you are experiencing problems with your network youmay want to print this page for your records.
Wireless LAN ArrayThe Command Line Interface 145The Command Line InterfaceThis chapter covers configuration and management tasks using the product’sCommand Line Interface (CLI), and includes a procedure for establishing a Telnetconnection to the Xirrus Array. Section headings for this chapter include:z“Establishing a Secure Shell (SSH) Connection” on page 145z“Basic Commands” on page 146z“Command Modes” on page 147z“Selecting Interfaces” on page 150z“Commands” on page 151Establishing a Secure Shell (SSH) ConnectionUse this procedure to initialize the system and log in to the Command LineInterface (CLI) via a Secure Shell (SSH) utility, such as PuTTY.1. Start your SSH session and communicate with the XS-3900 via its defaultIP address (10.0.1.1).When connected to the Array, a login prompt appears on your screen. Thedefault login user name and password is admin (for both). Login namesand passwords are case-sensitive.2. Enter admin when prompted for a user name and password. You are nowlogged in to the Array’s Command Line Interface.Figure 96. Command Line Interface
Wireless LAN Array146 The Command Line InterfaceBasic CommandsHelpTo get help at any point type help or ? to view the interactive help system.Tab KeyThe Tab key allows auto-completion of commands such that only a few uniquecharacters need to be entered followed by the Tab key, which will automaticallyfill in the rest of the command.? KeyThe ? key displays the list of available commands at any point of typing in thecommand line.Save You must type save to save the current configuration to flash memory so thatchanges are kept when the Array is rebooted.Show Displays the current settings and is useful when verifying the currentconfiguration settings.EndReturns you to the to top-level configure mode.ExitExits the current command mode level, and enters the next level up. QuitExits the command line interface.NoDisables an item that is currently enabled; or sets the selected item to the defaultvalue.
Wireless LAN ArrayThe Command Line Interface 147Command ModesConfigure Mode Allows major functional changes to interfaces and Array configuration.Requires read/write administrator privilegesFrom the default prompt, type configure then press <ENTER>Xirrus-Array# configureXirrus-Array(config)#The prompt changes to show the current mode in parentheses.Admin ModeAllows you to manage user accounts, including adding accounts, deletingaccounts, and displaying current user account information.Requires read/write administrator privilegesFrom the configure mode, type admin then press <ENTER>Xirrus-Array(config)# adminXirrus-Array(config-admin)#Contact Info ModeAllows you to display the current contact information for the Array, or modify theexisting contact information.Requires read/write administrator privilegesFrom the configure mode, type contact then press <ENTER>Xirrus-Array(config)# contactXirrus-Array(config-contact-info)##When inputting commands you need only type as many characters as the system requires before it recognizes your input.
Wireless LAN Array148 The Command Line InterfaceDate & Time ModeAllows you to configure the date and time settings used by the Array.Requires read/write administrator privilegesFrom the configure mode, type date then press <ENTER>Xirrus-Array(config)# dateXirrus-Array(config-date-time)#DHCP ModeAllows you to enable, disable and configure the DHCP server.Requires read/write administrator privilegesFrom the configure mode, type dhcp then press <ENTER>Xirrus-Array(config)# dhcpXirrus-Array(config-dhcp-server)#DNS ModeAllows you to configure the DNS settings.Requires read/write administrator privilegesFrom the configure mode, type dns then press <ENTER>Xirrus-Array(config)# dnsXirrus-Array(config-dns)#Radius ModeAllows you to make configuration changes to the internal RADIUS server.Requires read/write administrator privilegesFrom the configure mode, type radius then press <ENTER>Xirrus-Array(config)# radiusXirrus-Array(config-radius-server)#
Wireless LAN ArrayThe Command Line Interface 149Run Test ModeAllows you to execute diagnostic run tests (for example, pings and trace routes).Requires read/write administrator privilegesFrom the configure mode, type run-tests then press <ENTER>Xirrus-Array(config)# run-testsXirrus-Array(run-test)#Security ModeAllows you to set security parameters for the Array.Requires read/write administrator privilegesFrom the configure mode, type security then press <ENTER>Xirrus-Array(config)# securityXirrus-Array(config-security)#SNMP ModeAllows you to enable, disable or configure SNMP.Requires read/write administrator privilegesFrom the configure mode, type snmp then press <ENTER>Xirrus-Array(config)# snmpXirrus-Array(config-snmp)#SSID ModeAllows you to add, delete and modify SSIDs, or display the current definitions fora selected SSID.Requires read/write administrator privilegesFrom the configure mode, type ssid then press <ENTER>Xirrus-Array(config)# ssidXirrus-Array(config-ssid)#
Wireless LAN Array150 The Command Line InterfaceSyslog ModeAllows you to enable, disable and configure the Syslog server.Requires read/write administrator privilegesFrom the configure mode, type syslog then press <ENTER>Xirrus-Array(config)# syslogXirrus-Array(config-syslog)#Selecting InterfacesFrom the configure mode select the desired interface.interface {console | iap | gig1 | gig2 | eth0};console asynchronous serial console portiap integrated access point interfacegig1 gigabit Ethernet interfacegig2 gigabit Ethernet interfaceeth0 10/100 Ethernet interfaceExample:Xirrus-Array(config)# interface iapXirrus-Array(config-iap)#
Wireless LAN ArrayThe Command Line Interface 151CommandsThis section contains detailed information for each CLI command, organizedalphabetically. The following table provides a listing of the commands. Click onany command in this list to “jump” to that command.administrator moreacl radius-serverconsole rebootcontact-info resetcopy run-scriptdate-time run-testsdhcp-server savedir securitydns showerase snmpeth0 sshftp sysloggig1 telnetgig2hostnameiapiap global_settingsiap global_a_settingsiap global_bg_settingslocation
Wireless LAN Array152 The Command Line InterfaceadministratorDESCRIPTIONAdds and edits administrator accounts and privileges—available from theconfig command mode.SYNTAXadministrator [add <uid> password [enc] <passwd> {read_only |read_write} | del <uid> ]PARAMETERSadd <uid> Add user IDread_only Read only permissionsread_write Read/write permissionspassword Define user passwordenc Enter password in encrypted form (must be in quotes)DEFAULTSNone.USAGE GUIDELINESThe show command within the config-admin mode will display alladministrator accounts and privileges.
Wireless LAN ArrayThe Command Line Interface 153EXAMPLETo add a new administrator account:config-administrator (config-admin)# add johnk password xtyrk567 read_writeFigure 97. CLI: Adding a New Administrator AccountSEE ALSONone.
Wireless LAN Array154 The Command Line InterfaceaclDESCRIPTIONConfigures the MAC based Access Control Lists to allow or limit theassociation of stations to the Array.SYNTAXacl {off | on {allow_list | deny_list} | add <amac> | del <dmac>}PARAMETERSon Enable access control listoff Disable access control list allow_list Enable allow list, where this list is a list of users to allow association to the arraydeny_list Enable deny list, where this list is used to deny association to the arrayadd Add MAC address to the listdel Delete MAC address from the listDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo allow association to the array, type:Xirrus_WLAN_Array(config)# acl on allow_listXirrus_WLAN_Array(config)# acl add 00:00:a1:cd:45SEE ALSONone.
Wireless LAN ArrayThe Command Line Interface 155consoleDESCRIPTIONConfigures the Console Interface (serial port)—available from the config-interface command mode.SYNTAXconsole { {baud <brate> | bytesize <bsz> | stopbits <sbit> | parity {none |odd | even} | timeout <idleto>}@}PARAMETERStimeout Console inactivity timeout in secondsbaud Async port baud rate 2400 - 115,200 bpsbytesize Async port word size 7 or 8 bitsstopbits Async port number of stop bits 0, 1, or 2parity Async port number of parity bitsnone No parityodd Odd parityeven Even parityDEFAULTS115,200, 8bit, No Parity, 1 Stop bit, No Flow Control.Figure 98. CLI: Default Serial Port Settings
Wireless LAN Array156 The Command Line InterfaceUSAGE GUIDELINESNone.EXAMPLETo set the baud rate of the console serial port to 9600 baud: config-interface console(config-console)# baud 9600Figure 99. CLI: Setting the IP Address for the Serial PortSEE ALSONone.
Wireless LAN ArrayThe Command Line Interface 157contact-infoDESCRIPTIONSets the contact information for this Array—available from the configcommand mode.SYNTAXcontact-info {name [<conname>] | email [<emailcontact>] | phone[<contele>]}@PARAMETERScontact-info Contact information for assistance on this Arrayname Contact name (must be within quotes)email Contact email address (must be within quotes)phone Contact telephone number (must be within quotes)DEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo add new contact information (name and telephone number):config-contact-info (config-contact-info)# name Bill phone 8181239876Figure 100. CLI: Adding a New Administrator Account
Wireless LAN Array158 The Command Line InterfaceSEE ALSONone.copyDESCRIPTIONCreates a copy of the specified file on the Flash file system.SYNTAXcopy <sourcefile> <destinationfile>PARAMETERSsourcefile The existing source file namedestinationfile The new destination file nameDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo create a backup of the current system image file, type:Xirrus_WLAN_Array(config)# copy XS-39-1.1.0 XS-39-1.1.BAKSEE ALSOdirdelete
Wireless LAN ArrayThe Command Line Interface 159date-timeDESCRIPTIONSet the date/time for the Array—available from the config commandmode, using the format hh:mm mm/dd/yyyy.SYNTAXdate-time <date/time>PARAMETERSdst_adjust Adjust daylight savingsno Disable daylight savingsntp Configure the NTP serverset Set the date and time for the Arraytimezone Configure the time zoneDEFAULTSNone.USAGE GUIDELINESYou access the date-time command mode from the config mode.
Wireless LAN Array160 The Command Line InterfaceEXAMPLETo disable daylight savings, type:(config-date-time)# no dstFigure 101. CLI: Disabling Daylight Savings SEE ALSONone.dhcp-serverDESCRIPTIONConfigures the local DHCP server settings—available from the Config->dhcp-server command mode.SYNTAXdhcp {on | off | {start-ip-range <sipr> | end-ip-range <eipr> | default-lease <defl> | max-lease <maxl>}@}
Wireless LAN ArrayThe Command Line Interface 161PARAMETERSon Enable the DHCP server off Disable the DHCP serverstart-ip-range Starting IP address for the lease pool end-ip-range Ending IP address for the lease pool default-lease Default lease period (in minutes), if one is not requested max-lease Maximum lease period allowed show Display the current DHCP server settingsDEFAULTSDefault lease time 300Maximum lease time 300USAGE GUIDELINESNone.EXAMPLETo set the IP address range for the local DHCP server and enable the server,type:Xirrus_WLAN_Array(config)# dhcp-serverXirrus_WLAN_Array(config-dhcp-server)# start-ip-range 192.168.1.100 end-ip-range 192.168.1.200Xirrus_WLAN_Array(config-dhcp-server)# showDHCP Server Settings Summary----------------------------State disabledAddress range start 192.168.1.100Address range end 192.168.1.200Default lease time 300Maximum lease time 300SEE ALSONone.
Wireless LAN Array162 The Command Line InterfacedirDESCRIPTIONLists the contents of the local Flash file system directory.SYNTAXdirPARAMETERSNone.DEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo list the local Flash file system directory contents, type:Xirrus_WLAN_Array(config)# dirThe following will appear:...lastbootxs37-1.0.37.binSEE ALSODeleteCopy
Wireless LAN ArrayThe Command Line Interface 163dnsDESCRIPTIONUsed to configure the DNS settings—available from the Config-> dnscommand mode.SYNTAXdns { domain [<dom>] | server1 [<srv1>] | server2 [<srv2>] | server3[<srv3>]}PARAMETERSdomain Enter your domain name (Example: www.mydomain.com)server1 Enter the first DNS server IP addressserver2 Enter the second DNS server IP addressserver3 Enter the third DNS server IP addressDEFAULTSNone.USAGE GUIDELINESServer1, Server2, and Server3 IP addresses must be entered using thestandard A.B.C.D notation.EXAMPLETo configure the first DNS server, type:Xirrus_WLAN_Array(config)# dnsyXirrus_WLAN_Array(config-dns)# server1 10.10.10.1SEE ALSONone.
Wireless LAN Array164 The Command Line InterfaceeraseDESCRIPTIONErases the specified file from the Flash file system.SYNTAXErase <filename>PARAMETERSfilename existing file to delete.DEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo erase the file old-configuration, type:Xirrus_WLAN_Array(config)# erase old-configurationSEE ALSOdir copy
Wireless LAN ArrayThe Command Line Interface 165eth0DESCRIPTIONConfigures the 10/100 Ethernet Interface Settings—available from theconfig-interface command mode.SYNTAXeth0 {[no] autoneg [on | off] | defaults | duplex {half | full} | speed<spdsel> | mtu <mtusz> | down | up | ip {dhcp | {addr <statip> | mask<ipmask> | gateway <gway>}@}}PARAMETERShalf Half duplexfull Full duplexmtu Set the maximum MTU size allowed (64-17940)defaults Reset the interface to default valuesduplex Half or full duplex modespeed 10M or 100M operationsdown Shut this interface downup Bring this interface upip Set IP address (A.B.C.D)dhcp IP address, mask and gateway are obtained through DHCPaddr <IP Address> Static IP address (A.B.C.D)gateway <IP Address> Gateway IP address (A.B.C.D)mask <mask> IP mask (A.B.C.D)autoneg Autonegotiation on or offon Enable autonegotiationoff Disable autonegotiationDEFAULTSNone.USAGE GUIDELINESNone.
Wireless LAN Array166 The Command Line InterfaceEXAMPLETo set the IP address of the 10/100 Ethernet interfaces: config-interface eth0(config-eth0)# ip addr 192.168.39.186 mask 255.255.255.0Figure 102. CLI: Setting the IP Address for the Fast Ethernet InterfaceSEE ALSOconfig-interface gig1config-interface gig2
Wireless LAN ArrayThe Command Line Interface 167ftpDESCRIPTIONOpens an ftp connection to a remote system.SYNTAXftp <ip-address>PARAMETERS<ip-address> IP address of remote ftp host (in A.B.C.D format) DEFAULTSNone.USAGE GUIDELINESOnce an ftp connection is established, the following commands areavailable from the ftp prompt:EXAMPLENone.SEE ALSONone.binary delete ls recvbye dir mkdir renamecd disconnect open rmdircdup get put sendchmod hash pwd sizeclose help quit ?
Wireless LAN Array168 The Command Line Interfacegig1DESCRIPTIONConfigures the Gigabit 1 Ethernet Interface Settings—available from theconfig-interface command mode.SYNTAXgig1 {[no] autoneg [on | off]; | [no] management [on | off] | down | up |defaults | duplex {half | full} | speed <spdsel> | mtu <mtusz> | ip {dhcp| {addr <statip> | mask <ipmask> | gateway <gway>}@}}PARAMETERShalf Half duplexfull Full duplexmtu Set the maximum MTU size alloweddefaults Reset the interface to default valuesduplex Half or full duplex modespeed <speed> 100M or 1000M operationdown Shut this interface downup Bring this interface upip Set the IP addressdhcp IP address, mask and gateway are obtained through DHCPaddr <IP Address> Static IP address (A.B.C.D)gateway <IP Address> Gateway IP address (A.B.C.D)mask <mask> IP mask (A.B.C.D)management Enable or disable management via interfaceno Managed elsewhereon Enable managementoff Disable managementautoneg Autonegotiation on or offno Disable selected featureon Enable autonegotiationoff Disable autonegotiation
Wireless LAN ArrayThe Command Line Interface 169DEFAULTSNone.USAGE GUIDELINESSetting the Gigabit1 interface parameters will automatically set the Gigabit2parameters to the same values.EXAMPLETo set the IP address of the gigabit Ethernet interfaces: config-interface gig1(config-gig1/2)# ip addr 192.168.39.186 mask 255.255.255.0Figure 103. CLI: Setting the IP Address for the Gigabit 1 InterfaceSEE ALSOconfig-interface gig2config-interface eth0
Wireless LAN Array170 The Command Line Interfacegig2DESCRIPTIONConfigures the Gigabit 2 Ethernet Interface Settings—available from theconfig-interface command mode.SYNTAXgig2 {[no] autoneg [on | off]; | [no] management [on | off] | down | up |defaults | duplex {half | full} | speed <spdsel> | mtu <mtusz> |ip {dhcp | {addr <statip> | mask <ipmask> | gateway <gway>}@}}PARAMETERShalf Half duplexfull Full duplexmtu Set the maximum MTU size alloweddefaults Reset the interface to the default valuesduplex Half or full duplex modespeed <speed> 100M or 1000M operationdown Shut this interface downup Bring this interface upip Set the IP addressdhcp IP address, mask and gateway are obtained through DHCPaddr <IP Address> Static IP address (A.B.C.D)gateway <IP Address> Gateway IP address (A.B.C.D)mask <mask> IP mask (A.B.C.D)management Enable or disable management via interfaceno Managed elsewhereon Enable managementoff Disable managementautoneg Autonegotiation on or offno Disable selected featureon Enable autonegotiationoff Disable autonegotiationDEFAULTSNone.
Wireless LAN ArrayThe Command Line Interface 171USAGE GUIDELINESSetting Gigabit2 Interface parameters will automatically set the Gigabit1parameters to the same values for failover purposes.EXAMPLETo set the IP address of the gigabit Ethernet interfaces: config-interface gig2((config-gig1/2)# ip addr 192.168.39.186 mask 255.255.255.0Figure 104. CLI: Setting the IP Address for the Gigabit 2 InterfaceSEE ALSOconfig-interface gig1config-interface eth0
Wireless LAN Array172 The Command Line InterfacehostnameDESCRIPTIONSets the host name for this Array—available from the config commandmode.SYNTAXhostname <hname> “hostname string”PARAMETERSNone.DEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo set the hostname for the Xirrus Array:(config)# hostname Xirrus_Array_3900Figure 105. CLI: Setting the Host Name of the ArrayThe hostname is displayed immediately below the command line, asfollows:Xirrus_Array_3900(config)#
Wireless LAN ArrayThe Command Line Interface 173SEE ALSONone.iapDESCRIPTIONChanges the configuration of a specific Integrated Access Point (IAP) radiointerface—available from the config-interface command mode. Groups ofinterfaces can be accessed via the following interface commands.ziap number: Configuration for a specific IAP. The prompt will changeto: IAP number (config-iap-a12)#.zglobal_a_settings: Common configuration for all 802.11a IAPs. The prompt will change to: (config-iap-global-a)#.zglobal_bg_settings: Common configuration for all 802.11b/g IAPs.The prompt will change to: (config-iap-global-bg)#.zglobal_settings: Common configuration for all IAPs. The prompt willchange to: (config-iap-global)#.SYNTAXinterface iap <IAP number> {channel <cnum> | description <dot11desc> |down | up | cellsize {small | medium | large} | rx-threshold <thresrx> |tx-power <powertx>} }PARAMETERScellsize Cell size settingchannel Channel numberdescription Name to identify this IAP (up to 32 characters)down Shut down (disable) this IAPrx-threshold Deferred threshold (receive sensitivity)tx-power Maximum transmit powerup Bring up (enable) this IAPdot11a Set 802.11a modedot11bg Set 802.11b/g mode (only available on abg1, 2, 3, 4)antenna Select the antenna for the IAPinternal Internal directional 2.4GHz antenna
Wireless LAN Array174 The Command Line Interfacemonitor Internal omni-directional monitor antenna (available on abg2 IAP only)external Select the external antenna (Available on IAP abg1, abg3, and abg4 only)DEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo set the cell size to large for the integrated access point a12:(config-iap)# a12(config-iap-a12)# cellsize largeFigure 106. CLI: Setting the Cell Size of an IAPSEE ALSOiap global_a_settingsiap global_bg_settingsiap global_settingsshow iap all
Wireless LAN ArrayThe Command Line Interface 175iap global_settingsDESCRIPTIONMakes global configuration changes to all Integrated Access Point (IAP)radio interfaces—available from the config-interface command mode.This command allows configuration changes to all IAP interfaces. Otherglobal settings can be made for specific groups of IAPs by using one of thebelow parameters in the interface IAP command mode:ziap number: Configuration for a specific IAP. The prompt will changeto: IAP number (config-iap-a12)#zglobal_a_settings: Common configuration for all 802.11a IAPs. Theprompt will change to: (config-iap-global-a)#zglobal_bg_settings: Common configuration for all 802.11b/g IAPs.The prompt will change to: (config-iap-global-bg)#zglobal_settings: Common configuration for all IAPs. The prompt willchange to: (config-iap-global)#SYNTAXiap global_settings {all_down | all_up | [no] rogue_detect [ on | off |add <ssa> {approved | known} | del <ssd> | list ] | auto_channel[no][power_up [ on | off ] | schedule [<ts>]] | long-retries <lrl> | short-retries <srl> | cellsize {small | medium | large} | rx-threshold <thresrx> |tx-power <powertx> | beacon-rate <brate> | beacon-dtim <bdtim> |inactive-time <at> | reauth-period <ht> | led {disable | enable {iap_up |associated}} | led_activity {beacon | tx_data | rx_data | tx_mgmt |rx_mgmt | broadcast | probe_req | assoc}}PARAMETERSled Enable or disable the IAP ledsdisable Do not turn IAP leds onenable Turn an IAP led on when up (default) or when a station is associatediap_up Turn an IAP led on when the IAP is upassociated Turn an IAP led on when at least one station is associated with it
Wireless LAN Array176 The Command Line Interfaceled_activity Set IAP led behavior based on certain conditionsbeacon Blink an IAP led when a beacon is transmittedtx_data Blink an IAP led when a data frame is transmittedrx_data Blink an IAP led when a data frame is receivedtx_mgmt Blink an IAP led when a management frame is transmittedrx_mgmt Blink an IAP led when a management frame is receivedbroadcast Blink an IAP led when a broadcast frame is transmittedprobe_req Blink an IAP led when a probe request is receivedassoc Blink an IAP led heartbeat when stations are associatedbeacon-rate Time between beacons in kilo-microseconds (Kusec)beacon-dtim Beacons between Delivery Traffic Indication Messages (DTIM)all_down Shut down (disable) all IAPsall_up Bring up (enable) all IAPsshort-retries Short retry limitlong-retries Long retry limitinactive-time Time that an AP tracks an inactive stationreauth-period Time between 802.1x re-authentication attemptsrogue_detect Enable/disable rogue AP detection on IAP abg2on Enable rogue AP detectionoff Disable rogue AP detectionadd Add SSID to rogue databasedel Delete SSID from rogue databaseapproved Mark SSID as approved (stop reporting and displaying)known Mark SSID as known (stop reporting but display with an *)list List rogue databasecellsize Cell size settingsmall Small cell sizemedium Medium cell sizelarge Large cell sizerx-threshold Deferred thresholdtx-power Maximum transmit power
Wireless LAN ArrayThe Command Line Interface 177auto_channel Automatically assign channels to all IAPspower_up Automatically run automatic channel assignment at power upschedule Run automatic channel assignment at scheduled time(s)on Enable autochannel at power upoff Disable autochannel at power upDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo enable all the radio interfaces:(config-iap)# global_settings(config-iap-global)# all_upFigure 107. CLI: Enabling All Radio InterfacesSEE ALSOiap global_a_settingsiap global_bg_settingsiap global_settingsshow iap all
Wireless LAN Array178 The Command Line Interfaceiap global_a_settingsDESCRIPTIONMakes global configuration changes to all 802.11a Integrated Access Point(IAP) radio interfaces—available from the Config->Interface commandmode.This command allows configuration changes to all 802.11a IAP interfaces.Other global settings can be made for specific groups of IAPs by using oneof the following parameters in the interface IAP command mode:ziap number: Configuration for a specific IAP. The prompt will changeto: IAP number (config-iap-a12)#zglobal_bg_settings: Common configuration for all 802.11b/g IAPs.The prompt will change to: (config-iap-global-bg)#zglobal_settings: Common configuration for all IAPs. The prompt willchange to: (config-iap-global)#SYNTAXiap global_a_settings {all_down | all_up | rts-threshold <rtst> | frag-threshold <fragt> | auto_channel | cellsize {small | medium | large} | rx-threshold <thresrx> | tx-power <powertx> | rates {defaults |optimize_range | optimize_throughput | { basic { <br1> [<br2> [<br3>[<br4> [<br5> [<br6> [<br7> [<br8>]]]]]]]} | supported { [<sr1> [<sr2>[<sr3> [<sr4> [<sr5> [<sr6> [<sr7> [<sr8>]]]]]]]]}}}}PARAMETERSfrag-threshold 802.11a fragmentation threshold packet size above which a packet will be fragmentedrts-threshold 802.11a RTS threshold packet size above which an RTS is issued before sendingauto_channel Automatically assign channels to 802.11a IAPsrates Set allowed 802.11a data rates by listing the rates that will be used ( 6, 9, 12, 18, 24, 36, 48, 54, etc.)basic Set 802.11a basic (required) rates by listing the rates a client must support to associatesupported Set the 802.11a supported (accepted) ratesdefaults Use the default 802.11a rates
Wireless LAN ArrayThe Command Line Interface 179optimize_range Set 802.11a rates for the best rangeoptimize_throughput Set 802.11a rates for the best throughputall_down Shut down (disable) all 802.11a IAPsall_up Bring up (enable) all 802.11a IAPscellsize Cell size settingsmall Small cell sizemedium Medium cell sizelarge Large cell sizerx-threshold Deferred threshold, packets with a lower signal strength that the rx-threshold will be ignoredtx-power Maximum transmit power in dBparameter (-100,0) thresrx Deferred threshold valueparameter (0,20) powertx Maximum transmit valueDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo enable all 802.11a radio interfaces:((config-iap)# global_a_settings(config-iap-global-a)# all_upFigure 108. CLI: Enabling All 802.11a Radio Interfaces
Wireless LAN Array180 The Command Line InterfaceSEE ALSOiap global_bg_settingsiap global_settingsshow iap alliap global_bg_settingsDESCRIPTIONMakes global configuration changes to all 802.11bg Integrated Access Point(IAP) radio interfaces—available via the Config-> Interface commandmode.This command allows configuration changes to all 802.11bg IAP interfaces.Other global settings can be made for specific groups of IAPs by using oneof the below parameters in the Interface IAP command mode::ziap number: Configuration for a specific IAP. The prompt will changeto: IAP number (config-iap-a12)#zglobal_bg_settings: Common configuration for all 802.11b/g IAPs.The prompt will change to: (config-iap-global-bg)#zglobal_settings: Common configuration for all IAPs. The prompt willchange to: (config-iap-global)#SYNTAXIAPGlobalBG {all_down | all_up | slot_time {short_slot | long_slot} |[no] dot11g_protect [on | off] | [no] dot11g_only [on | off] | cellsize {small| medium | large} | rx-threshold <thresrx> | tx-power <powertx> |preamble {short_preamble | long_preamble} | auto_channel |rts-threshold <rtst> | frag-threshold <fragt> | rates {defaults |optimize_range | optimize_throughput | { basic { <br1> [<br2> [<br3>[<br4> [<br5> [<br6> [<br7> [<br8> [<br9> [<br10> [<br11>[<br12>]]]]]]]]]]]} | supported { [<sr1> [<sr2> [<sr3> [<sr4> [<sr5> [<sr6>[<sr7> [<sr8> [<sr9> [<sr10> [<sr11> [<sr12>]]]]]]]]]]]]}}}}
Wireless LAN ArrayThe Command Line Interface 181PARAMETERSfrag-threshold 802.11b/g fragmentation threshold packet size above which a packet will be fragmented rts-threshold 802.11b/g RTS threshold packet size above which an RTS is issued before sendingauto_channel Automatically assign channels to 802.11b/g IAPsrates Set allowed 802.11b/g bit ratesbasic Set 802.11b/g basic (required) rates supported Set 802.11b/g supported (accepted) rates defaults Set default 802.11b/g rates optimize_range Set 802.11b/g rates for best range optimize_throughput Set 802.11b/g rates for best throughputall_down Shut down (disable) all 802.11b/g IAPs all_up Bring up (enable) all 802.11b/g IAPs preamble Set 802.11b preamble lengthshort_preamble Enable cck short preamble (56 sync bits) long_preamble Use only cck long preamble (128 sync bits) slot_time Set 802.11b/g slot timeshort_slot Enable short slot time (9 us)long_slot Use only long slot time (20 us)dot11g_protect Enable or disable 802.11g protectiondot11g_only Enable or disable 802.11g only modeon Enable 802.11g only (or protection) modeoff D i s a b l e 8 0 2 . 1 1 g o n l y ( o r p r o t e c t i o n ) m o d ecellsize Cell size settingsmall Small cell sizemedium Medium cell sizelarge Large cell sizerx-threshold Deferred threshold (receive sensitivity)tx-power Maximum transmit powerDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLENone.
Wireless LAN Array182 The Command Line InterfaceSEE ALSONone.locationDESCRIPTIONDefines the location description for this Xirrus Array—available from theconfig command mode.SYNTAXlocation <locname>PARAMETERSlocname Input location name for this ArrayDEFAULTSNone.USAGE GUIDELINESQuotes must be used around the location text if spaces are used betweenwords. Typing location with no parameters will clear any set value.EXAMPLETo set the location description for the Xirrus Array:(config)# location “Building 11 Floor 2"SEE ALSONone.
Wireless LAN ArrayThe Command Line Interface 183moreDESCRIPTIONLists the contents of a file, one screen at a time.SYNTAXMore <file name>PARAMETERS<file name> The file name for which to display the contentsDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLENone.SEE ALSONone.radius-serverDESCRIPTIONConfigures the external or internal (local) radius server settings—availablefrom the Config-> radius-server command modeSYNTAXradius-server [no] external [ {on | off | ip <pri_ip> | port <pri_port> |secret [enc] [<pri_secret>] | timeout <tmout>}@ ] | secondary [ {ip[<sec_ip>] | port [<sec_port>] | secret [enc] [<sec_secret>]}] | [no] internal [ {on | off | {add <aid> password [enc] <passwd> ssid <ss>} |del <did>} ]
Wireless LAN Array184 The Command Line InterfacePARAMETERSexternal Configure the primary external RADIUS server parametersPrompt will change to (config-radius-external)#secondary Configure the secondary external RADIUS server parametersPrompt will change to (config-radius-secondary)#ip IP address of the RADIUS serverport Authentication port of the RADIUS server secret Shared secret for the RADIUS server enc Enter encrypted shared secret for the RADIUS serveron Enable external RADIUS server off Disable external RADIUS server timeout Timeout (in seconds) before the server is retried after it initially failed internal Configure internal RADIUS server parameterson Enable internal RADIUS server off Disable internal RADIUS server add Add this user del Delete this userpassword User passwordenc Enter encrypted password ssid SSID with which the user is allowed to associateshow Display current radius server settingsDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLENone.SEE ALSONone.
Wireless LAN ArrayThe Command Line Interface 185rebootDESCRIPTIONReboots the Xirrus Array.SYNTAXrebootPARAMETERSNone.DEFAULTSNone.USAGE GUIDELINESWhen rebooting the Array, you must respond to the following prompts:zThe system will prompt you to save any unsaved configurationchanges.zThe system will prompt you to confirm the reboot action.EXAMPLETo reboot the Xirrus Array type the following. Xirrus_WLAN_Array(config)# rebootDo you want to save changes to flash? [yes/no]: yare you sure you want to reboot? [yes/no]: ySEE ALSONone.
Wireless LAN Array186 The Command Line InterfaceresetDESCRIPTIONResets all settings to the factory defaults, then reboots the Xirrus Array.SYNTAXresetPARAMETERSNone.DEFAULTSNone.USAGE GUIDELINESWhen you enter the reset command, the system will prompt you to confirmthe reset action.EXAMPLETo reset the Xirrus Array back to factory defaults, type:Xirrus_WLAN_Array(config)# resetAre you sure you want to reset to factory settings and reboot? [yes/no]:ySEE ALSOrebootrun-scriptDESCRIPTIONRun a CLI command script.SYNTAXrun-script <file name>PARAMETERS<file name> name of command script file
Wireless LAN ArrayThe Command Line Interface 187DEFAULTSNone.USAGE GUIDELINESNone.EXAMPLENone.SEE ALSONone.run-testsDESCRIPTIONRuns network diagnostic tests from the run-test command mode—availablefrom the config-run-tests command mode.SYNTAXtraceroute <tracename> | ping <pingname>PARAMETERStraceroute <IP Address or DNS name> Run a trace on IP route or DNS nameping <IP Address or DNS name> Execute ping utilityDEFAULTSNone.USAGE GUIDELINESYou access the run-tests command mode from the config mode.
Wireless LAN Array188 The Command Line InterfaceEXAMPLETo test connectivity to a client device at IP address 192.168.0.2 type:(config)# run-tests(config-run-test)# ping 192.168.0.2Figure 109. CLI: Testing Client ConnectivityTo view the network routing to another device use traceroute:(config)# run-tests(config-run-test)# traceroute 192.168.0.2Figure 110. CLI: Viewing the Routing to a ClientSEE ALSONone.
Wireless LAN ArrayThe Command Line Interface 189saveDESCRIPTIONPermanently saves the current configuration so that changes will beavailable at the next system boot.SYNTAXsavePARAMETERSNone.DEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo permanently save the current configuration, type:Xirrus_WLAN_Array(config)# saveSEE ALSONone.securityDESCRIPTIONSet wireless and other security parameters for the Xirrus Array. Availablevia the config-security command mode.There are two options available from the Security command mode:zwep: Set WEP encryption parameterszwpa: Set WPA encryption parameters
Wireless LAN Array190 The Command Line InterfaceSYNTAXwep { on | off | default_key <keyid> | key {<keynum> size [not_set |<wepsz> { ascii | hex | enc } <keystr> ] } }PARAMETERSon Enable WEP encryptionoff Disable WEP encryptionkey Set static WEP key number 1-4size Key size (40 or 128 bits, default = 128)ascii ASCII charactershex Hex digitsenc Encrypted formdefault_key Default key ID 1-4SYNTAXwpa { on | off | rekey { never | <ti> } | { no ] tkip [ on | off } | [ no ] aes [ on| off ] | [ no ] eap [ on | off ] | [ no ] psk [ on | off ] | passphrase { not_set |<pstr> | enc <epstr> }}PARAMETERSon Enable WPA encryptionoff Disable WPA encryptionrekey Time interval for rekeying broadcast encryption keysnever Disable rekeying broadcast encryption keystkip Enable or disable Temporal Key Integrity Protocol (TKIP)on Enable TKIPoff Disable TKIPaes Enable or disable AES in counter mode with CBC-MAC (CCMP)on Enable AESoff Disable AESeap Enable or disable 802.1x EAPon Enable EAPoff Disable EAPpsk Enable or disable Pre-Shared Key (PSK)on Enable PSKoff Disable PSKpassphrase WPA PSK (Pre-Shared Key) passphrase
Wireless LAN ArrayThe Command Line Interface 191enc Enter an encrypted form of the passphrase in double quotesDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo disable WEP encryption, type:(config)# security(config-security) wep(config-security-wep) offFigure 111. CLI: Disabling WEP EncryptionSEE ALSONone.
Wireless LAN Array192 The Command Line InterfaceshowDESCRIPTIONDisplays settings and information, and is useful when verifying the currentconfiguration of the Array.SYNTAXshow [ acl| admin | array_info | console | contact_info | date_time |dhcp_server | diff | dns | ethernet | external_radius | factory_config | iap| internal_radius | log | rogue_ap | running_config | saved_config |security | snmp | ssid | startup_config | stations | statistics ]PARAMETERSacl Display access control listadmin Display administrator accounts listarray_info Display system informationconsole Display terminal settingscontact_info Display contact informationdate_time Display date and time settings summarydhcp_server Display internal DHCP server settings summarydiff Display the differences between configurationsdns Display DNS summaryethernet Display eth0 and gig1/gig2 interface summaryexternal_radius Display external RADIUS server settings summaryfactory_config Display the array configuration from the factoryiap Display IAP configuration summaryinternal_radius Display all users defined for the embedded RADIUS serverlog Display the event logrogue_ap Display rogue AP informationrunning_config Display the array configuration that is currently runningsaved_config Display the array configuration that was last savedsecurity Display security settings summarysnmp Display SNMP summaryssid Display SSID summarystartup_config Display the array configuration from the last boot
Wireless LAN ArrayThe Command Line Interface 193stations Display station (client) informationstatistics Display interface statisticsDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLETo display the current security settings, type:(config)# security(config-security) showFigure 112. CLI: Displaying the Current Security SettingsSEE ALSONone.
Wireless LAN Array194 The Command Line InterfacesnmpDESCRIPTIONConfigures SNMP (Simple Network Management Protocol). This commandis available from the config->snmp command mode.SYNTAXsnmp {on | off | [no] trap [enable | disable] | host [<thsnmp>] | port<tpsnmp> | community <csnmp>}PARAMETERSon E n a b l e S N M P off D i s a b l e S N M P host S N M P t r a p I P a d d r e s s o r h o s t n a m e port S N M P t r a p p o r t community S N M P c o m m u n i t y s t r i n g N o t e n o s p a c e s o r special characters may be used trap S e n d t r a p s f o r a u t h e n t i c a t i o n f a i l u r e s no D i s a b l e s e l e c t e d f e a t u r e enable E n a b l e t r a p s disable D i s a b l e t r a p s DEFAULTSSNMP is disabled by default.USAGE GUIDELINESSNMP community string cannot have spaces or special characters.EXAMPLENone.SEE ALSONone.
Wireless LAN ArrayThe Command Line Interface 195sshDESCRIPTIONEnables or disables ssh (secure shell) access to the Command Line Interface.SYNTAXssh {on | off}PARAMETERSon Enable ssh accessoff Disable ssh access DEFAULTSNone.USAGE GUIDELINESNone.EXAMPLENone.SEE ALSOtelnet.
Wireless LAN Array196 The Command Line InterfacesyslogDESCRIPTIONConfigures the syslog server settings. This command is available from theconfig->syslog command mode.SYNTAXsyslog {on | off | {ipsyslog <ip address> | [no] console [on | off] | level<slev> | buffered <logfilesz> | show}}PARAMETERSon E n a b l e S y s l o g s e r v e roff Disable Syslog serveripsyslog <ip address> Syslog IP address (in A.B.C.D format)level S y s l o g m e s s a g e l e v e l ( l o g a l l m e s s a g e s w i t h this level and lower)buffered Set the size of the local Syslog fileconsole Enable or disable display of Syslog messages on the console no Disable console feature on Enable Syslog messages on the console off Disable Syslog messages on the consoleshow Show current syslog messagesDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLENone.SEE ALSONone.
Wireless LAN ArrayThe Command Line Interface 197telnetDESCRIPTIONEnables or disables telnet access to the Command Line Interface.SYNTAXtelnet {on | off}PARAMETERSon Enable telnet accessoff Disable telnet accessDEFAULTSNone.USAGE GUIDELINESNone.EXAMPLENone.SEE ALSONone.
Wireless LAN Array198 The Command Line InterfacePage is intentionally blank
Wireless LAN Array199Appendices
Wireless LAN Array200Page is intentionally blank
Wireless LAN ArrayAppendix A: Servicing the Xirrus Array 201Appendix A: Servicing the Xirrus ArrayThis chapter contains procedures for servicing the Xirrus Array, including theremoval and reinstallation of major hardware components. Section headings forthis chapter include:z“Removing the Access Panel” on page 202z“Reinstalling the Access Panel” on page 204z“Replacing the FLASH Memory Module” on page 205z“Replacing the Main System Memory” on page 206z“Replacing the Integrated Access Point Radio Module” on page 207z“Replacing the Power Supply Module” on page 209!!Always turn OFF the Array’s power switch and disconnect the AC power cordbefore attempting to remove or replace components. Never work on the unitwith the power connected.You must be grounded and the work surface must be static-free.Figure 113. Disconnecting Power from the Array#Most service activities are performed with the Array placed face-down on a flatwork surface. To avoid damaging the finished enclosure, we recommend usinga protective material between the work surface and the unit (a clean sheet ofpaper will do the trick).Power switchAC power cord receptacle
Wireless LAN Array202 Appendix A: Servicing the Xirrus ArrayRemoving the Access PanelUse this procedure when you want to remove the system’s access panel. You mustremove this panel whenever you need to service the internal components of theArray.1. Turn OFF the Array’s main power switch.2. Disconnect the AC power cord from the Array.3. Place the Array face-down on a flat surface. Avoid moving the unit toreduce the risk of damage (scratching) to the finished enclosure.4. Remove the screws (3 places) that secure the access panel to the mainbody of the Array.Figure 114. Removing the Access Panel ScrewsScrewScrewScrew
Wireless LAN ArrayAppendix A: Servicing the Xirrus Array 2035. Lift up the access panel to reveal the main system board.Figure 115. Removing the Access Panel6. Disconnect the connectors to the power supply and the fan.Figure 116. Disconnecting the Power Supply and Fan7. The access panel can now be safely removed.Lift up the access panelPower supply connectorFan connector
Wireless LAN Array204 Appendix A: Servicing the Xirrus ArrayReinstalling the Access PanelUse this procedure when you need to reinstall the access panel after servicing theXS-3900’s internal components.1. Reconnect the fan and power supply.Figure 117. Reconnecting the Fan and Power Supply2. Reinstall the access panel and secure the panel with the three screws.Figure 118. Reinstalling the Access Panel3. Reconnect the AC power cord and turn ON the main power switch.Power supply connectorFan connectorScrew!Do not overtightenScrew!Do not overtightenScrew!Do not overtighten
Wireless LAN ArrayAppendix A: Servicing the Xirrus Array 205Replacing the FLASH Memory ModuleUse this procedure when you want to replace the system’s FLASH memorymodule.1. Remove the system’s access panel. Refer to “Removing the Access Panel”on page 202.2. Remove the FLASH memory module, taking care not to “wiggle” themodule and risk damaging the connection points.Figure 119. Removing the FLASH Memory Module3. The removal procedure is complete. You can now reinstall the FLASHmemory module (or install a new module).FLASH memory module
Wireless LAN Array206 Appendix A: Servicing the Xirrus Array4. Reinstall the access panel (refer to “Reinstalling the Access Panel” onpage 204).Replacing the Main System MemoryUse this procedure when you want to replace the main system memory.1. Remove the access panel (refer to “Removing the Access Panel” onpage 202).2. Remove the DIMM memory module, taking care not to “wiggle” themodule and risk damaging the connection points.Figure 120. Removing the DIMM Memory Module3. The removal procedure is complete. You can now reinstall the DIMMmemory module (or install a new module). Ensure that the DIMMmemory module is seated evenly and the locking tabs are in the uprightposition.4. Reinstall the access panel (refer to “Reinstalling the Access Panel” onpage 204).#The DIMM memory module is keyed to fit in its socket in one direction only.DIMM memory modulePush down on the two locking tabs to release the DIMM memory module
Wireless LAN ArrayAppendix A: Servicing the Xirrus Array 207Replacing the Integrated Access Point Radio ModuleUse this procedure when you want to replace the integrated access point radiomodule.1. Remove the access panel (refer to “Removing the Access Panel” onpage 202).2. Remove the nylon locking screws (8 places) that secure the chassis coverto the main body of the XS-3900.Figure 121. Removing the Chassis Cover Nylon Screws3. Lift and remove the chassis cover.Figure 122. Removing the Chassis CoverNylon screws (8 places)Remove the chassis cover
Wireless LAN Array208 Appendix A: Servicing the Xirrus Array4. Lift the edge of the integrated access point module.Figure 123. Lifting the Integrated Access Point Module5. Slide the integrated access point module away from the unit to disconnectit from the main system board.Figure 124. Disconnect the Integrated Access Point Module6. The removal procedure is complete. You can now reinstall the integratedaccess point module (or install a new module).Lift here (do not force)Disconnect the module
Wireless LAN ArrayAppendix A: Servicing the Xirrus Array 2097. Reinstall the chassis cover (see warnings).8. Reinstall the nylon locking screws (8 places) to secure the chassis cover inplace—do not overtighten.9. Reinstall the access panel (refer to “Reinstalling the Access Panel” onpage 204).Replacing the Power Supply ModuleUse this procedure when you want to replace the power supply module.1. Remove the access panel (refer to “Removing the Access Panel” onpage 202).2. Because the power supply unit is molded into the access panel, you mustinstall a new access panel assembly (with the power supply attached).Refer to “Reinstalling the Access Panel” on page 204.Figure 125. Installing a New Access Panel (with Power Supply)!!When reinstalling the chassis cover, take care to align the cover correctly toavoid damaging the antenna modules. Do not force the chassis cover onto thebody of the unit.Do not overtighten the nylon locking screws.Access panel (with power supply and fan)
Wireless LAN Array210 Appendix A: Servicing the Xirrus ArrayPage is intentionally blank
Wireless LAN ArrayAppendix B: Quick Reference Guide 211Appendix B: Quick Reference GuideThis chapter contains product reference information. Use this chapter to locate theinformation you need quickly and efficiently. Section headings for this chapterinclude:z“Review of WMI Pages” on page 211z“Factory Default Settings” on page 215z“Keyboard Shortcuts” on page 220Review of WMI PagesThis section provides a review of the product’s WMI pages, with a briefexplanation of their function and content. Click on any of the listed pages to go tothe corresponding procedure at the referenced destination.Page FunctionArray Status Provides a snapshot of the globalconfiguration settings for all Arraynetwork interfaces and radios.Express Setup Establish global configurationsettings that will enable basic XS-3900functionality.Network Interfaces Provides a snapshot of theconfiguration settings currentlyestablished for the network interfaces.Network Settings Establish basic configuration settingsfor the network interfaces.Network Statistics Provides statistical data associatedwith network interfaces and theiractivity.DHCP Settings Enable or disable DHCP (DynamicHost Configuration Protocol) serverfunctionality.
Wireless LAN Array212 Appendix B: Quick Reference GuideDNS Settings Set up a DNS server (or multipleservers), if you want to offer clientsassociating with the Array the abilityto use meaningful domain names(URLs) instead of numerical IPaddresses.IAP Interfaces Provides a snapshot of globalconfiguration data associated withradios.IAP Settings Enable or disable radios, define thewireless mode for each radio,establish the transmit and receiveparameters, and define global settingsfor the beacon interval and DTIMperiod.Global Settings Establish global IAP (radio) settings.Global IAP settings include enablingor disabling all radios (regardless oftheir operating mode).Global Settings .11a Establish global 802.11a IAP (radio)settings.Global Settings .11bg Establish global 802.11b/g IAP (radio)settings.IAP LED Settings Set the behavior of LEDs.Statistics Provides an overview of statisticaldata associated with individualradios.Page Function
Wireless LAN ArrayAppendix B: Quick Reference Guide 213SSID Provides a snapshot of SSID (ServiceSet IDentifier) assignments. Itincludes the SSID name, whether ornot an SSID is visible on the network,any security and QoS parametersdefined for each SSID, associatedVLAN IDs, guest access, and radioavailability per SSID.SSID Management Manage SSIDs (create, modify ordelete). It also allows you to assignsecurity parameters and VLANs on aper SSID basis.Security Provides a snapshot of Array globalsecurity configuration parameters,including administration accounts,ACL values, WEP/WPA/WPA2status, and RADIUS configurationsettings.Security Management Establish the security parameters foryour wireless network, includingWEP, WPA and RADIUSauthentication.Radius Server Set up the XS-3900’s internal RADIUSserver, or set up an external RADIUSserver for user authentication.Radius User Create, delete and manage RADIUSuser accounts.MAC Access List Create new MAC-based AccessControl Lists (ACLs), delete existingACLs, and add, remove, or restoreMAC addresses.Admin Management Manage network administratoraccounts (create, modify or delete),restore accounts, or limit accountaccess to a read only status.Page Function
Wireless LAN Array214 Appendix B: Quick Reference GuideManagement Control Displays rogue APs, according to thesort list you select (either Unknown,Known or Approved).Rogue Control List Establishes a control list for rogueAPs, based on a type that you define.Stations Displays stations that are currentlyassociated with the Array.Services Provides a current status of Syslogand SNMP services.Time Settings Synchronizes the Array’s clock with auniversal clock from an NTP server.System Log Enable or disable the Syslog server,define the server’s IP address, and setthe level for Syslog reporting.SNMP Enable or disable SNMP and definethe SNMP parameters.Array Info Displays the current status of theArray.Tools Ping the Array and obtain a status ofthe unit’s performance.Show Config Displays the configuration settings(Current/Saved/Start) for the Array.Event Log Provides an event log for the network.Page Function
Wireless LAN ArrayAppendix B: Quick Reference Guide 215Factory Default SettingsThe following tables show the Array’s factory default settings.Network InterfacesSerialGigabit 1 and Gigabit 2Setting Default ValueBaud Rate 115200Word Size 8 bitsStop Bits 1Parity No parityTime Out 10 secondsSetting Default ValueEnabled YesDHCP Bind YesDefault IP Address 10.0.1.2Default IP Mask 255.0.0.0Default Gateway NoneAuto Negotiate OnDuplex FullSpeed 1000 MbpsMTU Size 1504Management Enabled Yes
Wireless LAN Array216 Appendix B: Quick Reference GuideFast EthernetIntegrated Access Points (IAPs)Setting Default ValueEnabled YesDHCP Bind YesDefault IP Address 10.0.1.1Default IP Mask 255.0.0.0Default Gateway NoneAuto Negotiate OnDuplex FullSpeed 100 MbpsMTU Size 1500Management Enabled YesSetting Default ValueAntenna 0Mode 11a for a1 to a1211g for abg1 to abg4Channel AutoMaximum Transmit Power 0Cell Size Medium
Wireless LAN ArrayAppendix B: Quick Reference Guide 217Server SettingsDHCPExternal RADIUSSetting Default ValueEnabled NoMaximum Lease Time 300 minutesDefault Lease Time 300 minutesIP Start Range 192.168.1.100IP End Range 192.168.1.200Setting Default ValueEnabled YesPrimary Server 0.0.0.0Primary Port 1812Primary Secret xirrusSecondary Server null (no IP address)Secondary Port 1812Secondary Secret null (no secret)Time Out (before primary server is retired) 600 seconds
Wireless LAN Array218 Appendix B: Quick Reference GuideInternal RADIUSNTPSyslogSNMPSetting Default ValueEnabled NoThe user database is cleared upon reset to the factory defaults. For theInternal RADIUS Server you have a maximum of 200 entries.Setting Default ValueEnabled NoPrimary time.nist.govSecondary 192.6.15.29Setting Default ValueEnabled NoSetting Default ValueEnabled NoCommunity String xirrusTrap Host null (no setting)Trap Port 162Authorization Fail Port 1
Wireless LAN ArrayAppendix B: Quick Reference Guide 219Default SSIDEncryptionSetting Default ValueID xirrusVLAN NoneEncryption OffEncryption Type NoneQoS NoneEnabled YesSetting Default ValueEnabled YesWEP Keys null (all 4 keys)WEP Key Length null (all 4 keys)Default Key ID 0WPA Enabled NoTKIP Enabled YesAES Enabled NoEAP Enabled YesPSK Enabled NoPass Phrase nullGroup Rekey 600
Wireless LAN Array220 Appendix B: Quick Reference GuideAdministrator Account and PasswordManagementKeyboard ShortcutsThe following table shows the most common keyboard shortcuts.Setting Default ValueID adminPassword adminSetting Default ValueTelnet OnSSH OnAction ShortcutCut selected data and place it on theclipboard. Ctrl + XCopy selected data to the clipboard. Ctrl + CPaste data from the clipboard into a document(at the insertion point). Ctrl + VCopy the active window to the clipboard. Alt + Print ScreenCopy the entire desktop image to theclipboard. Print ScreenAbort an action at any time. EscGo back to the previous screen. bAccess the Help screen. ?
Wireless LAN ArrayAppendix C: Technical Support 221Appendix C: Technical SupportThis chapter provides valuable support information that can help you resolvetechnical difficulties. Before contacting Xirrus, review all sections in this chapterand try to determine if your problem resides with the Array or your networkinfrastructure. Section headings for this chapter include:z“General Hints and Tips” on page 221z“Frequently Asked Questions” on page 222z“Contact Information” on page 228General Hints and TipsThis section provides some useful tips that will optimize the reliability andperformance of your Xirrus Arrays.zThe Array requires careful handling. For best performance, units shouldbe mounted in a dust-free and temperature-controlled environment.zIf using multiple Arrays at the same location, we recommendmaintaining a distance of at least 50 feet between units.zKeep the Array away from electrical devices or appliances that generateRF noise. Because the Array is generally mounted on ceilings, be aware ofits position relative to lighting (especially fluorescent lighting).zIf using AC power, each Array requires its own dedicated AC poweroutlet. Do not attempt to “piggy-back” AC power to multiple units. Ifdeploying multiple units, consider using the optional Xirrus Remote DCPower System (XP-3100).zIf you are deploying multiple units, ensure that the “clock face” of allunits is aligned in the same direction.zThe Array should only be used with Wi-Fi certified client devices.
Wireless LAN Array222 Appendix C: Technical SupportFrequently Asked QuestionsThis section answers some of the most frequently asked questions, organized byfunctional area.Multiple SSIDsQ. What Are BSSIDs and SSIDs?A. BSSID (Basic Service Set Identifier) refers to an individual access pointradio and its associated clients. The identifier is the MAC address of theaccess point radio that forms the BSS.A group of BSSs can be formed to allow stations in one BSS tocommunicate to stations in another BSS by way of a backbone thatinterconnects each access point.The Extended Service Set (ESS) refers to the group of BSSIDs that aregrouped together to form one ESS. The ESSID (often referred to as SSID or“wireless network name”) identifies the Extended Service Set. Clientsmust associate to a single ESS at any given time. Clients ignore trafficfrom other Extended Service Sets that do not have the same SSID.Legacy access points typically support one SSID per access point. XirrusWireless LAN Arrays support the ability for multiple SSIDs to be definedand used simultaneously.Q. What would I use SSIDs for?A. The creation of different wireless network names allows systemadministrators to separate types of users with different requirements. Thefollowing policies can be tied to an SSID:zMinimum security required to join this SSID.zThe wireless Quality of Service (QoS) desired for this SSID.zThe wired VLAN associated with this SSID.As an example, one SSID named accounting might require the highestlevel of security, while another SSID named guests might have lowsecurity requirements.
Wireless LAN ArrayAppendix C: Technical Support 223Another example may define an SSID named voice that supports voiceover Wireless LAN phones with the highest possible Quality of Service(QoS) definition. This type of SSID might also forward traffic to specificVLANs on the wired network.Q. How do I set up SSIDs?A. Use the following procedure as a guideline. For more detailedinformation, go to “SSID” on page 107.1. From the Web Management Interface, go to the SSIDManagement page.2. Select Yes to make the SSID visible to all clients on the network.Although the XS-3900 will not broadcast SSIDs that are hidden,clients can still associate to a hidden SSID if they know the SSIDname to connect to it.3. Select the minimum security that will be required by users forthis SSID.4. If desired (optional), select a Quality of Service (QoS) setting forthis SSID. The QoS setting you define here will prioritize wirelesstraffic for this SSID over other SSID wireless traffic.5. If desired (optional), select a VLAN that you want this traffic tobe forwarded to on the wired network.6. If desired (optional), you can select which radios this SSID willnot be available on—the default is to make this SSID available onall radios.7. Click on the Apply button to apply your changes to this session.8. Click on the Save button to save your changes.9. If you need to edit any of the SSID settings, you can do so fromthe SSID Management page.
Wireless LAN Array224 Appendix C: Technical SupportSecurityQ. How do I know my management session is secure?A. Follow these guidelines:zAdministrator passwordsAlways change the default administrator password (the defaultis admin), and choose a strong replacement password. Whenappropriate, issue read only administrator accounts.zSSH versus TelnetBe aware that Telnet is not secure over network connections andshould be used only with a direct serial port connection. Whenconnecting to the unit’s Command Line Interface over a networkconnection, you must use a Secure SHell (SSH) utility. The mostcommonly used freeware providing SSH tools is PuTTY.zConfiguration auditingDo not change approved configuration settings. The optionalXirrus Wireless Management System (XM-3300) offers powerfulmanagement features for small or large XS-3900 deployments,and can audit your configuration settings automatically. Inaddition, using the XM-3300 eliminates the need for an FTPserver.Q. Which wireless data encryption method should I use?A. Wireless data encryption prevents eavesdropping on data beingtransmitted or received over the airwaves. The XS-3900 allows you toestablish the following data encryption configuration options:zOpenThis option offers no data encryption and is not recommended,though you might choose this option if clients are required to usea VPN connection through a secure SSH utility, like PuTTy.
Wireless LAN ArrayAppendix C: Technical Support 225zWEP (Wired Equivalent Privacy)This option provides minimal protection (though much betterthan using an open network). An early standard for wireless dataencryption and supported by all Wi-Fi certified equipment, WEPis vulnerable to hacking and is therefore not recommended foruse by Enterprise networks.zWPA (Wi-Fi Protected Access)This is a much stronger encryption model than WEP and usesTKIP (Temporal Key Integrity Protocol) with AES (AdvancedEncryption Standard) to prevent WEP cracks.TKIP solves security issues with WEP. It also allows you toestablish encryption keys on a per-user-basis, with key rotationfor added security. In addition, TKIP provides Message IntegrityCheck (MIC) functionality and prevents active attacks on thewireless network.AES is the strongest encryption standard and is used bygovernment agencies; however, old legacy hardware may not becapable of supporting the AES mode (it probably won’t work onolder wireless clients). Because AES is the strongest encryptionstandard currently available, it is highly recommended forEnterprise networks.Any of the above encryption modes can be used (and can be used at the same time).Q. Which user authentication method should I use?A. User authentication ensures that users are who they say they are. For thispurpose, the Array allows you to choose between the following userauthentication methods:zPre-Shared KeyUsers must manually enter a key (pass phrase) on the client sideof the wireless network that matches the key stored by theadministrator in the XS-3900.
Wireless LAN Array226 Appendix C: Technical SupportzRADIUS 802.1x with EAP802.1x uses a RADIUS server to authenticate large numbers ofclients, and can handle different EAP (Extensible AuthenticationProtocol) authentication methods, including EAP-TLS, EAP-TTLS and EAP-PEAP. The RADIUS server can be internal(provided by the XS-3900) or external. An external RADIUSserver offers more functionality and is recommended for largeEnterprise deployments.When using this method, user names and passwords must beentered into the RADIUS server for user authentication.zMAC Address ACLs (Access Control Lists)MAC address ACLs provide a list of client adapter MACaddresses that are allowed or denied access to the wirelessnetwork. Access Control Lists work well when there are a limitednumber of users—in this case, enter the MAC addresses of eachuser in the Allow list. In the event of a lost or stolen MACadapter, enter the affected MAC address in the Deny list.Q. Why do I need to authenticate my XS-3900 units?A. When deploying multiple Arrays, you may need to define which unitsare part of which wireless network (for example, if you are establishingmore than one network). In this case, you need to employ the XirrusWireless Management System (XM-3300) which can authenticate yourArrays automatically and ensure that only authorized units areassociated with the defined wireless network.Q. What is rogue AP (Access Point) detection?A. The Xirrus Array has a dedicated radio (abg/4) which constantly scansthe local wireless environment for rogue APs (non-Xirrus devices that arenot part of your wireless network), unencrypted transmissions, and othersecurity issues. Administrators can then classify each rogue AP andensure that these devices do not interrupt or interfere with the network.
Wireless LAN ArrayAppendix C: Technical Support 227VLAN SupportQ. What Are VLANs?A. VLANs (Virtual Local Area Networks) are a logical grouping of networkdevices that share a common network broadcast domain. Members of aparticular VLAN can be on any segment of the physical network butlogically only members of a particular VLAN can see each other.VLANs are defined and implemented using the wired network switchesthat are VLAN capable. Packets are tagged for transmission on aparticular VLAN according to the IEEE 802.1Q standard, with VLANswitches processing packets according to the tag.Q. What would I use VLANs for?A. Logically separating different types of users, systems, applications, orother logical division aids in performance and management of differentnetwork devices. Different VLANs can also be assigned with differentpacket priorities to prioritize packets from one VLAN over packets fromanother VLAN.VLANs are managed by software settings—instead of physicallyplugging in and moving network cables and users—which helps to easenetwork management tasks.Q. What are Wireless VLANs?A. Wireless VLANs allow similar functionality to the wired VLANdefinitions and extend the operation of wired VLANs to the wireless sideof the network.Wireless VLANs can be mapped to wireless SSIDs so that traffic fromwired VLANs can be sent to wireless users of a particular SSID. Thereverse is also true, where wireless traffic originating from a particularSSID can be tagged for transmission on a particular wired VLAN.Sixteen SSIDs can be defined on the XS-3900, allowing a total of sixteenVLANs to be accessed (one per SSID).
Wireless LAN Array228 Appendix C: Technical SupportAs an example, to provide guest user access an SSID of guest might becreated. This SSID could be mapped to a wired VLAN that segregatesunknown users from the rest of the wired network and restricts them toInternet access only. Wireless users could then associate to the wirelessnetwork via the guest SSID and obtain access to the Internet through theselected VLAN, but would be able to access other privileged networkresources.Contact InformationXirrus, Inc. is located in Westlake Village, California, just 45 minutes northwest ofdowntown Los Angeles and 45 minutes southeast of Santa Barbara.Xirrus, Inc.370 North Westlake Blvd, Suite 200Westlake Village, CA 91362USATel: 1.805.497.0955Fax: 1.805.449.1180www.xirrus.com
Wireless LAN ArrayGlossary of Terms 229Glossary of Terms802.11aA supplement to the IEEE 802.11 WLAN specification that describes radiotransmissions at a frequency of 5 GHz and data rates of up to 54 Mbps.802.11bA supplement to the IEEE 802.11 WLAN specification that describes radiotransmissions at a frequency of 2.4 GHz and data rates of up to 11 Mbps.802.11dA supplement to the Media Access Control (MAC) layer in 802.11 to promoteworldwide use of 802.11 WLANs. It allows Access Points to communicateinformation on the permissible radio channels with acceptable power levels foruser devices. Because the 802.11 standards cannot legally operate in somecountries, 802.11d adds features and restrictions to allow WLANs to operatewithin the rules of these countries.802.11gA supplement to the IEEE 802.11 WLAN specification that describes radiotransmissions at a frequency of 2.4 GHz and data rates of up to 54 Mbps.802.1QAn IEEE standard for MAC layer frame tagging (also known as encapsulation).Frame tagging uniquely assigns a user-defined ID to each frame. It also enables aswitch to communicate VLAN membership information across multiple (andmulti-vendor) devices by frame tagging.AES(Advanced Encryption Standard) A data encryption scheme that uses threedifferent key sizes (128-bit, 192-bit, and 256-bit). AES was adopted by the U.S.government in 2002 as the encryption standard for protecting sensitive butunclassified electronic data.
Wireless LAN Array230 Glossary of TermsauthenticationThe process that a station, device, or user employs to announce its identify to thenetwork which validates it. IEEE 802.11 specifies two forms of authentication,open system and shared key.bandwidthSpecifies the amount of the frequency spectrum that is usable for data transfer. Inother words, it identifies the maximum data rate a signal can attain on themedium without encountering significant attenuation (loss of power).beacon intervalWhen a device in a wireless network sends a beacon, it includes with it a beaconinterval, which specifies the period of time before it will send the beacon again.The interval tells receiving devices on the network how long they can wait in lowpower mode before waking up to handle the beacon. Network administrators canadjust the beacon interval—usually measured in milliseconds (ms) or itsequivalent, kilo-microseconds (Kmsec).bit rateThe transmission rate of binary symbols ('0' and '1'), equal to the total number ofbits transmitted in one second.BSS(Basic Service Set) When a WLAN is operating in infrastructure mode, each accesspoint and its connected devices are called the Basic Service Set.BSSIDThe unique identifier for an access point in a BSS network. See also, SSID.cellThe basic geographical unit of a cellular communications system. Servicecoverage of a given area is based on an interlocking network of cells, each with aradio base station (transmitter/receiver) at its center. The size of each cell isdetermined by the terrain and forecasted number of users.
Wireless LAN ArrayGlossary of Terms 231channelA specific portion of the radio spectrum—the channels allotted to one of thewireless networking protocols. For example, 802.11b and 802.11g use 14 channelsin the 2.4 GHz band, only 3 of which don't overlap (1, 6, and 11). In the 5 GHzband, 802.11a uses 8 channels for indoor use and 4 for outdoor use, none of whichoverlap.CoS(Class of Service) A category based on the type of user, type of application, orsome other criteria that QoS systems can use to provide differentiated classes ofservice.default gatewayThe gateway in a network that a computer will use to access another network if agateway is not specified for use. In a network using subnets, a default gateway isthe router that forwards traffic to a destination outside of the subnet of thetransmitting device.DHCP(Dynamic Host Configuration Protocol) A method for dynamically assigning IPaddresses to devices on a network. DHCP issues IP addresses automaticallywithin a specified range to client devices when they are first powered up.DHCP leaseThe DHCP lease is the amount of time that the DHCP server grants to the DHCPclient for permission to use a particular IP address. A typical DHCP server allowsits administrator to set the lease time.DNS(Domain Name System) A system that maps meaningful domain names withcomplex numeric IP addresses. DNS is actually a separate network—if one DNSserver cannot translate a domain name, it will ask a second or third until a serveris found with the correct IP address.
Wireless LAN Array232 Glossary of TermsdomainThe main name/Internet address of a user's Internet site as registered with theInterNIC organization, which handles domain registration on the Internet. Forexample, the “domain” address for Xirrus is: http://www.xirrus.com, brokendown as follows:zhttp:// represents the Hyper Text Teleprocessing Protocol used by all Web pages.zwww is a reference to the World Wide Web.zxirrus refers to the company.zcom specifies that the domain belongs to a commercial enterprise.DTIM(Delivery Traffic Indication Message) A DTIM is a signal sent as part of a beaconby an access point to a client device in sleep mode, alerting the device to a packetawaiting delivery.EAP(Extensible Authentication Protocol) When you log on to the Internet, you're mostlikely establishing a PPP connection via a remote access server. The password,key, or other device you use to prove that you are authorized to do so is controlledvia PPP’s Link Control Protocol (LCP). However, LCP is somewhat inflexiblebecause it has to specify an authentication device early in the process. EAP allowsthe system to gather more information from the user before deciding whichauthenticator to use. It is called extensible because it allows more authenticatortypes than LCP (for example, passwords and public keys).EDCF(Enhanced Distributed Coordinator Function) A QoS extension which uses thesame contention-based access mechanism as current devices but adds “offsetcontention windows” that separate high priority packets from low prioritypackets (by assigning a larger random backoff window to lower priorities than tohigher priorities). The result is “statistical priority,” where high-priority packetsusually are transmitted before low-priority packets.encapsulationA way of wrapping protocols such as TCP/IP, AppleTalk, and NetBEUI inEthernet frames so they can traverse an Ethernet network and be unwrappedwhen they reach the destination computer.
Wireless LAN ArrayGlossary of Terms 233encryptionAny procedure used in cryptography to translate data into a form that can bedecrypted and read only by its intended receiver.Fast EthernetA version of standard Ethernet that runs at 100 Mbps rather than 10 Mbps.FCC(Federal Communications Commission) US wireless regulatory authority. TheFCC was established by the Communications Act of 1934 and is charged withregulating Interstate and International communications by radio, television, wire,satellite and cable.frameApacket encapsulated to travel on a physical medium, like Ethernet or Wi-Fi. If apacket is like a shipping container, a frame is the boat on which the shippingcontainer is loaded. Gigabit 1The primary Gigabit Ethernet interface. See also, Gigabit Ethernet.Gigabit 2The secondary Gigabit Ethernet interface. See also, Gigabit Ethernet.Gigabit EthernetThe newest version of Ethernet, with data transfer rates of 1 Gigabit (1,000 Mbps).host nameThe unique name that identifies a computer on a network. On the Internet, thehost name is in the form comp.xyz.net. If there is only one Internet site the hostname is the same as the domain name. One computer can have more than onehost name if it hosts more than one Internet site (for example, home.xyz.net andcomp.xyz.net. In this case, comp and home are the host names and xyz.net is thedomain name.IPsecA Layer 3 authentication and encryption protocol. Used to secure VPNs.
Wireless LAN Array234 Glossary of TermsMAC address(Media Access Control Address) A 6-byte hexadecimal address assigned by amanufacturer to a device.Mbps(Megabits per second) A standard measure for data transmission speeds (forexample, the rate at which information travels over the Internet). 1 Mbps denotesone million bits per second.MTU(Maximum Transmission Unit) The largest physical packet size—measured inbytes—that a network can transmit. Any messages larger than the MTU aredivided into smaller packets before being sent. Every network has a differentMTU, which is set by the network administrator. Ideally, you want the MTU to bethe same as the smallest MTU of all the networks between your machine and amessage's final destination. Otherwise, if your messages are larger than one of theintervening MTUs, they will get broken up (fragmented), which slows downtransmission speeds.NTP(Network Time Protocol) An Internet standard protocol (built on top of TCP/IP)that ensures the accurate synchronization (to the millisecond) of computer clocktimes in a network of computers. Running as a continuous background clientprogram on a computer, NTP sends periodic time requests to servers, obtainingserver time stamps and using them to adjust the client's clock.packetData sent over a network is broken down into many small pieces—packets—bythe Transmission Control Protocol layer of TCP/IP. Each packet contains theaddress of its destination as well the data. Packets may be sent on any number ofroutes to their destination, where they are reassembled into the original data. Thissystem is optimal for connectionless networks, such as the Internet, where thereare no fixed connections between two locations.PLCP(Physical Layer Convergence Protocol) Defined by IEEE 802.6, a protocolspecified within the Transmission Convergence layer that defines exactly howcells are formatted within a data stream for a particular type of transmissionfacility.
Wireless LAN ArrayGlossary of Terms 235preamblePreamble (sometimes called a header) is a section of data at the head of a packetthat contains information that the access point and client devices need whensending and receiving packets. PLCP has two structures, a long and a shortpreamble. All compliant 802.11b systems have to support the long preamble. Theshort preamble option is provided in the standard to improve the efficiency of anetwork's throughput when transmitting special data, such as voice, VoIP (Voice-over IP) and streaming video.private keyIn cryptography, one of a pair of keys (one public and one private) that are createdwith the same algorithm for encrypting and decrypting messages and digitalsignatures. The private key is provided only to the requestor and never shared.The requestor uses the private key to decrypt text that has been encrypted withthe public key by someone else.PSK(Pre-Shared Key) A TKIP passphrase used to protect your network traffic in WPA.public keyIn cryptography, one of a pair of keys (one public and one private) that are createdwith the same algorithm for encrypting and decrypting messages and digitalsignatures. The public key is made publicly available for encryption anddecryption.QoS(Quality of Service) QoS can be used to describe any number of ways in which anetwork provider guarantees a service's performance, such as an average orminimum throughput rate.RADIUS(Remote Authentication Dial-In User Service) A client-server security protocol,developed to authenticate, authorize, and account for dial-up users. The RADIUSserver stores user profiles, which include passwords and authorization attributes.RDPS(Remote Distribution Power Supply) A Xirrus proprietary power supply used fordelivering power from a remote source to the Xirrus family of products.
Wireless LAN Array236 Glossary of TermsRemote DC Power System (XP-3100)An optional Xirrus proprietary product that provides distributed DC power tomultiple XS-3900 units, eliminating the need to run dedicated AC power to eachunit and facilitating backup power when connected via a UPS.RSSI(Received Signal Strength Indicator) A measure of the energy observed by anantenna when receiving a signal.SDMA(Spatial Division Multiple Access) A wireless communications mode thatoptimizes the use of the radio spectrum and minimizes cost by taking advantageof the directional properties of antennas. The antennas are highly directional,allowing duplicate frequencies to be used for multiple zones.SNMP(Simple Network Management Protocol) A standard protocol that regulatesnetwork management over the Internet.SNTP(Simple Network Time Protocol) A simplified version of NTP. SNTP can be usedwhen the ultimate performance of the full NTP implementation described in RFC1305 is not needed or justified.SSH(Secure SHell) Developed by SSH Communications Security, Secure Shell is aprogram to log into another computer over a network, to execute commands in aremote machine, and to move files from one machine to another. It providesstrong authentication and secure communications over insecure channels. SSHprotects a network from attacks, such as IP spoofing, IP source routing, and DNSspoofing. Attackers who has managed to take over a network can only force SSHto disconnect—they cannot “play back” the traffic or hijack the connection whenencryption is enabled. When using SSH's slogin (instead of rlogin) the entire loginsession, including transmission of password, is encrypted making it almostimpossible for an outsider to collect passwords.
Wireless LAN ArrayGlossary of Terms 237SSID(Service Set IDentifier) Every wireless network or network subset (such as a BSS)has a unique identifier called an SSID. Every device connected to that part of thenetwork uses the same SSID to identify itself as part of the family—when it wantsto gain access to the network or verify the origin of a data packet it is sending overthe network. In short, it is the unique name shared among all devices in a WLAN.subnet maskA mask used to determine what subnet an IP address belongs to. An IP addresshas two components: (1) the network address and (2) the host address. Forexample, consider the IP address 150.215.017.009. Assuming this is part of a ClassB network, the first two numbers (150.215) represent the Class B network address,and the second two numbers (017.009) identify a particular host on this network.TKIP(Temporal Key Integrity Protocol) Provides improved data encryption byscrambling the keys using a hashing algorithm and, by adding an integrity-checking feature, ensures that the encryption keys haven’t been tampered with.transmit powerThe amount of power used by a radio transceiver to send the signal out. Transmitpower is generally measured in milliwatts, which you can convert to dBm.VLAN(Virtual LAN) A group of devices that communicate as a single network, eventhough they are physically located on different LAN segments. Because VLANsare based on logical rather than physical connections, they are extremely flexible.A device that is moved to another location can remain on the same VLANwithout any hardware reconfiguration.
Wireless LAN Array238 Glossary of TermsVLAN tagging(Virtual LAN tagging) Static port-based VLANs were originally the only way tosegment a network without using routing, but these port-based VLANs couldonly be implemented on a single switch (or switches) cabled together. Routingwas required to transfer traffic between unconnected switches. As an alternativeto routing, some vendors created proprietary schemes for sharing VLANinformation across switches. These methods would only operate on that vendor'sequipment and were not an acceptable way to implement VLANs. With theadoption of the 802.1Q standard, traffic can be confined to VLANs that exist onmultiple switches from different vendors. This interoperability and trafficcontainment across different switches is the result of a switch's ability to use andrecognize 802.1Q tag headers—called VLAN tagging. Switches that implement802.1Q tagging add this tag header to the frame directly after the destination andsource MAC addresses. The tag header indicates:1. That the packet has a tag.2. Whether the packet should have priority over other packets.3. Which VLAN it belongs to, so that the switch can forward or filter itcorrectly.WEP(Wired Equivalent Privacy) An optional IEEE 802.11 function that offers frametransmission privacy similar to a wired network. The Wired Equivalent Privacygenerates secret shared encryption keys that both source and destination stationscan use to alter frame bits to avoid disclosure to eavesdroppers.Wi-Fi AllianceA nonprofit international association formed in 1999 to certify interoperability ofwireless Local Area Network products based on IEEE 802.11 specification. Thegoal of the Wi-Fi Alliance's members is to enhance the user experience throughproduct interoperability.Wireless LAN Array (XS-3900)A Xirrus proprietary high capacity wireless access point utilizing multiplechannels, specifically designed for the Enterprise market.Wireless Management System (XM-3300)A Xirrus proprietary product used for managing large XS-3900 deployments froma centralized Web-based interface.
Wireless LAN ArrayGlossary of Terms 239WPA(Wi-Fi Protected Access) A Wi-Fi Alliance standard that contains a subset of theIEEE 802.11i standard, using TKIP as an encryption method and 802.1X forauthentication.XM-3300The Xirrus Wireless Management System (XM-3300) is a Xirrus proprietaryproduct used for managing large XS-3900 deployments from a centralized Web-based interface.XP-3100The Xirrus Remote DC Power System (XP-3100) is an optional Xirrus proprietaryproduct that provides distributed DC power to multiple XS-3900 units,eliminating the need to run dedicated AC power to each unit and facilitatingbackup power when connected via a UPS.XS-3900The Xirrus Wireless LAN Array (XS-3900) is a high capacity, multi-wireless accesspoint specifically designed for the Enterprise market.
Wireless LAN Array240 Glossary of TermsPage is intentionally blank
Wireless LAN ArrayIndex 241IndexNumerics802.11a 11802.11a/b/g 11802.11b/g 11802.11e 12802.11p 12802.11q 12Aaccess panelreinstalling 204removing 202AES 12authentication 12Bbeam distribution 11benefits 10Cchannelsnon-overlapping 12character restrictions 68chassis cover 207CLITelnet connection 145Command Line Interface 145commandsCLI 145configuration changesapplying 68contact information 228coverageextended 11critical messages 67Ddefault settings 215deploymentease of 12DHCP server 23,85DIMM modulereplacing 206DNS settings 87EEAP-MDS 12EAP-TLS 12EAP-TTLS 12encryption 12event log 143event messages 67express setup 54,73external RADIUS server 802.1x 23Ffactory default settings 215FAQs 222features 10FLASH memoryreplacing 205frequently asked questions 222FTP server 23Gglossary of terms 229Hhelp button 68HyperTerminal 22Iinstallation 21,199installing the MCAP-3616 41
Wireless LAN Array242 Indexmounting the unit 43requirements 21unpacking the unit 40workflow 39installation workflow 39integrated radio modulereplacing 207interfacesWeb 65Internet Explorer 22Kkey features 10keyboard shortcuts 220Llogging 135,143logging in 69MMIC 12mounting the unit 43NNetscape Navigator 22networkinterfaces 79settings 80statistics 84network installation 21,199non-overlapping channels 12Ooverview 6Ppassword 69PEAP 12performance 10power cord 202power outlet 21power supplyreplacing 209power switch 202print button 68product installation 21,199product overview 6product specifications 13,17PuTTy 22QQoS 12Quality of Service 12quick reference guide 211Rradio distribution 10RADIUS server 23,118,120rogue detection 11SSecure Shell 22security 6,12,112management 113RADIUS server 118,120serial port 22services 132servicing the unit 199SNMP 9,137specifications 13,17SSH 22SSIDmanagement 107statistics 84status bar 68system log 135system memory
Wireless LAN ArrayIndex 243replacing 206Ttechnical supportcontact information 228frequently asked questions 222Telnetestablishing a connection 145TKIP 12tools 140Uunpacking the unit 40user interface 65VVoWLAN 12Wwarning messages 67Web interface 65structure and navigation 67WEP 12workflow 39WPA2 6XXirrus Management System 6,9,12,23Xirrus Remote Power System 21,23XMS 6,9,12,23XRPS 21,23XS 3900management 69
Wireless LAN Array244 IndexPage is intentionally blank

Navigation menu