Cisco Systems 102050 802.11 a/g Cardbus Adapter User Manual AIR XX21AG HIG

Cisco Systems Inc 802.11 a/g Cardbus Adapter AIR XX21AG HIG

UserManual.wiki >

Cisco Systems >

102050 User Manual >

User Manual 1

1. User Manual 1
2. User Manual 2

User Manual 1

Corporate HeadquartersCisco Systems, Inc.170 West Tasman DriveSan Jose, CA 95134-1706 USAhttp://www.cisco.comTel: 408 526-4000800 553-NETS (6387)Fax: 408 526-4100Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG)Installation and Configuration GuideSoftware Release 3.0Customer Order Number: Text Part Number: OL-4211-05

iiiCisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05CONTENTSPreface xiAudience xiiPurpose xiiOrganization xiiConventions xiiiRelated Publications xvObtaining Documentation xvCisco.com xvProduct Documentation DVD xvOrdering Documentation xvDocumentation Feedback xviCisco Product Security Overview xviReporting Security Problems in Cisco Products xviiObtaining Technical Assistance xviiCisco Technical Support & Documentation Website xviiSubmitting a Service Request xviiiDefinitions of Service Request Severity xviiiObtaining Additional Publications and Information xixCHAPTER1Product Overview 1-1Introduction to the Client Adapters 1-2Terminology 1-2Hardware Components 1-3Radio 1-3Radio Antenna 1-3LEDs 1-3Software Components 1-4Driver 1-4Client Utilities 1-4Network Configurations Using Client Adapters 1-5Ad Hoc Wireless LAN 1-5Wireless Infrastructure with Workstations Accessing a Wired LAN 1-6

ContentsviiiCisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05APPENDIXATechnical Specifications 25APPENDIXBTranslated Safety Warnings 31Explosive Device Proximity Warning 32Antenna Installation Warning 33Warning for Laptop Users 34APPENDIXCDeclarations of Conformity and Regulatory Information 37Manufacturer’s Federal Communication Commission Declaration of Conformity Statement 38Department of Communications – Canada 39Canadian Compliance Statement 39European Community, Switzerland, Norway, Iceland, and Liechtenstein 39Declaration of Conformity with Regard to the R&TTE Directive 1999/5/EC 39Declaration of Conformity Statement 41Cisco Aironet CB21AG Wireless LAN Client Adapter 41Cisco Aironet PI21AG Wireless LAN Client Adapter 42Declaration of Conformity for RF Exposure 43Guidelines for Operating Cisco Aironet Wireless LAN Client Adapters in Japan 43Japanese Translation 43English Translation 43Administrative Rules for Cisco Aironet Wireless LAN Client Adapters in Taiwan 442.4- and 5-GHz Client Adapters 44Chinese Translation 44English Translation 445-GHz Client Adapters 45Chinese Translation 45English Translation 45Brazil/Anatel Approval 45AIR-CB21AG-W-K9 45AIR-PI21AG-W-K9 46APPENDIXDChannels, Power Levels, and Antenna Gains 47Channels 48IEEE 802.11a 48IEEE 802.11b/g 49Maximum Power Levels and Antenna Gains 50IEEE 802.11a 50IEEE 802.11b 50

ContentsixCisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05IEEE 802.11g 51APPENDIXEConfiguring the Client Adapter through theWindows XP Operating System 53Overview 54Overview of Security Features 54Static WEP Keys 54EAP (with Dynamic WEP Keys) 55WPA 56Configuring the Client Adapter 57Enabling EAP-TLS Authentication 62Enabling PEAP Authentication 65Enabling PEAP (EAP-MSCHAP V2) 66Enabling PEAP (EAP-GTC) 68Associating to an Access Point Using Windows XP 70Viewing the Current Status of Your Client Adapter 70APPENDIXFPerforming a Site Survey 71Overview 72Guidelines 72Additional Information 72Opening the Site Survey Utility 73Selecting the Client Adapter 73Using the Associated AP Status Tab 74Specifying Display Units 74Viewing the Access Point’s Status 75Using the AP Scan List Tab 78Viewing the AP Scan List 79Pausing the AP Scan List 83Viewing AP Details 83Generating an AP Scan Log File 86Viewing an Accumulation of Access Points 88Using the Proximity Beeper 88Configuring the Proximity Beeper 88Enabling the Proximity Beeper 90Using Thresholds 90Configuring Threshold Values 90Enabling Threshold Triggers 93

xiCisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05PrefaceThe preface provides an overview of the Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration Guide (OL-4211-04), references related publications, and explains how to obtain other documentation and technical assistance, if necessary.The following topics are covered in this section:•Audience, page xii•Purpose, page xii•Organization, page xii•Conventions, page xiii•Related Publications, page xv•Obtaining Documentation, page xv•Documentation Feedback, page xvi•Cisco Product Security Overview, page xvi•Obtaining Technical Assistance, page xvii•Obtaining Additional Publications and Information, page xix

xiiiCisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05PrefaceConventions•Appendix A, “Technical Specifications,” lists the physical, radio, power, and regulatory specifications for the client adapters.•Appendix B, “Translated Safety Warnings,” provides translations of client adapter safety warnings in nine languages.•Appendix C, “Declarations of Conformity and Regulatory Information,” provides declarations of conformity and regulatory information for the client adapters.•Appendix D, “Channels, Power Levels, and Antenna Gains,” lists the IEEE 802.11a, b, and g channels supported by the world's regulatory domains as well as the maximum power levels and antenna gains allowed per domain.•Appendix E, “Configuring the Client Adapter through the Windows XP Operating System,”explains how to configure and use your client adapter with the Microsoft Wireless Configuration Manager.•Appendix F, “Performing a Site Survey” shows people who are responsible for conducting a site survey how they can use the site survey utility to determine the best placement for infrastructure devices within a wireless network.ConventionsThis publication uses the following conventions to convey instructions and information:•Commands are in boldface.•Variables are in italics.•Configuration parameters are capitalized.•Notes, cautions, and warnings use the following conventions and symbols:Note Means reader take note. Notes contain helpful suggestions or references to materials not contained in this manual.Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data.WarningThis warning symbol means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standard practices for preventing accidents. (To see translations of the warnings that appear in this publication, refer to the appendix “Translated Safety Warnings.”)WaarschuwingDit waarschuwingssymbool betekent gevaar. U verkeert in een situatie die lichamelijk letsel kan veroorzaken. Voordat u aan enige apparatuur gaat werken, dient u zich bewust te zijn van de bij elektrische schakelingen betrokken risico’s en dient u op de hoogte te zijn van standaard maatregelen om ongelukken te voorkomen. (Voor vertalingen van de waarschuwingen die in deze publicatie verschijnen, kunt u het aanhangsel “Translated Safety Warnings” (Vertalingen van veiligheidsvoorschriften) raadplegen.)

xivCisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05PrefaceConventionsVaroitusTämä varoitusmerkki merkitsee vaaraa. Olet tilanteessa, joka voi johtaa ruumiinvammaan. Ennen kuin työskentelet minkään laitteiston parissa, ota selvää sähkökytkentöihin liittyvistä vaaroista ja tavanomaisista onnettomuuksien ehkäisykeinoista. (Tässä julkaisussa esiintyvien varoitusten käännökset löydät liitteestä "Translated Safety Warnings" (käännetyt turvallisuutta koskevat varoitukset).)AttentionCe symbole d’avertissement indique un danger. Vous vous trouvez dans une situation pouvant entraîner des blessures. Avant d’accéder à cet équipement, soyez conscient des dangers posés par les circuits électriques et familiarisez-vous avec les procédures courantes de prévention des accidents. Pour obtenir les traductions des mises en garde figurant dans cette publication, veuillez consulter l’annexe intitulée « Translated Safety Warnings » (Traduction des avis de sécurité).WarnungDieses Warnsymbol bedeutet Gefahr. Sie befinden sich in einer Situation, die zu einer Körperverletzung führen könnte. Bevor Sie mit der Arbeit an irgendeinem Gerät beginnen, seien Sie sich der mit elektrischen Stromkreisen verbundenen Gefahren und der Standardpraktiken zur Vermeidung von Unfällen bewußt. (Übersetzungen der in dieser Veröffentlichung enthaltenen Warnhinweise finden Sie im Anhang mit dem Titel “Translated Safety Warnings” (Übersetzung der Warnhinweise).)AvvertenzaQuesto simbolo di avvertenza indica un pericolo. Si è in una situazione che può causare infortuni. Prima di lavorare su qualsiasi apparecchiatura, occorre conoscere i pericoli relativi ai circuiti elettrici ed essere al corrente delle pratiche standard per la prevenzione di incidenti. La traduzione delle avvertenze riportate in questa pubblicazione si trova nell’appendice, “Translated Safety Warnings” (Traduzione delle avvertenze di sicurezza).AdvarselDette varselsymbolet betyr fare. Du befinner deg i en situasjon som kan føre til personskade. Før du utfører arbeid på utstyr, må du være oppmerksom på de faremomentene som elektriske kretser innebærer, samt gjøre deg kjent med vanlig praksis når det gjelder å unngå ulykker. (Hvis du vil se oversettelser av de advarslene som finnes i denne publikasjonen, kan du se i vedlegget "Translated Safety Warnings" [Oversatte sikkerhetsadvarsler].)AvisoEste símbolo de aviso indica perigo. Encontra-se numa situação que lhe poderá causar danos fisicos. Antes de começar a trabalhar com qualquer equipamento, familiarize-se com os perigos relacionados com circuitos eléctricos, e com quaisquer práticas comuns que possam prevenir possíveis acidentes. (Para ver as traduções dos avisos que constam desta publicação, consulte o apêndice “Translated Safety Warnings” - “Traduções dos Avisos de Segurança”).¡Advertencia!Este símbolo de aviso significa peligro. Existe riesgo para su integridad física. Antes de manipular cualquier equipo, considerar los riesgos que entraña la corriente eléctrica y familiarizarse con los procedimientos estándar de prevención de accidentes. (Para ver traducciones de las advertencias que aparecen en esta publicación, consultar el apéndice titulado “Translated Safety Warnings.”)Varning!Denna varningssymbol signalerar fara. Du befinner dig i en situation som kan leda till personskada. Innan du utför arbete på någon utrustning måste du vara medveten om farorna med elkretsar och känna till vanligt förfarande för att förebygga skador. (Se förklaringar av de varningar som förekommer i denna publikation i appendix "Translated Safety Warnings" [Översatta säkerhetsvarningar].)

xvCisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05PrefaceRelated PublicationsRelated PublicationsFor more information about Cisco Aironet CB21AG and PI21AG Wireless LAN Client Adapters for Windows, refer to the following publication:•Release Notes for Cisco Aironet 802.11a/b/g Client Adapters (CB21AG and PI21AG) Install WizardFor more information about related Cisco Aironet products, refer to the publications for your infrastructure device. You can find Cisco Aironet technical documentation at this URL:http://www.cisco.com/en/US/products/hw/wireless/tsd_products_support_category_home.htmlObtaining DocumentationCisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.Cisco.comYou can access the most current Cisco documentation at this URL:http://www.cisco.com/techsupportYou can access the Cisco website at this URL:http://www.cisco.comYou can access international Cisco websites at this URL:http://www.cisco.com/public/countries_languages.shtmlProduct Documentation DVDThe Product Documentation DVD is a comprehensive library of technical product documentation on a portable medium. The DVD enables you to access multiple versions of installation, configuration, and command guides for Cisco hardware and software products. With the DVD, you have access to the same HTML documentation that is found on the Cisco website without being connected to the Internet. Certain products also have .PDF versions of the documentation available.The Product Documentation DVD is available as a single unit or as a subscription. Registered Cisco.com users (Cisco direct customers) can order a Product Documentation DVD (product number DOC-DOCDVD= or DOC-DOCDVD=SUB) from Cisco Marketplace at this URL:http://www.cisco.com/go/marketplace/Ordering DocumentationRegistered Cisco.com users may order Cisco documentation at the Product Documentation Store in the Cisco Marketplace at this URL:http://www.cisco.com/go/marketplace/

xviiCisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05PrefaceObtaining Technical AssistanceReporting Security Problems in Cisco ProductsCisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you have identified a vulnerability in a Cisco product, contact PSIRT:•For Emergencies only—security-alert@cisco.comAn emergency is either a condition in which a system is under active attack or a condition for which a severe and urgent security vulnerability should be reported. All other conditions are considered nonemergencies.•For Nonemergencies—psirt@cisco.comIn an emergency, you can also reach PSIRT by telephone:•1 877 228-7302•1 408 525-6532Tip We encourage you to use Pretty Good Privacy (PGP) or a compatible product (for example, GnuPG) to encrypt any sensitive information that you send to Cisco. PSIRT can work with information that has been encrypted with PGP versions 2.x through 9.x.Never use a revoked or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one linked in the Contact Summary section of the Security Vulnerability Policy page at this URL:http://www.cisco.com/en/US/products/products_security_vulnerability_policy.htmlThe link on this page has the current PGP key ID in use.If you do not have or use PGP, contact PSIRT at the aforementioned e-mail addresses or phone numbers before sending any sensitive material to find other means of encrypting the data.Obtaining Technical AssistanceCisco Technical Support provides 24-hour-a-day award-winning technical assistance. The Cisco Technical Support & Documentation website on Cisco.com features extensive online support resources. In addition, if you have a valid Cisco service contract, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not have a valid Cisco service contract, contact your reseller.Cisco Technical Support & Documentation WebsiteThe Cisco Technical Support & Documentation website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, at this URL:http://www.cisco.com/techsupport

xviiiCisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05PrefaceObtaining Technical AssistanceAccess to all tools on the Cisco Technical Support & Documentation website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:http://tools.cisco.com/RPF/register/register.doNote Use the Cisco Product Identification (CPI) tool to locate your product serial number before submitting a web or phone request for service. You can access the CPI tool from the Cisco Technical Support & Documentation website by clicking the Tools & Resources link under Documentation & Tools. Choose Cisco Product Identification Tool from the Alphabetical Index drop-down list, or click the Cisco Product Identification Tool link under Alerts & RMAs. The CPI tool offers three search options: by product ID or model name; by tree view; or for certain products, by copying and pasting show command output. Search results show an illustration of your product with the serial number label location highlighted. Locate the serial number label on your product and record the information before placing a service call.Submitting a Service RequestUsing the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco engineer. The TAC Service Request Tool is located at this URL:http://www.cisco.com/techsupport/servicerequestFor S1 or S2 service requests, or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.To open a service request by telephone, use one of the following numbers:Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)EMEA: +32 2 704 55 55USA: 1 800 553-2447For a complete list of Cisco TAC contacts, go to this URL:http://www.cisco.com/techsupport/contactsDefinitions of Service Request SeverityTo ensure that all service requests are reported in a standard format, Cisco has established severity definitions.Severity 1 (S1)—An existing network is down, or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation. Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operations are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.

xxCisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05PrefaceObtaining Additional Publications and Information•Networking products offered by Cisco Systems, as well as customer support services, can be obtained at this URL:http://www.cisco.com/en/US/products/index.html•Networking Professionals Connection is an interactive website for networking professionals to share questions, suggestions, and information about networking products and technologies with Cisco experts and other networking professionals. Join a discussion at this URL:http://www.cisco.com/discuss/networking•World-class networking training is available from Cisco. You can view current offerings at this URL:http://www.cisco.com/en/US/learning/index.html

CHAPTER1-1Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-051Product OverviewThis chapter describes the Cisco Aironet CB21AG and PI21AG client adapters and illustrates their role in a wireless network.The following topics are covered in this chapter:•Introduction to the Client Adapters, page 1-2•Hardware Components, page 1-3•Software Components, page 1-4•Network Configurations Using Client Adapters, page 1-5

1-2Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 1 Product OverviewIntroduction to the Client AdaptersIntroduction to the Client AdaptersThe Cisco Aironet IEEE 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) are radio modules that provide wireless data communications among fixed, portable, and mobile devices within both wireless and wired network infrastructures. The client adapters are fully compatible when used in devices supporting “plug-and-play” (PnP) technology.The primary function of the client adapters is to transfer data packets through the wireless infrastructure by communicating with other clients or with access points that are connected to a wired LAN. The adapters operate similarly to a standard network product except that radios rather than Ethernet cables make the connection to the wire. No special wireless networking functions are required, and all existing applications that operate over a network can operate using the adapters.This document covers the two client adapters described in Table 1-1.TerminologyThe following terms are used throughout this document:•client adapter—Refers to both types of adapters.•PC-Cardbus card or PCI card—Refers to a specific adapter.•workstation (or station)—Refers to a computing device with an installed client adapter.•infrastructure device—Refers to a device that connects client adapters to a wired LAN, such as an access point, bridge, or base station. Throughout this document, access point is used to represent infrastructure devices in general.Table 1-1 Client Adapter TypesClient Adapter Model Number Description IllustrationPC-Cardbus cardAIR-CB21AG An IEEE 802.11a/b/g-compliant 2.4- and 5-GHz 54-Mbps client adapter card radio module with a Cardbus interface that can be inserted into any device equipped with a 32-bit Cardbus slot. Host devices can include laptops and notebook computers.PCI card AIR-PI21AG An IEEE 802.11a/b/g-compliant 2.4- and 5-GHz 54-Mbps client adapter card radio module that can be inserted into any device equipped with an empty PCI expansion slot, such as a desktop personal computer.9557995580STAT U SACTIVITY

1-3Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 1 Product OverviewHardware ComponentsHardware ComponentsThe client adapters have three major hardware components: a radio, a radio antenna, and two LEDs.RadioThe client adapters contain a dual-band radio that is both IEEE 802.11a and 802.11b/g compliant. The radio uses both direct-sequence spread spectrum (DSSS) technology and orthogonal frequency division multiplexing (OFDM) technology for client applications in the 2.4-GHz Industrial Scientific Medical (ISM) frequency band and OFDM technology in the 5-GHz Unlicensed National Information Infrastructure (UNII) frequency bands. The client adapters operate with other IEEE 802.11a or 802.11b/g-compliant client devices in ad hoc mode or with Cisco Aironet access points and other IEEE 802.11a or 802.11b/g-compliant infrastructure devices in infrastructure mode.Radio AntennaThe type of antenna used depends on your client adapter:•PC-Cardbus cards have an integrated, permanently attached 0-dBi gain, dual-band 2.4/5-GHz diversity antenna. The benefit of the diversity antenna system is improved coverage. The system works by enabling the card to sample and switch between its two antenna ports in order to select the optimum port for receiving data packets. As a result, the card has a better chance of maintaining the radio frequency (RF) connection in areas of interference. The antenna is housed within the section of the card that hangs out of the Cardbus slot when the card is installed.•PCI cards have a 1-dBi gain, dual-band 2.4/5-GHz antenna that is permanently attached by a 6.6-foot (2-meter) cable. A base is provided with the antenna to enable it to be mounted to a wall or to sit upright on a desk or other horizontal surface.LEDsThe client adapters have two LEDs that glow or blink to indicate the status of the adapter or to convey error messages. Refer to Chapter 10 for an interpretation of the LED codes.

1-4Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 1 Product OverviewSoftware ComponentsSoftware ComponentsThe client adapters have two major software components: a driver and client utilities. These components are installed together by running a single executable Install Wizard file that is available from Cisco.com. This file can be run on Windows 2000 or XP and can be used only with CB21AG and PI21AG client adapters.Note Chapter 3 provides instructions on using the Install Wizard to install these software components.DriverThe driver provides an interface between a computer’s operating system and the client adapter, thereby enabling the operating system and the applications it runs to communicate with the adapter. The driver must be installed before the adapter can be used.Client UtilitiesTwo client utilities are available for use with the client adapters: Aironet Desktop Utility (ADU) and Aironet System Tray Utility (ASTU). These utilities are optional applications that interact with the client adapter’s radio to adjust settings and display information.ADU enables you to create configuration profiles for your client adapter and perform user-level diagnostics. Because ADU performs a variety of functions, it is documented by function throughout this manual.ASTU, which is accessible from an icon in the Windows system tray, provides a small subset of the features available through ADU. Specifically, it enables you to view status information about your client adapter and perform basic tasks. Chapter 8 provides detailed information and instructions on using ASTU.Note If your computer is running Windows XP, you can configure your client adapter through the Microsoft Wireless Configuration Manager (or another third-party tool) instead of through ADU. Refer to Appendix E for information. However, ADU is recommended for configuring the client adapter.

1-5Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 1 Product OverviewNetwork Configurations Using Client AdaptersNetwork Configurations Using Client AdaptersClient adapters can be used in a variety of network configurations. In some configurations, access points provide connections to your network or act as repeaters to increase wireless communication range. The maximum communication range is based on how you configure your wireless network.This section describes and illustrates the two most common network configurations:•Ad hoc wireless local area network (LAN)•Wireless infrastructure with workstations accessing a wired LANFor examples of more complex network configurations involving client adapters and access points, refer to the documentation for your access point.Note Refer to Chapter 5 for information on setting the client adapter’s network type.Ad Hoc Wireless LANAn ad hoc (or peer-to-peer) wireless LAN (see Figure 1-1) is the simplest wireless LAN configuration. In a wireless LAN using an ad hoc network configuration, all devices equipped with a client adapter can be linked together and communicate directly with each other. The use of an infrastructure device, such as an access point, is not required.Figure 1-1 Ad Hoc Wireless LAN47520

1-6Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 1 Product OverviewNetwork Configurations Using Client AdaptersWireless Infrastructure with Workstations Accessing a Wired LANA microcellular network can be created by placing two or more access points on a LAN. Figure 1-2shows a microcellular network with workstations accessing a wired LAN through several access points.This configuration is useful with portable or mobile stations because it enables them to be directly connected to the wired network even while moving from one microcell domain to another. This process is transparent, and the connection to the file server or host is maintained without disruption. The mobile station stays connected to an access point as long as it can. However, when the transfer of data packets needs to be retried or beacons are missed, the station automatically searches for and associates to another access point. This process is referred to as seamless roaming.Figure 1-2 Wireless Infrastructure with Workstations Accessing a Wired LANAccess Point(Root Unit)Access Point(Root Unit)65999Wired LAN

CHAPTER2-1Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-052Preparing for InstallationThis chapter provides information that you need to know before installing a client adapter.The following topics are covered in this chapter:•Safety information, page 2-2•Unpacking the Client Adapter, page 2-3•System Requirements, page 2-4•Site Requirements, page 2-5

2-2Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 2 Preparing for InstallationSafety informationSafety informationFollow the guidelines in this section to ensure proper operation and safe use of the client adapter.FCC Safety Compliance StatementThe FCC, with its action in ET Docket 96-8, has adopted a safety standard for human exposure to RF electromagnetic energy emitted by FCC-certified equipment. When used with approved Cisco Aironet antennas, Cisco Aironet products meet the uncontrolled environmental limits found in OET-65 and ANSI C95.1, 1991. Proper operation of this radio device according to the instructions in this publication will result in user exposure substantially below the FCC recommended limits.Safety Guidelines•Do not touch or move the antenna while the unit is transmitting or receiving.•Do not hold any component containing a radio such that the antenna is very close to or touching any exposed parts of the body, especially the face or eyes, while transmitting.•Do not operate the radio or attempt to transmit data unless the antenna is connected; otherwise, the radio may be damaged.•Use in specific environments:–The use of wireless devices in hazardous locations is limited to the constraints posed by the safety directors of such environments.–The use of wireless devices on airplanes is governed by the Federal Aviation Administration (FAA).–The use of wireless devices in hospitals is restricted to the limits set forth by each hospital.WarningsObserve the following warnings when operating the client adapter. The second warning pertains to the PI21AG client adapter, and the third warning pertains to the CB21AG client adapter.WarningDo not operate your wireless network device near unshielded blasting caps or in an explosive environment unless the device has been modified to be especially qualified for such use.WarningIn order to comply with FCC radio frequency (RF) exposure limits, antennas should be located at a minimum of 7.9 inches (20 cm) or more from the body of all persons.

2-4Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 2 Preparing for InstallationSystem RequirementsSystem RequirementsIn addition to the items shipped with the client adapter, you also need the following items in order to install and use the adapter:•One of the following computing devices running Windows 2000 or XP:–Laptop or notebook computer equipped with a 32-bit Cardbus slot–Desktop personal computer equipped with an empty PCI expansion slotNote Cisco recommends a 300-MHz (or greater) processor.•Service Pack 2 for Windows XP•20 MB of free hard disk space (minimum)•128 MB of RAM or greater (recommended)•The appropriate tools for removing your computer’s cover and expansion slot dust cover and for mounting the antenna base (for PCI cards)•If your wireless network uses EAP-TLS or PEAP authentication, Certificate Authority (CA) and user certificates for EAP-TLS authentication or CA certificate for PEAP authentication•If your wireless network uses PEAP (EAP-GTC) authentication with a One-Time Password (OTP) user database:–A hardware token device from OTP vendors or the Secure Computing SofToken program (version 2.1 or later)–Your hardware or software token password•The Microsoft 802.1X supplicant, if your client adapter is installed on a Windows 2000 device and uses PEAP (EAP-MSCHAPV2) with machine authentication•All necessary infrastructure devices (such as access points, servers, gateways, user databases, etc.) must be properly configured for any authentication type you plan to enable on the client.•The following information from your system administrator:–The logical name for your workstation (also referred to as client name)–The protocols necessary to bind to the client adapter, such as TCP/IP–The case-sensitive service set identifier (SSID) for your RF network–If your network setup does not include a DHCP server, the IP address, subnet mask, and default gateway address of your computer–The wired equivalent privacy (WEP) keys of the access points with which your client adapter will communicate, if your wireless network uses static WEP for security–The username and password for your network account–Protected access credentials (PAC) file if your wireless network uses EAP-FAST authentication with manual PAC provisioning

2-5Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 2 Preparing for InstallationSite RequirementsSite RequirementsThis section discusses the site requirements for both infrastructure and client devices.For Infrastructure DevicesBecause of differences in component configuration, placement, and physical environment, every network application is a unique installation. Therefore, before you install any wireless infrastructure devices (such as access points, bridges, and base stations, which connect your client adapters to a wired LAN), a site survey must be performed to determine the optimum placement of these devices to maximize range, coverage, and network performance. Appendix F, which is provided for people who are responsible for conducting a site survey, explains how the site survey utility can be used to determine the best placement for infrastructure devices within a wireless network.Note Infrastructure devices are installed and initially configured prior to client devices.For Client DevicesBecause the client adapter is a radio device, it is susceptible to RF obstructions and common sources of interference that can reduce throughput and range. Follow these guidelines to ensure the best possible performance:•Install the client adapter in an area where large steel structures such as shelving units, bookcases, and filing cabinets will not obstruct radio signals to and from the client adapter.•Install the client adapter away from microwave ovens. Microwave ovens operate on the same frequency as the client adapter and can cause signal interference.

2-6Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 2 Preparing for InstallationSite Requirements

CHAPTER3-1Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-053Installing the Client AdapterThis chapter provides instructions for installing the client adapter.The following topics are covered in this chapter:•Inserting a Client Adapter, page 3-2•Installing the Client Adapter Software, page 3-9•Installing the Intermediate Driver Manually, page 3-20•Installing a Microsoft Hot Fix for Group Policy Delay, page 3-21

3-2Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInserting a Client AdapterInserting a Client AdapterThis section provides instructions for inserting a PC-Cardbus card or PCI card into your computer.Caution These procedures and the physical connections they describe apply generally to conventional Cardbus slots and PCI expansion slots. In cases of custom or nonconventional equipment, be alert to possible differences in Cardbus slot and PCI expansion slot configurations.Inserting a PC-Cardbus CardStep 1 Before you begin, examine the card. One end has a dual-row, 68-pin connector. The card is keyed so it can be inserted only one way into the Cardbus slot.Note The PC-Cardbus slot, if supported, is usually on the left or right side of a laptop computer, depending on the model.Step 2 Turn on your computer and let the operating system boot up completely.Step 3 Hold the card with the Cisco label facing up and insert it into the Cardbus slot, applying just enough pressure to make sure it is fully seated (see Figure 3-1). The green LED lights when the card is inserted properly.Caution Do not force the card into your computer’s Cardbus slot. Forcing it will damage both the card and the slot. If the card does not insert easily, remove the card and reinsert it.Figure 3-1 Inserting a PC-Cardbus Card into a ComputerNote The configuration profiles for PC-Cardbus cards are tied to the slot in which the card is inserted. Therefore, you must always insert your PC-Cardbus card into the same slot or create profiles for both slots. See Chapter 4 for information on creating profiles for your client adapter.32617

3-5Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInserting a Client AdapterFigure 3-3 Inserting a PCI Card into a PCStep 6 Tilt the card to enable the LEDs to slip through the opening in the CPU back panel. See the enlarged view in Figure 3-3.Step 7 Press the card into the empty slot until its connector is firmly seated.Caution Do not force the card into the expansion slot; this could damage both the card and the slot. If the card does not insert easily, remove it and reinsert it.Step 8 Reinstall the screw on the CPU back panel and replace the computer cover.Assembling the AntennaFollow the steps below to assemble the PCI card’s antenna.Step 1 Slide the antenna through the opening in the bottom of the antenna base.Step 2 Position the antenna so its notches are facing the Cisco label on the front of the base. See Figure 3-4.STAT U SACTIVITY95582STATUSACTIVITY2131Antenna cable2LEDs3Card edge connector

3-6Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInserting a Client AdapterFigure 3-4 Inserting the Antenna into Its BaseStep 3 Press the antenna cable into the receptacle on the top of the base as shown in Figure 3-4.Step 4 Press the antenna straight down into the receptacle until it clicks into place.Mounting the AntennaBecause the PCI card is a radio device, it is susceptible to RF obstructions and common sources of interference that can reduce throughput and range. Follow these guidelines to ensure the best possible performance:•Place the PCI card’s antenna in an area where large steel structures such as shelving units, bookcases, and filing cabinets will not obstruct radio signals being transmitted or received.•Place the antenna away from microwave ovens and 2.4- and 5.8-GHz cordless phones. These products can cause signal interference because they operate in the same frequency range as the PCI card.955842131Antenna2Notch3Antenna base

3-7Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInserting a Client AdapterFollow the steps below to position the PCI card’s antenna on a flat horizontal surface or to mount it to a wall.Step 1 Perform one of the following:•If you want to use the antenna on a flat horizontal surface, position the antenna so it is pointing straight up. Then go to Step 7.•If you want to mount the antenna to a wall, go to Step 2.Step 2 Drill two holes in the wall that are 1.09 in. (2.8 cm) apart. Figure 3-5 shows the distance between the mounting holes on the bottom of the antenna base.Figure 3-5 Bottom of Antenna BaseStep 3 Tap the two supplied wall anchors into the holes.Step 4 Drive the two supplied screws into the wall anchors, leaving a small gap between the screw head and the anchor.Step 5 Position the mounting holes on the bottom of the antenna base over the screws (see Figure 3-6) and pull down to lock in place.955971.09 inches

3-8Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInserting a Client AdapterFigure 3-6 Mounting the AntennaStep 6 The antenna rotates 90 degrees from its base. For optimal reception, position the antenna so it is pointing straight up (see Figure 3-7).Figure 3-7 Rotating the AntennaStep 7 Boot up your PC. The green LED lights when the card is inserted properly.Step 8 If the Found New Hardware Wizard window appears, click Cancel.Step 9 Go to the “Installing the Client Adapter Software” section below.9559595596

3-9Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareInstalling the Client Adapter SoftwareThis section describes how to install Cisco Aironet CB21AG or PI21AG client adapter driver and utilities from a single executable file named WinClient-802.11a-b-g-Ins-Wizard-vx.exe, where xrepresents the release number. Follow these steps to install these client adapter software components on a computer running Windows 2000 or XP.Caution Cisco Aironet CB21AG and PI21AG client adapter software is incompatible with other Cisco Aironet client adapter software. The Aironet Desktop Utility (ADU) must be used with CB21AG and PI21AG cards, and the Aironet Client Utility (ACU) must be used with all other Cisco Aironet client adapters.Caution Do not eject your client adapter at any time during the installation process, including during the reboot.Note This procedure is meant to be used the first time the Cisco Aironet CB21AG or PI21AG client adapter software is installed on your computer. If this software is already installed on your computer, follow the instructions in Chapter 9 to upgrade the client adapter software.Note Only one CB21AG or PI21AG client adapter can be installed and used at a time. The software does not support the use of multiple CB21AG or PI21AG cards.Step 1 Make sure the client adapter is inserted into your computer.Step 2 Make sure that you have a Cisco Connection Online (CCO) username and password. Step 3 If you do not have a CCO username and password, go to Cisco’s main page (http://www.cisco.com) and click Register (top). Then, follow the instructions to create a CCO username and password.Step 4 Browse to the following location:http://www.cisco.com/public/sw-center/Step 5 Click Wireless Software.Step 6 Click Wireless LAN Access.Step 7 Click Cisco Wireless LAN Client Adapters.Step 8 Click Cisco Aironet Wireless LAN Client Adapters.Step 9 Perform one of the following steps:•If you are using a PC-Cardbus card, click Cisco Aironet 802.11a/b/g CardBus Wireless LAN Client Adapter (CB21AG).•If you are using a PCI card, click Cisco Aironet 802.11a/b/g PCI Wireless LAN Client Adapter (PI21AG).Step 10 When prompted, enter your CCO username and password, and click OK.Step 11 Click Aironet Client Installation Wizard (Firmware, Driver, Utility).Step 12 Click Windows 2000 or Windows XP.Step 13 Click the link with the greatest release number.

3-10Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareStep 14 Click the Install Wizard file (WinClient-802.11a-b-g-Ins-Wizard-vxx.exe), where xx is the version number.Step 15 If prompted, enter your CCO username and password, and click OK.Step 16 Complete the encryption authorization form, read and accept the terms and conditions of the Software License Agreement, select the file again to download it, and save the file on your computer’s Desktop.Step 17 Use Windows Explorer to find the installer.Step 18 Double-click the installer. The “Starting InstallShield Wizard” message appears followed by the Preparing Setup window (see Figure 3-8) and the Cisco Aironet Installation Program window (see Figure 3-9).Figure 3-8 Preparing Setup Window

3-11Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareFigure 3-9 Cisco Aironet Installation Program WindowStep 19 Click Next. The Setup Type window appears (see Figure 3-10).

3-12Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareFigure 3-10 Setup Type WindowStep 20 Choose one of the following options and click Next:Note To ensure compatibility among software components, Cisco recommends that you install the client utilities and driver.•Install Client Utilities and Driver—Installs the client adapter driver and client utilities.•Install Driver Only—Installs only the client adapter driver. If you choose this option, click Nextand go to Step 32.•Make Driver Installation Diskette(s)—Enables you to create driver installation diskettes that can be used to install drivers using the Windows Device Manager.Note If you choose one of the first two options and a client adapter is not inserted into your computer, the following message appears: “The device may not be present or could have been ejected/unplugged from the system. Insert or reinsert it now.” Insert the client adapter and click OK. If you proceed without the client adapter inserted, the installation continues, but the driver installation is incomplete. You must manually install the driver later using the Update Device Driver Wizard. See the “Manually Installing or Upgrading the Client Adapter Driver” section on page 9-6 for instructions.

$3-13Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareStep 21 When the Install Cisco Aironet Site Survey Utility window appears (see Figure 3-11), check the Install Cisco Aironet Site Survey Utility check box if you want to install a utility that helps you to determine the best placement of infrastructure devices within your wireless network. Click Next.Figure 3-11 Install Cisco Aironet Site Survey Utility WindowNote The site survey utility is a stand-alone application, separate from ADU, that runs from an executable file. If you check the Install Cisco Aironet Site Survey Utility check box, the Install Wizard installs the site survey executable file in the C:\Program Files\Cisco Aironet directory (unless you specify a different directory in Step 23). See Appendix F for instructions on using the utility.Step 22 If a message appears indicating that you are required to restart your computer at the end of the installation process, click Ye s .Note If you click No, you are asked to confirm your decision. If you proceed, the installation process terminates.The Choose Destination Location window appears (see Figure 3-12).$

$3-14Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareFigure 3-12 Choose Destination Location WindowStep 23 Perform one of the following:•If you chose the first option in Step 20, click Next to install the client utility files in the C:\Program Files\Cisco Aironet directory.Note If you want to install the client utilities in a different directory, click Browse, choose a different directory, click OK, and click Next.•If you chose the Make Driver Installation Diskette(s) option in Step 20, insert a floppy disk into your computer and click Next to copy the driver to the diskette. Go to Step 32.Note If you want to copy the driver to a different drive or directory, click Browse, choose a new location, click OK, and click Next.$

3-15Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareStep 24 The Select Program Folder window appears (see Figure 3-13).Figure 3-13 Select Program Folder WindowStep 25 Click Next to add program icons to the Cisco Aironet program folder.Note If you want to specify a different program folder, choose a folder from the Existing Folders list or type a new folder name in the Program Folder field and click Next.

3-16Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareStep 26 If your computer is running Windows 2000, go to Step 32. If your computer is running Windows XP, the window titled IMPORTANT: Please Read! appears (see Figure 3-14).Figure 3-14 IMPORTANT: Please Read! Window

3-17Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareStep 27 Read the information displayed and click Next. The Choose Configuration Tool window appears (see Figure 3-15).Figure 3-15 Choose Configuration Tool WindowStep 28 Choose one of the following options:•Cisco Aironet Desktop Utility (ADU)—Enables you to configure your client adapter using ADU.•Third-Party Tool—Enables you to configure your client adapter using a third-party tool such as the Microsoft Wireless Configuration Manager in Windows XP.Table 3-1 compares Windows XP and ADU client adapter features.Table 3-1 Comparison of Windows XP and ADU Client Adapter Features Feature Windows XP ADUConfiguration parameters Limited ExtensiveCapabilitiesCreate profiles Yes YesEnable/disable radio No Yes

3-18Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareNote If you choose Cisco Aironet Desktop Utility (ADU) above, the Microsoft Wireless Configuration Manager is disabled. If you ever manually enable it, you are prompted to disable it whenever ADU is activated.Step 29 Click Next.Step 30 If you chose Cisco Aironet Desktop Utility (ADU) in Step 28, go to Step 32. If you chose Third-Party Tool, the Enable Tray Icon window appears (see Figure 3-16).Figure 3-16 Enable Tray Icon WindowSecurityStatic WEP Yes YesLEAP or EAP-FAST authentication with dynamic WEPNo YesEAP-TLS or PEAP authentication Yes YesStatus and statisticsStatus window Limited ExtensiveStatistics window (transmit & receive)No YesTable 3-1 Comparison of Windows XP and ADU Client Adapter Features (continued)Feature Windows XP ADU

3-19Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Client Adapter SoftwareStep 31 Check the Enable Cisco Aironet System Tray Utility (ASTU) check box if you want to be able to use ASTU even though you have chosen to configure your client adapter through a third-party tool instead of ADU and click Next.Step 32 When prompted to insert your client adapter, click OK. The Setup Status window appears (see Figure 3-17).Figure 3-17 Setup Status WindowThe installation process begins, and you are notified as each software component is installed.Step 33 When a message appears indicating that your computer needs to be rebooted, click OK and allow your computer to restart.Step 34 If the Windows Found New Hardware Wizard appears after your computer reboots, click Next, allow the wizard to install the software for the client adapter, and click Finish.Step 35 If your network setup does not include a DHCP server and you plan to use TCP/IP, follow these steps for your operating system.•Windows 2000a. Double-click My Computer,Control Panel, and Network and Dial-up Connections.b. Right-click Local Area Connection x (where x represents the number of the connection).c. Click Properties.d. In the Components Checked Are Used by This Connection field, click Internet Protocol (TCP/IP) and Properties.

3-20Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling the Intermediate Driver Manuallye. Choose Use the following IP address and enter the IP address, subnet mask, and default gateway address of your computer (which can be obtained from your system administrator).f. Click OK to close each open window.•Windows XPa. Double-click My Computer,Control Panel, and Network Connections.b. Right-click Wireless Network Connection x (where x represents the number of the connection).c. Click Properties.d. In the This Connection Uses the Following Items field, click Internet Protocol (TCP/IP) and Properties.e. Choose Use the following IP address and enter the IP address, subnet mask, and default gateway address of your computer (which can be obtained from your system administrator).f. Click OK to close each open window.Step 36 If you are prompted to restart your computer, click Ye s .Step 37 Now that your client adapter is properly installed, it is ready to be configured.•If you are planning to configure your client adapter through ADU, go to Chapter 4 to create configuration profiles.•If you are planning to configure your client adapter through the Windows XP Wireless Configuration Manager, go to Appendix E.•If you are planning to configure your client adapter through another third-party tool, refer to the documentation for that application.Note If you want to be able to use ADU’s Group Policy Delay parameter, follow the instructions below to download and install a necessary hot fix before configuring your client adapter.Note If you experienced problems during or after installation, refer to Chapter 10 for troubleshooting information.Installing the Intermediate Driver ManuallyIn some instances, the installation of the CB21AG software might not work as expected because the intermediate driver might not have installed correctly. In this situation, the installer might not detect this condition, and the rest of the software will not function correctly.The CB21AG intermediate driver must be installed manually. To install the intermediate driver manually, follow these steps:Step 1 Insert the client adapter.Step 2 Click on "Network Connections" in the Start > Settings menu in Windows XP, or right click on "My Network Places" in Windows 2000. Find the CB21AGg instance.

$3-21Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling a Microsoft Hot Fix for Group Policy DelayStep 3 Right click on the Cisco CB21AG instance, and left click on Properties.Step 4 Choose the "Install" option and then add a new service.Step 5 Choose the "Have disk" button. Go to \windows\system32 directory and choose wsimd.inf. Step 6 Highlight and select "Wireless Intermediate Driver" and click "ok" button. The wireless IMD is bound to the adapter.Step 7 Reboot system.Installing a Microsoft Hot Fix for Group Policy DelayIf you want to use the Group Policy Delay parameter on the Profile Management (Security) window in ADU, you must install a Microsoft hot fix on computers running Windows 2000. The hot fix is incorporated into Windows XP Service Pack 2 and later.The Group Policy Delay parameter enables you to specify how much time elapses before the Windows logon process starts Group Policy, a Windows feature used by administrators to specify configuration options for groups of users. The objective is to delay the start of Group Policy until wireless network authentication occurs. Follow the steps below to obtain and install the hot fix.Note You must be a registered Cisco customer and log into Cisco.com in order to download the hot fix. If you are unable to access the hot fix from Cisco.com, contact Microsoft Support to obtain it. The Windows 2000 support page provides the contact information:http://support.microsoft.com/default.aspx?scid=fh;EN-US;win2000Step 1 Use your computer’s web browser to access the following URL:http://www.cisco.com/cgi-bin/tablebuild.pl/aironet_hotfixStep 2 If prompted, enter your Cisco Connection Online (CCO) username and password, and click OK.Note To create a CCO username and password, visit http://www.cisco.com.Step 3 Click the hot fix file (userenv.zip).Step 4 Complete the encryption authorization form and click Submit.Step 5 Click the file again to download it.Step 6 Save the file to your computer’s hard drive.Step 7 Find the file using Windows Explorer, double-click it, and extract its files to a folder.Step 8 Reboot your computer and press F8 while your computer is booting.Step 9 When the boot menu appears, select Safe Mode with Command Prompt.Note You must complete this procedure in safe mode; otherwise, system file protection (SFP) will silently restore the original version of the file you are replacing.$

$3-22Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 3 Installing the Client AdapterInstalling a Microsoft Hot Fix for Group Policy DelayStep 10 Copy the hot fix file (userenv.dll) to %systemroot%\System32 and overwrite the existing version of this file.Step 11 Delete the copy of userenv.dll in %systemroot%\System32\DllCache.Step 12 Reboot your computer.$

$4-13Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 4 Using the Profile ManagerImporting and Exporting ProfilesStep 4 Click Export. The Export Profile window appears (see Figure 4-7).Figure 4-7 Export Profile WindowThe profile name appears in the File name box.Step 5 Choose a directory (such as your computer’s floppy disk drive or a location on the network) from the Save in drop-down box.Note The default location is the directory where ADU is installed (such as C:\Program Files\Cisco Aironet).Step 6 Click Save. The profile is exported to the specified location.Step 7 Follow the instructions in the “Importing a Profile” section to import the profile on another computer.$

$5-16Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security Parameters•EAP-FAST—This authentication type (Flexible Authentication via Secure Tunneling) uses a three-phased tunneled authentication process to provide advanced 802.1X EAP mutual authentication.–Phase 0 enables the client to dynamically provision a protected access credential (PAC) when necessary. During this phase, a PAC is generated securely between the user and the network.–Phase 1 uses the PAC to establish a mutually authenticated and secure tunnel between the client and the RADIUS server. RADIUS servers that support EAP-FAST include Cisco Secure ACS version 3.2.3 and later.–Phase 2 performs client authentication in the established tunnel.ADU offers a variety of EAP-FAST configuration options, including how and when a username and password are entered to begin the authentication process and whether automatic or manual PAC provisioning is used.The client adapter uses the username, password, and PAC to perform mutual authentication with the RADIUS server through the access point. The username and password need to be re-entered each time the client adapter is inserted or the Windows device is rebooted unless you configure your adapter to use saved EAP-FAST credentials.PACs are created by Cisco Secure ACS and are identified by an ID. The user obtains his or her own copy of the PAC from the server, and the ID links the PAC to the profile created in ADU. When manual PAC provisioning is enabled, the PAC is manually copied from the server and imported onto the client device. The following rules govern PAC storage:–PACs are stored as encrypted data files in either the global or private store on the user’s computer.•Global PACs can be accessed and used by any user at any logon stage. They are available before or during logon or after the user is logged off if the profile is not configured with the No Network Connection Unless User Is Logged In option.•Private PACs can be accessed and used only by the user who provisioned them or the system administrator.Note Global PACs are stored on C:\Document and Settings\All Users\Application Data\Cisco\cscostore, and private PACs are stored on C:\Document and Settings\user\Application Data\Cisco\cscostore.–If automatic PAC provisioning is enabled and it occurs after the user is logged on, the PAC is stored in the private store of the currently logged-on user. Otherwise, the PAC is stored in the global store. –PAC files can be added or overwritten using the import feature.–PAC files can be removed using the delete feature. They are also deleted when you uninstall the client adapter software.–PAC files are tied to the machine, so they cannot be used if copied to another machine.$

5-17Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersEAP-FAST authentication is designed to support the following user databases over a wireless LAN:–Cisco Secure ACS internal user database–Cisco Secure ACS ODBC user database–Windows NT/2000/2003 domain user database–LDAP user databaseLDAP user databases (such as NDS) support only manual PAC provisioning while the other three user databases support both automatic and manual PAC provisioning.Note PACs that are created by ACS version 3.x.xx are not compatible with ACS version 4.0.xx. Client stations must import new PACs. If you select auto-provisioning, new PACs will automatically be generated and used. However, if you select manual provisioning, you must manually export new PACs to the client stations. If a user wants to authenticate to ACS version 4.0.xx and version 3.x.xx at different times, both PACs must remain on the client station. The ADU is capable of automatically selecting the appropriate PAC. However, if you experiences authentication failures after upgrading the software, delete all the PACs provisioned from the 3.x.xx server. •EAP-TLS—This authentication type uses a dynamic session-based WEP key derived from the client adapter and RADIUS server to encrypt data. It uses a client certificate for authentication.RADIUS servers that support EAP-TLS include Cisco Secure ACS release 3.0 or later and Cisco Access Registrar release 1.8 or later.•PEAP (EAP-GTC)—This PEAP authentication type is designed to support One-Time Password (OTP), Windows NT or 2000 domain, and LDAP user databases over a wireless LAN. It is based on EAP-TLS authentication but uses a password instead of a client certificate for authentication. PEAP (EAP-GTC) uses a dynamic session-based WEP key derived from the client adapter and RADIUS server to encrypt data. If your network uses an OTP user database, PEAP (EAP-GTC) requires you to enter a hardware or software token password to start the EAP authentication process and gain access to the network. If your network uses a Windows NT or 2000 domain user database or an LDAP user database (such as NDS), PEAP (EAP-GTC) requires you to enter your username, password, and domain name in order to start the authentication process.RADIUS servers that support PEAP (EAP-GTC) authentication include Cisco Secure ACS release 3.1 or later.•PEAP (EAP-MSCHAP V2)—This PEAP authentication type is based on EAP-TLS authentication but uses a password or client certificate for authentication. PEAP (EAP-MSCHAP V2) uses a dynamic session-based WEP key derived from the client adapter and RADIUS server to encrypt data.RADIUS servers that support PEAP (EAP-MSCHAP V2) authentication include Cisco Secure ACS release 3.2 or later.When you configure your access point as indicated in Table 5-4 on page 5-22 and configure your client adapter for LEAP, EAP-FAST, EAP-TLS, PEAP (EAP-GTC), or PEAP (EAP-MSCHAP V2), authentication to the network occurs in the following sequence:1. The client associates to an access point and begins the authentication process.Note The client does not gain full access to the network until authentication between the client and the RADIUS server is successful.

5-18Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security Parameters2. Communicating through the access point, the client and RADIUS server complete the authentication process, with the password (LEAP and PEAP), PAC (EAP-FAST), or certificate (EAP-TLS and PEAP) being the shared secret for authentication. The password and PAC are never transmitted during the process.3. If authentication is successful, the client and RADIUS server derive a dynamic, session-based WEP key that is unique to the client.

5-19Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security Parameters4. The RADIUS server transmits the key to the access point using a secure channel on the wired LAN.5. For the length of a session, or time period, the access point and the client use this key to encrypt or decrypt all unicast packets (and broadcast packets if the access point is set up to do so) that travel between them.Refer to the following pages for instructions on enabling these EAP types:•LEAP, page 5-29•EAP-FAST, page 5-34•EAP-TLS, PEAP (EAP-GTC), or PEAP (EAP-MSCHAP V2), page 5-44Note Refer to the IEEE 802.11 Standard for more information on 802.1X authentication and to the following URL for additional information on RADIUS servers:http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca7ab.htmlWPA and WPA2Wi-Fi Protected Access (WPA) and WPA2 are standards-based security solutions from the Wi-Fi Alliance that provide data protection and access control for wireless LAN systems. WPA is compatible with the IEEE 802.11i standard but was implemented prior to the standard’s ratification; WPA2 is the Wi-Fi Alliance’s implementation of the ratified IEEE 802.11i standard.WPA uses Temporal Key Integrity Protocol (TKIP) and message integrity check (MIC) for data protection while WPA2 uses the stronger Advanced Encryption Standard encryption algorithm using Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). Both WPA and WPA2 use 802.1X for authenticated key management.Both WPA and WPA2 support two mutually exclusive key management types: WPA/WPA2 and WPA/WPA2 passphrase (also known as WPA pre-shared key or WPA-PSK). Using WPA or WPA2, clients and the authentication server authenticate to each other using an EAP authentication method, and the client and server generate a pairwise master key (PMK). The server generates the PMK dynamically and passes it to the access point. Using WPA or WPA2 passphrase, however, you configure a passphrase (or pre-shared key) on both the client and the access point, and that passphrase is used as the PMK.Refer to the following pages for instructions on enabling these WPA variations:•WPA/WPA2 passphrase, page 5-28•LEAP with WPA/WPA2, page 5-29•EAP-FAST with WPA/WPA2, page 5-34•EAP-TLS with WPA/WPA2, page 5-45•PEAP (EAP-GTC) with WPA/WPA2, page 5-48•PEAP (EAP-MSCHAP V2) with WPA/WPA2, page 5-52Note WPA must also be enabled on the access point. To use WPA, access points must use Cisco IOS Release 12.2(11)JA or later. To use WPA2, access points must use Cisco IOS Release 12.3(2)JA or later. Refer to the documentation for your access point for instructions on enabling this feature.

5-22Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersSynchronizing Security FeaturesIn order to use any of the security features discussed in this section, both your client adapter and the access point to which it will associate must be set appropriately. Table 5-4 indicates the client and access point settings required for each security feature. This chapter provides specific instructions for enabling the security features on your client adapter. Refer to the documentation for your access point for instructions on enabling any of these features on the access point.Table 5-4 Client and Access Point Security SettingsSecurity Feature Client Setting Access Point SettingStatic WEP with open authenticationChoose Open authentication and Pre-Shared Key (Static WEP) and create a WEP keySet up and enable WEP and enable Open Authentication for the SSIDStatic WEP with shared key authenticationChoose Shared authentication and Pre-Shared Key (Static WEP) and create a WEP keySet up and enable WEP and enable Shared Key Authentication for the SSIDWPA or WPA2 passphrase(or WPA or WPA2 pre-shared key)Choose WPA/WPA2 Passphrase and enter the passphraseChoose a cipher suite, enable Open Authentication and WPA for the SSID, and enter a WPA pre-shared keyNote To allow both WPA and non-WPA clients to use the SSID, enable optional WPA.LEAP authentication Choose 802.1x and LEAP; then set LEAP settingsSet up and enable WEP and enable Network-EAP Authentication for the SSIDLEAP authentication with WPA or WPA2Choose WPA/WPA2/CCKM and LEAP; then set LEAP settingsFor WPA, choose a cipher suite that includes TKIP and enable Network-EAP and Open with EAP Authentication and WPA for the SSIDFor WPA2, choose a cipher suite that includes AES-CCMP and enable Network-EAP and Open with EAP Authentication and WPA for the SSIDNote To allow both WPA and non-WPA clients to use the SSID, enable optional WPA.

5-23Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersEAP-FAST authentication Choose 802.1x and EAP-FAST, set EAP-FAST settings, and enable automatic provisioning or import a PAC fileSet up and enable WEP and enable both Network-EAP and Open with EAP Authentication for the SSIDEAP-FAST authentication with WPA or WPA2Choose WPA/WPA2/CCKM and EAP-FAST, set EAP-FAST settings, and enable automatic provisioning or import a PAC fileFor WPA, choose a cipher suite that includes TKIP and enable both Network-EAP and Open with EAP Authentication as well as WPA for the SSIDFor WPA2, choose a cipher suite that includes AES-CCMP and enable both Network-EAP and Open with EAP Authentication as well as WPA for the SSIDNote To allow both WPA and non-WPA clients to use the SSID, enable optional WPA.EAP-TLS authenticationIf using ADU to configure cardChoose 802.1x and EAP-TLS; then set EAP-TLS settingsSet up and enable WEP and enable Open with EAP Authentication for the SSIDIf using Windows XP to configure cardChoose Enable network access control using IEEE 802.1X and Smart Card or other Certificate as the EAP TypeSet up and enable WEP and enable Open with EAP Authentication for the SSIDEAP-TLS authentication with WPA or WPA2If using ADU to configure cardChoose WPA/WPA2/CCKM and EAP-TLS; then set EAP-TLS settingsFor WPA, choose a cipher suite that includes TKIP; then enable WPA and Open with EAP Authentication for the SSIDFor WPA2, choose a cipher suite that includes AES-CCMP; then enable WPA and Open with EAP Authentication for the SSIDNote To allow both WPA and non-WPA clients to use the SSID, enable optional WPA.Table 5-4 Client and Access Point Security Settings (continued)Security Feature Client Setting Access Point Setting

5-24Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersIf using Windows XP to configure cardEnable WPA and choose Enable network access control using IEEE 802.1X and Smart Card or other Certificate as the EAP TypeNote WPA2 is not yet available in the Microsoft Wireless Configuration Manager in Windows XP.For WPA, choose a cipher suite that includes TKIP; then enable WPA and Open with EAP Authentication for the SSIDNote To allow both WPA and non-WPA clients to use the SSID, enable optional WPA.PEAP authenticationIf using ADU to configure cardChoose 802.1x and PEAP (EAP-GTC) or PEAP (EAP-MSCHAP V2); then set PEAP settings Set up and enable WEP and enable Open with EAP Authentication for the SSIDIf using Windows XP to configure cardChoose Enable network access control using IEEE 802.1X and PEAP as the EAP TypeSet up and enable WEP and enable Open with EAP Authentication for the SSIDPEAP authentication with WPA or WPA2If using ADU to configure cardChoose WPA/WPA2/CCKM and PEAP (EAP-GTC) or PEAP (EAP-MSCHAP V2); then set PEAP settingsFor WPA, choose a cipher suite that includes TKIP; then enable WPA and Open with EAP Authentication for the SSIDFor WPA2, choose a cipher suite that includes AES-CCMP; then enable WPA and Open with EAP Authentication for the SSIDNote To allow both WPA and non-WPA clients to use the SSID, enable optional WPA.If using Windows XP to configure cardEnable WPA and choose Enable network access control using IEEE 802.1X and PEAP as the EAP TypeNote WPA2 is not yet available in the Microsoft Wireless Configuration Manager in Windows XP.For WPA, choose a cipher suite that includes TKIP; then enable WPA and Open with EAP Authentication for the SSIDNote To allow both WPA and non-WPA clients to use the SSID, enable optional WPA.Table 5-4 Client and Access Point Security Settings (continued)Security Feature Client Setting Access Point Setting

5-25Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersCCKM fast secure roaming Choose WPA/WPA2/CCKM and LEAP, EAP-FAST, EAP-TLS, PEAP (EAP-GTC), or PEAP (EAP MSCHAP V2); then set the EAP authentication settingsNote If you want to enable CCKM, you must choose WPA/WPA2/CCKM, regardless of whether you want the client adapter to use WPA or WPA2. The configuration of the access point to which your client adapter associates determines whether CCKM will be used with 802.1x, WPA, or WPA2.Use Cisco IOS Release 12.2(11)JA or later, choose a cipher suite that is compatible with CCKM, enable both Network-EAP and Open with EAP Authentication and CCKM for the SSID, and configure for participation in wireless domain services (WDS)Note To allow both 802.1X clients and non-802.1X clients to use the SSID, enable optional CCKM.Reporting access points that fail LEAP authenticationNo settings required; automatically enabledNo settings required; automatically enabled in the firmware versions listed on page 5-20.MIC No settings required; automatically enabledSet up and enable WEP with full encryption, set MIC to MMH or check the Enable MIC check box, and set Use Aironet Extensions to YesTKIP No settings required; automatically enabledSet up and enable WEP, set TKIP to Cisco or check the Enable Per Packet Keying check box, and set Use Aironet Extensions to YesBroadcast key rotation Enable LEAP, EAP-FAST, EAP-TLS, PEAP (EAP-GTC), or PEAP (EAP-MSCHAP V2)Set up and enable WEP and set Broadcast WEP Key Rotation Interval to any value other than zero (0)Table 5-4 Client and Access Point Security Settings (continued)Security Feature Client Setting Access Point Setting

5-30Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersStep 2 Click Configure. The Configure LEAP window appears (see Figure 5-7).Figure 5-7 Configure LEAP WindowStep 3 Choose one of the following LEAP username and password setting options:•Use Temporary User Name and Password—Requires you to enter the LEAP username and password each time the computer reboots in order to authenticate and gain access to the network, unless you choose Use Windows User Name and Password.•Use Saved User Name and Password—Does not require you to enter a LEAP username and password each time the computer reboots. Authentication occurs automatically as needed using a saved username and password (which are registered with the RADIUS server).

5-31Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersStep 4 Perform one of the following:•If you chose Use Temporary User Name and Password in Step 3, choose one of the following options:–Use Windows User Name and Password—Causes your Windows username and password to also serve as your LEAP username and password, giving you only one set of credentials to remember. After you log in, the LEAP authentication process begins automatically. This option is the default setting.–Automatically Prompt for User Name and Password—Requires you to enter a separate LEAP username and password (which are registered with the RADIUS server) in addition to your regular Windows login in order to start the LEAP authentication process.–Manually Prompt for User Name and Password—Requires you to manually invoke the LEAP authentication process as needed using the Manual Login option in the Action drop-down menu or ASTU. You are not prompted to enter a LEAP username and password during the Windows login. This option might be used to support a software token one-time password system or other systems that require additional software that is not available at login.•If you chose Use Saved User Name and Password in Step 3, follow these steps:a. Enter a username and password in the appropriate fields.b. Re-enter the password in the Confirm Password field.c. If you wish to specify a domain name that will be passed to the RADIUS server along with your username, enter it in the Domain field.Step 5 If you chose Automatically Prompt for User Name and Password or Manually Prompt for User Name and Password in Step 4, perform one of the following:•Check the Always Resume the Secure Session check box at the top of the window if you want the LEAP supplicant to always attempt to resume the previous session without prompting you to re-enter your credentials whenever the client adapter becomes disassociated. The session resumes after the client temporarily loses connection to the access point (such as by roaming in and out of range) or wakes up from suspend or hibernate mode. This is the default setting.•Uncheck the Always Resume the Secure Session check box if you want to be prompted to re-enter your LEAP username and password whenever your client adapter temporarily loses association by roaming out of range or wakes up from suspend or hibernate mode. Note Checking this check box gives you the convenience of not having to re-enter your username and password when your client adapter experiences momentary losses of association. However, if you leave your device unattended during the period of time when the LEAP session can be resumed without re-entering user credentials, be aware that someone can resume your LEAP session and access the network.Note The Always Resume the Secure Session check box is disabled if you chose Use Windows User Name and Password or Use Saved User Name and Password in Step 4.

5-35Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersStep 2 Click Configure. The Configure EAP-FAST window appears (see Figure 5-8).Figure 5-8 Configure EAP-FAST WindowStep 3 Choose an authentication method from the EAP-FAST Authentication Method drop-down list and click Configure.

5-36Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersStep 4 If you chose GTC Token/Password in Step 3, do the following in the Configure GTC Token/Password window (see Figure 5-9):Figure 5-9 Configure GTC Token/Password Window1. Check the Always Resume the Secure Session check box at the top of the window if you want the EAP-FAST supplicant to always attempt to resume the previous session without prompting you to re-enter your credentials whenever the client adapter becomes disassociated. The session resumes after the client temporarily loses connection to the access point (such as by roaming in and out of coverage) or wakes up from suspend or hibernate mode. This is the default setting.Uncheck the Always Resume the Secure Session check box if you want to be prompted to re-enter your EAP-FAST username and password whenever your client adapter temporarily loses association by roaming out of coverage or wakes up from suspend or hibernate mode. Note Checking this check box gives you the convenience of not having to re-enter your username and password when your client adapter experiences momentary losses of association. However, if you leave your device unattended during the period of time when the EAP-FAST session can be resumed without re-entering user credentials, be aware that someone can resume your EAP-FAST session and access the network.Note The Always Resume the Secure Session check box is disabled if you chose Static Password.2. Check the Validate Server Identity check box to force the system to validate the identity of the server as an added level of security.If you uncheck this box, only user credentials will be validated.

5-37Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security Parameters3. To configure the remaining options in this window, refer to “Enabling PEAP (EAP-GTC)” on page 5-48.4. Click OK to save your settings and return to the Configure EAP-FAST window.Step 5 If you chose MSCHAPv2 User Name and Password in Step 3, do the following in the Configure MSCHAPv2 User Name and Password window (see Figure 5-10):Figure 5-10 Configure MSCHAPv2 User Name and Password Window1. Check the Always Resume the Secure Session check box at the top of the window if you want the EAP-FAST supplicant to always attempt to resume the previous session without prompting you to re-enter your credentials whenever the client adapter becomes disassociated. The session resumes after the client temporarily loses connection to the access point (such as by roaming in and out of coverage) or wakes up from suspend or hibernate mode. This is the default setting.Uncheck the Always Resume the Secure Session check box if you want to be prompted to re-enter your EAP-FAST username and password whenever your client adapter temporarily loses association by roaming out of coverage or wakes up from suspend or hibernate mode. Note To check or uncheck the Always Resume the Secure Session check box, you must first choose Automatically Prompt for User Name and Password or Manually Prompt for User Name and Password under Use Temporary User Name and Password.2. Check the Validate Server Identity check box to force the system to validate the identity of the server as an added level of security.

5-38Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security Parameters3. Choose a certificate authority from which the server certificate was downloaded in the Trusted Root Certification Authorities drop-down box, or, if applicable, choose <Any>.4. To use a temporary username and password, choose Use Temporary User Name and Password.This option requires you to enter the EAP-FAST username and password each time the computer reboots in order to authenticate and gain access to the network, unless you choose Use Windows User Name and Password.Choose one of the following options under Use Temporary User Name and Password:–Use Windows User Name and Password—Causes your Windows username and password to also serve as your EAP-FAST username and password, giving you only one set of credentials to remember. After you log in, the authentication process begins automatically. This option is the default setting.–Automatically Prompt for User Name and Password—Requires you to enter a separate EAP-FAST username and password (which are registered with the RADIUS server) in addition to your regular Windows login in order to start the authentication process.–Manually Prompt for User Name and Password—Requires you to manually invoke the EAP-FAST authentication process as needed using the Manual Login option in the Action drop-down menu or ASTU. You are not prompted to enter an EAP-FAST username and password during the Windows login. This option might be used to support a software token one-time password system or other systems that require additional software that is not available at login.5. To use a saved username and password, choose Use Saved User Name and Password.This option does not require you to enter an EAP-FAST username and password each time the computer reboots. Authentication occurs automatically as needed using a saved username and password (which are registered with the RADIUS server).Follow these steps to specify the username and password to use for EAP-FAST authentication:a. Enter a username and password in the appropriate fields.b. Re-enter the password in the Confirm Password field.c. If you wish to specify a domain name that will be passed to the RADIUS server along with your username, enter it in the Domain field.6. If you work in an environment with multiple domains and therefore want your Windows login domain to be passed to the RADIUS server along with your username, check the Include Windows Logon Domain with User Name check box. The default setting is checked.Note If you chose to use a saved username and password but do not check the Include Windows Logon Domain with User Name check box, the saved domain name is not passed to the RADIUS server.7. To specify a server or domain name and a login name to use for authenticating user credentials, click Advanced and follow the instructions in “Configuring Advanced Settings” on page 5-58.8. Click OK to save your settings and return to the Configure EAP-FAST window.

$5-40Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersStep 8 If necessary, follow these steps to import or modify the grouping of PAC files:a. Click Manage. The Manage PACs window appears (see Figure 5-12).Figure 5-12 Manage PACs Windowb. To create a new group, click New Group.c. To move a PAC from one group to another, just drag it to the destination group. d. Click Import. The Import EAP-FAST PAC File window appears (see Figure 5-13).Figure 5-13 Import EAP-FAST PAC File Windowe. Find the location of the PAC file (*.pac) in the Look in box. The default location is C:\Program Files\Cisco Aironet.Note The filename and extension of a PAC file is determined by the PAC authority that issues it, but the standard file extension is pac.$

5-43Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersNote This parameter is available only if the 802.1x security option is selected.Note For security reasons, Cisco recommends that WEP-enabled and WEP-disabled clients not be allowed in the same cell because broadcast packets are sent unencrypted, even to clients running WEP. However, you can enable VLANs on the access point to separate WEP-enabled and WEP-disabled clients.Step 15 If you want to limit the amount of time that is spent searching for a domain controller during the authentication process, check the Limit Time for Finding Domain Controller To check box. Then in the edit box, enter the amount of time (in seconds) to which you want to limit the search for the domain controller. A timeout value of 0 causes the authentication process to bypass the “Finding Domain Controller” step altogether.Range of timeout value: 0 to 300 secondsDefault: Unchecked; 0 secondsNote When the “Finding Domain Controller” step is reached during the authentication process, a timer starts based on the number of seconds you specified for finding the domain controller. If either this value or the EAP-FAST authentication timeout value expires before the domain controller is found, the authentication process times out. For example, if the authentication timeout value is 60 seconds and the finding domain controller timeout value is 10 seconds, the client adapter has up to 60 seconds to complete the entire authentication process, up to 10 seconds of which is allocated for finding the domain controller. However, if authentication happens quickly, the software might reach the “Finding Domain Controller” step in 5 seconds. If the domain controller could not be found within 10 seconds, the authentication process would timeout in just 15 seconds.Note The finding domain controller timeout value can never extend the authentication process beyond the EAP-FAST authentication timeout value, even if the finding domain controller timeout value is greater than the EAP-FAST authentication timeout value.Note If you require domain services such as login scripts and roaming desktops, Cisco recommends that you uncheck the Limit Time for Finding Domain Controller To check box.Note Regardless of whether the check box is checked or unchecked, the “Finding Domain Controller” step is bypassed once you are logged into Windows or if you log into the local machine and not into a domain.

5-46Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersStep 2 Click Configure. The Configure EAP-TLS window appears (see Figure 5-15).Figure 5-15 Configure EAP-TLS WindowStep 3 Check the Use Machine Information for Domain Logon check box if you want the client to attempt to log into a domain using machine authentication with a machine certificate and machine credentials rather than user authentication. Doing so enables your computer to connect to the network prior to user logon. The default setting is unchecked.Note If you do not check the Use Machine Information for Domain Logon check box, machine authentication is not performed. Authentication does not occur until you log on.Step 4 If you checked the Use Machine Information For Domain Logon check box in the previous step, the Always Do User Authentication check box at the bottom of the window becomes active. Perform one of the following:•Check the Always Do User Authentication check box if you want the client to switch from using machine authentication to using user authentication after you log on using your username and password. This is the default setting.•Uncheck the Always Do User Authentication check box if you want the client to continue to use machine authentication after your computer logs into the domain.Step 5 Check the Validate Server Identity check box to force the system to validate the identity of the server as an added level of security. If you uncheck this box, only user credentials will be validated.Step 6 Choose the certificate authority from which the server certificate was downloaded in the Trusted Root Certification Authorities drop-down box.Step 7 Choose your server certificate in the Select a Certificate drop-down box.

5-49Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersStep 2 Click Configure. The Configure PEAP (EAP-GTC) window appears (see Figure 5-16).Figure 5-16 Configure PEAP (EAP-GTC) WindowStep 3 Check the Use Machine Information for Domain Logon check box if you want the client to attempt to log into a domain using machine authentication with user credentials rather than user authentication. Doing so enables your computer to connect to the network prior to user logon. The default setting is checked.Note If you do not check the Use Machine Information for Domain Logon check box, machine authentication is not performed. Authentication does not occur until you log on.Step 4 Check the Validate Server Identity check box to force the system to validate the identity of the server as an added level of security. If you uncheck this box, only user credentials will be validated.Step 5 Choose the certificate authority from which the server certificate was downloaded in the Trusted Root Certification Authorities drop-down box, or, if applicable, choose <Any>.Step 6 Choose either Token or Static Password, depending on your user database.

5-50Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersNote If you choose Token, you must use a hardware token device or the Secure Computing SofToken program (release 2.1 or later) to obtain the one-time password and enter the password when prompted during the authentication process. Secure Computing PremierAccess release 3.1.1 or later is the only supported token server.Step 7 If you chose Token in Step 6, perform one of the following:•Check the Always Resume the Secure Session check box at the top of the window if you want the PEAP (EAP-GTC) supplicant to always attempt to resume the previous session without prompting you to re-enter your credentials whenever the client adapter becomes disassociated. The session resumes after the client temporarily loses connection to the access point (such as by roaming in and out of coverage) or wakes up from suspend or hibernate mode. This is the default setting.•Uncheck the Always Resume the Secure Session check box if you want to be prompted to re-enter your PEAP (EAP-GTC) username and password whenever your client adapter temporarily loses association by roaming out of coverage or wakes up from suspend or hibernate mode. Note Checking this check box gives you the convenience of not having to re-enter your username and password when your client adapter experiences momentary losses of association. However, if you leave your device unattended during the period of time when the PEAP (EAP-GTC) session can be resumed without re-entering user credentials, be aware that someone can resume your PEAP (EAP-GTC) session and access the network.Note The Always Resume the Secure Session check box is disabled if you chose Static Password in Step 6.Step 8 Perform one of the following to specify the username that will be used for inner PEAP tunnel authentication:•If you want your Windows username to also serve as your PEAP username, check the Use Windows User Name check box. This option gives you only one username to remember.Note If you chose the Static Password option in Step 6, the check box reads Use Windows User Name and Password.•If you want to enter a separate PEAP username (which is registered with the RADIUS server) in addition to your regular Windows username in order to start the PEAP authentication process, enter your PEAP username in the User Name field.Note Your Windows username is filled in automatically. Simply delete your Windows username and enter your separate PEAP username.Step 9 If you entered a PEAP username in the previous step and chose the Static Password option in Step 6,enter your PEAP authentication password (which is registered with the RADIUS server) in both the Password and Confirm Password fields.Step 10 If the Use Windows User Name and Password check box is unchecked and you want to implement added security by further refining the network certificate that will be accepted and controlling the string used to set up the outer PEAP tunnel, follow the steps in “Configuring Advanced Settings” on page 5-58.

5-53Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Security ParametersFigure 5-17 Configure PEAP (EAP-MSCHAP V2) WindowStep 3 Check the Use Machine Information for Domain Logon check box if you want the client to attempt to log into a domain using machine authentication with user credentials rather than user authentication. Doing so enables your computer to connect to the network prior to user logon. The default setting is checked.Note If you do not check the Use Machine Information for Domain Logon check box, machine authentication is not performed. Authentication does not occur until you log on.Step 4 Check the Validate Server Identity check box to force the system to validate the identity of the server as an added level of security. If you uncheck this box, only user credentials will be validated.Step 5 Choose the certificate authority from which the server certificate was downloaded in the Trusted Root Certification Authorities drop-down box, or, if applicable, choose <Any>.Step 6 Perform one of the following to specify how you want to establish a network connection:•If you want to connect using a username and password, choose User Name and Password and go to Step 7.•If you want to connect using a user certificate installed on your computer, choose Certificate, select a certificate from the drop-down box, and go to Step 8.

5-59Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterEnabling Wi-Fi MultimediaEnabling Wi-Fi MultimediaWi-Fi Multimedia (WMM) is a component of the IEEE 802.11e wireless LAN standard for quality of service (QoS). It specifically supports priority tagging and queuing. QoS is an access point feature that enables networking professionals to provide preferential treatment to certain traffic at the expense of other traffic. Without QoS, the access point offers best-effort service to each packet, regardless of the packet contents or size. Implementing QoS in a wireless LAN makes network performance more predictable and bandwidth usage more effective.Cisco recommends that you enable WMM if your computer is running a time-sensitive application for QoS-aware clients such as voice or video (for example, Cisco IP SoftPhone).QoS and WMM must be enabled on the access point to which the client will associate. These features are supported on the access point in Cisco IOS Release 12.3(2)JA or later. Refer to the documentation for your access point for instructions on enabling these features.WMM is supported automatically in the client adapter software. However, you must enable the Windows QoS Packet Scheduler to ensure WMM support. Follow the instructions below to enable the QoS Packet Scheduler on Windows 2000 or XP.Note The QoS Packet Scheduler must be installed before you can enable it. It comes preinstalled on Windows XP; however, you must install it on Windows 2000.Enabling the QoS Packet Scheduler on Windows 2000Follow these steps to enable the QoS Packet Scheduler on a computer running Windows 2000.Step 1 Double-click My Computer,Control Panel, and Network and Dial-up Connections.Step 2 Right-click your wireless network connection.Step 3 Click Properties. The Wireless Cisco Connection Properties window appears (see Figure 5-20).

5-60Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterEnabling Wi-Fi MultimediaFigure 5-20 Wireless Cisco Connection Properties WindowStep 4 If the QoS Packet Scheduler is already installed, it is included in the list of components that this connection uses. If it appears in the list, go to Step 8. Otherwise, go to the next step to install it.Step 5 Click Install. The Select Network Component Type window appears (see Figure 5-21).

5-61Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterEnabling Wi-Fi MultimediaFigure 5-21 Select Network Component Type WindowStep 6 Choose Service and click Add. The Select Network Service window appears (see Figure 5-22).Figure 5-22 Select Network Service WindowStep 7 Click QoS Packet Scheduler and OK. The Wireless Cisco Connection Properties window reappears, and the QoS Packet Scheduler is included in the list of connections.Step 8 Check the QoS Packet Scheduler check box if it is not checked.Step 9 Click OK.

5-62Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterEnabling Wi-Fi MultimediaEnabling the QoS Packet Scheduler on Windows XPFollow these steps to enable the QoS Packet Scheduler on a computer running Windows XP.Step 1 Click Control Panel.Step 2 Double-click Network Connections.Step 3 Right-click your wireless network connection.Step 4 Click Properties. The Wireless Network Connection Properties window appears (see Figure 5-23).Figure 5-23 Wireless Network Connection Properties WindowStep 5 Check the QoS Packet Scheduler check box, which appears in the list of items that this connection uses.Step 6 Click OK.

5-63Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Roaming Parameters in the Windows Control PanelSetting Roaming Parameters in the Windows Control PanelThe Cisco Aironet 802.11a/b/g Wireless Adapter Properties window (see Figure 5-24) in the Windows Control Panel enables you to set two parameters that regulate the client adapter’s roaming capabilities.Figure 5-24 Cisco Aironet 802.11a/b/g Wireless Adapter Properties WindowFollow these steps to access the roaming parameters.Step 1 Double-click My Computer,Control Panel, and System.Step 2 Click the Hardware tab and Device Manager.Step 3 Double-click Network Adapters.Step 4 Right-click Cisco Aironet 802.11a/b/g Wireless Adapter.Step 5 Click Properties and the Advanced tab. The roaming parameters appear in the Property list. Table 5-5lists and describes the client adapter’s roaming parameters. Follow the instructions in the table to change the parameters.

5-64Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterSetting Roaming Parameters in the Windows Control PanelThe default configuration of the client adapter software is optimized for high throughput and the lowest power consumption. However, in some environments, this configuration can cause the client adapter to unnecessarily stay with the currently associated access point longer than necessary.If your application requires a faster roaming response, configure the BSS Aging Interval and Scan Valid Interval parameters as follows:•Set the BSS Aging Interval parameter to 20•Set the Scan Valid Interval parameter to 20Note If you are using client software prior to 2.7.0.2, you will not be able to set the BSS Aging Interval parameter to 20. In that case, set it to 30.Table 5-5 Roaming Parameters (in the Windows Control Panel)Parameter DescriptionBSS Aging Interval The amount of time (in seconds) that the client keeps an access point in its roaming scanlist after it can no longer communicate to that device. The higher the value, the greater the number of access points to which the client may roam.Range: 20 to 300 seconds (in 10-second increments)Default: 120 secondsNote Cisco recommends that you set the BSS Aging Interval to twice the value of the Scan Valid Interval. For example, if the Scan Valid Interval is 50, the BSS Aging Interval would be 100.Scan Valid Interval The amount of time (in seconds) before the client starts scanning for a better access point after reaching the roaming threshold or missing beacons. (See the threshold criteria in the table below.) The higher the value, the less time the client spends scanning for a better access point and the more time it has to send data.Range: 20 to 120 seconds (in 5-second increments)Default: 60 secondsNote The client does not scan for a new access point as long as it has a good connection and is passing data.Wireless ModeSignal Strength Threshold (dBm)Transmit RateThreshold (Mbps)5 GHz, 54 Mbps or2.4 GHz, 54 Mbps24 242.4 GHz, 11 Mbps(other modes enabled)24 92.4 GHz, 11 Mbps(only mode enabled)24 5

$5-65Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration GuideOL-4211-05Chapter 5 Configuring the Client AdapterConfiguring Band UsageConfiguring Band UsageIf your AP coverage permits it, follow these steps to configure the client profile only in ADU to use the 5GHz (802.11a) or 2.4GHz (802.11b/g) band, not both:Step 1 Launch ADU.Step 2 Click Profile Management.Step 3 Select the profile of interest and click Modify.Step 4 Click Advanced.Step 5 Under Wireless Mode, uncheck the rates that you do not intend to use.If you do not use ADU to manage CB21AG, then you must use registry settings to select the rates. Follow these steps:1. Launch regedit and navigate to the following entry:HKLM\System\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}2. Right-click and choose Find and find the variable called “NetBand.” This variable will be under a four-digit subkey whose DriverDesc value is “Cisco Aironet 802.11a/b/g Wireless Adapter.”The NetBand REG_SZ variable is a bitmask of supported rates. By default, this variable it is set to 15 decimal (0x0F). The supported values are:–802.11a 0x01–(not used) 0x02–802.11b 0x04–802.11g 0x08–(not used) 0x10For example, to support only 11b and 11g rates, the bitmask would be 0x04 + 0x08 = 0x0C = 12 decimal.$

Cisco Systems 102050 802.11 a/g Cardbus Adapter User Manual AIR XX21AG HIG

Cisco Systems Inc 802.11 a/g Cardbus Adapter AIR XX21AG HIG

Contents

User Manual 1

Navigation menu

Namespaces

Views

Navigation