Extreme Networks AP3917E Wireless 802.11 a/ac+b/g/n Access Point User Manual ExtremeWireless V10 41 06 User Guide

Extreme Networks, Inc. Wireless 802.11 a/ac+b/g/n Access Point ExtremeWireless V10 41 06 User Guide

Extreme Wireless V10.41.06 User Guide Part 1

DraftExtremeWireless™ V10.41.06User Guide9035198-03-REV01Published April 2018
DraftCopyright © 2018 Extreme Networks, Inc. All rights reserved.LLegal NoticeExtreme Networks, Inc. reserves the right to make changes in specifications and other informationcontained in this document and its website without prior notice. The reader should in all casesconsult representatives of Extreme Networks to determine whether any such changes have beenmade.The hardware, firmware, software or any specifications described or referred to in this documentare subject to change without notice.TrademarksExtreme Networks and the Extreme Networks logo are trademarks or registered trademarks ofExtreme Networks, Inc. in the United States and/or other countries.All other names (including any product names) mentioned in this document are the property oftheir respective owners and may be trademarks or registered trademarks of their respectivecompanies/owners.For additional information on Extreme Networks trademarks, please see: www.extremenetworks.com/company/legal/trademarksSoftware LicensingSome software files have been licensed under certain open source or third-party licenses. End-user license agreements and open source declarations can be found at: www.extremenetworks.com/support/policies/software-licensingSupportFor product support, phone the Global Technical Assistance Center (GTAC) at 1-800-998-2408(toll-free in U.S. and Canada) or +1-408-579-2826. For the support phone number in othercountries, visit: http://www.extremenetworks.com/support/contact/For product documentation online, visit: https://www.extremenetworks.com/documentation/
DraftTable of ContentsPreface......................................................................................................................................... 7Text Conventions................................................................................................................................................................... 7Safety Information................................................................................................................................................................7Sicherheitshinweise..............................................................................................................................................................8Consignes De Sécurité....................................................................................................................................................... 9Providing Feedback to Us...............................................................................................................................................10Getting Help............................................................................................................................................................................ 11Extreme Networks Documentation............................................................................................................................. 11Chapter 1: About This Guide................................................................................................... 12Who Should Use This Guide...........................................................................................................................................12How to Use This Guide......................................................................................................................................................12Chapter 2: Overview of the ExtremeWireless Solution...................................................... 14Introduction............................................................................................................................................................................14Conventional Wireless LANs.......................................................................................................................................... 15Elements of the ExtremeWireless Solution.............................................................................................................15ExtremeWireless and Your Network.......................................................................................................................... 19ExtremeWireless Appliance Product Family.........................................................................................................29Chapter 3: Configuring the ExtremeWireless Appliance....................................................31System Configuration Overview...................................................................................................................................31Logging on to the ExtremeWireless Appliance...................................................................................................33Wireless Assistant Home Screen................................................................................................................................34Working with the Basic Installation Wizard.......................................................................................................... 39Configuring the ExtremeWireless Appliance for the First Time................................................................. 45Using a Third-party Location-based Solution...................................................................................................... 95Additional Ongoing Operations of the System................................................................................................... 99Chapter 4: Configuring the ExtremeWireless APs.............................................................101Wireless AP Overview..................................................................................................................................................... 101Discovery and Registration..........................................................................................................................................120Viewing a List of All APs................................................................................................................................................125Wireless AP Default Configuration...........................................................................................................................134Configuring Wireless AP Properties........................................................................................................................ 156Outdoor Access Point Installation............................................................................................................................ 167Assigning Wireless AP Radios to a VNS............................................................................................................... 168Configuring Wireless AP Radio Properties...........................................................................................................174Configuring IoT Applications...................................................................................................................................... 189Setting Up the Wireless AP Using Static Configuration................................................................................199Setting Up 802.1x Authentication for a Wireless AP......................................................................................203Configuring Co-Located APs in Load Balance Groups.................................................................................. 213Configuring an AP Cluster...........................................................................................................................................220Configuring an AP as a Guardian.............................................................................................................................. 221Configuring a Captive Portal on an AP................................................................................................................. 222AP3916ic Integrated Camera Deployment.......................................................................................................... 226Performing AP Software Maintenance..................................................................................................................235Understanding the ExtremeWireless LED Status............................................................................................ 242ExtremeWireless™ V10.41.06 User Guide 33
DraftChapter 5: Configuring Topologies.....................................................................................262Topology Overview.........................................................................................................................................................262Configuring the Admin Port....................................................................................................................................... 263Configuring a Basic Data Port Topology..............................................................................................................266Creating a Topology Group........................................................................................................................................ 270Edit or Delete a Topology Group...............................................................................................................................271Enabling Management Trac.................................................................................................................................... 272Layer 3 Configuration.................................................................................................................................................... 272Exception Filtering.......................................................................................................................................................... 278Multicast Filtering..............................................................................................................................................................281Chapter 6: Configuring Roles.............................................................................................. 284Roles Overview................................................................................................................................................................. 284Configuring Default VLAN and Class of Service for a Role........................................................................284Policy Rules.........................................................................................................................................................................288Chapter 7: Configuring WLAN Services..............................................................................318WLAN Services Overview.............................................................................................................................................318Third-party AP WLAN Service Type....................................................................................................................... 319Configuring a Basic WLAN Service......................................................................................................................... 319Configuring Privacy.........................................................................................................................................................327Configuring Accounting and Authentication.....................................................................................................334Configuring QoS Modes...............................................................................................................................................370Configuring Hotspots.................................................................................................................................................... 376Chapter 8: Configuring a VNS............................................................................................. 390Configuring a VNS.......................................................................................................................................................... 390VNS Global Settings.......................................................................................................................................................392Methods for Configuring a VNS............................................................................................................................... 423Manually Creating a VNS............................................................................................................................................. 423Creating a VNS Using the Wizard........................................................................................................................... 426Enabling and Disabling a VNS...................................................................................................................................485Renaming a VNS..............................................................................................................................................................486Deleting a VNS................................................................................................................................................................. 486Chapter 9: Configuring Classes of Service........................................................................ 487Classes of Service Overview...................................................................................................................................... 487Configuring Classes of Service................................................................................................................................. 487CoS Rule Classification.................................................................................................................................................490Priority and ToS/DSCP Marking................................................................................................................................ 491Rate Limiting......................................................................................................................................................................492Chapter 10: Configuring Sites............................................................................................. 494VNS Sites Overview....................................................................................................................................................... 494Configuring Sites.............................................................................................................................................................494Recommended Deployment Guidelines...............................................................................................................495Radius Configuration.....................................................................................................................................................499Selecting AP Assignments......................................................................................................................................... 500Selecting WLAN Assignments...................................................................................................................................501Chapter 11: Working with a Mesh Network........................................................................ 502About Mesh........................................................................................................................................................................ 502Table of ContentsExtremeWireless™ V10.41.06 User Guide 44
DraftSimple Mesh Configuration.........................................................................................................................................502Wireless Repeater Configuration.............................................................................................................................503Wireless Bridge Configuration..................................................................................................................................504Examples of Deployment............................................................................................................................................ 505Mesh WLAN Services.................................................................................................................................................... 505Key Features of Mesh....................................................................................................................................................509Deploying the Mesh System......................................................................................................................................... 511Changing the Pre-shared Key in a Mesh WLAN Service............................................................................... 517Chapter 12: Working with a Wireless Distribution System...............................................518About WDS..........................................................................................................................................................................518Simple WDS Configuration.......................................................................................................................................... 518Wireless Repeater Configuration.............................................................................................................................. 519Wireless Bridge Configuration.................................................................................................................................. 520Examples of Deployment.............................................................................................................................................. 521WDS WLAN Services......................................................................................................................................................521Key Features of WDS.....................................................................................................................................................525Deploying the WDS System....................................................................................................................................... 528Changing the Pre-shared Key in a WDS WLAN Service..............................................................................536Chapter 13: Availability and Session Availability.............................................................. 537Availability........................................................................................................................................................................... 537Session Availability..........................................................................................................................................................545Viewing SLP Activity......................................................................................................................................................553Chapter 14: Configuring Mobility........................................................................................ 555Mobility Overview............................................................................................................................................................555Mobility Domain Topologies....................................................................................................................................... 556Configuring a Mobility Domain................................................................................................................................. 558Chapter 15: Working with Third-party APs.........................................................................561Defining Authentication by Captive Portal for the Third-party AP WLAN Service......................... 561Defining the Third-party APs List............................................................................................................................. 561Defining Policy Rules for the Third-party APs....................................................................................................561Chapter 16: Working with ExtremeWireless Radar.......................................................... 563Radar Overview................................................................................................................................................................563Radar Components.........................................................................................................................................................564Radar License Requirements..................................................................................................................................... 565Enabling the Analysis Engine.....................................................................................................................................565Radar Scan Profiles.........................................................................................................................................................566AirDefense Profile............................................................................................................................................................567Viewing Existing Radar Profiles................................................................................................................................. 571Adding a New Radar Profile....................................................................................................................................... 573Configuring an In-Service Scan Profile..................................................................................................................574Configuring a Guardian Scan Profile...................................................................................................................... 577Assigning an AP to a Profile........................................................................................................................................ 581Viewing the List of Assigned APs.............................................................................................................................581Maintaining the Radar List of APs........................................................................................................................... 582Working with Radar Reports..................................................................................................................................... 593Chapter 17: Working with Location Engine.......................................................................605Location Engine Overview..........................................................................................................................................605Table of ContentsExtremeWireless™ V10.41.06 User Guide 55
DraftLocation Engine on the Controller..........................................................................................................................607Deploying APs for Location Aware Services.....................................................................................................608Configuring the Location Engine............................................................................................................................ 609ExtremeLocation Support............................................................................................................................................619Chapter 18: Working with Reports and Statistics..............................................................621Application Visibility and Device ID.........................................................................................................................621Viewing AP Reports and Statistics..........................................................................................................................627Available Client Reports...............................................................................................................................................642Viewing Role Filter Statistics..................................................................................................................................... 646Viewing Topology Reports......................................................................................................................................... 648Viewing Mobility Reports............................................................................................................................................ 650Viewing Controller Status Information..................................................................................................................654Viewing Routing Protocol Reports..........................................................................................................................657Viewing RADIUS Reports............................................................................................................................................660Call Detail Records (CDRs).........................................................................................................................................663Chapter 19: Performing System Administration................................................................669Performing Wireless AP Client Management.................................................................................................... 669Defining Wireless Assistant Administrators and Login Groups................................................................ 673Chapter 20: Logs, Traces, Audits and DHCP Messages................................................... 676ExtremeWireless Appliance Messages..................................................................................................................676Working with Logs..........................................................................................................................................................676Viewing Wireless AP Traces....................................................................................................................................... 684Viewing Audit Messages..............................................................................................................................................684Viewing the DHCP Messages.....................................................................................................................................685Viewing the NTP Messages........................................................................................................................................ 686Viewing Software Upgrade Messages...................................................................................................................687Viewing Configuration Restore/Import Messages.......................................................................................... 689Chapter 21: Working with GuestPortal Administration................................................... 690About GuestPortals........................................................................................................................................................690Adding New Guest Accounts....................................................................................................................................690Enabling or Disabling Guest Accounts................................................................................................................. 693Editing Guest Accounts................................................................................................................................................693Removing Guest Accounts......................................................................................................................................... 694Importing and Exporting a Guest File...................................................................................................................695Viewing and Printing a GuestPortal Account Ticket......................................................................................698Working with the Guest Portal Ticket Page.......................................................................................................700Configuring Guest Password Patterns................................................................................................................... 701Configuring Web Session Timeouts....................................................................................................................... 704Appendix A: Regulatory Information................................................................................. 705ExtremeWireless APs 37XX , 38XX, and 39XX.................................................................................................705Appendix B: Default GuestPortal Ticket Page.................................................................. 706Example Ticket Page..................................................................................................................................................... 706Glossary.........................................................................................................................................709Table of ContentsExtremeWireless™ V10.41.06 User Guide 66
DraftPrefaceThis section discusses the conventions used in this guide, ways to provide feedback, additional help, andother Extreme Networks publications.Text ConventionsThe following tables list text conventions that are used throughout this guide.Table 1: Notice IconsIIcon Notice Type Alerts you to...General Notice Helpful tips and notices for using the product.Note Important features or instructions.Caution Risk of personal injury, system damage, or loss of data.Warning Risk of severe personal injury.New!New Content Displayed next to new content. This is searchable text within the PDF.Table 2: Text ConventionsConvention DescriptionScreen displays This typeface indicates command syntax, or represents information as it appears on thescreen.The words eenter andtypeWhen you see the word “enter” in this guide, you must type something, and then pressthe Return or Enter key. Do not press the Return or Enter key when an instructionsimply says “type.”[Key] names Key names are written with brackets, such as [Return] or [Esc]. If you must press twoor more keys simultaneously, the key names are linked with a plus sign (+). Example:Press [Ctrl]+[Alt]+[Del]Words in italicized type Italics emphasize a point or denote new terms at the place where they are defined inthe text. Italics are also used when referring to publication titles.Safety InformationDangers•Replace the power cable immediately if it shows any sign of damage.•Replace any damaged safety equipment (covers, labels and protective cables) immediately.ExtremeWireless™ V10.41.06 User Guide7
Draft•Use only original accessories or components approved for the system. Failure to observe theseinstructions may damage the equipment or even violate safety and EMC regulations.•Only authorized Extreme Networks service personnel are permitted to service the system.Warnings•This device must not be connected to a LAN segment with outdoor wiring.•Ensure that all cables are run correctly to avoid strain.•Replace the power supply adapter immediately if it shows any sign of damage.•Disconnect all power before working near power supplies unless otherwise instructed by amaintenance procedure.•Exercise caution when servicing hot swappable components: power supplies or fans. Rotating fanscan cause serious personal injury.•This unit may have more than one power supply cord. To avoid electrical shock, disconnect all powersupply cords before servicing. In the case of unit failure of one of the power supply modules, themodule can be replaced without interruption of power to the ExtremeWireless Appliance. However,this procedure must be carried out with caution. Wear gloves to avoid contact with the module,which will be extremely hot.•There is a risk of explosion if a lithium battery is not correctly replaced. The lithium battery must bereplaced only by an identical battery or one recommended by the manufacturer.•Always dispose of lithium batteries properly.•Do not attempt to lift objects that you think are too heavy for you.Cautions•Check the nominal voltage set for the equipment (operating instructions and type plate). Highvoltages capable of causing shock are used in this equipment. Exercise caution when measuringhigh voltages and when servicing cards, panels, and boards while the system is powered on.•Only use tools and equipment that are in perfect condition. Do not use equipment with visibledamage.•To protect electrostatic sensitive devices (ESD), wear a wristband before carrying out any work onhardware.•Lay cables so as to prevent any risk of them being damaged or causing accidents, such as tripping.SicherheitshinweiseGefahrenhinweise•Sollte das Netzkabel Anzeichen von Beschädigungen aufweisen, tauschen Sie es sofort aus.•Tauschen Sie beschädigte Sicherheitsausrüstungen (Abdeckungen, Typenschilder und Schutzkabel)sofort aus.•Verwenden Sie ausschließlich Originalzubehör oder systemspezifisch zugelassene Komponenten.Die Nichtbeachtung dieser Hinweise kann zur Beschädigung der Ausrüstung oder zur Verletzungvon Sicherheits- und EMV-Vorschriften führen.•Das System darf nur von autorisiertem Extreme Networks-Servicepersonal gewartet werden.PrefaceExtremeWireless™ V10.41.06 User Guide 88
DraftWarnhinweise•Dieses Gerät darf nicht über Außenverdrahtung an ein LAN-Segment angeschlossen werden.•Stellen Sie sicher, dass alle Kabel korrekt geführt werden, um Zugbelastung zu vermeiden.•Sollte das Netzteil Anzeichen von Beschädigung aufweisen, tauschen Sie es sofort aus.•Trennen Sie alle Stromverbindungen, bevor Sie Arbeiten im Bereich der Stromversorgungvornehmen, sofern dies nicht für eine Wartungsprozedur anders verlangt wird.•Gehen Sie vorsichtig vor, wenn Sie an Hotswap-fähigen Wireless Controller-Komponenten(Stromversorgungen oder Lüftern) Servicearbeiten durchführen. Rotierende Lüfter könnenernsthafte Verletzungen verursachen.•Dieses Gerät ist möglicherweise über mehr als ein Netzkabel angeschlossen. Um die Gefahr eineselektrischen Schlages zu vermeiden, sollten Sie vor Durchführung von Servicearbeiten alle Netzkabeltrennen. Falls eines der Stromversorgungsmodule ausfällt, kann es ausgetauscht werden, ohne dieStromversorgung zum Wireless Controller zu unterbrechen. Bei dieser Prozedur ist jedoch mitVorsicht vorzugehen. Das Modul kann extrem heiß sein. Tragen Sie Handschuhe, um Verbrennungenzu vermeiden.•Bei unsachgemäßem Austausch der Lithium-Batterie besteht Explosionsgefahr. Die Lithium-Batteriedarf nur durch identische oder vom Händler empfohlene Typen ersetzt werden.•Achten Sie bei Lithium-Batterien auf die ordnungsgemäße Entsorgung.•Versuchen Sie niemals, ohne Hilfe schwere Gegenstände zu heben.Vorsichtshinweise•Überprüfen Sie die für die Ausrüstung festgelegte Nennspannung (Bedienungsanleitung undTypenschild). Diese Ausrüstung arbeitet mit Hochspannung, die mit der Gefahr eines elektrischenSchlages verbunden ist. Gehen Sie mit großer Vorsicht vor, wenn Sie bei eingeschaltetem SystemHochspannungen messen oder Karten, Schalttafeln und Baugruppen warten.•Verwenden Sie nur Werkzeuge und Ausrüstung in einwandfreiem Zustand. Verwenden Sie keineAusrüstung mit sichtbaren Beschädigungen.•Tragen Sie bei Arbeiten an Hardwarekomponenten ein Armband, um elektrostatisch gefährdeteBauelemente (EGB) vor Beschädigungen zu schützen.•Verlegen Sie Leitungen so, dass sie keine Unfallquelle (Stolpergefahr) bilden und nicht beschädigtwerden.Consignes De SécuritéDangers•Si le cordon de raccordement au secteur est endommagé, remplacez-le immédiatement.•Remplacez sans délai les équipements de sécurité endommagés (caches, étiquettes et conducteursde protection).•Utilisez uniquement les accessoires d'origine ou les modules agréés spécifiques au système. Dans lecas contraire, vous risquez d'endommager l'installation ou d'enfreindre les consignes en matière desécurité et de compatibilité électromagnétique.•Seul le personnel de service Extreme Networks est autorisé à maintenir/réparer le système.PrefaceExtremeWireless™ V10.41.06 User Guide 99
DraftAvertissements•Cet appareil ne doit pas être connecté à un segment de LAN à l'aide d'un câblage extérieur.•Vérifiez que tous les câbles fonctionnent correctement pour éviter une contrainte excessive.•Si l'adaptateur d'alimentation présente des dommages, remplacez-le immédiatement.•Coupez toujours l'alimentation avant de travailler sur les alimentations électriques, sauf si laprocédure de maintenance mentionne le contraire.•Prenez toutes les précautions nécessaires lors de l'entretien/réparations des modules du WirelessController pouvant être branchés à chaud : alimentations électriques ou ventilateurs.Les ventilateursrotatifs peuvent provoquer des blessures graves.•Cette unité peut avoir plusieurs cordons d'alimentation.Pour éviter tout choc électrique, débrancheztous les cordons d'alimentation avant de procéder à la maintenance.En cas de panne d'un desmodules d'alimentation, le module défectueux peut être changé sans éteindre le Wireless Controller.Toutefois, ce remplacement doit être eectué avec précautions. Portez des gants pour éviter detoucher le module qui peut être très chaud.•Le remplacement non conforme de la batterie au lithium peut provoquer une explosion. Remplacezla batterie au lithium par un modèle identique ou par un modèle recommandé par le revendeur.•Sa mise au rebut doit être conforme aux prescriptions en vigueur.•N'essayez jamais de soulever des objets qui risquent d'être trop lourds pour vous.Précautions•Contrôlez la tension nominale paramétrée sur l'installation (voir le mode d'emploi et la plaquesignalétique). Des tensions élevées pouvant entraîner des chocs électriques sont utilisées dans cetéquipement. Lorsque le système est sous tension, prenez toutes les précautions nécessaires lors dela mesure des hautes tensions et de l'entretien/réparation des cartes, des panneaux, des plaques.•N'utilisez que des appareils et des outils en parfait état. Ne mettez jamais en service des appareilsprésentant des dommages visibles.•Pour protéger les dispositifs sensibles à l'électricité statique, portez un bracelet antistatique lors dutravail sur le matériel.•Acheminez les câbles de manière à ce qu'ils ne puissent pas être endommagés et qu'ils neconstituent pas une source de danger (par exemple, en provoquant la chute de personnes).Providing Feedback to UsWe are always striving to improve our documentation and help you work better, so we want to hearfrom you! We welcome all feedback but especially want to know about:•Content errors or confusing or conflicting information.•Ideas for improvements to our documentation so you can find the information you need faster.•Broken links or usability issues.If you would like to provide feedback to the Extreme Networks Information Development team aboutthis document, please contact us using our short online feedback form. You can also email us directly at internalinfodev@extremenetworks.com.PrefaceExtremeWireless™ V10.41.06 User Guide 110
DraftGetting HelpIf you require assistance, contact Extreme Networks using one of the following methods:•GGTAC (Global Technical Assistance Center) for Immediate Support•Phone: 1-800-998-2408 (toll-free in U.S. and Canada) or +1 408-579-2826. For the supportphone number in your country, visit: www.extremenetworks.com/support/contact•Email:support@extremenetworks.com. To expedite your message, enter the product name ormodel number in the subject line.•Extreme Portal — Search the GTAC knowledge base, manage support cases and service contracts,download software, and obtain product licensing, training, and certifications.•The Hub — A forum for Extreme customers to connect with one another, answer questions, andshare ideas and feedback. This community is monitored by Extreme Networks employees, but is notintended to replace specific guidance from GTAC.Before contacting Extreme Networks for technical support, have the following information ready:•Your Extreme Networks service contract number and/or serial numbers for all involved ExtremeNetworks products•A description of the failure•A description of any action(s) already taken to resolve the problem•A description of your network environment (such as layout, cable type, other relevant environmentalinformation)•Network load at the time of trouble (if known)•The device history (for example, if you have returned the device before, or if this is a recurringproblem)•Any related RMA (Return Material Authorization) numbersExtreme Networks DocumentationTo find Extreme Networks product guides, visit our documentation pages at:Current Product Documentation www.extremenetworks.com/documentation/Archived Documentation (for earlierversions and legacy products)www.extremenetworks.com/support/documentation-archives/Release Notes www.extremenetworks.com/support/release-notesOpen Source DeclarationsSome software files have been licensed under certain open source licenses. More information isavailable at: www.extremenetworks.com/support/policies/software-licensing.PrefaceExtremeWireless™ V10.41.06 User Guide11
Draft1 About This GuideWWho Should Use This GuideHow to Use This GuideThis guide describes how to install, configure, and manage the Extreme Networks ExtremeWirelesssoftware. This guide is also available as an online help system.To access the online help, click Help in the ExtremeWireless Assistant top menu bar.Who Should Use This GuideThis guide is a reference for system administrators who install and manage the ExtremeWireless system.Any administrator performing tasks described in this guide must have an account with administrativeprivileges.How to Use This GuideTo locate information about various subjects in this guide, refer to the following table.For... Refer to...An overview of the product, its features and functionality. Overview of the ExtremeWireless Solution onpage 14Information about how to perform the installation, first time setupand configuration of the controller, as well as configuring the dataports and defining routing.Configuring the ExtremeWireless Appliance onpage 31Information on how to install the ExtremeWireless AP, how itdiscovers and registers with the controller, and how to view andmodify radio configuration.Configuring the ExtremeWireless APs on page101An overview of topologies and provides detailed informationabout how to configure them.Configuring Topologies on page 262An overview of roles and provides detailed information abouthow to configure them.Configuring Roles on page 284An overview of WLAN (Wireless Local Area Network) servicesand provides detailed information about how to configure them.Configuring WLAN Services on page 318An overview of Virtual Network Services (VNS), provides detailedinstructions in how to configure a VNS, either using the Wizardsor by manually creating the component parts of a VNS.Configuring a VNS on page 390Information about configuring CoS (Class of Service) which are aconfiguration entity containing QoS Marking (802.1p and ToS/DSCP), Inbound/Outbound Rate Limiting and Transmit QueueAssignments.Configuring Classes of Service on page 487ExtremeWireless™ V10.41.06 User Guide12
DraftFFor... Refer to...Information about configuring Sites which is a mechanism forgrouping APs and refers to specific Roles, Classes of Service(CoS) and RADIUS servers that are grouped to form a singleconfiguration.Configuring Sites on page 494An overview of Mesh networks and provides detailed informationabout how to create a Mesh network.Working with a Mesh Network on page 502An overview of a Wireless Distribution System (WDS) networkconfiguration and provides detailed information about how tocreate a Mesh network.Working with a Wireless Distribution Systemon page 518Information on how to set up the features that maintain serviceavailability in the event of a controller failover.Availability and Session Availability on page537Information on how to set up the mobility domain that providesmobility for a wireless device user when the user roams from oneExtremeWireless AP to another in the mobility domain.Configuring Mobility on page 555Information on how to use the ExtremeWireless AP features withthird-party wireless access points.Working with Third-party APs on page 561Information on the security tool that scans for, detects, providescountermeasures, and reports on rogue APs.Working with ExtremeWireless Radar on page563Information on the various reports and displays available in thesystem.Working with Reports and Statistics on page621Information on system administration activities, such asperforming ExtremeWireless AP client management, definingmanagement users, configuring the network time, andconfiguring Web session timeouts.Performing System Administration on page669Information on how to view and interpret the logs, traces, auditsand DHCP (Dynamic Host Configuration Protocol) messages.Logs, Traces, Audits and DHCP Messages onpage 676Information on how to configure GuestPortal accounts. Working with GuestPortal Administration onpage 690A list of terms and definitions for the ExtremeWireless Applianceand the ExtremeWireless AP as well as standard industry termsused in this guide.Glossary terms are displayed as links in thetext. Hover over a glossary term to display thedefinition, or click the link to go to theGlossary.Regulatory information for the ExtremeWireless Appliances andthe ExtremeWireless APs.Regulatory Information on page 705The default GuestPortal ticket page source code. Default GuestPortal Ticket Page on page 706About This GuideExtremeWireless™ V10.41.06 User Guide13
Draft2 Overview of the ExtremeWirelessSolutionIIntroductionConventional Wireless LANsElements of the ExtremeWireless SolutionExtremeWireless and Your NetworkExtremeWireless Appliance Product FamilyIntroductionThe next generation of wireless networking devices provides a truly scalable WLAN (Wireless Local AreaNetwork) solution. ExtremeWireless Access Points (APs, wireless APs) are fit access points controlledthrough a sophisticated network device, the controller. This solution provides the security andmanageability required by enterprises and service providers for huge industrial wireless networks.The ExtremeWireless system is a highly scalable Wireless Local Area Network (WLAN) solution. Basedon a third generation WLAN topology, the ExtremeWireless system makes wireless practical for serviceproviders as well as medium and large-scale enterprises.The ExtremeWireless controller provides a secure, highly scalable, cost-eective solution based on theIEEE 802.11 standard. The system is intended for enterprise networks operating on multiple floors inmore than one building, and is ideal for public environments, such as airports and convention centersthat require multiple access points.This chapter provides an overview of the fundamental principles of the ExtremeWireless System.The ExtremeWireless ApplianceThe ExtremeWireless Appliance is a network device designed to integrate with an existing wired LocalArea Network (LAN). The rack-mountable controller provides centralized management, network access,and routing to wireless devices that use Wireless APs to access the network. It can also be configured tohandle data trac from third-party access points.The controller provides the following functionality:•Controls and configures Wireless APs, providing centralized management.•Authenticates wireless devices that contact a Wireless AP.•Assigns each wireless device to a VNS when it connects.•Routes trac from wireless devices, using VNS, to the wired network.•Applies filtering roles to the wireless device session.•Provides session logging and accounting capability.ExtremeWireless™ V10.41.06 User Guide14
DraftConventional Wireless LANsWireless communication between multiple computers requires that each computer be equipped with areceiver/transmitter—a WLAN Network Interface Card (NIC)—capable of exchanging digital informationover a common radio frequency. This is called an ad hoc network configuration. An ad hoc networkconfiguration allows wireless devices to communicate together. This setup is defined as an independentbasic service set (IBSS).An alternative to the ad hoc configuration is the use of an access point. This may be a dedicatedhardware bridge or a computer running special software. Computers and other wireless devicescommunicate with each other through this access point. The 802.11 standard defines access pointcommunications as devices that allow wireless devices to communicate with a distribution system. Thissetup is defined as a basic service set (BSS) or infrastructure network.To allow the wireless devices to communicate with computers on a wired network, the access pointsmust be connected to the wired network providing access to the networked computers. This topology iscalled bridging. With bridging, security and management scalability is often a concern.Figure 1: Standard Wireless Network Solution ExampleThe wireless devices and the wired networks communicate with each other using standard networkingprotocols and addressing schemes. Most commonly, Internet Protocol (IP) addressing is used.Elements of the ExtremeWireless SolutionThe ExtremeWireless solution consists of two devices:Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide15
Draft•ExtremeWireless Appliance•ExtremeWireless APThis architecture allows a single controller to control many APs, making the administration andmanagement of large networks much easier.There can be several controllers in the network, each with a set of registered APs. The controllers canalso act as backups to each other, providing stable network availability.In addition to the controllers and APs, the solution requires three other components, all of which arestandard for enterprise and service provider networks:•RADIUS Server (Remote Access Dial-In User Service) or other authentication server•DHCP (Dynamic Host Configuration Protocol) Server (Dynamic Host Configuration Protocol). If youdo not have a DHCP Server on your network, you can enable the local DHCP Server on the controller.The local DHCP Server is useful as a general purpose DHCP Server for small subnets. For moreinformation, see Setting Up the Data Ports on page 51.•SLP (Service Location Protocol)Figure 2: ExtremeWireless Appliance SolutionAs illustrated in ExtremeWireless Appliance Solution, the ExtremeWireless Appliance appears to theexisting network as if it were an access point, but in fact one controller controls many APs. Thecontroller has built-in capabilities to recognize and manage the APs. The controller:Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide16
Draft•Activates the APs•Enables APs to receive wireless trac from wireless devices•Processes the data trac from the APs•Forwards or routes the processed data trac out to the network•Authenticates requests and applies access rolesSimplifying the APs makes them cost-eective, easy to manage, and easy to deploy. Putting control onan intelligent centralized controller enables:•Centralized configuration, management, reporting, and maintenance•High security•Flexibility to suit enterprise•Scalable and resilient deployments with a few controllers controlling hundreds of APsThe ExtremeWireless system:•Scales up to Enterprise capacity — ExtremeWireless Appliances are scalable:•C5215 — Up to 1000 APs, 2000 APs in Controller availability mode•C5210 — Up to 1000 APs, 2000 APs in Controller availability mode•C5110 — Up to 525 APs, 1050 APs in Controller availability mode•C4110 — Up to 250 APs, 500 APs in Controller availability mode•C25 — Up to 50 APs, 100 APs in Controller availability mode•C35 — Up to 125 APs, 250 APs in Controller availability mode•V2110 (Small Profile) — Up to 50 APs, 100 APs in Controller availability mode•V2110 (Medium Profile) — Up to 250 APs, 500 APs in Controller availability mode•V2110 (Large Profile) — Up to 525 APs, 1050 APs in Controller availability mode•In turn, each wireless AP can handle a mixture of secure and non-secure clients. AP per radiosupport is up to 200 clients, of which 127 are clients with security. With additional controllers, thenumber of wireless devices the solution can support can reach into the thousands.•Integrates with existing network — A controller can be added to an existing enterprise network as anew network device, greatly enhancing its capability without interfering with existing functionality.Integration of the controllers and APs does not require any re-configuration of the existinginfrastructure (for example, VLAN (Virtual LAN)s).•Integrates with the Extreme Networks Extreme Management Center Suite of products. For moreinformation, see Extreme Networks Extreme Management Center Integration on page 18.Plug-in applications include:•Automated Security Manager•Inventory Manager•NAC Manager•Role Control Console•Policy Manager•Oers centralized management and control — An administrator accesses the controller in itscentralized location to monitor and administer the entire wireless network. From the controller theadministrator can recognize, configure, and manage the APs and distribute new software releases.•Provides easy deployment of APs — The initial configuration of the APs on the centralized controllercan be done with an automatic “discovery” technique.Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide17
Draft•Provides security via user authentication — Uses existing authentication (AAA) servers toauthenticate and authorize users.•Provides security via filters and privileges — Uses virtual networking techniques to create separatevirtual networks with defined authentication and billing services, access roles, and privileges.•Supports seamless mobility and roaming — Supports seamless roaming of a wireless device fromone wireless AP to another on the same controller or on a dierent controller.•Integrates third-party access points — Uses a combination of network routing and authenticationtechniques.•Prevents rogue devices — Unauthorized access points are detected and identified as either harmlessor dangerous rogue APs.•Provides accounting services — Logs wireless user sessions, user group activity, and other activityreporting, enabling the generation of consolidated billing records.•Oers troubleshooting capability — Logs system and session activity and provides reports to aid introubleshooting analysis.•Oers dynamic RF management — Automatically selects channels and adjusts Radio Frequency(RF) signal propagation and power levels without user intervention.Extreme Networks Extreme Management Center IntegrationThe ExtremeWireless solution now integrates with the Extreme Management Center suite of products, acollection of tools to help you manage networks. Its client/server architecture lets you manage yournetwork from a single workstation or, for networks of greater complexity, from one or more clientworkstations. It is designed to facilitate specific network management tasks while sharing data andproviding common controls and a consistent user interface.The Extreme Management Center is a family of products comprising the Extreme Management CenterConsole and a suite of plug-in applications, including:•Automated Security Manager — Automated Security Manager is a unique threat response solutionthat translates security intelligence into security enforcement. It provides sophisticated identificationand management of threats and vulnerabilities. For information on how the ExtremeWirelesssolution integrates with the Automated Security Manager application, see the Maintenance Guide.•Inventory Manager — Inventory Manager is a tool for eciently documenting and updating thedetails of the ever-changing network. For information on how the ExtremeWireless solutionintegrates with the Automated Security Manager application, see the Maintenance Guide .•NAC Manager — NAC Manager is a leading-edge NAC solution to ensure only the right users haveaccess to the right information from the right place at the right time. The Extreme Networks NACsolution performs multi-user, multi-method authentication, vulnerability assessment and assistedremediation. For information on how the ExtremeWireless solution integrates with the ExtremeNetworks NAC solution, see NAC Integration with the Wireless WLAN on page 24.•Policy Manager — Policy Manager recognizes the ExtremeWireless suite as role capable devices thataccept partial configuration from Policy Manager. Currently this integration is partial in the sensethat Extreme Management Center is unable to create WLAN services directly; The WLAN servicesneed to be directly provisioned on the controller and are represented to Policy Manager as logicalports.The ExtremeWireless Appliance allows Policy Manager to:Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide18
Draft•Attach Topologies (assign VLAN to port) to the ExtremeWireless Appliance physical ports(Console).•Attach role to the logical ports (WLAN Service/SSID),•Assign a Default Role/Role to a WLAN Service, thus creating the VNS.•Perform authentication operations which can then reference defined roles for station-specificrole enforcement.This can be seen as a three-step process:1 Deploy the controller and perform local configuration•The ExtremeWireless Appliance ships with a default SSID, attached by default to all AP radios,when enabled.•Use the basic installation wizard to complete the ExtremeWireless Appliance configuration.2 Use Policy Manager to:•Push the VLAN list to the ExtremeWireless Appliance (Topologies)•Attach VLANs to ExtremeWireless Appliance physical ports (Console - Complete Topologydefinition)•Push RADIUS server configuration to the ExtremeWireless Appliance•Push role definitions to the ExtremeWireless Appliance•Attach the default role to create a VNS3 Fine tune controller settings. For example, configuring filtering at APs and ExtremeWirelessAppliance for a bridged at controller or routed topologies and associated VNSs.NoteComplete information about integration with Policy Manager is outside the scope of thisdocument.ExtremeWireless and Your NetworkThis section is a summary of the components of the ExtremeWireless solution on your enterprisenetwork. The following are described in detail in this guide, unless otherwise stated:•ExtremeWireless Appliance — A rack-mountable network device or virtual appliance that providescentralized control over all access points and manages the network assignment of wireless deviceclients associating through access points.•Wireless AP — A wireless LAN fit access point that communicates with a controller.•RADIUS Server (Remote Access Dial-In User Service) (RFC2865), or other authentication server —An authentication server that assigns and manages ID and Password protection throughout thenetwork. Used for authentication of the wireless users in either 802.1x or Captive Portal securitymodes. The RADIUS Server system can be set up for certain standard attributes, such as filter ID, andfor the Vendor Specific Attributes (VSAs). In addition, RADIUS Disconnect (RFC3576) which permitsdynamic adjustment of user role (user disconnect) is supported.•DHCP Server (Dynamic Host Configuration Protocol) (RFC2131) — A server that assigns dynamicallyIP addresses, gateways, and subnet masks. IP address assignment for clients can be done by theDHCP server internal to the controller, or by existing servers using DHCP relay. It is also used by theAPs to discover the location of the controller during the initial registration process using Options 43,60, and Option 78. Options 43 and 60 specify the vendor class identifier (VCI) and vendor specificOverview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide19
Draftinformation. Option 78 specifies the location of one or more SLP Directory Agents. For SLP, DHCPshould have Option 78 enabled.•Service Location Protocol (SLP) (SLP RFC2608) — Client applications are User Agents and servicesthat are advertised by a Service Agent. In larger installations, a Directory Agent collects informationfrom Service Agents and creates a central repository. The Extreme Networks solution relies onregistering “Extreme Networks” as an SLP Service Agent.•Domain Name Server (DNS) — A server used as an alternate mechanism (if present on theenterprise network) for the automatic discovery process. Controller, Access Points and ConvergenceSoftware relies on the DNS for Layer 3 deployments and for static configuration of the APs. Thecontroller can be registered in DNS, to provide DNS assisted AP discovery. In addition, DNS can alsobe used for resolving RADIUS server hostnames.•Web Authentication Server — A server that can be used for external Captive Portal and externalauthentication. The controller has an internal Captive portal presentation page, which allows webauthentication (web redirection) to take place without the need for an external Captive Portal server.•RADIUS Accounting Server (Remote Access Dial-In User Service) (RFC2866) — A server that isrequired if RADIUS Accounting is enabled.•SNMP (Simple Network Management Protocol) — A Manager Server that is required if forwardingSNMP messages is enabled.•Network Infrastructure — The Ethernet switches and routers must be configured to allow routingbetween the various services noted above. Routing must also be enabled between multiplecontrollers for the following features to operate successfully:•Availability•Mobility•ExtremeWireless Radar for detection of rogue access pointsSome features also require the definition of static routes.•Web Browser — A browser provides access to the controller Management user interface to configurethe ExtremeWireless system.•SSH Enabled Device — A device that supports Secure Shell (SSH) is used for remote (IP) shell accessto the system.•Zone Integrity — The Zone integrity server enhances network security by ensuring clients accessingyour network are compliant with your security roles before gaining access. Zone Integrity Release 5is supported.•(Optional) Online Signup Server — For use with Hotspot Networks.Network Trac FlowFigure 3 illustrates a simple configuration with a single controller and two APs, each supporting awireless device. A RADIUS server on the network provides authentication, and a DHCP server is used bythe APs to discover the location of the controller during the initial registration process. Network inter-connectivity is provided by the infrastructure routing and switching devices.Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide20
DraftFigure 3: Trac Flow DiagramEach wireless device sends IP packets in the 802.11 standard to the AP. The AP uses a UDP (UserDatagram Protocol) based tunnelling protocol. In tunneled mode of operation, it encapsulates thepackets and forwards them to the controller. The controller decapsulates the packets and routes theseto destinations on the network. In a typical configuration, access points can be configured to locallybridge trac (to a configured VLAN) directly at their network point of attachment.The controller functions like a standard L3 router or L2 switch. It is configured to route the networktrac associated with wireless connected users. The controller can also be configured to simply forwardtrac to a default or static route if dynamic routing is not preferred or available.Network SecurityThe Extreme Networks ExtremeWireless system provides features and functionality to control networkaccess. These are based on standard wireless network security practices.Current wireless network security methods provide protection. These methods include:•Shared Key authentication that relies on Wired Equivalent Privacy (WEP) keys•Open System that relies on Service Set Identifiers (SSIDs)•802.1x that is compliant with Wi-Fi Protected Access (WPA)•Captive Portal based on Secure Sockets Layer (SSL) protocolThe Extreme Networks ExtremeWireless system provides the centralized mechanism by which thecorresponding security parameters are configured for a group of users.•Wired Equivalent Privacy (WEP) is a security protocol for wireless local area networks defined in the802.11b standardOverview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide21
Draft•Wi-Fi Protected Access version 1 (WPA1™) with Temporal Key Integrity Protocol (TKIP)•Wi-Fi Protected Access version 2 (WPA2™) with Advanced Encryption Standard (AES) and CounterMode with Cipher Block Chaining Message Authentication Code (CCMP)AuthenticationThe controller relies on a RADIUS server, or authentication server, on the enterprise network to providethe authentication information (whether the user is to be allowed or denied access to the network). ARADIUS client is implemented to interact with infrastructure RADIUS servers.The controller provides authentication using:•Captive Portal — a browser-based mechanism that forces users to a Web page•RADIUS (using IEEE 802.1x)The 802.1x mechanism is a standard for authentication developed within the 802.11 standard. Thismechanism is implemented at the wireless port, blocking all data trac between the wireless deviceand the network until authentication is complete. Authentication by 802.1x standard uses ExtensibleAuthentication Protocol (EAP) for the message exchange between the controller and the RADIUSserver.When 802.1x is used for authentication, the controller provides the capability to dynamically assign per-wireless-device WEP keys (called per session WEP keys in 802.11). In the case of WPA, the controller isnot involved in key assignment. Instead, the controller is involved in the information exchange betweenRADIUS server and the user’s wireless device to negotiate the appropriate set of keys. With WPA2 thematerial exchange produces a Pairwise Master Key which is used by the AP and the user to derive theirtemporal keys. (The keys change over time.)The Extreme Networks ExtremeWireless solution provide a RADIUS redundancy feature that enablesyou to define a failover RADIUS server in the event that the active RADIUS server becomesunresponsive.PrivacyPrivacy is a mechanism that protects data over wireless and wired networks, usually by encryptiontechniques.Extreme Networks ExtremeWireless supports the Wired Equivalent Privacy (WEP) standard common toconventional access points.It also provides Wi-Fi Protected Access version 1 (WPA v.1) encryption, based on Pairwise Master Key(PMK) and Temporal Key Integrity Protocol (TKIP). The most secure encryption mechanism is WPAversion 2, using Advanced Encryption Standard (AES).Virtual Network ServicesVirtual Network Services (VNS) provide a versatile method of mapping wireless networks to thetopology of an existing wired network.In releases prior to V7.0, a VNS was a collection of operational entities. Starting with Release V7.0, aVNS becomes the binding of reusable components:Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide 222
Draft•WLAN Service components that define the radio attributes, privacy and authentication settings, andQoS attributes of the VNS•Role components that define the topology (typically a VLAN), policy rules, and Class of Serviceapplied to the trac of a station.Figure 4 illustrates the transition of the concept of a VNS to a binding of reusable components.Figure 4: VNS as a Binding of Reusable ComponentsWLAN Service components and Role components can be configured separately and associated with aVNS when the VNS is created or modified. Alternatively, they can be configured during the process ofcreating a VNS.Additionally, Roles can be created using the Extreme Networks Extreme Management Center PolicyManager or Extreme Management Center Wireless Manager and pushed to the ExtremeWirelessAppliance. Role assignment ensures that the correct topology and trac behavior are applied to a userregardless of WLAN service used or VNS assignment.When VNS components are set up on the controller, among other things, a range of IP addresses is setaside for the controller’s DHCP server to assign to wireless devices.If the OSPF (Open Shortest Path First) routing protocol is enabled, the controller advertises the routedtopologies as reachable segments to the wired network infrastructure. The controller routes tracbetween the wireless devices and the wired network.The controller also supports VLAN-bridged assignment for VNSs. This allows the controller to directlybridge the set of wireless devices associated with a WLAN service directly to a specified core VLAN.Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide23
DraftEach controller model can support a definable number and an active number of VNSs. See Table 3.Table 3: VNS and WLANService CapacityCController Model Max Number of DefinedVNSMax Number of DefinedWLAN ServicesMax Number of ActiveWLAN ServicesC5110 256 256 128C4110 128 128 64C25 32 32 16V2110 Small 32 32 16V2110 MediumV2110-HyperV128 128 64V2110 Large 256 256 128C5215 256 256 128C5210 256 256 128C35 32 16 32The AP radios can be assigned to each of the configured WLAN services and, therefore, VNSs in asystem. Each AP can be the subject of 16 service assignments—eight assignments per radio—whichcorresponds to the number of SSIDs it can support. Once a radio has all eight slots assigned, it is nolonger eligible for further assignment.The AP3912 has three additional client ports that can be assigned to a single WLAN Service. For moreinformation, see Assigning WLAN Services to Client Ports on page 170.NAC Integration with the Wireless WLANThe Extreme Networks Wireless WLAN supports integration with a NAC (Network Admission Control)Gateway. The NAC Gateway can provide your network with authentication, registration, assessment,remediation, and access control for mobile users.NAC Gateway integration with Wireless WLAN supports SSID VNSs when used in conjunction withMAC-based external captive portal authentication.Figure 5 depicts the topology and workflow relationship between Wireless WLAN that is configured forexternal captive portal and a NAC Gateway. With this configuration, the NAC Gateway acts like aRADIUS proxy server. An alternative is to configure the NAC Gateway to perform MAC-basedauthentication itself, using its own database of MAC addresses and permissions. For more information,see Creating a NAC VNS Using the VNS Wizard on page 426.Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide24
DraftFigure 5: WLAN and NAC Integration with External Captive Portal Authentication11The client laptop connects to the AP.The AP determines that authentication is required, and sends an association request to theappliance.2The appliance forwards to the NAC Gateway an access-request message for the client laptop, which isidentified by its MAC address.The NAC Gateway forwards the access-request to the RADIUS server. The NAC Gateway acts like aRADIUS proxy server.3The RADIUS server evaluates the access-request and sends an AccessAccept message back to the NAC.NoteRADIUS servers with captive portal and EAP authentication can be tested for connectivity using theradtest command. For more information, see the ExtremeWireless CLI Guide.The NAC receives the access-accept packet. Using its local database, the NAC determines thecorrect role to apply to this client laptop and updates the access-accept packet with the roleassignment. The updated AccessAccept message is forwarded to the appliance and AP.4The appliance and the AP apply role against the client laptop accordingly. The appliance assigns a set of filtersto the client laptop’s session and the AP allows the client laptop access to the network.5The client laptop interacts with a DHCP server to obtain an IP address.6Eventually the client laptop uses its web browser to access a website.•The appliance determines that the target website is blocked and that the client laptop still requiresauthentication.Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide25
Draft•The appliance sends an HTTP redirect to the client laptop’s browser. The redirect sends the browser to theweb server on the NAC Gateway.•The NAC displays an appropriate web page in the client laptop’s browser. The contents of the page dependon the current role assignment (enterprise, remediation, assessing, quarantine, or unregistered) for the MACaddress.77When the NAC determines that the client laptop is ready for a dierent role assignment, it sends a ‘disconnectmessage’ (RFC 3576) to the appliance.When the appliance receives the ‘disconnect message’ sent by the NAC, the appliance terminatesthe session for the client laptop.The appliance forwards the command to terminate the client laptop’s session to the AP, whichdisconnects the client laptop.VNS ComponentsThe distinct constituent high-level configurable umbrella elements of a VNS are:•Topology•Role•Classes of Service•WLAN ServiceTopologyTopologies represent the networks with which the controller and its APs interact. The main configurableattributes of a topology are:•Name - a string of alphanumeric characters designated by the administrator.•VLAN ID - the VLAN identifier as specified in the IEEE 802.1Q definition.•VLAN tagging options.•Port of presence for the topology on the controller. (This attribute is not required for Routed andBridged at AP topologies.)•Interface. This attribute is the IP (L3) address assigned to the controller on the network described bythe topology. (Optional.)•Type. This attribute describes how trac is forwarded on the topology. Options are:•“Physical” - the topology is the native topology of a data plane and it represents the actualEthernet ports•“Management” - the native topology of the controller management port•“Routed” - the controller is the routing gateway for the routed topology.•“Bridged at Controller” - the user trac is bridged (in the L2 sense) between wireless clients andthe core network infrastructure.•“Bridged at AP” - the user trac is bridged locally at the AP without being redirected to thecontroller•Exception Filters. Specifies which trac has access to the controller from the wireless clients or theinfrastructure network.•Certificates.Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide26
Draft•Multicast filters. Defines the multicast groups that are allowed on a specific topology segment.•For information about Topology groups, see Creating a Topology Group on page 270.RoleA Role is a collection of attributes and rules that determine actions taken user trac accesses the wirednetwork through the WLAN service (associated to the WLAN Service's SSID). Depending upon its type,a VNS can have between one and three Authorization Roles associated with it:1 Default non-authorized role — This is a mandatory role that covers all trac from stations that havenot authenticated. At the administrator's discretion the default non-authorized role can be appliedto the trac of authenticated stations as well.2 Default authorized role — This is a mandatory role that applies to the trac of authenticated stationsfor which no other role was explicitly specified. It can be the same as the default non-authorizedrole.3 Third-party AP role — This role applies to the list of MAC addresses corresponding to the wiredinterfaces of third party APs specifically defined by the administrator to be providing the RF accessas an AP WLAN Service. This role is only relevant when applied to third party AP WLAN Services.Classes of ServiceIn general, CoS (Class of Service) refers to a set of attributes that define the importance of a frame whileit is forwarded through the network relative to other packets, and to the maximum throughput per timeunit that a station or port assigned to a specific role is permitted. The CoS defines actions to be takenwhen rate limits are exceeded.All incoming packets may follow these steps to determine a CoS:•Classification - identifies the first matching rule that defines a CoS.•Marking - modifies the L2 802.1p and/or L3 ToS based on CoS definition.•Rate limiting (drop) is set.The system limit for the number of CoS profiles on a controller is identical to the number of roles. Forexample, the maximum number of CoS profiles on a C4110 is 512.WLAN ServicesA WLAN Service represents all the RF, authentication and QoS attributes of a wireless access serviceoered by the controller and its APs. A WLAN Service can be one of the following types:•Standard — A conventional service. Only APs running ExtremeWireless software can be part of thisWLAN Service. This type of service can be used as a Bridged at Controller, Bridged at AP, or RoutedTopology. This type of service provides access for mobile stations. Roles can be associated with thistype of WLAN service to create a VNS. Hotspot can be enabled for standard WLAN services.•Third Party AP — A Wireless Service oered by third party APs. This type of service provides accessfor mobile stations. Roles can be assigned to this type of WLAN service to create a VNS.•Dynamic Mesh and WDS (Static Mesh)— This is to configure a group of APs organized into ahierarchy for purposes of providing a Wireless Distribution Service. This type of service is in essenceOverview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide27
Drafta wireless trunking service rather than a service that provides access for stations. As such, thisservice cannot have roles attached to it.•Remote — A service that resides on the edge (foreign) controller. Pairing a remote service with aremoteable service on the designated home controller allows you to provision centralized WLANServices in the mobility domain. This is known as centralized mobility.The components of a WLAN Service map to the corresponding components of a VNS in previousreleases. The administrator makes an explicit choice of the type of authentication to use on the WLANService. If the choice of authentication option conflicts with any other authentication or privacy choices,the WLAN Service cannot be enabled.RoutingRouting can be used on the controller to support the VNS definitions. Through the user interface youcan configure routing on the controller to use one of the following routing techniques:•Static routes — Use static routes to set the default route of a controller so that legitimate wirelessdevice trac can be forwarded to the default gateway.•OSPF (version 2) (RFC2328) — Use OSPF to allow the controller to participate in dynamic routeselection. OSPF is a protocol designed for medium and large IP networks with the ability to segmentroutes into dierent areas by routing information summarization and propagation. Static Routedefinition and OSPF dynamic learning can be combined, and the precedence of a static routedefinition over dynamic rules can be configured by selecting or clearing the Override dynamicroutes option check box.•Next-hop routing — Use next-hop routing to specify a unique gateway to which trac on a VNS isforwarded. Defining a next-hop for a VNS forces all the trac in the VNS to be forwarded to theindicated network device, bypassing any routing definitions of the controller's route table.Mobility and RoamingIn typical simple configurations, APs are set up as bridges that bridge wireless trac to the local subnet.In bridging configurations, the user obtains an IP address from the same subnet as the AP, assuming noVLAN trunking functionality. If the user roams between APs on the same subnet, it is able to keep usingthe same IP address. However, if the user roams to another AP outside of that subnet, its IP address isno longer valid. The user's client device must recognize that the IP address it has is no longer valid andre-negotiate a new one on the new subnet. This mechanism does not mandate any action on the user.The recovery procedure is entirely client device dependent. Some clients automatically attempt toobtain a new address on roam (which aects roaming latency), while others will hold on to their IPaddress. This loss of IP address continuity seriously aects the client's experience in the network,because in some cases it can take minutes for a new address to be negotiated.The Extreme Networks ExtremeWireless solution centralizes the user's network point of presence,therefore abstracting and decoupling the user's IP address assignment from that of the APs locationsubnet. That means that the user is able to roam across any AP without losing its own IP address,regardless of the subnet on which the serving APs are deployed.In addition, a controller can learn about other controllers on the network and then exchange clientsession information. This enables a wireless device user to roam seamlessly between dierent APs ondierent controllers.Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide28
DraftNetwork AvailabilityThe Extreme Networks ExtremeWireless solution provides availability against AP outages, controlleroutages, and even network outages. The controller in a VLAN bridged topology can potentially allowthe user to retain the IP address in a failover scenario, if the VNS/VLAN is common to both controllers.For example, availability is provided by defining a paired controller configuration by which each peercan act as the backup controller for the other's APs. APs in one controller are allowed to fail over andregister with the alternate controller.If the primary controller fails, all of its associated APs can automatically switch over to anothercontroller that has been defined as the secondary or backup controller. If an AP reboots, the primarycontroller is restored if it is active. However, active APs will continue to be connected to the backupcontroller until the administrator releases them back to the primary home controller.Quality of Service (QoS)Extreme Networks ExtremeWireless solution provides advanced Quality of Service (QoS) managementto provide better network trac flow. Such techniques include:•WMM (Wi-Fi Multimedia) — WMM is enabled per WLAN service. The controller provides centralizedmanagement of the AP features. For devices with WMM enabled, the standard provides multimediaenhancements for audio, video, and voice applications. WMM shortens the time betweentransmitting packets for higher priority trac. WMM is part of the 802.11e standard for QoS. In thecontext of the ExtremeWireless Solution, the ToS/DSCP field is used for classification and properclass of service mapping, output queue selection, and priority tagging.•IP ToS (Type of Service) or DSCP (Diserv Codepoint) — The ToS/DSCP field in the IP header of aframe indicates the priority and class of service for each frame. Adaptive QoS ensures correctpriority handling of client payload packets tunneled between the controller and AP by copying theIP ToS/DSCP setting from client packet to the header of the encapsulating tunnel packet.•Rate Control — Rate Control for user trac can also be considered as an aspect of QoS. As part ofRole definition, the user can specify (default) role that includes Ingress and Egress rate control.Ingress rate control applies to trac generated by wireless clients and Egress rate control applies totrac targeting specific wireless clients. The bit-rates can be configured as part of globally availableprofiles which can be used by any particular configuration. A global default is also defined.Quality of Service (QoS) management is also provided by:•Assigning high priority to a WLAN service•Adaptive QoS (automatic and all time feature)•Support for legacy devices that use SpectraLink Voice Protocol (SVP) for prioritizing voice trac(configurable)ExtremeWireless Appliance Product FamilyThe ExtremeWireless Appliance is available in the following product families:Overview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide29
DraftTable 4: ExtremeWireless Product FamiliesEExtremeWireless Appliance ModelNumberSpecificationsC5110 •Three data ports supporting up to 525 APs•2 fiber optic SR (10Gbps)•1 Ethernet port GigE•One management port (Ethernet) GigE•One console port (DB9 serial)•Four USB ports — two on each front and back panel (only oneport active at a time)•Redundant dual power supply unitC5210/C5215 •Four data ports supporting up to 1000 APs•2 SFP+ (10Gbps)•2 Ethernet port GigE•One management port (Ethernet) GigE•One console port (RJ-45 serial)•Five USB ports — two on front and three on back panel (only oneport active at a time)•Redundant dual power supply unitC4110 •Four GigE ports supporting up to 250 APs•One management port (Ethernet) GigE•One console port (DB9 serial)•Four USB ports (only one active at a time)•Redundant dual power supply unitC25 •Two GigE ports supporting up to 50 APs•One management port GigE•One console port (DB9 serial)•Two USB portsV2110 •Two GigE ports or 10G fiber ports supporting up to 525 APs•One management port GigE•USB ports (only one active at a time)C35 •Four GigE ports supporting up to 125 APs•One management port GigE•One console port•Two USB portsOverview of the ExtremeWireless SolutionExtremeWireless™ V10.41.06 User Guide30
Draft3 Configuring the ExtremeWirelessApplianceSSystem Configuration OverviewLogging on to the ExtremeWireless ApplianceWireless Assistant Home ScreenWorking with the Basic Installation WizardConfiguring the ExtremeWireless Appliance for the First TimeUsing a Third-party Location-based SolutionAdditional Ongoing Operations of the SystemSystem Configuration OverviewThe following section provides a high-level overview of the steps involved in the initial configuration ofExtremeWireless:1 Before you begin the configuration process, research the type of WLAN (Wireless Local AreaNetwork) deployment that is required. For example, topology and VLAN (Virtual LAN) IDs, SSIDs,security requirements, and filter roles.2 Prepare the network servers. Ensure that the external servers, such as DHCP (Dynamic HostConfiguration Protocol) and RADIUS servers (if applicable) are available and appropriatelyconfigured.3 Install the controller. For more information, see the documentation for your controller.4 Perform the first time setup of the controller on the physical network, which includes configuring theIP addresses of the interfaces on the controller.a Create a new physical topology and provide the IP address to be the relevant subnet point ofattachment to the existing network.b To manage the controller through the interface configured above, select the Mgmt check box onthe IInterfaces tab.c Configure the data port interfaces to be on separate VLANs, matching the VLANs configured instep 3 above. Ensure also that the tagged vs. untagged state is consistent with the switch portconfiguration.d Configure the time zone. Because changing the time zone requires restarting the controller, it isrecommended that you configure the time zone during the initial installation and configuration ofExtremeWireless™ V10.41.06 User Guide31
Draftthe controller to avoid network interruptions. For more information, see Configuring NetworkTime on page 89.e Apply an activation key file. If an activation key is not applied, the controller functions with somefeatures enabled in demonstration mode. Not all features are enabled in demonstration mode.For example, mobility is not enabled and cannot be used.CCautionWhenever the licensed region changes on the ExtremeWireless Appliance, all APs arechanged to Auto Channel Select to prevent possible infractions to local RF regulatoryrequirements. If this occurs, all manually configured radio channel settings will belost.Installing the new license key before upgrading will prevent the ExtremeWirelessAppliance from changing the licensed region, and in addition, manually configuredchannel settings will be maintained. For more information, see the ExtremeWirelessMaintenance Guide.5 Configure the controller for remote access:a Set up an administration station (laptop) on subnet 192.168.10.0/24. By default, the controller'sManagement interface is configured with the static IP address 192.168.10.1.b Configure the controller’s management interface.c Configure the data interfaces.d Set up the controller on the network by configuring the physical data ports.e Configure the routing table.f Configure static routes or OSPF (Open Shortest Path First) parameters, if appropriate to thenetwork.For more information, see Configuring the ExtremeWireless Appliance for the First Time on page45.6 Configure the trac topologies your network must support. Topologies represent the controller’spoints of network attachment, and therefore VLANs and port assignments need to be coordinatedwith the corresponding network switch ports. For more information, see Configuring a Basic DataPort Topology on page 266.7 Configure roles. Roles are typically bound to topologies. Role application assigns user trac to thecorresponding network point.•Roles define user access rights (filtering or ACL (Access Control List))•Polices reference user's rate control profile.For more information, see Configuring Roles on page 284.8 Configure WLAN services.•Define SSID and privacy settings for the wireless link.•Select the set of APs/Radios on which the service is present.•Configure the method of credential authentication for wireless users (None, Internal CP, ExternalCP, GuestPortal, 802.1x[EAP])For more information, see Configuring WLAN Services on page 318.9 Create the VNSs.A VNS binds a WLAN Service to a Role that will be used for default assignment upon a user’snetwork attachment.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide32
DraftYou can create topologies, roles, and WLAN services first, before configuring a VNS, or you canselect one of the wizards (such as the VNS wizard), or you can simply select to create new VNS.The VNS page then allows for in-place creation and definition of any dependency it may require,such as:•Creating a new WLAN Service•Creating a new role•Creating a new class of service (within a role)•Creating a new topology (within a role)•Creating new rate controls, and other Class of Service parametersThe default shipping configuration does not ship any pre-configured WLAN Services, VNSs, orRoles.10 Install, register, and assign APs to the VNS.•Confirm the latest firmware version is loaded. For more information, see Performing AP SoftwareMaintenance on page 235.•Deploy APs to their corresponding network locations.•If applicable, configure a default AP template for common radio assignment, whereby APsautomatically receive complete configuration. For typical deployments where all APs are to havethe same configuration, this feature will expedite deployment, as an AP will automatically receivefull configuration (including VNS-related assignments) upon initial registration with thecontroller. If applicable, modify the properties or settings of the APs. For more information, see Configuring the ExtremeWireless APs on page 101.•Connect the APs to the controller.•Once the APs are powered on, they automatically begin the Discovery process of the controller,based on factors that include:•Their Registration mode (on the AAP Registration screen)•The enterprise network services that will support the discovery processLogging on to the ExtremeWireless Appliance1 Start your Web browser (Internet Explorer version 11 or later, FireFox, or Chrome).See the Release Notes for the supported web browsers.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide33
Draft2 In the browser address bar, type the following, using the IP address of your controller:https://192.168.10.1:5825This launches the Wireless Assistant. The login screen displays.3 Type your user name and password and click Login . The WWireless Assistant Home screen displays.NoteThe default User Name is "admin". The default Password is "abc123".Wireless Assistant Home ScreenThe WWireless Assistant Home screen provides real-time status information on the current state of thewireless network. Information is grouped under multiple functional areas, and the Wireless AssistantHome Screen provides a graphical representation of information related to the active APs (such as thenumber of wired packets, stations, and total APs). Navigate the Wireless Assistant using the top menubar tabs.Figure 6: Wireless Assistant Top Menu BarThe bottom status bar displays the type and description of the current wireless controller, user andadmin login status, flash status, software version and the number of admin users currently logged intothe controller.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide34
raftFigure 7: Wireless Assistant Home ScreenTable 5 describes the panes on the WWireless Assistant Home Screen.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide35
DraftTable 5: Wireless Assistant Home ScreenHHome Screen Heading DescriptionNetwork Status Includes real-time totals for the following components. Click the numberdisplayed to display additional information, such as name, serial number, and IPaddress.•Local APs - total number of active or inactive local configured APs.•Foreign APs - total number of active or inactive foreign configured APs.Availability pair must be configured to display additional information.•Pending APs - total APs pending verification.•Load Groups - total active load groups. Click to display the Active WirelessLoad Groups report.•Local Stations - total number of active mobile stations. Click to display the AllActive Client report.•Local & Foreign - total number of active and foreign stations. Click to displaythe All Active Client report.•VNS - total defined VNSs (enabled and disabled). Click to display the totalnumber of enabled and disabled VNS assignments, respectively, configuredon the system.•Availability - status of the controller availability. Click to display controllersettings (Stand-alone, Paired, Fast Failover FFO).•Mobility Tunnels - status of the mobility tunnel. Click to display controllersettings.Admin Sessions Displays information on the total number of recent administrative activitiesincluding:•Read/Write sessions - total number of currently active GUI and CLI (eitherSSH or serial console ones) Read/Write sessions.•Read-only sessions - total number of currently active GUI and CLI (either SSHor serial console ones) Read only sessions.•Guest Access sessions - total number of currently active GuestPortal Managersessions that can only be achieved through the GUI.•Auth Type - lists the presently configured login mode.Click each heading to access the Wireless Controller > Login Managementscreen. For more information, see Configuring the Login Authentication Mode onpage 75.Stations by Protocol Displays a graphical representation of the total number of active stationsgrouped by protocol.Click the Stations by Protocol heading to access the All Active Clients Report.For more information, see Viewing Statistics for APs on page 627.APs by Channel Displays a graphical representation of the total number of active stations and thenumber of APs.Click the APs by Channel heading to access the Active Wireless AP Report. Formore information, see Viewing Statistics for APs on page 627.Stations by AP Displays a graphical representation of the total number of active APs grouped bychannel.Click the Status by AP heading to access the Active Clients by Wireless APsReport. For more information, see Viewing Statistics for APs on page 627.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide36
DraftTable 5: Wireless Assistant Home Screen (continued)HHome Screen Heading DescriptionApplications by WLAN If Application Visibility is enabled on the WWLAN Configuration screen, a pie chartdisplaying the top five applications on that WLAN displays. If ApplicationVisibility is not enabled, click Enable Application Visibility to display the Apps,operating systems, and devices used by clients.The Application Visibility option displays the following information for clientsassociated with a selected WLAN:•IPv4 and IPv6 Addresses•Host Name•Operating System•Device Type•Top 5 Application Groups by Throughput (2-minute interval)•Top 5 current Application Groups by Bytes, from session start.•Throughput chart for an application group.•Average TCP Round Trip Time.•Average DNS Round Trip Time.For more information, see Enabling Application Visibility with DeviceIdentification on page 626 and Device Identification on page 625.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide37
DraftTable 5: Wireless Assistant Home Screen (continued)HHome Screen Heading DescriptionLicensing Displays licensing information including:•License mode: License Manager can operate in Lone or Paired mode.Lone (standalone) - Only local APs are counted against locallyinstalled capacity keys. ALL Radar In-Service and Guardian APs arecounted against locally installed Radar keys. This is the default licensemode. License Manager switches to Paired mode on the followingconditions: Availability is enabled while License Manager is runningand it receives a license request or Availability is enabled before theLicense Manger starts up and the database has counters for the peerscapacity and Radar keys.Paired - Both local and foreign APs are counted against sum of locallyinstalled capacity keys and capacity keys, pooled from the peercontroller. ALL Radar In-Service and Guardian APs are countedagainst sum or locally installed Radar keys, installed on the peercontroller. License Manager switches to Lone (standalone) mode ifAvailability is disabled or if the peer IP address is changed.•Unused AP Licenses: total number of unassigned AP licenses (for moreinformation, see Applying Product License Keys on page 47).•Local AP Licenses: total number of AP licenses local to the primary controller.•Foreign AP Licenses: total number of AP licenses local to the secondary(backup) controller.•Local Radar Licenses: total number of Radar licenses local to the primarycontroller.•Foreign Radar Licenses: total number of Radar licenses local to the secondary(backup) controller.•Unused Radar Licenses: total number of unassigned licenses for Radar (formore information, see Radar License Requirements on page 565).•Days Remaining: number of days remaining on this license key.•Regulatory Domain: Domain information for this license period.Click the Licensing heading to access the Wireless Controller > SoftwareMaintenance screen. For more information, see Installing the License Keys onpage 49.Health Displays network health statistics including:•Local AP Uptime (min)•APs with > 30 clients•APs in low power modeThis feature is for AP39xx only. This option displays when there is oneor more AP39xx in low power mode. Click to display details of the AP.•Failed VNS RADIUS TxsClick each heading to access the Active Wireless APs Report. For moreinformation, see Viewing Statistics for APs on page 627.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide38
DraftTable 5: Wireless Assistant Home Screen (continued)HHome Screen Heading DescriptionRadar Displays totals for the following security related statistics:•AP Remote Access - click to access the APs > AP Registration page•Unsecured WLANs - click to access the WLAN Security Report•Uncategorized APs - click to access the list of Uncategorized APs•Active Threats - click to access the Active Threats Report•Active Countermeasures - click to access the Active Countermeasures Report•APs denied by license - click to access the list of APs denied by licenseconstraints.For more information, see Wireless AP Registration on page 123, and Workingwith Radar Reports on page 593.Events Displays major events that impact network performance and eciency. Eachevent listed includes a timestamp of the event, the type or classification of theevent, which component is impacted by the event, and a log message providingspecific information for the event.Click the Events heading to access the Log > Logs & Traces page. For moreinformation, see Working with Reports and Statistics on page 621.Working with the Basic Installation WizardThe Extreme Networks ExtremeWireless system provides a basic installation wizard that can helpadministrators configure the minimum controller settings that are necessary to deploy a functioningExtremeWireless system solution on a network.Use the Basic Installation Wizard to quickly configure the controller for deployment, and later to revisethe controller configuration as needed.The Basic Installation Wizard launches when you log on to the controller for the first time and when thesystem has been reset to the factory default settings. You can also launch the wizard from the left paneof the controller CConfiguration screen anytime.To configure the controller using the Basic Installation Wizard:1 Log on to the controller. For more information, see Logging on to the ExtremeWireless Appliance onpage 33.2 From the top menu, click Controller. The WWireless Controller Configuration screen displays.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide39
aft3 In the left pane, click Administration > Installation Wizard.The BBasic Installation Wizard screen displays.4 In the Time Settings section, configure the controller timezone:•Continent or Ocean — Select the continent for the time zone.•Time Zone Region — Select the appropriate time zone region for the selected continent.5 To configure the controller’s time, do one of the following:•To manually set the controller time, click Set time. The Year, Month, Day, HR, and Min. fieldsdisplay, where you can use the drop-down lists to specify the time values.•To use the controller as the NTP time server, select the Run local NTP Server option. In theServer field, enter the IP address or Domain Name for the NTP server.•To use NTP to set the controller time, select the Use NTP option, and then type the IP address ofan NTP time server that is accessible on the enterprise network.The Network Time Protocol is a protocol for synchronizing the clocks of computer systems overpacket-switched data networks.6 In the Server field, enter the IP address or Domain Name for the NTP server.NoteThe Server Address field supports both IPv4 and IPv6 addresses.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide40
7 In the Topology Configuration section, the physical interface of the controller data port, the IPAddress and Netmask values for the data port, and the VLAN ID display as read-only values.For information on how to obtain a temporary IP address from the network, click How to obtain atemporary IP address.8 Click Next. The Management screen displaysBasic Installation Wizard - Management ScreenThe MManagement screen displays:1 In the AP Password section, enter a password for the AP. Click Unmask to display the passwordcharacters as you type. Access Points are shipped with default passwords. You must create a newSSH Access Password here.NotePasswords can include the following characters: A-Z a-z 0-9 ~!@#$%^&*()_+|-=\{}[];<>?,.Password cannot include the following characters: / ` ' " : or a space.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide41
Draft2 In the Management Port section, confirm the port configuration values that were defined when thecontroller was physically deployed on the network. If applicable, edit these values:•Static IP Address — Displays the IPv4 address for the controller’s management port. Revise thisas appropriate for the enterprise network.•Netmask — Displays the appropriate subnet mask for the IP address to separate the networkportion from the host portion of the address.•Gateway — Displays the default gateway of the network.•Static IPv6 Address — Displays the IPv6 address for the controller’s management port. Revisethis as appropriate for the enterprise network.•Prefix Length — Length of the IPv6 prefix. Maximum is 64 bits.•Gateway — Displays the default gateway of the network.3 In the SNMP section, click V2c or V3 in the Mode drop-down list to enable SNMP (Simple NetworkManagement Protocol), if applicable.If you selected V2c, the Community options display:•Read Community — Type the password that is used for read-only SNMP communication.•Write Community — Type the password that is used for write SNMP communication.•Trap Destination — Type the IP address of the server used as the network manager that willreceive SNMP messages.NoteThe Trap Destination Address field supports both IPv4 and IPv6 addresses.If you selected V3, the Syslog Server options display:•Enable — Click to enable Syslog Server.•IP Address — Enter the IP address for the Syslog Server.4 In the OSPF section, select the Enable check box to enable OSPF, if applicable. Use OSPF to allowthe controller to participate in dynamic route selection. OSPF is a protocol designed for medium andlarge IP networks with the ability to segment routes into dierent areas by routing informationsummarization and propagation.Do the following:•Area ID — Type the desired area. Area 0.0.0.0 is the main area in OSPF.5 In the Syslog Server section, select the Enable check box to enable the syslog protocol for thecontroller, if applicable. Syslog is a protocol used for the transmission of event notification messagesacross networks.In the IP Address field, type the IP address of the syslog server.NoteThe Syslog Server IP Address field supports both IPv4 and IPv6 addresses.6 Click Next. The Services screen displays.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide42
aftBasic Installation Wizard - Services Screen1 In the RADIUS section, select the Enable check box to enable RADIUS login authentication, ifapplicable.RADIUS login authentication uses a RADIUS server to authenticate user login attempts. RADIUS is aclient/server authentication and authorization access protocol used by a network access server(NAS) to authenticate users attempting to connect to a network device.Do the following:•Server Alias — Type a name that you want to assign to the RADIUS server. You can type a nameor IP address of the server.•IP Address — Type the RADIUS server's hostname or IP address.•Shared Secret — Type the password that will be used to validate the connection between thecontroller and the RADIUS server.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide 443
Draft2 In the Mobility section, select the Enable check box to enable the controller mobility feature, ifapplicable. Mobility allows a wireless device user to roam seamlessly between dierent APs on thesame or dierent controllers.A dialog informs you that NTP is required for the mobility feature and prompts you to confirm youwant to enable mobility.NNoteIf the ExtremeWireless Appliance is configured as a mobility agent, it will act as an NTPclient and use the mobility manager as the NTP server. If the appliance is configured as amobility manager, its local NTP will be enabled for the mobility domain.3 Click OK to continue, and then do the following:•Role — Select the role for the controller, Manager or Agent. One controller on the network isdesignated as the mobility manager and all other controllers are designated as mobility agents.•Port — Click the interface on the controller to be used for communication between mobilitymanager and mobility agent. Ensure that the selected interface is routable on the network. Formore information, see Configuring Mobility on page 555.•Manager IP — Type the IP address of the mobility manager port if the controller is configured asthe mobility agent.4 In the Default VNS section, select the Enable check box to enable a default VNS for the controller.NoteRefer to Virtual Network Services on page 22 for more information about the default VNS.The default VNS parameters display.5 Click Finish.The Success screen displays.Basic Installation Wizard - Success ScreenConfiguring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide44
aft1 We recommend that you change the factory default administrator password.2 To change the administrator password:a Type a new administrator password in the New Password.b Confirm the new password in the Confirm Password field.c Click Save. Your new password is saved.3 Click OK, and then click Close.NNoteThe ExtremeWireless Appliance reboots after you click Save if the time zone is changedduring the Basic Install Wizard. If the IP address of the management port is changedduring the configuration with the Basic Install Wizard, the ExtremeWireless Assistantsession is terminated and you will need to log back in with the new IP address.The WWireless Assistant home screen displays.Configuring the ExtremeWireless Appliance for the First TimeAfter the ExtremeWireless Appliance is deployed, perform the following configuration tasks:Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide45
Draft•Changing the Administrator Password on page 46•Applying Product License Keys on page 47•Setting Up the Data Ports on page 51•Setting Up Internal VLAN ID and Multicast Support on page 58•Setting Up Static Routes on page 59•Setting Up OSPF Routing on page 61•Configuring Filtering at the Interface Level on page 65•Protecting Controller Interfaces and the Internal Captive Portal Page on page 69•Configuring the Login Authentication Mode on page 75•Configuring SNMP on page 85•Configuring Network Time on page 89•Configuring DNS Servers for Resolving Host Names of NTP and RADIUS Servers on page 94The basic installation wizard automatically configures aspects of the controller deployment. You canmodify that configuration according to your network specifications.Changing the Administrator PasswordExtreme Networks recommends that you change your default administrator password once yoursystem is deployed. The ExtremeWireless Appliance default password is abc123. When the controller isinstalled and you elect to change the default password, the new password must be a minimum of eightcharacters.The minimum eight character password length is not applied to existing passwords. For example, if a sixcharacter password is already being used and an upgrade of the software is performed, the softwaredoes not require the password to be changed to a minimum of eight characters. However, once theupgrade is completed and a new account is created, or the password of an existing account is changed,the new password length minimum will be enforced.To Change the Administrator Password:1 From the top menu, click Controller.2 In the left pane, click Login Management.3 In the Full Administrator table, click the administrator user name.4 In the Password field, type the new administrator password.5 In the Confirm Password field, type the new administrator password again.6 Click Change Password.NNoteThe ExtremeWireless Controller provides you with local login authentication mode, theRADIUS-based login authentication mode, and combinations of the two authenticationmodes. The local login authentication is enabled by default. For more information, see Configuring the Login Authentication Mode on page 75.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide46
DraftApplying Product License KeysThe controller’s license system works on simple software-based key strings. A key string consists of aseries of numbers and/or letters. Using these key strings, you can license the software, and enhance thecapacity of the controller to manage additional APs.The key strings can be classified into the following variants:•Activation Key — Activates the software. This key is further classified into sub-variants:•Temporary Activation Key — Activates the software for a trial period of 90 days.•Permanent Activation Key — Activates the software for an infinite period.•Cloud provider license.•Subscription license.NNoteYou must obtain a specific activation key to run release v10.01 or later. Once installed, thenumber of available Radar licenses increments by 2.•Option Key — Activates the optional feature:•Capacity Enhancement Key Format — For AP:Enhances the capacity of the controller to manage additional APs.You may have to add multiple capacity enhancement keys to reach the ExtremeWireless's limit.Depending on the appliance model, a capacity enhancement key adds the following APs:C5110 — Adds 25 wireless APsC5210 — Adds 25 or 100 wireless APsC5215 — Adds 25 or 100 wireless APsC4110 — Adds 25 wireless APsC25 — Adds 1 or 16 wireless APsC35 — Adds 1 or 16 wireless APsV2110 — Adds 1 or 16 wireless APsNoteIf you connect additional wireless APs to an ExtremeWireless controller that has apermanent activation key without installing a capacity enhancement key, a graceperiod of seven days will start. You must install the correct key during the grace period.If you do not install the key, the controller will start generating event logs every 15minutes, indicating that the key is required. In addition, you will not be able to edit theVirtual Network Services (VNS) parameters.•Capacity Enhancement Key Format — For Radar:Enhances the capacity of the controller to manage Radar licenses for multiple APs. Radarcapacity licenses are only required for In-Service Scan Profiles (for more information, see RadarLicense Requirements on page 565). The capacity enhancement key includes a capacityincrement which determines the number of APs supported as follows:License format: RADCAP<nnn> (where <nnn> is the capacity increment):RADCAP001 — Adds 1 wireless APRADCAP016 — Adds 16 wireless APsConfiguring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide47
DraftRADCAP025 — Adds 25 wireless APsRADCAP100 — Adds 100 wireless APsNNoteAny AP assigned to an In-Service scan profile counts as 1 against the licensed Radarcapacity.The controller can be in the following licensing modes:•Unlicensed — When the controller is not licensed, it operates in ‘demo mode.’ In ‘demo mode,’ thecontroller allows you to operate as many APs as you want, subject to the maximum limit of theplatform type. In demo mode, you can use only the b/g radio, with channels 6, 11, and auto. 11nsupport and Mobility are disabled in demo mode.•Licensed with a temporary activation key — A temporary activation key comes with a regulatorydomain. With the temporary activation key, you can select a country from the domain and operatethe APs on any channel permitted by the country. A temporary activation key allows you to use allsoftware features. You can operate as many APs as you want, subject to the maximum limit of theplatform type.A temporary activation key is valid for 90 days. Once the 90 days are up, the temporary key expires.You must get a permanent activation key and install it on the controller. If you do not install apermanent activation key, the controller will start generating event logs every 15 minutes, indicatingthat an appropriate license is required for the current software version. In addition, you will not beable to edit the Virtual Network Services (VNS) parameters.•Cloud Provider — A Cloud Provider license is valid for a period of 5 years. License pooling is notsupported because the values are set at the platform limits. Cloud Provider licenses enable local APswith the system limit of the platform, while the radar licenses are set at twice the system limits. e.g.for V2110 medium, local AP licenses available are 250 and Local radar licenses available are 500.•Subscription — A subscription license can be generated for a period between 1 to 255 days. Licensepooling is not supported because the values are set at the platform limits. A Subscription licenseenables local APs with the system limit of the platform, while the radar licenses are set at twice thesystem limits. e.g. for V2110 medium, local AP licenses available are 250 and Local radar licensesavailable are 500.•Licensed with permanent activation key — A permanent activation key is valid for an infiniteperiod. In addition, unlike the temporary activation key, the permanent activation key allows you tooperate a stipulated number of the APs, depending upon the platform type. If you want to connectadditional APs, you have to install a capacity enhancement key. You may even have to install multiplecapacity enhancement keys to reach the controller’s limit.The Table 6 lists the platform type and the corresponding number of the APs allowed by thepermanent activation key.Table 6: Platform Type / Wireless APs Allowed by Permanent Activation KeyPlatform Wireless APs permitted bypermanent activation keyPlatform’s optimumlimitNumber of capacity enhancementkeys to reach the optimum limitC25 16 50 4 to 34 (depending on theenhancement license type used)C35 50 125 15 to 75 (depending on theenhancement license type used)Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide48
DraftTable 6: Platform Type / Wireless APs Allowed by Permanent Activation Key(continued)PPlatform Wireless APs permitted bypermanent activation keyPlatform’s optimumlimitNumber of capacity enhancementkeys to reach the optimum limitC4110 50 250 8C5110 150 525 15C5210 100 1000 9 to 36 (depending on theenhancement license type used)C5215 100 1000 9 to 36 (depending on theenhancement license type used)V2110 (Small) 8 50 17 to 42 (depending on theenhancement license type used)V2110(Medium)8 250 12 to 242 (depending on theenhancement license type used)V2110 (Large) 8 525 37 to 517 (depending on theenhancement license type used)If the controller detects multiple license violations, such as capacity enhancement, a grace periodcounter starts from the moment the first violation occurred. The controller generates event logs forevery violation. To leave the grace period, clear all outstanding license violations.The controller can be in an unlicensed state for an infinite period. However, if you install a temporaryactivation key, the unlicensed state is terminated. After the validity of a temporary activation key andthe related grace period expire, the controller generates event logs every 15 minutes, indicating that anappropriate license is required for the current software version. In addition, you will not be able to editthe Virtual Network Services (VNS) parameters.License PoolingIf the controller is paired with an availability partner, you can redistribute licenses when a CapacityEnhancement Key (AP or Radar) is installed. Both controllers must be running at least v9.01 and bothmembers must have a permanent license key. Separate pools will be introduced for each type of license,and licenses installed on either member of an availability pair are shared across the pair automatically.License pooling is supported in fast failover and legacy availability setups. The limit of distribution is setby the license key; therefore if a controller has two keys of 25 APs each, then you will be allowed totransfer 25 or 50 APs to the former peer controller (for more information, see Availability on page 537).License pooling is not supported for Cloud Provider and Subscription license types since the values arealready set at the platform system limits.Installing the License KeysThis section describes how to install the license key on the controller. It does not explain how togenerate the license key. For information on how to generate the license key, see the ExtremeWirelessLicense Certificate, which is sent to you via traditional mail.For more information on licensing, see Licensing Considerations on page 108.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide49
tYou have to type the license keys on the Wireless Assistant GUI.To install the license keys:1 From the top menu, click Controller.2 In the left pane, click Administration > Software Maintenance.3 Click the EWC Product Keys tab.The bottom pane displays the license summary.Figure 8: Product Keys Tab4 If you are installing a temporary or permanent activation license key, type the key in the ActivationKey field, and then click the Apply Activation Key button.5 If you are installing a capacity enhancement, type the key in the Option Key field, and then click theApply Option Key button.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide 550
raft6 To view installed keys, click View Installed Keys. The IInstalled Licensed Keys dialog displays.Figure 9: Installed License KeysSetting Up the Data PortsA new controller is shipped from the factory with all its data ports set up. Support of managementtrac is disabled on all data ports. By default, data interface states are enabled. A disabled interfacedoes not allow data to flow (receive/transmit).Physical ports are represented by the L2 (Ethernet) Ports. The L2 port can be accessed from L2 Portstabs under ExtremeWireless Controller Configuration. The L2 Ports cannot be removed from the systembut their operational status can be changed. Refer to Viewing and Changing the L2 Ports Informationon page 52.Link Aggregation ports are represented by the L2 (peer-to-peer) LAG (Link Aggregation Group) Ports.The L2 port and Topology information can be accessed from L2 Ports and Topology tabs underExtremeWireless Controller Configuration. The LAG L2 Ports cannot be removed from the system buttheir operational status can be changed. Refer to Viewing and Changing the L2 Ports Information onpage 52.NoteYou can redefine a data port to function as a Third-Party AP Port. Refer to Viewing andChanging the Physical Topologies on page 54 for more information.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide51
DraftViewing and Changing the L2 Ports InformationTo view and change the l2 port information:1 From the top menu, click Controller.2 In the left pane, click Network > L2 Ports. The LL2 Ports tab is displayed.3 The L2 Ports tab presents the Physical (that is, Ethernet) and LAG (peer to peer) data ports thatexist on the controller. These ports cannot be deleted and new ones cannot be created.LAG ports are statically configured by adding/removing physical ports from the LAG. Physical portbelong to at most one LAG at one time. L2 port attached to a LAG port does not have any propertiesand could not be attached to any topology. The L2 ports attached to LAG ports can be enabled ordisabled. Optional, if changes occur to the port physical parameters (speed, half or full duplex), awarning will be displayed to indicate that the L2 port does not meet LAG conditions.Considerations for attaching/detaching regular L2 ports to LAG ports:•Regular L2 port should not have any bridged and physical topologies associated with the port.•Regular L2 port should not be disabled.•L2 ports can be detached from LAG ports regardless of any topologies attached to the LAG port.•If the L2 port is the last remaining in LAG, a warning will be issued. If last port of the LAG hasbeen detached, the LAG should be in operational DOWN state.•After detaching the L2 port, it could be attached to any bridged or physical topology or pointsvia a routing table to the port any Routed topology.•Jumbo Frames support is a feature that allows the configuration of physical MaximumTransmission Unit (MTU) sizes larger than the standard 1500 bytes on the AP and controller.When Jumbo Frames is enabled, the maximum MTU is 1800 bytes.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide52
Draft4 Assigning any bridged or physical topology without specifying an L2 port is not supported.However, you can move any bridged and physical topology to either a physical or LAG L2 port.Physical:•C5110 — Three data ports, displayed as esa0, esa1, and esa2.•C5210 — Four data ports, displayed as esa0, esa1, esa2, and esa3.•C5215 — Four data ports, displayed as esa0, esa1, esa2, and esa3.•C4110 — Four data ports, displayed as Port1, Port2, Port3, and Port4.•C25 — Two data ports, displayed as esa0 and esa1.•C35 — Four data ports, displayed as esa0, esa1, esa2, and esa3.•V2110 — Two data ports, displayed as esa0 and esa1.Link Aggregation:•C5110 — One data port, displayed as lag1•C5210 — Two data ports, displayed as lag1 and lag2.•C5215 — Two data ports, displayed as lag1 and lag2.•C4110 — Two data ports, displayed as lag1 and lag2.•C35 — Two data ports, displayed as lag1 and lag2.•C25 — One data port, displayed as lag1.5 An “Admin” port is created by default. This represents a physical port, separate from the other dataports, being used for management connectivity. For more information, see Configuring the AdminPort on page 263.Parameters displayed for the L2 Ports are:•Operational status, represented graphically with a green checkmark (UP) or red X (DOWN). Thisis the only configurable parameter.•Port name, as described above.•MAC address, as per Ethernet standard.•Untagged VLAN, displays the associated untagged VLAN ID. This ID is unique among topologies.•Tagged VLAN, displays the associated tagged VLAN ID.•Attached Physical L2 Ports (Link Aggregation L2 Ports only) select the physical L2 portsassociated with the link aggregation L2 Ports.NoteRefer to Viewing and Changing the Physical Topologies on page 54 for more informationabout L2 port topologies.6 If desired, change the operational status by clicking the Enable check box.You can change the operational state for each port. By default, data interface states are enabled. Ifthey are not enabled, you can enable them individually. A disabled interface does not allow data toflow (receive/transmit).7 If support of MTU sizes above 1500 bytes is required, click Enable Jumbo Frames support. This willextend the MTU size to 1800 bytes on the data link layer.Enabling Jumbo Frames support requires that port speed to be 1Gbps or higher on the controllerand the APs which support Jumbo Frames. Jumbo Frames are not supported on 10 or 100 Mbpsspeeds.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide53
ftViewing and Changing the Physical TopologiesTo view and change the L2 Port topologies:1 From the top menu, click Controller.2 In the left pane, click Network > Topologies.An associated topology entry is created by default for each L2 Port with the same name.The TTopologies tab is displayed.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide54
Draft3 To make changes, select a specific topology.The EEdit Topology dialog appears.For the data ports predefined in the system, Name and Mode are not configurable.4 Optionally, configure one of the physical topologies for Third Party AP connectivity by clicking the3rd Party AP Topology check box.You must configure a topology to which you will be connecting third-party APs by checking thisbox. Only one topology can be configured for third-party APs.Third-party APs must be deployed within a segregated network for which the controller becomesthe single point of access (i.e., routing gateway). When you define a third-party AP topology, theinterface segregates the third-party AP from the remaining network.5 To configure an interface for VLAN assignment, configure the VLAN Settings in the Layer 2 box.When you configure a controller port to be a member of a VLAN, you must ensure that the VLANconfiguration (VLAN ID, tagged or untagged attribute, and Port ID) is matched with the correctconfiguration on the network switch.6 To replicate topology settings, click Synchronize in the Status field.7 If the desired IP configuration is dierent from the one displayed, change the Interface IP and Maskaccordingly in the Layer 3 box.For this type of data interface, the Layer 3 check box is selected automatically. This allows for IPInterface and subnet configuration together with other networking services.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide55
Draft8 The MTU value specifies the Maximum Transmission Unit or maximum packet size for this topology.The fixed value is 1500 bytes for physical topologies.If you are using OSPF, be sure that the MTU of all the interfaces in the OSPF link match.NoteIf the routed connection to an AP traverses a link that imposes a lower MTU than thedefault 1500 bytes, the controller and AP participate in automatic MTU discovery andadjust their settings accordingly. At the controller, MTU adjustments are tracked on a perAP basis. If the ExtremeWireless software cannot discover the MTU size, it enforces thestatic MTU size.9 To enable AP registration through this interface, select the AP Registration check box.Wireless APs use this port for discovery and registration. Other controllers can use this port toenable inter-controller device mobility if this port is configured to use SLP or the controller isrunning as a manager and SLP is the discovery protocol used by the agents.10 To enable management trac, select the Management Trac check box. Enabling managementprovides access to SNMP (v1/v2c, v3), SSH, and HTTPs management interfaces.DDNoteThis option does not override the built-in protection filters on the port. The built-inprotection filters for the port, which are restrictive in the types of packets that are allowedto reach the management plane, are extended with a set of definitions that allow foraccess to system management services through that interface (SSH, SNMP, HTTPS:5825).11 To enable the local DHCP Server on the controller, in the DHCPfield, select Local Server. Then, clickon the Configure button to open the DDHCP configuration pop-up window.NoteThe local DHCP Server is useful as a general-purpose DHCP Server for small subnets.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide56
Drafta In the Domain Name field, type the name of the domain that you want the APs to use for DNSServer’s discovery.b In the Lease (seconds) default field, type the time period for which the IP address will beallocated to the APs (or any other device requesting it).c In the Lease (seconds) max field, type the maximum time period in seconds for which the IPaddress will be allocated to the APs.d In the DNS Servers field, type the DNS Server’s IP address if you have a DNS Server.e In the WINS field, type the WINS Server’s IP address if you have a WINS Server.NNoteYou can type multiple entries in the DNS Servers and WINS fields. Each entry must beseparate by a comma. These two fields are not mandatory to enable the local DHCPfeature.f In the Gateway field, type the IP address of the default gateway.DDDNoteSince the controller is not allowed to be the gateway for the segment, including APs,you cannot use the Interface IP address as the gateway address for physical andBridged at Controller topology. For Routed topology, the controller IP address must bethe gateway.g Configure the address range from which the local DHCP Server will allocate IP addresses to theAPs.•In the Address Range: from field, type the starting IP address of the IP address range.•In the Address Range: to field, type the ending IP address of the IP address range.h Click the Exclusion(s) button to exclude IP addresses from allocation by the DHCP Server. TheDHCP Address Exclusion window opens.The controller automatically adds the IP addresses of the Interfaces (Ports), and the default gatewayto the exclusion list. You cannot remove these IP addresses from the exclusion list.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide57
Draft•Select Range. In the From field, type the starting IP address of the IP address range that youwant to exclude from the DHCP allocation.•In the To field, type the ending IP address of the IP address range that you want to exclude fromthe DHCP allocation.•To exclude a single address, select the Single Address radio button and type the IP address in theadjacent field.•In the Comment field, type any relevant comment. For example, you can type the reason forwhich a certain IP address is excluded from the DHCP allocation.•Click Add. The excluded IP addresses are displayed in the IP Address(es) to exclude from DHCPAddress Range field.•To delete a IP Address from the exclusion list, select it in the IP Address(es) to exclude fromDHCP Range field, and then click Delete.•To save your changes, click OK.NNoteThe Broadcast (B’cast) Address field is view only. This field is computed from the maskand the IP addresses.Setting Up Internal VLAN ID and Multicast SupportYou can configure the Internal VLAN ID, and enable multicast support. The internal VLAN used onlyinternally and is not visible on the external trac. The physical topology used for multicast isrepresented by a physical topology to/from which the multicast trac is forwarded in conjunction withConfiguring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide58
ftthe virtual routed topologies (and VNSs) configured on the controller. Please note that no multicastrouting is available at this time.To configure the Internal VLAN ID and enable multicast support:1 From the top menu, click Controller.2 In the left pane, click Network > Topologies.The TTopologies tab is displayed.3 In the Internal VLAN ID field, type the internal VLAN ID.4 From the Multicast Support drop-down list, select the desired physical topology.5 To save your changes, click Save.Setting Up Static RoutesWhen setting up a controller routing protocol, you must define a default route to your enterprisenetwork, either with a static route or by using the OSPF protocol. A default route enables the controllerto forward packets to destinations that do not match a more specific route definition.To Set a Static Route on the controller:Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide59
raft1 From the top menu, click Controller.The WWireless Controller Configuration screen displays.2 In the left pane, click Network > Routing Protocols.The SStatic Routes tab is displayed.3 To add a new route, click New, and in the EEdit route dialog, enter the following information:•In the Destination Address field, type the IP address of the destination controller.To define a default static route for any unknown address not in the routing table, type 0.0.0.0.•In the Subnet Mask field, type the appropriate subnet mask to separate the network portion fromthe host portion of the IP address (typically 255.255.255.0). To define the default static route forany unknown address, type 0.0.0.0.•In the Gateway field, type the IP address of the adjacent router port or gateway on the samesubnet as the controller to which to forward these packets. This is the IP address of the next hopbetween the controller and the packet’s ultimate destination.•Select the Override dynamic routes check box to give priority over the OSPF learned routes,including the default route, which the controller uses for routing. This option is enabled bydefault.•To remove this priority for static routes, so that routing is controlled dynamically at all times, clearthe Override dynamic routes check box.NoteIf you enable dynamic routing (OSPF), the dynamic routes will normally have priorityfor outgoing routing. For internal routing on the controller, the static routes normallyhave priority.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide60
Draft4 To save your changes, click Save.Viewing the Forwarding TableYou can view the defined routes, whether static or OSPF, and their current status in the forwardingtable.To view the forwarding table on the controller:1 From the Routing Protocols Static Routes tab, click View Forwarding Table. The Forwarding Tableis displayed.2 Alternatively, from the top menu, click Reports. The AAvailable AP Reports screen displays.3 In the left pane, click Routing Protocols, then click Forwarding Table.The FForwarding Table is displayed.This report displays all defined routes, whether static or OSPF, and their current status.4 To update the display, click Refresh.Setting Up OSPF RoutingOpen Shortest Path First (OSPF) is a robust link-state routing protocol. OSPF forms adjacencies withneighbors and shares information via the Designated Router (DR) and Backup DR using link stateadvertisements. Areas in OSPF are used to limit LSAs and summarize routes. Everyone connects to areazero, the backbone.Related LinksEnabling OSPF Routing on page 62Setting OSPF Routing Settings on page 62Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide61
DraftConfirming OSPF Ports on page 65Enabling OSPF RoutingTo enable OSPF (OSPF RFC2328) routing, you must:1 Specify at least one topology on which OSPF is enabled on the Port Settings option of the OSPF tab.This is the interface on which you can establish OSPF adjacency.2 Enable OSPF globally on the controller.3 Define the global OSPF parameters.4 Ensure that the OSPF parameters defined here for the controller are consistent with the adjacentrouters in the OSPF area. This consistency includes the following:•If the peer router has dierent timer settings, the protocol timer settings in the controller mustbe changed to match to achieve OSPF adjacency.•The MTU of the ports on either end of an OSPF link must match. The MTU for ports on thecontroller is fixed at 1500. This matches the default MTU in standard routers. The maximum MTUcan be increased to 1800 bytes by enabling Jumbo Frames support (for more information, see Setting Up the Data Ports on page 51).It is important to ensure that the MTU of the ports on either end of an OSPF link match. If there is amismatch in the MTU, then the OSPF adjacency between the controller and the neighboring routermight not get established.Related LinksSetting Up OSPF Routing on page 61Setting OSPF Routing Settings on page 62Confirming OSPF Ports on page 65Setting OSPF Routing SettingsTo set OSPF routing global settings on the controller:1 From the top menu, click Controller.2 In the left pane, click Network > Routing Protocols. The SStatic Routes tab is displayed by default.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide62
raft3 Click the OOSPF tab.4 From the OSPF Status drop-down list, click On to enable OSPF.In the Router ID field, type the IP address of the controller. This ID must be unique across the OSPFarea. If left blank, the OSPF daemon automatically picks a router ID from one of the controller’sinterface IP addresses.5 In the Area ID field, type the area. 0.0.0.0 is the main area in OSPF.6 In the Area Type drop-down list, click one of the following:•Default — The default acts as the backbone area (also known as area zero). It forms the core ofan OSPF network. All other areas are connected to it, and inter-area routing happens via a routerconnected to the backbone area.•Stub — The stub area does not receive external routes. External routes are defined as routeswhich were distributed in OSPF via another routing protocol. Therefore, stub areas typically relyon a default route to send trac routes outside the present domain.•Not-so-stubby — The not-so-stubby area is a type of stub area that can import autonomoussystem (AS) external routes and send them to the default/backbone area, but cannot receive ASexternal routes from the backbone or other areas.7 To save your changes, click Save.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide63
Draft8 To add a new OSPF interface, click New or select a port to configure by clicking on the desired portin the Port Settings table.The EEdit Port dialog displays.9 In the Link Cost field, type the OSPF standard value for your network for this port. This is the cost ofsending a data packet on the interface. The lower the cost, the more likely the interface is to be usedto forward data trac.DNoteIf more than one port is enabled for OSPF, it is important to prevent the controller fromserving as a router for other network trac (other than the trac from wireless deviceusers on routed topologies controlled by the controller). For more information, see PolicyRules on page 288.10 In the Authentication drop-down list, click the authentication type for OSPF on your network: Noneor Password. The default setting is None.11 If Password is selected as the authentication type, in the Password field, type the password.If None is selected as the Authentication type, leave this field empty. This password must match oneither end of the OSPF connection.12 Type the following:•Hello-Interval — Specifies the time in seconds (displays OSPF default).The default setting is 10seconds.•Dead-Interval — Specifies the time in seconds (displays OSPF default). The default setting is 40seconds.•Retransmit-Interval — Specifies the time in seconds (displays OSPF default). The default settingis 5 seconds.•Transmit Delay— Specifies the time in seconds (displays OSPF default). The default setting is 1second.13 To save your changes, click Save.Related LinksSetting Up OSPF Routing on page 61Enabling OSPF Routing on page 62Confirming OSPF Ports on page 65Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide64
DraftConfirming OSPF PortsTo confirm that the ports are set up for OSPF, and that advertised routes from the upstream router arerecognized:1 Click View Forwarding Table. The FForwarding Table is displayed.The following additional reports display OSPF information when the protocol is in operation:•OSPF Neighbor — Displays the current neighbors for OSPF (routers that have interfaces to acommon network)•OSPF Linkstate — Displays the Link State Advertisements (LSAs) received by the currentlyrunning OSPF process. The LSAs describe the local state of a router or network, including thestate of the router’s interfaces and adjacencies.2 To update the display, click Refresh.Related LinksSetting Up OSPF Routing on page 61Enabling OSPF Routing on page 62Setting OSPF Routing Settings on page 62Configuring Filtering at the Interface LevelThe ExtremeWireless solution has a number of built-in filters that protect the system from unauthorizedtrac. These filters are specific only to the controller. These filters are applied at the network interfacelevel and are automatically invoked. By default, these filters provide stringent-level rules to allow onlyaccess to the system's externally visible services. In addition to these built-in filters, the administratorcan define specific exception filters at the interface-level to customize network access. These filtersdepend on Topology Modes and the configuration of an L3 interface for the topology.For Bridged at Controller topologies, exception filters are defined only if L3 (IP) interfaces are specified.For Physical, Routed, and 3rd Party AP topologies, exception filtering is always configured since they allhave an L3 interface presence.Built-in Interface-based Exception FiltersOn the controller, various interface-based exception filters are built in and invoked automatically. Thesefilters protect the controller from unauthorized access to system management functions and servicesvia the interfaces. Access to system management functions is granted if the administrator selects theallow management trac option in a specific topology.Allow management trac is possible on the topologies that have L3 IP interface definitions. Forexample, if management trac is allowed on a physical topology (esa0), only users connected throughESA0 will be able to get access to the system. Users connecting on any other topology, such as Routedor Bridged Locally at Controller, will no longer be able to target ESA0 to gain management access tothe system. To allow access for users connected on such a topology, the given topology configurationitself must have allow management trac enabled and users will only be able to target the topologyinterface specifically.On the controller’s L3 interfaces (associated with either physical, Routed, or Bridged Locally atController topologies), the built-in exception filter prohibits invoking SSH, HTTPS, or SNMP. However,such trac is allowed, by default, on the management port.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide65
DIf management trac is explicitly enabled for any interface, access is implicitly extended to thatinterface through any of the other interfaces (VNS). Only trac specifically allowed by the interface’sexception filter is allowed to reach the controller itself. All other trac is dropped. Exception filters aredynamically configured and regenerated whenever the system's interface topology changes (forexample, a change of IP address for any interface).Enabling management trac on an interface adds additional rules to the exception filter, which opensup the well-known IP(TCP/UDP) ports, corresponding to the HTTPS, SSH, and SNMP applications.The interface-based built-in exception policy rules, in the case of trac from wireless users, areapplicable to trac targeted directly for the topology L3 interface. For example, a filter specified by aRole may be generic enough to allow trac access to the controller's management (for example, AllowAll [*.*.*.*]). Exception policy rules are evaluated after the user's assigned filter role, as such, it ispossible that the role allows the access to management functions that the exception filter denies. Thesepackets are dropped.To enable SSH, HTTPS, or SNMP access through a physical data interface:1 From the top menu, click Controller.2 In the left pane, click Network > Topologies. The TTopologies tab is displayed.3 On the Topologies tab, click the appropriate data port topology. The EEdit Topology window displays.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide66
Draft4 Select the Management Trac check box if the topology has specified an L3 IP interface presence.5 To save your changes, click Save.Working with Administrator-defined Interface-based Exception FiltersYou can add specific policy rules at the interface level in addition to the built-in rules. Such rules giveyou the capability of restricting access to a port, for specific reasons, such as a Denial of Service (DoS)attack.The policy rules are set up in the same manner as policy rules defined for a Role — specify an IPaddress, select a protocol if applicable, and then either allow or deny trac to that address. For moreinformation, see Policy Rules on page 288.The rules defined for port exception filters are prepended to the normal set of restrictive exceptionfilters and have precedence over the system's normal protection enforcement (that is, they areevaluated first).WWarningIf defined improperly, user exception rules may seriously compromise the system’s normalsecurity enforcement rules. They may also disrupt the system's normal operation and evenprevent system functionality altogether. It is advised to only augment the exception-filteringmechanism if absolutely necessary.To define interface exception filters:1 From the top menu, click Controller.2 In the left pane, click Network > Topologies. The TTopologiesscreen displays.3 Select a topology to be configured. The EEdit Topology window is displayed.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide67
aft4 If the topology has an L3 interface defined, an EException Filters tab is available. Select this tab.The Exception Filter rules are displayed.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide68
Draft5 Add rules by either:•Click Add Predefined , select a filter from the drop down list, and click Add.•Click Add, configure the following parameters, then click OK:In the IP / subnet:port field, type the destination IP address. You can also specify an IP range, aport designation, or a port range on that IP address.In the Protocol drop-down list, click the protocol you want to specify for the filter. This list mayinclude UDP, TCP, GRE, IPsec-ESP, IPsec-AH, ICMP (Internet Control Message Protocol). Thedefault is N/A.6 The new filter is displayed in the upper section of the screen.7 Click the new filter entry.8 To allow trac, select the Allow check box.9 To adjust the order of the policy rules, click Up or Down to position the rule. The policy rules areexecuted in the order defined here.10 To save your changes, click Save.Protecting Controller Interfaces and the Internal Captive Portal PageBy default, the controller is shipped with a self-signed certificate used to perform the following tasks:•Protect all interfaces that provide administrative access to the controller•Protect the internal Captive Portal pageThis certificate is associated with topologies that have a configured L3 (IP) interface.If you continue to use the default certificate to secure the controller and internal Captive Portal page,your web browser will likely produce security warnings regarding the security risks of trusting self-Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide69
Draftsigned certificates. To avoid the certificate-related web browser security warnings, you can installcustomized certificates on the controller.NNoteTo avoid the certificate-related web browser security warnings when accessing the controller,you must also import the customized certificates into your web browser application.Before Installing a CertificateBefore you create and install a certificate:1 Select a certificate format to install. The controller supports several types of certificates, as shown in Table 7.Table 7: Supported Certificate and CA FormatsCertificate Format DescriptionPKCS#12 The PKCS#12 certificate (.pfx) file contains both a certificate and thecorresponding private key.The controller will accept the PKCS#12 file as long as the format ofthe private key and certificate are valid.PEM/DER The PEM/DER certificate (.crt) file requires a separate PEM/DERprivate key (.key) file. The controller uses OpenSSL PKCS12command to convert the .crt and .key files into a single .pfx PKCS#12certificate file.The controller will accept the PEM/DER file as long as the format ofthe private key and certificate are valid.PEM-formatted CA public certificate file If you choose to install this optional certificate, you must do so whenspecifying the PCKCS#12 or PEM/DER certificates.NoteWhen generating the PKCS#12 certificate file or PEM/DER certificate and key files, youmust ensure that the interface identified in the certificate corresponds to the controller’sinterface for which the certificate is being installed.2 Understand how the controller monitors the expiration date of installed certificates.The controller generates an entry in the events information log as the certificate expiry dateapproaches, based on the following schedule: 15, 8, 4, 2, and 1 day prior to expiration. The logmessages cease when the certificate expires. For more information, refer to the Extreme NetworksExtremeWireless Maintenance Guide.3 Understand how the controller manages certificates during upgrades and migrations.Installed certificates will be backed up and restored with the controller configuration data. Installedcertificates will also be migrated during an upgrade and during a migration.Installing a Certificate for a Controller InterfaceTo install a certificate for a Controller Data Interface:1 From the top menu, click Controller.2 In the left pane, click Network > Topologies. The TTopologies tab is displayed.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide70
D3 Click the CCertificates tab. Topologies with an L3 interface will be listed.4 In the Interface Certificates table, click to select the topology for which you want to install acertificate.The CConfiguration for Topologies section displays.NoteThere are separate certificates if IPv4 and IPv6 is configured for Admin topology.The Configuration for Topologies section and the Generate Signing Request button becomeavailable. Use the field and button descriptions in Table 8 to create and install certificates.NoteThe certificate Common Name (CN) must match the interface IP or DNS addresses (Adminonly).Table 8: Topologies Page: Certificates Tab Fields and ButtonsField/Button DescriptionInterface CertificatesTopology Topology nameExpiry Date Date when the certificate expiresConfiguring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide71
DraftTable 8: Topologies Page: Certificates Tab Fields and Buttons (continued)FField/Button DescriptionCA Cert. Identifies whether or not a CA certificate has been installed on thetopology.Name (CN) The IP address of DNS address associated with the topology thatthe certificate applies to.Note: The Name field supports both IPv4 or IPv6 addresses.Org Unit (OU) Name of the organization’s unit.Organization Name of the organizationConfiguration for TopologyReplace/Install selected Topology’scertificateTo replace/install the existing port’s certificate and key using thisoption, do the following:1 From the click the Generate Signing Request button to createthe certificate and key.2 Download the CSR when prompted.3 Use a 3rd party certificate service to sign the CSR and create acertificate and a Certificate Authority (CA) file.4 Save the certificate on your computer.5 Return to the Certificates tab on the ExtremeWireless UI.6 Select the topology for which you created the certificate andselect Replace/Install selected Topologies certificate.7 Click Browse next to the Signed certificate to install field.8 Navigate to the certificate file you want to install for this port,and then click Open. The certificate file name is displayed in theCertificate file to install field.9 (Optional) Click Browse next to the Optional:Enter PEM-encoded CA public certificates file field. The Choose file dialogis displayed.10 (Optional) Navigate to the certificate file you want to install forthis port, and then click Open. The certificate file name isdisplayed in the Optional:Enter PEM-encoded CA publiccertificates file field.Note: If you choose to install a CA public certificate, you must installit when you install the PEM/DER certificate and key.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide72
DraftTable 8: Topologies Page: Certificates Tab Fields and Buttons (continued)FField/Button DescriptionReplace/Install selected Topology’scertificate and key from a single fileTo replace the existing port’s certificate and key using this option,do the following:1 Click Browse next to the PKCS #12 file to install field. TheChoose file dialog is displayed.2 Navigate to the certificate file you want to install for this port,and then click Open. The certificate file name is displayed in thePKCS #12 file to install field.3 In the Private key password box, type the password for the keyfile. The key file is password protected.4 (Optional) Click Browse next to the Optional:Enter PEM-encoded CA public certificates file field. The CChoose file dialogis displayed.5 (Optional) Navigate to the certificate file you want to install forthis port, and then click Open. The certificate file name isdisplayed in the Optional:Enter PEM-encoded CA publiccertificates file field.Note: If you choose to install a CA public certificate, you must installit when you install the PEM/DER certificate and key.Replace/Install selected Topology’scertificate and key from separate filesTo replace the existing port’s certificate and key using this option,do the following:1 Click Browse next to the PKCS #12 file to install field. TheChoose file dialog is displayed.2 Navigate to the certificate file you want to install for this port,and then click Open. The certificate file name is displayed in thePKCS #12 file to install field.3 Click Browse next to the Private key file to install field. TheChoose file dialog is displayed.4 Navigate to the key file you want to install for this port, and thenclick Open. The key file name is displayed in the Private key fileto install field.5 In the Private key password box, type the password for the keyfile. The key file is password protected.6 (Optional) Click Browse next to the Optional:Enter PEM-encoded CA public certificates file field. The CChoose file dialogis displayed.7 (Optional) Navigate to the certificate file you want to install forthis port, and then click Open. The certificate file name isdisplayed in the Optional:Enter PEM-encoded CA publiccertificates file field.Note: If you choose to install a CA public certificate, you must installit when you install the PEM/DER certificate and key.Reset selected Topology to the factorydefault certificate and keyRemove custom certificate that user installed.No change No change.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide73
DraftTable 8: Topologies Page: Certificates Tab Fields and Buttons (continued)FField/Button DescriptionGenerate Signing Request To generate a CSR for the controller, click Generate Signing Request.The GGenerate Certificate Signing Request window displays (Figure10).Save Click to save the changes to this Topology.NoteTo avoid the certificate-related web browser security warnings when accessing theWireless Assistant, you must also import the customized certificates into your webbrowser application.Figure 10: Generate Certificate Signing Request WindowTable 9: Generate Certificate Signing Request Page - Fields and ButtonsField/Button DescriptionCountry name The two-letter ISO abbreviation of the name of the countryState or Province name The name of the State/ProvinceLocality name (city) The name of the city.Organization name The name of the organizationOrganizational Unit name The name of the unit within the organization.Common Name Set the common name to be one of the following:the IP address of the interface that the CSR applies to.a DNS address associated with the IP address of the interface thatthe CSR applies to.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide74
DraftTable 9: Generate Certificate Signing Request Page - Fields and Buttons(continued)FField/Button DescriptionEmail address The email address of the organizationGenerate Signing Request Click to generate a signing request. A certificate request file isgenerated (.csr file extension). The name of the file is the IP addressof the topology you created the CSR for. The FFile Download dialog isdisplayed.Configuring the Login Authentication ModeYou can configure the following login authentication modes to authenticate administrator loginattempts:•Local authentication — The controller uses locally configured login credentials and passwords. See Configuring the Local Login Authentication Mode and Adding New Users on page 75.•RADIUS authentication — The controller uses login credentials and passwords configured on aRADIUS server. See Configuring the RADIUS Login Authentication Mode on page 78.•Local authentication first, then RADIUS authentication — The controller first uses locally configuredlogin credentials and passwords. If this login fails, the controller attempts to validate logincredentials and passwords configured on a RADIUS server. See Configuring the Local, RADIUS LoginAuthentication Mode on page 82.•RADIUS authentication first, then local authentication — The controller first uses login credentialsand passwords configured on a RADIUS server. If this login fails, the controller attempts to validatelogin credentials and passwords configured locally. See Configuring the RADIUS, Local LoginAuthentication Mode on page 84.NoteThe ExtremeWireless Appliance enables you to recover the controller via the Rescue modeif you have lost its login password. For more information, see the ExtremeWirelessMaintenance Guide.Configuring the Local Login Authentication Mode and Adding New UsersLocal login authentication mode is enabled by default. If the login authentication was previously set toanother authentication mode, you can change it to the local authentication. You can also add new usersand assign them to a login group — as full administrators, read-only administrators, or as a GuestPortalmanagers. For more information, see Defining Wireless Assistant Administrators and Login Groups onpage 673.To configure the local login authentication mode:1 From the top menu, click Controller.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide75
aft2 In the left pane, click Administration > Login Management.The LLogin Management screen displays.3 In the Authentication mode section, click Configure.The LLogin Authentication Mode Configuration window is displayed.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide76
Draft4 Select the Local check box.If the RADIUS check box is selected, deselect it.5 Click OK.6 In the Add User section, select one of the following from the Group drop-down list:•Full Administrator — Grants the administrator’s access rights to the administrator.•Read-only Administrator — Grants read-only access right to the administrator.•GuestPortal Manager — Grants the user GuestPortal manager rights.7 In the User ID box, type the user’s ID.8 In the Password box, type the user’s password.NNoteUNICODE characters are not supported in passwords for local and remote RADIUS/TACACS+ authentication. All passwords must be 8 to 24 characters long.9 In the Confirm Password box, re-type the password.10 To add the user, click Add User. The new user is added.11 Click Save.The AAdministrator Password Confirmation window is displayed.12 Select the appropriate option.•Yes — Change authentication mode to local. Use the administrator password currently defined onthe controller.•Yes, but I want to change administrator’s password first — Change authentication mode tolocal and change the administrator password currently defined on the controller.•No — Do not change the authentication mode to local.13 Click Submit.14 If you chose Yes, but I want to change administrator’s password first, you are prompted to changethe administrator’s password.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide77
DraftConfiguring the RADIUS Login Authentication ModeThe local login authentication mode is enabled by default. You can change the local login authenticationmode to RADIUS-based authentication.NNoteBefore you change the default local login authentication to RADIUS-based authentication,you must configure the RADIUS Server on the GGlobal Settings screen. For more information,see VNS Global Settings on page 392.RADIUS is a client/server authentication and authorization access protocol used by a network accessserver (NAS) to authenticate users attempting to connect to a network device. The NAS functions as aclient, passing user information to one or more RADIUS servers. The NAS permits or denies networkaccess to a user based on the response it receives from one or more RADIUS servers. RADIUS uses UserDatagram Protocol (UDP) for sending the packets between the RADIUS client and server.You can configure a RADIUS key on the client and server. If you configure a key on the client, it must bethe same as the one configured on the RADIUS servers. The RADIUS clients and servers use the key toencrypt all RADIUS packets transmitted. If you do not configure a RADIUS key, packets are notencrypted. The key itself is never transmitted over the network.NoteBefore you configure the system to use RADIUS-based login authentication, you mustconfigure the Service-Type RADIUS attribute on the RADIUS server.EWC uses the standard RADIUS attribute Service-Type to put the user into theappropriate groups:•Administrator Service-Type = 6•Read-Only Service-Type = 7•GuestPortal Manager Service-Type = 8To configure the RADIUS login authentication mode:1 From the top menu, click Controller.2 In the left pane, click Administration > Login Management. The LLogin Management screen displays.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide78
aft3 Click the RADIUS Authentication tab.4 In the Authentication mode section, click Configure.The LLogin Authentication Mode Configuration window is displayed.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide79
Draft5 Deselect Local and select the RADIUS check box.6 Click OK.7 From the drop-down list, located next to the Use button, select the RADIUS Server that you want touse for the RADIUS login authentication, and then click Use. The RADIUS Server’s name is displayedin the Configured Servers box, and in the Auth section, and the following default values of theRADIUS Server are displayed.NNoteThe RADIUS Servers displayed in the list located against the Use button are defined onGlobal Settings screen. For more information, see VNS Global Settings on page 392.The following values can be edited:•NAS IP address — The IP address of Network Access Server (NAS).•NAS Identifier — The Network Access Server (NAS) identifier. The NAS identifier is a RADIUSattribute that identifies the server responsible for passing information to designated RADIUSservers, and then acting on the response returned.•Auth Type — The authentication protocol type (PAP, CHAP, MS-CHAP, or MS-CHAP2).•Set as Primary Server — Specifies the primary RADIUS server when there are multiple RADIUSservers.8 To add additional RADIUS servers, repeat step 7.NoteYou can add up to three RADIUS servers to the list of login authentication servers. Whenyou add two or more RADIUS servers to the list, you must designate one of them as thePrimary server. The controller first attempts to connect to the Primary server. If thePrimary Server is not available, it tries to connect to the second and third server accordingto their order in the Configured Servers box. You can change the order of RADIUS serversin the Configured Servers box by clicking on the Up and Down buttons.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide80
Draft9 Click Test to test connectivity to the RADIUS server.NNoteYou can also test the connectivity to the RADIUS server after you save the configuration. Ifyou do not test the RADIUS server connectivity, and you have made an error in configuringthe RADIUS-based login authentication mode, you will be locked out of the controllerwhen you switch the login mode to the RADIUS login authentication mode. If you arelocked out, access Rescue mode via the console port to reset the authentication methodto local.The following window is displayed.10 In the User ID and the Password fields, type the user’s ID and the password, which were configuredon the RADIUS Server, and then click Test.The RADIUS connectivity result is displayed.NoteTo learn how to configure the User ID and the Password on the RADIUS server, refer to yourRADIUS server’s user guide.If the test is not successful, the following message will be displayed:Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide81
Draft11 If the RADIUS connectivity test displays “Successful” result, click Save on the RRADIUS Authenticationscreen to save your configuration.The following window is displayed:12 If you tested the RADIUS server connectivity earlier in this procedure, click No. If you click Yes, youwill be asked to enter the RADIUS server user ID and password.13 To change the authentication mode to RADIUS authentication, click OK.You will be logged out of the controller immediately. You must use the RADIUS login user name andpassword to log on the controller.To cancel the authentication mode changes, click Cancel.Configuring the Local, RADIUS Login Authentication ModeTo configure the Local, RADIUS login authentication mode:1 From the top menu, click Controller.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide82
aft2 In the left pane, click Administration > Login Management. The LLogin Management screen displays.3 In the Authentication mode section, click Configure.4 Select the Local and RADIUS check box.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide83
D5 If necessary, select Local and use the Move Up button to move Local to the top of the list.6 Click OK.7 On the LLogin Management screen, click Save.For information on setting local login authentication settings, see Configuring the Local LoginAuthentication Mode and Adding New Users on page 75.For information on setting RADIUS login authentication settings, see Configuring the RADIUS LoginAuthentication Mode on page 78.Configuring the RADIUS, Local Login Authentication ModeTo configure the RADIUS, Local login authentication mode:1 From the top menu, click Controller.2 In the left pane, click Administration > Login Management. The LLogin Management screen displays.3 In the Authentication mode section, click Configure.The LLogin Authentication Mode Configuration window is displayed.4 Select the Local and RADIUS check box.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide84
Draft5 If necessary, select the RADIUS field and use the Move Up button to move RADIUS to the top of thelist.6 Click OK.7 On the LLogin Management screen, click Save.For information on setting RADIUS login authentication settings, see Configuring the RADIUS LoginAuthentication Mode on page 78.For information on setting local login authentication settings, see Configuring the Local LoginAuthentication Mode and Adding New Users on page 75.Configuring SNMPThe controller supports the SNMP for retrieving statistics and configuration information. If you enableSNMP on the controller, you can choose either SNMPv3 or SNMPv1/v2 mode. If you configure thecontroller to use SNMPv3, then any request other than SNMPv3 request is rejected. The same is true ifyou configure the controller to use SNMPv1/v2.To configure SNMP:1 From the top menu, click Controller. The WWireless Controller Configuration screen displays.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide85
raft2 In the left pane, click Network > SNMP.The SSNMP screen displays.3 In the SNMP Common Settings section, configure the following:•Mode — Select SNMPv1/v2c or SNMPv3 to enable SNMP.•Contact Name — The name of the SNMP administrator.•Location — The physical location of the controller running the SNMP agent.•SNMP Port — The destination port for the SNMP traps. Possible ports are 0–65555.•Forward Traps — The lowest severity level of SNMP trap that you want to forward.•Publish AP as interface of controller — Enable or disable SNMP publishing of the access point asan interface to the controller.4 Select the tab for the SNMP version you are configuring. For more information, see:•Configuring SNMPv1/v2c-specific Parameters on page 87•Configuring SNMPv3-specific Parameters on page 87Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide86
DraftConfiguring SNMPv1/v2c-specific Parameters1 Configure the following parameters on the SSNMPv1/v2c tab:•Read Community Name — The password that is used for read-only SNMP communication.•Read/Write Community Name — The password that is used for write SNMP communication.•Manager A — The IP address of the server used as the primary network manager that will receiveSNMP messages.•Manager B — The IP address of the server used as the secondary network manager that willreceive SNMP messages.NoteManager A and Manager B address fields support both IPv4 or IPv6 addresses.2 Click Save.Configuring SNMPv3-specific Parameters1 Configure the parameters following on the SSNMPv3 tab:•Context String — A description of the SNMP context.•Engine ID — The SNMPv3 engine ID for the controller running the SNMP agent. The engine IDmust be from 5 to 32 characters long.•RFC3411 Compliant — The engine ID will be formatted as defined by SnmpEngineID textualconvention (that is, the engine ID will be prepended with SNMP agents' private enterprisenumber assigned by IANA as a formatted HEX text string).2 Click Add User Account. The AAdd SNMPv3 User Accountwindow displays.3 Configure the following parameters:•User — Enter the name of the user account.•Security Level — Select the security level for this user account. Choices are: authPriv, authNoPriv,noAuthnoPriv.•Auth Protocol — If you have selected a security level of authPriv or authNoPriv, select theauthentication protocol. Choices are: MD5 (Message-Digest algorithm 5), SHA, None.•Auth Password — If you have selected a security level of authPriv or authNoPriv, enter anauthentication password.•Privacy Protocol — If you have selected the security level of authPriv, select the privacy protocol.Choices are: DES, None•Privacy Password — If you have selected the security level of authPriv, enter a privacy password.•Engine ID — If desired, enter an engine ID. The ID can be between 5 and 32 bytes long, with nospaces, control characters, or tabs.•Destination IP — If desired, enter the IP address of a trap destination.NoteThe Destination IP address field supports both IPv4 or IPv6 addresses.4 Click OK. The AAdd SNMPv3 User Account window closes.5 Repeat steps 2 through 4 to add additional users.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide87
Draft6 In the Trap 1 and Trap 2 sections, configure the following parameters:•Destination IP — The IP address of the machine monitoring SNMPv3 trapsNNoteThe Destination IP address field supports both IPv4 or IPv6 addresses.•User Name — The SNMPv3 user to configure for use with SNMPv3 traps7 Click Save.Editing an SNMPv3 UserTo edit an SNMPv3 user:1 From the top menu, click Controller.2 In the left pane, click SNMP. The SSNMPscreen displays.3 Click the SNMPv3 tab.4 Select an SNMP user.5 Click Edit Selected User. The EEdit SNMPv3 User Accountwindow displays.6 Edit the user configuration as desired.7 Click OK. The EEdit SNMPv3 User Accountwindow closes.8 Click Save.Deleting an SNMPv3 UserTo delete an SNMPv3 user:1 From the top menu, click Controller.2 In the left pane, click SNMP. The SNMP screen displays.3 Click the SNMPv3 tab.4 Select an SNMP user.5 Click Delete Selected User. You are prompted to confirm that you want to delete the selected user.6 Click OK.SNMP Trap TypesThe SNMP agent generates traps to notify the administrator of events such as configuration changes,component failures, and disconnection of Access Points. Administrators can configure the Agent andthe Controller, defining the level of trap to receive. The following trap types are supported byExtremeWireless Controllers:•Interfaces MIB (IF-MIB) linkDown (.1.3.6.1.6.3.1.1.5.3)•Interfaces MIB (IF-MIB) linkUp (.1.3.6.1.6.3.1.1.5.4)•HIPATH-WIRELESS-HWC-MIB apTunnelAlarm (.1.3.6.1.4.1.4329.15.3.19.4)•Sent by the controller when it detects that it has lost the connection to an AP. The trap identifiesthe AP that the controller can no longer contact.•HIPATH-WIRELESS-HWC-MIB hiPathWirelessLogAlarm (.1.3.6.1.4.1.4329.15.3.9.6)Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide88
Draft•A generic trap that contains specific information relevant to the event. The information is carriedin the trap, and the information varies from event to event.•The trap contains the trap severity, the component on the controller that raised the event, andthe text string associated with the event, as it appears in the controller GUI.•A trap containing one event that also is displayed in the controller’s Event / Log report page. Thetrap is sent when the event is raised and recorded on the controller.•This trap accounts for the vast majority of traps messages sent by the controller at most sites.Configuring Network TimeYou should synchronize the clocks of the controller and the APs to ensure that the logs and reportsreflect accurate time stamps. For more information, see Working with Reports and Statistics on page621.The normal operation of the controller will not be aected if you do not synchronize the clock. The clocksynchronization is necessary to ensure that the logs display accurate time stamps. In addition, clocksynchronization of network elements is a prerequisite for the following configuration:•Mobility Manager•Session AvailabilityNNetwork Time SynchronizationNetwork time is synchronized in one of two ways:•Using the system’s time — The system’s time is the controller’s time.•Using Network Time Protocol (NTP) — The Network Time Protocol is a protocol for synchronizingthe clocks of computer systems over packet-switched data networks.The controller automatically adjusts for any time change due to Daylight Savings time.Configuring the Network Time Using the System’s Time1 From the top menu, click Controller.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide89
Draft2 In the left pane, click Network > Network Time. The NNetwork Time screen displays.3 From the Continent or Ocean drop-down list, click the appropriate large-scale geographic groupingfor the time zone.4 From the Time Zone Region drop-down list, click the appropriate time zone region for the selectedcountry.5 Click Apply Time Zone.6 In the System Time field, type the system time.7 Click Set Clock. The WLAN network time is synchronized in accordance with the controller’s time.Configuring the Network Time Using an NTP Server1 From the top menu, click Controller.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide90
aft2 In the left pane, click Network > Network Time. The NNetwork Time screen displays.3 From the Continent or Ocean drop-down list, click the appropriate large-scale geographic groupingfor the time zone.4 From the Time Zone Region drop-down list, click the appropriate time zone region for the selectedcountry.5 Click Apply Time Zone.6 In the System Time box, type the system time.7 Select the Use NTP check box.NoteIf you want to use the controller as the NTP Server, select the Run local NTP Server checkbox, and click Apply.8 In the Time Server 1 text box, type the IP address or FQDN (Full Qualified Domain Name) of an NTPtime server that is accessible on the enterprise network.NoteThe Time Server fields supports both IPv4 and IPv6 addresses.9 Repeat for Time Server2 and Time Server3 text boxes.If the system is not able to connect to the Time Server 1, it will attempt to connect to the additionalservers that have been specified in Time Server 2 and Time Server 3 text boxes.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide91
Draft10 Click Apply. The WLAN network time is synchronized in accordance with the specified time server.Configuring Secure ConnectionsThe controllers communicate amongst themselves using a secure protocol. Among other things, thisprotocol is used to share between controllers the data required for high availability. They also use thisprotocol to communicate with NMS Wireless Manager. The protocol requires the use of a shared secretfor mutual authentication of the end points.By default the controllers and NMS Wireless Manager use a well known factory default shared secret.This makes it easy to get up and running but is not as secure as some sites require.The controllers and NMS Wireless Manager allow the administrator to change the shared secret used bythe secure protocol. In fact the controllers and Wireless Manager can use a dierent shared secret foreach individual end point to which they connect with the protocol.To configure the shared secret for a connection on the controller:1 From the top menu, click Controller.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide92
ft2 In the left pane, click Network > Secure Connections.The SSecure Connections screen displays.3 Select Enable Weak Ciphers to enable weak ciphers for the remote connections. Disabling weakciphers prevents users from accessing various web pages on the controller using less securemethods.4 Enter the Server IP address of the other end of the secure protocol tunnel and the shared secret touse.5 Click Add/Update.6 Click Save.NoteConfigure the same shared secret onto the devices at each end of the connection.Otherwise, the two controllers or controller and NMS Wireless Manager will not be able tocommunicate.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide93
DraftConfiguring DNS Servers for Resolving Host Names of NTP and RADIUSServersBecause the GGlobal Settings screen allows you to set up NTP and RADIUS servers by defining their hostnames, you have to configure your DNS servers to resolve the host names of NTP and RADIUS serversto the corresponding IP addresses. Go to VNS > Global Settings.NoteFor more information on RADIUS server configuration, see Defining RADIUS Servers and MACAddress Format on page 394.You can configure up to three DNS servers to resolve NTP and RADIUS server host names to theircorresponding IP addresses.The controller sends the host name query to the first DNS server in the stack of three configured DNSservers. The DNS server resolves the queried domain name to an IP address and sends the result backto the controller.If for some reason, the first DNS server in the stack of configured DNS servers is not reachable, thecontroller sends the host name query to the second DNS server in the stack. If the second DNS server isalso not reachable, the query is sent to the third DNS server in the stack.To configure DNS servers for resolving host names of NTP and RADIUS servers:1 From the top menu, click Controller.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide94
aft2 In the left pane, click Administration > Host Attributes.The HHost Attributes screen displays.3 In the DNS box, type the DNS server’s IP address in the Server Address field and then click AddServer. The new server is displayed in the DNS servers’ list.NoteYou can configure up to three DNS servers. The Server Address field supports both IPv4and IPv6 addresses.4 Int the Default Gateway IP box, enter the IP address of the Default Gateway.5 To save your changes, click Save.Using a Third-party Location-based SolutionExtremeWireless supports the following location-based solutions:•AeroScout•Ekahau•CentrakOn the controller, configure the AeroScout/Ekahau/Centrak server IP address and enable the location-based service. When using AeroScout or Ekahau, the location-based server is aware of the controller IPaddress. And if using AeroScout, the controller notifies the AeroScout server of the operational APs.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide95
DraftEnable the location-based service on the APs that you want to participate.NNoteParticipating APs must use the 2.4 GHz band and the radio that receives location-basedservice tags must have at least one WLAN service associated with it.Once you have enabled the location-based service on the controller and the participating APs, at leastone of the participating APs will receive reports from a location-based service Wi-Fi RFID tag in the 2.4GHz band. The tag reports are collected by the AP and forwarded to the location-based server byencapsulating the tag reports in a WASSP tunnel and routing them as IP packets through the controller.When using Ekahau or Centrak, the controller does not converse directly with the location-basedservice server.NoteTag reports are marked with UP=CS5, and DSCP = 0xA0. On the wireless controller, tagreports are marked with UP=CS5 to the core (if 802.1p exists).An AP’s tag report collection status is reported in the AP Inventory report. For more information, see Viewing Routing Protocol Reports on page 657.If availability is enabled, tag report transmission pauses on failed over APs until they are configured andnotified by the location-based server. With an availability pair, it is good practice to configure bothcontrollers with the same location-based service.When location-based service support is disabled on the controller, the controller does not communicatewith the location-based server and the APs do not perform any location-based functionality.Ensure that your location-based service tags are configured to transmit on all non-overlapping channels(1, 6 and 11) and also on channels above 11 for countries where channels above 11 are allowed. Forinformation about proper deployment of the location-based solution, refer to the third-partydocumentation (AeroScout/Ekahau/Centrak).Related LinksConfiguring Location-Based Services on page 96AP Multi-Edit Properties on page 111AP Properties Tab - Advanced Settings on page 164Configuring Location-Based ServicesTo configure a controller for use with an AeroScout/Ekahau/Centrak solution:1 From the top menu, click Controller.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide96
Draft2 In the left pane, click Services > Location-based Service.3 Select the desired location-based service for the controller.•Enter the IP address of the location based service server.•Centrak and Ekahau configuration oer a default port number and multicast address, but youcan modify the default values if necessary.4 Click Save.Now assign APs to participate in the location-based service.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide 997
t5 From the top menu, click AP. In the left pane, click APs.NNoteYou can enable location-based service on APs using the Location-based service field onthe AAP Multi-edit screen and the AAdvanced window of the AAP Default Settings screen. Thefollowing procedure shows you how to enable location-based services on one AP at atime.6 Click on an AP row.The AAP Status dashboard displays.7 Click Configure to display the CConfiguration dialog.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide98
aft8 Click Advanced.The AAdvanced dialog displays.9 Select Enable location-based service and close the dialog.10 Enable Location-based services on each additional AP that you want to participate.11 Click Save.Related LinksUsing a Third-party Location-based Solution on page 95AP Multi-Edit Properties on page 111AP Properties Tab - Advanced Settings on page 164Additional Ongoing Operations of the SystemOngoing operations of the Extreme Networks ExtremeWireless system can include the following:•Controller System Maintenance•Client Disassociate•Logs and Traces•Reports and DisplaysConfiguring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide99
DraftFor more information, see Performing System Administration on page 669 or the Extreme NetworksExtremeWireless Maintenance Guide.Configuring the ExtremeWireless ApplianceExtremeWireless™ V10.41.06 User Guide 1100
Draft4 Configuring the ExtremeWirelessAPsWWireless AP OverviewDiscovery and RegistrationViewing a List of All APsWireless AP Default ConfigurationConfiguring Wireless AP PropertiesOutdoor Access Point InstallationAssigning Wireless AP Radios to a VNSConfiguring Wireless AP Radio PropertiesConfiguring IoT ApplicationsSetting Up the Wireless AP Using Static ConfigurationSetting Up 802.1x Authentication for a Wireless APConfiguring Co-Located APs in Load Balance GroupsConfiguring an AP ClusterConfiguring an AP as a GuardianConfiguring a Captive Portal on an APAP3916ic Integrated Camera DeploymentPerforming AP Software MaintenanceUnderstanding the ExtremeWireless LED StatusWireless AP OverviewExtreme Networks ExtremeWireless APs use the 802.11 wireless standards (802.11a/b/g/n/ac) fornetwork communications, and bridge network trac to an Ethernet LAN. In addition to the WirelessAPs that run proprietary software and communicate with a controller only, Extreme Networks oers aCloud-enabled APs. The 3805i and the AP39xx series are radar capable, Cloud-enabled APs thatinteroperate fully with ExtremeCloud and other ExtremeWireless products.A wireless AP physically connects to a LAN infrastructure and establishes an IP connection to acontroller, which manages the AP configuration through the Wireless Assistant. The controller alsoprovides centralized management (verification and upgrade) of the AP firmware image.A UDP-based protocol enables communication between an AP and a controller. The UDP-basedprotocol encapsulates IP trac from the AP and directs it to the controller. The controller decapsulatesthe packets and routes them to the appropriate destinations, while managing sessions and applyingroles.ExtremeWireless™ V10.41.06 User Guide101
DraftAP Model Firmware SupportRefer to the ExtremeWireless Hardware Firmware Support Matrix to easily determine the currentlysupported firmware version and the minimum firmware version for each ExtremeWireless access point.Wireless Protocol Standards (802.11)Most current wireless networks and end-user devices use the IEEE 802.11n wireless protocol standard.The 802.11n APs are backward-compatible with existing 802.11a/b/g networks and devices. The AP38xxand AP39xx series APs support the 802.11ac wireless protocol.•The AP3705i delivers data rates up to 300 Mbps per radio; the AP37xx series APs except for theAP3705i deliver data rates up to 450 Mbps per radio.•The AP38xx series APs deliver data rates up to 1.3 Gbps on Radio 1 (the 5 GHz radio) and 450 Mbpson Radio 2 (the 2.4 GHz radio)•The AP39xx series supports an internal antenna array and active/active E/N data ports that deliverdata rates up to 1.7 Gbps on Radio 1 and 600 Mbps on Radio 2.To configure an 802.11n/ac AP to achieve this high link rate, see Achieving High Throughput with 11n and11ac Wireless APs on page 187.AntennasSome wireless AP models have built-in, internal antennas; some support external antennas. APs withinternal antennas are certified as a complete unit. External antennas are individually certified formaximum transmitting power and determination of available channels in each country in which the APis deployed.The latest AP3915i/e and AP3917i/e models oer both Wi-Fi antennas and IoT antennas that are used toreceive iBeacon signals from IoT devices.For a list of the external antennas that can be used with each AP model and how to install them, refer tothe Installation Guide for each AP and to the ExtremeWireless External Antenna Site Preparation andInstallation Guide.Wireless APs with external antenna ports must be configured to associate the external antennaconnected to each antenna port. For more information, see Configuring Wireless AP Properties on page156.AP Types (Features)AP model types are dierentiated by their feature design, particularly:•Indoor/Outdoor — APs are built for either indoor or outdoor service.•Indoor APs are built for use in enclosed, protected areas (like inside buildings) where they are notexposed to harsh weather or temperature extremes. Indoor APs have optional mounting bracketsfor mounting the AP on walls or drop ceilings.•Outdoor APs are built weather-hardened, with watertight fittings for cables and antennas, splashguards, and a greater resistance to temperature extremes (both cold and heat). Outdoor APs canConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1102
Draftextend your Wireless LAN to outdoor locations without Ethernet cabling. Mounting brackets areavailable to enable quick and easy mounting of the Outdoor APs to walls, rails, and poles.•Controller-based — Controller-based APs are intended to be controlled centrally by anExtremeWireless Appliance. All AP and service configuration, bridging, and networking is done onthe controller, with the AP acting as the remote access point relaying communications between thenetwork (the controller) and end-user devices.•Cloud-enabled — Cloud-enabled APs are intended to be controlled by ExtremeCloud™ an easy to useand scalable cloud-based management platform that supports and transforms with your business.Combined with enterprise-grade wired and wireless cloud-managed devices, ExtremeCloud deliversa scalable and highly available pay-as-you go subscription solution.•IoT ready, smoke detector models — ExtremeWireless oers APs that are equipped with IoTantennas for receiving iBeacon signals from IoT devices. The controller collects and filters data basedon configuration parameters, and forwards the data to an Application Server for reporting. TheAP3915i/e and AP3917i/e are equipped with IoT antennas.Additionally, the indoor model (AP3915i/e) is equipped with a smoke detector.The AP3912 and AP3916 models are equipped with BLE radios that send iBeacon signals to IoTdevices.•AP 3916ic (Integrated Camera) — 2x2 11ac AP with an integral security camera (2MP camera withresolution up to 1080p) that lets you extend your Wireless LAN and provide simultaneous wirelessservice, BLE or 802.15.4 coverage and security in public spaces, such as classrooms and oces. Thisfully featured access point can be mounted on the ceiling or wall. The integral ONVIF compatiblesecurity camera is connected to an internal wired Ethernet port. The AP3916ic provides flow baseddata handling for the wireless and wired connections. Enabled for ExtremeCloud™ support.•AP 3912 Wall Plate — 2x2 11ac AP that is installed replacing other existing Ethernet wall plates withone or two ports. One Ethernet port on the wall plate must be connected to the LAN1 uplinkconnection on the AP (black). This link provides AF or AT POE to the AP and uplink dataconnectivity to the network. The other Ethernet port on the wall plate can be connected to the pass-through port on the AP (blue), allowing connection options for wired devices like IP phones. TheAP3912 is intended to take advantage existing wired Ethernet outlets and a switch port. The AP3912is installed over an existing wall plate, and it is connected to the existing cable / switch port. The APoers an integrated BTLE/802.15.4 radio for connectivity to Internet of Things (IoT) sensors anddevices. Enabled for ExtremeCloud™ support.•Threat Detection and Prevention Capability —As the potential for wireless security threats grows,APs must evolve to detect and counter hostile intrusion and attacks. The AP37xx, AP38xx, AP39xxand W78xC series of access points are designed to support Radar channel monitoring and areconfigurable for protection against detected attacks.The Radar and Mitigator functions are described in greater detail in Threat Detection and PreventionFeatures on page 105. Configuration of these functions on controllers is described in Working withExtremeWireless Radar on page 563.Other dierentiating features in an AP product series are the number of internal or external antennas(see Antennas on page 102) or the number of radios the AP has (see Radios on page 103).RadiosAll wireless APs are equipped with at least two radios — Radio 1 and Radio 2:Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1103
Draft•Radio 1 supports a 5 GHz radio band•Radio 2 supports a 2.4 GHz radio bandNNoteThe following APs oer integrated BLE/802.15.4 radios: AP3912i , AP3915i/e, AP3916ic,AP3917i/e/k.The AP39xx supports up to 1.7 Gbps on the 5 GHz radio and 600 Mbps on the 2.4 GHz radio using fourspatial streams.The 38xx and AP37xx series radios (except AP3705i) support up to 450Mbps using three spatialstreams.The radios are enabled or disabled through the Wireless Assistant. For more information, see Modifying11n and 11ac Wireless AP Radio Properties on page 178.The Unlicensed National Information Infrastructure (U-NII) bands all lie within the 5 GHz band, designedfor short-range, high-speed, wireless networking communication.802.11n APs support the full range of frequencies available in the 5 GHz band:•5150 to 5250 MHz - U-NII Low band•5250 to 5350 MHz - U-NII Middle Band•5470 to 5700 MHz - U-NII Worldwide•5725 to 5825 MHz - U-NII High BandNote802.11n-compliant wireless APs can achieve link rates of up to 300 Mbps. You canconfigure the controller for this higher level link rate. For more information, see AchievingHigh Throughput with 11n and 11ac Wireless APs on page 187.AP3916ic (Integrated Camera)The AP3916ic is an 11ac Wave 2 AP with an integral security camera that lets you extend your WirelessLAN and provide simultaneous wireless service, BLE or 802.15.4 coverage and security in public spaces,such as classrooms and oces.The AP3916 can be mounted on the ceiling, wall or in a junction/gang box. The integral ONVIFcompatible security camera is connected to an internal wired Ethernet port, and the AP provides policyenforcement control for the wireless and wired connections.The AP3916ic has the following specifications:•Integrated 2MP camera with resolution up to 1080p, with manual view adjustment.•Radios: Two concurrent Wi-Fi radios (2.4 GHz and 5 GHz) and one additional radio that can operateas Bluetooth or 802.15.4.•Antennas: Four internal single band Wi-Fi antennas and one internal antenna for Bluetooth (BLE) or802.15.4.•LEDs: Six•802.3af compliant for full functionality. Optional AC adapter.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide104
Draft•Supports the 802.11ac and 802.11n wireless standards, with full backward compatibility with legacy802.11abg.•10/100/1000 Mbps operation.•Adjustable mounting bracket (included) for drop-ceiling T-bar rail.•Optional mounts can be purchased separately for junction/gang box, indoor wall and solid ceilinginstallation.•Enabled for ExtremeCloud™ support.ExtremeWireless support for the AP3916ic:•Camera is powered by the AP3916i PoE power supply:•Camera port (CAM) can be assigned through policy to B@AP or B@AC virtual network servicetopologies. Default and specific assignment is supported. You can use policy definition andassignment to provide network segmentation for network access and camera (CAM) functions.•The AP3916ic's camera function is identified as "EXTR2MP-CAM" device type. Filter the applianceclient list to obtain a list of cameras under the appliance management.•The controller provides factory reset and restart functions for the camera.RRelated LinksAP3916ic Integrated Camera Deployment on page 226Upgrading the Camera Image Manually on page 237AP3916ic-Camera Web User Interface on page 227Threat Detection and Prevention FeaturesExtremeWireless Appliances and the wireless APs they manage, provide Wireless Intrusion DetectionServices (WIDS) and Wireless Intrusion Prevention Services (WIPS) to detect, report, and protectagainst potential wireless network attacks and threats such as rogue APs, AP spoofing, honeypot APs,password cracking, man-in-the-middle, denial of service (DoS), and others. The latest generation ofcontrollers and the APs (AP39xx, AP38xx, AP37xx and W78xC series) implement the Radar feature andits major functions:•Scanning channels for threat identification•Analyzing and detecting a wide range of wireless security threats•Taking active countermeasures (if configured to do so) against identified threats•Validating WLAN (Wireless Local Area Network) Service configuration to protect against securityweakness•Generating threat event reports and forwarding them to Extreme Management Center™All APs can simultaneously perform channel bridging and scan (monitor) the channels they arebridging. These APs can also be configured (on their controller) to perform countermeasures againstdetected threats. Radar threat detection scanning of channels on the APs is configured on In-ServiceScan Profiles.You can configure APs to operate as full time Radar agents by adding them to a Guardian Scan Profile.When operating in this mode, they are referred to as "Guardians." Once assigned to the Guardian ScanProfile, the APs stop forwarding trac on both radios and devote all of their resources to threatdetection and countermeasures. Any AP added to a Guardian Scan Profile is done so in its entirety.Therefore, it is not possible to dedicate one radio to scanning, and the other to forwarding. Guardian APConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide105
Draftcan scan on multiple channels, which you can configure from the SScan Profile Detection Settings userinterface. The AP cannot scan or transmit on channels that are prohibited by the regulations of thecountries in which it is deployed.Related LinksGuardian Scan Profile Detection Settings on page 578Working with ExtremeWireless Radar on page 563802.11n- and 802.11ac-Compliant Access Point FeaturesAll 802.11n-compatible APs have the following features:MIMOWireless APs use MIMO (multiple input, multiple output) — a technology that uses advanced signalprocessing with multiple antennas to improve throughput. MIMO takes advantage of multipathpropagation to decrease packet retries to improve the fidelity of the wireless network. MIMO increasesthroughput by using multiple streams.MIMO radios send out one, two or three radio signals through each antenna. Each signal is called aspatial stream. The antennas on the AP are deliberately spaced so that each spatial stream follows aslightly dierent path to the client device. Two spatial streams get multiplied into several streams asthey bounce o obstructions in the vicinity. This phenomenon is called multipath. As the streams arebounced from dierent surfaces, they follow dierent paths to the client device. The client device alsohas multiple antennas. Each of the antennas independently decodes the arriving signal. Then thedecoded signal from each antenna combines with the decoded signals from the other antennas. Asoftware algorithm uses this redundancy to extract one or two spatial streams and enhances the signalto noise ratio of the streams.The client device also sends out one or two spatial streams through its multiple antennas. These spatialstreams get multiplied into several steams as they bounce o the obstructions in the vicinity en route tothe AP. MIMO receivers receive these multiple streams with three antennas. Each of the three antennasindependently decodes the arriving signal. Then the decoded signal of each antennas is combined withthe decoded signals from the other antennas. The receiving AP's MIMO receiver also uses redundancy toextract one or two spatial streams and enhances the streams' signal to noise ratio.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide106
ftOperating with multiple antennas, an AP with MIMO is capable of picking up even the weakest signalsfrom the client devices.Figure 11: MIMO in Wireless APsThe AP39xx models oer Multi-User MIMO that enables Wave2 APs to communicate with multipleWave2 clients concurrently, in the downstream direction. Up to 3 MU-MIMO conversations concurrently.Channel BondingIn addition to MIMO technology, the 802.11n-compliant APs have additional radio features that increasethe eective throughput of the wireless LAN. Second-generation wireless APs use radio channels thatare 20 MHz wide. The channels must be spaced at 20 MHz to avoid interference. The radios of 802.11n-compliant wireless APs can use two channels at the same time to create a 40-MHz-wide channel. The802.11ac radio of the AP38xx and AP39xx series can use four channels at the same time to create an 80-MHz-wide channel. By using multiple 20-MHz channels in this manner, the wireless AP achieves morethan double the throughput. The 40-MHz and 80-MHz channels in 802.11n and 802.11ac are adjacent 20-Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1107
DraftMHz channels, bonded together. This technique of using multiple channels at the same time is calledchannel bonding.Shortened Guard IntervalThe purpose of the guard interval is to introduce immunity to propagation delays, echoes andreflections of symbols in orthogonal frequency division multiplexing (OFDM) — a method by whichinformation is transmitted via a radio signal in APs.In OFDM, the beginning of each symbol is preceded by a guard interval. As long as the echoes fallwithin this interval, they do not aect the safe decoding of the actual data, as data is interpreted onlyoutside the guard interval. Longer guard periods reduce the channel eciency. 802.11n-compliant APsprovide reduced guard periods, thereby increasing the throughput.MAC Enhancements802.11n-compliant APs also have an improved MAC layer protocol that reduces overhead (in the MAClayer protocol) and contention losses, resulting in increased throughput.Wireless AP International LicensingA wireless AP must be configured to operate on the appropriate radio band in accordance with theregulations of the country in which it is being used. For more information, see Regulatory Informationon page 705.To configure the appropriate radio band according to the country of operation, use the controller. Formore information, see Configuring Wireless AP Properties on page 156.RRelated LinksLicensing Considerations on page 108Licensing ConsiderationsWith ExtremeWireless v10.01 and later each controller is licensed in a specific domain. The domainlicenses include:•FCC•ROW•MNT•EGYThe user interface reflects the domain of the controller. The following are use cases for each domain:•A wireless appliance with an FCC license can manage access points deployed in the United States,Puerto Rico, or Colombia.•A wireless appliance with a ROW license can manage access points deployed in any country exceptthe United States, Puerto Rico, Egypt, or Colombia.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide108
Draft•A wireless appliance with a EGY license will continue to require ROW hardware, but the license willrestrict country selection to Egypt only. A wireless controller with a EGY license can manage accesspoints deployed in Egypt.NNoteIf upgrading from v10.21 with an EGY license, call customer support for assistance.•A wireless appliance with a MNT license can manage only domain-locked access points, which arethe AP39xx-FCC, AP39xx-ROW, and the AP3805i-FCC, AP3805i-ROW only. The FCC models mustbe deployed in the United States, Puerto Rico, or Colombia. The ROW must be deployed in anycountry except the United States, Puerto Rico, or Colombia.•NoteThe AP37xx and AP38xx will NOT be able to connect to a controller licensed in the MNTdomain.First-time Configuration GuidelinesWireless AP Default IP AddressWireless APs are shipped from the factory with a default IP address — 192.168.1.20. The default IPaddress simplifies the first-time IP address configuration process for APs. If an AP fails in its discoveryprocess, it returns to its default IP address. This AP behavior ensures that only one AP at a time can usethe default IP address on a subnet. For more information, see Discovery and Registration on page 120.Wireless APs can acquire their IP addresses by one of two methods:•DHCP assignment — When an AP is powered on, it attempts to reach the DHCP (Dynamic HostConfiguration Protocol) server on the network to acquire an IP address. If successful, the DHCPserver assigns an IP address to the AP.•If the DHCP assignment is not successful in the first 60 seconds, the AP returns to its default IPaddress.•After 30 seconds in the default IP address mode, it attempts again to acquire an IP address fromthe DHCP server.•The process repeats until the DHCP assignment is successful, or until an administrator assigns theAP an IP address, using static configuration.DHCP assignment is the default method for AP configuration. DHCP assignment is part of thediscovery process. For more information, see Discovery and Registration on page 120.•Static configuration —Use the static configuration option to assign a static IP address to a wirelessAP. For more information, see the following section.You can establish an SSH session with an AP during the time window of 30 seconds when the APreturns to its default IP address mode. If a static IP address is assigned during this period, reboot theAP for the configuration to take eect. For more information, see Assigning a Static IP Address to aWireless AP on page 110.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide109
DraftAssigning a Static IP Address to a Wireless APDepending upon the network condition, you can assign a static IP address to a wireless AP using theWireless Assistant (Controller’s GUI). Refer to Setting Up the Wireless AP Using Static Configuration onpage 199 for more information.Configuring Wireless APs for the First TimeBefore configuring an AP for the first time, confirm that the following tasks have already beenperformed:•The ExtremeWireless Appliance has been installed and connected to the network. For moreinformation, see Configuring the ExtremeWireless Appliance on page 31.•The ExtremeWireless Appliance has been configured. For more information, see Configuring theExtremeWireless Appliance on page 31.•The wireless APs have been installed.For installation information, refer to the respective AP Installation Guide.Once the APs are installed, continue with the AP initial configuration:1 Define parameters for the discovery process. For more information, see Wireless AP Registration onpage 123.2 Connect the AP to a power source to initiate the discovery and registration process. For installationinformation, refer to the respective AP Installation Guide.General Configuration MethodsThis section describes the methods you can use to modify the properties of APs in your network.Modifying the Properties of Wireless APs Based on a Default AP ConfigurationTo reset the AP to the default configuration, select AP Properties > Reset To Defaults.To configure a wireless AP with the system default AP settings:1 From the top menu, click AP and select the AP to modify.2 Click Reset to Defaults and click OK to confirm your changes.CCautionIf you reset an AP to defaults, its Search List is deleted, regardless of the settings inCommon Configuration.Modifying the Default Setting of Wireless APs Using the Copy to Defaults FeatureThe Copy to Defaults feature allows the properties of an already configured AP to become the system’sdefault AP settings.To modify the system default AP settings based on an already configured AP:1 From the main menu, click AP and select the AP whose properties you want to use as the default.You can modify the properties here if necessary.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide110
Draft2 Click Copy to Defaults and click OK to confirm your changes.AP Multi-Edit PropertiesWhen you use the Multi-edit function, only options that are explicitly modified are changed by theupdate. The APs shown in the Wireless APs list are supported by various versions of software. Onlyattributes that are common between software versions are available for multi-edit. Setting an attributethat does not apply to an AP does not cause an abort of the multi-edit operation.Table 10: Multi-Edit AP PropertiesFField DescriptionAP PropertiesLocation Define the location of the AP.When a client roams to an AP with a dierent location, AreaNotification is triggered. The Area Notification feature is designed totrack client locations within pre-defined areas using either theLocation Engine (for more information, see Configuring the LocationEngine on page 609) or the AP Location field. When the clients changeareas, a notification is sent.Location functionality on the AP is useful when access to ExtremeManagement Center OneView is not available.Zone Zone allows the RADIUS client to send the AP Zone name as theBSSID instead of the radio MAC address. This feature can be enabledregardless of whether the Site is using centrally located or localRADIUS servers. Zone name is limited to 32 bytes. Each AP can haveits own Zone label although it is often useful to assign the same Zoneto multiple APs. It can be easier to base authorization decisions on thezone label rather than on the BSSID.Poll Timeout Type the timeout value, in seconds. The AP uses this value to triggerre-establishing the link with the Controller if the AP does not get ananswer to its polling. The default value is 10 seconds.Note: If you are configuring session availability, the Poll Timeout valueshould be 1.5 to 2 times of Detect link failure value on AAP Propertiesscreen. For more information, see Session Availability on page 545.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide111
DraftTable 10: Multi-Edit AP Properties (continued)FField DescriptionSecure Tunnel This feature, when enabled, provides encryption, authentication, andkey management between the AP and/or controllers.Select the desired Secure Tunnel mode from the drop-down list:•Disabled — Secure Tunnel is turned o and no trac is encrypted.All SFTP/SSH/TFTP trac works normally.•Encrypt control trac between AP & Controller — An IPSEC tunnelis established from the AP to the controller and all SFTP/SSH/TFTP/WASSP control trac is encrypted. The AP skips theregistration and authentication phases and when selected, theSecure Tunnel Lifetime feature can be configured.•Encrypt control and data trac between AP & Controller — Thismode only benefits routed/bridged@Controller Topologies. AnIPSEC tunnel is established from the AP to the controller and allSFTP/SSH/TFTP/WASSP control and data trac is encrypted. TheAP skips the registration and authentication phases, and whenselected, the Secure Tunnel Lifetime feature can be configured.Note: This option is not available for AP3805 models.•Debug mode — An IPSEC tunnel is established from the AP to thecontroller, no trac is encrypted, and all SFTP/SSH/TFTP tracworks normally. The AP skips the registration and authenticationphases and when selected, the Secure Tunnel Lifetime feature canbe configured.Note: Changing a Secure Tunnel mode will automatically disconnectand reconnect the AP.Secure Tunnel Lifetime (hours) Enter an interval (in hours) at which time the keys of the IPSEC tunnelare renegotiated.Note: Changing the Secure Tunnel Lifetime setting will not cause anyAP disruption.Remote Access Determines if the AP can be accessed remotely.Location-based Service Enable or disable third-party location based services on this AP.ExtremeWireless supports the following third-party services:•AeroScout•Ekahau•CentrakMaintain client session in event of pollfailureDetermines if the AP remains active when a link loss with thecontroller occurs. Select this option when using a bridged at AP VNS.This option is enabled by default.Restart service in the absence ofcontrollerDetermines if the AP’s radios continue providing service when theAP’s connection to the controller is lost. Select this option when usinga bridged at AP VNS. When this option is enabled, the AP starts abridged at AP VNS in the absence of a controller.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide112
DraftTable 10: Multi-Edit AP Properties (continued)FField DescriptionUse broadcast for disassociation Determines if the AP uses broadcast disassociation whendisconnecting all clients, instead of disassociating each client one byone. This setting aects the behavior of the AP when the AP ispreparing to reboot or preparing to enter one of the special modes(DRM initial channel selection). and when a BSSID is deactivated orremoved on the AP. This option is disabled by default.LLDP Determines if the AP broadcasts LLDP (Link Layer Discovery Protocol)information. This option is disabled by default.If SNMP (Simple Network Management Protocol) is enabled on thecontroller and you enable LLDP, the LLLDP Confirmation dialog isdisplayed.Select one of the following:•Proceed (not recommended) — Select this option to enable LLDPand keep SNMP running.•Disable SNMP publishing, and proceed — Select this option toenable LLDP and disable SNMP.•For more information on enabling SNMP, see the ExtremeWirelessMaintenance Guide.Multicast prioritized as voice Ensures that multicast data has the highest priority in the wirelessnetwork. Prioritizes multicast data to the level of voice data. Thissetting must be enabled when deploying healthcare patientmonitoring devices.IP Multicast Assembly Determines if IP Multicast Assembly runs on the wireless AP. Ifenabled, IP Multicast Assembly joins together fragmented multicastdata packets that are too large to fit the MTU size of the tunnel header.This feature is disabled by default.Balanced Channel List Power Simplify power settings so settings function across all channels in thechannel plan.LED Select the desired LED pattern from the drop-down list. Optionsinclude: O, WDS Signal Strength, Identify, and Normal.Country Indicates the country of operation. The antenna you select determinesthe available channel list and the maximum transmitting power for thecountry in which the AP is deployed.Antennas The Professional Install option is only available for AP models withexternal antennas. The fields and corresponding antenna value optionsthat appear on the PProfessional Install dialog depend on the selectedAP and the antenna models that are available. Select an antenna foreach available port. By default, the two antennas must be identical.However, you have the option to select No Antenna for the secondantenna port. The AP3915e and AP3917e access point models oer anexternal IoT antenna. Select the antenna model from the drop-downfield. Choose the desired attenuation for each radio from the drop-down list. Selectable range is from 0 to 30 dBI.Radio SettingsAdmin Mode Determines if the radio mode. Select On to enable the radio. Select Oto disable the radio.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide113
DraftTable 10: Multi-Edit AP Properties (continued)FField DescriptionRadio Mode Select the radio mode based on the type of AP. Available radiosettings are dependent on the selected radio mode.Channel Width Determines the channel width for the radio. Valid values are:•20 MHz — Allows 802.11n clients to use the primary channel (20MHz) and non-802.11n clients, beacons, and multicasts to use the802.11b/g radio protocols.•40 MHz — Allows 802.11n clients that support the 40 MHzfrequency to use 40 MHz, 20 MHz, or the 802.11b/g radio protocols.802.11n clients that do not support the 40 MHz frequency can use20 MHz or the 802.11b/g radio protocols and non-802.11n clients,beacons, and multicasts use the 802.11b/g radio protocols.•80 MHz — Allows 802.11ac clients to use the 80 MHz frequency.Applies to AP38xx and AP39xx Radio 1 only.•Auto — Automatically switches between 20 MHz, 40 MHz, and 80MHz channel widths, depending on how busy the extensionchannels are.DTIM Type the desired DTIM (Delivery Trac Indication Message) period —the number of beacon intervals between two DTIM beacons. To ensurethe best client power savings, use a large number. Use a small numberto minimize broadcast and multicast delay. The default value is 5.Beacon Period Defines the time, in milliseconds, between beacon transmissions. Thedefault value is 100 milliseconds.RTS/CTS (Bytes) (Request to Send/Clear to Send) handshake. Determines themaximum packet size, in bytes, that triggers a RTS/CTS handshake.The default value is 2346 (the maximum 802.11 frame size) whichmeans all packets are sent without RTS/CTS. If the transmitted packetsize is greater than the threshold value, the RTS/CTS handshakeoccurs. Otherwise, the data frame is sent immediately. Reduce thisvalue only if necessary. Note: In order for RTS/CTS to take aect, theRTS threshold must be less than or equal to the Frag threshold.Frag Threshold (Bytes) Determines the maximum packet size, in bytes, that triggers packetfragmentation. The default value is 2346. At 2346, all packets are sentunfragmented. Any value above the frag threshold triggers packetfragmentation by the AP prior to transmission.RF Domain Defines a group of APs that cooperate in managing RF channels andtransmission power levels. The maximum string length is 16 characters.Channel Select Auto to use Automatic Channel Selection. For moreinformation, see Dynamic Radio Management (DRM) on page 174.Auto Tx Power Control Determines if the AP automatically adapts transmission power signalsaccording to the coverage provided by the AP. After a period of time,the system stabilizes itself based on the RF coverage of your wirelessAPs. When enabled, Min Tx Power and Auto Tx Power Ctrl Adjustparameters can be edited, and the ATPC algorithm adjusts the APpower between the Max Tx and Min Tx settings. When disabled, theradio uses the Max Tx Power value or the largest value in thecompliance table,whichever is smaller.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide114
DraftTable 10: Multi-Edit AP Properties (continued)FField DescriptionMax Tx Power Determines the maximum power level used by the radio in dBm. Thevalues are governed by compliance requirements based on thecountry, radio, and antenna selected, and vary by AP. Changing thisvalue below the current Min Tx Power value will lower the Min TxPower to a level lower than the selected Max TX Power. If Auto TxPower Ctrl (ATPC) is disabled, the radio uses the selected value or thelargest value in the compliance table as the power level, whichever issmaller.Min Tx Power Determines the minimum power level for the radio. Use the lowestsupported value in order to not limit the potential Tx power level rangethat can be used. If ATPC is enabled, select the Min Tx power level thatis equal or lower than the Max Tx power level. The Min Tx Powersetting cannot be set higher than the Max Tx Power setting.Auto Tx Ctrl Adjust Determines if the AP automatically adapts transmission power signalsaccording to the coverage provided by the AP. After a period of time,the system stabilizes itself based on the RF coverage of your wirelessAPs. When enabled, Min Tx Power and Auto Tx Power Ctrl Adjustparameters can be edited, and the ATPC algorithm adjusts the APpower between the Max Tx and Min Tx settings. When disabled, theradio uses the Max Tx Power value or the largest value in thecompliance table,whichever is smaller.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide115
DraftTable 10: Multi-Edit AP Properties (continued)FField DescriptionChannel Plan If ACS is enabled you can define a channel plan for the AP. Defining achannel plan allows you to control which channels are available for useduring an ACS scan. For example, you may want to avoid usingspecific channels because of low power, regulatory domain, or radarinterference.•For 5 GHz Radio nodes, click one of the following:•All channels — ACS scans all channels for an operating channeland, when ACS is triggered, the optimal channel is selectedfrom all available channels.•All Non-DFS Channels — ACS scans all non-DFS channels foran operating channel. With ACS, the AP selects the best non-DFS channel.•Custom — To configure individual channels from which the ACSselects an operating channel, click Configure. The CCustomChannel Plan dialog displays. By default, all channelsparticipate in the channel plan. Click the individual channelsyou want to include in the channel plan. To select contiguouschannels, use the Shift key. To select multiple, non-contiguouschannels in the list, use the CTRL key. Click OK to save theconfiguration.•All channels including weather radar — ACS selects the bestchannel from the available channels list. Selected channel maybe DFS, weather-radar DFS or non-DFS. Weather-radarchannels are approved for selected AP models in selectedcountries. Consult the compliance information for the selectedAP.The weather channel includes 5600-5650MHz sub-bandsand requires a listening period before the AP can providewireless service. During the listening period, the CurrentChannel field for DFS channels displays the value DFSTimeout, and the weather channel fields display DFSTimeout . In Europe, the listening period can be up to 10minutes. In the U.S., this period is 1 minute.•For 2.4 GHz Radio nodes, click one of the following:•3 Channel Plan — ACS scans the following channels: 1, 6, and 11in North America, and 1, 7, and 13 in the rest of the world.•4 Channel Plan — ACS scans the following channels: 1, 4, 7, and11 in North America, and 1, 5, 9, and 13 in the rest of the world.•Auto — ACS scans the default channel plan channels: 1, 6, and11 in North America, and 1, 5, 9, and 13 in the rest of the world.•Custom — If you want to configure individual channels fromwhich the ACS selects an operating channel, click Configure.The AAdd Channels dialog is displayed. Click the individualchannels you want to add to the channel plan while pressingthe CTRL key, and then click OK.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide116
DraftTable 10: Multi-Edit AP Properties (continued)FField DescriptionDynamic Channel Selection Determines behavior when trac or noise levels exceed theconfigured DCS thresholds. Valid values are:•Monitor Mode — An alarm is triggered and an information log isgenerated.•Active Mode — An alarm is triggered, an information log isgenerated, the AP stops operating on the current channel,and ACSautomatically selects an alternate channel for the AP to operateon.DCS Noise Threshold Defines the noise interference limit, measured in dBm. If the noiseinterface exceeds this threshold, ACS scans for a new operatingchannel for the AP.DCS Channel Occupancy Threshold Defines the channel utilization level, measured as a percentage. If thethreshold is exceeded, ACS scans for a new operating channel for theAP.DCS Update Period (Minutes) Defines a period of time, in minutes, where the average values for DCSNoise and Channel Occupancy are measured. If the average value foreither setting exceeds the defined threshold for that setting, then theAP triggers Automatic Channel Scan (ACS).Dynamic Channel Selection (DCS) events Indicates items that can aect DCS (Dynamic Channel Selection).Enable one or more events if they are part of the wireless network:•Bluetooth•Microwave•Cordless Phone•Constant Wave•Video BridgeInterference Wait Time Length of the delay (in seconds) before logging an alarm. Defaultsetting is 10 seconds.Preamble Select a preamble type for 11b-specific (CCK) rates: Short, or Long.Click Short if you are sure that there is no 11b APs or client in thevicinity of this AP. Click Long if compatibility with 11b clients isrequired.Protection Mode When data collides on a given channel, CTS (clear to send) protectiondetermines which device transmits at a given time.•Auto. The default and recommended setting.•None. Select if 11b APs and clients are not expected.•Always. Select if you expect many 11b-only clients.Protection Rate A CTS (Clear to Send) packet is always sent out at the MBR (MinimumBasic Rate) configured for the radio. Protection is used when thesending rate (to the client) is greater than the configured protectionrate. For example,if the protection rate is 11Mbps it means that 802.11protection is used.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide117
DraftTable 10: Multi-Edit AP Properties (continued)FField DescriptionProtection Type Select a protection type:•CTS (Clear to Send) Only.•RTS (Request to Send) and CTS. Recommended when a 40 MHz or80 MHz channel is used. This protects high throughputtransmissions on extension channels from interference fromnon-11n APs and clients.Min Basic Rate Defines the minimum data rate that must be supported by all stationsin a BSS (Base Station Subsystem):•Select 1, 2, 5.5, or 11 Mbps for 11b and 11b+11g modes.•Select 6, 12, or 24 Mbps for 11g-only mode.•Select 6, 12, or 24 Mbps for 11a mode.Probe Suppression Used to remedy "sticky clients", that is clients that do not probe onother channels and remain associated to an AP when a better AP isavailable. Configure per radio (Enable/Disable and Threshold). Appliesto AP37xx, AP38xx, and AP39xx series APs. Probe Suppressionaccomplishes the following:•RSS threshold (Adjustable “Cell Size”)•Reduces the number of Probe Responses.•Prevents clients with RSS below the threshold from associating.Force Disassociate Field is available when Probe Suppression is enabled. This setting doesthe following:•Disassociates “Sticky Clients”•Occurs 5dBm below the suppression threshold.•Prevents clients from re-associating to the AP.•Encourages/Forces roaming to a better AP.Configure per radio (Enable/Disable).RSS Threshold (dBm) 90 (Range of -50 to -100). Field is available when Probe Suppression isenabled.Max % of non-unicast trac per BeaconperiodDefines the maximum percentage of time that the AP transmits non-unicast packets (broadcast and multicast trac) for each configuredBeacon Period. For each non-unicast packet transmitted, the systemcalculates the airtime used by each packet and drops all packets thatexceed the configured maximum percentage. Restrict non-unicasttrac, to limit the impact of broadcasts and multicasts on overallsystem performance.Optimized Multicast for power save Enables several performance enhancements applicable to clients inpower save mode. One of these enhancements converts multicast tounicast for power save clients when the ratio of active to power saveclients is suciently large.Adaptable rate for Multicast Determines if the AP tracks the lowest unicast transmission speed ofany station currently associated to the AP. Multicast frames are thenforwarded at that speed or at the Minimum Basic Rate, whichever ishigher.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide118
DraftTable 10: Multi-Edit AP Properties (continued)FField DescriptionMulticast to Unicast delivery Determines if multicast packets are replaced by one unicast packet perdestination station. Each unicast packet is transmitted at the highestspeed the destination station will accept. Note: It is possible that someclient devices will not handle frames properly when the L2 MAC isunicast and the L3 IP address is multicast in which case the "Multicastto Unicast Delivery" option should be disabled.Note: The AP converts a multicast frame to unicast frames only whenit determines that it is more ecient to do so. With the exception of“Optimized Multicast for power save” these options can be enabled atany time without service disruption.11n Radio SettingsGuard Interval Ensures that individual transmissions do not interfere with oneanother. It is the space between the symbols being transmitted.Selecting Short increases throughput, but can increase interference.Selecting Long can increase overhead due to additional idle time. Thewireless 802.11n AP provides a shorter guard interval, which increaseschannel throughput. Long guard periods reduce channel eciency.Protection Mode When data collides on a given channel, CTS (clear to send) protectiondetermines which device transmits at a given time.•Auto. The default and recommended setting.•None. Select if 11b APs and clients are not expected.•Always. Select if you expect many 11b-only clients.Protection Type Select a protection type:•CTS (Clear to Send) Only.•RTS (Request to Send) and CTS. Recommended when a 40 MHz or80 MHz channel is used. This protects high throughputtransmissions on extension channels from interference fromnon-11n APs and clients.Extension Channel Busy Threshold CTS Only or RTS CTS, when a 40 MHz channel is used. This protectshigh throughput transmissions on extension channels frominterference from non-11n APs and clients.Aggregate MSDUs Determines MAC Service Data Unit (MSDU) aggregation. Enable toincrease the maximum frame transmission size.Aggregate MPDUs Determines MAC Protocol Data Unit (MPDU) aggregation. Enable toincrease the maximum frame transmission size, providing a significantimprovement in throughput.Aggregate MPDU Max Length Defines the maximum length of the MAC Protocol Data Unit (MPDU)aggregation. Valid values range from 1024-65535 bytes. For the802.11ac radio (Radio 1 of the AP38xx), the range is 1024-1048575.Agg. MPDU Max # of Sub-frames Determines the maximum number of sub frames in the aggregateMAC Protocol Data Unit (MPDU). Valid value range is 2-64. The defaultvalue and recommended value is 64. Setting this value to 64 results inless overhead and higher throughput.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide119
DraftTable 10: Multi-Edit AP Properties (continued)FField DescriptionADDBA Support Block acknowledgement. Provides acknowledgement of a group offrames instead of a single frame. ADDBA Support must be enabled ifAggregate MPDU is enable.LDPC Increases the reliability of the transmission resulting in a 2dB increasedperformance compared to traditional 11n coding.STBC Space Time Block Coding. A simple open loop transmit diversityscheme. When enabled, STBC configuration is 2x1 (two spatial streamscombined into one spatial stream). TXBF overrides STBC if both areenabled for single stream rates.TXBF Tx Beam Forming is a technique of re-aligning the transmittermultipath spatial streams phases in order to get better signal-to-noiseratio on the receiver side. For the AP37xx and AP38xx models, validvalues are Enabled or Disabled. For the 39xx APs, this setting is onlyavailable on Radio1. The valid values are: MU_MIMO and Disabled.Static ConfigurationEWC Search List Defines the list of IP addresses that the AP is configured to try toconnect to in the event that the current connection to the controller islost.Tunnel MTU Maximum transmission unit. Determines the largest packet size thancan be transmitted by an IP interface without the packet needing to bebroken down into smaller units.WLAN AssignmentsWLAN Assignment Option Determines action on the WLAN assignment list associated with oneor more APs. Valid values are Clear WLAN List or Reconfigure WLANList.Discovery and RegistrationWhen a wireless AP is powered on, it automatically begins a discovery process to determine its own IPaddress and the IP address of the controller. When the discovery process is successful, the AP registerswith the controller. For more information, see Figure 12.WarningOnly use power supplies that are recommended by Extreme Networks.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide120
ftFigure 12: Wireless AP Discovery ProcessWireless AP DiscoveryWireless APs discover the IP address of a controller using a sequence of mechanisms that allow for thepossible services available on the enterprise network. The discovery process is successful when the APsuccessfully locates a controller to which it can register.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1121
DraftEnsure that the appropriate services on your enterprise network are prepared to support the discoveryprocess. The following steps are used to find a known controller:1 Use the predefined static IP addresses for the controllers on the network (if configured).You can specify a list of static IP addresses of the controllers on your network. On the StaticConfiguration tab, add the addresses to the Wireless Controller Search List.CCautionWireless APs configured with a static Wireless Controller Search List can connect only tocontrollers in the list. Improperly configured APs cannot connect to a non-existentcontroller address, and therefore cannot receive a corrected configuration.2 Use the IP address of the controller to which the AP last connected successfully.Once an AP has successfully registered with a controller, it recalls that controller's IP address, anduses that address on subsequent reboots. The AP bypasses discovery and goes straight toregistration.If a known controller cannot be located, the following discovery process steps should be followed:3 Use DHCP Option 60 to query the DHCP server for available controllers. The DHCP server respondsto the AP with Option 43, which lists the available controllers.For the DHCP server to respond to an Option 60 request from an AP, configure the DHCP serverwith the vendor class identifier (VCI) for each AP. Also, configure the DHCP server with the IPaddresses of the controllers. For more information, refer to the Getting Started Guide.4 Use a Domain Name Server (DNS) lookup for the host name Controller.domain-name.The AP tries the DNS server if it is configured in parallel with SLP unicast and SLP multicast.If you use this method for discovery, place an A record in the DNS server for Controller.<domain-name>. The <domain-name> is optional, but if used, ensure it is listed with the DHCP server.5 Use a multicast SLP request to find SLP SAsThe AP sends a multicast SLP request, looking for any SLP Service Agents providing the ExtremeNetworks service.The AP tries SLP multicast in parallel with other discovery methods.6 Use DHCP Option 78 to locate a Service Location Protocol (SLP) Directory Agent (DA), followed by aunicast SLP request to the Directory Agent.To use the DHCP and unicast SLP discovery method, ensure that the DHCP server on your networksupports Option 78 (DHCP for SLP RFC2610). The APs use this method to discover the controller.This solution takes advantage of two services that are present on most networks:•DHCP — The standard is a means of providing IP addresses dynamically to devices on a network.•SLP — A means of allowing client applications to discover network services without knowingtheir location beforehand. Devices advertise their services using a Service Agent (SA). In largerinstallations, a Directory Agent (DA) collects information from SAs and creates a centralrepository (SLP RFC2608).Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide122
DraftThe controller contains an SLP SA that, when started, queries the DHCP server for Option 78 andif found, registers itself with the DA as service type Extreme Networks. The controller contains aDA (SLPD).The AP queries DHCP servers for Option 78 to locate any DAs. The SLP User Agent for the APthen queries the DAs for a list of Extreme Networks SAs.Option 78 must be set for the subnets connected to the ports of the controller and the subnetsconnected to the APs. These subnets must contain an identical list of DA IP addresses.Wireless AP RegistrationTo define the discovery process parameters:1 From the top menu, click AP.2 In the left pane, click Global > Registration.The following screen appears:3 Configure the following parameters:Security Mode•The Allow all Wireless APs to connect option is selected by default. For more information, see Security Mode on page 124.•Allow only approved Wireless APs to connectDiscovery Timers . The discovery timer parameters dictate the number of retry attempts and thetime delay between each attempt.•Number of retriesConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1123
Draft•Delay between retriesThe number of retries is limited to 255 for the discovery. The default number of retries is 3, andthe default delay between retries is 3 seconds.SSH AccessSet up a Secure Shell password. Click Unmask to display the password as you type.•Password•Confirm PasswordSecure ClusterCluster Shared Secret. A common, default cluster ID.•Click Unmask to display the shared secret value.•Check Use Cluster Encryption . If you disable cluster encryption, the AP cannot participate in thecluster.4 Click View SLP Registration to confirm SLP Registration. A screen appears displaying the results ofthe diagnostic slpdump tool.5 From the Wireless AP Registration screen, click Save to save your changes.Once the discovery parameters are defined, you can connect the AP to a power source. For instructionson connecting and powering an AP, refer to the Installation Guide for the specific AP.Security ModeSecurity mode defines how the controller behaves when registering new, unknown devices. During theregistration process, the controller’s approval of the AP’s serial number depends on the security modethat has been set:•Allow all APs to connect•If the controller does not recognize the registering serial number, a new registration record isautomatically created for the AP (if within MDL license limit). The AP receives a defaultconfiguration. The default configuration can be the default template assignment.•If the controller recognizes the serial number, it indicates that the registering device is pre-registered with the controller. The controller uses the existing registration record to authenticatethe AP and the existing configuration record to configure the AP.•Allow only approved APs to connect (this is also known as secure mode)•If controller does not recognize the AP, the AP's registration record is created in pending state (ifwithin MDL limits). The administrator is required to manually approve a pending AP for it toprovide active service. The pending AP receives minimum configuration only, which allows it tomaintain an active link with the controller for future state change. The AP's radios are notconfigured or enabled. Pending APs are not eligible for configuration operations (VNSAssignment, default template, Radio parameters) until approved.•If the controller recognizes the serial number, the controller uses the existing registration recordto authenticate the AP. Following successful authentication, the AP is configured according to itsstored configuration record.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1124
DraftDuring the initial setup of the network, Extreme Networks recommends that you select the Allowall Wireless APs to connect option. This option is the most ecient way to get a large number ofAPs registered with the controller. Once the initial setup is complete,Extreme Networksrecommends that you reset the security mode to the Allow only approved Wireless APs toconnect option. This option ensures that no unapproved APs are allowed to connect. For moreinformation, see Configuring Wireless AP Properties on page 156.Registration After DiscoveryAny of the discovery steps 2 through 6 can inform the AP of a list of multiple IP addresses to which theAP may attempt to connect. Once the AP has discovered these addresses, it sends out connectionrequests to each of them. These requests are sent simultaneously. The AP attempts to register only withthe first which responds to its request.When the AP obtains the IP address of the controller, it connects and registers, sending its serialnumber identifier to the controller, and receiving from the controller a port IP address and binding key.Once the AP is registered with a controller, configure the AP. After the AP is registered and configured,you can assign it to one or more Virtual Network Services (VNS) to handle wireless trac.The AP is registered with Secure mode and Un-secure mode. For new APs, that option is set in AAPDefault Settings dialog.Viewing a List of All APsTo view a list of all APs:Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide125
aft1 From the top menu, click AP.Search for any part of the AP string, any column of the AP list. Results:•APs that match the search criteria appear.•Select one or more APs and apply actions to selected APs.2At the top of the screen, enter search criteria and click .APs that match the search criteria are displayed in the list.3 To take action on one or more APs, select the check box for the AP and select an action from theActions button. For more information, see AP Actions on page 128.4 To view AP properties, click the AP row (not the check box). AP details are displayed.5 Click Configure to display AP properties. For more information, see AP Properties Tab Configurationon page 159.6 To add a new AP to the list, click New > Create. For more information, see New Button -- Adding andRegistering a Wireless AP on page 131.7 To add a new AP as a clone of an existing AP, click New > Clone. For more information, see Creatinga Clone AP on page 133.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1126
DraftRRelated LinksAP Search Facility on page 127Understanding AP Status on page 127AP Actions on page 128Radio Actions on page 130New Button -- Adding and Registering a Wireless AP on page 131Deleting an AP on page 134AP Properties Tab Configuration on page 159AP Search FacilitySearch for any part of the AP string, any column of the AP list. Results:•APs that match the search criteria appear.•Select one or more APs and apply actions to selected APs.To search, do the following:1 Go to AP > APs.2At the top of the screen, enter search criteria and click .APs that match the search criteria are displayed in the list.Related LinksAP Actions on page 128Radio Actions on page 130New Button -- Adding and Registering a Wireless AP on page 131Deleting an AP on page 134Understanding AP Status on page 127Understanding AP StatusThe full AP list can be filtered to display just Foreign APs or just Local APs. When displaying a list of allAPs, the value in the Status column is limited to Foreign or Local. In the left pane, click the Foreign orLocal link to filter the list respectively. When the list is filtered, the value in the Status column changes.Possible statuses for Local APs include:•Pending. (You cannot view AP properties for Pending APs.)•Active•In-ActivePossible statuses for Foreign APs include:•Active•In-ActiveConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide127
DraftFor information about changing an AP's status, see AP Actions on page 128.AP ActionsTake the following actions from the AP Actions button.Figure 13: AP Actions buttonTable 11: AP ActionsFField DescriptionImage Upgrade Select from the list of AP version images and apply to selected APs. Ifmore than one AP is selected, the upgrade image must be commonbetween the selected APs. If not, message displays indicating nocommon image.To upgrade without interrupting service, click Upgrade withoutinterrupting service. If you click this option while the upgradescheduler is running, the schedule is interrupted, and the currentupgrade cycle calculates a new schedule that includes APs thatweren't upgraded.Download appropriate image or select dierent APs. For informationon downloading an upgrade image, see Downloading a new WirelessAP Software Image on page 240.Multi Edit Opens MMulti Edit dialog for selected APs. Configuration changes areapplied to selected APs only. For more information, see AP Multi-EditProperties on page 111.Manage Certificates Opens CCertificates screen for selected APs. Configuration changes areapplied to selected APs only. For more information, see ManagingCertificates on page 211Approve Approve — A Wireless AP's status changes from Pending to Approve ifthe AAP Registration screen was configured to register only approvedAPs.Release Release foreign APs after recovery from a failover. Releasing an APcorresponds to the Availability function. For more information, see Availability and Session Availability on page 537.Pending Change Status to Pending — AP is removed from the Active list, and isforced into discovery.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide128
DraftTable 11: AP Actions (continued)FField DescriptionReboot Restart selected APs without using SSH to access it.On-demand Background Scan To verify channel assignments and review channel details withouthaving to run a full ACS, run an on-demand background scan. Formore information, see Running a Background Scan on page 638.Set Country Select from a list of countries and apply the command to the selectedAPs. You are prompted to confirm your selection.Apply WLAN The AApply WLAN dialog appears. Select the radio for each configuredWLAN Service for the selected AP. List can contain 128 WLANServices. You are prompted to confirm your selection. For AP3912 only,you can select the client port for each service.For the AP3916 only, youcan select CAM on each service.Reboot Camera For AP3916 only. Restarts the camera on the AP.Reset Camera For AP3916 only. Resets the camera to factory default settings. Afterthe camera is reset, a DHCP server is required to reassign IP addressesto the camera.Multi Edit - IoT Configure more than one AP for IoT support.Related LinksIoT Multi-Edit Configuration on page 129IoT Thread Gateway on page 196Modifying the Status of a Wireless AP on page 156Assigning WLAN Services to Client Ports on page 170Applying WLAN ServiceSelect the radio for each configured WLAN Service for the selected AP. List can contain 128 WLANServices. You are prompted to confirm your selection. For AP3912 only, you can select the client port foreach service.Related LinksAssigning WLAN Services to Client Ports on page 170IoT Multi-Edit ConfigurationConfigure more than one AP at a time for IoT support.1 Select the check box next to more than one AP that supports the IoT.The following APs oer integrated BLE/802.15.4 radios: AP3912i , AP3915i/e, AP3916ic, AP3917i/e/k.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide129
Draft2 Click Actions > Multi Edit - IoT.Figure 14: Multi-Edit - IoT Action3 Select Enable from the IoT Admin field.4 Select a value from the Application field. Valid values are iBeacon, iBeacon Scan, Eddystone-urlBeacon, Eddystone-url Scan, or Thread Gateway. Resulting parameters depend on the applicationyou select here.RRelated LinksConfiguring AP as an iBeacon on page 190Configuring iBeacon Scan on page 192Configuring AP as an Eddystone-url Beacon on page 194Configuring Eddystone-url Scan on page 195Advanced Thread Gateway Properties on page 198Radio ActionsTake the following actions from the Radio Actions button for the appropriate radio.Figure 15: Radio 1 ActionsConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide130
DraftFigure 16: Radio 2 Actions buttonTable 12: Radio ActionsFField DescriptionSet Tx Power Apply this command to selected APs. All selected APs must be thesame model and licensed for the same country. Configure the settingfrom the resulting dialog.First, configure the selected APs to the same radio mode and samechannel width before setting Tx Power here. When selected AP’s areconfigured for the same width/mode, the SSet Tx Power dialog displaysthe width/mode and you are able to set the Tx power and channel. Formore information, see Configuration Parameters for Radio Propertieson page 180.Auto Channel Select Apply this command to selected APs. For more information aboutACS, see Dynamic Radio Management (DRM) on page 174.Set Radio Mode Apply this command to selected APs. All selected APs must be thesame model and licensed for the same country. Configure the settingfrom the resulting dialog.For more information, see Configuration Parameters for RadioProperties on page 180.Set Channel Width Apply this command to selected APs. All selected APs must be thesame model and licensed for the same country. Configure the settingfrom the resulting dialog.For more information, see Configuration Parameters for RadioProperties on page 180.Related LinksConfiguration Parameters for Radio Properties on page 180Dynamic Radio Management (DRM) on page 174New Button -- Adding and Registering a Wireless APYou can manually add and register a wireless AP to the controller, but the AP must still go through theautomatic discovery and registration process to locate the controller. The AP may skip the discoveryprocess if it has a static list, or has previously connected and registered with the controller. When youmanually add and register an AP, the system applies the default settings to the AP. After the systemregisters the AP, you can go in and edit its configuration settings (see Configuring Wireless APProperties on page 156).To add and register an AP manually:1 From the top menu, click AP.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide131
raftRegardless of the tab that you click on, the New button displays at the bottom of the page.2 Click New and select Create or Clone.CCreateDisplays the AAdd Wireless AP dialog. For field descriptions, see Table 13 on page 133.CloneDisplays the CClone AP dialog. See Creating a Clone AP on page 133.The AAdd Wireless AP screen displays.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide132
DraftTable 13: Add Wireless APFField DescriptionSerial # Type the unique identifier of the AP.Hardware Type Select the hardware model of this AP from the drop-down menu. WithExtremeWireless v10.01 each controller is licensed in a specific domain.There are three types of domain licenses: FCC, ROW, EGY, and MNT.The ExtremeWireless user interface reflects the domain of thecontroller. The following are use cases for each domain:•A wireless controller with an FCC license can manage AP37xx,AP38xx, and AP39xx-FCC. These access points can be deployed inthe United States, Puerto Rico, or Colombia.•A wireless controller with a ROW license can manage AP37xx,AP38xx, and AP39xx-ROW. These access points can be deployedin any country except the United States, Puerto Rico, Egypt, orColombia.•A wireless controller with a MNT license can manage only domain-locked access points, which are the AP39xx-FCC and the AP39xx-ROW only. The AP39xx-FCC must be deployed in the UnitedStates, Puerto Rico, or Colombia. The AP39xx-ROW must bedeployed in any country except the United States, Puerto Rico,Egypt, or Colombia.Note: The AP37xx and AP38xx cannot connect to a controllerlicensed in the MNT domain.•A wireless controller with a EGY license can manage AP37xx,AP38xx, and AP39xx-EGY.Name Type a unique name for the AP that identifies the access point. Thedefault value is the AP’s serial number.Description Enter a description of this AP.Add Wireless AP Click to add the AP with default settings. You can later modify thesesettings.When an AP is added manually, it is added to the controller databaseonly and does not get assigned.Close Click to close this window.Related LinksConfiguring Wireless AP Properties on page 156Creating a Clone AP on page 133Creating a Clone APCreate a new AP with the same type and configuration as the selected AP. Only one AP can be selectedfor the Clone action.1 Select an AP from the AP list and click New > Clone.2 Enter the Serial # and Name of the new clone AP.3 Click Apply.Related LinksConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide133
DraftViewing a List of All APs on page 125New Button -- Adding and Registering a Wireless AP on page 131Deleting an APTo delete an AP from the controller AP list:1 Go to AP > APs.2 Select the APs to delete.3 Click Delete.Wireless AP Default ConfigurationDefault wireless AP configuration acts as a configuration template that can be automatically assigned tonew registering APs. The default AP configuration allows you to specify common sets of radioconfiguration parameters and VNS assignments for APs.Configuring the Default Wireless AP SettingsWireless APs are added with default settings. You can modify the system’s AP default settings, and thenuse these default settings to configure newly added APs. In addition, you can base the AP defaultsettings on an existing AP configuration or you can make pre-configured APs inherit the properties ofthe default AP configuration when they register with the system.Each AP model has its own tab:•Common Configuration — Configure common configuration, such as WLAN assignments and staticconfiguration options for all APs. See Configuring Common Configuration Default AP Settings onpage 135.•AP37xx W78xC— Configure the default settings for the Radar series APs. See Configuring AP37xx,W78xC Default AP Settings on page 146.•AP37xx Dual Band — Configure the default settings for the Radar series APs. See ConfiguringAP37xx Dual Band Default Settings on page 145•AP38xx— Configure the default settings for the ExtremeWireless Radar series APs. See ConfiguringAP38xx Default AP Settings on page 143.•AP3801— Configure the default settings for the ExtremeWireless Radar series APs. See ConfiguringAP3801 Default AP Settings on page 143.•AP3805— Configure the default settings for the ExtremeWireless Radar series APs. See ConfiguringAP3805 Default AP Settings on page 144.•AP3912 — Configure the default settings for the ExtremeWireless wall plate AP. See ConfiguringAP3912 Default AP Settings on page 139.•AP3915 — Configure the default settings for the ExtremeWireless AP3915, BLE Radio enabled AP.See Configuring AP3915 Default AP Settings on page 138.•AP3916ic — Configure the default settings for the ExtremeWireless Integrated Camera AP. See Configuring AP3916 Default AP Settings on page 137.•AP3917 — Configure the default settings for the ExtremeWireless AP3917, BLE Radio enabled AP.See Configuring AP3917 Default AP Settings on page 136.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide134
Draft•AP3935 — Configure the default settings for the ExtremeWireless indoor series AP. See ConfiguringAP3935 Default AP Settings on page 140.•AP3965 — Configure the default settings for the ExtremeWireless outdoor series AP. See Configuring AP3965 Default AP Settings on page 142.Configuring Common Configuration Default AP SettingsTo configure common configuration default AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.The Common Configuration tab is displayed.NNotePorts 1, 2, and 3, are available on the AP3912. Port 1 is the port that corresponds to theCamera (CAM) function of the AP3916ic.3 In the Static Configuration section, you can specify an EWC search list or use the search listprovided from the AP. Do one of the following:Check Learn EWC Search List from AP to accept the AP's search list, or clear the check box tospecify a common search list for all APs. For more information about creating an EWC Search List,see Table 22 on page 201.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide135
Draft4 In the WLAN Assignments section, you can associate a WLAN assignment to a radio.•If the controller is in an availability pair, you can apply default WLAN assignments to foreign APs,by selecting the Apply default WLAN assignments to foreign APs check box. For moreinformation, see Availability on page 537.•To associate a WLAN Service in the list to a radio and or a client port, select the check boxmatching the radio and or port for the selected WLAN.•One WLAN can be assigned per port. The assignment enables the port.•Wireless and wired users associated to the same WLAN service receive identical service. Theyare aected by the same policies and filters.NoteAirtime % is available for AP38xx and AP39xx access point models that are assignedWLANS configured with Reserved Airtime.5 Click Save Settings.Related LinksConfiguring Airtime Fairness: Reservation Mode on page 406Configuring AP3917 Default AP SettingsTo configure AP3917 default AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide136
raft3 Click the AP3917 FCC tab.Figure 17: AP3917 Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.5 Click Save Settings.Configuring AP3916 Default AP SettingsTo configure AP3916 default AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1137
aft3 Click the AP3916 ROW tab.Figure 18: AP3916 Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.5 Click Save Settings.Configuring AP3915 Default AP SettingsTo configure AP3915 default AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1138
raft3 Click the AP3915 FCC tab.Figure 19: AP3915 Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.5 Click Save Settings.Configuring AP3912 Default AP SettingsTo configure AP3912 default AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1139
ft3 Click the AP3912 FCC tab.Figure 20: AP3912 Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.5 Click Save Settings.Configuring AP3935 Default AP SettingsExtremeWireless 10.01 associates the license key to a specific Wireless Controller, and each license keyapplies to a specific regulatory domain (FCC or ROW). The FCC domain operates in the United States,Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1140
ftColombia and Puerto Rico. The ROW domain operates outside these countries. The AP3935 can belicensed to operate within an FCC or ROW regulatory domain.To configure AP3935 default AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.3 Click the AP3935 FCC tab.Figure 21: AP3935 FCC Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.5 To save your changes, click Save Settings.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1141
DConfiguring AP3965 Default AP SettingsExtremeWireless 10.01 associates the license key to a specific Wireless Controller, and each license keyapplies to a specific regulatory domain (FCC or ROW). The FCC domain operates in the United States,Colombia and Puerto Rico. The ROW domain operates outside these countries. The AP3965 can belicensed to operate within an FCC or ROW regulatory domain.To configure AP3965 default AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.3 Click the AP3965 FCC tab.Figure 22: AP3965 FCC Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1142
ft5 To save your changes, click Save Settings.Configuring AP38xx Default AP SettingsTo configure AP38xx default AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.3 Click the AP38xx tab.Figure 23: AP38xx Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.5 To save your changes, click Save Settings.Configuring AP3801 Default AP SettingsTo configure AP3801 default AP settings:1 From the top menu, click AP.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1143
raft2 In the left pane, click Global > Default Settings.3 Click the AP3801 tab.Figure 24: AP3801 Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.5 To save your changes, click Save Settings.Configuring AP3805 Default AP SettingsTo configure AP3805 default AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1144
raft3 Click the AP3805 ROW tab.Figure 25: AP3805 Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.5 To save your changes, click Save Settings.Configuring AP37xx Dual Band Default SettingsThis AP37xx profile supports two concurrent Wi-Fi radios (2.4 GHz and 5 GHz). To configure AP37xxdefault AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1145
raft3 Click the AP37xx tab.Figure 26: AP37xx Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.5 Click Save Settings.Configuring AP37xx, W78xC Default AP SettingsTo configure AP37xx, W78xC default AP settings:1 From the top menu, click AP.2 In the left pane, click Global > Default Settings.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1146
raft3 Click the AP37xx W78xC tab.Figure 27: AP37xx W78xC Default Settings4 Configure the following Default AP Settings as required:•AP Properties•Radio Settings•Advanced SettingsFor detailed information, see AP Default Settings on page 148.5 Click Save Settings.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1147
DraftAP Default SettingsTable 14: AP Default SettingsFField DescriptionAP PropertiesLLDP Determines if the AP broadcasts LLDP information. This option isdisabled by default.If SNMP is enabled on the controller and you enable LLDP, the LLLDPConfirmation dialog is displayed.Select one of the following:•Proceed (not recommended) — Enables LLDP and keeps SNMP(Simple Network Management Protocol) running.•Disable SNMP publishing, and proceed — Enables LLDP anddisables SNMP.•For more information on using SNMP, see the Extreme NetworksExtremeWireless Maintenance GuideAnnouncement Interval Determines how often the AP advertises its information by sending anew LLDP (Link Layer Discovery Protocol) packet when LLDP isenabled. This value is measured in seconds. If there are no changes tothe AP configuration that impact the LLDP information, the AP sendsa new LLDP packet according to this schedule.Note: Announcement Interval is not applicable on all AP models.Announcement Delay Determines the length of time that delays the new packet delivery. Theannouncement delay helps minimize LLDP (Link Layer DiscoveryProtocol) packet trac when LLDP is enabled. This value is measuredin seconds. If a change to the AP configuration occurs which impactsthe LLDP information, the AP sends an updated LLDP packet.Note: Announcement Delay is not applicable on all AP models.Time to Live Determines the lifespan of the LLDP (Link Layer Discovery Protocol)packet. The Time to Live value is calculated as four times theAnnouncement Interval value. It cannot be directly edited.Note: Time to Live is not applicable on all AP models.Country Select the country of operation.Radio Settings (Radio 1 and Radio 2)Admin mode Select On to enable this radio; Select O to disable this radio.Radio mode Click the radio mode based on the type of AP. For more informationon the available Radio modes, see Configuring Wireless AP RadioProperties on page 174.The available radio settings are dependent on the radio mode youselect.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide148
DraftTable 14: AP Default Settings (continued)FField DescriptionChannel Width Click the channel width for the radio:•20 MHz — Click to allow 802.11n clients to use the primary channel(20 MHz) and non-802.11n clients, beacons, and multicasts to usethe 802.11b/g radio protocols.•40 MHz — Click to allow 802.11n clients that support the 40 MHzfrequency to use 40 MHz, 20 MHz, or the 802.11b/g radio protocols.802.11n clients that do not support the 40 MHz frequency can use20 MHz or the 802.11b/g radio protocols and non-802.11n clients,beacons, and multicasts use the 802.11b/g radio protocols.•80 MHz — Click to allow 802.11ac clients to use the 80MHzfrequency. Applies to AP38xx and AP39xx Radio 1 only.•Auto — Click to automatically switch between 20 MHz, 40 MHz,and 80 MHz channel widths, depending on how busy the extensionchannels are.RF Domain Uniquely defines a group of APs that cooperate in managing RFchannels and transmission power levels. The maximum length of thestring is 16 characters.Auto Tx Power Ctrl (ATPC) Determines if the AP will automatically adapt transmission powersignals. Click to either enable or disable ATPC from the Auto Tx PowerCtrl drop-down list. ATPC automatically adapts transmission powersignals according to the coverage provided by the AP. After a period oftime, the system stabilizes itself based on the RF coverage of yourWireless APs.Note: When enabled, Min Tx Power and Auto Tx Power Ctrl Adjustparameters can be edited, and the ATPC algorithm will adjust the APpower between Max Tx power and Min Tx Power. When disabled, theMax Tx Power selected value or the largest value in the compliancetable will be the power level used by the radio, whichever is smaller.Max Tx Power Click the appropriate Tx power level from the Max TX Power drop-down list. The values in the Max TX Power drop-down are in dBm andwill vary by AP. The values are governed by compliance requirementsbased on the country, radio, and antenna selected. Changing this valuebelow the current Min Tx Power value will change the Min Tx Power toa level lower than the selected Max TX Power.Note: If Auto Tx Power Ctrl (ATPC) is disabled, the selected value orthe largest value in the compliance table will be the power level usedby the radio, whichever is smaller.Min Tx Power If ATPC is enabled, select the minimum Tx power level that is equal orlower than the maximum Tx power level. We recommend that you usethe lowest supported value if you do not want to limit the potential Txpower level range that can be used.Note: The Min Tx Power setting cannot be set higher than the Max TxPower setting.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide149
DraftTable 14: AP Default Settings (continued)FField DescriptionAuto Tx Power Ctrl Adjust The Auto Tx Power Ctrl Adj parameter is a correction parameter thatallows you to manually adjust (up or down) the Tx Power calculated bythe ATPC algorithm. If ATPC is enabled, click the Tx power level thatcan be used to adjust the ATPC power levels that the system hasassigned. Extreme Networks recommends that use 0 dB during yourinitial configuration. If you have an RF plan that recommends Tx powerlevels for each AP, compare the actual Tx power levels your system hasassigned against the recommended values your RF plan has provided.Use the Auto Tx Power Ctrl Adjust value to achieve the recommendedvalues. Valid range is from -(Max Tx Power - Min Tx Power) dB to (MaxTx Power - Min Tx Power) dB.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide150
DraftTable 14: AP Default Settings (continued)FField DescriptionChannel Plan If ACS is enabled you can define a channel plan for the AP. Defining achannel plan allows you to control which channels are available for useduring an ACS scan. For example, you may want to avoid usingspecific channels because of low power, regulatory domain, or radarinterference.•For 5 GHz Radio nodes, click one of the following:•All channels — ACS scans all channels for an operating channeland, when ACS is triggered, the optimal channel is selectedfrom all available channels.•All Non-DFS Channels — ACS scans all non-DFS channels foran operating channel. With ACS, the AP selects the best non-DFS channel.•Custom — To configure individual channels from which the ACSselects an operating channel, click Configure. The CCustomChannel Plan dialog displays. By default, all channelsparticipate in the channel plan. Click the individual channelsyou want to include in the channel plan. To select contiguouschannels, use the Shift key. To select multiple, non-contiguouschannels in the list, use the CTRL key. Click OK to save theconfiguration.•All channels including weather radar — ACS selects the bestchannel from the available channels list. Selected channel maybe DFS, weather-radar DFS or non-DFS. Weather-radarchannels are approved for selected AP models in selectedcountries. Consult the compliance information for the selectedAP.The weather channel includes 5600-5650MHz sub-bandsand requires a listening period before the AP can providewireless service. During the listening period, the CurrentChannel field for DFS channels displays the value DFSTimeout, and the weather channel fields display DFSTimeout . In Europe, the listening period can be up to 10minutes. In the U.S., this period is 1 minute.•For 2.4 GHz Radio nodes, click one of the following:•3 Channel Plan — ACS scans the following channels: 1, 6, and 11in North America, and 1, 7, and 13 in the rest of the world.•4 Channel Plan — ACS scans the following channels: 1, 4, 7, and11 in North America, and 1, 5, 9, and 13 in the rest of the world.•Auto — ACS scans the default channel plan channels: 1, 6, and11 in North America, and 1, 5, 9, and 13 in the rest of the world.•Custom — If you want to configure individual channels fromwhich the ACS selects an operating channel, click Configure.The AAdd Channels dialog is displayed. Click the individualchannels you want to add to the channel plan while pressingthe CTRL key, and then click OK.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide151
DraftTable 14: AP Default Settings (continued)FField DescriptionAntenna Selection Antenna Selection — Click the antenna, or antenna combination, youwant to configure on this radio.When you configure 11n Wireless APs to use specific antennas, thetransmission power is recalculated; the Current Tx Power Level valuefor the radio is automatically adjusted to reflect the recent antennaconfiguration. It takes approximately 30 seconds for the change to theCurrent Tx Power Level value to be reflected in the ExtremeWirelessAssistant. Also, the radio is reset causing client connections on thisradio to be lost.Note: Antenna Selection is not applicable on all AP models.Advanced dialog – AP PropertiesPoll Timeout Type the timeout value, in seconds. The AP uses this value to triggerre-establishing the link with the controller if the AP does not get ananswer to its polling. The default value is 10 seconds.Note: If you are configuring session availability, the Poll Timeout valueshould be 1.5 to 2 times of Detect link failure value on AAP Propertiesscreen. For more information, see Session Availability on page 545.Secure Tunnel This feature, when enabled, provides encryption, authentication, andkey management between the AP and/or controllers.Select the desired Secure Tunnel mode from the drop-down list:•Disabled — Secure Tunnel is turned o and no trac is encrypted.All SFTP/SSH/TFTP trac works normally.•Encrypt control trac between AP & Controller — An IPSEC tunnelis established from the AP to the controller and all SFTP/SSH/TFTP/WASSP control trac is encrypted. The AP skips theregistration and authentication phases and when selected, theSecure Tunnel Lifetime feature can be configured.•Encrypt control and data trac between AP & Controller — Thismode only benefits routed/bridged@Controller Topologies. AnIPSEC tunnel is established from the AP to the controller and allSFTP/SSH/TFTP/WASSP control and data trac is encrypted. TheAP skips the registration and authentication phases, and whenselected, the Secure Tunnel Lifetime feature can be configured.Note: This option is not available for AP3805 models.•Debug mode — An IPSEC tunnel is established from the AP to thecontroller, no trac is encrypted, and all SFTP/SSH/TFTP tracworks normally. The AP skips the registration and authenticationphases and when selected, the Secure Tunnel Lifetime feature canbe configured.Note: Changing a Secure Tunnel mode will automatically disconnectand reconnect the AP.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide152
DraftTable 14: AP Default Settings (continued)FField DescriptionSecure Tunnel Lifetime Enter an interval (in hours) at which time the keys of the IPSEC tunnelare renegotiated.Note: Changing the Secure Tunnel Lifetime setting will not cause anyAP disruption.Remote Access Click to Enable or Disable SSH to the AP.Location-based Service Click to Enable or Disable location-based service on this AP. Location-based service allows you to use this AP with an AeroScout or Ekahausolution.Maintain client sessions in event of pollfailureClick to Enable or Disable (using a bridged at AP VNS) the AP remainsactive if a link loss with the controller occurs. This option is disabled bydefault.Restart service in the absence ofcontrollerClick to Enable or Disable (if using a bridged at AP VNS) to ensure theAP continues providing service if the AP’s connection to the controlleris lost. If this option is enabled, it allows the AP to start a bridged at APVNS even in the absence of a controller.Use broadcast for disassociation Click to Enable or Disable if you want the AP to use broadcastdisassociation when disconnecting all clients, instead of disassociatingeach client one by one. This aects the behavior of the AP under thefollowing conditions:•If the AP is preparing to reboot or to enter one of the specialmodes (DRM initial channel selection).•If a BSSID is deactivated or removed on the AP.This option is disabled by default.IP Multicast Assembly Click to Enable or Disable multicast frames assembling for groups ofAPs using AP Multi-editing settings (for more information, see APMulti-Edit Properties on page 111 ).Balanced Channel List Power: This simplifies power settings such that they will function across allchannels in the channel plan.LED Select the desired LED pattern from the drop-down list. Optionsinclude: O, WDS Signal Strength, Identify, and Normal.Radio SettingsDTIM Type the desired DTIM (Delivery Trac Indication Message) period —the number of beacon intervals between two DTIM beacons. To ensurethe best client power savings, use a large number. Use a small numberto minimize broadcast and multicast delay. The default value is 5.Beacon Period Defines the time, in milliseconds, between beacon transmissions. Thedefault value is 100 milliseconds.RST/CTS Type the packet size threshold, in bytes, above which the packet willbe preceded by an RTS/CTS (Request to Send/Clear to Send)handshake. The default value is 2346, which means all packets are sentwithout RTS/CTS. Reduce this value only if necessary.Frag. Threshold Type the fragment size threshold, in bytes, above which the packetswill be fragmented by the AP prior to transmission. The default value is2346, which means all packets are sent un-fragmented.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide153
DraftTable 14: AP Default Settings (continued)FField DescriptionDynamic Channel Selection Click one of the following:•Monitor Mode — If trac or noise levels exceed the configuredDCS thresholds, an alarm is triggered and an information log isgenerated.•Active Mode — If trac or noise levels exceed the configured DCSthresholds, an alarm is triggered and an information log isgenerated. In addition, the AP ceases operating on the currentchannel and ACS automatically selects an alternate channel for theAP to operate on.DCS Noise Threshold Type the noise interference level, measured in dBm, after which ACSscans for a new operating channel for the AP if the threshold isexceeded.DCS Channel Occupancy Threshold Type the channel utilization level, measured as a percentage, afterwhich ACS scans for a new operating channel for the AP if thethreshold is exceeded.DCS Update Period Type the time, measured in minutes that determines the period duringwhich the AP averages the DCS Noise Threshold and DCS ChannelOccupancy Threshold measurements. If either one of these thresholdsis exceeded, then the AP triggers ACS.DCS Interference Event(appears if Dynamic Channel Selection isenabled)Enable or disable the following DCS Events:•Bluetooth•Microwave•Cordless Phone•Constant Wave•Video BridgeInterference Wait Time Length of the delay (in seconds) before logging an alarm. Defaultsetting is 10 seconds.Preamble Click a preamble type for 11b-specific (CCK) rates: Short, or Long. ClickShort if you are sure that there is no 11b APs or client in the vicinity ofthis AP. Click Long if compatibility with 11b clients is required.Protection Rate Click a protection rate: 1, 2, 5.5, or 11 Mbps. The default andrecommended setting is 11. Only reduce the rate if there are many 11bclients in the environment or if the deployment has areas with poorcoverage. For example, rates lower than 11 Mbps are required to ensurecoverage.Protection Mode Click a protection mode: None, Auto, or Always. The default andrecommended setting is Auto. Click None if 11b APs and clients are notexpected. Click Always if you expect many 11b-only clients.Protection Type Click a protection type, CTS Only or RTS CTS, when a 40 MHz or 80MHz channel is used. This protects high throughput transmissions onextension channels from interference from non-11n APs and clients.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide154
DraftTable 14: AP Default Settings (continued)FField DescriptionMax % of non-unicast trac per BeaconperiodEnter the maximum percentage of time that the AP transmits non-unicast packets (broadcast and multicast trac) for each configuredBeacon Period. For each non-unicast packet transmitted, the systemcalculates the airtime used by each packet and drops all packets thatexceed the configured maximum percentage. By restricting non-unicast trac, you limit the impact of broadcasts and multicasts onoverall system performance.Optimized Multicast for power save Click to optimize for power save.Adaptable rate for Multicast Click to enable adaptable rate capabilities.Multicast to Unicast delivery Click to set the Multicast to Unicast delivery method from the drop-down list.Enhanced Rate ControlMin. Basic Rate For each radio, click the minimum data rate that must be supported byall stations in a BSS:•Click 1, 2, 5.5, or 11 Mbps for 11b and 11b+11g modes.•Click 6, 12, or 24 Mbps for 11g-only mode.•Click 6, 12, or 24 Mbps for 11a mode.11n SettingsProtection Mode Click a protection mode: None, Auto, or Always. The default andrecommended setting is Auto. Click None if 11b APs and clients are notexpected. Click Always if you expect many 11b-only clients.Protection Type Click a protection type, CTS Only or RTS CTS, when a 40 MHz channelis used. This protects high throughput transmissions on extensionchannels from interference from non-11n APs and clients.Extension Channel Busy Threshold Type the extension channel threshold percentage, which if exceeded,disables transmissions on the extension channel (40 MHz).Aggregate MSDUs Click an aggregate MSDU mode: Enabled or Disabled. AggregateMSDU increases the maximum frame transmission size.Aggregate MPDUs Click an aggregate MPDU mode: Enabled or Disabled. AggregateMPDU provides a significant improvement in throughput.Aggregate MPDU Max Length Type the maximum length of the aggregate MPDU. The value range is1024-65535 bytes.Agg. MPDU Max # of Sub-frames Type the maximum number of sub-frames of the aggregate MPDU.The value range is 2-64.ADDBA Support Click an ADDBA support mode: Enabled or Disabled. ADDBA, or blockacknowledgement, provides acknowledgement of a group of framesinstead of a single frame. ADDBA Support must be enabled ifAggregate MPDU is enable.LDPC Click an LDPC mode: Enabled or Disabled. LDPC increases thereliability of the transmission resulting in a 2dB increased performancecompared to traditional 11n coding.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide155
DraftTable 14: AP Default Settings (continued)FField DescriptionSTBC Click an STBC mode: Enabled or Disabled. STBC is a simple open looptransmit diversity scheme. When enabled, STBC configuration is 2x1(two spatial streams combine into one spatial stream). TXBF willoverride STBC if both are enabled for single stream rates.TxBF Tx Beam Forming is a technique of re-aligning the transmittermultipath spatial streams phases in order to get better signal-to-noiseratio on the receiver side. Click a TXBF mode: For the AP37xx andAP38xx models, valid values are Enabled or Disabled. For the 39xxAPs, this setting is only available on Radio1 and valid values are MU-MIMO and Disabled.Configuring Wireless AP PropertiesWireless APs are added with default settings, which you can adjust and configure according to yournetwork requirements. In addition, you can modify the properties and the settings for each radio on theAP.You can also locate and select APs in specific registration states to modify their settings. For example,this feature is useful when approving pending APs when there are a large number of other APs that arealready registered. On the AAccess Approval screen, click Pending to select all pending APs, then clickApprove to approve all selected APs.Configuring AP settings can include the following processes:•Modifying the Status of a Wireless AP on page 156•AP Properties Tab Configuration on page 159•Setting Up the Wireless AP Using Static Configuration on page 199When configuring APs, you can choose to configure individual APs or simultaneously configure a groupof APs. For more information, see AP Multi-Edit Properties on page 111 .Modifying the Status of a Wireless APIf during the discovery process, the controller security mode was Allow only approved Wireless APs toconnect, then the status of the AP is Pending. Modify the security mode to Allow all Wireless APs toconnect.Related LinksSecurity Mode on page 124AP Rehoming on page 156AP Actions on page 128AP RehomingYou can balance your AP deployment by switching an AP from local to foreign (and from foreign tolocal). The AP will continue providing service without interruption while the APs are redeployed. If theavailability link is down, the conversion will be completed when the link is established.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide156
DraftThe rehomed AP will establish an active tunnel to the new controller and radio configuration ispreserved once conversion is complete.•WLAN assignments are not aected by rehoming.•WDS and Mesh APs cannot be converted from local to foreign.•A rehomed AP will be removed from load balance groups.AP DashboardExtremeWireless oers a dashboard of statistical information for each AP in the network. The followinginformation is displayed for each AP:•IP address. Supports both IPv4 and IPv6 addresses.•IoT MAC. Mac address for the Internet of Things enablement. Displays for AP3912 and AP3916 whenIoT is enabled.•Model Number•Software version running on the AP•Country•AP Role•Number of 802.3 clients (AP3912)•Camera IP (AP3916)•Number of radios•Channel number if applicable•Channel Mode•Power levelThe following APs oer integrated BLE/802.15.4 radios: AP3912i , AP3915i/e, AP3916ic, AP3917i/e/k.AP properties for these access points display the IoT MAC address and channel and the TX Power Levelfor the BLE radio when the IoT is enabled.Figure 28: AP3916 Dashboard with IoT EnabledThe dashboard displays a graphical representation over the last hour for the following:•Client count. Associated clients per radio•Devices by Type classification•Noise floor for both bands•Channel utilization for both bandsConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide157
ftFigure 29: AP DashboardCClientsDisplays the number of clients on each radio in 10-minute intervals. Use this information to gain visibilityover time into AP utilization per radio. Details for the AP3912 and AP3916 show the number of 802.3clients. These are clients that utilize the wired client ports that are available on these AP models.Devices by TypeOers visibility into the type of devices connected to your network by percentage. Use this informationto understand the BYOD usage on your network.Noise (dBm)Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide158
DraftTracks the noise level for each AP radio in 10-minute intervals. Use this information to understandchannel performance over time.CChannel Utilization (%)Tracks the percentage of trac on each radio. Use this information to understand channel usage overtime, in 10-minute intervals.Click Configure to display configuration options for the AP. For more information, see AP Properties TabConfiguration on page 159.Related LinksAP Properties Tab Configuration on page 159Channel Inspector Report on page 637AP Properties Tab ConfigurationUse the AP Properties tab to view and configure basic AP properties. Some of the AP properties can beviewed and configured via the Advanced dialog.1 From the top menu, click AP.2 Click the appropriate wireless AP in the list (not the check box). The AAP dashboard displays.For more information, see AP Dashboard on page 157.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide159
ft3 Click Configure. The AAP Properties tab displays.Related LinksAP Dashboard on page 157AP Properties Tab - Basic Settings on page 161AP Properties Tab - Advanced Settings on page 164Professional Install Settings on page 166Assigning Wireless AP Radios to a VNS on page 168Configuration Parameters for Radio Properties on page 180Configuring IoT Applications on page 189Setting Up the Wireless AP Using Static Configuration on page 199Setting Up 802.1x Authentication for a Wireless AP on page 203Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide160
DraftAP Properties Tab - Basic SettingsFField DescriptionSerial # Read-only. Displays a unique identifier (serial number) that is assignedduring the manufacturing process.Host Name Read-only. This value, which is based on AP Name, cannot be directlyedited. This value depicts the AP Host-Name value. If the AP Namevalue does begin with a number, for example when it is the AP serialnumber, the AP model is prepended to the value. This value is used fortracking purposes on the DHCP server.Name The default value of the AP Name is the serial number, but it can bemodified to any desired AP Name. Supported characters include:alphanumeric, blank space, hyphen, underscore, and period. Up to 255characters.Location Define the location of the AP.When a client roams to an AP with a dierent location, AreaNotification is triggered. The Area Notification feature is designed totrack client locations within pre-defined areas using either the LocationEngine (for more information, see Configuring the Location Engine onpage 609) or the AP Location field. When the clients change areas, anotification is sent.Location functionality on the AP is useful when access to ExtremeManagement Center OneView is not available.Zone Zone is a label that can be sent to a RADIUS server in place of an APBSSID in the called-station-id attribute. It can be easier to baseauthorization decisions on the zone label rather than on the BSSID.Each AP can have its own Zone label although it is often useful toassign the same Zone to multiple APs.Description Type comments for the AP.Topology Read only. The Topology name with which the AP is registered.AP Environment Select — Indoor or Outdoor. This property is available for outdoor APsonly, indicating where the AP is deployed. The Outdoor APs can bedeployed in both indoor and outdoor environments. AP placementshould depend on the country of operation that is selected and thecountry regulatory domain requirements for radio emissions. For moreinformation, see Outdoor Access Point Installation on page 167.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide161
DraftFField DescriptionHardware Type Select the hardware model of this AP from the drop-down menu. WithExtremeWireless v10.01 each controller is licensed in a specific domain.There are three types of domain licenses: FCC, ROW, EGY, and MNT.The ExtremeWireless user interface reflects the domain of thecontroller. The following are use cases for each domain:•A wireless controller with an FCC license can manage AP37xx,AP38xx, and AP39xx-FCC. These access points can be deployed inthe United States, Puerto Rico, or Colombia.•A wireless controller with a ROW license can manage AP37xx,AP38xx, and AP39xx-ROW. These access points can be deployed inany country except the United States, Puerto Rico, Egypt, orColombia.•A wireless controller with a MNT license can manage only domain-locked access points, which are the AP39xx-FCC and the AP39xx-ROW only. The AP39xx-FCC must be deployed in the United States,Puerto Rico, or Colombia. The AP39xx-ROW must be deployed inany country except the United States, Puerto Rico, Egypt, orColombia.Note: The AP37xx and AP38xx cannot connect to a controllerlicensed in the MNT domain.•A wireless controller with a EGY license can manage AP37xx,AP38xx, and AP39xx-EGY.Application Version Displays the ExtremeWireless release version.Status Approved — Indicates that the AP has received its binding key from thecontroller after the discovery process.If no status is shown, that indicates that the AP has not yet successfullybeen approved for access with the secure controller.You can modify the status of an AP on the Access Approval screen. Formore information, see Modifying the Status of a Wireless AP on page156.Active Clients Displays the number of wireless devices currently associated with theAP.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide162
DraftFField DescriptionRole Displays the role for the AP.Note: You can only view these options here. You cannot change them.Options include:•Trac Forwarding — Normal Operation. Applies to all APs.•Guardian — Once the AP is configured as a Guardian, the AP stopsforwarding trac and dedicates both radios to threat detectionand countermeasures. For more information, see Configuring an APas a Guardian on page 221. The AP can be configured in one ofthree sub-modes:•Out-of-Service with its radios o•Providing full bridging functionality without RADAR•Providing full bridging functionality and In-Service RADAR.For more information, see Configuring a Guardian Scan Profile onpage 577.•AirDefense Sensor — AP39xx integration with the AirDefenseServices Platform (ADSP). Alternative to the Guardian APconfiguration. For more information, see Configuring an AirDefenseProfile on page 568.Country Click the country of operation.Note: The antenna you select determines the available channel list andthe maximum transmitting power for the country in which the AP isdeployed.Related LinksAP Properties Tab - Advanced Settings on page 164Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide163
DraftAP Properties Tab - Advanced SettingsFField DescriptionPoll Timeout Type the timeout value, in seconds. The AP uses this value to trigger re-establishing the link with the Controller if the AP does not get an answer toits polling. The default value is 10 seconds.Note: If you are configuring session availability, the Poll Timeout valueshould be 1.5 to 2 times of Detect link failure value on AP Properties screen.For more information, see Session Availability on page 545.Secure Tunnel This feature, when enabled, provides encryption, authentication, and keymanagement between the AP and/or controllers.Select the desired Secure Tunnel mode from the drop-down list:•Disabled — Secure Tunnel is turned o and no trac is encrypted. AllSFTP/SSH/TFTP trac works normally.•Encrypt control trac between AP & Controller — An IPSEC tunnel isestablished from the AP to the controller and all SFTP/SSH/TFTP/WASSP control trac is encrypted. The AP skips the registration andauthentication phases and when selected, the Secure Tunnel Lifetimefeature can be configured.•Encrypt control and data trac between AP & Controller — This modeonly benefits routed/bridged@Controller Topologies. An IPSEC tunnelis established from the AP to the controller and all SFTP/SSH/TFTP/WASSP control and data trac is encrypted. The AP skips theregistration and authentication phases, and when selected, the SecureTunnel Lifetime feature can be configured.Note: This option is not available for AP3805 models.•Debug mode — An IPSEC tunnel is established from the AP to thecontroller, no trac is encrypted, and all SFTP/SSH/TFTP trac worksnormally. The AP skips the registration and authentication phases andwhen selected, the Secure Tunnel Lifetime feature can be configured.Note: Changing a Secure Tunnel mode will automatically disconnect andreconnect the AP.Secure Tunnel Lifetime Available when Secure Tunnel is enabled. Enter an interval (in hours) atwhich time the keys of the IPSEC tunnel are renegotiated.Note: Changing the Secure Tunnel Lifetime setting will not cause any APdisruption.Enable SSH Access Click to enable or disable SSH for access to the AP.Enable location-based-service Enable or disable the AeroScout, Ekahau, or Centrak location-based servicefor the AP.Maintain client session in event ofpoll failureSelect this option (if using a bridged at AP VNS) if the AP should remainactive if a link loss with the controller occurs. This option is enabled bydefault.Restart service in the absence ofcontrollerSelect this option (if using a bridged at AP VNS) to ensure the AP’s radioscontinue providing service if the AP’s connection to the controller is lost. Ifthis option is enabled, it allows the AP to start a bridged at AP VNS even inthe absence of a controller.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide164
DraftFField DescriptionUse broadcast for disassociation Select this option if you want the AP to use broadcast disassociation whendisconnecting all clients, instead of disassociating each client one by one.This aects the behavior of the AP under the following conditions:•If the AP is preparing to reboot or to enter one of the special modes(DRM initial channel selection).•If a BSSID is deactivated or removed on the AP.This option is disabled by default.Enable LLDP Click to enable or disable the AP from broadcasting LLDP information. Thisoption is disabled by default.If SNMP is enabled on the controller and you enable LLDP, the LLDPConfirmation dialog is displayed.Select one of the following:•Proceed (not recommended) — Select this option to enable LLDP andkeep SNMP running, and then click OK.•Disable SNMP publishing, and proceed — Select this option to enableLLDP and disable SNMP, and then click OK.•For more information on enabling SNMP, see the ExtremeWirelessMaintenance Guide.Announcement Interval If LLDP is enabled, type how often the AP advertises its information bysending a new LLDP packet. This value is measured in seconds.If there are no changes to the AP configuration that impact the LLDPinformation, the AP sends a new LLDP packet according to this schedule.Note: The Time to Live value cannot be directly edited. The Time to Livevalue is calculated as four times the Announcement Interval value.Announcement Delay If LLDP is enabled, type the announcement delay. This value is measured inseconds. If a change to the AP configuration occurs which impacts theLLDP information, the AP sends an updated LLDP packet. Theannouncement delay is the length of time that delays the new packetdelivery. The announcement delay helps minimize LLDP packet trac.IP Multicast Assembly Click to Enable or Disable IP Multicast Assembly on this Wireless AP. IfEnabled, the IP Multicast Assembly feature assembles multicast datapackets that were too large to fit the MTU size of the tunnel and werefragmented in order to fit the tunnel header. This feature is disabled bydefault.Active OBSS channel widthadjustmentWhen enabled, this setting avoids channel overlap by shrinking channels,when ACS detects an overlapping BSS.Before a radio provides service, it performs an overlapping BSS coexistencescan to ensure that the radio's channel will not overlap with a nearbyoperating AP's secondary channels. This behavior is in accordance with the802.11 standard and provides data to the Channel Inspector Report.If the channel width is set to 40 or 80 MHz and an overlap is detected, ACSshrinks the channel to 20 or 40MHz to avoid the overlap.When this setting is disabled, the radio starts the service in spite of theoverlap.By default, this option is enabled for newly deployed APs and is disabledfor existing AP deployments, ensuring backward compatibility withprevious ExtremeWireless releases.Balanced Channel List Power This simplifies power settings such that they will function across allchannels in the channel plan.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide165
DraftFField DescriptionLow Power Mode Override Check this box to have AP ALWAYS operate in 4x4 mode regardless ofwhat was negotiated with the Switch PoE. When this option is cleared, theAP operates in 2x2 or 4x4 depending on what was negotiated with theSwitch PoE using the 2-event classification.•AP sends Power Status element with "Power Mode" set to 0 when "LowPower Mode Override" is enabled.•AP sends Critical Log "entering Low Power mode" only if negotiated .afwith Switch PoE and "Low Power Mode Override" is disabled.Otherwise, Critical Log is not sent.•Controller "Network Health" shows only APs that have "Power Mode"bit in the Power Status set to 1.The default configuration for the 39xx AP is disabled.LED Select the desired LED pattern from the drop-down list. Options include:O, WDS Signal Strength, Identify, and Normal.Real Capture Click Start to start real capture server on the AP. Default capture servertimeout is set to 300 seconds and the maximum configurable timeout is 1hour. While the capture session is active, the AP interface operates inpromiscuous mode.From the Wireshark GUI, set the capture interface to the IP address of theselected AP, and select null authentication. Once Wireshark connects tothe AP, the AP's interfaces are listed as available to capture trac. eth0 isthe wired interface, wlan0 is the 5Ghz interface, and wlan1 is the 2.4Ghzinterface. You can capture bidirectional trac on eth0, wifi0, and wifi1. Thecapture on wifi0 and wifi1 does not include internally generated hardwarepackets by the capturing AP.The capturing AP does not report its own Beacons, Retransmission, Ackand 11n Block Ack. If this information is needed, perform Real Capture froma second AP that is close by. Make sure both APs are on the same wirelesschannel. Broadcast an SSID to activate the radios, but do not broadcast theSSID of the AP you are troubleshooting. You do not want the clients toconnect to the second capturing AP.Capture statistics are found on the Active Wireless APs report (see ViewingStatistics for APs on page 627).Related LinksAP Properties Tab - Basic Settings on page 161Professional Install SettingsThe Professional Install option is only available for AP models with external antennas. The fields andcorresponding antenna value options that appear on the PProfessional Install dialog depend on theselected AP and the antenna models that are available. Select an antenna for each available port. Bydefault, the two antennas must be identical. However, you have the option to select No Antenna for thesecond antenna port. The AP3915e and AP3917e access point models oer an external IoT antenna.Select the antenna model from the drop-down field. Choose the desired attenuation for each radio fromthe drop-down list. Selectable range is from 0 to 30 dBI.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide166
DraftFigure 30: Professional Install dialog AP3917Outdoor Access Point InstallationThe FCC regulations for the indoor and outdoor installation are dierent. The professional installer mustconfigure the access point transmitters accordingly. Products that are specifically intended to be placedoutdoors are configured at the factory for compliant outdoor operation. Professional installers shouldreview the following to assess the legality of outdoor deployments:•When a transmitter is placed indoors but the antenna is placed outdoors, the FCC interprets this asan outdoor installation.•When a transmitter is placed indoors and the antenna is oriented to intentionally radiate outdoors,the FCC interprets this as an outdoor installation.•When the transmitter is placed on a loading dock or inside a covered stadium with a retractablecover, the FCC views this as an outdoor installation.Antenna GainAntenna gain is the ratio of an antenna's radiation intensity in a given direction to the intensityproduced by a no-loss, isotropic antenna radiating equally in all directions. An antenna's gain along thehorizon and at an elevation of 30 degree may vary. The elevation gain is defined as the maximumantenna gain at 30 to 150 degrees above the horizon. If elevation gain is configured, the transmit (TX)power calculations maximize the allowable TX power for an elevation below 30 degree.Access Points must conform to U.S. Federal Communications Commission's (FCC) limitations. FCC hasnow stipulated a 21dBm Eective Isotropic Radiated Power (EIRP) limit for power directed 30 degreesabove the horizon. For Extreme Networks -supplied antennas, compatible with 5.0 GHz on the accesspoint, refer to the Antenna Guide for Elevation Gain information. If using a third-party antenna, youmust obtain the antenna-elevation gain information from the antenna manufacturer.The elevation gain should be configured if the access point:•Is deployed outdoors, andConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1167
Draft•Is used with a dipole antenna (Panel antennas and polarized antennas are for point to point only andare excluded from this requirement.) and•Is transmitting in the 5.15 - 5.25 GHz Unlicensed National Information Infrastructure-1 (UNII-1) band.Professional installers must complete the following steps to ensure compliance with the FCC rule:NNoteExtremeWireless determines the antenna peak gain and elevation gain based on the userconfigured settings.1 Configure the antenna type from the PProfessional Installdialog.2 Configure the antenna placement from the AP Environment field on the AAP Properties tab.3 Configure the Country field on the AAP Properties tab.The firmware uses this information with hardcoded maximum limits (that are determined duringtesting) to limit the EIRP below 21dBm for outdoor use in UNII-1 band. For information on specificantennas, refer to the ExtremeWireless External Antenna with Wave 2.Related LinksAP Properties Tab - Basic Settings on page 161Professional Install Settings on page 166Outdoor Access Point Installation on page 167Assigning Wireless AP Radios to a VNSThe following describe methods of assigning AP radios to a VNS:•VNS configuration — When a VNS is configured, you can assign AP radios to the VNS through itsassociated WLAN Service. For more information, see Configuring WLAN Services on page 318.NoteTo configure foreign AP radios to a VNS, use the VNS configuration method. Foreign APsare listed and available only for VNS assignment from the WLAN Services tab. For moreinformation, see Configuring a VNS on page 390.•AP Multi-edit — When you configure multiple APs simultaneously, use the AP Multi-edit feature. Formore information, see AP Multi-Edit Properties on page 111 .•Wireless AP configuration — When you configure an individual AP, assign its radios to a specificWLAN Service.To assign wireless AP radios when configuring an AP:1 From the top menu, click AP.2 Click the appropriate AP in the list (not the check box). The AAP Details dialog is displayed.3 Click Configure.The AAP Properties tab is displayed.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide168
ft4 Click the WWLAN Assignment tab.NoteAirtime % is available for AP38xx and AP39xx access point models that are assignedWLANS configured with Reserved Airtime.5 In the Radio 1 and Radio 2 columns, select the radio check box that you want to assign for eachWLAN Service.6 To save your changes, click Apply.Related LinksAssigning WLAN Services to Client Ports on page 170AP Properties Tab Configuration on page 159Configuration Parameters for Radio Properties on page 180Setting Up 802.1x Authentication for a Wireless AP on page 203Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide169
DraftAP Multi-Edit Properties on page 111Configuring Airtime Fairness: Reservation Mode on page 406NEW!Assigning WLAN Services to Client PortsWhen configuring client ports on access point models AP391x that oer client ports, you can assign oneor more client ports to a single WLAN service. Client ports oer 802.1x authentication and policysupport.NNoteNetwork access for the AP3916ic camera function is controlled through policy definition,assigned as a the CAM port. The camera port on the AP3916 is treated as a wired client port.1 From the top menu, click AP.2 Select a specific AP.Port options depend on the AP model you select:•AP3912 supports wired client ports 1-3.•AP3916ic supports the wired CAM port for a camera.•AP3917i/e supports 1 client port.•Additionally, all the AP391x models, including AP3915i/e, support IoT Thread Gateway using theAP as a border gateway router.The AAP Properties dialog appears.3 Click Configure.4 Select the WWLAN Assignment tab.5 Select one or more client ports for each WLAN Service.All Port Assignments:•One WLAN can be assigned per port. The assignment enables the port.•Wireless and wired users associated to the same WLAN service receive identical service. They areaected by the same policies and filters.The wired ports for the AP391x default to auto-negotiation for speed and mode. To configure fixedspeed and mode values (for instance, 100Mbps and Full Duplex), select the SStatic Configuration taband select the speed and mode settings for the Ethernet port and each client port. Configure thevalues that the client hardware supports.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide170
ftFigure 31: Port Configuration for AP3912 Wired PortsCCAM Port Assignments:•The topology associated with the role that is assigned to the CAM port (either through WLANassignment or through device MBA authentication) must be configured to allow ONVIF cameradiscovery and video streaming. Configure the default topology to explicitly allow multicastbridging of WS-Discovery group (239.255.255.0).•When the camera port is unassigned, it is disabled, and the camera is disconnected from thenetwork and turned o.•One policy definition for wired and wireless users. Users on wired ports can receive the samedefault policy. However, the camera function (CAM) can be assigned a specific device policy toseparate user service and video surveillance networks.•The camera function can be assigned to B@AP and B@AC topologies and Mac BasedAuthentication for dynamic policies.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide171
aft•Configure MAC authentication (MBA) for network attached devices or collect device metricsthrough RADIUS accounting from the AAuth&Acct tab.•WLAN SSID, Privacy, and QoS settings are not relevant for the camera functionality.•Captive Portal and 802.1x are not supported on the CAM port.NoteBind the WLAN Service to the VNS to activate service.Figure 32: WLAN Services Port AssignmentConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide172
DraftFigure 33: Assigning Ports to WLAN Service on the AP3912Figure 34: Assigning the Camera Port to WLAN Service on the AP3916icConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1173
DraftFigure 35: Assigning the IoT Port to WLAN Service on the AP3915RRelated LinksConfiguring IoT Applications on page 189Setting Up the Wireless AP Using Static Configuration on page 199Configuring Common Configuration Default AP Settings on page 135Configuring Wireless AP Radio PropertiesWireless AP radio properties can vary depending on the model of the AP being configured. For specificinformation on modifying a wireless 802.11n AP, see Modifying 11n and 11ac Wireless AP Radio Propertieson page 178.Dynamic Radio Management (DRM)Use the Dynamic Radio Management (DRM) controller function to establish the optimum radioconfiguration for your APs.Consider the following deployment methodologies:•Plan the wireless RF deployment using various site survey methodologies including theExtremeCloud RF planner. Configure each AP’s channel width and channel according to the RF plan.•Use the DRM automatic tool to configure the deployed AP’s channel width and channel according tothe channel plan.•Use DRM Auto Channel Selection (ACS) to automatically assign the APs to appropriate channelsand channel width.•Use Auto Tx Power Control (ATPC) to set transmit power and let the AP dynamically adapttransmit power.•Use Dynamic Channel Selection (DCS) to monitor channel occupancy around the APs andoptionally allow the AP to dynamically adapt the channel.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide174
DraftThe controller’s DRM functionality:•Adjusts transmit power levels to balance coverage between APs assigned to the same RF domainand operating on the same channel.•Triggers ACS for all selected APs in the deployment, simultaneously. The APs determine thedeployment density and the optimal channel width for the selected group.Density deployment is based on the following factors:•The number of channels configured in the channel list•The number of APs that have to be set up•The number of detected APs that do not belong to the deployment.Each AP is set to the best available channel. The channel inspector displays the RF environment seenby each AP. Use the Channel Inspector Report to understand why an AP selects a channel and, ifnecessary, to make manual adjustments.AP39xx and AP38xx perform overlapping BSS (OBSS) scan every time the radio is restarted. Thisscan results are used as follows:•Channel inspector is always updated with the latest RF environment seen by the AP.•If the channel width is set to 40MHz or 80MHz and the AP property Active OBSS channel widthadjustment is enabled, the AP shrinks its channel to avoid overlapping with other APs detectedin the area. (An OBSS overlap occurs when a primary channel and a secondary channel overlap.)After the interfering AP is shut down and the AP’s radio is reset, the channel width returns to40MHz or 80MHz.NNoteWhen setting a fixed channel width to 40 MHz or 80 MHz, the Active OBSS channel widthadjustment setting must be disabled. This setting is disabled by default for existing APs inorder to maintain existing behavior and the existing channel plan. For APs that are newlyadded to the network, this setting is enabled by default.•AP39xx and AP38xx return to original channel after a RADAR event in order to restore originalchannel plan.When a RADAR event is detected, the channel is marked and the AP selects a new channel from theallowed channel list. After 30 minutes, if there are no clients associated with the AP, the AP returnsto the original channel. If there are associated clients, the AP tries to return to the original channelevery five minutes until there are no clients associated with the radio.The DRM feature consists of three functions:Auto Channel Selection (ACS)ACS provides an easy way to optimize channel arrangement based on the current situation in the field.An optimal solution is provided only if ACS is triggered on all APs in a deployment, or all APs placed in adistinct area like a floor. ACS forces the channel width selection of the involved APs to Auto width. TheACS algorithm selects the optimal channel width for all the selected APs and places each AP on thebest channel available in its area. Use the Channel Inspector Report to visualize why the AP was placedon the selected channel.Triggering ACS on a single AP or on a subset of APs can be useful but it is not an optimal solution. TheACS algorithm places the selected APs as best it can considering the channels occupied by otherConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide175
Draftoperating APs. ACS relies on the RF channel information observed at the time it is triggered. Once anAP has selected a channel, it remains operating on that channel until you change the channel or triggerACS again.ACS can be triggered by one of the following events:•A new AP registers with the controller and the AP Default Settings channel is Auto.•A user selects Auto from the Request New Channel drop-down list on the Wireless AP’s radioconfiguration tabs.•A user selects Auto from the Channel drop-down list on the AAP Multi-edit screen.•If Dynamic Channel Selection (DCS) is enabled in active mode and a DCS threshold is exceeded.•A Wireless AP detects radar on its current operating channel and it employs ACS to select a newradar free channel. The AP returns to the original channel under the following condition:•A 30-minute Non-Occupancy timer expired per the DFS standard.•The AP does not disrupt service to any clients.•You can initiate ACS from the Channel Inspector Report.•ACS is triggered for Site deployments or Cloud deployments by sending the ACS command to oneof the member APs, which will distribute the ACS command to all other member APs. Each Site isconsidered an RF domain.•Channel Plan — The ACS algorithm selects channels from the configured channel plan. You candefine the channel plan for each AP or accept the default plan. It is recommended that all APs in adeployment have identical channel plans. Defining a channel plan allows you to limit the availablechannels for use during an ACS scan. For example, you may want to avoid using specific channelsbecause of allowed power limits on that channel or regulatory domain, or avoid DFS channel RADARinterference.•Multi-Edit — The best way to trigger ACS between multiple APs is to use the AP Multi Edit option.First, select Radio 1 or Radio 2 actions, and then select Auto Channel Select. APs that configure ACStogether, must all be part of the same RF domain. Therefore, set the RF Domain before ACS isstarted. ACS between multiple APs must start at the same time.Dynamic Channel Selection (DCS)DCS allows a Wireless AP to monitor RF channel conditions and noise levels on the channel on whichthe AP is currently operating. DCS can operate in the following modes:•Monitor — When DCS is enabled in monitor mode the AP monitors channel occupancy and trac ornoise levels on the channel on which the AP is currently operating. The DCS monitor alarm andgenerated stats can be used to evaluate the RF environment of your deployed APs.•Active — When DCS is enabled in active mode and channel occupancy trac or noise levels exceedthe configured DCS thresholds, ACS is triggered to move the AP from a busy / noisy channel to thebest available channel. Also, an alarm is triggered and an information log is generated.NoteIf DCS is enabled, DCS statistics can be viewed in the Wireless Statistics by Wireless APsdisplay. For more information, see Working with Reports and Statistics on page 621.Related LinksAP Properties Tab - Advanced Settings on page 164Use Cases for Dynamic Radio Management on page 178Configuration Parameters for Radio Properties on page 180Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide176
DraftAP Multi-Edit Properties on page 111Radio Advanced Properties on page 184Channel Inspector Report on page 637ATPCThe purpose of ATPC is to automatically adjust the coverage cell around an AP. During initialdeployment, the Tx Power of each AP is adjusted to provide coverage without overlapping the coveragecell of a neighboring AP. To maintain optimal performance, it is important to maintain a small cell sizesto encourage WLAN clients to roam to the closest AP and operate at high data rates. This practice freesthe channel as fast as possible and reduces congestion.Setting the AP transmit power too high can cause interference and potentially exceed useful bounds.Setting the AP transmit power too low may introduce coverage gaps in the installation.ATPC operates over a group of APs configured to participate in the same RF domain. Configure the RFDomain parameter as a unique string across all the APs that provide service coverage, ensuring thatcell shaping is not influenced by non-participating APs. ATPC operates by periodically broadcastingcustom probe requests that allow the other APs in range to determinate the “RF Distance / Path Loss”to the sending AP. Every 10 seconds, each AP evaluates the Path Loss to its neighbors. If Path Loss isless then 70dB, the AP reduces its Tx Power. If the Path Loss is more than 70dB, the AP boosts its TxPower.When all APs are operating, the cells size of each AP is adjusted to cover the surrounding area. If oneAP fails, the APs around it increase their Tx Power, increasing the cell size, and compensating for theloss of the failed AP. If an RF obstructing object is moved between the APs, the APs increase Tx Powerin order to maintain coverage.The ATPC feature is configured for each radio. When you check Auto Tx Power Ctrl (ATPC)check box, you are enabling the radio to participate in the AP group that collaborates to automaticallyadjust the cell size. When ATPC is enabled, the following parameters are available for configuration:•Max Tx Power•Min Tx Power•Auto Tx Power Ctrl AdjThe Max and Min Tx Power parameters set the power range used by the ATPC. The Auto Tx Power CtrlAdj parameter allows you to manually adjust the Tx Power calculated by the ATPC algorithm (either upor down). The Current Tx Power Level field on the AP / Radio page displays the actual AP TxPower.ATPC preserving Power Setting — In some cases operators may use ATPC to initially set up the powersetting of the APs over a service area, but then want to “freeze” this setting during normal operation ofthe network. When the Auto Tx Power Ctrl (ATPC)check box is cleared you have two choices:•Maintain the ATPC-acquired Tx Power value after turning ATPC o.•Set the Tx Power to the Max Tx Power value.The ATPC feature allows you to use ATPC to achieve a Tx Power level required for the installation, andthen statically maintain this value if ATPC is turned o.RRelated LinksConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide177
DraftConfiguration Parameters for Radio Properties on page 180Use Cases for Dynamic Radio ManagementThe following scenarios outline use cases for Dynamic Radio Management (DRM).•UUsing ACS with a set of APsWhen you trigger ACS for a set of APs, the channel width is automatically set to Auto and ACSdetermines the deployment density and the desired channel width to minimize co-channelinterference. A channel plan is created with non-overlapping cells, and each AP performs anoverlapping BSS (OBSS) scan to avoid channel overlap.•Manually Selecting Channels and Channel WidthWhen you select a fixed channel and channel width, the AP radio is set to the requested channel andwidth. The AP performs an overlapping BSS (OBSS) scan and sends the results to the ChannelInspector. If the setting Active OBSS channel width adjustment is not enabled, the radio uses themanually selected channel and width, and the detected overlap is not remedied automatically.If Active OBSS channel width adjustment is enabled, the detected overlap is corrected by shrinkingthe channel width before the radio is enabled. The channel width can recover after a subsequentradio reset if the OBSS scan does not detect another channel overlap.Modifying 11n and 11ac Wireless AP Radio PropertiesThe ExtremeWireless 37xx/W78xC series are 802.11n-compliant access points. AP38xx and AP39xxseries are 11n and 11ac-compliant. This section describes how to configure/modify properties of an 11n or11ac AP.Channel BondingChannel bonding improves the eective throughput of the wireless LAN. In contrast to legacy APswhich use radio channel spacings that are only 20 MHz wide, 11n wireless APs can use two channels atthe same time to create a 40 MHz wide channel. 11ac wireless APs can use four channels at the sametime to create an 80 MHz wide channel.The 40 MHz channel width is achieved by bonding the primary channel (20 MHz) with an extensionchannel.Channel bonding is predefined on both Radio 1 and Radio 2. Channel bonding is enabled by selectingthe Channel Width on the Radio tabs. When selecting Channel Width, the following options areavailable:•20 MHz — Channel bonding is not enabled:•802.11n clients use the primary channel (20 MHz)•Non-802.11n clients, as well as beacons and multicasts, use the 802.11a/b/g radio protocols.•40 MHz — Channel bonding is enabled:•802.11n clients that support the 40 MHz channel width can use 40 MHz, 20 MHz, or the802.11a/b/g radio protocols.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide178
Draft•802.11n clients that do not support the 40 MHz channel width can use 20 MHz or the 802.11a/b/gradio protocols.•Non-802.11n clients, beacons, and multicasts use the 802.11a/b/g radio protocols.•80 MHz — Channel bonding is enabled:•802.11ac clients that support the 80 MHz channel width can use 80 MHz, 40 MHz, 20 MHz, or the802.11a/b/g radio protocols.•802.11n clients that do not support the 80 MHz channel width can use 20 MHz, 40 MHz, or the802.11a/b/g radio protocols.•Non-802.11n clients, beacons, and multicasts use the 802.11a/b/g radio protocols.•Auto — Channel bonding is automatically enabled or disabled, switching between 20 MHz, 40 MHz,and 80 MHz, depending on how busy the extension channel(s) are. If the extension channel is busyabove a prescribed threshold percentage, which is defined in the 40 MHz Channel Busy Thresholdbox, channel bonding is disabled.Channel Selection — Primary and ExtensionThe primary channel of the wireless 802.11n AP is selected from the Request New Channel drop-downlist. If auto is selected, the ACS feature selects the primary channel. The channels in the Request NewChannel drop-down list show which extension channel(s) are being used for bonding.Guard IntervalThe guard intervals ensure that individual transmissions do not interfere with one another. The wireless802.11n AP provides a shorter guard interval that increases the channel throughput. You can select theguard interval to improve the channel eciency. The guard interval is selected from the Guard Intervaldrop-down list. Longer guard periods reduce the channel eciency.Aggregate MSDU and MPDUThe wireless 802.11n AP provides aggregate Mac Service Data Unit (MSDU) and aggregate Mac ProtocolData Unit (MPDU) functions, which combine multiple frames together into one larger frame for a singledelivery. This aggregation reduces the overhead of the transmission and results in increased throughput.The aggregate methods are enabled and defined selected from the Aggregate MSDUs and AggregateMPDUs drop-down lists.Antenna SelectionWireless APs have diering numbers of antennas, internal or external, depending on the AP model.Wireless APs by default transmit on all antennas. Depending on your deployment requirements, you canconfigure the AP to transmit on specific antennas. You can configure the wireless 802.11ac AP totransmit on specific antennas for both radios, including all the available modes:•Radio 1 — a/n/ac, ac-strict modes•Radio 2 — b/g, g/n, b/g/n, n-strict modesWhen you configure the AP to use specific antennas, the following occurs:•Transmission power is recalculated — The Current Tx Power Level value for the radio isautomatically adjusted to reflect the recent antenna configuration. It takes approximately 30seconds for the change to the Current Tx Power Level value to be reflected in the WirelessAssistant.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 1179
Draft•Radio is reset — The radio is reset causing client connections on this radio to be lost.TTo modify wireless AP radio properties:1 From the top menu, click AP.2 Click the appropriate wireless AP in the list (not the check box). The AAP dashboard displays.3 Click Configure. The AAP Properties tab displays.4 Click the Radio tab you want to modify.Configuration Parameters for Radio PropertiesTable 15: Radio PropertiesField DescriptionBase SettingsBSS Info BSS Info is read-only. After WLAN Service configuration, the BasicService Set (BSS) section displays the MAC address on the AP for eachWLAN Service and the SSIDs of the WLAN Services to which this radiohas been assigned.Admin Mode Select On to enable the radio; select O to disable the radio.Radio Mode - Radio 1Note: Depending on the radio modes you select, some of the radiosettings may not be available for configuration. The AP hardwareversion dictates the available radio modes.Click one of the following radio options for Radio 1:•a — Click to enable the 802.11a mode of Radio 1 without 802.11ncapability.•a/n — Click to enable the 802.11a mode of Radio 1 with 802.11ncapability.•a/n/ac — Click to enable the 802.11ac mode of Radio 1 with802.11ac capability.•ac-strict — Click to enable the 802.11ac mode of Radio 1 with802.ac strict capability.•n-strict — Click to enable the 802.11a mode of Radio 1 with 802.11nstrict capability.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide180
DraftTable 15: Radio Properties (continued)FField DescriptionRadio Mode - Radio 2Note: Depending on the radio modes you select, some of the radiosettings may not be available for configuration.Click one of the following radio options for Radio 2:•b — Click to enable the 802.11b-only mode of Radio 2. If selected,the AP uses only 11b (CCK) rates with all associated clients.•g — Click to enable the 802.11g-only mode of Radio 2.•b/g — Click to enable both the 802.11g mode and the 802.11b modeof Radio 2. If selected, the AP uses 11b (CCK) and 11g-specific(OFDM) rates with all of the associated clients and will not transmitor receive 11n rates.•g/n — Click to enable both the 802.11g mode and the 802.11nbmode of Radio 2. If selected, the AP uses 11n and 11g-specific(OFDM) rates with all of the associated clients. The AP will nottransmit or receive 11b rates.•b/g/n — Click to enable b/g/n modes of Radio 2. If selected, theAP uses all available 11b, 11g, and 11n rates.•n-strict — Click to enable the 802.11n-strict mode of Radio 2. Ifselected, the AP can be configured to use 11n-strict rates with all ofthe associated clients. With n-strict mode enabled, the AP doesnot transmit or receive 11b or 11g rates.Basic Radio SettingsRF Domain Type a string that uniquely identifies a group of APs that cooperate inmanaging RF channels and transmission power levels. The maximumlength of the string is 16 characters. The RF Domain is used to identifya group of APs. The RF Domain feature is part of the Auto Tx PowerControl (ATPC) feature (for more information, see ConfiguringWireless AP Radio Properties on page 174).Current Channel Read-only. The actual channel the ACS has assigned to the AP radio.The Current Channel value and the Last Requested Channel value maybe dierent because the ACS automatically assigns the best availablechannel to the AP, ensuring that a AP’s radio is always operating onthe best available channel.Last Requested Channel Read-only. The last wireless channel that you had selected tocommunicate with the wireless devices.Request New Channel Click the wireless channel you want the wireless AP to use tocommunicate with wireless devices.Weather channels (116, 120, 124, 128) are supported for Europeancompliance. See Channel Plan.Click Auto to request the ACS to search for a new channel for the AP,using a channel selection algorithm. This forces the AP to go throughthe auto-channel selection process again.Note: ACS in the 2.4 GHz radio band with 40 MHz channels is notrecommended due to severe co-channel interference.Depending on the regulatory domain (based on country), somechannels may be restricted. The default value is based on NorthAmerica. For more information, refer to the appropriate AP InstallationGuide.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide181
DraftTable 15: Radio Properties (continued)FField DescriptionAuto Tx Power Ctrl (ATPC) Click to either enable or disable ATPC from the Auto Tx Power Ctrldrop-down list. ATPC automatically adapts transmission power signalsaccording to the coverage provided by the AP. After a period of time,the system stabilizes itself based on the RF coverage of your WirelessAPs.Note: When enabled, Min Tx Power and Auto Tx Power Ctrl Adjustparameters can be edited, and the ATPC algorithm will adjust the APpower between Max Tx power and Min Tx Power. When disabled, theMax Tx Power selected value or the largest value in the compliancetable will be the power level used by the radio, whichever is smaller.Current Tx Power Level The actual Tx power level used by the AP radio.Max Tx Power Displays dynamic power level based on channel selected. Select theMax TX Power from the drop-down list. The values in the Max TXPower drop-down are in dBm and will vary by AP. The values aregoverned by compliance requirements based on the country, radio,and antenna selected. Changing this value below the current Min TxPower value will change the Min Tx Power to a level lower than theselected Max TX Power.Note: If Auto Tx Power Ctrl (ATPC) is disabled, the selected value orthe largest value in the compliance table will be the power level usedby the radio, whichever is smaller.Min Tx Power If ATPC is enabled, select the minimum Tx power level that is equal orlower than the maximum Tx power level. Extreme Networksrecommends that you use 0 dBm if you do not want to limit thepotential Tx power level range that can be used.Note: The Min Tx Power setting cannot be set higher than the Max TxPower setting.Auto Tx Power Ctrl Adjust The Auto Tx Power Ctrl Adj parameter is a correction parameter thatallows you to manually adjust (up or down) the Tx Power calculated bythe ATPC algorithm. If ATPC is enabled, click the Tx power level thatcan be used to adjust the ATPC power levels that the system hasassigned. It is recommended that you use 0 dBm during the initialconfiguration. If you have an RF plan that recommends Tx power levelsfor each AP, compare the actual Tx power levels your system hasassigned against the recommended values your RF plan has provided.Use the Auto Tx Power Ctrl Adjust value to achieve the recommendedvalues. Valid range is from - (Max Tx Power - Min Tx Power) dB to(Max Tx Power - Min Tx Power) dB.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide182
DraftTable 15: Radio Properties (continued)FField DescriptionChannel Plan - Radio 1 If ACS is enabled you can define a channel plan for the AP. Defining achannel plan allows you to control which channels are available for useduring an ACS scan. For example, you may want to avoid usingspecific channels because of low power, regulatory domain, or radarinterference.•For 5 GHz Radio nodes, click one of the following:•All channels — ACS scans all channels for an operating channeland, when ACS is triggered, the optimal channel is selectedfrom all available channels.•All Non-DFS Channels — ACS scans all non-DFS channels foran operating channel. With ACS, the AP selects the best non-DFS channel.•Custom — To configure individual channels from which the ACSselects an operating channel, click Configure. The CCustomChannel Plan dialog displays. By default, all channelsparticipate in the channel plan. Click the individual channelsyou want to include in the channel plan. To select contiguouschannels, use the Shift key. To select multiple, non-contiguouschannels in the list, use the CTRL key. Click OK to save theconfiguration.•All channels including weather radar — ACS selects the bestchannel from the available channels list. Selected channel maybe DFS, weather-radar DFS or non-DFS. Weather-radarchannels are approved for selected AP models in selectedcountries. Consult the compliance information for the selectedAP.The weather channel includes 5600-5650MHz sub-bandsand requires a listening period before the AP can providewireless service. During the listening period, the CurrentChannel field for DFS channels displays the value DFSTimeout, and the weather channel fields display DFSTimeout . In Europe, the listening period can be up to 10minutes. In the U.S., this period is 1 minute.•For 2.4 GHz Radio nodes, click one of the following:•3 Channel Plan — ACS scans the following channels: 1, 6, and 11in North America, and 1, 7, and 13 in the rest of the world.•4 Channel Plan — ACS scans the following channels: 1, 4, 7, and11 in North America, and 1, 5, 9, and 13 in the rest of the world.•Auto — ACS scans the default channel plan channels: 1, 6, and11 in North America, and 1, 5, 9, and 13 in the rest of the world.•Custom — If you want to configure individual channels fromwhich the ACS selects an operating channel, click Configure.The AAdd Channels dialog is displayed. Click the individualchannels you want to add to the channel plan while pressingthe CTRL key, and then click OK.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide183
DraftTable 15: Radio Properties (continued)FField DescriptionChannel Plan - Radio 2 If ACS is enabled, you can define a channel plan for the AP. Defining achannel plan allows you to limit which channels are available for useduring an ACS scan. For example, you may want to avoid usingspecific channels because of low power, regulatory domain, or radarinterference. Click one of the following:•3 Channel Plan — ACS scans the following channels: 1, 6, and 11 inNorth America, and 1, 7, and 13 in most other parts of the world.•4 Channel Plan — ACS scans the following channels: 1, 4, 7, and 11in North America, and 1, 5, 9, and 13 in most other parts of theworld.•Auto — ACS scans the default channel plan channels: 1, 6, and 11 inNorth America, and 1, 5, 9, and 13 in most other parts of the world.•Custom — If you want to configure individual channels from whichthe ACS selects an operating channel, click Configure. The AAddChannels dialog is displayed. Click the individual channels youwant to add to the channel plan while pressing the CTRL key, andthen click OK.View Click to open a new dialog that displays the selected Channel Plan forthe antenna.Related LinksRadio Advanced Properties on page 184Radio Actions on page 130AP Properties Tab Configuration on page 159Assigning Wireless AP Radios to a VNS on page 168Setting Up the Wireless AP Using Static Configuration on page 199Setting Up 802.1x Authentication for a Wireless AP on page 203Radio Advanced PropertiesTable 16: Advanced Radio PropertiesField DescriptionAdvanced Dialog - Base SettingsDTIM period Type the desired DTIM (Delivery Trac Indication Message) period —the number of beacon intervals between two DTIM beacons. To ensurethe best client power savings, use a large number. Use a small numberto minimize broadcast and multicast delay. The default value is 5.Beacon Period Defines the time, in milliseconds, between beacon transmissions. Thedefault value is 100 milliseconds.RTS/CTS Threshold Type the packet size threshold, in bytes, above which the packet ispreceded by an RTS/CTS (Request to Send/Clear to Send) handshake.The default value is 2346, which means all packets are sent withoutRTS/CTS. Reduce this value only if necessary.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide184
DraftTable 16: Advanced Radio Properties (continued)FField DescriptionFrag. Threshold Type the fragment size threshold, in bytes, above which the packetsare fragmented by the AP prior to transmission. The default value is2346, which means all packets are sent unfragmented. Reduce thisvalue only if necessary.Maximum Distance Enter a value from 100 to 15,000 meters that identifies the maximumlink distance between APs that participate in a WDS. This valueensures that the acknowledgement of communication between APsdoes not exceed the timeout value predefined by the 802.11 standard.The default value is 100 meters. If the link distance between APs isgreater than 100 meters, configure the maximum distance up to15,000 meters so that the software increases the timeout valueproportionally with the distance between APs.Do not change the default setting for the radio that provides service to802.11 clients only.Advanced Dialog - Basic Radio SettingsDynamic Channel Selection To enable Dynamic Channel Selection, click one of the following:•Monitor Mode — If enabled, a selection of DCS Interference Eventsappears in a separate dialog. If trac or noise levels exceed theconfigured DCS thresholds, an alarm is triggered and aninformation log is generated.•Active Mode — If enabled, a selection of DCS Interference Eventsappears in a separate dialog. If trac or noise levels exceed theconfigured DCS thresholds, an alarm is triggered and aninformation log is generated. In addition, the AP ceases operatingon the current channel and ACS is employed to automaticallyselect an alternate channel for the AP to operate on.Probe Suppression Click to Enable Probe Suppression.•Forced Disassociate — Click to enable.•RSS Threshold — 90 (Range of -50 to -100).Applies to AP37xx, AP38xx, and AP39xx series APs.Min. Basic Rate Click the minimum data rate that must be supported by all stations ina BSS: 6, 12, or 24 Mbps and MCS0-MCS7 for n Radio (MCS0, 1 toMCS7,1 for a/n/c radio). If necessary, the Max Basic Rate choices adjustautomatically to be higher or equal to the Min Basic Rate.Advanced Dialog - Multicast SettingsMax % of non-unicast trac per BeaconperiodEnter the maximum percentage of time that the AP transmits non-unicast packets (broadcast and multicast trac) for each configuredBeacon Period. For each non-unicast packet transmitted, the systemcalculates the airtime used by each packet and drops all packets thatexceed the configured maximum percentage. By restricting non-unicast trac, you limit the impact of broadcasts and multicasts onoverall system performance.Optimized for power save Click to optimize for power save.Adaptable rate Click to enable adaptable rate capabilities.Multicast to Unicast delivery Click to set the Multicast to Unicast delivery method from the drop-down list.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide185
DraftTable 16: Advanced Radio Properties (continued)FField DescriptionAdvanced Dialog - 11n SettingsGuard Interval Intended to eliminate interference between symbols duringtransmission. It is the space between the symbols being transmitted.Valid values are Long or Short. Enabling Short Guard Interval increasesthroughput, but can increase interference. Enabling Long GuardInterval can increase overhead due to additional idle time.Protection Mode Click a protection mode: None, Auto, or Always. The default andrecommended setting is Auto. Click None if 11b APs and clients are notexpected. Click Always if you expect many 11b-only clients.Extension Channel Busy Threshold Click a protection type, CTS Only or RTS CTS, when a 40 MHz channelis used. This protects high throughput transmissions on extensionchannels from interference from non-11n APs and clients.Aggregate MSDUs Click an aggregate MSDU mode: Enabled or Disabled. AggregateMSDU increases the maximum frame transmission size.Aggregate MPDUs Click an aggregate MPDU mode: Enabled or Disabled. AggregateMPDU provides a significant improvement in throughput.Aggregate MPDU Max Length Type the maximum length of the aggregate MPDU. The value range is1024-65535 bytes. For the 802.11ac radio (Radio 1 of the AP38xx), therange is 1024-1048575.Agg. MPDU Max # of Sub-frames Type the maximum number of sub-frames of the aggregate MPDU.The value range is 2-64.ADDBA Support Click an ADDBA support mode: Enabled or Disabled. ADDBA, or blockacknowledgement, provides acknowledgement of a group of framesinstead of a single frame. ADDBA Support must be enabled ifAggregate APDU is enable.LDPC Click an LDPC mode: Enabled or Disabled. LDPC increases thereliability of the transmission resulting in a 2dB increased performancecompared to traditional 11n coding.STBC Click an STBC mode: Enabled or Disabled. STBC is a simple open looptransmit diversity scheme. When enabled, STBC configuration is 2x1(two spatial streams combine into one spatial stream). TXBF overridesSTBC if both are enabled for single stream rates.TXBF Tx Beam Forming is a technique of re-aligning the transmittermultipath spatial streams phases in order to get better signal-to-noiseratio on the receiver side. Click a TXBF mode: For the AP37xx andAP38xx models, valid values are Enabled or Disabled. For the 39xxAPs, this setting is only available on Radio1 and valid values are MU-MIMO and Disabled.Advanced Dialog - 11b SettingsPreamble Click a preamble type for 11b-specific (CCK) rates: Short or Long. ClickShort if you are sure that there is no pre-11b AP or a client in thevicinity of this wireless AP. Click Long if compatibility with pre-11bclients is required.Advanced Dialog - 11g SettingsConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide186
DraftTable 16: Advanced Radio Properties (continued)FField DescriptionProtection Mode Click a protection mode: None, Auto, or Always. The default andrecommended setting is Auto. Click None if 11b APs and clients are notexpected. Click Always if you expect many 11b-only clients.Protection Rate Click a protection rate: 1, 2, 5.5, or 11 Mbps. The default andrecommended setting is 11. Only reduce the rate if there are many 11bclients in the environment or if the deployment has areas with poorcoverage. For example, rates lower than 11 Mbps are required to ensurecoverage.Protection Type Click a protection type: CTS Only or RTS CTS. The default andrecommended setting is CTS Only.Click RTS CTS only if an 11b AP that operates on the same channel isdetected in the neighborhood, or if there are many 11b-only clients inthe environment. The overall throughput is reduced when ProtectionMode is enabled, due to the additional overhead caused by the RTS/CTS.The overhead is minimized by setting Protection Type to CTS Only andProtection Rate to 11 Mbps. The overhead causes the overallthroughput to be sometimes lower than if just 11b mode is used. Ifthere are many 11b clients, it is recommended that you disable 11gsupport (11g clients are backward compatible with 11b APs).An alternate approach, although potentially a more expensive method,is to dedicate all APs on a channel for 11b (for example, disable 11g onthese APs) and disable 11b on all other APs. The diculty with thismethod is that the number of APs must be increased to ensurecoverage separately for 11b and 11g clients.Achieving High Throughput with 11n and 11ac Wireless APsTo achieve high throughput with the wireless APs, configure your system as described in this section.NoteSome client devices choose a 2.4 GHz radio even when a 5 GHz high-speed radio network isavailable. You may need to force those client devices to use only 5 GHz if you have configuredhigh throughput only on the 5 GHz radio.To achieve high throughput with a wireless AP:1 From the top menu, click AP.2 Click the appropriate wireless AP in the list (not the check box). The AAP dashboard displays.3 Click Configure. The AAP Properties tab displays.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide187
Draft4 For Radio 2 configure the following:•In the Radio Mode drop-down list, click b/g/n.•In the Channel Width drop-down list, click 40 MHz.•Under Advanced Settings, in the Guard Interval drop-down list, click Short.•In the 11g Settings section, click None in the Protection Mode drop-down list.NNoteDo not disable 802.11g protection mode if you have 802.11b or 802.11g client devicesusing this AP. Instead, configure only Radio 1 for high throughput unless it is acceptableto achieve less than maximum 802.11n throughput on Radio 2.•If only 802.11n devices are present, disable 11n protection and 40 MHz protection:•Protection Mode — Click None.•Protection Type — Click CTS only or RTS CTS.DDDNoteDo not disable 802.11n protection mode if you have 802.11b or 802.11g client devicesusing this AP. Instead, configure only Radio 1 for high throughput unless it isacceptable to achieve less than maximum 802.11n throughput on Radio 2.•Aggregate MSDUs — Click Enabled.•Aggregate MPDUs — Click Enabled.•Aggregate MPDUs Max Length — Click 65535 (for the 802.11ac AP models).•Agg. MPDUs Max # of Sub-frames — Type 64.•ADDBA Support — Click Enabled.5 Click the Radio 1 tab, and then do the following:•In the Admin Mode drop-down list, click the On option.•In the Radio Mode drop-down list, click the a/n option for the AP3825, and click a/n/ac for theAP3865 and the 39xx series APs).•In the Channel Width drop-down list, click 40 MHz (for the AP3825 and for the AP3865 and39xx series, click 80 MHz).•In the Guard Interval drop-down list, click Short.•If only 802.11n devices are present, disable 11n protection and 40 MHz protection:•Protection Mode — Click None.•Protection Type — Click CTS only or RTS CTS.•Aggregate MSDUs — Click Enabled.•Aggregate MPDU — Click Enabled.•Aggregate MPDU Max Length — Click Enabled.•Agg. MPDU Max # of Sub-frames — Type 64.•ADDBA Support — Click Enabled.6 From the top menu, click VNS.7 In the left pane select WLAN Services and select the WLAN service to configure.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide188
Draft8 Click the Privacy tab. Some client devices do not use 802.11n mode if they are using WEP or TKIP forsecurity. Do one of the following:•Select None.•Select WPA-PSK, and then clear the WPA v.1 option:•Select WPA v.2.•In the Encryption drop-down list, click AES only.NNoteTo achieve the strongest encryption protection for your VNS, it is recommendedthat you use WPA v.2.9 Click the QoS tab. From the QoS tab, you can select WMM and Flexible Client Access (FCA) to getbetter throughput.NoteFor FCA, go to VNS > Global > Wireless QoS and set the Fairness Policy to 100% Airtime.10 In the Wireless QoS section, select the WMM option. Some 802.11n client devices remain at legacyrates.NEW!Configuring IoT ApplicationsConfigure IoT support from the IIoT tab access point models AP391xExtremeWireless supports Real Time Location Systems (RTLS) on APs that oer integrated BLE/802.15.4 radios for connectivity to Internet of Things (IoT) sensors and devices. The AP must be BLEenabled.ExtremeWireless supports the following applications. Each supported AP can be configured for oneapplication at a time.•iBeacon — AP is an Apple iBeacon. AP sends beacons in Apple iBeacon format.•iBeacon Scan — AP scans for Apple iBeacons, filtering beacons based on configuration parametersand reports findings to an Application Server.•Eddystone-url Beacon — AP sends a compressed URL in a beacon for automatic presentation of awebsite. Eddystone-url is supported by both iOS and Android 4.4 operating systems.•Eddystone-url Scan — AP scans for Eddystone-url beacons, filtering beacons based on configurationparameters and reports findings to an Application Server.•Thread Gateway — AP is a gateway router to the Thread Network. Thread is a mesh networkingprotocol based on IEEE 802.15.4 for IoT devices.Related LinksIoT iBeacon on page 190IoT iBeacon Scan on page 191Eddystone-url Beacon on page 193Eddystone-url Scan on page 195IoT Thread Gateway on page 196Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide189
DraIoT iBeaconiBeacon is Apple's technology standard that allows mobile apps to identify a beacon position in thephysical world. It delivers content based on the identified location.Extreme Wireless access point models AP391x support iBeacon.RRelated LinksConfiguring AP as an iBeacon on page 190IoT iBeacon Scan on page 191Configuring IoT Applications on page 189IoT Multi-Edit Configuration on page 129Configuring AP as an iBeaconWith the iBeacon application, configure a supported AP as an iBeacon in an IoT network. The followingAPs oer integrated BLE/802.15.4 radios: AP3912i , AP3915i/e, AP3916ic, AP3917i/e/k.To configure iBeacon support from the IIoT tab:1 From the top menu, click AP. The AAP screen displays.2 Click the appropriate wireless AP in the list (not the check box). The AAP dashboard displays.3 Click Configure. The AAP Properties tab displays.4 Click the IoT tab, and select IoT Admin.5 From the Application field, select iBeacon.Figure 36: IoT Admin Tab iBeacon Application6 Configure the following parameters:Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide190
DraftTable 17: IoT iBeacon Application SettingsFField DescriptionApplication Determines application type. Select iBeaconAdvertise Interval The advertising interval for the beacon application. Valid values are:Min (100ms) and Max (10240ms). The default value is Min (100ms).UUID Identifier used to dierentiate a large group of related beacons. Acompany can have a network of beacons with the same UUID.Major Identifies a subset of beacons within the larger set. This value couldrepresent a venue specific attribute, such as a specific store or wing ina building. Valid values are 0 to 65635.Minor Identifies an individual beacon. Used to more precisely pinpointbeacon location. This value complements the UUID and Major valuesto provide more granular identification of a specific location, such as aparticular shelf, door-way, or item. Valid values are 0 to 65635.Related LinksIoT iBeacon on page 190Configuring IoT Applications on page 189IoT Multi-Edit Configuration on page 129IoT iBeacon ScanWith iBeacon Scan, an AP scans for beacons, filtering data based on configuration parameters andreports findings to an Application Server. ExtremeWireless forwards an iBeacon report as a JSONmessage to the customer's Application Server. The iBeacon report includes the following data:•AP serial number•The MAC address of the iBeacon tag•The RSSI•The signal strength of the iBeacon tag•The UUID of the iBeacon tag including Major and Minor values.The following filters can be applied at the AP to specify the message stream:•UUID. The Global Unique Identifier. iBeacon messages with corresponding UUID are sent to theApplication Server. All other UUID values are omitted.•Minimum Received Signal Strength Indicator (RSSI). Transfers messages that meet the configuredRSSI threshold. Messages received with an RSSI below the configured threshold are omitted.Refer to the Integration Guide for details on the format of the iBeacon RTLS message.The customer's Application Server handles the business logic and presentation of the IoT report. TheApplication Server:•Calculates the distance between the BLE tag and the AP, based on the signal strength for the tag/radio channel•Maps AP Serial Number to a physical location•Tracks BLE tags.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide191
DFrom ExtremeWireless, configure iBeacon Scan parameters under AP configuration.RRelated LinksConfiguring iBeacon Scan on page 192IoT Multi-Edit Configuration on page 129Configuring IoT Applications on page 189Configuring iBeacon ScanThe following APs oer integrated BLE/802.15.4 radios: AP3912i , AP3915i/e, AP3916ic, AP3917i/e/k.To configure iBeacon Scan support from the IIoT tab:1 From the top menu, click AP. The AAP screen displays.2 Click the appropriate wireless AP in the list (not the check box). The AAP dashboard displays.3 Click Configure. The AAP Properties tab displays.4 Click the IoT tab, and select IoT Admin.5 From the Application field, select iBeacon Scan.Figure 37: iBeacon Scan Application6 Configure the following parameters:Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide192
DraftTable 18: iBeacon Scan SettingsFField DescriptionApplication Determines application type. Select iBeacon ScanDestination IP Address IP address of the customer Application Server that receives thebeacon report.Destination Port Destination Port on the customer Application Server that presents thebeacon report.Scan Interval Determines how long to wait between scans. Valid values are: Min(100ms) and Max (10240ms). The default value is Min (100ms).Scan Window Determines how long to scan per channel. Valid values are Min(100ms) and Max (10240ms).Value must be less than Scan Intervalvalue. Default value is 100ms.UUID Identifier used to dierentiate a large group of related beacons. Acompany can have a network of beacons with the same UUID.Used for filtering data. ExtremeWireless forwards data with matchingUUID to the Application Server and filters out all other UUID data. IfUUID configured value is all zeros, no filtering occurs.Min RSSI This is the signal strength required to include the packet in the BLEreport. Valid values: -10 to -100. Default value is -100. Data frombeacons with an RSSI that is less than the Min RSSI configured value isfiltered out.Related LinksIoT iBeacon Scan on page 191IoT Multi-Edit Configuration on page 129NEW!Eddystone-url BeaconEddystone-url is a Google technology standard that supports the physical web by providing a beacon-delivered URL that oers content based on the identified location. Eddystone-url is supported by bothiOS and Android 4.4 operating systems.An AP sends a beacon that includes a compressed URL. A mobile device app accepts the beacon, andthe mobile user can access the URL that is provided in the beacon.This technology automatically presents websites to mobile users at the AP location. Possible use casesinclude:•Registration at a medical facility or school.•Online payment at a parking garage.•Detailed information about a museum exhibit.The beacon format is defined by a Google specification. Both the URL and the Advertising Interval areconfigurable parameters on the AP.Related LinksConfiguring AP as an Eddystone-url Beacon on page 194Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide193
DraftConfiguring AP as an Eddystone-url BeaconConfigure an AP with integrated BLE radio as an Eddystone-url Beacon in an IoT network. The followingAPs oer integrated BLE/802.15.4 radios: AP3912i , AP3915i/e, AP3916ic, AP3917i/e/k.To configure Eddystone-url Beacon support from the IIoT tab:1 From the top menu, click AP. The AAP screen displays.2 Click the appropriate wireless AP in the list (not the check box). The AAP dashboard displays.3 Click Configure. The AAP Properties tab displays.4 Click the IoT tab, and select IoT Admin.5 From the Application field, select Eddystone-url Beacon.Figure 38: IoT Admin Tab Eddystone-url Beacon Application6 Configure the following parameters:Table 19: IoT Eddystone-url Beacon Application SettingsField DescriptionApplication Determines application type. Select Eddystone-url BeaconURL The URL that is included with the Eddystone-url beacon. The URL islimited to 17 characters. The 17 characters does not include theprotocol, but it does include the domain name. A secure protocol(HTTPS address) is required. The URL is compressed, eectivelyallowing more than a 17-character input. See https://github.com/google/eddystone/tree/master/eddystone-url for the Eddystone-urlcompression rules to more accurately judge the length of your URL. Ifnecessary, also find third-party URL Shortening Services available onthe internet.Advertise Interval The advertising interval for the beacon application. Valid values are:Min (100ms) and Max (10240ms). The default value is Min (100ms).Related LinksEddystone-url Beacon on page 193Configuring IoT Applications on page 189IoT Multi-Edit Configuration on page 129Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide194
DraftNEW!Eddystone-url ScanBLE-enabled APs capture beacons and send them to a configured Application Server. Upon reception,the server application triggers possible actions such as updating statistics related to beacon location orcommunicating with a mobile device application.An AP scans for beacons, filtering data based on configuration parameters and reports findings to anApplication Server. ExtremeWireless forwards the report as a JSON message to the customer'sApplication Server. The report includes the following data:•AP Serial Number•The MAC address of the beacon tag•Decoded URL•Device transmission power•The signal strength of the iBeacon tagThe following filters can be applied at the AP to specify the message stream:•Minimum Received Signal Strength Indicator (RSSI). Transfers messages that meet the configuredRSSI threshold. Messages received with an RSSI below the configured threshold are omitted.NNoteOnly scanned frames with Eddystone-url format are supported. The UUID must be 0xFEAA.Refer to the Integration Guide for details on the format of the beacon RTLS message.The customer's Application Server handles the business logic and presentation of the IoT report. TheApplication Server:•Calculates the distance between the BLE tag and the AP, based on the signal strength for the tag/radio channel•Maps AP Serial Number to a physical location•Tracks BLE tags.From ExtremeWireless, configure Eddystone-url Scan parameters under AP configuration.Configuring Eddystone-url ScanThe following APs oer integrated BLE/802.15.4 radios: AP3912i , AP3915i/e, AP3916ic, AP3917i/e/k.To configure Eddystone-url Scan support from the IIoT tab:1 From the top menu, click AP. The AAP screen displays.2 Click the appropriate wireless AP in the list (not the check box). The AAP dashboard displays.3 Click Configure. The AAP Properties tab displays.4 Click the IoT tab, and select IoT Admin.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide195
Draft5 From the Application field, select Eddystone-url Scan.Figure 39: Eddystone-url Scan Application6 Configure the following parameters:Table 20: Eddystone-url Scan SettingsFField DescriptionApplication Determines application type. Select Eddystone URL ScanDestination IP Address IP address of the customer Application Server that receives thebeacon report.Destination Port Destination Port on the customer Application Server that presents thebeacon report.Scan Interval Determines how long to wait between scans. Valid values are: Min(100ms) and Max (10240ms). The default value is Min (100ms).Scan Window Determines how long to scan per channel. Valid values are Min(100ms) and Max (10240ms).Value must be less than Scan Intervalvalue. Default value is 100ms.Min RSSI This is the signal strength required to include the packet in the BLEreport. Valid values: -10 to -100. Default value is -100. Data frombeacons with an RSSI that is less than the Min RSSI configured value isfiltered out.Related LinksEddystone-url Scan on page 195IoT Multi-Edit Configuration on page 129Configuring IoT Applications on page 189IoT Thread GatewayThe ExtremeWireless Thread Network solution makes use of a single infrastructure to combine awireless network with an IoT sensor network, while integrating with an enterprise backbone network.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide196
DraftEach AP391x, with integrated BLE/802.15.4 radios, creates a separate Thread Network identified with aseparate PAN ID. Sensors scan, find the AP Thread Network, and build a Mesh network with that APserving as the border gateway router. The AP routes network trac between its own Thread Networkinterface and the IoT interface.To configure a Thread Network, do the following:•Configure a VNS:•Create a new VNS.•Enable IPv6 multicast•Assign a VLAN.NNoteThe VLAN must have a Router with DHCPv6-PD — Thread Network supports IPv6addressing only. If the DHCPv6 server provides global address, all sensors in the networkreceive the global address, and therefore, can be managed from the Cloud IPv6 network.•Configure IoT Thread Gateway on an AP391x.•Configure a WLANS with an IoT port enabled.•Configure a whitelist that defines the allowed sensor nodes and joiner sensors for the ThreadNetwork.NoteIf the whitelist is not configured, all sensors with password THREAD are accepted into thenetwork.Related LinksConfiguring an AP as a Thread Gateway on page 197Advanced Thread Gateway Properties on page 198Managing an IoT Whitelist on page 671IoT Multi-Edit Configuration on page 129Configuring an AP as a Thread GatewayTo configure the Thread Network on each supported AP, take the following steps:1 From the top menu, click AP. The AAP screen displays.2 Click the AP row (not the check box) for an AP model that oers a BLE/802.15.4 radio.The AAP dashboard displays.3 Click Configure. The AAP Properties tab displays.4 Click the IoT tab, and select IoT Admin.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide197
Draft5 From the Application field, select Thread Gateway and click Advanced.Figure 40: IoT Admin Tab Thread Gateway ApplicationThe AAdvanced Thread Gateway parameters dialog displays.Related LinksAdvanced Thread Gateway Properties on page 198IoT Thread Gateway on page 196Advanced Thread Gateway PropertiesConfigure the following parameters on the selected AP. The AP serves as a border gateway router for itsown Thread Network.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide198
DraftFigure 41: IoT Thread Gateway PropertiesDNNoteThe configured Thread Gateway displays on the Active Clients report, indicating that thegateway is up and running.Table 21: Thread Gateway PropertiesField DescriptionApplication Determines application type. Select Thread GatewayName Thread Network name. Default value is the AP serial number. Each APcreates a separate Thread Network identified with separate Short PANID and Extended PAN ID.Channel The IEEE Standard: 802.15.4 AP channel number.Short PAN ID A 16-bit, MAC-layer addressing field used in RF data transmissionsbetween devices in a Thread Network. The default value is derivedfrom the AP serial number. The Short PAN ID identifies the APs ThreadNetwork.Extended PAN ID A 64-bit, MAC-layer addressing field used in RF data transmissionsbetween devices in a Thread Network. The default value is derivedfrom the AP serial number. This value must be unique. It is used for amore specific network identification.Master Key Indicates the Network Master Key used to encrypt communicationbetween nodes in a Thread Network.Related LinksConfiguring an AP as a Thread Gateway on page 197IoT Thread Gateway on page 196Setting Up the Wireless AP Using Static ConfigurationStatic configuration settings allow you to set up branch oce support. These settings can be employedwhenever required, and are not dependent on branch topology. In the branch oce model, while thecontroller is at a central oce, APs are installed in remote sites. The APs must be able to interact in bothConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide199
Draftthe local site network and the central oce network. When this is the case, a static configuration isrecommended.For initial configuration of a wireless AP to use a static IP address assignment:•Allow the AP to first obtain an IP address using DHCP. By default, APs are configured to use theDHCP IP address configuration method.•Allow the AP to connect to the controller using the DHCP assigned IP address.•After the AP has successfully registered to the controller, use the SStatic Configuration tab toconfigure a static IP address for the AP, and then save the configuration.•Once the static IP address has been configured on the AP, the AP can then be moved to its targetlocation, if applicable.NoteIf a wireless AP with a statically configured IP address (without a statically configuredWireless Controller Search List) cannot register with the controller within the specifiednumber of retries, the wireless AP uses SLP, DNS, and SLP multicast as a backupmechanism.To set up a wireless AP using static configuration:1 From the top menu, click AP. The AAP screen displays.2 Click the appropriate wireless AP in the list (not the check box). The AAP dashboard displays.3 Click Configure. The AAP Properties tab displays.4 Click the Static Configuration tab.5 Configure the following parameters:a Select a VLAN (Virtual LAN) setting for the AP.CautionCaution should be exercised when using this feature. For more information, see Configuring VLAN Tags for Wireless APs on page 203. If the Wireless AP VLAN is notconfigured properly (wrong tag), connecting to the AP may not be possible. To recoverfrom this situation, you need to reset the AP to its factory default settings. For moreinformation, see the Extreme Networks ExtremeWireless Maintenance Guide .Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide200
Draftb Select a method of IP address assignment for the AP.NNoteClient Port configuration is available for the AP3912. For more information, see Assigning WLAN Services to Client Ports on page 170.Table 22: Static Configuration PropertiesField/Button DescriptionVLAN SettingsTagged Select if you want to assign this AP to a specific VLAN and type the value in thebox.Untagged Select if you want this AP to be untagged. This option is selected by default.VLAN ID Enter a VLAN ID. Valid values are 2 to 4094IP Address AssignmentConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide201
DraftTable 22: Static Configuration Properties (continued)FField/Button DescriptionUse DHCP Select to enable Dynamic Host Configuration Protocol (DHCP). This option isenabled by default.Static Values Select to specify the IP address of the AP.IP Address Type the IP address of the AP.Netmask Type the appropriate subnet mask to separate the network portion from the hostportion of the address.Gateway Type the default gateway of the network.Ethernet PortEthernet Speed If the AP has an Ethernet port, select values in the Ethernet Speed and EthernetMode drop down lists.Ethernet Mode If the AP has an Ethernet port, select values in the Ethernet Speed and EthernetMode drop down lists.Tunnel MTU Enter a static MTU value, from 600 to 1500, in the Tunnel MTU box. Themaximum MTU can be increased to 1800 bytes by enabling Jumbo Framessupport (for more information, see Setting Up the Data Ports on page 51). If thewireless software cannot discover the MTU size, it enforces the static MTU size.Set the MTU size to allow the source to reduce the packet size and avoid theneed to fragment data packets in the tunnel.LACP Applies to the AP38xx and AP39xx only. Click to Enable Link AggregationControl Protocol. This feature allows higher throughput by combining the twoEthernet ports. This feature is disabled by default.Wireless Controller Search ListUp Select a controller and click the Up button to modify the order of the controllers.When an AP searches for a controller to register with, it begins with the firstcontroller in the list.Down Select a controller and click the Up button to modify the order of the controllers.When an AP searches for a controller to register with, it begins with the firstcontroller in the list.Delete Click to remove the controller from the list so that it can no longer control the AP.Add In the Add box, type the IP address of the controller that will control this AP thenclick the Add button to add the IP address is added to the list. Repeat thisprocess to add the IP addresses of up to three controllers.This feature allows the AP to bypass the discovery process. If the WirelessController Search List box is not populated, the AP uses SLP unicast/multicast,DNS, or DHCP vendor option 43 to discover a controller.For the initial AP deployment, it is necessary to use one of the described optionsin Discovery and Registration on page 120.Additional ButtonsCopy to Defaults To make this AP’s configuration be the system’s default AP settings, click Copyto Defaults. A pop-up dialog asking you to confirm the configuration change isdisplayed.To confirm resetting the system’s default AP settings, click OK.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide202
DraftTable 22: Static Configuration Properties (continued)FField/Button DescriptionReset to Defaults If you have an AP that is already configured with its own settings, but would likethe AP to be reset to use the system’s default AP settings, use the Reset toDefaults featureApply Click to save your changes.Related LinksAP Properties Tab Configuration on page 159Assigning Wireless AP Radios to a VNS on page 168Configuration Parameters for Radio Properties on page 180Setting Up 802.1x Authentication for a Wireless AP on page 203Configuring VLAN Tags for Wireless APsCautionExercise caution while configuring a VLAN ID tag. If a VLAN tag is not configured properly,the connectivity between the controller and the AP will be lost.To configure Wireless APs with a VLAN tag:1 Connect the AP in the central oce to the controller port (or to a network point) that does notrequire VLAN tagging.2 From the top menu, click AP.3 Click the Static Configuration tab.4 In the VLAN Settings section, select Tagged - VLAN ID.5 In the Tagged - VLAN ID text box, type the VLAN ID on which the AP operates.6 To save your changes, click Save. The AP reboots and loses connection with the controller.7 Log out from the controller.8 Disconnect the AP from the central oce network and move it to the target location.9 Power up the AP. The AP connects to the controller.If the AP does not connect to the controller, the AP was not configured properly. To recover from thissituation, reset the AP to its factory default settings, and reconfigure the static IP address.Setting Up 802.1x Authentication for a Wireless AP802.1x is an authentication standard for wired and wireless LANs. The 802.1x standard can be used toauthenticate access points to the LAN to which they are connected. 802.1x support provides security fornetwork deployments where access points are placed in public spaces.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide203
DraftTo successfully set up 802.1x authentication of a Wireless AP, the AP must be configured for 802.1xauthentication before the AP is connected to a 802.1x enabled switch port.CCautionIf the switch port to which the AP is connected is not 802.1x enabled, the 802.1xauthentication does not take eect.802.1x authentication credentials can be updated at any time, whether or not the AP is connected withan active session. If the AP is connected, the new credentials are sent immediately. If the AP is notconnected, the new credentials are delivered the next time the AP connects to the controller.There are two main aspects to the 802.1x feature:•Credential management — The controller and the AP are responsible for the requesting, creating,deleting, or invalidating the credentials used in the authentication process.•Authentication — The AP is responsible for the actual execution of the EAP-TLS or PEAP protocol.802.1x authentication can be configured on a per-AP basis. For example, 802.1x authentication can beapplied to specific APs individually or with a multi-edit function.The 802.1x authentication supports two authentication methods:•PEAP (Protected Extensible Authentication Protocol)•Is the recommended 802.1x authentication method•Requires minimal configuration eort and provides equal authentication protection to EAP-TLS•Uses user ID and passwords for authentication of access points•EAP-TLS•Requires more configuration eort•Requires the use of a third-party Certificate Authentication application•Uses certificates for authentication of access points•The controller can operate in either proxy mode or pass through mode.Proxy mode — The controller generates the public and private key pair used in the certificate.Pass through mode — The certificate and private key are created by the third-party CertificateAuthentication application.NoteAlthough a wireless AP can support using both PEAP and EAP-TLS credentialssimultaneously, it is not recommended to do so. Instead, it is recommended thatyou use only one type of authentication and that you install the credentials for onlythat type of authentication on the wireless AP.Related LinksAP Properties Tab Configuration on page 159Assigning Wireless AP Radios to a VNS on page 168Configuration Parameters for Radio Properties on page 180Setting Up the Wireless AP Using Static Configuration on page 199Setting Up 802.1x Authentication for Wireless APs Using Managing Certificates on page 209Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide204
DraftConfiguring 802.1x EAP-TLS AuthenticationEAP-TLS authentication uses certificates for authentication. A third-party Certificate Authenticationapplication is required to configure EAP-TLS authentication. Certificates can be overwritten with newones at any time.With EAP-TLS authentication, the controller can operate in the following modes:•Proxy Mode on page 205•Pass Through Mode on page 207NNoteWhen a wireless AP that is configured with 802.1x EAP-TLS authentication is connected toa controller, the AP begins submitting logs to the controller thirty days before thecertificate expires to provide administrators with a warning of the impending expiry date.Proxy ModeIn proxy mode, the controller generates the public and private key pair used in the certificate. You canspecify the criteria used to create the Certificate Request. The Certificate Request that is generated bythe controller is then used by the third-party Certificate Authentication application to create thecertificate used for authentication of the Wireless AP. To successfully configure 802.1x authentication ofa Wireless AP, the AP must first be configured for 802.1x authentication before the AP is deployed on a802.1x enabled switch port.To Configure 802.1x EAP-TLS Authentication in Proxy Mode:1 From the top menu, click AP.2 In the AP list, click the wireless AP (not the check box) for which you want to configure 802.1x EAP-TLS authentication.3 Click the 8802.1x tab.4 Click Generate Certificate Signing Request. The GGenerate Certificate Signing Request window isdisplayed.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide205
raft5 Type the criteria to be used to create the certificate request. All fields are required:•Country name — The two-letter ISO abbreviation of the name of the country•State or Province name — The name of the State/Province•Locality name (city) — The name of the city•Organization name — The name of the organization•Organizational Unit name — The name of the unit within the organization•Common name — Click the value you want to assign as the common name of the wireless AP.(See Table 23 on page 212 for credential parameters and values.)•Email address — The email address of the organization6 Click Generate Certificate Signing Request. A certificate request file is generated (.csr fileextension). The name of the file is the AP serial number. The FFile Download dialog is displayed.7 Click Save. The SSave as window is displayed.8 Navigate to the location on your computer that you want to save the generated certificate requestfile, and then click Save.9 In the third-party Certificate Authentication application, use the content of the generated certificaterequest file to generate the certificate file (.cer file extension).10 On the 8802.1x tab, click Browse. The CChoose file dialog is displayed.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide206
Draft11 Navigate to the location of the certificate file, and click Open. The name of the certificate file isdisplayed in the X509 DER / PKCS#12 file box.12 To save your changes, click Save.The 802.1x EAP-TLS (certificate and private key) authentication in proxy mode is assigned to the AP.The wireless AP can now be deployed to a 802.1x enabled switch port.Pass Through ModeIn pass through mode, the certificate and private key are created by the third-party CertificateAuthentication application. To successfully configure 802.1x authentication of a wireless AP, the APmust first be configured for 802.1x authentication before the AP is deployed on a 802.1x enabled switchport.Before you configure 802.1x using EAP-TLS authentication in pass through mode, create a certificateusing the third-party Certificate Authentication application and save the certificate file in PKCS #12 fileformat (.pfx file extension) on your system.TTo Configure 802.1x EAP-TLS Authentication in Pass Through Mode:1 From the top menu, click AP.2 Click the appropriate wireless AP in the list (not the check box). The AAP dashboard displays.3 Click Configure. The AAP Properties tab displays.4 Click the 8802.1x tab.5 Click Browse. The CChoose file window is displayed.6 Navigate to the location of the certificate file (.pfx) and click Open. The name of the certificate file isdisplayed in the X509 DER / PKCS#12 file box.7 In the Password box, type the password that was used to protect the private key.NoteThe password that was used to protect the private key must be a maximum of 31characters long.8 To save your changes, click Save.The 802.1x EAP-TLS authentication in pass through mode is assigned to the wireless AP. The AP cannow be deployed to a 802.1x enabled switch port.Viewing 802.1x CredentialsWhen 802.1x authentication is configured on a wireless AP, the light bulb icon on the 802.1x tab for theconfigured AP is lit to indicate which 802.1x authentication method is used. A wireless AP can beconfigured to use both EAP-TLS and PEAP authentication methods. For example, when both EAP-TLSConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide207
Draftand PEAP authentication methods are configured for the AP, both light bulb icons on the 802.1x tab arelit.NNoteYou can view only the 802.1x credentials of wireless APs that have an active session with thecontroller. If you attempt to view the credentials of a wireless AP that does not have an activesession, the AAP Credentials window displays the following message: Unable to query wirelessAP: not connected.To view current 802.1x credentials:1 From the top menu, click AP.2 In the AP list, click the wireless AP (not the check box) for which you want to view its current 802.1xcredentials.3 Select the 8802.1x tab.4 In the Current Credentials section, click Get Certificate details.The WWireless AP Credentials window is displayed.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide208
DraftDeleting 802.1x CredentialsCCautionExercise caution when deleting 802.1x credentials. For example, deleting 802.1x credentialsmay prevent the AP from being authenticated or cause it to lose its connection with thecontroller.To delete current 802.1x credentials:1 From the top menu, click AP.2 In the AP list, click the wireless AP (not the check box) for which you want to view its current 802.1xcredentials.3 Select the 8802.1x tab.4 Do the following:•To delete EAP-TLS credentials, click Delete EAP-TLS credentials.•To delete PEAP credentials, click Delete PEAP credentials.The credentials are deleted and the AP settings are updated.DDNoteIf you attempt to delete the 802.1x credentials of a wireless AP that currently does nothave an active session with the controller, the credentials are deleted only after the APconnects with the controller.Setting Up 802.1x Authentication for Wireless APs Using ManagingCertificatesIn addition to configuring APs individually, you can also configure 802.1x authentication for multiple APssimultaneously by using the AP 802.1x Multi-edit feature.When you use the AP 802.1x Multi-edit feature, you can choose to:•Assign EAP-TLS authentication based on generated certificates to multiple APs by uploadinga .pfx, .cer, or .zip file.•Assign PEAP credentials to multiple APs based on a user name and password that you defineTo configure 802.1x EAP-TLS Authentication in Proxy Mode using Multi-edit:Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide209
ft1 From the top menu, click AP.The AAP screen displays.2 In the AAPs list, select one or more APs to configure. To search for a specific AP, enter the AP in thesearch bar and click .3 Click Actions > Manage Certificates4 In the Certificate Signing Request section, type the following:•Country name — The two-letter ISO abbreviation of the name of the country•State or Province name — The name of the State/Province•Locality name (city) — The name of the city•Organization name — The name of the organization•Organizational Unit name — The name of the unit within the organization•Common name — Click the value you want to assign as the common name of the wireless AP(see Table 23 on page 212 for credential parameters and values).•Email address — The email address of the organization•Key Size — If the email address key size is dierent from the default value shown, you canchange it by selecting a new value from the drop down menu.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide210
Draft5 Click Generate Certificates. The AAP 802.1x Multi-edit progress dialog is displayed, which providesthe status of the configuration process. Once complete, the FFile Download dialog is displayed.6 Click Save. The SSave as window is displayed.7 Navigate to the location on your computer that you want to save the generatedcertificate_requests.tar file, and then click Save.The certificate_requests.tar file contains a certificate request (.csr) file for each AP.8 Do one of the following:•For each certificate request, generate a certificate using the third-party CertificateAuthentication application. This method produces a certificate for each wireless AP. Oncecomplete, zip all the certificates files (.cer) into one .zip file.•Use one of the certificate requests and generate one certificate using the CertificateAuthentication application. This method produces one certificate that can be applied to all APs.9 In the Bulk Certificate Upload section, click Browse. The CChoose file window is displayed.10 Navigate to the location of the file (.zip or .cer), and then click Open. The name of the file isdisplayed in the PFX, CER or ZIP Archive box.11 Click Upload and Set certificates.Once complete, the Settings updated message is displayed in the footer of the Wireless Assistant.The 802.1x EAP-TLS authentication configuration is assigned to the APs. The APs can now be deployedto 802.1x enabled switch ports.Configuring 802.1x EAP-TLS Authentication in Pass Through Mode Using Multi-editWhen you configure 802.1x EAP-TLS authentication in pass through mode using Multi-edit, do one ofthe following:•Generate a certificate for each AP using the third-party Certificate Authentication application. Whengenerating the certificates:•Use the Common name value (either Name, Serial, or MAC) of the AP to name each generatedcertificate.•Use a common password for each generated certificate.•All .pfx files created by the third-party Certificate Authentication application must be zipped intoone file.•Generate one certificate, using the third-party Certificate Authentication application, to be appliedto all APs. When generating the certificate, use the Common name value (either Name, Serial, orMAC) of the wireless AP to name the generated certificate.The 802.1x PEAP authentication configuration is assigned to the APs. The APs can now be deployed to802.1x enabled switch ports.Managing CertificatesTo configure certificates, take the following steps:Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide211
Draft1 Certificate Signing Request•Country name — The two-letter ISO abbreviation of the name of the country•State or Province name — The name of the State/Province•Locality name (city) — The name of the city•Organization name — The name of the organization•Organizational Unit name — The name of the unit within the organization•Common name — Click the value you want to assign as the common name of the wireless AP(see Table 23 on page 212 for credential parameters and values).•Email address — The email address of the organization•Key Size — If the email address key size is dierent from the default value shown, you canchange it by selecting a new value from the drop down menu.2 Click Generate Certificates. The AAP 802.1x Multi-edit progress window is displayed, which providesthe status of the configuration process. Once complete, the FFile Download dialog is displayed.3 Click Save. The SSave as window is displayed.4 Navigate to the location on your computer that you want to save the generatedcertificate_requests.tar file, and then click Save.The certificate_requests.tar file contains a certificate request (.csr) file for each AP.5 Do one of the following:•For each certificate request, generate a certificate using the third-party CertificateAuthentication application. This method produces a certificate for each wireless AP. Oncecomplete, zip all the certificates files (.cer) into one .zip file.•Use one of the certificate requests and generate one certificate using the CertificateAuthentication application. This method produces one certificate that can be applied to all APs.Bulk Certificate Upload6 Click Browse. The CChoose file window is displayed.7 Navigate to the location of the file (.zip or .cer), and then click Open. The name of the file isdisplayed in the PFX, CER or ZIP Archive box.8 Click Upload and Set certificates. Once complete, the Settings updated message is displayed in thefooter of the Wireless Assistant.The 802.1x EAP-TLS authentication configuration is assigned to the APs. The APs can now bedeployed to 802.1x enabled switch ports.PEAP AuthenticationPEAP authentication uses user ID and passwords for authentication. To successfully configure 802.1xauthentication of a wireless AP, the AP must first be configured for 802.1x authentication before the AP isdeployed on an 802.1x enabled switch port.9 In the Username drop-down list, click the value you want to assign as the user name credential:10 In the Password drop-down list, click the value you want to assign as the password credential.Table 23: Credential ParametersParameter ValueName The name of the wireless AP, which is assigned on the AP Properties tab. The AP name can beedited.Serial The serial number of the AP. This setting cannot be edited.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide212
DraftTable 23: Credential Parameters (continued)PParameter ValueMAC The MAC address of the AP. The setting cannot be edited.Other Click to specify a custom value. A text box is displayed. In the text box, type the value you wantto assign as the user name credential.11 To save your changes, click Save.The 802.1x PEAP authentication configuration is assigned to the AP. The AP can now be deployed toan 802.1x enabled switch port.Related LinksSetting Up 802.1x Authentication for Wireless APs Using Managing Certificates on page 209Configuring Co-Located APs in Load Balance GroupsYou can configure APs that are co-located in an open area, such as a classroom, a conference hall, or anentrance lobby, to act as a load balance group. Load balancing distributes clients across the co-locatedAPs that are members of the load balance group. The co-located APs should provide the same SSID,have Line-of-Sight (LoS) between each other, and be deployed on multiple channels with overlappingcoverage.Assign an AP's radio to the load balance group for the client distribution to occur. Load balancingoccurs only among the assigned AP radios of the load balance group. Each radio can be assigned onlyto one load balance group. Multiple radios on the same AP do not have to be in the same load balancegroup. The radios that you assign to the load balance group must be on APs that are controlled by thesame controller.The load balance group uses one or more WLAN services for all APs assigned to the load balancegroup. You can configure two types of load balance groups:•Client Balancing load group – performs load balancing based on the number of clients across all APsin the group and only for the WLANs assigned to the load group. This is dierent from load controlin the Radio Preference group— load control APs make decisions in isolation from each other.•Radio Preference load group – performs band preference steering and load control. Band preferencesteering is a mechanism to move 11a-capable clients to the 11a radio on the AP, relieving congestionon the 11g radio. No balancing is done between the 11a and 11g radios. Load control is disabled bydefault. A radio load group executes band preference steering and/or load control across the radioson each AP in the group. Each AP balances in isolation from the other APs, but all APs in the loadgroup have the same configuration related to the band preference and load control.Client balancing on the controller is AP-centric and requires no input from the client. The AP radios inthe client balance group share information with secure (AES) messaging using multicast on the wirednetwork. All APs in a client balance group must be in the same SIAPP cluster to ensure that each AP canreach all other APs in the client balance group over the wired subnet. If the APs in a client balancegroup are not in the same SIAPP cluster, client balancing happens independently within the subgroupsdefined by SIAPP clusters.The benefits of configuring your co-located APs that are controlled by the same controller as a clientbalance group are the following:Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide213
Draft•Resource sharing of the balanced AP•Ecient use of the deployed 2.4 and 5 GHz channels•Reduce client interference by distributing clients on dierent channels•Scalable 802.11 deployment: if more clients need to be served in the area, additional APs can bedeployed on a new channelYou can assign a maximum of 32 APs to a client balance group. Table 24 lists the maximum number ofload balance groups for each controller.Table 24: Maximum Number of Load Balance GroupsEExtremeWireless Appliance Number of load balance groupsC4110 32C5110 64C5210 64C5215 64C25 8C35 8V2110 64V2110 (MS Hyper-V platform) 32Currently, all APs support load balance groups.To create a load balance group, see Creating a Load Balance Group on page 214.Creating a Load Balance GroupTo create a load balance group:1 From the top menu, click AP.2 In the left pane, click Load Groups.3 Click New. The AAdd Load Group window displays.4 Enter a unique name for a load group ID, and select a Type from the drop-down menu and then clickAdd. The options are:•Client Balancing — load balancing based on the number of clients across all APs in the loadbalance group and only for the WLANs assigned to the group.•Radio Preference —band preference steering and load control on this load group.If you are adding a Client Balancing load balancing group, the RRadio Assignment tab becomes available.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide214
raftIf you are adding a Radio Preference load balancing group, the RRadio Preference tab becomes available.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide215
DraftThe radios for both types of load groups can be assigned to a WLAN, on the WWLAN Assignment tab.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide216
raftYou can filter the display of AP Groups. In the left pane, Expand Client Balancing to see only ClientBalancing groups. Expand Radio Preference to see only Radio Preference groups.NNoteFor more information about the fields on these screens, see Configuration Parameters for APLoad Groups on page 217.Configuration Parameters for AP Load GroupsTable 25: AP Load GroupsField/Button DescriptionLoad Group ID Enter a unique name for the load group. You can create load groupswith the same name on dierent controller; however, the groups aretreated as separate groups according to the home controller where thegroup was originally created.Type The type of load group is displayed. Options include:•Client Balancing - select to perform load balancing based on thenumber of clients across all APs in the load balance group and onlyfor the WLAN Services assigned to the group.•Radio Preference - select to perform band preference steering andenforce load control settings on this load group.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide217
DraftTable 25: AP Load Groups (continued)FField/Button DescriptionNew Click to create a new load group. The AAdd Load Group window.Delete Click to delete this load group.Save Click to save your changes.Radio Assignment tab - Available for load groups assigned the Client Balancing type.Select AP Radios From the drop-down menu, select the AP radios that you want toassign to the load group. Options include:•All radios•Radio 1•Radio 2•Clear all radiosYou can assign a radio to only one load balance group. A radio that isassigned to another load balance group has an asterisk next to it. Ifyou select a radio that has been assigned to another load balancegroup, the radio is reassigned to the new load balance group.Note: You can assign each radio of an AP to dierent load balancegroups.Radio Preference tab - Available for load groups assigned the Radio Preference typeBand Preference Select the Enable check box to enable band preference for this loadgroup.You can apply band preference to a VNS assigned in the load group.Enabling band preference enables you to move an 11a-capable client toan 11a radio to relieve congestion on an 11g radio. A client is considered11a capable if the AP receives requests on an 11a VNS that alreadybelongs to a load group with band preference enabled. After youconfigure band preference, if a client tries to re-associate with an 11gradio, it is rejected if the AP determines that the client is 11a capable.Load Control Select the following parameters for each radio assigned to this loadgroup:•Enable: Select this check box to enable Radio Load Control (RLC)for individual radios (Radio1 and Radio2) associated with this LoadGroup.•Max. # of Clients: Enter the maximum number of clients for Radio1 and Radio 2. The default limit is 60. The valid range is: 5 to 60.•Strict Limit: Select this check box to enable a strict limit on thenumber of clients allowed on a specific radio, based on the max #of clients allowed. Limits can be enforced separately for radio1 andradio 2.AP Assignment Select the APs on which you want to enforce the Band Preference andLoad Control settings.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide218
DraftTable 25: AP Load Groups (continued)FField/Button DescriptionWLAN Assignment tabWLAN Name Click the check box of the one or more WLAN services that you wantto assign to all member radios of the load balance group. You canselect up to the radio limit of eight VNSs.When you assign a radio to a load group, WLAN service assignmentcan be done only from the WLAN Assignment tab on the WWireless APLoad Groups screen. On all other WLAN Assignment tabs associatedwith the member AP radios, the radio check box associated with themember AP radios is grayed out. When you remove a radio from aload group, the load group’s WLAN service remains assigned to theradio, but you can now assign a dierent WLAN service to the radio.How Availability Mode Aects Load BalancingAll radios assigned to a load group must belong to APs that are all controlled by the same controller.Availability mode can be configured only from the home controller on which the load group wascreated. Load balancing continues to operate if member APs fail over to the foreign controller as long asthe WLAN service assignment remains the same.To ensure that load balancing works properly in availability mode, enable synchronization of the systemconfiguration and the WLAN services used by the load group when you configure availability mode. Ifyou do not enable synchronization, the radios on any AP that fails over may be removed from theirassigned load groups. For more about availability mode, see Configuring Availability Using theAvailability Wizard on page 539.If you have not configured synchronization, in a failover situation you are able to change the loadbalance group’s WLAN service assignment from the VVNS Configuration screens and the WWireless APWLAN Assignment screens on the foreign controller.If you have configured synchronization, you cannot change the WLAN assignments from the foreigncontroller. If you have not configured synchronization, you must configure the foreign controller toensure that all AP radios in the load balance group have the same WLAN services assigned before theAP fails over, as originally configured for the load group. If the WLAN services assigned do not matchwhen an AP fails over, the aected AP radios are removed from the load group. If you change theWLAN services to match after the AP fails over, the AP radios still are not allowed to be in the loadgroup. Reconnect the AP to the home controller to have the radios become part of the load groupagain.Load Balance Group StatisticsYou can view load balance group statistics through the Active Wireless Load Groups report. For moreinformation, see Viewing Load Balance Group Statistics on page 631.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide219
DraftConfiguring an AP ClusterAPs operating in both fit mode and standalone mode operate in a cluster setup. A cluster is a group ofAPs configured to communicate with each other. Mobile users (MU) can seamlessly roam between theAPs participating in the cluster. Wireless APs extend basic cluster functions with the followingenhancements:•Client balancing across AP in the Load Group•Client session synchronization between APs in the SiteAPs operating on the same subnet with multicast and IGMP (Internet Group Management Protocol)snooping enabled can be formed into a cluster. You assign each AP a common, default cluster ID(shared secret).An AP cluster can exist at any point in your network. Each cluster member periodically (every 30seconds) sends a secure SIAPP (Siemens Inter-AP Protocol) multicast message to update other clustermembers. The SIAPP message includes:•The AP name•The AP Ethernet MAC address•The AP IP address•The client count•The base BSSIDs for both radios•Client session information in a case when APs are members of a SiteEach AP caches locally-stored information about the other cluster members and maintains its own viewof the cluster including the client session information in the Site.To change an AP cluster’s configuration:1 From the top menu, click AP.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide220
Draft2 In the left pane, click Global Settings > AP Registration.3 In the Secure Cluster section, enter a cluster shared secret.4 Enable cluster encryption by clicking on the User Cluster Encryption check box. APs on which usercluster encryption is disabled cannot participate in the cluster.5 Enable or disable support for inter-AP roaming by clicking on the Inter AP Roam check box.6 Click Save.Configuring an AP as a GuardianWireless access points that are configured as Guardians do not bridge trac and instead devote all ofthe AP’s resources to threat detection and countermeasures.When an AP is Approved as a Guardian:•The AP becomes a full time RADAR agent.•The AP is added to a Guardian scan profile.•The AP no longer provides services (WLAN service, load group, site) that were provided prior to thechange.NoteOnce an AP is assigned to a Guardian Scan Profile it will stop forwarding trac on bothradios.To configure an AP as a Guardian Scan Profile:1 From the top menu, click WIPS.2 In the left pane, expand Radar Profiles.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide221
Draft3 In the left pane, expand Guardian Scan and select an AP from the list or click New.4 In the AAdd Scan Profile dialog, select Guardian from the Profile drop-down.5 Click Add.For more information, see Configuring a Guardian Scan Profile on page 577.Configuring a Captive Portal on an APExtremeWireless oers a scalable captive portal solution on the AP that can be managed locally orthrough a Cloud solution. The distributed solution is available on ExtremeWireless AP38xx series andAP39xx series APs.Firewall Friendly External Captive Portal (FFECP) on the AP for B@AP topologies is an extension toFirewall Friendly Captive Portal on the controller for tunneled (B@AC and routed) topologies.You can configure the FFECP with full authentication using a URI and signature, or you can configure aRADIUS server, authenticating with a user name and password.To configure an External Captive Portal on an AP, the following is required:•The WLAN Service topology must be VLAN B@AP.•You must configure specific policy rules that defines which trac is allowed, which trac is denied,and if using Rule-based Redirection, which trac is redirected.•The Captive Portal must be configured as External Firewall Friendly.NoteExtremeWireless supports a non-topology specific implementation. Extreme will register sub-domain “apcp.ezcloudx.com” and populate public/Extreme DNS server with DNS mapping of1.1.1.1 for FQDN “apcp.ezcloudx.com”.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide222
DraftIn Figure 42, the default Access Control on the VLAN is Deny. Rules are created to allow the ECP URL,allow DNS and DHCP trac, and to allow all outgoing MU trac, and to redirect specific trac.Figure 42: Example: Policy Rules for non-authenticated roleRRelated LinksConfiguring Firewall Friendly External Captive Portal on an AP on page 223Controlling Network Access on the AP on page 226Configuring Firewall Friendly External Captive Portal on page 353Assigning RADIUS Servers for Authentication on page 340Configuring Firewall Friendly External Captive Portal on an APTo configure a Firewall Friendly External Captive Portal (FFECP) on the AP, take the following steps:Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide223
Draft1 If configuring Rule-based Redirection, verify that Rule-based Redirection is enabled. Go to VNS >Global > Filtering Mode and select Enable Rule-Based Redirection.Rule-Based Redirection is enabled by default for new installations of ExtremeWireless v10.11 andlater. When upgrading from an earlier version of ExtremeWireless, this option is cleared by default.You must enable Rule-Based Redirection from the FFiltering Mode screen.NoteThe option to disable Rule-based Redirection is available for backward capability only.Rule-based Redirection relies on policy rules that are defined for HTTP(S) redirection. Non-Rule-based Redirection automatically redirects an un-authenticated client to ECP when a deny actionoccurs on HTTP(S) trac.NoteYou cannot configure Captive Portal Redirection using IPv6 classifiers. While you can httpto IPv6 websites, you cannot apply Captive Portal redirection to http [s] over IPv6 .2 Create a basic topology where the topology mode is Bridge Trac Locally at AP. The topology canbe tagged or untagged. For more information, see Configuring a Basic Topology on page 267 in theUser Guide.If using RADIUS authentication, FF-ECP on the AP can work with both local and central RADIUSauthentication.3 Create a role and define specific policy rules.The role must be configured with the following parameters:From the VVLAN & Class of Service tab, select a default Access Control value for the role.Select from one of the following:•None - No role defined•No change - Default setting•Allow - Packets contained to role's default action's VLAN/topology.•Deny - Any packet not matching a rule in the Role is dropped.•Containment VLAN - Any packet not matching a rule is sent to defined VLAN.For B@AP trac, only the FF ECP is supported as an external captive portal.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide224
DraftOn the PPolicy Rules tab, enable AP Filtering.Configure specific policy filters.•Allow DHCP and DNS trac.•Mobile user access to FF-ECP.•Allow trac towards mobile user.•HTTP(S) redirection.DDDNoteExtremeWireless supports a non-topology specific implementation. Extreme willregister sub-domain “apcp.ezcloudx.com” and populate public/Extreme DNS serverwith DNS mapping of 1.1.1.1 for FQDN “apcp.ezcloudx.com”.For more information, see Configuring Rule-Based Redirection on page 291 in the User Guide.4 Configure a WLAN Service with the following parameter settings:•Default Topology = Bridged at AP, tagged or untagged.•Select an AP.•Configure Privacy settings.•Configure the Captive Portal to be External Firewall Friendly.•(Optional) Configure RADIUS servers for RADIUS authentication. For more information, see Assigning RADIUS Servers for Authentication on page 340 in the User Guide.•Configure the following parameters on the ECP:•The Identity and Shared Secret fields are required and must match the values used when youconfigured the captive portal.•When configuring the Allow policy for the ECP, the IP/subnet value specified on the FFilterRule Definition dialog must match the Redirection URL value specified on the FFECPConfigure dialog.•Select the Vendor Specific Attributes (VSAs) for authentication. For more information, see Vendor Specific Attributes on page 344 in the User Guide.•Select an option for Send Successful Login To.For FFECP local radius authentication:•The AP must be in Site mode.•Local RADIUS authentication is configured on at least one RADIUS server.•The Signature option is unchecked.5 Configure a VNS with the authenticated and non-authenticated policies.Related LinksConfiguring a Basic Topology on page 267Configuring Rule-Based Redirection on page 291Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide225
DraftUnderstanding the Filter Rule Definition Dialog on page 302Configuring a Basic WLAN Service on page 319Configuring WLAN Service Privacy on page 330Configuring Firewall Friendly External Captive Portal on page 353Assigning RADIUS Servers for Authentication on page 340Controlling Network Access on the APWhen Rule-based Redirection is disabled, denied HTTP(S) trac from an non-authenticated client isautomatically redirected to the External Captive Portal by the AP. To control network access afterauthentication, configure roles that have an Access Control of deny and specify that role under VirtualNetworks > General.To configure default roles that deny network access after authentication:1 Go to Virtual Networks and select a VNS or click New.2 Specify the default roles for Authenticated network trac. In the Authenticated field under DefaultRoles, select a role or create a new role that has policy rules defined to deny access.For more information, see Understanding the Filter Rule Definition Dialog on page 302AP3916ic Integrated Camera DeploymentThe AP3916ic features an integrated video camera, oering a single device for wireless access andsecurity purposes. Video management is provided by the customer's Video Management System (VMS)integrated per ONVIF Profile S 2.4 compliance. The camera deployment process is as follows:1 The AP3916ic is connected to the network and the controller discovers the camera IP address.Per ONVIF specification, video management systems query network through WS-Discoverymulticast (239.255.255.250). Allow multicast when configuring the default camera topology.•Client IP = IP address of camera module•Device Type = Extreme Networks 2 MP Camera (EXTR2MP-CAM)•AP = AP camera module is ‘associated’ with Radio/Port = CAM•Packet/Byte counters = Indicate Camera Activity2 Associate a WLAN B@AP or B@AC topology to the camera port.3 The camera requests a DHCP address.4 The EWC Active Clients Report lists the IP address of the camera. You can export the client IPaddress list to an XML file.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide226
Draft(Optional) The camera IP address can be detected by third-party tools, such as ONVIF DeviceManager.NNoteExtremeWireless manages the AP and camera firmware revision. After initial connection,the AP/camera may undergo a firmware upgrade. The upgrade process runs before thedevice becomes fully active on the network.5 Based on the reported IP address of the camera, the user associates the camera to the videosurveillance system.For information about camera configuration settings, see Accessing the Camera Web User Interfaceon page 227.Related LinksAP3916ic (Integrated Camera) on page 104Assigning WLAN Services to Client Ports on page 170Upgrading the Camera Image Manually on page 237Multicast Filtering on page 281AP3916ic-Camera Web User Interface on page 227Camera Direct Stream SubscriptionIf your video management system does not support ONVIF/IP camera discovery, subscribe directlyusing Real Time Streaming Protocol (RTSP). With direct stream, video is streamed through RTSP – H.264 or Motion JPEG (MJPEG):•Stream 1:•Max Resolution: 1920x1080 (1080p)•RTSP URL: rtsp://<Camera IP>:554/live/ch00_0•Stream 2:•Max Resolution: 640x360•RTSP URL: rtsp://<Camera IP>:554/live/ch01_0AP3916ic-Camera Web User InterfaceThe AP3916ic is an 11ac Wave 2 AP with an integral security camera that lets you extend your WirelessLAN and provide simultaneous wireless service, BLE or 802.15.4 coverage and security in public spaces,such as classrooms and oces.Extreme Networks oers a web-based user interface to customize and configure the camera.Related LinksAccessing the Camera Web User Interface on page 227Camera UI Basic Functions on page 228Accessing the Camera Web User InterfaceTake the following steps to access the AP3916ic Web User Interface:Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide227
raft1 Using your browser, navigate to the IP address of the camera.Find the camera IP address on the AP dashboard of the AP3916ic. Go to the AP list and click on anAP3916ic.2 Enter the camera IP address into your browser.The web UI displays.Figure 43: AP3916ic Web UI3 Login with default credentials admin/admin The credentials are case sensitive.Later, you can customize these credentials. See User Management on page 235.NNoteAfter the initial login, set a password in accordance with your IT policy regulations. Usingdefault credentials is a security vulnerability for your network.Related LinksAP3916ic (Integrated Camera) on page 104Camera UI Basic Functions on page 228AP3916ic Integrated Camera Deployment on page 226Camera Direct Stream Subscription on page 227Camera UI Basic FunctionsConfigure the AP3916ic camera using the web user interface. The AP3916ic web user interface is dividedinto the following tabs:•System on page 229•Network on page 231Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide228
Draft•Media on page 232•User Management on page 235RRelated LinksAccessing the Camera Web User Interface on page 227AP3916ic (Integrated Camera) on page 104Camera Direct Stream Subscription on page 227SystemSystem settings for the AP3916ic camera:•Status — Displays status information about the system, network, and video streams.Figure 44: Sample System and Network StatusConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide229
DraftFigure 45: Sample Video Status•Time — Date/Time settings for the camera.Figure 46: Sample Manual Time settingsConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 2230
DraftFigure 47: Sample NTP Server Settings•Firmware — Browse to the camera image (.dlf file) and apply the image. Camera firmware isdistributed and managed from the controlling ExtremeWireless appliance. If GTAC Supportdetermines that a specific firmware version is required on your device, the on-board firmwareupload functionality can be used to install the image. GTAC will provide the necessary firmware (.dfl)file.•Backup — Save camera settings to a backup file or restore settings from an existing backup file.Figure 48: Sample Backup /Restore Settings•Reset to Default/Reboot•Reset Camera Defaults — Rest camera to factory default settings. Backup current settingsbefore resetting to factory default settings.•Reboot Camera — Restarts the camera. The current camera settings are retained after a camerarestart.NetworkNetwork settings for the AP3916ic camera.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 2231
Draft•IP Configuration — Configure network settings for the camera port.NNoteDynamic IP (DHCP) is the default network Mode.Figure 49: Sample IP Configuration Settings•Universal Plug and Play (UPnP)Figure 50: Sample Discovery Settings: UPnPMediaConfigure settings for: video, camera, advanced settings, privacy mask, and audio.•VideoConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide232
raftFigure 51: Sample Video Configuration Settings•CameraThe video feed assumes a ceiling mount default orientation. When installing the AP in any otherorientation, adjust the video feed accordingly. For example,when the AP is installed as a desk-mount, the video Mirror/Flip setting should be Flip.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 2233
DraftFigure 52: Sample Camera Settings•AdvancedFigure 53: Sample Camera Advanced Settings•AudioConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide 2234
DraftFigure 54: Sample Camera Audio SettingsUser ManagementAdd and delete user accounts, change user settings, and change user password.•User ListFigure 55: User Management SettingsNNoteYou cannot delete the Administrator account.Performing AP Software MaintenanceWhen a new version of AP software becomes available, you can install it from the controller. You canconfigure each AP to upload the new software version either immediately, or the next time the APconnects to the controller. You can also set up a maintenance cycle for specific APs using the optionsConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide235
Dravailable on the AP Maintenance Cycle tab. Part of the AP boot sequence seeks and installs its softwarefrom the controller.WWarningNever disconnect an AP from its power supply during a firmware upgrade. Disconnecting anAP from its power supply during a firmware upgrade may cause firmware corruptionrendering the AP unusable.You can modify most of the radio properties on an AP without requiring a reboot of the AP. Duringupgrade, the AP keeps a backup copy of its software image. When a software upgrade is sent to the AP,the upgrade becomes the AP's current image and the previous image becomes the backup. In the eventof failure of the current image, the AP runs the backup image.Maintaining the List of Current AP Software ImagesTo maintain the list of current wireless AP software images:1 From the top menu, click AP.2 In the left pane, click Global > Maintenance.The following screen appears:Figure 56: AP Software Maintenance3 In the AP Images for Platform drop-down list, click the appropriate platform.4 To select an image to be the default image for a software upgrade, click it in the list, and then clickSet as default.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide236
Draft5 In the Upgrade Behavior section, select one of the following:•Upgrade when AP connects using settings from Controlled Upgrade — The CControlled Upgradetab is displayed when you click Save. Controlled upgrade allows you to individually select andcontrol the state of an AP image upgrade: which APs to upgrade, when to upgrade, how toupgrade, and to which image the upgrade or downgrade should be done. Administrators decideon the levels of software releases that the equipment should be running.•Always upgrade AP to default image (overrides Controlled Upgrade settings) — Selected bydefault. Allows for the selection of a default revision level (firmware image) for all APs in thedomain. As the AP registers with the controller, the firmware version is verified. If it does notmatch the same value as defined for the default-image, the AP is automatically requested toupgrade to the default-image.6 To save your changes, click Save.Related LinksUpgrading the Camera Image Manually on page 237Upgrading the Camera Image ManuallyThe AP3916ic is an 11ac Wave 2 AP with an integral security camera that lets you extend your WirelessLAN and provide simultaneous wireless service, BLE or 802.15.4 coverage and security in public spaces,such as classrooms and oces.The camera image (.dlf file) is distributed within the controller builds. The AP manages the cameraimage — camera images are automatically upgraded with the AP image upgrade when a new cameraimage is available.You have the option to upgrade the camera image manually if necessary. To upgrade the AP3916iccamera image manually:1 From the top menu, click AP.2 In the left pane, click Global > Maintenance.3 From the AAP Software Maintenance tab, under Download AP Images:a Provide the necessary information to download the camera image file.b Select AP3916-Camera as the Platform.c Click Download.4 Under Upgrade Behavior, select Upgrade when AP connects using settings from ControlledUpgrade.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide237
Draft5 Click Save.The CControlled Upgrade tab displays.Figure 57: Manually Upgrading Camera Image6 Select the CControlled Upgrade tab.Figure 58: Controlled Upgrade Tab7 Select AP Platform: AP3916-camera.8 Select the camera image file.9 Click Camera Image Upgrade.Scheduling a Maintenance Cycle for Specific APsTo schedule a maintenance cycle for specific APs:Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide238
aft1 Go to AP.2 In the left pane, click Global Settings > Maintenance.3 Click the AAP Maintenance Cycle tab.The following screen appears:4 Click the Start At box to display the CChoose Time dialog.5 Adjust the sliders for both Hour and Minute to set the time for the AP maintenance cycle, then clickDone.6 In the Duration drop-down, select the desired duration time (in hours).7 Under Recurrence, select the desired frequency.8 Under Platforms, select the AP(s) that are included in the maintenance cycle.9 Click Save.Deleting a Wireless AP Software ImageTo delete a wireless AP software image:1 From the top menu, click AP. The AAP screen displays.2 In the left pane, click Global > Maintenance.3 In the AP Images for Platform drop-down list, click the appropriate platform.4 In the AP Images list, click the image you want to delete.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide239
Draft5 Click Delete. The image is deleted.Downloading a new Wireless AP Software ImageTo download a new wireless AP software image:1 From the top menu, click AP.2 In the left pane, click Global Settings, then AP Maintenance. The AAP Software Maintenance tab isdisplayed.3 In the Download AP Images list, type the following:•FTP Server — The IP of the FTP server to retrieve the image file from.•User ID — The user ID for the controller to use when it attempts to log in to the FTP server.•Password — The corresponding password for the user ID.•Confirm — The corresponding password for the user ID to confirm it was typed correctly.•Directory — The directory on the server in which the image file to be retrieved is stored.•Filename — The name of the image file to retrieve.•Platform — The AP hardware type to which the image applies. The are several types of AP andthey require dierent images.4 Click Download. The new software image is downloaded.Defining Parameters for a Controlled Software UpgradeTo define parameters for a wireless AP controlled software upgrade:1 From the top menu, click AP.2 In the left pane, click Global > Maintenance.3 Under upgrade behavior, select Upgrade when AP connects using settings from ControlledUpgrade.The CControlled Upgrade tab displays.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide240
aft4 Click the CControlled Upgrade tab.NoteThe CControlled Upgrade tab is displayed only when the Upgrade Behavior is set toUpgrade when AP connects using settings from Controlled Upgrade on the AAP SoftwareMaintenance tab.5 In the Select AP Platform drop-down list, click the type of AP you want to upgrade.6 In the Select an image to use drop-down list, click the software image you want to use for theupgrade.7 In the list of registered Wireless APs, select the check box for each AP to be upgraded with theselected software image.8 Click Apply AP image version. The selected software image is displayed in the Upgrade To columnof the list.9 To save the software upgrade strategy to be run later, click Save for later.Configuring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide241
Draft10 To run the software upgrade immediately, click Upgrade Now. The selected AP reboots, and the newsoftware version is loaded.NNoteThe Always upgrade AP to default image check box on the AAP Software Maintenance taboverrides the Controlled Upgrade settings.11 To upgrade without interrupting service, click Upgrade without interrupting service. If you click thisoption while the upgrade scheduler is running, the schedule is interrupted, and the current upgradecycle calculates a new schedule that includes APs that weren't upgraded.Understanding the ExtremeWireless LED StatusWhen you power on and boot an AP, you can follow its progress through the registration process byobserving the LED sequence as described in the following sections:•39xx Series Wireless APs•38xx Series Wireless APs on page 251•37xx Series Wireless APs on page 255After you power on and boot the AP for the first time, you can configure LED behavior as described in Configuring Wireless AP LED Behavior on page 259.39xx Series Wireless APsThe following AP39xx model access points are supported by ExtremeWireless:•AP3917i/e•AP3916i/e•AP3915i/e•AP3912i/e•AP3935i/e•AP3965i/eConfiguring the ExtremeWireless APsExtremeWireless™ V10.41.06 User Guide242

Navigation menu