Download: | ![Samsung Electronics Co WEA453E WLAN Access Point User Manual Model Name Manual Name](/pdf.png) |
Mirror Download [FCC.gov] | ![Samsung Electronics Co WEA453E WLAN Access Point User Manual Model Name Manual Name](/pdf.png) |
Document ID | 2529411 |
Application ID | drNK2MQF4nk97uT6wYNA7w== |
Document Description | APC Operation Manual - Professional Installation Guide 2 of 2 |
Short Term Confidential | No |
Permanent Confidential | No |
Supercede | No |
Document Type | User Manual |
Display Format | Adobe Acrobat PDF - pdf |
Filesize | 363.92kB (4549005 bits) |
Date Submitted | 2015-02-10 00:00:00 |
Date Available | 2015-03-16 00:00:00 |
Creation Date | 2014-12-23 16:18:49 |
Producing Software | Microsoft® Office Word 2007 |
Document Lastmod | 2015-01-21 11:38:49 |
Document Title | Model Name Manual Name |
Document Creator | Microsoft® Office Word 2007 |
Document Author: | ë””ìžì¸ëœ° |
CHAPTER 7. WLAN Additional Services
7.6
Spectrum Analysis
A non-802.11 device such as microwave oven, bluetooth, or Closed Circuit Television
(CCTV), etc. deteriorates data transmitting/receiving performance because it causes
interference in a wireless LAN environment. As a function that measures surrounding
interference, the spectrum analysis analyzes wireless or Radio Frequency (RF) signals to
resolve interference problem instantly.
7.6.1
Retrieving Spectrum Analysis Data
The spectrum analysis function of APC provides the following data.
Sample report: Wireless capture data converted into Fast Fourier Transform (FFT)
Duty cycle report: Channel utilization rate
Interference report: Interference signal information
The FFT report provides the information of an AP and maximum 13 available channels and
also maximum/minimum values of Received Signal Strength Indicator (RSSI) for each
channel. The duty cycle report provides AP information and affected channel information.
In addition, it provides duty cycle transmission data that indirectly provides channel
utilization rate.
The interference report provides AP information, affected channel, or configuration
information of an interferer and also interference information (RSSI or maximum/minimum
frequency of an interference signal) in real-time.
Configuration using CLI
By using the following command, you can check each data.
show spectrum-analysis report [DATA] ap [AP_ID]
Parameter
Description
DATA
Spectrum analysis data type (sample/duty_cycle/interference)
AP_ID
AP ID (range: 1-500)
An example of command execution and its execution result are as follows:
FFT report
APC# show spectrum-analysis report sample ap 1
FFT (Fast Fourier Transform) Reporting Enabled
AP ID 1 Description:
MAC Address......................................
Name.............................................
IP Address.......................................
Mode.............................................
© SAMSUNG Electronics Co., Ltd.
00:11:22:33:44:55
AP_ 01122334455
100.100.100.220
General
page 301 of 628
CHAPTER 7. WLAN Additional Services
Operational Status............................... Up
Map Location......................................
Channel Information:
Channel Interval.................................. 2000 ms
Channel........................................... 1 2 3 4 5 6 7 8
9 10 11 12 13
Channel ID........................................... 1
----------------------------Num Maximum RSSI Average RSSI
--- ------------ -----------1
-120
-120
-120
-120
-120
-120
-120
-120
-120
-120
-120
-120
-120
-120
-120
-120
-120
-120
10
-120
-120
11
-120
-120
12
-120
-120
13
-120
-120
14
-120
-120
15
-120
-120
16
-120
-120
17
-120
-120
18
-120
-120
19
-120
-120
20
-120
-120
21
-120
-120
22
-120
-120
23
-120
-120
24
-120
-120
25
-120
-120
26
-120
-120
27
-120
-120
28
-120
-120
29
-120
-120
30
-120
-120
Press any key to continue (q : quit | enter : next line) :
Duty cycle report
APC# show spectrum-analysis report duty_cycle ap 1
Duty Cycle Reporting Enabled
AP ID 1 Description:
MAC Address...................................... 00:11:22:33:44:55
Name............................................. AP_ 01122334455
© SAMSUNG Electronics Co., Ltd.
page 302 of 628
CHAPTER 7. WLAN Additional Services
IP Address....................................... 100.100.100.220
Mode............................................. General
Operational Status............................... Up
Map Location.....................................
Affected Channels:
Channel Interval................................. 2000 ms
Channel.......................................... 1 2 3 4 5 6 7 8 9
10 11 12 13
Real Time Duty Cycle Report:
Current Time : 2012-06-29 00:40:13
-------------------------------------------------------------------Channel:
1.......................................... D: 100 %
Channel:
2.......................................... D: 100 %
Channel:
3.......................................... D: 100 %
Channel:
4.......................................... D: 100 %
Channel:
5.......................................... D:
30 %
Channel:
6.......................................... D: 100 %
Channel:
7.......................................... D: 100 %
Channel:
8.......................................... D: 100 %
Channel:
9.......................................... D: 100 %
Channel: 10.......................................... D:
50 %
Channel: 11.......................................... D:
97 %
Channel: 12.......................................... D:
70 %
Channel: 13.......................................... D: 100 %
--------------------------------------------------------------------
Interference report
APC# show spectrum-analysis report interference ap 1
Interference Reporting Enabled
AP ID 1 Description:
MAC Address..........................................
00:11:22:33:44:55
Name................................................. AP_
01122334455
IP Address...........................................
100.100.100.220
Mode................................................. General
Operational Status................................... Up
Map Location.........................................
Affected Channels:
Channel Interval..................................... 2000 ms
Channel.............................................. 1 2 3 4 5 6 7
8 9 10 11 12 13
Affected Interferers:
BlueTooth.........................................
Microwave Oven....................................
802.11bgn Continuous Transmitter..................
802.11bgn DECT-like Phone.........................
© SAMSUNG Electronics Co., Ltd.
Enabled
Enabled
Enabled
Enabled
page 303 of 628
CHAPTER 7. WLAN Additional Services
802.11bgn Video Camera...........................
ZigBee...........................................
802.11an Continuous Transmitter..................
802.11an DECT-like Phone.........................
802.11an Video Camera............................
Enabled
Enabled
Enabled
Enabled
Enabled
Real Time Interference Report:
Number of Interferers................................. 1
Num Evoke
Time Interferer Type
RSSI Minimum Frequency Maximum
Frequency
--- ------------------- -------------------------------- ---- ---------------- ----------------1
2012-06-29 08:52:47 802.11bgn Video Camera -80 2401
2401
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. You can retrieve the interference report.
Figure 144. Spectrum Analysis Data
7.6.2
Spectrum Analysis Configuration
You can configure the spectrum analysis function and also a spectrum analysis channel that
will be applied to each spectrum report. The channel information is as follows:
Radio
Channel
2.4 GHz
All, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13
5 GHz Low
All, 36, 40, 44, 48, 52, 56, 60, 64
5 GHz Mid
All, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136,140
5 GHz High
All, 149, 153, 157, 161, 165
To configure the spectrum analysis related function, you must go to the configuration mode
of an AP for which the spectrum analysis function will be configured by executing the
command as follows:
APC# configure terminal
APC/configure# spectrum-analysis ap 1
APC/configure/spectrum-analysis/ap 1#
© SAMSUNG Electronics Co., Ltd.
page 304 of 628
CHAPTER 7. WLAN Additional Services
[Enable/Disable Spectrum]
The command that enables or disables the spectrum analysis function is shown below.
service [MODE]
Parameter
MODE
Description
Enables or disables spectrum analysis
- enable: Enable (default)
- disable: Disable
[Spectrum Analysis Report Configuration]
The command used to enable or disable each spectrum analysis data item is shown below.
configuration-request [DATA] [MODE]
Parameter
DATA
Description
Type of a report to configure (sample/duty-cycle/interference)
- sample: FFT report (default: disabled)
- duty-cycle: Duty cycle report (default: disabled)
- interference: Interference report (default: enable)
MODE
Enables or disables each report function.
- enable: Enable
- disable: Disable
[Channel Report Interval Configuration]
The command is shown below.
channel-interval [INTERVAL]
Parameter
INTERVAL
Description
Channel report interval (range: 1000-60000 ms, default: 1000)
[Changing Channel]
By using the following command, you can change a channel for which the spectrum
analysis will be executed.
(The default is ‘All’ channels.)
dot11b: 2.4 GHz wireless bandwidth
dot11aLow: 5 GHz low wireless bandwidth
dot11aMid: 5 GHz mid wireless bandwidth
dot11aHigh: 5 GHz high wireless bandwidth
© SAMSUNG Electronics Co., Ltd.
page 305 of 628
CHAPTER 7. WLAN Additional Services
7.6.3
Interference Type Configuration
The interference type of 2.4 GHz or 5 GHz that can be detected by the W-EP wireless LAN
is shown below.
Wireless bandwidth
Interference type
2.4 GHz
continuous_transmitter, cordless_phone, video_camera
5 GHz
bluetooth, continuous_transmitter, cordless_phone, microwave_oven,
video_camera, zigbee
To configure an interference type, execute the command as follows:
1)
Go to configure mode of CLI.
APC# configure terminal
APC/configure#
2)
Configure an interference type. The default value of all the interference types is
‘enabled’.
interferer 80211b zigbee: 2.4 GHz configuration
interferer 80211a cordless_phone: 5 GHz configuration
© SAMSUNG Electronics Co., Ltd.
page 306 of 628
CHAPTER 7. WLAN Additional Services
7.7
Controlling Usage per User
A wireless terminal can control traffic usage per user by receiving a QoS profile that
specifies traffic usage (bandwidth) from the RADIUS server at the authentication stage.
You can configure upward and downward usage per wireless terminal.
Configuration using CLI
The procedure of configuring a usage to a profile is as follows:
1)
Go to configure mode of CLI.
APC# configure terminal
2)
Create a QoS profile.
APC/configure# qos [PROFILE_NAME]
APC/configure/qos samsung#
3)
4)
Parameter
Description
PROFILE_NAME
Name of a QoS profile to create
Configure the downward usage in kbps.
bw-contract-downstream [VALUE]
Parameter
Description
VALUE
Downward usage
Configure the upward usage in kbps.
bw-contract-upstream [VALUE]
Parameter
Description
VALUE
Upward usage
5) To check the configured profile information, use the ‘show qos profile’ command.
© SAMSUNG Electronics Co., Ltd.
page 307 of 628
CHAPTER 7. WLAN Additional Services
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. To create a QoS profile to apply to a terminal, click the
button in the initial window.
The QoS addition window consists of the following QoS parameters. By entering each QoS
parameter, you can configure the QoS profile of a specific terminal or configure the usage
control function for each user.
Figure 145. Controlling Usage per User
ID: ID (range: 1-16)
PROFILE NAME: Profile name
DESCRIPTION: Profile description
MAX. DOT1P TAG: Maximum allowed 802.1p tag (range: 0-7)
PER-USER UPSTREAM BANDWIDTH CONTRACT: Maximum upward usage
(range: 0-450000)
PER-USER DOWNSTREAM BANDWIDTH CONTRACT: Maximum downward
usage (range: 0-450000)
VOICE/VIDEO/BEST EFFORT/BACKGROUND: Enter 802.1P TAG (range: 0-7)
and DSCP TAG (range: 0-64) for each item.
© SAMSUNG Electronics Co., Ltd.
page 308 of 628
CHAPTER 7. WLAN Additional Services
7.8
Remote Packet Capture
APC can capture a packet exchanged between the wireless terminals on a remote PC in
real-time by using the remote packet capture protocol.
To configure the remote packet capture function, you must go to the pcap mode by
executing the command as follows:
APC# configure terminal
APC/configure# pcap
Configuring the MAC address of a wireless terminal
Configure the MAC address of a wireless terminal whose packets will be captured.
APC/configure/pcap# config-filter
APC/configure/pcap/config-filter# station-mac [MAC_ADDRESS]
APC/configure/pcap/config-filter# enable-station-mac [INDEX]
Parameter
Description
MAC_ADDRESS
MAC address (11:22:33:44:55:66 format)
INDEX
Index number of MAC address (range: 1-10)
Configuring AP MAC address
Configure the MAC address of an AP whose packets will be captured.
APC/configure/pcap# config-filter
APC/configure/pcap/config-filter# ap-mac [MAC_ADDRESS]
APC/configure/pcap/config-filter# enable-ap-mac [INDEX]
Parameter
Description
MAC_ADDRESS
MAC address (11:22:33:44:55:66 format)
INDEX
Index number of MAC address (range: 1-10)
Configuring Filtering Mode
Capture target can be specified by configuring the filtering mode
APC/configure/pcap# filtering-mode [FILTERING MODE]
Parameter
FILTERING MODE
Description
Filtering mode
- station-only: Use only the configured station MAC information.
- ap-only: Use only the configured AP MAC information.
© SAMSUNG Electronics Co., Ltd.
page 309 of 628
CHAPTER 7. WLAN Additional Services
Starting Service
You must start the remote packet capture service to connect to a device using a program
that supports the remote packet capture protocol on a remote PC.
The related commands are given below.
APC/configure/pcap# start-service
Retrieving Configuration Information
Use the ‘show pcap current-config’ command to retrieve the remote packet capture
configuration information.
APC# show pcap current-config detail
- Current status : Idle
- Filtering mode : station-only
- Configured AP’s MAC Information
No.
MAC Addr.
Filtering
Matched Count
Inbound Rate
Outbound Rate
===== ===================== =========== =============================
================ ================
F4:D9:FB:23:66:00
--------> ON
0.0
0.0
ID
Prf.
AP Name
IPv4 Addr
------ ----------- ----------------------- --------------2
ap_2
AP_f4d9fb236600
10.10.10.20
- Configured Station’s MAC Information
No.
MAC Addr.
Filtering
Matched Count
Inbound Rate
Outbound Rate
===== ===================== =========== =============================
================ ================
78:47:1D:C5:4C:85
OFF <------0
0.0
0.0
AP WN
SSID
IPv4 Addr
---- ---- --------------------------- --------------2
Ajay_2_2_4G
20.20.20.30
FC:A1:3E:47:59:E7
OFF <------0
0.0
0.0
AP WN
SSID
IPv4 Addr
---- ---- --------------------------- --------------2
Ajay_2_2_4G
20.20.20.25
WEC8500#
© SAMSUNG Electronics Co., Ltd.
page 310 of 628
CHAPTER 7. WLAN Additional Services
7.9
Clustering
The clustering function comprehensively manages several APC systems in a single wireless
LAN when several APC systems are used to manage a wireless LAN that cannot be
managed by a single APC. The inter-APC handover function is provided by using
clustering. In other words, it can provide the handover function between wireless LANs
managed by different APC systems.
However, if a model is different, it is not interoperated through clustering.
Configuration using CLI
[Cluster Setting]
To use the clustering function, you must configure each APC according to the following
procedure. Maximum 12 WEC8500 can be grouped in a cluster. Maximum 2 WEC8050
can be grouped in a cluster.
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Set the interval and the number of retries to transmit the Keep-alive messages between
APCs in the cluster.
cluster keep-alive-interval [INTERVAL]
cluster keep-alive-retry-count [RETRY_COUNT]
Parameter
INTERVAL
Description
Interval to transmit the Keep-alive message
(Unit: s, range: 1-30, default: 10)
RETRY_COUNT
Maximum number of the transmission retries when there is no
response to the Keep-alive message (range: 3-20, default: 3)
3)
Enable the cluster
cluster enable: Enable
no cluster enable: Disable
4) To check the configuration information, use the ‘show cluster config’ command.
WEC8500# show cluster config
========================================================
CLUSTER CONFIGURATION INFORMATION
========================================================
KEEP-ALIVE-INTERVAL
: 10
KEEP-ALIVE-RETRY-COUNT
: 3
© SAMSUNG Electronics Co., Ltd.
page 311 of 628
CHAPTER 7. WLAN Additional Services
ENABLE
: YES
OWN-APC-INDEX
: 1
========================================================
[Adding APC to APC List]
To add an APC to the cluster, the APC must be added to the APC list first. APC information
is automatically added to the APC list.
1)
Go to apc-list configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure# apc apc-list
WEC8500/configure/apc/apc-list#
2)
Add the APC to the APC list.
add-apc [APC_NAME] [MAC_ADDRESS]
Parameter
Description
APC_NAME
APC name to be added to the APC list
MAC_ADDRESS
MAC address of the APC to be added to the APC list
(system mac address output parameter value of the ‘show
system info’ command in the APC)
[Adding APC to cluster]
After adding APC to the APC list, the APC must be added to a cluster.
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Add the APC to a cluster.
cluster add-apc [INDEX] [APC_NAME] [IPV4_ADDRESS] [DB_REFRESH_
INTERVAL]
Parameter
Description
INDEX
Index in cluster (range: 1-12)
APC_NAME
APC name (maximum 18 characters)
IPV4_ADDRESS
IPv4 address
DB_REFRESH_INTERVAL
Database update interval (Unit: s, range: 60-5000, default: 120)
© SAMSUNG Electronics Co., Ltd.
page 312 of 628
CHAPTER 7. WLAN Additional Services
[Deleting APC from cluster]
Delete the APC added in cluster. To delete an APC from a cluster, you must delete the APC
from the cluster configuration of all the APCs in the cluster.
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Delete an APC from the cluster. To delete all the APC systems in a cluster, enter the
‘cluster del-apc-all’ command.
cluster del-apc [INDEX]
cluster del-apc-all
Parameter
Description
INDEX
Index in cluster (range: 1-12)
[Retrieving APC information added in cluster]
You can check the added APC information using the ‘show cluster list-apc’ command.
WEC8500# show cluster list-apc
======================================================================
INDEX APC-NAME
IPv4-ADDRESS
DB-REF-INT CONNECT-STATUS
======================================================================
APC-1
192.168.87.146 120
CONNECTED[1]
APC-2
192.168.87.217 120
CONNECTED[1]
======================================================================
© SAMSUNG Electronics Co., Ltd.
page 313 of 628
CHAPTER 7. WLAN Additional Services
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
The Clustering window is shown below.
Figure 146. Clustering window
Configure a clustering configuration value in the item and then click the
button to apply. The Clustering Members item shows all the clustering members.
Click the or button to add or delete a clustering member.
The clustering addition window is shown below.
Figure 147. Clustering addition window
© SAMSUNG Electronics Co., Ltd.
page 314 of 628
CHAPTER 7. WLAN Additional Services
7.10 Limiting the Number of Connected Users
The W-EP wireless LAN system limits the number of wireless terminals connected to each AP.
The limitation is per radio (2.4/5 GHz bandwidth) or WLAN for each AP.
7.10.1 Limiting Connections per Radio
Configuration using CLI
1)
Go to configure mode of CLI.
APC# configure terminal
APC/configure#
2)
Configure connection limitation.
[RADIO] max-associated-stations [MAX_STATION] global: Configures connection
limitation per wireless bandwidth. When you enter the ‘global’ parameter at the end,
connection limitation is applied to all the APs.
[RADIO] max-associated-stations [MAX_STATION] [TARGET] [AP_ID]:
Configures connection limitation to a specific AP.
Parameter
RADIO
Description
Wireless area to configure
[80211bg/80211a]
- 80211bg: 2.4 GHz area
- 80211a: 5 GHz area
MAX-STATION
Maximum number of wireless terminals that can be connected
(default: 127)
TARGET
Configuration range
- AP: Index of an AP to configure
- Global: All APs connected to an APC
AP_ID
AP ID (range: 1-500)
3) To check the configuration information, use the ‘show 80211bg radio-config global’
command.
© SAMSUNG Electronics Co., Ltd.
page 315 of 628
CHAPTER 7. WLAN Additional Services
Configuration using Web UI
In the menu bar of , select and then select the
<802.11a/n> or <802.11b/g/n> menu in the sub-menus.
Figure 148. Configuring connection limitation per radio
After configuring MAX CLIENT COUNTS, click the button.
7.10.2 Connection Limitation per WLAN
Configuration using CLI
To configure connection limitation per WLAN, execute the command as follows:
1)
Go to configure wlan configuration mode of CLI.
APC# configure terminal
APC/configure# wlan 1
APC/configure/wlan 1#
2)
Disable the WLAN.
APC/configure/wlan 1# no enable
3)
Configure connection limitation.
max-associated-stations [MAX-STATION]
Parameter
Description
MAX-STATION
Maximum number of wireless terminals that can be connected (default: 127)
© SAMSUNG Electronics Co., Ltd.
page 316 of 628
CHAPTER 7. WLAN Additional Services
4)
Enable the WLAN.
APC/configure/wlan 1# enable
5) To check the configured connection limitation, use the ‘show wlan detail’ command.
Configuration using Web UI
In the menu bar of , select and then select the
<802.11a/n> or <802.11b/g/n> menu in the sub-menus.
Figure 149. Configuring connection limitation per WLAN
After configuring MAXIMUM CONNECTIONS, click the button.
© SAMSUNG Electronics Co., Ltd.
page 317 of 628
CHAPTER 7. WLAN Additional Services
7.11 Voice Statistics and Communication Failure
Detection
Because APC provides voice statistics and the WLAN-based communication failure
detection function, you can easily know communication failure reason.
7.11.1 Voice Statistics Function
It provides the number of successful voice communication and call time.
When the CAC function is enabled, the CAC statistics is also provided.
Configuration using CLI
Use the following command to check voice statistics.
APC# show 80211bg voip-stats ap 2
VoIP Stats
Cumulative Number of Calls ................
Cumulative Time of Calls ..................
Number of Active Calls ....................
CAC Stats
Calls In Progress .........................
Handover Calls In Progress ................
Calls Since AP Joined .....................
Handover Calls Since AP Joined ............
Calls Rejected Since AP Joined ............
Handover Calls Rejected Since AP Joined ...
Calls On Invite ...........................
Preferred Calls Received ..................
Preferred Calls Accepted ..................
© SAMSUNG Electronics Co., Ltd.
0:0:23
page 318 of 628
CHAPTER 7. WLAN Additional Services
Configuration using Web UI
In the menu bar of , select and then select the <802.11a/n> or <802.11b/g/n> AP menu in the sub-menus.
Figure 150. Voice statistics
© SAMSUNG Electronics Co., Ltd.
page 319 of 628
CHAPTER 7. WLAN Additional Services
7.11.2 Detecting WLAN-based Communication Failure
You can configure whether to detect WLAN-based communication failure.
Configuration using CLI
1)
Go to configure mode of CLI.
APC# configure terminal
APC/configure#
2)
Enable or disable communication failure detection.
[no] call-fail-detect [WLAN_ID]
Parameter
Description
WLAN_ID
WLAN ID (range: 1-240)
3) To check the configured connection limitation information, use the ‘show voip config
[WLAN_ID]’ command.
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. Select a WLAN ID to change in the WLANs screen
and go to the tab.
Figure 151. Detecting WLAN-based communication failure
After configuring the VOIP FAILURE DETECT item, click the button.
© SAMSUNG Electronics Co., Ltd.
page 320 of 628
CHAPTER 7. WLAN Additional Services
7.12 Voice Signal and Media Monitoring
For voice call fault analysis, the APC provides VoIP wireless terminal, call information,
event and RTP media voice quality statistics.
7.12.1 Checking Voice Related Wireless Information
Configuration using CLI
Execute the following command to check voice related fault analysis statistics.
1)
Check the connection status of a voice wireless terminal.
WEC8500# show voice station summary
MAC Address
IP Address
Tel-no
AP
Proto Server IP
Reg
Call
----------------- -------------- --------- -------- ------------- ----------- ---------50:01:BB:FD:96:E1 10.10.10.5
9922
SIP(UDP) 90.90.1.100 Registered Established
78:47:1D:C2:18:11 10.10.10.10
9907
SIP(UDP) 90.90.1.100 Registered Not calling
WEC8500#
2)
BSS
WLAN
----------------- ---F4:D9:FB:24:C8:C2 1
F4:D9:FB:24:C8:D1 1
Check the connection status of an active call.
WEC8500# show voice active-call summary
MAC Address
IP Address
Tel-No
AP
BSS
WLAN
Caller
Callee
Dir Status
Dur(sec) Start Time
MOS
----------------- -------------- ---------- --- ---------------- ------------- ----------- --- -------- ------ -------- --C8:19:F7:70:89:04 10.10.10.65
9961
F4:D9:FB:24:C8:C2 1
9907
9961
In Established 48
05-12 21:16:13 3.95
50:01:BB:FD:96:E1 10.10.10.5
9922
F4:D9:FB:24:C8:C2 1
9922
9950
Out Established 336
05-12 21:11:25 3.95
78:47:1D:C2:18:11 10.10.10.10
9907
F4:D9:FB:24:C8:D1 1
9907
9961
Out Established 48
05-12 21:16:13 3.77
----------------- -------------- ---------- --- ----------------- ------------- ----------- --- -------- ------ -------- ---#
© SAMSUNG Electronics Co., Ltd.
page 321 of 628
CHAPTER 7. WLAN Additional Services
3)
Check the information of a completed call.
WEC8500# show voice complete-call summary
CONN
Start Time
Dur
AP
SSID
MAC Address
Tel-no IPv4 Address Port Rat
MOS LQ/CQ/PQ
Pkt Cnt
==== ==================== ==== ==== =============== === ==============
========== =============== ===== ==== ============== ===============
0 2013/05/11-17:24:23
26
uready Caller D4:88:90:1B:3C:E2
10.10.10.194
23143 GOOD 4.01/3.95/3.84
225,664
Callee 3C:8B:FE:2E:6F:6A
10.10.10.193
10617 POOR 2.31/2.17/2.90
221,708
------------------------------------------------------------------------------------------------------------------------------------------1 2013/05/11-17:25:16
10
uready Caller 3C:8B:FE:2E:6F:6A
10.10.10.193
10617 FAIR 3.57/3.11/3.63
90,300
Callee D4:88:90:1B:3C:E2
10.10.10.194
23143 GOOD 4.06/3.91/3.94
85,140
------------------------------------------------------------------------------------------------------------------------------------------2 2013/05/11-19:02:10
28
uready Caller D4:88:90:1B:3C:E2
10.10.10.194
23143 POOR 3.21/2.92/3.44
244,756
Callee 3C:8B:FE:2E:6F:6A
10.10.10.193
10617 POOR 1.97/1.66/2.68
240,800
-------------------------------------------------------------------------------------------------------------------------------------------
4)
Check the voice signal related log.
WEC8500/configure# show voice sipmsg-log
Time
MAC Address
Msg Type
Dir
SRC IP
DST IP
AP
BSS
WLAN Contents
--------------------- ---------------- ------------- --------------- ----------- ---- ---------------- ----- -------------------2013-05-12 21:26:45
c8:19:f7:70:89:04 INVITE
SEND
10.10.10.65 90.90.1.100
f4:d9:fb:24:c8:c2 1
F:9922, T:995
0, RTP:10.10.10.65:21120
2013-05-12 21:26:44
c8:19:f7:70:89:04 200(REGISTER) RECV
90.90.1.100 10.10.10.65
f4:d9:fb:24:c8:c2 1
F:9961, T:996
1, Expire:600
2013-05-12 21:26:44
c8:19:f7:70:89:04
REGISTER
SEND
10.10.10.65 90.90.1.100
f4:d9:fb:24:c8:c2 1
F:9961, T:996
1, Expire:600
2013-05-12 21:26:44
c8:19:f7:70:89:04
401(REGISTER)
RECV
90.90.1.100 10.10.10.65
f4:d9:fb:24:c8:c2 1
F:9961, T:996
1, Expire:0
2013-05-12 21:26:44
c8:19:f7:70:89:04
REGISTER
SEND
10.10.10.65 90.90.1.100
f4:d9:fb:24:c8:c2 1
F:9961, T:996
1, Expire:
© SAMSUNG Electronics Co., Ltd.
page 322 of 628
CHAPTER 7. WLAN Additional Services
5)
Check a WLAN event related to a voice.
WEC8500# show voice event
Event Type
MAC Address
AP
BSS
WLAN
Time
Contents
------------------- ---------------- ---- ----------------- ---------------------- ---------------------------Deassoc During Call 78:47:1D:C2:18:11 3
F4:D9:FB:24:C8:D1 1
2013-05-12 21:22:04 wlan disconncted in AP(3) BSSID(f4:d9:fb:24:c8:d1)
during call caller(9907)
callee(9950) duration(5)sec
CallStop
C8:19:F7:70:89:04 3
F4:D9:FB:24:C8:C2 1
2013-05-12 21:22:04 caller(9922) callee(9950) duration(62)sec
CallConnect
78:47:1D:C2:18:11 3
F4:D9:FB:24:C8:D1 1
2013-05-12 21:22:01 caller(9907) callee(9950)
CallSetup
78:47:1D:C2:18:11 3
F4:D9:FB:24:C8:D1 1
2013-05-12 21:21:59 caller(9907) callee(9950)
CallStop
78:47:1D:C2:18:11 3
F4:D9:FB:24:C8:D1 1
2013-05-12 21:21:47 caller(9907) callee(9950) duration(6)sec
CallConnect
78:47:1D:C2:18:11 3
F4:D9:FB:24:C8:D1 1
2013-05-12 21:21:47 caller(9907) callee(9950)
6)
Check the voice related statistics.
WEC8500# show voice statistics radio
RADIO (5G) Voice Statistis
------ ------ ------- -----Type
Total Success Failed
Calls Call
Call
------ ------ ------- -----Total
5 Min
15 Min
1 Hour
1 Day
----- --- ------ ------ --Active
UpstreamTime
Call MOS Jitter Delay MOS
----- --- ------ ------ --2 0.0
0 0.0
0 0.0
0 0.0
0 0.0
0 0.0
0 0.0
0 0.0
2 0.0
0 0.0
------ -----Downstream
Jitter Delay
------ -----0
RADIO (2.4G) Voice Statistis
------ ------ ------- ------ ----- --- ------ ------ --Type
Total Success Failed Active
UpstreamTime
Calls Call
Call
Call MOS Jitter Delay MOS
------ ------ ------ ------ ------ --- ------ ------ --Total
0 0.0
0 0.0
5 Min
0 0.0
0 0.0
15 Min
0 0.0
0 0.0
1 Hour
0 0.0
0 0.0
1 Day
0 0.0
0 0.0
WEC8500# show voice statistics wlan 1
------ -----Downstream
Jitter Delay
------ -----0
© SAMSUNG Electronics Co., Ltd.
page 323 of 628
CHAPTER 7. WLAN Additional Services
WLAN (A_toanyone_1) Voice Statistis
------ ------ ------- ------ ----- --- ------ ------ --- ------ -----Type
Total Success Failed Active
UpstreamTime
Downstream
Calls Call Call
Call MOS Jitter Delay MOS Jitter Delay
------ ------ ----- ------ ------ --- ------ ------ --- ------ -----Total
11
2 0.0
0 0.0
5 Min
0 0.0
0 0.0
15 Min
0 0.0
0 0.0
1 Hour
0 0.0
0 0.0
1 Day
11
2 0.0
0 0.0
WEC8500# show voice statistics device
DEVICE ( Model Name:SHV-E210L, OS Ver:4.1.1 Build Ver:E210LKLJLK1 )
Voice Statistis
---------- ------ ------ ------ ------ --- ------ ------ --- ------ ----Type
Total Success Failed Active
UpstreamTime
Downstream
Calls Call Call
Call MOS Jitter Delay MOS Jitter Delay
------ ------ ----- ------ ------ --- ------ ------ --- ------ -----Total
2 0.0
0 0.0
5 Min
0 0.0
0 0.0
15 Min
0 0.0
0 0.0
1 Hour
0 0.0
0 0.0
1 Day
2 0.0
0 0.0
WEC8500#
Configuration using Web UI
1)
Check the connection status of a voice wireless terminal.
In the menu bar of , select and then select the
menu in the
sub-menus.
Figure 152. VoIP Stations Retrieval Screen
© SAMSUNG Electronics Co., Ltd.
page 324 of 628
CHAPTER 7. WLAN Additional Services
2)
Check the connection status of an active call.
In the menu bar of , select and then select the
menu in the sub-menus.
Figure 153. Active Call Retrieval Screen
3)
Check the information of a completed call.
In the menu bar of , select and then select the
menu in the sub-menus.
Figure 154. Complete Calls Retrieval Screen
© SAMSUNG Electronics Co., Ltd.
page 325 of 628
CHAPTER 7. WLAN Additional Services
7.12.2 Checking Voice Related Quality Information
Configuration using CLI
Execute the following command to check the voice related quality analysis (Voice Quality
Monitoring) information.
1)
Operator can check the voice quality analysis information of a wireless terminal that
has an active call.
WEC8500# show voice vqm current-stats brief
========================================================
[CONN-740 Start Time=2013/7/19.14:47:27, Duration=47 sec(s)
Call-ID[f03c77b50564418855587192e12b889d <-> ca371fce-6e10-401a9a4e-dd53678804c6@ug1.scm.com] Session id :0
SRC [I/F=ge4 Phone-No=9960, IP=20.20.20.30:22458]
DST [I/F=ge4 Phone-No=9910, IP=20.20.20.25:25407]
RTP Flow Quality Metrics:
[Flow-1] DIR=Forward Quality Ratings=Poor [MOS-LQ=3.06, MOSCQ=2.82, MOS-PQ=3.35]
RTP Flow Quality Metrics:
[Flow-2] DIR=Reverse Quality Ratings=Good [MOS-LQ=4.04, MOSCQ=3.95, MOS-PQ=3.89]
WEC8500#
2)
Operator can check the voice quality analysis information of a wireless terminal that
has a completed call.
WEC8500# show voice vqm history-stats brief
========================================================
[CONN-1 Start Time=2013/7/19.14:47:27, Duration=75 sec(s)
Station Mac [78:47:1d:c5:4c:85:fc:a1:3e:47:59:e7:] startBssid
[f4:d9:fb:23:66:10f4:d9:fb:23:66:10] endBssid
[f4:d9:fb:23:66:10f4:d9:fb:23:66:10]
ssid [Ajay_2_2_4GAjay_2_2_4G] Direction [12] wlanId [22]
startApId [22] endApId [22]
Session id :0
SRC [I/F=ge4 Call-ID=f03c77b50564418855587192e12b889d Phone-No=9960,
IP=20.20.20.30:22458]
DST [I/F=ge4 Call-ID=ca371fce-6e10-401a-9a4e-dd53678804c6@ug1.scm.com
Phone-No=9910, IP=20.20.20.25:25407]
RTP Flow Quality Metrics:
[Flow-1] DIR==Forward Quality Ratings=Poor [MOS-LQ=2.21, MOS-CQ=1.33,
MOS-PQ=2.84]
RTP Flow Quality Metrics:
[Flow-2] DIR==Reverse Quality Ratings=Poor [MOS-LQ=2.46, MOS-CQ=1.50,
MOS-PQ=3.00]
========================================================
[CONN-2 Start Time=2013/7/19.14:52:36, Duration=30 sec(s)
Station Mac [fc:a1:3e:47:59:e7:78:47:1d:c5:4c:85:] startBssid
[f4:d9:fb:23:66:10f4:d9:fb:23:66:10] endBssid
[f4:d9:fb:23:66:10f4:d9:fb:23:66:10]
© SAMSUNG Electronics Co., Ltd.
page 326 of 628
CHAPTER 7. WLAN Additional Services
ssid [Ajay_2_2_4GAjay_2_2_4G] Direction [12] wlanId [22]
startApId [22] endApId [22]
Session id :1
SRC [I/F=ge4 Call-ID=035be38a40032eb8edb0b94e944d58d4 Phone-No=9910,
IP=20.20.20.25:25407]
DST [I/F=ge4 Call-ID=917a913e-83ae-497f-ad84-bf0ee80edf36@ug1.scm.com
Phone-No=9960, IP=20.20.20.30:22458]
RTP Flow Quality Metrics:
[Flow-1] DIR==Forward Quality Ratings=Fair [MOS-LQ=3.73, MOS-CQ=3.65,
MOS-PQ=3.72]
RTP Flow Quality Metrics:
[Flow-2] DIR==Reverse Quality Ratings=Poor [MOS-LQ=3.30, MOS-CQ=3.06,
MOS-PQ=3.49]
========================================================
[CONN-3 Start Time=2013/7/19.14:53:12, Duration=24 sec(s)
Station Mac [78:47:1d:c5:4c:85:fc:a1:3e:47:59:e7:] startBssid
[f4:d9:fb:23:66:10f4:d9:fb:23:66:10] endBssid
[f4:d9:fb:23:66:10f4:d9:fb:23:66:10]
ssid [Ajay_2_2_4GAjay_2_2_4G] Direction [12] wlanId [22]
startApId [22] endApId [22]
Session id :2
SRC [I/F=ge4 Call-ID=a47241e5f5d3d6b7f942d0aaeddbd8ef Phone-No=9960,
IP=20.20.20.30:22458]
DST [I/F=ge4 Call-ID=65031276-a4dd-4b1c-a718-4ed3188e44a5@ug1.scm.com
Phone-No=9910, IP=20.20.20.25:25407]
RTP Flow Quality Metrics:
[Flow-1] DIR==Forward Quality Ratings=Poor [MOS-LQ=3.25, MOS-CQ=2.96,
MOS-PQ=3.47]
RTP Flow Quality Metrics:
[Flow-2] DIR==Reverse Quality Ratings=Fair [MOS-LQ=3.65, MOS-CQ=3.57,
MOS-PQ=3.68]
WEC8500#
3)
Operator can check the call statistics information.
WEC8500# show voice vqm summary-stats
========================================================
VQM Summary Stats for last YEAR:0 MONTH:0 DAY:0 0 HR:26 MN:44 SEC
Calls Active
= 0
Calls Terminated = 3
Flows Quality Summary (Total/Good/Fair/Poor) = 6/0/2/4
Listening Call Quality (MOS) min/ave/max = 2.21/3.10/3.73
Conversational Call Quality (MOS) min/ave/max = 1.33/2.68/3.65
P.862 Raw Quality (MOS) min/ave/max = 2.84/3.36/3.72
Listening Call Quality (R-factor) min/ave/max = 45/63/77
Conversational Call Quality (R-factor) min/ave/max = 24/53/75
Packet Delay Variation (msec) ave/max = 13/25
Packet Received/Processed/Lost/Discarded = 12980/12909/93/1154
Packet Duplicate/OutOfseq = 0/135
Packet Error Stats: Ignored/Errors = 71/1
System Error Stats: Resource Unavail/Filter Mismatch/Limit Exceeded =
0/0/0
Voice Quality Alerts: Low R-factor/Excess Loss/Excess Delay/Upload =
1/6/5/0
© SAMSUNG Electronics Co., Ltd.
page 327 of 628
CHAPTER 7. WLAN Additional Services
Upload Count
Upload Ok Count
Upload Fail Count
Requested Count
= 1141
= 0
= 0
= 1141
WEC8500#
4)
Operator can check the alarm information that occurs during call.
WEC8500# show voice vqm alarms brief
========================================================
VQM ActiveRfactor/ActivePktLoss/ActivePktDly/ActiveMos = 1/1/1/1
VQM QualityThresh/LossThresh/DelayThresh/MOSThresh = 50/50/195/35
ALARMS REPORTED :
Src Call Id = f03c77b50564418855587192e12b889d Dst Call Id =
ca371fce-6e10-401a-9a4e-dd53678804c6@ug1.scm.com Session = 0
Direction :Forward Type : [Low-Quality]
[Excessive Burst]
[Excessive delay]
Direction :Reverse Type : [Excessive Burst] [Excessive delay]
ALARMS REPORTED :
Src Call Id = 035be38a40032eb8edb0b94e944d58d4 Dst Call Id =
917a913e-83ae-497f-ad84-bf0ee80edf36@ug1.scm.com Session = 1
Direction :Forward Type : [Excessive Burst]
Direction :Reverse Type : [Excessive Burst] [Excessive delay]
ALARMS REPORTED :
Src Call Id = a47241e5f5d3d6b7f942d0aaeddbd8ef Dst Call Id =
65031276-a4dd-4b1c-a718-4ed3188e44a5@ug1.scm.com Session = 2
Direction :Forward Type : [Excessive Burst]
Direction :Reverse Type : [Excessive Burst]
WEC8500#
© SAMSUNG Electronics Co., Ltd.
page 328 of 628
CHAPTER 7. WLAN Additional Services
7.13 Multicast Stream Admission Control
The multicast stream admission control is provided to protect the currently running
multicast streams from new streams that flow into the wireless LAN. When the maximum
allowed usage of streams or channels per radio is reached, the APC does not allow any
additional streams.
7.13.1 Configuring Admission Control
The multicast stream admission control function configures the maximum number of
streams or the maximum usage of channels to protect the currently running multicast
streams. It denies multicast streaming requests once the maximum number of streams or
the maximum usage of channels is reached. You can set the number of marginal streams or
the usage of channels with consideration for handover.
Configuration using CLI
To set multicast stream admission control, execute the following commands:
1)
Configuration mode of CLI enter the multicast stream admission control mode of
the desired wireless section.
APC# configure terminal
APC/configure# [80211a/80211bg] msac
APC/configure/80211a/msac#
2)
Enable or disable the multicast stream admission control function.
acm [MODE]
Parameter
Mode
Description
Whether or not to use the multicast stream admission control
(enable/disable)
- enable: Enable
- disable: Disable
3)
Configure the maximum allowed number of streams.
max-streams [VALUE]
Parameter
Description
VALUE
Maximum allowed number of streams
© SAMSUNG Electronics Co., Ltd.
page 329 of 628
CHAPTER 7. WLAN Additional Services
4)
Set the maximum allowed usage of channels.
5)
Description
VALUE
Maximum allowed usage of channels
reserved-ho-streams [VALUE]
Parameter
Description
VALUE
Number of marginal streams with consideration for handover
Configure the usage of marginal channels with consideration for handover.
7)
Parameter
Configure the number of marginal streams with consideration for handover.
6)
max-chan-util [VALUE]
reserved-ho-chan-util [VALUE]
Parameter
Description
VALUE
Usage of marginal channels with consideration for handover
You can view the information you configured by using the ‘show[80211a | 80211bg]
msac configuration’ command.
Configuration using Web UI
From the menu bar of , select and then select
<802.11a/n> or <802.11b/g/n> in the submenus.
Figure 155. 802.11a/n Admission Control Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 330 of 628
CHAPTER 7. WLAN Additional Services
After configuring the items below in the Multicast Stream Admission Control, click the
button.
ADMISSION CONTROL: Configure the CAC function
METHOD: Select the method of admission control
MAX STREAMS: Maximum allowed number of streams (range: 1-20)
HANDOVER STREAMS: Number of marginal streams with consideration for
handover (range: 0-6)
The maximum allowed number of streams becomes MAX STREAMS-HANDOVER
STREAMS.
MAX CHANNEL UTILIZATION (%): Maximum allowed usage of channels (range:
5-85)
HANDOVER CHANNEL UTILIZATION (%): Usage of marginal channels with
consideration for handover (range: 0-30)
7.14 Wi-Fi Band Steering
This is a function of leading a UE which supports the Dual Band (2.4/5.0 GHz) to be
connected to 2.4 GHz or 5.0 GHz to secure more stabilized performance if many resources
are used in a specific radio.
7.14.1 Activating Band Steering Function
You can activate the Band Steering function by WLAN and the 5.0 GHz band steering is
set as default upon Band Steering On.
Configuration using CLI
To activate or deactivate the Band Steering function, execute the command as follows:
1)
Configure a specific WLAN which requires the steering band.
APC# configure terminal
APC/configure# wlan 1
APC/configure/wlan 1#
2)
Activate or deactivate the Band Steering function.
band-steering [MODE]
Parameter
Mode
Description
Whether to configure the Band Steering function
- enable: Setting
- disable: Release (by default)
© SAMSUNG Electronics Co., Ltd.
page 331 of 628
CHAPTER 7. WLAN Additional Services
WEC8500/configure/wlan
WLAN (1) band steering
WEC8500/configure/wlan
WLAN (1) band steering
3)
band-steering enable
On (5-GHz preferred)
no band-steering enable
Off
Select a steering band.
band-steering [VALUE]
Parameter
Description
VALUE
1 (5.0 GHz), 2 (2.4 GHz)
WEC8500/configure/wlan
WLAN (1) band steering
WEC8500/configure/wlan
WLAN (1) band steering
4)
1#
is
1#
is
1#
is
1#
is
band-steering 1
On (5-GHz preferred)
band-steering 2
On (2.4-GHz preferred)
Add an entry to the dual band station database.
band-steering add-station [MAC]
Parameter
Description
MAC
Station MAC Address
WEC8500/configure/wlan 1# band-steering add-station 00:00:00:00:00:01
WLAN(1): add station(00:00:00:00:00:01), prefer a band(5-GHz) are set
5)
Delete an entry from the dual band station database.
band-steering delete-station [MAC]
Parameter
Description
MAC
Station MAC Address
WEC8500/configure/wlan 1# band-steering delete-station
00:00:00:00:00:01
Deleted...
6)
Delete all entries from the dual band station database.
band-steering delete-all
WEC8500/configure/wlan 1# band-steering delete-all
WLAN(1): all stations are deleted...
© SAMSUNG Electronics Co., Ltd.
page 332 of 628
CHAPTER 7. WLAN Additional Services
Configuration using Web UI
WLAN > Advanced > BAND STEERING [Disable][2.4 GHz preferred][5 GHz preferred]
Figure 156. Band Steering Function On/Off and Band Setting
© SAMSUNG Electronics Co., Ltd.
page 333 of 628
CHAPTER 7. WLAN Additional Services
7.15 Wi-Fi Load Balancing
The load balancing function in the AP Controller is a function of load balancing by
transferring the message that the connections to wireless stations among APs have been
permitted or cannot be permitted based on the set threshold value and then controlling the
number of stations connected to APs.
7.15.1 Activating Load Balancing Function
The setting can be made based on the WLAN and it is possible to check the load balancing
function among APs for stations attempting at association to APs with the threshold value
and the maximum denial count value based on station count.
Configuration using CLI
For the load balancing function, execute the command as follows:
1)
Configure a specific WLAN which requires load balancing.
APC# configure terminal
APC/configure# wlan 1
APC/configure/wlan 1#
2)
Activate or deactivate the Load Balancing function.
load-balancing [MODE]
Parameter
Mode
Description
Whether to configure the Load Balancing function
- enable: Setting
- disable: Release (by default)
WEC8500/configure/wlan 1# load-balancing enable
WLAN (1), Wi-Fi Load Balancing: Enable
WEC8500/configure/wlan 1# no load-balancing enable
WLAN (1), Wi-Fi Load Balancing: Disable
3)
Configure the load balancing station count threshold value.
load-balancing threshold_station [VALUE]
Parameter
Description
VALUE
1-127 (127 by default)
© SAMSUNG Electronics Co., Ltd.
page 334 of 628
CHAPTER 7. WLAN Additional Services
WEC8500/configure/wlan 1# load-balancing threshold_station 100
Wi-Fi Load Balancing threshold: 100 stations
4)
Configure the maximum denial count value.
load-balancing denial_count [VALUE]
Parameter
Description
VALUE
1-10 (2 by default)
WEC8500/configure/wlan 1# load-balancing denial_count 4
Wi-Fi Load Balancing MAX denial count: 4
Configuration using Web UI
Configure WLAN > Advanced > LOAD BALANCING[Enable] [Disable]
WLAN > Advanced > THRESHOLD[Value]
WLAN > Advanced > MAXIMUM DENIAL COUNT[Value].
Figure 157. Configuring Load Balancing Function
© SAMSUNG Electronics Co., Ltd.
page 335 of 628
CHAPTER 7. WLAN Additional Services
7.16 Station-based Adaptive Load Balancing
Station-based Adaptive Load Balancing performs load balancing based on the number of
stations and RSSI in an individual radio unit of the AP group. Configuring Basic Function
and Setting Load Balancing Parameters of AP Group are available and the settings of the
load balancing parameters in individual APs are available to apply a different value set only
for a specific AP.
7.16.1 Basic Setting of Station-based Adaptive Load Balancing
Station-based Adaptive Load Balancing operates only when it is enabled in the setting of
the basic functions and configures options applied to the overall function operation.
Configuration using CLI
To configure the basic function, execute the commands as follows:
1)
Go to the configure load-balancing configuration mode of CLI.
APC# configure terminal
APC/configure# load-balancing
APC/configure/load-balancing#
2)
Activate the Station-based Adaptive Load Balancing function.
enable
3)
If a function of distributing stations uniformly among APs is necessary, activate the
Active Load Balancing function (Default: no active).
active
4) To activate the Active Load Balancing function, set up the interval for attempting to
distribute uniformly.
interval [NUMBER]
Parameter
Description
NUMBER
Interval for performing active load balancing (sec)
5) To allow load balancing among APs which use the same channel, set the following
option (Default: no allow-channel):
allow-channel
© SAMSUNG Electronics Co., Ltd.
page 336 of 628
CHAPTER 7. WLAN Additional Services
6) To calibrate the RSSI value depending on types of stations, the calibration value must
be set.
calibration mobile [NUMBER]
calibration pc [NUMBER]
calibration others [NUMBER]
Parameter
NUMBER
Description
RSSI calibration value (-dbm)
- Default value: 0 dbm
7) To exclude stations where the traffic occurs from load balancing, the following option
must be set (Default: no idle-station):
idle-station
7.16.2 Setting AP Group Parameter
Station-based Adaptive Load Balancing must set operating parameters to the radio of the
corresponding AP group because it operates in a radio unit of the AP group.
Configuration using CLI
To set AP group parameters, execute the command as follows:
1)
Go to the load-balancing configuration mode in configure AP Group of CLI.
APC# configure terminal
APC/configure# ap-group lb
APC/configure/ap-group lb# load-balancing
APC/configure/ap-group lb/load-balancing#
2)
Go to the radio to perform the Station-based Adaptive Load Balancing function.
APC/configure/ap-group lb/load-balancing# radio 1
APC/configure/ap-group lb/load-balancing/radio 1#
3)
4)
Activate load balancing in the corresponding radio.
enable
Set the interval to attempt at the Load Balancing function.
interval [NUMBER]
Parameter
Description
NUMBER
Interval for performing load balancing (sec)
© SAMSUNG Electronics Co., Ltd.
page 337 of 628
CHAPTER 7. WLAN Additional Services
5)
Set the station threshold to perform the Load Balancing function.
threshold [NUMBER]
Parameter
Description
NUMBER
Station threshold as the standard for the performance of load
balancing
6)
Set the time of blocking the reconnection after the load of the station is now balanced.
kickout-timeout [NUMBER]
Parameter
Description
NUMBER
Reconnection limit time (0~100 sec.)
7) To lead the station which performs load balancing to connect to a specific AP, set the
probe response limit time to other APs.
no-probe-timeout [NUMBER]
Parameter
Description
NUMBER
Probe response limit time (0~100 sec.)
8) The rssi-high value is a criterion for excluding candidates for load balancing to be
selected. The station with the RSSI value higher than the set value does not attempt at
load balancing (In case of the active mode, N/A).
rssi-high [NUMBER]
Parameter
Description
NUMBER
RSSI reference value (-100~0 dbm)
9) The rssi-low value is a criterion for selecting a sticky station. The station with the
RSSI value lower than the set value always attempts at load balancing.
rssi-low [NUMBER]
Parameter
Description
NUMBER
RSSI reference value (-100~0 dbm)
© SAMSUNG Electronics Co., Ltd.
page 338 of 628
CHAPTER 7. WLAN Additional Services
7.16.3 Setting AP Parameters
Station-based Adaptive Load Balancing operates as the default value of the setting of the
AP group but it is possible to set other parameter value to an individual AP. Because it
operates in a radio unit, the parameters to change must be set to the individual radio of the
corresponding AP must be set.
Configuration using CLI
To set AP parameters, execute the command as follows:
1)
Go to the load-balancing configuration mode in configure AP of CLI.
APC# configure terminal
APC/configure# ap ap_1
APC/configure/ap ap_1# load-balancing
APC/configure/ap ap_1/load-balancing#
2)
Go to the radio to perform the Station-based Adaptive Load Balancing function.
APC/configure/ap ap_1/load-balancing# radio 1
APC/configure/ap ap_1/load-balancing/radio 1#
3)
Activate load balancing in the corresponding radio.
enable
4)
Set the station threshold to perform the Load Balancing function.
interval [NUMBER]
5)
Parameter
Description
NUMBER
Interval for performing load balancing (sec)
Set the station threshold to perform the Load Balancing function.
threshold [NUMBER]
Parameter
Description
NUMBER
Station threshold as the standard for the performance of load
balancing
© SAMSUNG Electronics Co., Ltd.
page 339 of 628
CHAPTER 7. WLAN Additional Services
6)
Set the time of blocking the reconnection after the load of the station is now balanced.
kickout-timeout [NUMBER]
Parameter
Description
NUMBER
Reconnection limit time (0~100 sec.)
7) To lead the station which performs load balancing to connect to a specific AP, set the
probe response limit time to other APs.
no-probe-timeout [NUMBER]
Parameter
Description
NUMBER
Probe response limit time (0~100 sec.)
8) The rssi-high value is a criterion for excluding candidates for load balancing to be
selected. The station with the RSSI value higher than the set value does not attempt at
load balancing (In case of the active mode, N/A).
rssi-high [NUMBER]
Parameter
Description
NUMBER
Probe response limit time (0~100 sec.)
9) The rssi-high value is a criterion for excluding candidates for load balancing to be
selected. The station with the RSSI value higher than the set value does not attempt at
load balancing (In case of the active mode, N/A).
rssi-low [NUMBER]
Parameter
Description
NUMBER
RSSI reference value (-100~0 dbm)
© SAMSUNG Electronics Co., Ltd.
page 340 of 628
CHAPTER 8. Security
CHAPTER 8. Security
The W-EP wireless LAN system supports the security function, required in a wire/wireless
network environment, such as RADIUS server interoperation function, system user
management, guest connection service, unauthorized AP/terminal detection and simple
blocking function, firewall, access control (ACL), etc.
In this chapter, how to configure various security functions supported in the system is
described.
8.1
RADIUS Server Configuration
The W-EP wireless LAN system provides the security and authentication function by
interoperating with an external RADIUS server. The WEC8050 also provides the internal
RADIUS server function.
8.1.1
External RADIUS Server
The W-EP wireless LAN system provides the security and authentication function by
interoperating with an external RADIUS server. Follow the below procedure to interoperate
with a RADIUS server.
8.1.1.1
Basic Settings
The basic steps for configuring a RADIUS server are as follows:
Configuration using CLI
1)
Go to configure security radius configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# security
WEC8500/configure/wlan 1/security# radius 1
WEC8500/configure/security/radius 1#
2)
Configure the IP address of a RADIUS server.
WEC8500/configure/security/radius 1# serverIp [IP_ADDRESS]
© SAMSUNG Electronics Co., Ltd.
page 341 of 628
CHAPTER 8. Security
3)
Parameter
Description
IP_ADDRESS
The IP address of a RADIUS server
Configure the key of a RADIUS server.
WEC8500/configure/security/radius 1# secret [KEY_TYPE] [KEY_STRING]
Parameter
KEY_TYPE
Description
RADIUS server key input format
- ASCII: ASCII character string
- HEX: Hexadecimal value
KEY_STRING
4)
RADIUS server key
Enable the accounting function of a RADIUS server and configure the port number.
WEC8500/configure/security/radius 1# acct [PORT_NUMBER]
Parameter
PORT_NUMBER
Description
Accounting port number of a RADIUS server
(range: 1-65535, default: 1813)
5)
Configure the authentication port number of a RADIUS server.
WEC8500/configure/security/radius 1# auth [PORT_NUMBER]
Parameter
PORT_NUMBER
Description
Accounting port number of a RADIUS server
(range: 1-65535, default: 1812)
6)
Configure the items related to retransmissions in RADIUS communications. You can
use default values without changing configuration.
WEC8500/configure/security/radius 1# retransmit-interval
[RETRY_INTERVAL]
WEC8500/configure/security/radius 1# retransmit-count [RETRY_COUNT]
WEC8500/configure/security/radius 1# fo-retransmit-count
[FO_RETRY_COUNT]
© SAMSUNG Electronics Co., Ltd.
page 342 of 628
CHAPTER 8. Security
Parameter
Description
RETRY_INTERVAL
Retransmission interval for a RADIUS message
(unit: seconds, range: 1-60, default value: 2)
RETRY_COUNT
Maximum retransmission count of a RADIUS message
(range: 1-20, default value: 10)
FO_RETRY_COUNT
Maximum retransmission count of a RADIUS message before
a RADIUS server failover is attempted
Must smaller than the RETRY_COUNT value (range: 1-10,
default value: 3)
7)
Exit RADIUS server configuration and security configuration mode.
WEC8500/configure/security/radius 1# exit
WEC8500/configure/security# exit
8) To check the configuration information, use the ‘show security radius-server summary’
command.
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
If you click the button in the RADIUS initial window, you can add a RADIUS
server.
The server addition window is shown below.
Figure 158. RADIUS server configuration
© SAMSUNG Electronics Co., Ltd.
page 343 of 628
CHAPTER 8. Security
Item
Description
INDEX
ID that distinguishes RADIUS server configurations
TYPE
Selects the type of the RADIUS server
- Auth: Performs authentication
- Acct: Performs accounting
- Auth/Acct: Performs authentication and accounting
IP ADDRESS
IP address of the RADIUS server
SHARED SECRET FORMAT
Key input format for communications with the RADIUS server
- ASCII: ASCII strings
- HEX: Hexadecimal values
SHARED SECRET
Key for RADIUS server communications
CONFIRM SHARED SECRET
Re-enters the key for RADIUS server communications for
confirmation
AUTH PORT NUMBER
Number of the communication port for RADIUS server
authentication
(range: 1-65,535, default value: 1,812)
ACCT PORT NUMBER
Number of the communication port for RADIUS server
accounting
(range: 1-65,535, default value: 1,813)
RETRANSMIT INTERVAL
Retransmission interval for a RADIUS message
(range: 1-60, default value: 2, unit: seconds)
TOTAL RETRANSMIT COUNT
Maximum retransmission count of a RADIUS message
(range: 1-20, default value: 10)
RETRANSMIT COUNT
Maximum retransmission count of a RADIUS message before
FAILOVER
a RADIUS server failover is attempted
(range: 1-10, default value: 3, must be smaller than the TOTAL
RETRANSMIT value)
8.1.1.2
Configuring MAC Authentication
The MAC authentication of a RADIUS server is configured as follows:
Configuration using CLI
1)
Go to configure security radius configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# security
WEC8500/configure/wlan 1/security# radius 1
WEC8500/configure/security/radius 1#
© SAMSUNG Electronics Co., Ltd.
page 344 of 628
CHAPTER 8. Security
2)
Set the password type that will be used for the MAC authentication of the device.
WEC8500/configure/security/radius 1# mac-auth-pw-type [PW_TYPE]
Parameter
PW_TYPE
Description
Password type (default value: mac)
- mac: MAC address of the device. Note: it must be a string whose
type must be the same as that of the MAC string which is used as a
user ID when the MAC authentication of the device is performed
- shared-secret: Key shared between the APC and RADIUS server
3)
Set the type of separator of the device’s MAC string which is used as a user ID when
the MAC authentication of the device is performed.
WEC8500/configure/security/radius 1# mac-auth-delimiter
[DELIMITER_TYPE]
Parameter
DELIMITER_TYPE
Description
Type of the MAC string separator (default: none)
- none: no separator (xxxxxxxxxxxx)
- colon: Uses ‘:’ as a separator (xx:xx:xx:xx:xx:xx)
- hyphen: Uses ‘-’ as a separator (xx-xx-xx-xx-xx-xx)
- single-hyphen: Uses only one ‘-’ in the middle (xxxxxx-xxxxxx)
4)
Configure whether to use lowercase characters or uppercase characters for the device’s
MAC string that will be used as an ID upon the MAC authentication of the device.
WEC8500/configure/security/radius 1# mac-auth-case [CASE_TYPE]
Parameter
CASE_TYPE
Description
Case type of the device’s MAC string (default value: lower)
- lower: Uses lowercase
- upper: Uses uppercase
5)
Exit RADIUS server configuration and then security configuration mode.
WEC8500/configure/security/radius 1# exit
WEC8500/configure/security# exit
6)
You can view configuration information by using the ‘show security radius-server
detail ’ command.
© SAMSUNG Electronics Co., Ltd.
page 345 of 628
CHAPTER 8. Security
Configuration using Web UI
In the menu bar of , select and then select
menus in the sub-menus.
After selecting a RADIUS server to configure, configure the MAC authentication item.
Figure 159. RADIUS Server MAC Authentication Configuration Window
Item
PASSWORD TYPE
Description
Password type
- MAC Address: MAC address of the UE. The string in a type
same to the MAC string used as a user ID upon the
authentication of the MAC of the UE
- APC Shared Secret: The shared key between the APC and
the RADIUS server
MAC DELIMITER
MAC string delimiter type
- No Delimiter: No delimiter (xxxxxxxxxxxx)
- Colon: ‘:’ used as delimiter (xx:xx:xx:xx:xx:xx)
- Hyphen: ‘-’ used as delimiter (xx-xx-xx-xx-xx-xx)
- Single Hyphen: Only one ‘-’ used in the middle (xxxxxxxxxxxx)
MAC CASE
English upper case and lower case types of the MAC string
- Lower: Lower case used
- Upper: Upper case used
© SAMSUNG Electronics Co., Ltd.
page 346 of 628
CHAPTER 8. Security
8.1.2
Internal RADIUS Server
The W-EP wireless LAN system provides the security and authentication function by
interoperating with an internal RADIUS server.
To use the internal RADIUS server, operator can add, delete, or edit a user
(WEC8500: maximum 2048 users, WEC8050: maximum 512 users).
Configuration using CLI
To configure a local network user related function, enter into the ‘radiuscm’ of configure
mode by executing the following command.
WEC8050# configure terminal
WEC8050/configure# radiuscm
Operator can execute various commands for Local Net Users.
[Adding User]
To add a user to the Local Net Users, execute the following command.
Add-local-userdb {username} {password} [name] [email] [department] [home_phone]
[work_phone] [mobile_phone]
Parameter
Username
Description
Login ID of a user
- Character varying (1-63)
- MANDATORY
- Korean is not allowed.
- Special characters {, }, (, ), ,, ;, +=, -=,:=, =, !=, >=, >, <=, <, = - , !
- , =*, !*, ==, #, “”, ‘‘, ``, *, ?, \, space, & Cannot be used.
Password
User’s password
- Character varying (1-63)
- MANDATORY
- Korean is not allowed.
- Special characters {, }, (, ), ,, ;, +=, -=,:=, =, !=, >=, >, <=, <, = - , !
- , =*, !*, ==, #, “”, ‘‘, ``, *, ?, \, space, & Cannot be used.
Name
Name
- Character varying (1-63)
- OPTIONAL
- Korean is not allowed.
- Special characters ‘, *, ?, \, ; cannot be used.
email
email address
- Character varying (1-63)
- OPTIONAL
© SAMSUNG Electronics Co., Ltd.
page 347 of 628
CHAPTER 8. Security
Parameter
Description
- Korean is not allowed.
- Special characters ‘, *, ?, \, ; cannot be used.
department
Division information
- Character varying (1-63)
- OPTIONAL
- Korean is not allowed.
- Special characters ‘, *, ?, \, ; cannot be used.
Home_phone
Home phone number
- Character varying (1-63)
- OPTIONAL
- Korean is not allowed.
- Special characters ‘, *, ?, \, ; cannot be used.
Work_phone
Office phone number
- Character varying (1-63)
- OPTIONAL
- Korean is not allowed.
- Special characters ‘, *, ?, \, ; cannot be used.
Mobile_phone
Mobile phone number.
- Character varying (1-63)
- OPTIONAL
- Korean is not allowed.
- Special characters ‘, *, ?, \, ; cannot be used.
[Modifying User]
To modify a user from the Local Net Users, execute the following command.
modify-local-userdb {username} {password} [name] [email] [department]
[home_phone] [work_phone] [mobile_phone]
[Deleting User]
To delete one user from the Local Net Users, execute the following command.
delete-local-userdb {username}
Parameter
Username
Description
User’s ID
- Character varying (1-63)
- MANDATORY
- Korean is not allowed.
- Special characters {, }, (, ), ,, ;, +=, -=,:=, =, !=, >=, >, <=, <, = - , !
- , =*, !*, ==, #, “”, ‘‘, ``, *, ?, \, space, & Cannot be used.
To delete all the users from the Local Net Users, execute the following command.
Remove-all-local-userdb
© SAMSUNG Electronics Co., Ltd.
page 348 of 628
CHAPTER 8. Security
[Importing User]
To import the Local Net Users list file, execute the following command.
Import-local-userdb {filename}
Parameter
Filename
Description
File to import
- CSV file format
- Filename (1-512)
[Exporting User]
To export the Local Net Users list file, execute the following command.
Export-local-userdb {filename}
Parameter
Filename
Description
File to export
- CSV file format
- Filename (1-512)
[Checking User]
To check one local net user, execute the following command.
Show radiuscm username {username}
To check all the local net users, execute the following command.
Show radiuscm all-user
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
© SAMSUNG Electronics Co., Ltd.
page 349 of 628
CHAPTER 8. Security
To add a user, click the button.
1)
Enter an item according to each parameter description, and click the button.
ID: ID of a user to add
PASSWORD: User’s initial password
CONFIRM PASSWORD: Repeat Password
FULL NAME: User’s name (option)
DEPARTMENT: User’s department information (option)
OFFICE PHONE: Office phone number (option)
CELL PHONE: Mobile phone number (option)
HOME PHONE: Home phone number (option)
E-MAIL: email (option)
2)
Importing a local net user list
Operator can import or export the list of local users. The user list is in the CSV format.
An existing data is deleted if there is new importing.
3)
Exporting a local net user list
Operator can export the list of local users in the CSV format file.
© SAMSUNG Electronics Co., Ltd.
page 350 of 628
CHAPTER 8. Security
8.2
Unauthorized AP/Terminal Detection and
Blocking
As the security function, the W-EP wireless LAN device provides the detection service for
an unauthorized AP using the Wireless Intrusion Detection System (WIDS)/WIPS function.
This function detects any AP that is illegally installed without an administrator’s approval
and also any wireless terminals connected to the AP. If an authorized wireless terminal is
connected to an unauthorized AP, some information may be exposed or the wireless LAN
may be attacked in some ways. Therefore, it is important to manage the risk.
8.2.1
Enabling Detection Function
The procedure of enabling the unauthorized AP and terminal detection function is shown
below.
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Enable the detection function.
WEC8500/configure# wi enable
3) To check the configured information, use the following command.
show wi current-config
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
Click Apply after selecting Enable or Disable, then operator can configure the Wireless
Intrusion service status.
Figure 160. Wireless Intrusion General Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 351 of 628
CHAPTER 8. Security
8.2.2
Detection
The W-EP wireless LAN system detects all the packets in a wireless LAN network,
classifies unauthorized APs and wireless terminals, and creates related alarms and logs.
The detected unauthorized APs are classified as follows according to the configured
classification policy.
Classification type
Managed AP
Description
AP that is allowed to be used by an administrator among the detected
unauthorized APs
- Configures the managed AP classification policy.
- An administrator can classify a specific AP as a managed AP among the
manually detected unauthorized APs.
Unmanage AP
AP that is not allowed to be used by an administrator among the detected
unauthorized APs and AP that can be used maliciously
- Configures the unmanaged AP classification policy.
- An administrator can classify a specific AP as a unmanaged AP among
the manually detected unauthorized APs.
8.2.2.1
Configuring the managed AP classification policy
To configure the managed type authorized AP classification policy, execute the command
as follows:
Configuration using CLI
1)
Go to configure wi device configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# device
WEC8500/configure/wi/device#
2)
Configure the managed type authorized AP policy.
add-classification-rule- managed [RULE_NAME] enable [PRIORITY]
[SSID_TYPE] [SSID]
Parameter
Description
RULE_NAME
Classification policy name
PRIORITY
Priority number
SSID_TYPE
SSID type
- managed-ssid: SSID that is used in an authorized AP that is connected to
the APC.
- user-configured-ssid [SSID]: Entered SSID (An AP that has SSID as
SSID_NAME is classified as a friendly type unauthorized AP.)
© SAMSUNG Electronics Co., Ltd.
page 352 of 628
CHAPTER 8. Security
Parameter
SSID_NAME
Description
SSID that is used when the SSID_TYPE is entered as user-configured-ssid
3) To check the configured information, use the ‘show wids device rule managed’
command.
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And
then, select at the upper tab.
1)
By using Add, Delete, or Change, operator can add, delete, or change user defined rules.
Figure 161. Managed Rule Configuration Window
2)
In the rule addition screen, operator can add a rule by entering the information and
click Apply.
Figure 162. Managed Addition Window
© SAMSUNG Electronics Co., Ltd.
page 353 of 628
CHAPTER 8. Security
8.2.2.2
Configuring the unmanaged AP classification policy
To configure the unmanaged type unauthorized AP classification policy, execute the
command as follows:
Configuration using CLI
1)
Go to configure wi device configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# device
WEC8500/configure/wi/device#
2)
Configure the unmanaged type unauthorized AP policy.
add-classification-rule-unmanaged [RULE_NAME] enable [PRIORITY]
[MATCH_TYPE] [MIN_RSSI] [MIN_DURATION] [NO_OF_MIN_ASSOC CL
IENTS] [ENCRYPTION] [SSID_TYPE] [SSID]
Parameter
Description
RULE_NAME
Classification policy name
PRIORITY
Rule priority number
MATCH_TYPE
Enter either match-all or match-any.
- match-all: Classifies as a unmanaged unauthorized AP when the
detection criteria entered thereafter are all satisfied.
- match-any: Classifies as a unmanaged unauthorized AP when any
one of the detection criteria entered thereafter is satisfied.
MIN_RSSI
Minimum RSSI. When the RSSI value is higher than this value, it is
classified as a unmanaged unauthorized AP.
MIN_DURATION
Minimum lasting time (unit: s). When the signal lasting time is higher
than this value, it is classified as a unmanaged unauthorized AP.
NO_OF_MIN_ASSOCCL
IENTS
Minimum number of connected terminals When the number of
connected terminals is higher than this value, it is classified as a
unmanaged unauthorized AP.
ENCRYPTION
Whether to use encryption
- 0: Does not use encryption. If encryption is not used, it is classified
as a unmanaged unauthorized AP.
- 1: Uses encryption. If encryption is used, it is classified as a
malicious unauthorized AP.
SSID TYPE
SSID type
- managed-ssid: SSID that is used in an authorized AP that is
connected to the APC.
- user-configured-ssid [SSID]: Entered SSID (An AP that has SSID as
SSID_NAME is classified as a friendly type unauthorized AP.)
SSID_ NAME
SSID that is used when the SSID_TYPE is entered as userconfigured-ssid
© SAMSUNG Electronics Co., Ltd.
page 354 of 628
CHAPTER 8. Security
3) To check the configured information, use the ‘show wids device rule unmanaged’
command.
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And
then, select at the upper tab.
1)
By using Add, Delete, or Change, operator can add, delete, or change user defined rules.
Figure 163. Unmanaged Rule Configuration Window
2)
In the rule addition screen, operator can add a rule by entering the information and
click Apply.
Figure 164. Unmanaged Rule Addition Window
© SAMSUNG Electronics Co., Ltd.
page 355 of 628
CHAPTER 8. Security
8.2.2.3
Manual configuration (Move)
A user can change the classification of an unauthorized AP that is detected by the WI or
that is classified according to the rule configured by a user.
Configuration using CLI
1)
Go to configure wi device configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# device
WEC8500/configure/wi/device#
By using the MAC of an unauthorized AP to change, execute the move command.
move [MAC] [FROM] [TO]
Parameter
Description
MAC
MAC address of a detected AP
FROM
Previous classification of a MAC
TO
Classification to change
2) To check the changed configuration, use the following command.
show wi device ap list managed
show wi device ap list unmanaged
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And when the AP list is displayed,
select one out of the AP list to go to the detail view screen. In the detail view screen,
operator can manually change the classification of an AP by using the top down menu of
MOVE CLASSIFICATION MANUALLY.
© SAMSUNG Electronics Co., Ltd.
page 356 of 628
CHAPTER 8. Security
1)
In the AP list screen, go to the detail view screen by clicking a MAC address.
Figure 165. List Window to Manually Change Classification
2)
In the AP detail screen, change the classification and click Apply, then the
configuration is changed.
Figure 166. Classification Change Window in AP Detail Screen
© SAMSUNG Electronics Co., Ltd.
page 357 of 628
CHAPTER 8. Security
8.2.2.4
Manual configuration (Remove)
A user can manually change the status of an unauthorized AP to ‘Removed’, that is
detected by the WIDS or that is classified according to the rule configured by a user.
Configuration using CLI
1)
Go to configure wi device configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# device
WEC8500/configure/wi/device#
2)
By using the MAC of an unauthorized AP to change, execute the remove command.
remove [MAC]
Parameter
Description
MAC
MAC address of an unauthorized AP
3) To check the changed configuration, use the following command.
show wi device ap list removed
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And when the AP list is displayed,
check a desired MAC in the list and click the button to manually remove an AP.
In addition, after going into the detail view screen by selecting one out of the AP list,
operator can also remove an AP by changing the REMOVE MANUALLY option to On.
1)
In the AP list screen, operator can change the status of several APs to ‘Removed’ by
clicking button.
Figure 167. List Window to Manually Remove
© SAMSUNG Electronics Co., Ltd.
page 358 of 628
CHAPTER 8. Security
2)
If you change the setting of REMOVE MANUALLY to ‘On’ in the AP detail screen
and click Apply, the AP status is changed to ‘Removed’.
Figure 168. Manual Remove Change Window in AP Detail Screen
8.2.2.5
Unauthorized AP detection option
Operator can enable or disable the AP detection option pre-defined in the system.
Configuration using CLI
1)
Go to configure wi device ap configuration mode.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# device
WEC8500/configure/wi/device# ap
WEC8500/configure/wi/device/ap#
2)
Using the following command, configure the unauthorized AP detection option.
[OPTION] [NOTI_TYPE]
Parameter
Description
OPTION
Unauthorized AP detection option
NOTI_TYPE
Event save option
- notify: Notify the state with alarm
- detect: Save the state with sys log
© SAMSUNG Electronics Co., Ltd.
page 359 of 628
CHAPTER 8. Security
The description of OPTION parameter is as follows:
Parameter
Description
ap-blacklist-check
Allocates Rogue ID = 101 by checking a rogue included in the
black list.
managed_ssid_invalid_security
Allocates Rogue ID = 102 for an AP that uses a managed
SSID and its managed client is in the association status.
fakeap-beacon-on-invalid-channel
Allocates rogue ID = 103 for an AP whose UIC is invalid and
that uses a SSID that is not in the ssid white list among the
APs that use a managed MAC.
fakeap-beacon-without-ssid
Allocates Rogue ID = 104 for an AP whose UIC is invalid and
its SSID is hidden among the APs that use a managed MAC.
fakeap-managed-ssid
Allocates Rogue ID = 105 for an AP whose UIC is invalid and
its channel is not in the channel validation list among the APs
that use a managed MAC.
illegal-channel
Allocates Rogue ID = 106 if an AP uses a channel that is not
in the channel validation list among detected APs.
managedap-invalid-ssid
Allocates Rogue ID = 107 for an AP that uses a SSID that is
not in the ssid-whitelist among the APs that use a managed
MAC and its UIC is valid.
unknownap-managed-ssidwithauth-client
Allocates Rogue ID = 108 by checking the association status
between an unauthorized AP and a managed client.
3) To check the changed configuration, use the following command.
show wi device ap current-config
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And then,
operator can change the setting by selecting at the upper tab and clicking Apply.
In the configuration screen, operator can check Option and click Apply for configuration.
Figure 169. Configuration Window for Unauthorized AP Detection Option
© SAMSUNG Electronics Co., Ltd.
page 360 of 628
CHAPTER 8. Security
8.2.2.6
Unauthorized client detection option
Operator can enable or disable the client detection option pre-defined in the system.
Configuration using CLI
1)
Go to configure wi device client configuration mode.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# rogue
WEC8500/configure/wi/device# client
WEC8500/configure/wi/device /client#
2)
Configure the unauthorized client detection option by using the following command.
[OPTION] [NOTI_TYPE]
Parameter
Description
OPTION
Rogue Client detect option
NOTI_TYPE
Event save option
- notify: Notify the state with alarm
- detect: Save the state with sys log
The description of OPTION parameter is as follows:
Parameter
Description
assoc-fail-det
Classifies a client that exceeds the association fail threshold
as an unauthorized client.
auth-fail-det
Classifies a client that exceeds the authentication fail
threshold as an unauthorized client.
auth-request-det
Classifies a client that exceeds the authentication request
threshold as an unauthorized client.
deauth-request-det
Classifies a client that exceeds the de-authentication request
threshold as an unauthorized client.
exclusion-list-check
Classifies a MAC that does not exist in the client blacklist as
an unauthorized client.
oneXauth-fail-det
Classifies a client that exceeds the 802.1X authentication fail
threshold as an unauthorized client.
oui-list-check
Classifies an OUI that does not exist in the OUI list white list
as an unauthorized client.
probe-request-det
Classifies a client that exceeds the probe request threshold
as an unauthorized client.
webauth-fail-det
Classifies a client that exceeds the WEB authentication fail
threshold as an unauthorized client.
© SAMSUNG Electronics Co., Ltd.
page 361 of 628
CHAPTER 8. Security
3) To check the changed configuration, use the following command.
show wi device client current-config
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And then,
operator can change the setting by selecting at the upper tab and clicking Apply.
In the configuration screen, operator can check Option and click Apply for configuration.
Figure 170. Configuration Window for Unauthorized Station Detection Option
8.2.2.7
Unauthorized Channel Validation Configuration
The unauthorized channel validation function helps an operator detect an AP that uses an
unauthorized channel other than configured channels. The configuration procedure is as
follows:
Configuration using CLI
1)
Go to configure wi channel-validation configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# channel-validation
2)
Enable the unauthorized channel validation function.
WEC8500/configure/wi/channel-validation# enable
3)
Configure an authorized channel.
add [CHANNEL]
© SAMSUNG Electronics Co., Ltd.
page 362 of 628
CHAPTER 8. Security
Parameter
Description
CHANNEL
Authorized channel number (e.g. add 2, 3, 4)
4) To check the changed configuration, execute the following command.
show wi current-config
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And then,
operator can configure the SERVICE STATE and Valid Channel List in the screen.
Operator can change configuration after changing the SERVICE STATE and Valid Channel
List and clicking Apply.
Figure 171. Configuration Window for Channel Validation
8.2.2.8
Configuring and Searching Black/White List
Operator can configure classification to distinguish authorized and unauthorized
APs/stations. The administrator configurable lists include . The are automatically configured and can be used only for search.
Configuration using CLI
1)
Go to the configure wids configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wi
© SAMSUNG Electronics Co., Ltd.
page 363 of 628
CHAPTER 8. Security
2)
3)
4)
5)
Configure the AP black-list.
ap-blacklist [MAC]
Parameter
Description
MAC
MAC address that will be used as AP black-list
Configure the station black-list.
client-black-list [MAC]
Parameter
Description
MAC
MAC address that will be used as a black-list of the station
Configure the Managed Organizationally Unique Identifier (OUI).
oui-whitelist [OUI]
Parameter
Description
OUI
First 3 bytes of station MAC address
Configure the Managed/Neighbor AP.
Managed [MAC] [TYPE]
Parameter
Description
MAC
AP MAC address of Managed/Neighbor AP
TYPE
- Managed: Indicates that the address is located internally
during configuration
- Neighbor: Indicates that the address is located externally
during configuration
6) To check the changed configuration, execute the following command.
show wi lists managed-ap
show wi lists ap-blacklist
show wi lists managed-stat
show wi lists client-blacklist
show wi lists managed ssid
show wi lists oui-list
show wi lists neighbor-ap
© SAMSUNG Electronics Co., Ltd.
page 364 of 628
CHAPTER 8. Security
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And then, operator can
configure and search by using the upper tab in the screen.
1)
In the [AP Blacklist] tab, operator can add an AP blacklist by entering a MAC and
click Add. Operator can also delete it by using Delete.
Figure 172. AP blacklist Configuration Window
2)
In the [Managed AP] tab, operator can search for a Managed AP.
Figure 173. Managed AP Window
© SAMSUNG Electronics Co., Ltd.
page 365 of 628
CHAPTER 8. Security
3)
In the [Station Blacklist] tab, operator can add a station blacklist by entering a MAC
and click Add. Operator can also delete it by using Delete.
Figure 174. Station blacklist Search/Configuration Window
4)
In the [Managed Station] tab, operator can search Managed Station.
Figure 175. Managed Station Search Window
© SAMSUNG Electronics Co., Ltd.
page 366 of 628
CHAPTER 8. Security
5)
In the [Managed OUI] tab, operator can add a Managed OUI by entering an OUI and
click Add. Operator can also delete it by using Delete.
6)
In the [Managed SSID] tab, you can check the SSID that the WLAN is using.
Figure 176. Managed SSID Window
© SAMSUNG Electronics Co., Ltd.
page 367 of 628
CHAPTER 8. Security
7)
If you click Add in the [Managed/Neighbor AP] tab, operator can go to the Managed/
Neighbor AP list addition screen and can add a Managed/Neighbor AP list.
Operator can also delete it by using Delete.
[Managed/Neighbor AP] tab main screen
Figure 177. Managed/Neighbor AP Search/Configuration Window
Managed/Neighbor AP list addition screen
Figure 178. Managed/Neighbor AP List Addition Window
8.2.2.9
Station Allow Limit
The WIDS counts the number of frames and number of authentication failures to
distinguish a station that generates too many management frames in a network or that is
continuously failed for authentication. A threshold value is defined for the count and a
station is recognized as an unauthorized station if the count exceeds the threshold.
Configuration using CLI
1)
Go to the configure wi device client configuration mode.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# device
WEC8500/configure/wi/device# client
WEC8500/configure/wi/device/client#
© SAMSUNG Electronics Co., Ltd.
page 368 of 628
CHAPTER 8. Security
2)
Configure a threshold.
allowed-limit [OPTION] [COUNT]
Parameter
OPTION
Description
- 80211-auth-req: Authentication requests threshold per second
- 80211-probe-req: Probe requests threshold per second
- 80211-deauth-req: De-authentication requests threshold per second
- 80211-assoc-fail: Association failures threshold per second
- 80211-auth-fail: Authentication failures threshold per second
- 8021x-auth-fail: 802.1x authentication failures threshold per WIDS interval
- web-auth-fail: Web authentication failures threshold that occurs continuously
COUNT
Threshold value of [OPTION] ranging from 3 to 20
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And then, enter
a threshold value and click Apply to configure the value in the screen.
Figure 179. Station Allowed Limit Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 369 of 628
CHAPTER 8. Security
8.2.3
Enabling Blocking Function
The setting of enabling the blocking function is as follows:
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Enable the blocking function.
WEC8500/configure# wids containment enable
3) To check the configuration information, execute the following command.
show wids containment current-config
Configuration using Web UI
In the menu bar of , select and then select
menus in the sub-menus.
Select Enable and Disable and press Apply to activate and deactivate the wireless intrusion
blocking policy.
Figure 180. Wireless Intrusion Containment General Configuration Window
8.2.4
Blocking
The W-EP WLAN system performs blocking to the detected AP and the wireless device.
The method for blocking is classified as follows:
Blocking Method
Description
Manual blocking
The administrator performs blocking manually to APs or UEs.
Automatic blocking
APs or UEs are automatically blocked by the policy defined by the
administrator.
© SAMSUNG Electronics Co., Ltd.
page 370 of 628
CHAPTER 8. Security
8.2.4.1
Configuring Manual Blocking
To configure manual blocking, execute the command as follows:
Configuration using CLI
1)
Go to configure wids containment configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wids
WEC8500/configure/wids# containment
WEC8500/configure/wids/containment#
2)
Configure manual blocking.
manual[TARGET] enable[MAC]
Parameter
Description
TARGET
Select either AP or station which is the target for manual blocking.
MAC
MAC address of the target for manual blocking
Configuration using Web UI
In the menu bar of , select and then select menu in the sub-menus.
Select the target and perform containment to perform manual blocking.
1)
After selecting an AP in the AP list, possible to block by using the containment.
Figure 181. List Window for Blocking AP
© SAMSUNG Electronics Co., Ltd.
page 371 of 628
CHAPTER 8. Security
2)
After selecting a station in the station list, possible to block by using the containment.
Figure 182. List Window for Blocking Station
8.2.4.2
Configuring Automatic Blocking
To configure automatic blocking, execute the command as follows:
Configuration using CLI
1)
Go to configure wids containment configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wids
WEC8500/configure/wids# containment
WEC8500/configure/wids/containment#
2)
Configure automatic blocking.
auto[OPTION]
The description of OPTION parameter is as follows:
Parameter
Description
adhoc-connection
If adhoc is detected, it is automatically blocked.
managed-station-associated-with-
If the managed station and the neighbor AP are connected, it
friendly-external
is automatically blocked.
rogue-ap-with-auth-station
If the managed station and the unmanaged AP are
connected, it is automatically blocked.
© SAMSUNG Electronics Co., Ltd.
page 372 of 628
CHAPTER 8. Security
Parameter
Description
rogue-ap-with-managed-ssid
If the honeypot is detected, it is automatically blocked.
unmanaged-ap
If the unmanaged AP is detected, it is automatically blocked.
3) To check the configuration of automatic blocking, it is possible to use the following
command:
show wids containment current-config
Configuration using Web UI
In the menu bar of , select and then select
menus in the sub-menus.
Select the target and press Apply to configure automatic blocking.
Figure 183. Automatic Blocking Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 373 of 628
CHAPTER 8. Security
8.3
Captive Portal
The W-EP WLAN system provides the Captive Portal function. A guest user can receive a
normal service after connected to a specific WLAN (SSID) and going through user
authentication.
8.3.1
Configuring Guest Authentication
Configuration using CLI
To configure guest authentication, go to the Configure mode and execute the command.
1)
Go to configure security captive-portal configuration mode of CLI.
APC# configure terminal
APC/configure# security
APC/configure/security# captive-portal
APC/configure/security/captive-portal#
2) The command to add a guest user is as follows:
guest add [ID][PASSWD][START_TIME][END_TIME]
Parameter
Description
ID
Login ID of a user
PASSWD
Password
START_TIME
Start time (YYYY-MM-DD:HH:MM:SS format)
END_TIME
End time (YYYY-MM-DD:HH:MM:SS format)
3) The command to add a guest user is as follows:
guest delete [ID]
Parameter
Description
ID
User ID
4) To select the authentication method for a guest service, execute the command as follows:
auth-type[FLAG]
Parameter
FLAG
Description
Authentication method
- local-only: Uses internal authentication.
- radius-only: Uses the authentication of the RADIUS server.
- local-radius: Uses the authentication of the RADIUS if the
internal authentication is failed.
© SAMSUNG Electronics Co., Ltd.
page 374 of 628
CHAPTER 8. Security
Parameter
Description
- radius-local: Uses the internal authentication if the RADIUS
server authentication is failed.
5)
For RADIUS authentication, the operator can configure the primary and secondary
servers by using a profile ID.
radius-primary [PROFILE_ID]
radius-secondary [PROFILE_ID]
Parameter
Description
PROFILE_ID
Profile ID
Configuration using Web UI
In the menu bar of , select and then select
menus in the sub-menus.
Figure 184. Guest User Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 375 of 628
CHAPTER 8. Security
The operator can check and delete a guest created in the menu.
Figure 185. Guest User List Window
In the menu, the operator can select Auth Type and also PRIMARY
RADIUS and SECONDARY RADIUS servers.
Figure 186. Guest Auth Configuration Window
8.3.2
Configuring Guest ACL
To operate the captive portal services, redirection must be basically performed and if a drop
occurs by the Pre-Auth ACL of the WLAN, the redirection is performed.
Accordingly, the proper configuration of the ACL for guests is necessary depending on
types of captive portal services.
For the guest ACL, the DNS permit rule, and the permit rule for the web service address
used by the captive portal are basically necessary and the permit rule of the address of the
external web server is additionally necessary if the external web server is used.
Configuration using CLI
To configure the guest ACL, execute the following command:
1)
Go to configure fqm-mode configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# fqm-mode
2)
Configure an access list.
WEC8500/configure/fqm-mode#
WEC8500/configure/fqm-mode# access-list ip guest_acl permit seq 1 udp
any eq * any eq 53 os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit seq 2 tcp
192.168.20.10 255.255.255.255 eq 80 any eq * os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit seq 3 tcp
any eq * 192.168.20.10 255.255.255.255 eq 80 os-aware *
© SAMSUNG Electronics Co., Ltd.
page 376 of 628
CHAPTER 8. Security
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
90.90.100.120 255.255.255.255 eq 80 any eq * os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
any eq * 90.90.100.120 255.255.255.255 eq 80 os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
any eq * any eq * os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
192.168.10.10 255.255.255.255 eq 80 any eq * os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
any eq * 192.168.10.10 255.255.255.255 eq 80 os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
192.168.0.0 255.255.0.0 eq * any eq 443 os-aware *
seq 4 tcp
seq 5 tcp
seq 6 udp
seq 7 tcp
seq 8 tcp
seq 10 tcp
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menu of in the submenus.
Select Add on the screen and then configure the ACL.
Figure 187. Access List Addition Window
Figure 188. Access List Entry Addition Window
© SAMSUNG Electronics Co., Ltd.
page 377 of 628
CHAPTER 8. Security
8.3.3
Configuring Web Authentication
To provide the web authentication service, the security L3 item of the WLAN and the web
authentication of the captive portal must be configured.
Configuration using CLI
[WLAN Configuration]
To configure web authentication in the WLAN, execute the command as follows:
1)
Go to configure WLAN configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wlan 1
2)
Configure a guest flag (default: disabled).
guest-flag
WEC8500/configure/wlan 1# guest-flag
3)
Go to configure WLAN security layer 3 configuration mode of CLI.
WEC8500/configure/wlan 1# security
WEC8500/configure/wlan 1/security# layer3
WEC8500/configure/wlan 1/security/layer3#
4)
Enable the WEB authentication (default: disabled).
web-policy authentication
WEC8500/configure/wlan 1/security/layer3# web-policy authentication
5)
Configure the Pre-Authentication ACL.
pre-auth-acl [ACL]
Parameter
Description
ACL
ACL applied before the guest is authenticated
6) To change the redirection of the basic captive portal configuration to another address,
configure an overriding URL.
redirect-URL-override [URL]
© SAMSUNG Electronics Co., Ltd.
page 378 of 628
CHAPTER 8. Security
Parameter
Description
URL
URL to which the guest is redirected
7) To check the configuration, use the ‘show wlan security detail’ command.
WEC8500# show wlan security detail 1
[Captive Portal Configuration]
1)
Go to configure security captive-portal configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# security
WEC8500/configure/security# captive-portal
WEC8500/configure/security/captive-portal#
2) To configure the web authentication method of web authentication in the captive
portal, execute the command as follows:
web-auth web-type [FLAG]
web-auth external-url [URL]
Parameter
FLAG
Description
Web Authentication Method
- internal: Uses the internal authentication page.
- external: Uses the authentication page of an external web
server.
- downloaded: Uses the authentication page downloaded
from the system.
- customized: Uses the authentication page created through
configuration.
URL
Address of an external authentication server
3) To configure the operation after authentication, execute the command as follows:
web-auth after-auth [FLAG]
web-auth redirect-url [URL]
Parameter
FLAG
Description
Operation after authentication
- redirect: Redirect to a specified URL
- request: Redirect to a requested URL
URL
© SAMSUNG Electronics Co., Ltd.
URL specified as the operation after authentication
page 379 of 628
CHAPTER 8. Security
4) To check the configuration, use the ‘show security captive-portal web-auth’ command.
WEC8500# show security captive-portal web-auth
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. In the WLANs screen, select WLAN ID and enable
the option.
Figure 189. WLAN Guest Configuration Window
Go to the of the tab.
Enable and select the Web Authentication item and then designate the
ACL set in the guest ACL to .
To change a URL, enable and configure .
Figure 190. WLAN Web Policy Configuration Window
In the menu, the operator can select web
authentication method. The operator can also configure Redirect as the operation after
authentication.
Figure 191. Web Auth Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 380 of 628
CHAPTER 8. Security
8.3.4
Configuring Web Authentication on MAC Authentication
Failure
To provide the service of Web Authentication on MAC Authentication Failure, the MAC
Authentication of security L2 of the WLAN must be enabled and the web policy of L3 and
the web authentication of the captive portal must be configured.
Configuration using CLI
[WLAN Configuration]
To configure Web Authentication on MAC Authentication Failure in the WLAN, execute
the command as follows:
1)
Go to configure WLAN configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wlan 1
2)
Configure a guest flag (default: disabled).
guest-flag
WEC8500/configure/wlan 1# guest-flag
3)
Go to configure WLAN security layer 3 configuration mode of CLI.
WEC8500/configure/wlan 1# security
WEC8500/configure/wlan 1/security# layer3
WEC8500/configure/wlan 1/security/layer3#
4)
Enable the WEB authentication (default: disabled).
web-policy authentication
WEC8500/configure/wlan 1/security/layer3# web-policy macAuthFailure
5)
Configure the Pre-Authentication ACL.
pre-auth-acl [ACL]
Parameter
Description
ACL
ACL applied before the guest is authenticated
© SAMSUNG Electronics Co., Ltd.
page 381 of 628
CHAPTER 8. Security
6) To change the redirection of the basic captive portal configuration to another address,
configure an overriding URL.
redirect-URL-override [URL]
Parameter
Description
URL
URL to which the guest is redirected
7) To check the configuration, use the ‘show wlan security detail’ command.
WEC8500# show wlan security detail 1
[Captive Portal Configuration]
1)
Go to configure security captive-portal configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# security
WEC8500/configure/security# captive-portal
WEC8500/configure/security/captive-portal#
2) To configure the web authentication method of web authentication in the captive
portal, execute the command as follows:
web-auth web-type [FLAG]
web-auth external-url [URL]
Parameter
FLAG
Description
Web Authentication Method
- internal: Uses the internal authentication page.
- external: Uses the authentication page of an external web
server.
- downloaded: Uses the authentication page downloaded
from the system.
- customized: Uses the authentication page created through
configuration.
URL
Address of an external authentication server
3) To configure the operation after authentication, execute the command as follows:
web-auth after-auth [FLAG]
web-auth redirect-url [URL]
© SAMSUNG Electronics Co., Ltd.
page 382 of 628
CHAPTER 8. Security
Parameter
Description
FLAG
Operation after authentication
- redirect: Redirect to a specified URL
- request: Redirect to a requested URL
URL
URL specified as the operation after authentication
4) To check the configuration, use the ‘show security captive-portal web-auth’ command.
WEC8500# show security captive-portal web-auth
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. In the WLANs screen, select WLAN ID and enable
the option.
Figure 192. WLAN Guest Configuration Window
Go to the of the tab.
Enable .
Figure 193. WLAN Layer 2 Security Configuration Window
Go to the of the tab.
Enable and select the Web Authentication on MAC Authentication
Failure item and then designate the ACL set in the guest ACL to .
To change a URL, enable and configure .
© SAMSUNG Electronics Co., Ltd.
page 383 of 628
CHAPTER 8. Security
Figure 194. WLAN Web Policy Configuration Window
In the menu, the operator can select web
authentication method. The operator can also configure Redirect as the operation after
authentication.
Figure 195. Web Auth Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 384 of 628
CHAPTER 8. Security
8.3.5
Configuring Web Pass-through
The APC provides the web pass-through function to move to a specific address all the time
when the user uses the web.
Configuration using CLI
[WLAN Configuration]
To configure web pass-through in the WLAN, execute the command as follows:
1)
Go to configure WLAN configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wlan 1
2)
Configure a guest flag (default: disabled).
guest-flag
WEC8500/configure/wlan 1# guest-flag
3)
Go to configure WLAN security layer 3 configuration mode of CLI.
WEC8500/configure/wlan 1# security
WEC8500/configure/wlan 1/security# layer3
WEC8500/configure/wlan 1/security/layer3#
4)
Enable the WEB authentication (default: disabled).
web-policy pass-through
WEC8500/configure/wlan 1/security/layer3# web-policy pass-through
5)
Configure the Pre-Authentication ACL.
pre-auth-acl [ACL]
Parameter
Description
ACL
ACL for occurrence of redirection
6) To change the redirection of the basic captive portal configuration to another address,
configure an overriding URL.
redirect-URL-override [URL]
© SAMSUNG Electronics Co., Ltd.
page 385 of 628
CHAPTER 8. Security
Parameter
Description
URL
URL to which the guest is redirected
7) To check the configuration, use the ‘show wlan security detail’ command.
WEC8500# show wlan security detail 1
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. In the WLANs screen, select WLAN ID and enable
the option.
Figure 196. WLAN Guest Configuration Window
Go to the of the tab.
Enable and select Web PassThrough.
Enable and configure .
Figure 197. Web Pass-through Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 386 of 628
CHAPTER 8. Security
8.3.6
Configuring One Time Redirection
To provide the One Time Redirection service, the security L3 of the WLAN must be
configured.
Configuration using CLI
[WLAN Configuration]
To configure one time redirection in the WLAN, execute the command as follows:
1)
Go to configure WLAN configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wlan 1
2)
Configure a guest flag (default: disabled).
guest-flag
WEC8500/configure/wlan 1# guest-flag
3)
Go to configure WLAN security layer 3 configuration mode of CLI.
WEC8500/configure/wlan 1# security
WEC8500/configure/wlan 1/security# layer3
WEC8500/configure/wlan 1/security/layer3#
4)
Enable the WEB authentication (default: disabled).
web-policy oneTimeRedirection
WEC8500/configure/wlan 1/security/layer3# web-policy
oneTimeRedirection
5)
Configure the Pre-Authentication ACL.
pre-auth-acl [ACL]
Parameter
Description
ACL
ACL to perform redirection
6) To change the redirection of the basic captive portal configuration to another address,
configure an overriding URL.
redirect-URL-override [URL]
© SAMSUNG Electronics Co., Ltd.
page 387 of 628
CHAPTER 8. Security
Parameter
Description
URL
URL to which the guest is redirected
7) To check the configuration, use the ‘show wlan security detail’ command.
WEC8500# show wlan security detail 1
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. In the WLANs screen, select WLAN ID and enable
the option.
Figure 198. WLAN Guest Configuration Window
Go to the of the tab.
Enable and select One Time Redirection.
Enable and configure .
Figure 199. One Time Redirection Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 388 of 628
CHAPTER 8. Security
8.3.7
Redirection Address Format
The Captive Portal attempts at first redirection for the request of the web service of the
station.
The redirection address transmitted by the station in the APC to perform redirection is
formed as follows:
1)
Redirection Address Format
Destination Address + Redirection Option Information
2)
Redirection Address Option
Option
forward
Description
The address of the APC to receive the station information in case of the external
web authentication
redirect
URL to move to after authentication
essid
ESS ID to which the station is connected
bssid
BSS ID to which the station is connected
apname
The name of the AP to which the station is connected
client_ip
IP address of the station
client_mac
MAC Address of the station
osname
OS information of the station, effective when the OS Aware function is configured.
model_name
Model information of the station, effective in case of the FMC station.
os_version
OS version of the station, effective in case of the FMC station.
build_num
OS build number of the station, effective in case of the FMC station.
© SAMSUNG Electronics Co., Ltd.
page 389 of 628
CHAPTER 8. Security
8.4
NAT and Firewall Configuration
The APC provides the NAT and firewall function to provide stable network to a WLAN user.
8.4.1
Firewall Configuration
Configuration using CLI
[Firewall Configuration]
1) Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure the accelerator function of a firewall.
WEC8500/configure# firewall enable
[Firewall Configuration using Access List]
1) Go to configure mode of CLI.
WEC8500# configure terminal
2)
Create an access-list.
WEC8500/configure# access-list fw fw4 deny tcp any any eq 23
3)
Configure a firewall to the interface using an access-list.
WEC8500/configure# interface vlan1.10
WEC8500/configure/interface vlan1.10# ip access-group fw forward fw4
WEC8500/configure/interface vlan1.10# exit
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. You can configure
whether to use a firewall.
Figure 200. Firewall configuration (1)
© SAMSUNG Electronics Co., Ltd.
page 390 of 628
CHAPTER 8. Security
In the menu bar of , select and then select the
menu in the sub-menus.
You can configure an interface for which a firewall will be applied by clicking the
button of Interface window.
Figure 201. Firewall configuration (2)
8.4.2
Access List Configuration
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Create an access-list.
access-list fw [ACL_NAME] [ACTION] [SRC_ADDRESS (SRC_PORT)]
[DST_ADDRESS (DST_PORT)] [PROTOCOL]
Parameter
Description
ACL_NAME
ACL name to configure
ACTION
Action configuration (deny/permit)
SRC_ADDRESS(SRC_PORT)
Source IP address and port
DST_ADDRESS(DST_PORT)
Destination IP address and port
PROTOCOL
Protocol
© SAMSUNG Electronics Co., Ltd.
page 391 of 628
CHAPTER 8. Security
Configuration using Web UI
In the menu bar of , select and then select the
< menu in the sub-menus. Click the button
to configure the firewall Policy.
Figure 202. Access-list configuration
8.4.3
NAT Configuration
Configuration using CLI
[SNAT Configuration using Access List]
To add Source NAT (SNAT) using an access-list, execute the command as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Create an access-list.
WEC8500/configure# access-list fw fw1 deny any 10.10.10.10/32 any
3)
Create a NAT pool.
WEC8500/configure# ip nat pool pool1 30.30.30.1 30.30.30.1
255.255.255.0
4)
Configure a NAT to the interface.
WEC8500/configure# interface vlan1.30
WEC8500/configure/interface vlan1.30# ip nat inside
WEC8500/configure/interface vlan1.30#exit
5)
Add the NAT rule by using access-list and pool.
WEC8500/configure# ip nat outside source list fw1 pool pool1
© SAMSUNG Electronics Co., Ltd.
page 392 of 628
CHAPTER 8. Security
[SNAT Configuration using Static IP]
To add SNAT using a static IP, execute the command as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure a NAT to the interface.
WEC8500/configure# interface vlan1.30
WEC8500/configure/interface vlan1.30#ip nat outside
WEC8500/configure/interface vlan1.30#exit
3)
Configure a NAT rule using a static IP.
WEC8500/configure# ip nat outside source static 10.10.10.10 30.30.30.1
[DNAT Configuration using Access List]
To add Destination NAT (DNAT) using an access-list, execute the command as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Create a NAT pool.
WEC8500/configure# ip nat pool pool2 10.10.10.10 10.10.10.10
255.255.255.0
3)
Configure a NAT to the interface.
WEC8500/configure# interface vlan1.30
WEC8500/configure/interface vlan1.30#ip nat outside
WEC8500/configure/interface vlan1.30#exit
4)
Add the NAT rule by using access-list and pool.
WEC8500/configure# ip nat outside destination list fw6 pool pool2
© SAMSUNG Electronics Co., Ltd.
page 393 of 628
CHAPTER 8. Security
[DNAT Configuration using Static IP]
To add DNAT using a static IP, execute the command as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure a NAT to the interface.
WEC8500/configure# interface vlan1.30
WEC8500/configure/interface vlan1.30#ip nat outside
WEC8500/configure/interface vlan1.30#exit
3)
Configure a NAT rule using a static IP (A port can be also specified for DNAT).
WEC8500/configure# ip nat outside destination static tcp 10.10.10.1
4300 30.30.30.2 23
[Checking NAT Configuration]
To check the created NAT, use the following command.
WEC8500/configure# show nat
Configuration using Web UI
1)
In the menu bar of , select and then select
the menu in the sub-menus. Click the
button and configure the NAT pool.
Figure 203. NAT configuration (1)
© SAMSUNG Electronics Co., Ltd.
page 394 of 628
CHAPTER 8. Security
2)
Click the button in the Translation Rule window and configure the Translation
Rule. Select NAT TYPE as either SNAT or DANT. Select STATIC checkbox to
configure Static and configure the values of Original IP Addr: Port and Translated IP
Addr: Port.
Figure 204. NAT configuration (2)
To proceed with NAT configuration, you must create an access list first.
© SAMSUNG Electronics Co., Ltd.
page 395 of 628
CHAPTER 8. Security
8.5
MAC Filter
The W-EP wireless LAN system provides the MAC filter function. A user may experience
connection restriction due to MAC filtering when connecting to a specific WLAN (SSID).
Configuration using CLI
To configure a MAC list for connection control by the MAC filter, execute the command as
follows:
1)
Go to configure security configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# security
2)
Creates a MAC filter list.
WEC8500/configure/security# mac-filter [ID]
3)
Parameter
Description
ID
MAC filter list table ID (range: 1-20)
Configure the filtering policy.
WEC8500/configure/security/mac-filter 1# policy [POLICY]
4)
Parameter
Description
POLICY
Table policy of MAC filtering list
Configure a MAC entry.
WEC8500/configure/security/mac-filter 1# mac [MAC_ADDRESS]
5)
Parameter
Description
MAC_ADDRESS
MAC address (XX:XX:XX:XX:XX:XX format)
Specify the MAC filter ID that is configured in the WLAN to which a MAC filter will
be applied.
WEC8500/configure/wlan 1/security# mac-filter
© SAMSUNG Electronics Co., Ltd.
page 396 of 628
CHAPTER 8. Security
6)
Parameter
Description
MAC_FILTER_ID
MAC FILTER ID (range: 1-20)
You can check the configured information below.
show security mac-filter summary
WEC8500# show security mac-filter detail
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
You can create a MAC filter table for station access control by clicking the button.
Figure 205. MAC configuration
The procedure for MAC entry configuration is given below.
1)
In the MAC Filter initial window, select an INDEX item to switch to the Edit screen
and then click the button to configure a MAC entry.
Figure 206. MAC entry configuration window(1)
© SAMSUNG Electronics Co., Ltd.
page 397 of 628
CHAPTER 8. Security
2)
Configure the policy in the Edit configuration screen by selecting the index of MAC
filter list.
Figure 207. MAC entry configuration(2)
3)
Select a WLAN for which the MAC filter will be applied. Check a MAC FILTER ID
to apply in the Security > L2 configuration screen.
To apply the configuration, click the button.
Figure 208. MAC entry configuration(3)
© SAMSUNG Electronics Co., Ltd.
page 398 of 628
CHAPTER 8. Security
8.6
Operator Authentication through
Interoperation with TACACS+ Server
A W-EP wireless LAN system provides an operator authentication function by
interoperating with an external TACACS+ server.
8.6.1
Configuring External TACACS+ Server
A W-EP wireless LAN system provides an operator authentication function by
interoperating with an external TACACS+ server and the procedure detailed below is
carried out for interoperation with a TACACS+ server.
8.6.1.1
Basic Settings
The default configuration of the TACACS+ server is as follows:
Configuration using CLI
1)
Go to configure security tacacs configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# security
WEC8500/configure/security# tacacs 1
WEC8500/configure/security/tacacs 1#
2)
Configure the IP address of the TACACS+ server.
WEC8500/configure/security/tacacs 1# server-ip [IP_ADDRESS]
3)
Parameter
Description
IP_ADDRESS
IP address of the TACACS+ server
Set the public key of the TACACS+ server.
WEC8500/configure/security/tacacs 1# shared-secret [KEY_STRING]
4)
Parameter
Description
KEY_STRING
Public key of the TACACS+ server
Configure the port number of the TACACS+ server.
WEC8500/configure/security/tacacs 1# server-port [PORT_NUMBER]
© SAMSUNG Electronics Co., Ltd.
page 399 of 628
CHAPTER 8. Security
Parameter
PORT_NUMBER
Description
Port number of the TACACS+ server
(range: 1-65,535, default value: 49)
5)
Configure the items related to retransmissions in TACACS+ communications.
You can use default values without changing configuration.
WEC8500/configure/security/tacacs 1# retransmit-interval
[RETRY_INTERVAL]
WEC8500/configure/security/tacacs 1# retransmit-count [FO_RETRY_COUNT]
Parameter
RETRY_INTERVAL
Description
Retransmission interval for a TACACS+ message
(unit: seconds, range: 1-5, default value: 3)
FO_RETRY_COUNT
Maximum message retransmission count before a TACACS+
server failover is attempted (range: 0-3, default value: 2)
6)
If necessary, configure the source IP address of the TACACS+ message.
WEC8500/configure/security/tacacs 1# source-ip [IP_ADDRESS]
Parameter
IP_ADDRESS
Description
Source IP address of the TACACS+ message
Note: it must be one of the IP addresses configured in the WEP wireless LAN system.
7)
Configure whether to transfer packets to the TACACS+ server. You can use default
values without changing configuration.
WEC8500/configure/security/tacacs 1# status [STATUS]
Parameter
STATUS
Description
Status indicating whether packets are transferred to the
TACACS+ server (default value: enable)
8)
Exit TACACS+ server configuration and then security configuration mode.
WEC8500/configure/security/tacacs 1# exit
WEC8500/configure/security# exit
© SAMSUNG Electronics Co., Ltd.
page 400 of 628
CHAPTER 8. Security
9)
You can view configuration information by using the ‘show security tacacs server
config’ and ‘show security tacacs server detail [SERVER ID]’ commands.
Configuration using Web UI
In the menu bar of , select , and then select
in the submenus.
If you click the button in the TACACS+ initial window, you can add a TACACS+
server.
The server addition window is shown below.
Figure 209. TTACACS+ Server Configuration Window
Item
Description
INDEX (PRIORITY)
ID that distinguishes TACACS+ server configurations
IP ADDRESS
IP address of the TACACS+ server
SHARED SECRET
Public key of the TACACS+ server
CONFIRM SHARED
Re-enters the key for TACACS+ server communications for
SECRET
confirmation
PORT NUMBER
Communication port number of the TACACS+ server
(range: 1-65,535, default value: 49)
RETRANSMIT
Retransmission interval for a TACACS+ message
INTERVAL
(range: 1-5, default value: 2, unit: seconds)
RETRANSMIT COUNT
Maximum message retransmission count before a TACACS+ server
BEFORE FAILOVER
failover is attempted (range: 0-3, default value: 2)
SOURCE IP ADDRESS
Source IP address of the TACACS+ message
- Note: it must be one of the IP addresses configured in the W-EP
wireless LAN system.
STATUS
Status indicating whether packets are transferred to the TACACS+
server (default value: enable)
© SAMSUNG Electronics Co., Ltd.
page 401 of 628
CHAPTER 8. Security
8.6.2
Configuring Authentication Type of Operator Account
The steps for configuring the authentication type of the operator account are as follows:
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Configure the type of operator account authentication.
WEC8500/configure# mgmt-user auth-type [AUTH_TYPE]
Parameter
AUTH_TYPE
Description
Authentication type of the operator account (default value: local)
- local: Authentication is performed using the database stored inside.
- tacacs: Authentication is performed using the TACACS+ server.
- local-tacacs: Authentication is performed using the database stored
inside first, and, failing that, an authentication request is transmitted to
the TACACS+ server.
- tacacs-local: An authentication request is transmitted to the TACACS+
server first, and, failing that, authentication is performed using the DB
stored inside.
3)
You can view the configuration information by using the ‘show mgmt-users auth-type’
command.
Configuration using Web UI
In the menu bar of , select , and then select
in the submenus.
Figure 210. Operator Account Authentication Type Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 402 of 628
CHAPTER 8. Security
8.7
Role Based Access Control
The W-EP WLAN system can manage the user's access authority depending on a
designated role.
It can designate ACL, limit the bandwidth, designate the interface, or manage redirecting
URL, etc. by user.
8.7.1
Configuring Role Profile
The W-EP WLAN system can designate the configuration of ACL, QoS, VLAN, and URL
and manage as a profile.
To provide a service of a role desired to a specific user or a user group, it can use a role
profile.
8.7.1.1
Configuring Profile
The basic settings of the role profile are as follows:
Configuration using CLI
Example:
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# role-profile role_01
WEC8500/configure/rbac/role-profile role_01# acl acl1
WEC8500/configure/rbac/role-profile role_01# qos 1
WEC8500/configure/rbac/role-profile role_01# vlan 10
WEC8500/configure/rbac/role-profile role_01# url http://www.role1
WEC8500/configure/rbac/role- profile role_01# end
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# no role-profile role_01
WEC8500/configure/rbac# end
CLI for confirming configuration:
WEC8500# show rbac role-profile summary
===== Role Profile Summary =====
Id ProfileName Acl
Qos Vlan Url
== =========== ========== === ==== ====================
1 role_01
acl1
10 http://www.role1
© SAMSUNG Electronics Co., Ltd.
page 403 of 628
CHAPTER 8. Security
Configuration using Web UI
Configuration > Security > Role Based Access Control > Role Profile
Example:
Figure 211. Role Profile Configuration
Figure 212. Role Profile Add Configuration
8.7.2
Configuring Derivation Profile
The W-EP WLAN system can edit conditions to allocate roles and manage by profile.
It can manage a role by user depending on the edited conditions.
8.7.2.1
Configuring Profile
The basic settings of the derivation profile are as follows:
Configuration using CLI
Example:
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# derivation-profile derivation_1
WEC8500/configure/rbac/derivation-profile derivation_1# condition
priority 11 user equal derivationUser role role_1
WEC8500/configure/rbac/derivation-profile derivation_1# condition
priority 12 user start-with derivation role role_2
WEC8500/configure/rbac/derivation-profile derivation_1# condition
priority 13 user contain vation role role_3
© SAMSUNG Electronics Co., Ltd.
page 404 of 628
CHAPTER 8. Security
WEC8500/configure/rbac/derivation-profile derivation_1#
priority 14 user end-with User role role_4
WEC8500/configure/rbac/derivation-profile derivation_1#
priority 15 user not-equal samsung role role_5
WEC8500/configure/rbac/derivation-profile derivation_1#
WEC8500/configure/rbac# derivation-profile derivation_2
WEC8500/configure/rbac/derivation-profile derivation_2#
condition
condition
exit
end
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# no derivation-profile derivation_2
WEC8500/configure/rbac# end
CLI for confirming configuration:
WEC8500# show rbac derivation-profile summary
derivation-profile derivation_1
condition priority 11 user equal derivationUser role role_1
condition priority 12 user start-with derivation role role_2
condition priority 13 user contain vation role role_3
condition priority 14 user end-with User role role_4
condition priority 15 user not-equal samsung role role_5
Configuration using Web UI
Configuration > Security > Role Based Access Control > Derivation Profile
Example:
Figure 213. Derivation Profile Configuration
Figure 214. Derivation Profile Add Configuration
© SAMSUNG Electronics Co., Ltd.
page 405 of 628
CHAPTER 8. Security
Figure 215. Derivation Profile Configuration
Figure 216. Derivation Profile Add Configuration
8.7.2.2
WLAN Configuration
The method for configuring a derivation profile in the WLAN is as follows:
Configuration using CLI
Example:
WEC8500# configure terminal
WEC8500/configure# wlan 1
WEC8500/configure/wlan 1# derivation-profile ieee8021x derivation_1
WEC8500/configure/wlan 1# end
CLI for confirming configuration:
WEC8500# show rbac wlan-derivation-config
================ RbacDerivationConfigForWlan ================
WlanId Owner
DerivationProfileId
====== ================ ===================
Global
Open
Radius
CaptivePotal
© SAMSUNG Electronics Co., Ltd.
page 406 of 628
CHAPTER 8. Security
Configuration using Web UI
Configuration > WLANs > Security > Radius
Example:
Figure 217. Wlan Derivation Profile Configuration
8.7.3
Configuring ACL Profile
The W-EP WLAN system can manage ACL to apply to a user if the AP of the remote group
operates as local bridge.
© SAMSUNG Electronics Co., Ltd.
page 407 of 628
CHAPTER 8. Security
8.7.3.1
Configuring Profile
The basic settings of the ACL profile are as follows:
Configuration using CLI
Example:
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# acl-profile aclPro_1
WEC8500/configure/rbac/acl-profile aclPro_1#
WEC8500/configure/rbac/acl-profile aclPro_1#
WEC8500/configure/rbac/acl-profile aclPro_1#
WEC8500/configure/rbac# acl-profile aclPro_2
WEC8500/configure/rbac/acl-profile aclPro_2#
add-acl acl1
add-acl acl2
exit
end
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# no acl-profile aclPro_2
WEC8500/configure/rbac# end
CLI for confirming configuration:
WEC8500# show rbac acl-profile summary
================ LocalSwAclProfile ================
Id ProfileName TotalRuleCnt AclCnt RmtCnt
== =========== ============ ====== ======
1 aclPro_
Configuration using Web UI
Configuration > Security > Role Based Access Control > Derivation Profile
Example:
Figure 218. Acl Profile Configuration
© SAMSUNG Electronics Co., Ltd.
page 408 of 628
CHAPTER 8. Security
Figure 219. Acl Profile Add Configuration
Figure 220. Acl Profile Edit Configuration
8.7.3.2
Remote Ap Group Configuration
The method for configuring the ACL profile to the remote AP group is as follows:
Configuration using CLI
Example:
WEC8500# configure terminal
WEC8500/configure# ap-group apg_1
WEC8500/configure/ap-group apg_1# remote
WEC8500/configure/ap-group apg_1/remote# acl-profile aclPro_1
WEC8500/configure/ap-group apg_1/remote# end
CLI for confirming configuration:
WEC8500# show rbac remote-group summary
GRP_ID
GRP_NAME
PRO_ID Role Config File Name
======
==================
====== ==========================
apg_1
etc/rmtapgrp/rbac_cfg_rmtapgrp2_XXXX.tar
© SAMSUNG Electronics Co., Ltd.
page 409 of 628
CHAPTER 8. Security
Configuration using Web UI
Configuration > AP Groups > Remote AP Group > ACL Profile
Change the configuration of the ACL PROFILE NAME and then press Apply.
After that, press Send To APs to transmit the ACL profile and the relevant settings to APs.
Example:
Figure 221. Remote Ap Group-Alc Profile Configuration
© SAMSUNG Electronics Co., Ltd.
page 410 of 628
CHAPTER 8. Security
8.7.4
Configuration Synchronization (Remote AP Group)
The W-EP WLAN system provides a function of synchronizing the configuration of the AP
of the remote group and ACL if the AP of the remote group operates as a local bridge.
8.7.4.1
Requesting Synchronization
If the remote AP operates with the local switching mode, the configuration of the ACL
between APC and AP must be synchronized. If AP and CAPWAP run, the configuration of
the ACL is automatically synchronized, but if the operator changes the ACL of the APC,
the synchronization of ACL configuration must be performed as follows:
Configuration using CLI
The synchronization of the AP of the remote group uses the following CLI:
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# sync-config ?
acl-profile
all
ap
remote-ap-group
Sync-config
Sync-config
Sync-config
Sync-config
Acl profile
All
Remote Ap Group
Remote Ap Group
all: Perform synchronization for all APs of the remote group.
remote-ap-group [group-name]: Performs synchronization only for the APs included in
the corresponding remote group.
acl-profile [profile-name]: Performs synchronization only for the APs included in the
remote group which uses the corresponding ACL profile (CLI only).
ap [ap-profile-name]: Performs synchronization only for a specific AP (CLI only).
Synchronization can be confirmed as follows:
WEC8500# show rbac remote-group summary
GRP_ID
GRP_NAME
PRO_ID
Role
Config File Name
======
==================
====== ==========================
rmt_grp_01
etc/rmtapgrp/rbac_cfg_20140305094752849046.tar
© SAMSUNG Electronics Co., Ltd.
page 411 of 628
CHAPTER 8. Security
Configuration using Web UI
Configuration > Security > Role Based Access Control > ACL Profile
‘Send To APs’
Figure 222. ACL Configuration Synchronization - All
Configuration > AP Groups > Remote AP Group > ACL Profile
‘Send To APs’
Figure 223. ACL Configuration Synchronization - Remote Group
© SAMSUNG Electronics Co., Ltd.
page 412 of 628
CHAPTER 8. Security
Configuration > Access Points > Remote AP
‘Send To APs’
Figure 224. ACL Configuration Synchronization - Remote AP
© SAMSUNG Electronics Co., Ltd.
page 413 of 628
CHAPTER 8. Security
8.8
External BYOD Server
The W-EP WLAN system provides a function of interoperating with the external BYOD
server. To use the BYOD function, a separate BYOD server is necessary. Employees and
guest users can receive a service after being connected to a specific WLAN (SSID) and
going through authentication.
(The external BYOD server now supported is only AirCuve BYOD.)
8.8.1
Configuring External BYOD Server
Configuration using CLI
To configure the interoperation with external BYOD, execute the command as follows:
1)
Go to configure security byod of CLI.
WEC8500# configure terminal
WEC8500/configure# security byod
2)
Enter the IP address of the BYOD server.
WEC8500/configure/security/byod# address1 10.10.10.20
To interoperate with AirCuve BYOD Suite, enter Airfront IP in address1 and Byfront
IP in address2.
3)
Enable the function of interoperating with the external BYOD server.
WEC8500/configure/security/byod# enable
4)
Configure a HTTPS request URL.
Upon the interoperation with AirCuve BYOD Suite, the HTTPS request URL is
necessary to update the list of all authentications. The basically set value is used and if
change is required in the future, change as follows:
WEC8500/configure/security/byod# https-requrl
regist.do?cmd=dhcpTableXMLReceiver
5) To check the configured environment, use the ‘show security byod configuration’
command.
© SAMSUNG Electronics Co., Ltd.
page 414 of 628
CHAPTER 8. Security
Configuration using Web UI
In the menu bar of , select and then select
in the sub-menus.
Figure 225. External BYOD Server Configuration Window
1)
2)
3)
4)
5)
6)
Service
Enable the function of interoperating with the external BYOD server.
Server IP Address 1
Enter the IP address of the BYOD server. Enter the Airfront IP upon the interoperation
with AirCuve BYOD Suite.
Server IP Address 2
Enter the Byfront IP upon the interoperation with AirCuve BYOD Suite.
Requested URL
It is necessary to update the list of all authentications upon the interoperation with
AirCuve BYOD Suite. Basically use the set value and enter a new URL if change is
required.
SYNC. Status
Display the result value of updating the list of all authentications.
The status value has one of the following four items:
0: Idle, 1: In progress, 2: Success, 3: Failure
SYNC. Failure Reason
If the update of the list of all authentications fails, display the reason of failure.
Failure reason items
None: No failure.
No response: When there is no response from the BYOD server
Invalid data format: When the BYOD server failed to send the data on the list of all
authentications or in the invalid format
© SAMSUNG Electronics Co., Ltd.
page 415 of 628
CHAPTER 8. Security
8.8.2
Captive Portal Configuration
To use the external BYOD service, the External Web Authentication of the Captive Portal
is necessary to be configured. The Captive Portal service must configure ACL basically and
apply the ACL to L3 security of the WLAN. Below is an example of how to configure the
captive portal to use the BYOD service.
Configuration using CLI
1)
Configuring PreAuthentication ACL
PRE-AUTH ACL must have the basic permit rules for the HTTP port to DNS and web
servers.
WEC8500# configure terminal
WEC8500/configure# fqm-mode
WEC8500/configure/fqm-mode # access-list ip preauth permit seq
any eq * any eq 53 os-aware *
WEC8500/configure/fqm-mode # access-list ip preauth permit seq
192.168.20.10 255.255.255.255 eq 80 any eq * os-aware *
WEC8500/configure/fqm-mode # access-list ip preauth permit seq
any eq * 192.168.20.10 255.255.255.255 eq 80 os-aware *
WEC8500/configure/fqm-mode # access-list ip preauth permit seq
90.90.100.120 255.255.255.255 eq 80 any eq * os-aware *
WEC8500/configure/fqm-mode # access-list ip preauth permit seq
any eq * 90.90.100.120 255.255.255.255 eq 80 os-aware *
WEC8500/configure/fqm-mode # ip access-group wireless preauth
WEC8500/configure/wlan 1/security/layer3# pre-auth-acl preauth
2)
1 udp
2 tcp
3 tcp
4 tcp
5 tcp
Configuring WLAN
To configure WLAN, set a guest flag and designate the configuration of the web
policy of Layer 3 as authentication.
WEC8500# configure terminal
WEC8500/configure# wlan 1
WEC8500/configure/ wlan 1# guest-flag
WEC8500/configure/ wlan 1# security
WEC8500/configure/ wlan 1/security# layer3
configure/wlan 1/security/layer3# web-policy authentication
© SAMSUNG Electronics Co., Ltd.
page 416 of 628
CHAPTER 8. Security
3)
Configuring Web Authentication Type
WEC8500/configure/security/captive-portal # web-auth
WEC8500/configure/security/captive-portal/web-auth#auth-type external
WEC8500/configure/security/captive-portal/web-auth#external-url
http://90.90.100.120/pc/zero_page.jsp
Configuration using Web UI
1)
Configuring PreAuthentication ACL
PRE-AUTH ACL must have the basic permit rules for the HTTP port to DNS and web
servers.
2)
Configuring WLAN
To create WLAN to use for guests, the guest service must be enabled.
To use the Captive Portal function, enable a web policy in Security of WLAN > L3 tab
and select Web Authentication. Designate the pre-set ACL for Captive Portal as PREAUTHENTICATION ACL on the bottom.
© SAMSUNG Electronics Co., Ltd.
page 417 of 628
CHAPTER 8. Security
3)
Configuring Web Authentication Type
To use the External BYOD function, External Web Auth must be configured.
Designate the type as External in Security > Captive Portal > Web Authentication and
designate the external BYOD server as URL.
© SAMSUNG Electronics Co., Ltd.
page 418 of 628
CHAPTER 9. IP Application
CHAPTER 9. IP Application
In this chapter, the IP application functions available in the APC and each configuration
method are described.
9.1
DNS
The DNS is a network service that interprets a domain or host name into an IP address.
The APC gets DNS information from a DNS server and provides the DNS relay function
that relays the DNS server and a client. If a wireless terminal connected to the APC
configures the APC as a DNS server, it can receive the DNS service.
If a DNS server is connected to the APC and a DNS proxy is configured, a station
connected to the APC can receive the DNS service by configuring the APC as a DNS server.
9.1.1
DNS Client Configuration
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure a DNS client.
ip dns client enable: Enable
no ip dns client enable: Disable
3)
Configure a DNS server to which DNS will be requested. You can enter maximum 3
DNS server addresses.
ip dns name-server [A.B.C.D]: Configures a DNS server.
no ip dns name-server [A.B.C.D]: Deletes a configured DNS server.
no ip dns name-server all: Deletes all the DNS servers.
© SAMSUNG Electronics Co., Ltd.
page 419 of 628
CHAPTER 9. IP Application
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
Figure 226. DNS client
You can enable or disable a DNS client using the QUERY of a DNS SERVER item.
In the 1ST DNS SERVER, 2ND DNS SERVER, and 3RD DNS SERVER boxes, you can
configure 3 name servers.
9.1.2
DNS Proxy Configuration
You can configure the DNS relay function or a cache for relay. The cache is a temporary
space where the APC saves the DNS information obtained from a DNS server.
You can configure maximum number of entries as 10000-100000. The DNS relay is related
to the DNS client configuration. If you disable the DNS client function or delete all the
name servers, the DNS relay function is not working.
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure a DNS relay. Configure the cache to a default, i.e. 10000.
ip dns relay enable: Enables a relay.
no ip dns relay enable: Disables a relay.
3) To change cache configuration, enter as follows:
ip dns relay enable cache: Configures a DNS relay and configures the cache to a
default, i.e. 10000.
ip dns relay enable cache 20000: Configures a DNS relay and configures the cache
to 20000.
ip dns relay enable no-cache: Configures a DNS relay and disables the cache
settings.
© SAMSUNG Electronics Co., Ltd.
page 420 of 628
CHAPTER 9. IP Application
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
Figure 227. DNS proxy
The DNS Relay item supports DNS Proxy configuration. In the SERVICE, you can enable
or disable a DNS proxy and configure the cache size of the DNS proxy in the CACHING
SIZE. If the cache size is 0, disable the cache.
© SAMSUNG Electronics Co., Ltd.
page 421 of 628
CHAPTER 9. IP Application
9.2
NTP
The Network Time Protocol (NTP) is a protocol used to receive time from a configured
server and synchronize the local time.
The APC can operate as a NTP server and a client. If you configure the APC as a NTP
client, it receives the Coordinated Universal Time (UTC) information from the configured
NTP server and synchronizes the local time. In addition, if you configure the APC as a NTP
server, it transmits a local time when it receives a NTP request from a NTP client.
Configuration using CLI
[Configuring NTP Client]
The time server that is referred to when the APC is working as a NTP client can be used
based on a domain name and IP address. But, if it is working based on a domain name,
there must be a configured DNS server.
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Enable or disable a NTP client.
ntp client enable: Enable
no ntp client enable: Disable
3)
Configure the interval of a NTP client.
ntp client interval [INTERVAL]: Configures an interval.
no ntp client interval: Disables an interval.
4)
Parameter
Description
INTERVAL
Interval (range: 3-14)
Configure a server that a NTP client will refer to.
[Configuring based on a domain name]
Enables or disables.
ntp client server-addr hostname : Enable
no ntp client server-addr hostname : Disable
Configure the index of a server that a NTP client will refer to. (Use a default value 1 if it is
not configured.)
ntp client server-addr hostname index [INDEX]: Enable
no ntp client server-addr hostname