Download: |  |
Mirror Download [FCC.gov] |  |
Document ID | 2696663 |
Application ID | yN5oEYZBiNmLF+KriQjxxA== |
Document Description | Part 2 |
Short Term Confidential | No |
Permanent Confidential | No |
Supercede | No |
Document Type | User Manual |
Display Format | Adobe Acrobat PDF - pdf |
Filesize | 286.02kB (3575258 bits) |
Date Submitted | 2015-07-29 00:00:00 |
Date Available | 2016-01-25 00:00:00 |
Creation Date | 2015-06-18 23:36:35 |
Producing Software | Microsoft® Office Word 2007 |
Document Lastmod | 2015-06-18 23:38:40 |
Document Title | Model Name Manual Name |
Document Creator | Microsoft® Office Word 2007 |
Document Author: | ë””ìžì¸ëœ° |
CHAPTER 8. Security
8.2.2.3
Manual configuration (Move)
A user can change the classification of an unauthorized AP that is detected by the WI or
that is classified according to the rule configured by a user.
Configuration using CLI
Go to configure wi device configuration mode of CLI.
1)
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# device
WEC8500/configure/wi/device#
By using the MAC of an unauthorized AP to change, execute the move command.
move [MAC] [FROM] [TO]
Parameter
Description
MAC
MAC address of a detected AP
FROM
Previous classification of a MAC
TO
Classification to change
2) To check the changed configuration, use the following command.
show wi device ap list managed
show wi device ap list unmanaged
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And when the AP list is displayed,
select one out of the AP list to go to the detail view screen. In the detail view screen,
operator can manually change the classification of an AP by using the top down menu of
MOVE CLASSIFICATION MANUALLY.
© SAMSUNG Electronics Co., Ltd.
page 356 of 628
CHAPTER 8. Security
1)
In the AP list screen, go to the detail view screen by clicking a MAC address.
Figure 165. List Window to Manually Change Classification
2)
In the AP detail screen, change the classification and click Apply, then the
configuration is changed.
Figure 166. Classification Change Window in AP Detail Screen
© SAMSUNG Electronics Co., Ltd.
page 357 of 628
CHAPTER 8. Security
8.2.2.4
Manual configuration (Remove)
A user can manually change the status of an unauthorized AP to ‘Removed’, that is
detected by the WIDS or that is classified according to the rule configured by a user.
Configuration using CLI
1)
Go to configure wi device configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# device
WEC8500/configure/wi/device#
2)
By using the MAC of an unauthorized AP to change, execute the remove command.
remove [MAC]
Parameter
Description
MAC
MAC address of an unauthorized AP
3) To check the changed configuration, use the following command.
show wi device ap list removed
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And when the AP list is displayed,
check a desired MAC in the list and click the button to manually remove an AP.
In addition, after going into the detail view screen by selecting one out of the AP list,
operator can also remove an AP by changing the REMOVE MANUALLY option to On.
1)
In the AP list screen, operator can change the status of several APs to ‘Removed’ by
clicking button.
Figure 167. List Window to Manually Remove
© SAMSUNG Electronics Co., Ltd.
page 358 of 628
CHAPTER 8. Security
2)
If you change the setting of REMOVE MANUALLY to ‘On’ in the AP detail screen
and click Apply, the AP status is changed to ‘Removed’.
Figure 168. Manual Remove Change Window in AP Detail Screen
8.2.2.5
Unauthorized AP detection option
Operator can enable or disable the AP detection option pre-defined in the system.
Configuration using CLI
1)
Go to configure wi device ap configuration mode.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# device
WEC8500/configure/wi/device# ap
WEC8500/configure/wi/device/ap#
2)
Using the following command, configure the unauthorized AP detection option.
[OPTION] [NOTI_TYPE]
Parameter
Description
OPTION
Unauthorized AP detection option
NOTI_TYPE
Event save option
- notify: Notify the state with alarm
- detect: Save the state with sys log
© SAMSUNG Electronics Co., Ltd.
page 359 of 628
CHAPTER 8. Security
The description of OPTION parameter is as follows:
Parameter
Description
ap-blacklist-check
Allocates Rogue ID = 101 by checking a rogue included in the
black list.
managed_ssid_invalid_security
Allocates Rogue ID = 102 for an AP that uses a managed
SSID and its managed client is in the association status.
fakeap-beacon-on-invalid-channel
Allocates rogue ID = 103 for an AP whose UIC is invalid and
that uses a SSID that is not in the ssid white list among the
APs that use a managed MAC.
fakeap-beacon-without-ssid
Allocates Rogue ID = 104 for an AP whose UIC is invalid and
its SSID is hidden among the APs that use a managed MAC.
fakeap-managed-ssid
Allocates Rogue ID = 105 for an AP whose UIC is invalid and
its channel is not in the channel validation list among the APs
that use a managed MAC.
illegal-channel
Allocates Rogue ID = 106 if an AP uses a channel that is not
in the channel validation list among detected APs.
managedap-invalid-ssid
Allocates Rogue ID = 107 for an AP that uses a SSID that is
not in the ssid-whitelist among the APs that use a managed
MAC and its UIC is valid.
unknownap-managed-ssidwithauth-client
Allocates Rogue ID = 108 by checking the association status
between an unauthorized AP and a managed client.
3) To check the changed configuration, use the following command.
show wi device ap current-config
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And then,
operator can change the setting by selecting at the upper tab and clicking Apply.
In the configuration screen, operator can check Option and click Apply for configuration.
Figure 169. Configuration Window for Unauthorized AP Detection Option
© SAMSUNG Electronics Co., Ltd.
page 360 of 628
CHAPTER 8. Security
8.2.2.6
Unauthorized client detection option
Operator can enable or disable the client detection option pre-defined in the system.
Configuration using CLI
1)
Go to configure wi device client configuration mode.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# rogue
WEC8500/configure/wi/device# client
WEC8500/configure/wi/device /client#
2)
Configure the unauthorized client detection option by using the following command.
[OPTION] [NOTI_TYPE]
Parameter
Description
OPTION
Rogue Client detect option
NOTI_TYPE
Event save option
- notify: Notify the state with alarm
- detect: Save the state with sys log
The description of OPTION parameter is as follows:
Parameter
Description
assoc-fail-det
Classifies a client that exceeds the association fail threshold
as an unauthorized client.
auth-fail-det
Classifies a client that exceeds the authentication fail
threshold as an unauthorized client.
auth-request-det
Classifies a client that exceeds the authentication request
threshold as an unauthorized client.
deauth-request-det
Classifies a client that exceeds the de-authentication request
threshold as an unauthorized client.
exclusion-list-check
Classifies a MAC that does not exist in the client blacklist as
an unauthorized client.
oneXauth-fail-det
Classifies a client that exceeds the 802.1X authentication fail
threshold as an unauthorized client.
oui-list-check
Classifies an OUI that does not exist in the OUI list white list
as an unauthorized client.
probe-request-det
Classifies a client that exceeds the probe request threshold
as an unauthorized client.
webauth-fail-det
Classifies a client that exceeds the WEB authentication fail
threshold as an unauthorized client.
© SAMSUNG Electronics Co., Ltd.
page 361 of 628
CHAPTER 8. Security
3) To check the changed configuration, use the following command.
show wi device client current-config
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And then,
operator can change the setting by selecting at the upper tab and clicking Apply.
In the configuration screen, operator can check Option and click Apply for configuration.
Figure 170. Configuration Window for Unauthorized Station Detection Option
8.2.2.7
Unauthorized Channel Validation Configuration
The unauthorized channel validation function helps an operator detect an AP that uses an
unauthorized channel other than configured channels. The configuration procedure is as
follows:
Configuration using CLI
1)
Go to configure wi channel-validation configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# channel-validation
2)
Enable the unauthorized channel validation function.
WEC8500/configure/wi/channel-validation# enable
3)
Configure an authorized channel.
add [CHANNEL]
© SAMSUNG Electronics Co., Ltd.
page 362 of 628
CHAPTER 8. Security
Parameter
Description
CHANNEL
Authorized channel number (e.g. add 2, 3, 4)
4) To check the changed configuration, execute the following command.
show wi current-config
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And then,
operator can configure the SERVICE STATE and Valid Channel List in the screen.
Operator can change configuration after changing the SERVICE STATE and Valid Channel
List and clicking Apply.
Figure 171. Configuration Window for Channel Validation
8.2.2.8
Configuring and Searching Black/White List
Operator can configure classification to distinguish authorized and unauthorized
APs/stations. The administrator configurable lists include . The are automatically configured and can be used only for search.
Configuration using CLI
1)
Go to the configure wids configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wi
© SAMSUNG Electronics Co., Ltd.
page 363 of 628
CHAPTER 8. Security
2)
3)
4)
5)
Configure the AP black-list.
ap-blacklist [MAC]
Parameter
Description
MAC
MAC address that will be used as AP black-list
Configure the station black-list.
client-black-list [MAC]
Parameter
Description
MAC
MAC address that will be used as a black-list of the station
Configure the Managed Organizationally Unique Identifier (OUI).
oui-whitelist [OUI]
Parameter
Description
OUI
First 3 bytes of station MAC address
Configure the Managed/Neighbor AP.
Managed [MAC] [TYPE]
Parameter
Description
MAC
AP MAC address of Managed/Neighbor AP
TYPE
- Managed: Indicates that the address is located internally
during configuration
- Neighbor: Indicates that the address is located externally
during configuration
6) To check the changed configuration, execute the following command.
show wi lists managed-ap
show wi lists ap-blacklist
show wi lists managed-stat
show wi lists client-blacklist
show wi lists managed ssid
show wi lists oui-list
show wi lists neighbor-ap
© SAMSUNG Electronics Co., Ltd.
page 364 of 628
CHAPTER 8. Security
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And then, operator can
configure and search by using the upper tab in the screen.
1)
In the [AP Blacklist] tab, operator can add an AP blacklist by entering a MAC and
click Add. Operator can also delete it by using Delete.
Figure 172. AP blacklist Configuration Window
2)
In the [Managed AP] tab, operator can search for a Managed AP.
Figure 173. Managed AP Window
© SAMSUNG Electronics Co., Ltd.
page 365 of 628
CHAPTER 8. Security
3)
In the [Station Blacklist] tab, operator can add a station blacklist by entering a MAC
and click Add. Operator can also delete it by using Delete.
Figure 174. Station blacklist Search/Configuration Window
4)
In the [Managed Station] tab, operator can search Managed Station.
Figure 175. Managed Station Search Window
© SAMSUNG Electronics Co., Ltd.
page 366 of 628
CHAPTER 8. Security
5)
In the [Managed OUI] tab, operator can add a Managed OUI by entering an OUI and
click Add. Operator can also delete it by using Delete.
6)
In the [Managed SSID] tab, you can check the SSID that the WLAN is using.
Figure 176. Managed SSID Window
© SAMSUNG Electronics Co., Ltd.
page 367 of 628
CHAPTER 8. Security
7)
If you click Add in the [Managed/Neighbor AP] tab, operator can go to the Managed/
Neighbor AP list addition screen and can add a Managed/Neighbor AP list.
Operator can also delete it by using Delete.
[Managed/Neighbor AP] tab main screen
Figure 177. Managed/Neighbor AP Search/Configuration Window
Managed/Neighbor AP list addition screen
Figure 178. Managed/Neighbor AP List Addition Window
8.2.2.9
Station Allow Limit
The WIDS counts the number of frames and number of authentication failures to
distinguish a station that generates too many management frames in a network or that is
continuously failed for authentication. A threshold value is defined for the count and a
station is recognized as an unauthorized station if the count exceeds the threshold.
Configuration using CLI
1)
Go to the configure wi device client configuration mode.
WEC8500# configure terminal
WEC8500/configure# wi
WEC8500/configure/wi# device
WEC8500/configure/wi/device# client
WEC8500/configure/wi/device/client#
© SAMSUNG Electronics Co., Ltd.
page 368 of 628
CHAPTER 8. Security
2)
Configure a threshold.
allowed-limit [OPTION] [COUNT]
Parameter
OPTION
Description
- 80211-auth-req: Authentication requests threshold per second
- 80211-probe-req: Probe requests threshold per second
- 80211-deauth-req: De-authentication requests threshold per second
- 80211-assoc-fail: Association failures threshold per second
- 80211-auth-fail: Authentication failures threshold per second
- 8021x-auth-fail: 802.1x authentication failures threshold per WIDS interval
- web-auth-fail: Web authentication failures threshold that occurs continuously
COUNT
Threshold value of [OPTION] ranging from 3 to 20
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. And then, enter
a threshold value and click Apply to configure the value in the screen.
Figure 179. Station Allowed Limit Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 369 of 628
CHAPTER 8. Security
8.2.3
Enabling Blocking Function
The setting of enabling the blocking function is as follows:
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Enable the blocking function.
WEC8500/configure# wids containment enable
3) To check the configuration information, execute the following command.
show wids containment current-config
Configuration using Web UI
In the menu bar of , select and then select
menus in the sub-menus.
Select Enable and Disable and press Apply to activate and deactivate the wireless intrusion
blocking policy.
Figure 180. Wireless Intrusion Containment General Configuration Window
8.2.4
Blocking
The W-EP WLAN system performs blocking to the detected AP and the wireless device.
The method for blocking is classified as follows:
Blocking Method
Description
Manual blocking
The administrator performs blocking manually to APs or UEs.
Automatic blocking
APs or UEs are automatically blocked by the policy defined by the
administrator.
© SAMSUNG Electronics Co., Ltd.
page 370 of 628
CHAPTER 8. Security
8.2.4.1
Configuring Manual Blocking
To configure manual blocking, execute the command as follows:
Configuration using CLI
1)
Go to configure wids containment configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wids
WEC8500/configure/wids# containment
WEC8500/configure/wids/containment#
2)
Configure manual blocking.
manual[TARGET] enable[MAC]
Parameter
Description
TARGET
Select either AP or station which is the target for manual blocking.
MAC
MAC address of the target for manual blocking
Configuration using Web UI
In the menu bar of , select and then select menu in the sub-menus.
Select the target and perform containment to perform manual blocking.
1)
After selecting an AP in the AP list, possible to block by using the containment.
Figure 181. List Window for Blocking AP
© SAMSUNG Electronics Co., Ltd.
page 371 of 628
CHAPTER 8. Security
2)
After selecting a station in the station list, possible to block by using the containment.
Figure 182. List Window for Blocking Station
8.2.4.2
Configuring Automatic Blocking
To configure automatic blocking, execute the command as follows:
Configuration using CLI
1)
Go to configure wids containment configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wids
WEC8500/configure/wids# containment
WEC8500/configure/wids/containment#
2)
Configure automatic blocking.
auto[OPTION]
The description of OPTION parameter is as follows:
Parameter
Description
adhoc-connection
If adhoc is detected, it is automatically blocked.
managed-station-associated-with-
If the managed station and the neighbor AP are connected, it
friendly-external
is automatically blocked.
rogue-ap-with-auth-station
If the managed station and the unmanaged AP are
connected, it is automatically blocked.
© SAMSUNG Electronics Co., Ltd.
page 372 of 628
CHAPTER 8. Security
Parameter
Description
rogue-ap-with-managed-ssid
If the honeypot is detected, it is automatically blocked.
unmanaged-ap
If the unmanaged AP is detected, it is automatically blocked.
3) To check the configuration of automatic blocking, it is possible to use the following
command:
show wids containment current-config
Configuration using Web UI
In the menu bar of , select and then select
menus in the sub-menus.
Select the target and press Apply to configure automatic blocking.
Figure 183. Automatic Blocking Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 373 of 628
CHAPTER 8. Security
8.3
Captive Portal
The W-EP WLAN system provides the Captive Portal function. A guest user can receive a
normal service after connected to a specific WLAN (SSID) and going through user
authentication.
8.3.1
Configuring Guest Authentication
Configuration using CLI
To configure guest authentication, go to the Configure mode and execute the command.
Go to configure security captive-portal configuration mode of CLI.
1)
APC# configure terminal
APC/configure# security
APC/configure/security# captive-portal
APC/configure/security/captive-portal#
2) The command to add a guest user is as follows:
guest add [ID][PASSWD][START_TIME][END_TIME]
Parameter
Description
ID
Login ID of a user
PASSWD
Password
START_TIME
Start time (YYYY-MM-DD:HH:MM:SS format)
END_TIME
End time (YYYY-MM-DD:HH:MM:SS format)
3) The command to add a guest user is as follows:
guest delete [ID]
Parameter
Description
ID
User ID
4) To select the authentication method for a guest service, execute the command as follows:
auth-type[FLAG]
Parameter
FLAG
Description
Authentication method
- local-only: Uses internal authentication.
- radius-only: Uses the authentication of the RADIUS server.
- local-radius: Uses the authentication of the RADIUS if the
internal authentication is failed.
© SAMSUNG Electronics Co., Ltd.
page 374 of 628
CHAPTER 8. Security
Parameter
Description
- radius-local: Uses the internal authentication if the RADIUS
server authentication is failed.
5)
For RADIUS authentication, the operator can configure the primary and secondary
servers by using a profile ID.
radius-primary [PROFILE_ID]
radius-secondary [PROFILE_ID]
Parameter
Description
PROFILE_ID
Profile ID
Configuration using Web UI
In the menu bar of , select and then select
menus in the sub-menus.
Figure 184. Guest User Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 375 of 628
CHAPTER 8. Security
The operator can check and delete a guest created in the menu.
Figure 185. Guest User List Window
In the menu, the operator can select Auth Type and also PRIMARY
RADIUS and SECONDARY RADIUS servers.
Figure 186. Guest Auth Configuration Window
8.3.2
Configuring Guest ACL
To operate the captive portal services, redirection must be basically performed and if a drop
occurs by the Pre-Auth ACL of the WLAN, the redirection is performed.
Accordingly, the proper configuration of the ACL for guests is necessary depending on
types of captive portal services.
For the guest ACL, the DNS permit rule, and the permit rule for the web service address
used by the captive portal are basically necessary and the permit rule of the address of the
external web server is additionally necessary if the external web server is used.
Configuration using CLI
To configure the guest ACL, execute the following command:
1)
Go to configure fqm-mode configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# fqm-mode
2)
Configure an access list.
WEC8500/configure/fqm-mode#
WEC8500/configure/fqm-mode# access-list ip guest_acl permit seq 1 udp
any eq * any eq 53 os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit seq 2 tcp
192.168.20.10 255.255.255.255 eq 80 any eq * os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit seq 3 tcp
any eq * 192.168.20.10 255.255.255.255 eq 80 os-aware *
© SAMSUNG Electronics Co., Ltd.
page 376 of 628
CHAPTER 8. Security
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
90.90.100.120 255.255.255.255 eq 80 any eq * os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
any eq * 90.90.100.120 255.255.255.255 eq 80 os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
any eq * any eq * os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
192.168.10.10 255.255.255.255 eq 80 any eq * os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
any eq * 192.168.10.10 255.255.255.255 eq 80 os-aware *
WEC8500/configure/fqm-mode# access-list ip guest_acl permit
192.168.0.0 255.255.0.0 eq * any eq 443 os-aware *
seq 4 tcp
seq 5 tcp
seq 6 udp
seq 7 tcp
seq 8 tcp
seq 10 tcp
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menu of in the submenus.
Select Add on the screen and then configure the ACL.
Figure 187. Access List Addition Window
Figure 188. Access List Entry Addition Window
© SAMSUNG Electronics Co., Ltd.
page 377 of 628
CHAPTER 8. Security
8.3.3
Configuring Web Authentication
To provide the web authentication service, the security L3 item of the WLAN and the web
authentication of the captive portal must be configured.
Configuration using CLI
[WLAN Configuration]
To configure web authentication in the WLAN, execute the command as follows:
1)
Go to configure WLAN configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wlan 1
2)
Configure a guest flag (default: disabled).
guest-flag
WEC8500/configure/wlan 1# guest-flag
3)
Go to configure WLAN security layer 3 configuration mode of CLI.
WEC8500/configure/wlan 1# security
WEC8500/configure/wlan 1/security# layer3
WEC8500/configure/wlan 1/security/layer3#
4)
Enable the WEB authentication (default: disabled).
web-policy authentication
WEC8500/configure/wlan 1/security/layer3# web-policy authentication
5)
Configure the Pre-Authentication ACL.
pre-auth-acl [ACL]
Parameter
Description
ACL
ACL applied before the guest is authenticated
6) To change the redirection of the basic captive portal configuration to another address,
configure an overriding URL.
redirect-URL-override [URL]
© SAMSUNG Electronics Co., Ltd.
page 378 of 628
CHAPTER 8. Security
Parameter
Description
URL
URL to which the guest is redirected
7) To check the configuration, use the ‘show wlan security detail’ command.
WEC8500# show wlan security detail 1
[Captive Portal Configuration]
1)
Go to configure security captive-portal configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# security
WEC8500/configure/security# captive-portal
WEC8500/configure/security/captive-portal#
2) To configure the web authentication method of web authentication in the captive
portal, execute the command as follows:
web-auth web-type [FLAG]
web-auth external-url [URL]
Parameter
FLAG
Description
Web Authentication Method
- internal: Uses the internal authentication page.
- external: Uses the authentication page of an external web
server.
- downloaded: Uses the authentication page downloaded
from the system.
- customized: Uses the authentication page created through
configuration.
URL
Address of an external authentication server
3) To configure the operation after authentication, execute the command as follows:
web-auth after-auth [FLAG]
web-auth redirect-url [URL]
Parameter
FLAG
Description
Operation after authentication
- redirect: Redirect to a specified URL
- request: Redirect to a requested URL
URL
© SAMSUNG Electronics Co., Ltd.
URL specified as the operation after authentication
page 379 of 628
CHAPTER 8. Security
4) To check the configuration, use the ‘show security captive-portal web-auth’ command.
WEC8500# show security captive-portal web-auth
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. In the WLANs screen, select WLAN ID and enable
the option.
Figure 189. WLAN Guest Configuration Window
Go to the of the tab.
Enable and select the Web Authentication item and then designate the
ACL set in the guest ACL to .
To change a URL, enable and configure .
Figure 190. WLAN Web Policy Configuration Window
In the menu, the operator can select web
authentication method. The operator can also configure Redirect as the operation after
authentication.
Figure 191. Web Auth Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 380 of 628
CHAPTER 8. Security
8.3.4
Configuring Web Authentication on MAC Authentication
Failure
To provide the service of Web Authentication on MAC Authentication Failure, the MAC
Authentication of security L2 of the WLAN must be enabled and the web policy of L3 and
the web authentication of the captive portal must be configured.
Configuration using CLI
[WLAN Configuration]
To configure Web Authentication on MAC Authentication Failure in the WLAN, execute
the command as follows:
1)
Go to configure WLAN configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wlan 1
2)
Configure a guest flag (default: disabled).
guest-flag
WEC8500/configure/wlan 1# guest-flag
3)
Go to configure WLAN security layer 3 configuration mode of CLI.
WEC8500/configure/wlan 1# security
WEC8500/configure/wlan 1/security# layer3
WEC8500/configure/wlan 1/security/layer3#
4)
Enable the WEB authentication (default: disabled).
web-policy authentication
WEC8500/configure/wlan 1/security/layer3# web-policy macAuthFailure
5)
Configure the Pre-Authentication ACL.
pre-auth-acl [ACL]
Parameter
Description
ACL
ACL applied before the guest is authenticated
© SAMSUNG Electronics Co., Ltd.
page 381 of 628
CHAPTER 8. Security
6) To change the redirection of the basic captive portal configuration to another address,
configure an overriding URL.
redirect-URL-override [URL]
Parameter
Description
URL
URL to which the guest is redirected
7) To check the configuration, use the ‘show wlan security detail’ command.
WEC8500# show wlan security detail 1
[Captive Portal Configuration]
1)
Go to configure security captive-portal configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# security
WEC8500/configure/security# captive-portal
WEC8500/configure/security/captive-portal#
2) To configure the web authentication method of web authentication in the captive
portal, execute the command as follows:
web-auth web-type [FLAG]
web-auth external-url [URL]
Parameter
FLAG
Description
Web Authentication Method
- internal: Uses the internal authentication page.
- external: Uses the authentication page of an external web
server.
- downloaded: Uses the authentication page downloaded
from the system.
- customized: Uses the authentication page created through
configuration.
URL
Address of an external authentication server
3) To configure the operation after authentication, execute the command as follows:
web-auth after-auth [FLAG]
web-auth redirect-url [URL]
© SAMSUNG Electronics Co., Ltd.
page 382 of 628
CHAPTER 8. Security
Parameter
Description
FLAG
Operation after authentication
- redirect: Redirect to a specified URL
- request: Redirect to a requested URL
URL
URL specified as the operation after authentication
4) To check the configuration, use the ‘show security captive-portal web-auth’ command.
WEC8500# show security captive-portal web-auth
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. In the WLANs screen, select WLAN ID and enable
the option.
Figure 192. WLAN Guest Configuration Window
Go to the of the tab.
Enable .
Figure 193. WLAN Layer 2 Security Configuration Window
Go to the of the tab.
Enable and select the Web Authentication on MAC Authentication
Failure item and then designate the ACL set in the guest ACL to .
To change a URL, enable and configure .
© SAMSUNG Electronics Co., Ltd.
page 383 of 628
CHAPTER 8. Security
Figure 194. WLAN Web Policy Configuration Window
In the menu, the operator can select web
authentication method. The operator can also configure Redirect as the operation after
authentication.
Figure 195. Web Auth Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 384 of 628
CHAPTER 8. Security
8.3.5
Configuring Web Pass-through
The APC provides the web pass-through function to move to a specific address all the time
when the user uses the web.
Configuration using CLI
[WLAN Configuration]
To configure web pass-through in the WLAN, execute the command as follows:
1)
Go to configure WLAN configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wlan 1
2)
Configure a guest flag (default: disabled).
guest-flag
WEC8500/configure/wlan 1# guest-flag
3)
Go to configure WLAN security layer 3 configuration mode of CLI.
WEC8500/configure/wlan 1# security
WEC8500/configure/wlan 1/security# layer3
WEC8500/configure/wlan 1/security/layer3#
4)
Enable the WEB authentication (default: disabled).
web-policy pass-through
WEC8500/configure/wlan 1/security/layer3# web-policy pass-through
5)
Configure the Pre-Authentication ACL.
pre-auth-acl [ACL]
Parameter
Description
ACL
ACL for occurrence of redirection
6) To change the redirection of the basic captive portal configuration to another address,
configure an overriding URL.
redirect-URL-override [URL]
© SAMSUNG Electronics Co., Ltd.
page 385 of 628
CHAPTER 8. Security
Parameter
Description
URL
URL to which the guest is redirected
7) To check the configuration, use the ‘show wlan security detail’ command.
WEC8500# show wlan security detail 1
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. In the WLANs screen, select WLAN ID and enable
the option.
Figure 196. WLAN Guest Configuration Window
Go to the of the tab.
Enable and select Web PassThrough.
Enable and configure .
Figure 197. Web Pass-through Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 386 of 628
CHAPTER 8. Security
8.3.6
Configuring One Time Redirection
To provide the One Time Redirection service, the security L3 of the WLAN must be
configured.
Configuration using CLI
[WLAN Configuration]
To configure one time redirection in the WLAN, execute the command as follows:
1)
Go to configure WLAN configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# wlan 1
2)
Configure a guest flag (default: disabled).
guest-flag
WEC8500/configure/wlan 1# guest-flag
3)
Go to configure WLAN security layer 3 configuration mode of CLI.
WEC8500/configure/wlan 1# security
WEC8500/configure/wlan 1/security# layer3
WEC8500/configure/wlan 1/security/layer3#
4)
Enable the WEB authentication (default: disabled).
web-policy oneTimeRedirection
WEC8500/configure/wlan 1/security/layer3# web-policy
oneTimeRedirection
5)
Configure the Pre-Authentication ACL.
pre-auth-acl [ACL]
Parameter
Description
ACL
ACL to perform redirection
6) To change the redirection of the basic captive portal configuration to another address,
configure an overriding URL.
redirect-URL-override [URL]
© SAMSUNG Electronics Co., Ltd.
page 387 of 628
CHAPTER 8. Security
Parameter
Description
URL
URL to which the guest is redirected
7) To check the configuration, use the ‘show wlan security detail’ command.
WEC8500# show wlan security detail 1
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. In the WLANs screen, select WLAN ID and enable
the option.
Figure 198. WLAN Guest Configuration Window
Go to the of the tab.
Enable and select One Time Redirection.
Enable and configure .
Figure 199. One Time Redirection Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 388 of 628
CHAPTER 8. Security
8.3.7
Redirection Address Format
The Captive Portal attempts at first redirection for the request of the web service of the
station.
The redirection address transmitted by the station in the APC to perform redirection is
formed as follows:
1)
Redirection Address Format
Destination Address + Redirection Option Information
2)
Redirection Address Option
Option
forward
Description
The address of the APC to receive the station information in case of the external
web authentication
redirect
URL to move to after authentication
essid
ESS ID to which the station is connected
bssid
BSS ID to which the station is connected
apname
The name of the AP to which the station is connected
client_ip
IP address of the station
client_mac
MAC Address of the station
osname
OS information of the station, effective when the OS Aware function is configured.
model_name
Model information of the station, effective in case of the FMC station.
os_version
OS version of the station, effective in case of the FMC station.
build_num
OS build number of the station, effective in case of the FMC station.
© SAMSUNG Electronics Co., Ltd.
page 389 of 628
CHAPTER 8. Security
8.4
NAT and Firewall Configuration
The APC provides the NAT and firewall function to provide stable network to a WLAN user.
8.4.1
Firewall Configuration
Configuration using CLI
[Firewall Configuration]
1) Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure the accelerator function of a firewall.
WEC8500/configure# firewall enable
[Firewall Configuration using Access List]
1) Go to configure mode of CLI.
WEC8500# configure terminal
2)
Create an access-list.
WEC8500/configure# access-list fw fw4 deny tcp any any eq 23
3)
Configure a firewall to the interface using an access-list.
WEC8500/configure# interface vlan1.10
WEC8500/configure/interface vlan1.10# ip access-group fw forward fw4
WEC8500/configure/interface vlan1.10# exit
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. You can configure
whether to use a firewall.
Figure 200. Firewall configuration (1)
© SAMSUNG Electronics Co., Ltd.
page 390 of 628
CHAPTER 8. Security
In the menu bar of , select and then select the
menu in the sub-menus.
You can configure an interface for which a firewall will be applied by clicking the
button of Interface window.
Figure 201. Firewall configuration (2)
8.4.2
Access List Configuration
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Create an access-list.
access-list fw [ACL_NAME] [ACTION] [SRC_ADDRESS (SRC_PORT)]
[DST_ADDRESS (DST_PORT)] [PROTOCOL]
Parameter
Description
ACL_NAME
ACL name to configure
ACTION
Action configuration (deny/permit)
SRC_ADDRESS(SRC_PORT)
Source IP address and port
DST_ADDRESS(DST_PORT)
Destination IP address and port
PROTOCOL
Protocol
© SAMSUNG Electronics Co., Ltd.
page 391 of 628
CHAPTER 8. Security
Configuration using Web UI
In the menu bar of , select and then select the
< menu in the sub-menus. Click the button
to configure the firewall Policy.
Figure 202. Access-list configuration
8.4.3
NAT Configuration
Configuration using CLI
[SNAT Configuration using Access List]
To add Source NAT (SNAT) using an access-list, execute the command as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Create an access-list.
WEC8500/configure# access-list fw fw1 deny any 10.10.10.10/32 any
3)
Create a NAT pool.
WEC8500/configure# ip nat pool pool1 30.30.30.1 30.30.30.1
255.255.255.0
4)
Configure a NAT to the interface.
WEC8500/configure# interface vlan1.30
WEC8500/configure/interface vlan1.30# ip nat inside
WEC8500/configure/interface vlan1.30#exit
5)
Add the NAT rule by using access-list and pool.
WEC8500/configure# ip nat outside source list fw1 pool pool1
© SAMSUNG Electronics Co., Ltd.
page 392 of 628
CHAPTER 8. Security
[SNAT Configuration using Static IP]
To add SNAT using a static IP, execute the command as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure a NAT to the interface.
WEC8500/configure# interface vlan1.30
WEC8500/configure/interface vlan1.30#ip nat outside
WEC8500/configure/interface vlan1.30#exit
3)
Configure a NAT rule using a static IP.
WEC8500/configure# ip nat outside source static 10.10.10.10 30.30.30.1
[DNAT Configuration using Access List]
To add Destination NAT (DNAT) using an access-list, execute the command as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Create a NAT pool.
WEC8500/configure# ip nat pool pool2 10.10.10.10 10.10.10.10
255.255.255.0
3)
Configure a NAT to the interface.
WEC8500/configure# interface vlan1.30
WEC8500/configure/interface vlan1.30#ip nat outside
WEC8500/configure/interface vlan1.30#exit
4)
Add the NAT rule by using access-list and pool.
WEC8500/configure# ip nat outside destination list fw6 pool pool2
© SAMSUNG Electronics Co., Ltd.
page 393 of 628
CHAPTER 8. Security
[DNAT Configuration using Static IP]
To add DNAT using a static IP, execute the command as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure a NAT to the interface.
WEC8500/configure# interface vlan1.30
WEC8500/configure/interface vlan1.30#ip nat outside
WEC8500/configure/interface vlan1.30#exit
3)
Configure a NAT rule using a static IP (A port can be also specified for DNAT).
WEC8500/configure# ip nat outside destination static tcp 10.10.10.1
4300 30.30.30.2 23
[Checking NAT Configuration]
To check the created NAT, use the following command.
WEC8500/configure# show nat
Configuration using Web UI
1)
In the menu bar of , select and then select
the menu in the sub-menus. Click the
button and configure the NAT pool.
Figure 203. NAT configuration (1)
© SAMSUNG Electronics Co., Ltd.
page 394 of 628
CHAPTER 8. Security
2)
Click the button in the Translation Rule window and configure the Translation
Rule. Select NAT TYPE as either SNAT or DANT. Select STATIC checkbox to
configure Static and configure the values of Original IP Addr: Port and Translated IP
Addr: Port.
Figure 204. NAT configuration (2)
To proceed with NAT configuration, you must create an access list first.
© SAMSUNG Electronics Co., Ltd.
page 395 of 628
CHAPTER 8. Security
8.5
MAC Filter
The W-EP wireless LAN system provides the MAC filter function. A user may experience
connection restriction due to MAC filtering when connecting to a specific WLAN (SSID).
Configuration using CLI
To configure a MAC list for connection control by the MAC filter, execute the command as
follows:
1)
Go to configure security configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# security
2)
Creates a MAC filter list.
WEC8500/configure/security# mac-filter [ID]
3)
Parameter
Description
ID
MAC filter list table ID (range: 1-20)
Configure the filtering policy.
WEC8500/configure/security/mac-filter 1# policy [POLICY]
4)
Parameter
Description
POLICY
Table policy of MAC filtering list
Configure a MAC entry.
WEC8500/configure/security/mac-filter 1# mac [MAC_ADDRESS]
5)
Parameter
Description
MAC_ADDRESS
MAC address (XX:XX:XX:XX:XX:XX format)
Specify the MAC filter ID that is configured in the WLAN to which a MAC filter will
be applied.
WEC8500/configure/wlan 1/security# mac-filter
© SAMSUNG Electronics Co., Ltd.
page 396 of 628
CHAPTER 8. Security
6)
Parameter
Description
MAC_FILTER_ID
MAC FILTER ID (range: 1-20)
You can check the configured information below.
show security mac-filter summary
WEC8500# show security mac-filter detail
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
You can create a MAC filter table for station access control by clicking the button.
Figure 205. MAC configuration
The procedure for MAC entry configuration is given below.
1)
In the MAC Filter initial window, select an INDEX item to switch to the Edit screen
and then click the button to configure a MAC entry.
Figure 206. MAC entry configuration window(1)
© SAMSUNG Electronics Co., Ltd.
page 397 of 628
CHAPTER 8. Security
2)
Configure the policy in the Edit configuration screen by selecting the index of MAC
filter list.
Figure 207. MAC entry configuration(2)
3)
Select a WLAN for which the MAC filter will be applied. Check a MAC FILTER ID
to apply in the Security > L2 configuration screen.
To apply the configuration, click the button.
Figure 208. MAC entry configuration(3)
© SAMSUNG Electronics Co., Ltd.
page 398 of 628
CHAPTER 8. Security
8.6
Operator Authentication through
Interoperation with TACACS+ Server
A W-EP wireless LAN system provides an operator authentication function by
interoperating with an external TACACS+ server.
8.6.1
Configuring External TACACS+ Server
A W-EP wireless LAN system provides an operator authentication function by
interoperating with an external TACACS+ server and the procedure detailed below is
carried out for interoperation with a TACACS+ server.
8.6.1.1
Basic Settings
The default configuration of the TACACS+ server is as follows:
Configuration using CLI
1)
Go to configure security tacacs configuration mode of CLI.
WEC8500# configure terminal
WEC8500/configure# security
WEC8500/configure/security# tacacs 1
WEC8500/configure/security/tacacs 1#
2)
Configure the IP address of the TACACS+ server.
WEC8500/configure/security/tacacs 1# server-ip [IP_ADDRESS]
3)
Parameter
Description
IP_ADDRESS
IP address of the TACACS+ server
Set the public key of the TACACS+ server.
WEC8500/configure/security/tacacs 1# shared-secret [KEY_STRING]
4)
Parameter
Description
KEY_STRING
Public key of the TACACS+ server
Configure the port number of the TACACS+ server.
WEC8500/configure/security/tacacs 1# server-port [PORT_NUMBER]
© SAMSUNG Electronics Co., Ltd.
page 399 of 628
CHAPTER 8. Security
Parameter
PORT_NUMBER
Description
Port number of the TACACS+ server
(range: 1-65,535, default value: 49)
5)
Configure the items related to retransmissions in TACACS+ communications.
You can use default values without changing configuration.
WEC8500/configure/security/tacacs 1# retransmit-interval
[RETRY_INTERVAL]
WEC8500/configure/security/tacacs 1# retransmit-count [FO_RETRY_COUNT]
Parameter
RETRY_INTERVAL
Description
Retransmission interval for a TACACS+ message
(unit: seconds, range: 1-5, default value: 3)
FO_RETRY_COUNT
Maximum message retransmission count before a TACACS+
server failover is attempted (range: 0-3, default value: 2)
6)
If necessary, configure the source IP address of the TACACS+ message.
WEC8500/configure/security/tacacs 1# source-ip [IP_ADDRESS]
Parameter
IP_ADDRESS
Description
Source IP address of the TACACS+ message
Note: it must be one of the IP addresses configured in the WEP wireless LAN system.
7)
Configure whether to transfer packets to the TACACS+ server. You can use default
values without changing configuration.
WEC8500/configure/security/tacacs 1# status [STATUS]
Parameter
STATUS
Description
Status indicating whether packets are transferred to the
TACACS+ server (default value: enable)
8)
Exit TACACS+ server configuration and then security configuration mode.
WEC8500/configure/security/tacacs 1# exit
WEC8500/configure/security# exit
© SAMSUNG Electronics Co., Ltd.
page 400 of 628
CHAPTER 8. Security
9)
You can view configuration information by using the ‘show security tacacs server
config’ and ‘show security tacacs server detail [SERVER ID]’ commands.
Configuration using Web UI
In the menu bar of , select , and then select
in the submenus.
If you click the button in the TACACS+ initial window, you can add a TACACS+
server.
The server addition window is shown below.
Figure 209. TTACACS+ Server Configuration Window
Item
Description
INDEX (PRIORITY)
ID that distinguishes TACACS+ server configurations
IP ADDRESS
IP address of the TACACS+ server
SHARED SECRET
Public key of the TACACS+ server
CONFIRM SHARED
Re-enters the key for TACACS+ server communications for
SECRET
confirmation
PORT NUMBER
Communication port number of the TACACS+ server
(range: 1-65,535, default value: 49)
RETRANSMIT
Retransmission interval for a TACACS+ message
INTERVAL
(range: 1-5, default value: 2, unit: seconds)
RETRANSMIT COUNT
Maximum message retransmission count before a TACACS+ server
BEFORE FAILOVER
failover is attempted (range: 0-3, default value: 2)
SOURCE IP ADDRESS
Source IP address of the TACACS+ message
- Note: it must be one of the IP addresses configured in the W-EP
wireless LAN system.
STATUS
Status indicating whether packets are transferred to the TACACS+
server (default value: enable)
© SAMSUNG Electronics Co., Ltd.
page 401 of 628
CHAPTER 8. Security
8.6.2
Configuring Authentication Type of Operator Account
The steps for configuring the authentication type of the operator account are as follows:
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Configure the type of operator account authentication.
WEC8500/configure# mgmt-user auth-type [AUTH_TYPE]
Parameter
AUTH_TYPE
Description
Authentication type of the operator account (default value: local)
- local: Authentication is performed using the database stored inside.
- tacacs: Authentication is performed using the TACACS+ server.
- local-tacacs: Authentication is performed using the database stored
inside first, and, failing that, an authentication request is transmitted to
the TACACS+ server.
- tacacs-local: An authentication request is transmitted to the TACACS+
server first, and, failing that, authentication is performed using the DB
stored inside.
3)
You can view the configuration information by using the ‘show mgmt-users auth-type’
command.
Configuration using Web UI
In the menu bar of , select , and then select
in the submenus.
Figure 210. Operator Account Authentication Type Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 402 of 628
CHAPTER 8. Security
8.7
Role Based Access Control
The W-EP WLAN system can manage the user's access authority depending on a
designated role.
It can designate ACL, limit the bandwidth, designate the interface, or manage redirecting
URL, etc. by user.
8.7.1
Configuring Role Profile
The W-EP WLAN system can designate the configuration of ACL, QoS, VLAN, and URL
and manage as a profile.
To provide a service of a role desired to a specific user or a user group, it can use a role
profile.
8.7.1.1
Configuring Profile
The basic settings of the role profile are as follows:
Configuration using CLI
Example:
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# role-profile role_01
WEC8500/configure/rbac/role-profile role_01# acl acl1
WEC8500/configure/rbac/role-profile role_01# qos 1
WEC8500/configure/rbac/role-profile role_01# vlan 10
WEC8500/configure/rbac/role-profile role_01# url http://www.role1
WEC8500/configure/rbac/role- profile role_01# end
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# no role-profile role_01
WEC8500/configure/rbac# end
CLI for confirming configuration:
WEC8500# show rbac role-profile summary
===== Role Profile Summary =====
Id ProfileName Acl
Qos Vlan Url
== =========== ========== === ==== ====================
1 role_01
acl1
10 http://www.role1
© SAMSUNG Electronics Co., Ltd.
page 403 of 628
CHAPTER 8. Security
Configuration using Web UI
Configuration > Security > Role Based Access Control > Role Profile
Example:
Figure 211. Role Profile Configuration
Figure 212. Role Profile Add Configuration
8.7.2
Configuring Derivation Profile
The W-EP WLAN system can edit conditions to allocate roles and manage by profile.
It can manage a role by user depending on the edited conditions.
8.7.2.1
Configuring Profile
The basic settings of the derivation profile are as follows:
Configuration using CLI
Example:
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# derivation-profile derivation_1
WEC8500/configure/rbac/derivation-profile derivation_1# condition
priority 11 user equal derivationUser role role_1
WEC8500/configure/rbac/derivation-profile derivation_1# condition
priority 12 user start-with derivation role role_2
WEC8500/configure/rbac/derivation-profile derivation_1# condition
priority 13 user contain vation role role_3
© SAMSUNG Electronics Co., Ltd.
page 404 of 628
CHAPTER 8. Security
WEC8500/configure/rbac/derivation-profile derivation_1#
priority 14 user end-with User role role_4
WEC8500/configure/rbac/derivation-profile derivation_1#
priority 15 user not-equal samsung role role_5
WEC8500/configure/rbac/derivation-profile derivation_1#
WEC8500/configure/rbac# derivation-profile derivation_2
WEC8500/configure/rbac/derivation-profile derivation_2#
condition
condition
exit
end
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# no derivation-profile derivation_2
WEC8500/configure/rbac# end
CLI for confirming configuration:
WEC8500# show rbac derivation-profile summary
derivation-profile derivation_1
condition priority 11 user equal derivationUser role role_1
condition priority 12 user start-with derivation role role_2
condition priority 13 user contain vation role role_3
condition priority 14 user end-with User role role_4
condition priority 15 user not-equal samsung role role_5
Configuration using Web UI
Configuration > Security > Role Based Access Control > Derivation Profile
Example:
Figure 213. Derivation Profile Configuration
Figure 214. Derivation Profile Add Configuration
© SAMSUNG Electronics Co., Ltd.
page 405 of 628
CHAPTER 8. Security
Figure 215. Derivation Profile Configuration
Figure 216. Derivation Profile Add Configuration
8.7.2.2
WLAN Configuration
The method for configuring a derivation profile in the WLAN is as follows:
Configuration using CLI
Example:
WEC8500# configure terminal
WEC8500/configure# wlan 1
WEC8500/configure/wlan 1# derivation-profile ieee8021x derivation_1
WEC8500/configure/wlan 1# end
CLI for confirming configuration:
WEC8500# show rbac wlan-derivation-config
================ RbacDerivationConfigForWlan ================
WlanId Owner
DerivationProfileId
====== ================ ===================
Global
Open
Radius
CaptivePotal
© SAMSUNG Electronics Co., Ltd.
page 406 of 628
CHAPTER 8. Security
Configuration using Web UI
Configuration > WLANs > Security > Radius
Example:
Figure 217. Wlan Derivation Profile Configuration
8.7.3
Configuring ACL Profile
The W-EP WLAN system can manage ACL to apply to a user if the AP of the remote group
operates as local bridge.
© SAMSUNG Electronics Co., Ltd.
page 407 of 628
CHAPTER 8. Security
8.7.3.1
Configuring Profile
The basic settings of the ACL profile are as follows:
Configuration using CLI
Example:
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# acl-profile aclPro_1
WEC8500/configure/rbac/acl-profile aclPro_1#
WEC8500/configure/rbac/acl-profile aclPro_1#
WEC8500/configure/rbac/acl-profile aclPro_1#
WEC8500/configure/rbac# acl-profile aclPro_2
WEC8500/configure/rbac/acl-profile aclPro_2#
add-acl acl1
add-acl acl2
exit
end
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# no acl-profile aclPro_2
WEC8500/configure/rbac# end
CLI for confirming configuration:
WEC8500# show rbac acl-profile summary
================ LocalSwAclProfile ================
Id ProfileName TotalRuleCnt AclCnt RmtCnt
== =========== ============ ====== ======
1 aclPro_
Configuration using Web UI
Configuration > Security > Role Based Access Control > Derivation Profile
Example:
Figure 218. Acl Profile Configuration
© SAMSUNG Electronics Co., Ltd.
page 408 of 628
CHAPTER 8. Security
Figure 219. Acl Profile Add Configuration
Figure 220. Acl Profile Edit Configuration
8.7.3.2
Remote Ap Group Configuration
The method for configuring the ACL profile to the remote AP group is as follows:
Configuration using CLI
Example:
WEC8500# configure terminal
WEC8500/configure# ap-group apg_1
WEC8500/configure/ap-group apg_1# remote
WEC8500/configure/ap-group apg_1/remote# acl-profile aclPro_1
WEC8500/configure/ap-group apg_1/remote# end
CLI for confirming configuration:
WEC8500# show rbac remote-group summary
GRP_ID
GRP_NAME
PRO_ID Role Config File Name
======
==================
====== ==========================
apg_1
etc/rmtapgrp/rbac_cfg_rmtapgrp2_XXXX.tar
© SAMSUNG Electronics Co., Ltd.
page 409 of 628
CHAPTER 8. Security
Configuration using Web UI
Configuration > AP Groups > Remote AP Group > ACL Profile
Change the configuration of the ACL PROFILE NAME and then press Apply.
After that, press Send To APs to transmit the ACL profile and the relevant settings to APs.
Example:
Figure 221. Remote Ap Group-Alc Profile Configuration
© SAMSUNG Electronics Co., Ltd.
page 410 of 628
CHAPTER 8. Security
8.7.4
Configuration Synchronization (Remote AP Group)
The W-EP WLAN system provides a function of synchronizing the configuration of the AP
of the remote group and ACL if the AP of the remote group operates as a local bridge.
8.7.4.1
Requesting Synchronization
If the remote AP operates with the local switching mode, the configuration of the ACL
between APC and AP must be synchronized. If AP and CAPWAP run, the configuration of
the ACL is automatically synchronized, but if the operator changes the ACL of the APC,
the synchronization of ACL configuration must be performed as follows:
Configuration using CLI
The synchronization of the AP of the remote group uses the following CLI:
WEC8500# configure terminal
WEC8500/configure# rbac
WEC8500/configure/rbac# sync-config ?
acl-profile
all
ap
remote-ap-group
Sync-config
Sync-config
Sync-config
Sync-config
Acl profile
All
Remote Ap Group
Remote Ap Group
all: Perform synchronization for all APs of the remote group.
remote-ap-group [group-name]: Performs synchronization only for the APs included in
the corresponding remote group.
acl-profile [profile-name]: Performs synchronization only for the APs included in the
remote group which uses the corresponding ACL profile (CLI only).
ap [ap-profile-name]: Performs synchronization only for a specific AP (CLI only).
Synchronization can be confirmed as follows:
WEC8500# show rbac remote-group summary
GRP_ID
GRP_NAME
PRO_ID
Role
Config File Name
======
==================
====== ==========================
rmt_grp_01
etc/rmtapgrp/rbac_cfg_20140305094752849046.tar
© SAMSUNG Electronics Co., Ltd.
page 411 of 628
CHAPTER 8. Security
Configuration using Web UI
Configuration > Security > Role Based Access Control > ACL Profile
‘Send To APs’
Figure 222. ACL Configuration Synchronization - All
Configuration > AP Groups > Remote AP Group > ACL Profile
‘Send To APs’
Figure 223. ACL Configuration Synchronization - Remote Group
© SAMSUNG Electronics Co., Ltd.
page 412 of 628
CHAPTER 8. Security
Configuration > Access Points > Remote AP
‘Send To APs’
Figure 224. ACL Configuration Synchronization - Remote AP
© SAMSUNG Electronics Co., Ltd.
page 413 of 628
CHAPTER 8. Security
8.8
External BYOD Server
The W-EP WLAN system provides a function of interoperating with the external BYOD
server. To use the BYOD function, a separate BYOD server is necessary. Employees and
guest users can receive a service after being connected to a specific WLAN (SSID) and
going through authentication.
(The external BYOD server now supported is only AirCuve BYOD.)
8.8.1
Configuring External BYOD Server
Configuration using CLI
To configure the interoperation with external BYOD, execute the command as follows:
1)
Go to configure security byod of CLI.
WEC8500# configure terminal
WEC8500/configure# security byod
2)
Enter the IP address of the BYOD server.
WEC8500/configure/security/byod# address1 10.10.10.20
To interoperate with AirCuve BYOD Suite, enter Airfront IP in address1 and Byfront
IP in address2.
3)
Enable the function of interoperating with the external BYOD server.
WEC8500/configure/security/byod# enable
4)
Configure a HTTPS request URL.
Upon the interoperation with AirCuve BYOD Suite, the HTTPS request URL is
necessary to update the list of all authentications. The basically set value is used and if
change is required in the future, change as follows:
WEC8500/configure/security/byod# https-requrl
regist.do?cmd=dhcpTableXMLReceiver
5) To check the configured environment, use the ‘show security byod configuration’
command.
© SAMSUNG Electronics Co., Ltd.
page 414 of 628
CHAPTER 8. Security
Configuration using Web UI
In the menu bar of , select and then select
in the sub-menus.
Figure 225. External BYOD Server Configuration Window
1)
2)
3)
4)
5)
6)
Service
Enable the function of interoperating with the external BYOD server.
Server IP Address 1
Enter the IP address of the BYOD server. Enter the Airfront IP upon the interoperation
with AirCuve BYOD Suite.
Server IP Address 2
Enter the Byfront IP upon the interoperation with AirCuve BYOD Suite.
Requested URL
It is necessary to update the list of all authentications upon the interoperation with
AirCuve BYOD Suite. Basically use the set value and enter a new URL if change is
required.
SYNC. Status
Display the result value of updating the list of all authentications.
The status value has one of the following four items:
0: Idle, 1: In progress, 2: Success, 3: Failure
SYNC. Failure Reason
If the update of the list of all authentications fails, display the reason of failure.
Failure reason items
None: No failure.
No response: When there is no response from the BYOD server
Invalid data format: When the BYOD server failed to send the data on the list of all
authentications or in the invalid format
© SAMSUNG Electronics Co., Ltd.
page 415 of 628
CHAPTER 8. Security
8.8.2
Captive Portal Configuration
To use the external BYOD service, the External Web Authentication of the Captive Portal
is necessary to be configured. The Captive Portal service must configure ACL basically and
apply the ACL to L3 security of the WLAN. Below is an example of how to configure the
captive portal to use the BYOD service.
Configuration using CLI
1)
Configuring PreAuthentication ACL
PRE-AUTH ACL must have the basic permit rules for the HTTP port to DNS and web
servers.
WEC8500# configure terminal
WEC8500/configure# fqm-mode
WEC8500/configure/fqm-mode # access-list ip preauth permit seq
any eq * any eq 53 os-aware *
WEC8500/configure/fqm-mode # access-list ip preauth permit seq
192.168.20.10 255.255.255.255 eq 80 any eq * os-aware *
WEC8500/configure/fqm-mode # access-list ip preauth permit seq
any eq * 192.168.20.10 255.255.255.255 eq 80 os-aware *
WEC8500/configure/fqm-mode # access-list ip preauth permit seq
90.90.100.120 255.255.255.255 eq 80 any eq * os-aware *
WEC8500/configure/fqm-mode # access-list ip preauth permit seq
any eq * 90.90.100.120 255.255.255.255 eq 80 os-aware *
WEC8500/configure/fqm-mode # ip access-group wireless preauth
WEC8500/configure/wlan 1/security/layer3# pre-auth-acl preauth
2)
1 udp
2 tcp
3 tcp
4 tcp
5 tcp
Configuring WLAN
To configure WLAN, set a guest flag and designate the configuration of the web
policy of Layer 3 as authentication.
WEC8500# configure terminal
WEC8500/configure# wlan 1
WEC8500/configure/ wlan 1# guest-flag
WEC8500/configure/ wlan 1# security
WEC8500/configure/ wlan 1/security# layer3
configure/wlan 1/security/layer3# web-policy authentication
© SAMSUNG Electronics Co., Ltd.
page 416 of 628
CHAPTER 8. Security
3)
Configuring Web Authentication Type
WEC8500/configure/security/captive-portal # web-auth
WEC8500/configure/security/captive-portal/web-auth#auth-type external
WEC8500/configure/security/captive-portal/web-auth#external-url
http://90.90.100.120/pc/zero_page.jsp
Configuration using Web UI
1)
Configuring PreAuthentication ACL
PRE-AUTH ACL must have the basic permit rules for the HTTP port to DNS and web
servers.
2)
Configuring WLAN
To create WLAN to use for guests, the guest service must be enabled.
To use the Captive Portal function, enable a web policy in Security of WLAN > L3 tab
and select Web Authentication. Designate the pre-set ACL for Captive Portal as PREAUTHENTICATION ACL on the bottom.
© SAMSUNG Electronics Co., Ltd.
page 417 of 628
CHAPTER 8. Security
3)
Configuring Web Authentication Type
To use the External BYOD function, External Web Auth must be configured.
Designate the type as External in Security > Captive Portal > Web Authentication and
designate the external BYOD server as URL.
© SAMSUNG Electronics Co., Ltd.
page 418 of 628
CHAPTER 9. IP Application
CHAPTER 9. IP Application
In this chapter, the IP application functions available in the APC and each configuration
method are described.
9.1
DNS
The DNS is a network service that interprets a domain or host name into an IP address.
The APC gets DNS information from a DNS server and provides the DNS relay function
that relays the DNS server and a client. If a wireless terminal connected to the APC
configures the APC as a DNS server, it can receive the DNS service.
If a DNS server is connected to the APC and a DNS proxy is configured, a station
connected to the APC can receive the DNS service by configuring the APC as a DNS server.
9.1.1
DNS Client Configuration
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure a DNS client.
ip dns client enable: Enable
no ip dns client enable: Disable
3)
Configure a DNS server to which DNS will be requested. You can enter maximum 3
DNS server addresses.
ip dns name-server [A.B.C.D]: Configures a DNS server.
no ip dns name-server [A.B.C.D]: Deletes a configured DNS server.
no ip dns name-server all: Deletes all the DNS servers.
© SAMSUNG Electronics Co., Ltd.
page 419 of 628
CHAPTER 9. IP Application
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
Figure 226. DNS client
You can enable or disable a DNS client using the QUERY of a DNS SERVER item.
In the 1ST DNS SERVER, 2ND DNS SERVER, and 3RD DNS SERVER boxes, you can
configure 3 name servers.
9.1.2
DNS Proxy Configuration
You can configure the DNS relay function or a cache for relay. The cache is a temporary
space where the APC saves the DNS information obtained from a DNS server.
You can configure maximum number of entries as 10000-100000. The DNS relay is related
to the DNS client configuration. If you disable the DNS client function or delete all the
name servers, the DNS relay function is not working.
Configuration using CLI
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure a DNS relay. Configure the cache to a default, i.e. 10000.
ip dns relay enable: Enables a relay.
no ip dns relay enable: Disables a relay.
3) To change cache configuration, enter as follows:
ip dns relay enable cache: Configures a DNS relay and configures the cache to a
default, i.e. 10000.
ip dns relay enable cache 20000: Configures a DNS relay and configures the cache
to 20000.
ip dns relay enable no-cache: Configures a DNS relay and disables the cache
settings.
© SAMSUNG Electronics Co., Ltd.
page 420 of 628
CHAPTER 9. IP Application
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
Figure 227. DNS proxy
The DNS Relay item supports DNS Proxy configuration. In the SERVICE, you can enable
or disable a DNS proxy and configure the cache size of the DNS proxy in the CACHING
SIZE. If the cache size is 0, disable the cache.
© SAMSUNG Electronics Co., Ltd.
page 421 of 628
CHAPTER 9. IP Application
9.2
NTP
The Network Time Protocol (NTP) is a protocol used to receive time from a configured
server and synchronize the local time.
The APC can operate as a NTP server and a client. If you configure the APC as a NTP
client, it receives the Coordinated Universal Time (UTC) information from the configured
NTP server and synchronizes the local time. In addition, if you configure the APC as a NTP
server, it transmits a local time when it receives a NTP request from a NTP client.
Configuration using CLI
[Configuring NTP Client]
The time server that is referred to when the APC is working as a NTP client can be used
based on a domain name and IP address. But, if it is working based on a domain name,
there must be a configured DNS server.
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Enable or disable a NTP client.
ntp client enable: Enable
no ntp client enable: Disable
3)
Configure the interval of a NTP client.
ntp client interval [INTERVAL]: Configures an interval.
no ntp client interval: Disables an interval.
4)
Parameter
Description
INTERVAL
Interval (range: 3-14)
Configure a server that a NTP client will refer to.
[Configuring based on a domain name]
Enables or disables.
ntp client server-addr hostname : Enable
no ntp client server-addr hostname : Disable
Configure the index of a server that a NTP client will refer to. (Use a default value 1 if it is
not configured.)
ntp client server-addr hostname index [INDEX]: Enable
no ntp client server-addr hostname index [INDEX]: Disable
© SAMSUNG Electronics Co., Ltd.
page 422 of 628
CHAPTER 9. IP Application
Parameter
Description
INDEX
Server index (range: 1-5)
Configure the version of a server that a NTP client will refer to. (Use a default value 1 if it
is not configured.)
ntp client server-addr hostname version [1-4]: Enable
no ntp client server-addr hostname version [1-4]: Disable
[Configuring based on IP address]
Enable or disable.
ntp client server-addr ip : Enable
no ntp client server-addr ip : Disable
Configure the index of a server that a NTP client will refer to. (Use a default value 1 if it is
not configured.)
ntp client server-addr ip index [1-5]: Enable
no ntp client server-addr ip index [1-5]: Disable
Configure the version of a server that a NTP client will refer to. (Use a default value 1 if it
is not configured.)
ntp client server-addr ip version [1-4]
no ntp client server-addr ip version [1-4]
You can proceed with configurations simultaneously as shown below.
ntp client server-addr hostname index [1-5] version [1-4]
ntp client server-addr hostname version [1-4] index [1-5]
ntp client server-addr ip index [1-5] version [1-4]
ntp client server-addr ip version [1-4] index [1-5]
no ntp client server-addr hostname index [1-5] version [1-4]
no ntp client server-addr hostname version [1-4] index [1-5]
no ntp client server-addr ip index [1-5] version [1-4]
no ntp client server-addr ip version [1-4] index [1-5]
© SAMSUNG Electronics Co., Ltd.
page 423 of 628
CHAPTER 9. IP Application
[NTP Server Configuration]
The NTP server configuration is as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure a NTP server.
ntp server enable: Configures a NTP server.
no ntp server enable: Disables a NTP server.
[Checking NTP Configuration Status]
To check the status of a NTP client or server, enter the ‘show ntp’ command.
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
The NTP initial window is shown below.
Figure 228. NTP client configuration
The Enable/Disable of a NTP server can be performed using a radio box.
You can configure polling interval enable/disable of a NTP client and also configure the
polling interval during enabling. The range of polling interval is 3-14.
Click the or button to add or delete a NTP proxy server. Click the
button to configure a specific ‘Server IP’ or ‘Server DOMAIN NAME’ that will be used by
a NTP proxy.
© SAMSUNG Electronics Co., Ltd.
page 424 of 628
CHAPTER 9. IP Application
9.3
FTP/sFTP
The FTP is a network service for file transmission. The APC support the client and server
function for FTP and sFTP (Secure FTP).
Configuration using CLI
[SFTP Server Configuration]
The secure FTP server configuration is as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Enable or disable the sFTP server.
sftp-server enable: Enable
no sftp-server enable: Disable
3)
Enter as follows to change a user’s ID and password.
sftp-server chguser [ID] [PASSWORD]
Parameter
Description
ID
User ID of a server
PASSWORD
User password of a server
4) To check the status of sFTP server, enter the ‘show sftp-server’ command.
[FTP Server Configuration]
1) Go to configure mode of CLI.
WEC8500# configure terminal
2)
Enable or disable the sFTP server.
ftp-server enable: Enable
no ftp-server enable: Disable
3)
Enter as follows to change a user’s ID and password.
ftp-server chguser [ID] [PASSWORD]
Parameter
Description
ID
User ID of a server
PASSWORD
User password of a server
© SAMSUNG Electronics Co., Ltd.
page 425 of 628
CHAPTER 9. IP Application
4) To change the idle timeout, enter the command below. The unit of timeout is minutes
and the default value is 15 minutes.
ftp-server idle-timeout [timeout]
5) To check the status of FTP server, enter the ‘show ftp-server’ command.
[Using as Client]
Using the following commands, you can download or upload a file using a FTP/sFTP client.
file download
file upload
A usage example is provided below.
File download using a sFTP client
WEC8500# file download samsung Samsung 90.90.21.108 wec8500 wec8500
sftp
File upload using a sFTP client
WEC8500# file upload samsung Samsung 90.90.21.108 wec8500 wec8500 sftp
File download using a FTP client
WEC8500# file download samsung Samsung 90.90.21.108 wec8500 wec8500
File upload using a FTP client
WEC8500# file upload samsung Samsung 90.90.21.108 wec8500 wec8500
© SAMSUNG Electronics Co., Ltd.
page 426 of 628
CHAPTER 9. IP Application
Configuration using Web UI
To configure the FTP/SFTP server configuration, in the menu bar of ,
select and then select the menu in the sub-menus.
Figure 229. FTP/SFTP server configuration
The FTP and SFTP can be configured using the Enable/Disable radio box.
For FTP, you can configure a port number that will be used for FTP by using ‘PORT’ and
can change the user name and password of a FTP server by entering ‘USER’,
‘PASSWORD’, or ‘CONFIRM PASSWORD’. Enter an idle timeout value in ‘IDLE
TIMEOUT’.
Also for SFTP, you can change the user name and password of a SFTP server by entering
‘USER’, ‘PASSWORD’, or ‘CONFIRM PASSWORD’.
© SAMSUNG Electronics Co., Ltd.
page 427 of 628
CHAPTER 9. IP Application
9.4
Telnet/SSH
The telnet or Secure Shell (SSH) is an Internet protocol that helps login to another
computer in a network or connects to a virtual remote system. Using telnet or SSH, you can
connect to another computer while staying at a current computer.
Because the SSH can access a remote system and transmit an encrypted message by using
public key-based encryption method, it provides better security.
Configuration using CLI
[Telnet Server Configuration]
The Telnet server configuration is as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
3)
Enable or disable the telnet service. If you configure the telnet service, you can use the
APC as a telnet server.
telnet-server enable: Enable
no telnet-server enable: Disable
If you configure the telnet service, specify the port number of telnet server.
telnet-server port [PORT_NUMBER]
Parameter
Description
PORT_NUMBER
Port number to configure (range: 1-65535)
[SSH Server Configuration]
The SSH server configuration is as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Enable or disable the SSH server.
ssh-server enable: Enable
no ssh-server enable: Disable
3)
Specify the port number of SSH server.
ssh-server port [PORT_NUMBER]
Parameter
Description
PORT_NUMBER
Port number to configure (range: 1-65535)
© SAMSUNG Electronics Co., Ltd.
page 428 of 628
CHAPTER 9. IP Application
[Checking Server Configuration Status]
To check the status of telnet or ssh server, enter the following command. You can retrieve
the configured port number as well as server status.
show ssh-server: Retrieves the status of SSH server
show telnet-server: Retrieves the status of telnet server
[Using as Client]
By using the APC as a telnet or SSH client, you can connect to a server.
Enter as follows in CLI.
telnet [IP_ADDRESS] [PORT_NUMBER]
ssh [IP_ADDRESS] [ID] [PORT_NUMBER]
Parameter
Description
IP_ADDRESS
IP address or domain name of a server to connect
ID
login ID
PORT_NUMBER
Port number (range: 1-65535)
If the port number is not entered, its default is shown below.
- telnet: 23
- ssh: 22
Configuration using Web UI
To configure the Telnet/SSH server configuration, in the menu bar of , select and then select the menu in the submenus.
Figure 230. Telnet/SSH server configuration
You can configure the service by using the Enable/Disable radio box of ‘TELNET
SERVICE’ or ‘SSH SERVICE’.
You can configure the port number of service by using ‘TELNET PORT’ or ‘SSH PORT’.
By using ‘SESSION TIMEOUT’, you can configure the session timeout of TELNET or
SSH in min. and can also configure maximum number of sessions by using ‘MAXIMUM
NUMBER OF SESSIONS’.
© SAMSUNG Electronics Co., Ltd.
page 429 of 628
CHAPTER 9. IP Application
9.5
Utilities
The APC provides the functions such as ping, traceroute, or tcpdump to check a network
and its problems.
[ping]
Used to check network connection status.
ping [IP_ADDRESS]
[traceroute]
Used to check a route path.
traceroute [IP_ADDRESS]
[tcpdump]
Used to check the packet of a specific interface.
tcpdump [INTERFACE_NAME]
© SAMSUNG Electronics Co., Ltd.
page 430 of 628
CHAPTER 10. System Management
CHAPTER 10. System Management
In this chapter, the various functions used by an operator to manage the system and
troubleshooting method are described. In addition, the configurations required for system
operation such as system configuration management, resource management, alarm
management, and package management, etc. and checking methods are described.
10.1 SNMP Configuration
10.1.1 SNMP Community
To use an external management server or to manage the system through a web server after
initial system installation, you must configure the SNMP community using CLI.
When creating the SNMP community, you can restrict configuration privilege by allocating
the access right such as read-only or read-write and can also restrict an IP to connect.
You can configure maximum 10 SNMP communities.
Configuration using CLI
To add a SNMP community, execute the command as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Use the ‘snmp community’ command to add a SNMP community.
snmp community [COMMUNITY_NAME] [ACCESS] [IP_VERSION]
[IP_ADDRESS] [NET MAST]
Parameter
Description
COMMUNITY_NAME
Name of a community to add
ACCESS
Access privilege (rw/ro)
- rw: read-write privilege
- ro: read-only privilege
IP_VERSION
IP address version type (v4/v6)
IP_ADDRESS, NETMAST
IP address area that can be connected
3) To check the created SNMP community, use the ‘show snmp community’ command.
© SAMSUNG Electronics Co., Ltd.
page 431 of 628
CHAPTER 10. System Management
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. When you click the button in
the Community window, the community creation window is displayed. When you enter a
configuration value and click the button, the configuration is applied.
Figure 231. Adding SNMP community
10.1.2 SNMP Trap
All the alarms of the APC system are basically transmitted to outside through the SNMP
trap. Therefore, to receive a system alarm from an external management server, the server
address must be registered as a trap target. The trap supports v1/v2.
Configuration using CLI
To add a SNMP trap target, execute the command as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Add a SNMP trap target.
snmp trap [TRAP_VERSION] [COMMUNITY_NAME] [IP_VERSION]
[IP_ADDRESS] [PORT_NUMBER]
Parameter
Description
TRAP_VERSION
Trap version (v1/v2)
COMMUNITY_NAME
Name of a community to be transmitted
IP_VERSION
IP address type (v4/v6)
IP_ADDRESS
IP address to which a trap will be transmitted
PORT_NUMBER
Port number to which a trap will be transmitted (default: 162)
3) To check the added trap target, use the ‘show snmp trap’ command.
© SAMSUNG Electronics Co., Ltd.
page 432 of 628
CHAPTER 10. System Management
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
When you click the button in the Trap Receiver window, the trap creation window
is displayed. When you enter a configuration value and click the button, the
configuration is applied.
Figure 232. SNMP trap configuration
© SAMSUNG Electronics Co., Ltd.
page 433 of 628
CHAPTER 10. System Management
10.2 System Management
10.2.1 Retrieving System Information
Retrieving with CLI
By using the ‘show system info’ command, you can check the system configuration
information of the APC system such as version information, memory information, disk
information, temperature sensor and fan status, etc.
The execution results of the command in WEC8500 are as follows:
WEC8500/configure# show system info
----------------------------------------------------Item
System Info
----------------------------------------------------System Info :
model type
WEC8500
system description
Samsung AP Controller
board version
0.1
cpld version
0.5
system mac address
00:7e:37:00:1e:70
system total memory
16046580 KBytes
system total disk
13520032 KBytes
Temperature Sensor Status
cpu upside sensor
cpu downside sensor
board sensor
OK
OK
OK
Fan Status :
fan[0]
fan[1]
fan[2]
fan[3]
OK
OK
OK
OK
Power Supply Status :
Power Supply[0]
Equipped
Status
OK
Power Supply[1]
Not Equipped
Status
-----------------------------------------------------
© SAMSUNG Electronics Co., Ltd.
page 434 of 628
CHAPTER 10. System Management
The execution results of the command in WEC8050 are as follows:
WEC8050# show system info
----------------------------------------------------Item
System Info
----------------------------------------------------System Info :
model type
WEC8050
system description
Samsung AP Controller
board version
0.0
cpld version
0.1
serial number
system mac address
00:7e:37:00:21:d4
system total memory
4855272 KBytes
system total disk
12191593 KBytes
Temperature Sensor Status :
CPU sensor1
OK
CPU sensor2
OK
Fan Status :
fan[0]
OK
fan[1]
OK
-----------------------------------------------------
The descriptions of the output parameters are as follows:
[System Info]
Parameter
Description
model type
Product model name
system description
Product type
board version
Hardware version of a board
cpld version
System cpld version
system mac address
System MAC address
system total memory
System total memory capacity
system total disk
System total disk capacity
[Temperature Sensor Status]
Parameter
Description
cpu upside sensor
CPU upside sensor status (OK, NOK)
cpu downside sensor
CPU downside sensor status (OK, NOK)
board sensor
Board sensor status (OK, NOK)
© SAMSUNG Electronics Co., Ltd.
page 435 of 628
CHAPTER 10. System Management
[Fan Status]
For WEC8500:
Parameter
Description
Fan [0]~[3]
Fan operation status (OK, NOK)
For WEC8050:
Parameter
Description
Fan [0]~[1]
Fan operation status (OK, NOK)
[Power Supply Status]
The WEC8500 has dual detachable power module as shown below.
Parameter
Description
Power Supply [0]~[1]
Whether a power module is equipped (Equipped, Not Equipped)
Status
Power module operation status (OK, NOK)
The WEC8050 has only one power module as shown below.
Parameter
Description
Power Supply Status
Power module operation status (OK, NOK)
© SAMSUNG Electronics Co., Ltd.
page 436 of 628
CHAPTER 10. System Management
Retrieving with Web UI
In the menu bar of , select and then select the
menu in the sub-menus. It provides a wide range of information, status
retrieving event and alarm retrieving function of the WEC8500 system.
Figure 233. System information
© SAMSUNG Electronics Co., Ltd.
page 437 of 628
CHAPTER 10. System Management
It provides various information, status retrieving event and alarm retrieving function of the
WEC8050 system.
© SAMSUNG Electronics Co., Ltd.
page 438 of 628
CHAPTER 10. System Management
10.2.2 System Reboot
There is a command that can reboot the system. Rebooting can be reserved and you can
cancel or retrieve the reservation.
Configuration using CLI
Use the ‘reboot’ command to reboot the system.
WEC8500# reboot
Use the ‘reboot in HH:MM:SS’ command to reserve system reboot. Once the reservation is
completed, the system is rebooted after a specified time (HH:MM:SS).
WEC8500# reboot in 12:00:00
Do you want to save the configuration? (y/n): y
Do you want to restart the system? (y/n): y
Notice: The system WILL reboot in 12:00:00.
WEC8500# show reboot schedule
The reboot has scheduled in 11:58:41.
To cancel the reservation, enter the ‘no reboot’ command.
WEC8500# no reboot
Configuration using Web UI
To configure a reboot related function, in the menu bar of , select
and then select the menu in the sub-menus.
The Reboot window is shown below.
[APC]
Figure 234. Reboot (APC)
© SAMSUNG Electronics Co., Ltd.
page 439 of 628
CHAPTER 10. System Management
[AP]
Figure 235. Reboot (AP)
© SAMSUNG Electronics Co., Ltd.
page 440 of 628
CHAPTER 10. System Management
10.3 System Resource Management
10.3.1 Retrieving System Status
Retrieving with CLI
By using the ‘show system’ command, you can check the status of each system resource
such as CPU load, memory usage, disk usage, Fan RPM level, or system temperature, etc.
show system cpu: Retrieves CPU load. If there are several cores, the CPU load of each
core is displayed.
show system memory: Retrieves memory usage.
show system disk: Retrieves disk usage.
show system fan: Retrieves system fan speed (RPM level range: 0-3)
show system temp: Retrieves system temperature (°C).
The result of system status retrieval using each command is as follows:
[CPU Load]
The retrieving CLI execution result of WEC8500 is as follows:
WEC8500# show system cpu
Average CPU usage (%)
control plane : 3.84
data plane
: 0.00
WEC8500# show system cpu detail
----------------------------------------------------------------Average CPU usage
(%)
control plane
2.12
data plane
0.00
----------------------------------------------------------------Detail CPU usage
(%)
control plane
[10.00] [04.23] [00.00] [02.74] [00.00] [00.00] [00.00] [00.00]
data plane
[00.00] [00.00] [00.00] [00.00] [00.00] [00.00] [00.00] [00.00]
[00.00] [00.00] [00.00] [00.00] [00.00] [00.00] [00.00] [00.00]
The retrieving CLI execution result of WEC8050 is as follows:
WEC8050# show system cpu
Average CPU usage (%)
control plane
: 39.43
data plane
: 0.01
WEC8050# show system cpu detail
----------------------------------------------------------------Average CPU usage
(%)
control plane
21.97
data plane
0.01
© SAMSUNG Electronics Co., Ltd.
page 441 of 628
CHAPTER 10. System Management
----------------------------------------------------------------Detail CPU usage
(%)
control plane
[23.29] [25.71] [16.90]
data plane
[00.01] [00.00] [00.00]
[Memory usage]
WEC8500# show system
Total
Memory :
Used
Memory :
Available Memory :
Reserved
Memory :
memory
7657960
3341868
4316092
8900608
KBytes
KBytes
KBytes
Kbytes
[Disk usage]
WEC8500# show
Total Disk
Used
Disk
Free
Disk
system disk
: 13520032 KBytes
: 4338296 KBytes
: 9181736 KBytes
[Fan RPM Level]
The retrieving CLI execution result of WEC8500 is as follows:
WEC8500# show system fan
FAN ID
rpm Level(0-3)
------- -------------FAN[0]
1 level
FAN[1]
1 level
FAN[2]
1 level
FAN[3]
1 level
The retrieving CLI execution result of WEC8050 is as follows:
WEC8050# show system fan
FAN ID
rpm Level(0-3)
------- -------------FAN[0]
1 level
FAN[1]
1 level
© SAMSUNG Electronics Co., Ltd.
page 442 of 628
CHAPTER 10. System Management
[System Temperature (°C)]
The retrieving CLI execution result of WEC8500 is as follows:
WEC8500# show system temp
Sensor Location
Temperature
------------------------CPU sensor 1
33
CPU sensor 2
38
Board
29
The retrieving CLI execution result of WEC8050 is as follows:
WEC8050# show system temp
Sensor Location
Temperature(‘C)
----------------------------CPU sensor 1
45
CPU sensor 2
52
Retrieving with Web UI
In the menu bar of , select and then select the
menu in the sub-menus. For more information about detail window, see
‘10.2.1 Retrieving System Information’.
© SAMSUNG Electronics Co., Ltd.
page 443 of 628
CHAPTER 10. System Management
10.3.2 Retrieving and Configuring Threshold
If each resource of the system exceeds its configured threshold, there occurs an alarm.
The APC helps an operator check and configure each threshold.
Configuration using CLI
To check each threshold, use the below command.
show system threshold cpu: CPU load (%)
show system threshold memory: Memory usage (%)
show system threshold disk: Disk usage (%)
show system threshold fan: Fan RPM level
show system threshold temp: Retrieves system temperature (°C).
To change a threshold related to CPU load or memory usage, enter the command as
follows:
system monitor cpu threshold [THRESHOLD]: Configures the CPU load threshold.
system monitor memory threshold [THRESHOLD]: Configures the memory usage
threshold.
Parameter
Description
THRESHOLD
Threshold to configure (%)
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
You can retrieve and configure a threshold at which CPU load, disk usage, temperature
alarm, memory usage, or fan alarm occurs. Enter a value for each item, and click the
button to make the configuration applied.
Figure 236. Configuring SNMP alarm threshold
© SAMSUNG Electronics Co., Ltd.
page 444 of 628
CHAPTER 10. System Management
10.4 Managing Alarm and Event
The system alarms and events are saved into a system log and transmitted to an external
server according to the filtering policy. An alarm is managed in terms of occurrence and
release and an event is managed in the report format.
The alarm and event are managed according to group or level. Each group or level is
classified into the following item. You can select an item to retrieve.
Alarm, event group
Group
Description
system
Retrieves system alarm or event.
pm
Retrieves performance monitoring alarm or event.
ap
Retrieves AP related alarm or event.
wlan
Retrieves WLAN related alarm or event.
wifi
Retrieves WI-FI related alarm or event.
security
Retrieves security related alarm or event.
network
Retrieves network related alarm or event.
interface
Retrieves interface related alarm or event.
se
Retrieves system engine related alarm or event.
list
Retrieves alarm or event list information.
Alarm level
Level
critical
Description
Retrieves a critical alarm. A critical alarm is a system log that
could give a critical effect to a service.
major
Retrieves a major alarm. A major alarm is a system log that
could give a major effect to a service.
minor
Retrieves a minor alarm. A minor alarm is a system log that
could give a minor effect to a service.
© SAMSUNG Electronics Co., Ltd.
page 445 of 628
CHAPTER 10. System Management
10.4.1 Retrieving Current Alarm
All the system alarms are basically recorded into a system log. The procedure of retrieving
current alarms is as follows:
Retrieving with CLI
To retrieve current alarms, execute the command as follows:
WEC8500# show alarm list all
1 network
2012-12-17 09:56:13 MAJ APC ge8 1301 NET Link dn
AdminStatus[up] OperStatus[down]
2 network
2012-12-17 09:56:13 MAJ APC xe1 1301 NET Link dn
AdminStatus[up] OperStatus[down]
3 network
2012-12-17 09:56:13 MAJ APC xe2 1301 NET Link dn
AdminStatus[up] OperStatus[down]
…
To selectively retrieve a group or level, execute the command as follows:
WEC8500# show alarm list group network
1 network
2012-12-17 09:56:13 MAJ APC ge8 1301 NET Link dn
AdminStatus[up] OperStatus[down]
WEC8500# show alarm history level major
1 network
2012-12-17 09:56:13 MAJ APC ge8 1301 NET Link dn
AdminStatus[up] OperStatus[down]
Retrieving with Web UI
To retrieve the list of current alarms, in the menu bar of , select
and then select the menu in the sub-menus.
Figure 237. Current alarm
© SAMSUNG Electronics Co., Ltd.
page 446 of 628
CHAPTER 10. System Management
10.4.2 Retrieving History
Retrieving with CLI
The APC retrieves the history of alarm and event using the following command.
[Alarm History]
WEC8500# show alarm history all
1 ap
2012-12-20 13:13:25 MAJ AP_f4:d9:fb:24:cf:80 r=1 AP RADIO
CARD TX FAIL Clear radio(1)
2 ap
2012-12-20 13:13:25 MAJ AP_f4:d9:fb:24:cf:80 r=2 AP RADIO
CARD TX FAIL Clear radio(2)
3 ap
2012-12-20 13:13:25 MAJ AP_f4:d9:fb:24:cf:80 r=1,w=1 BSS
…
Because all the alarms are managed per group or level, you can retrieve it selectively using
the following command.
WEC8500# show alarm history group system
1 system
2012-12-21 17:49:45 MAJ APC core2 CPU Load Alarm Declare
LOAD(100.00)
…
WEC8500# show alarm history level major
1 system
2012-12-21 17:49:45 MAJ APC core 2 CPU Load Alarm Declare
LOAD(100.00)
…
[Event History]
You can retrieve event information using the following command.
WEC8500# show event
1 system
2012-08-31 13:59:46 NOT APC MGMT User Login ID=samsung,
IP=192.168.0.91
2 system 2012-08-31 13:48:33 NOT SWM:system Boot Complete …
An event is managed per group and you can retrieve it selectively using the following
command.
WEC8500# show event group interface
1 interface 2012-08-31 13:48:32 NOT APC Index[1] Name[ge1] IF Admin No
Shut AdminStatus[up] OperStatus[up]
…
© SAMSUNG Electronics Co., Ltd.
page 447 of 628
CHAPTER 10. System Management
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus. It provides status retrieving event and alarm
retrieving function.
Figure 238. History
© SAMSUNG Electronics Co., Ltd.
page 448 of 628
CHAPTER 10. System Management
10.4.3 External Transmission Configuration
All the alarms and events in the system are transmitted to outside through the SNMP trap
and syslog. If the alarm filter information is configured, only filtered alarm is transmitted to
an external management server.
10.4.4 Alarm Filter and Level Configuration
An alarm filter can be configured per group or level (severity). The filtered alarms are
transmitted to an external server through the SNMP trap and syslog.
Configuration using CLI
The procedure of alarm filter configuration is as follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
Configure group information.
WEC8500/configure# alarm group system
3)
Configure level information.
WEC8500/configure# alarm level major
4) To check the configured alarm filter information, use the ‘show alarm conf’ command.
© SAMSUNG Electronics Co., Ltd.
page 449 of 628
CHAPTER 10. System Management
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
You can retrieve the configuration related to alarm filter and alarm level.
Figure 239. Configuring alarm filter and level
© SAMSUNG Electronics Co., Ltd.
page 450 of 628
CHAPTER 10. System Management
10.5 Managing Traffic Performance
You can manage the traffic performance statistics information and accumulated data for the
APC system and the interface of each AP.
10.5.1 Managing History Information
When the traffic performance information management is enabled, the APC system creates
history information at every 5 minute. But, if the FTP server information is not configured,
the history information is not transmitted to outside although it is created.
Collecting information
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Configure the traffic performance information.
WEC8500/configure# stats-report enable
3)
Configure a FTP server to transmit history information.
stats-report target ip [IP_ADDRESS] port [PORT_NUMBER] id [ID] password
[PASSWORD] path [PATH]
Parameter
Description
IP_ADDRESS
IP address of a target server
PORT_NUMBER
Port number of a target server
ID
User ID of a target server
PASSWORD
User password of a target server
PATH
File storage path of a target server
4) To check the information of traffic performance information management, use the
‘show stats-report conf’ command.
5)
Configure so that the performance information is uploaded to the FTP server.
But, because the default is the ‘start’ status, this step may be skipped.
WEC8500/configure# stats-report upload start
© SAMSUNG Electronics Co., Ltd.
page 451 of 628
CHAPTER 10. System Management
Stopping information collection
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2)
‘Disable’ the traffic performance information management.
WEC8500/configure# no stats-report enable
3) To check the configured information, use the ‘show stats-report conf’ command.
10.5.2 Managing Real-time Information Collection
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2) To collect real-time information, execute the following command. At this time, you
must specify the name and status of an interface whose information will be collected.
stats-report current-stats [INTERFACE_NAME] [STATE]
Parameter
Description
INTERFACE_NAME
Name of an interface to collect or stop collection
STATE
Status of real-time information (start/stop)
- start: Starts real-time information collection
- stop: Stops or initializes the real-time information collection.
3) To check the entered information, use the ‘show stats-report conf’ command.
4) To check the information of a configured interface when the real-time information
collection is configured, execute the following command.
show stats-report current-stats [INTERFACE_NAME]
If the real-time information collection is suspended or initialized, you cannot check the
real-time information of the interface.
WEC8500/configure# show stats-report current-stats ge3
Error: This interface was not configured to gather statistics.
© SAMSUNG Electronics Co., Ltd.
page 452 of 628
CHAPTER 10. System Management
10.6 Managing License Key
The Samsung Electronics Common License Method (SLM) is applied to Version 1.5 or
newer of the APC system.
Therefore, SLM licensing is applied to new websites that are installed using Version 1.5 or
later.
However, if Version 1.4 is upgraded to Version 1.5, the existing license key is used without
any modification. The existing license which is not SLM must be installed and used also in
the case of expanding or reissuing the APC system.
In this document, license keys supported by Version 1.4 or later are referred to as ‘old
license keys’ and license keys supported by Version 1.5 or later are referred to as
‘Activation keys’.
These details are summarized in the table below.
Initially installed
Reinstalling the
version
license
APC Version 1.4
Expanding/reissuing
After an upgrade
Install the old license
Install the old license
Re-use the old license
Install the SLM
Install the SLM
Re-use the SLM license
license
license
or below
APC 1.5 or higher
If an APC system is shipped out without a license installed, only the following services are
offered:
System Model
Number of APs
VQM
Firewall
WEC8050
5 units connected
Not provided
Not provided
WEC8500
2 units connected
Not provided
Not provided
10.6.1 Managing SLM License (Activation) Key
An SLM activation key can have differences in regard to the number of manageable APs,
whether to support the VQM function, whether to support the firewall function, and the
period of use of a function.
Every system has a unique activation key and activation keys are provided in the form of
encrypted files.
To clear an SLM activation key installed in a system, the deactivation command needs to
be executed and after the execution of the command, a deactivation key is issued to notify
that clearing has been completed successfully.
© SAMSUNG Electronics Co., Ltd.
page 453 of 628
CHAPTER 10. System Management
Installation
Only two activation keys can be installed/registered in an APC system.
If two unexpired activation keys co-exist, available services are offered as shown
in the following example:
(Example)
- Activation Key 1: AP (100 units), VQM (Disable), Firewall (Disable)
- Activation Key 2: AP (50 units), VQM (Enable), Firewall (Disable)
- result: AP (100 units), VQM (Enable), Firewall (Disable)
Period of Use
Each activation key has its own information regarding the start and end times,
and if the current time is not within the set period, the activation key expires.
Application
An activation key only functions correctly after the system is rebooted after
deletion or installation of a key.
Configuration using CLI
To configure an activation key, first execute the following commands and enter license mode:
WEC8500# configure terminal
WEC8500/configure# system license
WEC8500/configure/system/license#
[Installing Activation Key]
When the system is shipped out, there is no registered license key. Therefore, you must
install the license key you received immediately after the first system installation. You can
install a license key directly or remotely using CLI.
activate-key [Fullpath filename]
Registers an activation key file. If a license key file exists in a specified folder, use the
license key file for registration.
When entering the file name of an activation key, you must enter the file name
including its full path.
[Clearing Activation Key]
no activate-key [the activation key’s license key]
Clears an activation key registered in the system.
You can view the license key information of an activation key in the ‘License’ field of
the activation key by executing the ‘show system license-key’ command.
After clearance, you can view information about the deactivation key in the ‘License
Key’ of the key after executing the ‘show system license-key’ command.
© SAMSUNG Electronics Co., Ltd.
page 454 of 628
CHAPTER 10. System Management
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
In the figure below, the ‘SLM License Key Status’ shows the installation and application
statuses of SLM activation keys.
In the ‘License Control’ section, the operator can select an activation key stored in their PC
and install it in the system.
In addition, the operator can also deactivate an installed activation key. The operator can
clear an installed activation key by selecting Deactivation in ‘License Control’ and then
entering the license key shown in ‘SLM License Key Status’.
Figure 240. SLM License Search and Configuration Window
© SAMSUNG Electronics Co., Ltd.
page 455 of 628
CHAPTER 10. System Management
10.6.2 Managing Old License Key
An old license key can differ in regard to the number of manageable APs, whether to
support the VQM function, whether to support the firewall function, and the period of use
of a function.
A license key is unique for each system and it consists of encrypted 53 characters.
A license key is distributed in a file or text format.
Installation
APC system can install/register only one official license key and one temporary
license key. A license key (temporary license Key) with time duration can be
installed only 3 times.
Use period
An official license key has no restriction on use period.
A temporary license key has a restriction on use period and the period can be 1,
30, or 60-day.
Apply
A license key becomes active only after system rebooting after the key is installed
or deleted.
Configuration using CLI
To configure a license key related function, go to license mode by executing the following
command.
WEC8500# configure terminal
WEC8500/configure# system license
WEC8500/configure/system/license#
[Installing License Key]
When the system is shipped out, basically there is no registered license key. Therefore, you
must install the license key you received right after the first system installation. You can
install a license key directly or remotely using CLI.
install-key: Registers a file. If a license key file exists in a specified folder, use the
license key file for registration. Once it is installed, the license key file is deleted from
the system.
install-key [LICENSE_KEY]: Direct registration
install-key [IP_ADDRESS] [PORT_NUMBER] [ID] [PASSWORD] [PATH]: Remote
registration
© SAMSUNG Electronics Co., Ltd.
page 456 of 628
CHAPTER 10. System Management
Parameter
Description
LICENSE_KEY
Issued license key
IP_ADDRESS
IP address
PORT_NUMBER
Port number
ID
login ID
PASSWORD
Password
PATH
Server path
[Deleting License Key]
You can delete a license key directly.
no install-key [LICENSE_KEY]
Parameter
Description
LICENSE_KEY
License key to delete
[Retrieving License Key Information]
To check the license key information, use the ‘show system license-key’ command.
===== Current System Status ======
Number of APs
: 2
VQM
: Disabled
Firewall
: Disabled
===== License Information ======
* Old License - Official License Key
License Key
: YNHSHPWP-5MNMTE04-UJHKDO4U-A2WGSBGXOJZ2MJ5R-7Z5DBYMT
MAC Address
: F4D9FB236C01
System Model
: Any
Lifetime
: Permanet
Number of APs
: 75
VQM
: Eanbed
Firewall
: Eanbed
Installation Time
: 00
[Analyzing License Key]
Before registering a license key to the system, you can check the functions supported by
the license key.
analyze-key [LICENSE-KEY]
Parameter
Description
LICENSE_KEY
License key
© SAMSUNG Electronics Co., Ltd.
page 457 of 628
CHAPTER 10. System Management
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
From the APC Version 1.5 and later, in respect of old license keys, the web UI does not
provide input/deletion functions and shows only whether they are installed properly.
In the figure below, ‘License Key Status’ is the section that shows whether old license keys
are installed properly and ‘Current System Status’ shows license information currently
applied to the system.
Figure 241. Old License Installation Check Window
© SAMSUNG Electronics Co., Ltd.
page 458 of 628
CHAPTER 10. System Management
10.7 Syslog Configuration
The system log (syslog) configuration is required to transmit an event, alarm, and system
log information to a target syslog server. You can configure maximum two target syslog
servers in the system and you can configure the IP address and port number independently.
In addition, because you can configure a filter level, only filtered log information is
transmitted to the syslog server.
Configuration using CLI
To transmit an alarm, event, and system log to the syslog server, executes the command as
follows:
1)
Go to configure mode of CLI.
WEC8500# configure terminal
2) To transmit an alarm, event, and system log information to the syslog server, specify
‘enable’ as a parameter.
WEC8500/configure# syslog enable
3)
Configure the IP address and UDP port of a target syslog server (The default of the
UDP port is ‘514’.).
WEC8500/configure# syslog add 192.168.0.91
WEC8500/configure# syslog add 192.168.0.99 udpport 510
4)
Configure a log level to filter.
WEC8500/configure# syslog level information
5) To check the configured syslog information, use the ‘show syslog conf’ command.
© SAMSUNG Electronics Co., Ltd.
page 459 of 628
CHAPTER 10. System Management
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
It provides syslog related configuration and retrieving function.
Figure 242. Syslog window
© SAMSUNG Electronics Co., Ltd.
page 460 of 628
CHAPTER 10. System Management
10.8 Upgrade
The APC provides the upgrade function and version checking function that applies a new
version of package when it is distributed.
10.8.1 Checking Package Version
You can check the version of a current system by using the following command.
show version
The following shows the execution results of the command:
WEC8500# show version
Samsung package version information
Primary (currently running)
ver
: 1.4.4.R
buildTime
: Fri Sep 6 06:08:35 2013
builder
: apcbuild
buildDir
: /home2/apcbuild/release/wec8500_1.4.4
Backup
ver
: 1.4.4.R
buildTime
: Fri Sep 6 06:08:35 2013
builder
: apcbuild
buildDir
: /home2/apcbuild/release/wec8500_1.4.4
Boot rom version information
ver
: GC15
10.8.2 System Upgrade
The APC does system upgrade using CLI and Web UI.
Configuration using CLI
Apply a new package to the system by using the following command.
1)
Go to configure mode of CLI.
WEC8500# configure terminal
WEC8500/configure#
2)
Perform upgrade by using a package.
package upgrade [FILE_NAME]
Parameter
FILE_NAME
Description
Package file to upgrade
The package must be located in the /user/package directory.
© SAMSUNG Electronics Co., Ltd.
page 461 of 628
CHAPTER 10. System Management
A usage example is provided below. When the upgrade is completed, the system is
rebooted to apply the package.
When executing the package upgrade command, the message recommending to save
the configuration file is displayed.
If you save the current configuration, operator can use it for any future version
downgrade.
If there is a configuration file saved during previous upgrade, the message asking
whether you are going to use the file is displayed.
WEC8500/configure# package upgrade wec8500_1.4.4.R.bin
Notice: It is recommended that you save the configuration before
upgrade.
You can reapply the configuration, if you need to downgrade.
Do you want to save the configuration? (y/n): y
Previous configuration file is existed. Do you want to use it?
(y/n): y
Package Validation check ... success
Package Upgrade ............................................... done
Success
3)
If package upgrade fails, upgrade is cancelled.
Possible causes and the troubleshooting methods are described below.
Possible Cause
Error Message
Troubleshooting
File does not exist
Error: no exist ‘wec8500_
Download the package to be upgraded again as
1.3.11.R.bin’ file
the package error has occurred during the
Checksum error
Error: Package validation
package downloading.
on the file
check
Upgrade
Error: Internal error
1)
terminated due to
Execute the ‘show process status’ command
to check the process status.
2)
an internal error
Execute the ‘show system cpu detail’
command to check the CPU status.
3)
Transmit the logs above to the Samsung
Technical Support.
Upgrade
saving the configuration-
terminated due to
failed (time-out)
timeout
1)
Execute the ‘show process status’ command
to check the process status.
2)
Execute the ‘show system cpu detail’
command to check the CPU status.
3)
Transmit the logs above to the Samsung
Technical Support.
© SAMSUNG Electronics Co., Ltd.
page 462 of 628
CHAPTER 10. System Management
4)
After system rebooting, check if the new package is applied to the system.
WEC8500# show reboot cause
Reboot Cause: Block: Upgrade/ Code: Package Upgrade
WEC8500# show version
Samsung package version information
Primary (currently running)
ver
: 0.7.1.R
buildTime
: Mon Aug 20 11:35:43 2012
builder
: gampul
buildDir
: /data/nome/ymkim/apc_0817
Backup
ver
: 0.7.1.R
buildTime
: Mon Aug 20 11:35:43 2012
builder
: gampul
buildDir
: /data/nome/ymkim/apc_0817
Boot rom version information
ver
: unknown
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
Figure 243. Package upgrade (APC)
© SAMSUNG Electronics Co., Ltd.
page 463 of 628
CHAPTER 10. System Management
10.9 Configuration Management
The APC supports the following functions for configuration management.
Saves the current configuration information.
Exports/imports the current configuration information (import/export).
Initializes system
Configuration using CLI
To save the current configuration information in the system, execute the command as
follows:
WEC8500# save local
To transmit the current configuration information in the system to outside, execute the
command as follows: When you execute the command, the configuration information is
compressed into the entered ‘FILENAME’ as a file.
WEC8500# export [FILENAME]
In addition, to apply a file (‘FILENAME’) from outside to the current system, execute the
command as follows:
WEC8500# import [FILENAME]
To initialize the current configuration information to the factory default, execute the
command as follows: If the ‘full-erase’ parameter is not entered, only the configuration
information is initialized.
WEC8500# factory-reset (full-erase)
© SAMSUNG Electronics Co., Ltd.
page 464 of 628
CHAPTER 10. System Management
Configuration using Web UI
In the menu bar of , select and then select the
menu in the sub-menus.
Figure 244. DB Backup/Restore
In the DB backup/restore window, enter FILE NAME and click the button to
create the configuration information as a file or apply an external configuration information
file. The STATUS shows the execution results of backup/restore function.
© SAMSUNG Electronics Co., Ltd.
page 465 of 628
CHAPTER 10. System Management
10.10 Debug and Diagnosis
10.10.1 Process
The APC can retrieve the status of an active process in the system and an error associated
with each process.
Retrieving the Process Status
WEC8500# show processes
Processes Info.
Status: D - usually IO, R - Running, S - Sleep
T - Stop, X - Dead, Z - Zombie
up - Active, down - Inactive
dis - Disable
id
-0
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
name
-------swmmon
evm
evmlogd
db
license
pcap
filemgr
filemib
cm
iim
iimp
nsm
mstpd
pimd
ripd
ospfd
lacpd
fqm
imi
zebosm
awmb
apm
capwap
hostapd
eqm
© SAMSUNG Electronics Co., Ltd.
pid
---6222
1759
1760
1807
1838
1839
1840
1841
1846
1847
1850
1902
1903
1904
1905
1906
1907
1909
1942
2188
2226
2385
2386
2387
2388
activationTime
--------------2012-08-31 14:38:21
2012-08-31 13:47:08
2012-08-31 13:47:08
2012-08-31 13:47:14
2012-08-31 13:47:34
2012-08-31 13:47:34
2012-08-31 13:47:34
2012-08-31 13:47:34
2012-08-31 13:47:34
2012-08-31 13:47:34
2012-08-31 13:47:34
2012-08-31 13:47:35
2012-08-31 13:47:35
2012-08-31 13:47:35
2012-08-31 13:47:35
2012-08-31 13:47:35
2012-08-31 13:47:35
2012-08-31 13:47:35
2012-08-31 13:47:35
2012-08-31 13:47:55
2012-08-31 13:48:00
2012-08-31 13:48:30
2012-08-31 13:48:30
2012-08-31 13:48:30
2012-08-31 13:48:30
status reStart
------ -----up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
up(S)
page 466 of 628
CHAPTER 10. System Management
Checking process error log
You can check the log of errors that occurred in a current process
WEC8500# show processes log
id date
----- -------------------2509. 2012-12-21 15:59:50
2510. 2012-12-21 15:59:50
2511. 2012-12-21 15:59:50
2511. 2012-12-21 15:59:50
2512. 2012-12-21 15:59:50
2513. 2012-12-21 15:59:50
2514. 2012-12-21 15:59:50
2515. 2012-12-21 15:59:50
2516. 2012-12-21 15:59:50
2517. 2012-12-21 15:59:50
2518. 2012-12-21 15:59:50
2519. 2012-12-21 15:59:50
2520. 2012-12-21 15:59:50
2520. 2012-12-21 15:59:50
2521. 2012-12-21 15:59:50
2522. 2012-12-21 15:59:50
name
pid
----------- ---iimp
1800
sipalg
2377
apclt
2375
apccluster
2217
evmlogd
1766
imi
1893
wids
2293
ipwlogd
2416
nfm
2417
httprd
2379
fqm
1882
irfm
2297
filemib
1770
pm
2376
salh
2415
guestService 2294
signal
backtrace
------------ ---------SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15) traced
SIGTERM(15)
reason
--------signal
signal
signal
signal
signal
signal
signal
signal
signal
signal
signal
signal
signal
signal
signal
In addition, you can check the detail information corresponding to the ‘id’ of each error log
by using the following command.
WEC8500# show processes log id 15
id date
name
pid signal
backtrace
reason
----- ------------------- ------------ ----- ----------- ----------- --------15. 2012-08-02 18:39:08 eqm
2311 NONE(0)
coredump
detail (additional info.)
core_dump (comm:eqm, signr:11, pid:2311)
detected unixtime: 1343900344 -> Thu Aug 2 18:39:04 2012
id date
name
pid signal
backtrace
reason
----- ------------------- ------------ ----- ----------- ----------- --------15. 2012-08-09 12:37:09 eqm
30103 NONE(0)
coredump
detail (additional info.)
core_dump (comm:eqm, signr:11, pid:30103)
© SAMSUNG Electronics Co., Ltd.
page 467 of 628
CHAPTER 10. System Management
10.10.2 Retrieving Crash Information
When a critical problem occurs in the system platform during operation, the APC saves
important system information at that time to provide the crash information that can be used
for post mortem analysis. The crash information includes the Crash Detect and Report
(CDR) information that has the context about the crash status and the core dump
information that has the memory dump about the crash status of a user process.
10.10.2.1 Managing CDR Information
To manage the CDR information, the system provides the following function.
Retrieving CDR Information
Exports CDR history information
Deletes CDR history information
[Retrieving Summarized CDR History Information]
To retrieve the entire history information for all the rebooting including rebooting due to a
crash, enter the ‘show debug reboot summary’ command.
show debug reboot summary
WEC8500# show debug reboot summary
======================================================================
====================================
ID
EVENT_NAME
EVENT_DESCRIPTION
REBOOT_TIME
======================================================================
====================================
0001 DIE
DIE_VAL[1] - Unhandled kernel unaligned access
03:56:00, Aug 22 2012
0000 PANIC
softlockup: hung tasks
03:51:51, Aug 22 2012
[Retrieving Detail CDR History Information]
To check the detail crash information, execute the ‘show debug reboot info [id/all]’
command. By using this command, you can view the key information including a kernel
log that exists before the system is rebooted due to a critical crash. The description of each
parameter is shown below.
show debug reboot info [DATA]
Parameter
DATA
Description
Selects crash information (id/all)
- id: A specific CDR ID value to view
- all: Retrieve all the CDR histories
© SAMSUNG Electronics Co., Ltd.
page 468 of 628
CHAPTER 10. System Management
If no parameter is entered, the most recent reboot information is retrieved.
WEC8500# show debug reboot info
######################################################################
[REBOOT_SUMMARY]======================================================
ID
EVENT NAME
EVENT DESC
REBOOT TIME
0001
DIE
DIE_VAL[1] - Unhandled kernel unaligned access
03:56:00, Aug 22 2012
[KERNEL_LOG]==========================================================
console [cdr-1] enabled
Creating 1 MTD partitions on “nor0”:
0x000000dc0000-0x000000fc0000 : “crash_raw”
CDR connector initialized (ID = {8.1})
…
…
[Exporting CDR history information]
The crash information of system can be extracted to text file for post analysis.
By entering the ‘show debug reboot export’ command, you can send the system crash
information created in a text file to outside using the ‘transfer’ command.
show debug reboot export
[Deleting CDR history information]
To delete CDR information remaining in a device, execute the following command.
debug reboot erase [DATA]
Parameter
DATA
Description
If there is no reboot information selection (id/all)
option, the most recent system reboot information is deleted.
- id: A specific CDR ID value to delete
- all: Delete all the CDR histories
© SAMSUNG Electronics Co., Ltd.
page 469 of 628
CHAPTER 10. System Management
10.10.2.2 Retrieving Core Dump Information
Use the ‘show debug coredump summary’ command to retrieve the status of core dump.
WEC8500# show debug coredump summary
CORE_DUMP
enable
DUMP_QUOTA
1024 (MB)
CORE_SIZE
204800 (KB)
POLL_PERIOD
60 (sec)
THRESHOLD
80 (%)
----------------------------------------------------------------------------------------------------------------------PROCESS
SIGNAL
TIME
CORE_FILE
----------------------------------------------------------------------------------------------------------------------eqm
Segmentation fault
Wed Aug 22 03:05:16 2012 core-eqm11-1345572316-2437.gz
hostapd
Aborted Wed Aug 22 03:06:02 2012 core-hostapd-61345572362-2436.gz
nsm
Bus error Wed Aug 22 03:07:21 2012 core-nsm-101345572441-2013.gz
© SAMSUNG Electronics Co., Ltd.
page 470 of 628
CHAPTER 10. System Management
10.11 File Management
The APC provides the file management functions of copying, moving, or retrieving a file
and also file download and upload. In addition, it checks the integrity of a package file and
provides version retrieving method.
To use a file related command, go to the file mode first. The command is basically used as
follows:
1)
Go to the file mode of CLI.
WEC8500# file
WEC8500/file#
2)
Use each command. The following commands are used in the file mode.
Command
Description
cd
Changes the current directory.
copy
Copies a file.
df
Retrieves the brief information of a storage media connected to the system.
download
Downloads a file using FTP protocol.
dump
Shows the content of a file.
ls
Retrieves the list of files or directories in a specified path.
move
Changes the name of a file.
pwd
Shows the current directory.
remove
Deletes a file.
upload
Uploads a file using FTP protocol.
verify
Checks the integrity of a package file and shows the result.
version
Shows the information of a package file.
10.11.1 Retrieving Configuration of Current Directory
The file management command supports both a relative path and an absolute path based on
the current (working) directory. The current directory is a path that is a reference of a
relative path. For example, if the current directory is ‘disk:/’, the ‘copy test1 test2’ is the
same as the ‘copy disk:/test1 disk:/test2’ command.
To retrieve a current directory, enter the ‘pwd’ command.
WEC8500/file# pwd
disk:/
© SAMSUNG Electronics Co., Ltd.
page 471 of 628
CHAPTER 10. System Management
To change a directory, use the ‘cd [TARGET_DIR]’ command.
WEC8500/file# cd etc
WEC8500/file# pwd
disk:/etc
Parameter
Description
TARGET_DIR
Name of a directory to change
10.11.2 Retrieving Directory List
To retrieve a file or directory in a specific directory, use the ‘ls’ command. If you enter only
‘ls’, all the contents in the current directory are displayed.
To check only a specific directory, enter the ‘ls [TARGET_DIR]’ command.
A usage example is provided below.
WEC8500/file# ls
Current working directory: disk:/
directory
4.0K
Jul
directory
16K
Jan
directory
4.0K
Jun
directory
4.0K
Jun
directory
4.0K
Jun 12
WEC8500/file# ls etc
Current working directory: disk:/
directory
4.0K
Jun
directory
4.0K
Jun
directory
4.0K
Jun
file
168
Jul
WEC8500/file# ls disk:/etc
Current working directory: disk:/
directory
4.0K
Jun
directory
4.0K
Jun
directory
4.0K
Jun
file
168
Jul
WEC8500/file#
© SAMSUNG Electronics Co., Ltd.
13:49:49
09:00:39
15:36:02
16:46:59
01:11:01
etc
lost+found
opt
stats
var
15:36:02
15:36:02
15:36:02
13:49:49
ap
config
db
PKG_INFO_STANDBY
15:36:02 ap
15:36:02 config
15:36:02 db
13:49:49 P KG_INFO_STANDBY
page 472 of 628
CHAPTER 10. System Management
10.11.3 Revising File
To copy a file, use the ‘copy [SRC_FILENAME] [DES_FILENAME]’ command.
The below command copies the ‘test’ file into ‘disk:/test2’.
WEC8500/file# copy test disk:/test2
To delete a file, use the ‘remove [FILENAME]’ command. If you enter the below
command and enter ‘y’, the ‘test2’ file is deleted.
WEC8500/file# remove test2
‘disk:/test2’ Do you really want to remove it ? (y/n)
To change a filename, use the ‘move [SRC_FILENAME] [DES_FILENAME]’ command.
If you enter the below command, the ‘test’ file is changed to ‘test2’.
WEC8500/file# move test test2
10.11.4 Retrieve File Content
To retrieve the content of a file, use the ‘dump’ command. It can be displayed in the hexa
or ascii format.
WEC8500/file# dump test2
0000000 7f45 4c46 0202 0100
0000010 0002 0008 0000 0001
0000020 0000 0000 0000 0040
0000030 808d 0007 0040 0038
0000040 0000 0006 0000 0005
0000050 0000 0001 2000 0040
0000060 0000 0000 0000 0188
0000070 0000 0000 0000 0008
0000080 0000 0000 0002 5b40
0000090 0000 0001 2002 5b40
© SAMSUNG Electronics Co., Ltd.
0000
0000
0000
0007
0000
0000
0000
0000
0000
0000
0000
0001
0000
0040
0000
0001
0000
0003
0001
0000
0000
2000
0002
001e
0000
2000
0000
0000
2002
0000
0000
4950
9600
001d
0040
0040
0188
0004
5b40
000f
|.ELF............
|............ .IP
|.......@........
|.....@.8...@....
|...............@
|.... ..@.... ..@
|................
|................
|......[@.... .[@
|.... .[@........
page 473 of 628
CHAPTER 10. System Management
10.11.5 File Download and Upload
A file is downloaded or uploaded through FTP protocol.
To download a file, use the ‘download’ command. An example of downloading the ‘test’
file from ‘192.168.1.1’ to ‘disk:/test’ is shown below.
WEC8500/file# download
guest guest 192.168.1.1 test disk:/test
To upload a file, use the ‘upload’ command.
An example of uploading the ‘disk:/uploadtest’ file to ‘192.168.1.1’ is shown below.
WEC8500/file# upload
uploadtest
guest guest 192.168.1.1 disk:/uploadtest
10.11.6 Package File
You can use a package file by downloading it from a network or copying it from a USB
memory. The APC checks the integrity of a package file and provides the information
retrieving function.
Checking the integrity of a package file
Checking if a package file is damaged is called integrity checking. An example of checking
integrity using the ‘verify’ command is shown below.
[Checking APC package file]
WEC8500/file# verify package/wec8500_0.3.0.R.bin
Verify: success!!
[Checking AP package file]
WEC8500/file# verify package/ap/wea302.img
Verify: success!!
© SAMSUNG Electronics Co., Ltd.
page 474 of 628
CHAPTER 10. System Management
Retrieving the information of a package file
A package file includes the information such as version information, model information,
package build information, etc. To check the content of a package file, use the ‘version’
command.
[Retrieving the information of APC package file]
WEC8500/file# version package/wec8500_0.3.0.R.bin
=====================================================
Model
WEC8500
Version
0.3.0.R
Build Date
Sat Jun 30 15:57:09 2012
Builder
apcbuild
Build Path
/home2/apcbuild/release/apc
MD5SUM
b715450abf1be81616fd7e6391e12cee
[Retrieving the information of AP package file]
WEC8500/file# version package/ap/wea302.img
=====================================================
Model
wea302
Version
0.1.0.R
Build Date
Fri Apr 13 18:41:26 KST 2012
Sisze
31998080
CRC
d5aa76ad
© SAMSUNG Electronics Co., Ltd.
page 475 of 628
CHAPTER 10. System Management
10.11.7 Retrieving Storage Media
The WEC8500 supports a disk and USB memory as a storage media. And the WEC8050
supports only a disk as a storage media. Both current directory-based relative path and
absolute path are all supported during command execution and the path of each device is
shown in the below table.
Device
Disk
Path
disk:/
Description
Uses the system disk as a storage media.
(basic path)
USB memory
usb [N]:/
Uses a USB memory as a storage media.
(‘N’ represents a partition number in a USB memory.)
The check the information of a storage media connected to the APC, use the ‘df’ command.
WEC8500/file# df
Device
: disk
Filesystem
: ext4
Total size
: 12.9G Free space:
11.3G
Device
Filesystem
Total size
7.0G
: usb1
: vfat
: 7.4G Free space:
Using the results of entering the above command, an operator can check the below
information.
The disk and USB memory are connected.
Disk free space: 11.3 GB
USB memory free space: 7 GB
© SAMSUNG Electronics Co., Ltd.
page 476 of 628
CHAPTER 10. System Management
10.11.8 Managing File in Web UI
10.11.8.1 File Uploading and Downloading
In the menu bar of , select < Administration > and then select the
menu in the sub-menus.
Path selection
menu
Figure 245. File management window
The File Management window provides the following functions:
Retrieving a file list
Select a desired path in the path selection menu, which is categorized based on the
following criteria:
disk: Select this to retrieve the entire files in the SSD disk of APC.
APC Package: Select this to retrieve an APC package file.
AP Package: Select this to retrieve an AP package file.
Log: Select this to retrieve a log file.
Stats: Select this to retrieve a statistics file.
USBN: Select this to retrieve a file in a USB memory connected to the APC.
(The N represents a partition number in a USB memory. )
Copying a file
After selecting the checkbox of a file to copy, click the