Tranzeo Wireless Technologies GNVPZ1NT3 WIRELESS MESH ROUTER User Manual users manual

Tranzeo Wireless Technologies, Inc WIRELESS MESH ROUTER users manual

users manual

    Document No. TR0153 Rev E2     EnRoute50x/51x  User’s Guide  Rev. E1                   Communicate Without Boundaries      Tranzeo Wireless Technologies Inc. 19473 Fraser Way, Pitt Meadows, BC, Canada V3Y 2V4 www.tranzeo.com technical support email:  support@tranzeo.com
EnRoute50x/51x User’s Guide      TR0153 Rev. E1    2                                                  Tranzeo,  the  Tranzeo  logo  and  EnRoute500  are  trademarks  of  Tranzeo  Wireless  Technologies  Inc..  All  rights reserved.  All  other  company,  brand,  and  product  names  are  referenced  for  identification  purposes  only  and  may  be trademarks that are the properties of their respective owners.  Copyright © 2007, Tranzeo Wireless Technologies Inc..
EnRoute50x/51x User’s Guide  TR0153 Rev. E1    3   FCC Notice to Users and Operators This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions:    (1)  This  device  may  not  cause  harmful  interference,  and  (2)  This  device  must accept any interference received, including interference that may cause undesired operation.  This equipment has been tested and found to comply with the limits for Class B Digital Device, pursuant  to  Part  15  of  the  FCC  Rules.  These  limits  are  designed  to  provide  reasonable protection against harmful interference in a residential installation. This equipment generates and can radiate radio frequency energy and, if not installed and used in accordance with the instructions,  may  cause  harmful  interference  to  radio  communications.  However,  there  is  no guarantee  that  interference  will  not  occur  in  a  particular  installation.  If  this  equipment  does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures.  •  Reorient or relocate the receiving antenna •  Increase the separation between the equipment and receiver •  Connect the equipment into an outlet on a circuit different from that to which the receiver is connected •  Consult the dealer or an experienced radio/TV technician for help  To reduce potential radio interference to other users, the antenna type and its gain should be so  chosen  that  the  equivalent  isotropically  radiated  power  (EIRP)  is  not  more  than  that required for successful communication.  •  This device must be installed so that there is a minimum of 150.7 cm between the       antenna and any person.  Any  changes  or  modification  to  said  product  not  expressly  approved  by  Tranzeo Wireless Technologies Inc. could void the user's authority to operate this device.   The Tranzeo EnRoute500 Mesh Router must be installed by a trained professional, value  added  reseller,  or  systems  integrator  who  is  familiar  with  RF  cell  planning issues  and  the  regulatory  limits  defined  by  the  FCC  for  RF  exposure,  specifically those limits outlined in sections 1.1307.
EnRoute50x/51x User’s Guide  TR0153 Rev. E1    4    Table of Contents  1 Working with the EnRoute500........................................................................... 9 1.1 EnRoute500 Variants ............................................................................................9 1.2 EnRoute500 Capabilities.....................................................................................10 1.3 Network Topology ...............................................................................................10 1.4 Network Terminology ..........................................................................................11 1.5 EnRoute500 Interfaces........................................................................................12 1.5.1 Ethernet and PoE............................................................................................... 13 1.5.2 Antennas............................................................................................................ 14 1.6 Deployment Considerations ................................................................................14 1.6.1 Mesh Channel Selection .................................................................................... 14 1.6.2 AP Channel Selection ........................................................................................ 15 2 Connecting to the EnRoute500 ....................................................................... 16 2.1 Network Interfaces ..............................................................................................16 2.2 Connecting to an Unconfigured EnRoute500......................................................17 2.3 Default Login and Password ...............................................................................18 2.4 Resetting the ‘admin’ Password ..........................................................................18 3 Using the Web Interface .................................................................................. 19 3.1 Accessing the Web Interface...............................................................................19 3.2 Navigating the Web Interface..............................................................................21 3.3 Setting Parameters .............................................................................................21 3.4 Help Information..................................................................................................22 3.5 Rebooting............................................................................................................22 4 Using the Command Line Interface ................................................................ 24 4.1 Accessing the CLI ...............................................................................................24 4.2 User Account.......................................................................................................24 4.3 CLI Interfaces......................................................................................................25 4.4 CLI Features .......................................................................................................25 4.4.1 Control of the Cursor.......................................................................................... 25 4.4.2 Cancel a Command ........................................................................................... 25 4.4.3 Searching the Command History ....................................................................... 26 4.4.4 Executing a Previous Command ........................................................................ 26 4.5 CLI Commands ...................................................................................................26 4.5.1 ‘?’ command....................................................................................................... 26 4.5.2 ‘whoami’ command ............................................................................................ 26 4.5.3 ‘help’ command .................................................................................................. 27 4.5.4 ‘show’ command ................................................................................................ 27 4.5.5 ‘use’ command ................................................................................................... 28 4.5.6 ‘set’ command .................................................................................................... 29
EnRoute50x/51x User’s Guide  TR0153 Rev. E1    5 4.5.7 ‘get’ command.................................................................................................... 30 4.5.8 ‘list’ command .................................................................................................... 31 4.5.9 ‘ping’ command .................................................................................................. 31 4.5.10 ‘ifconfig’ command ............................................................................................. 32 4.5.11 ‘route’ command................................................................................................. 32 4.5.12 ‘clear’ command ................................................................................................. 32 4.5.13 ‘history’ command .............................................................................................. 33 4.5.14 ‘!’ command........................................................................................................ 34 4.5.15 ‘exit’ command ................................................................................................... 35 4.5.16 ‘quit’ command ................................................................................................... 35 5 Initial Configuration of an EnRoute500 .......................................................... 36 6 Status Information ........................................................................................... 39 6.1 Configuration Overview Page..............................................................................39 6.2 Interface Status ...................................................................................................40 6.2.1 Mesh and Virtual AP Interfaces.......................................................................... 40 6.2.2 Wired Interface Status........................................................................................ 41 6.3 Routing Table......................................................................................................42 6.4 ARP Table...........................................................................................................43 6.5 Event Log............................................................................................................43 6.6 DHCP Event Log.................................................................................................44 7 Configuration Profile Management................................................................. 46 7.1 Saving the Current Configuration ........................................................................46 7.2 Load a Configuration Profile................................................................................47 7.3 Delete a Configuration Profile .............................................................................48 7.4 Downloading a Configuration Profile from an EnRoute500 .................................48 7.5 Uploading a Configuration Profile to an EnRoute500..........................................49 8 System Settings ............................................................................................... 50 8.1 User Password....................................................................................................50 8.2 Operating Scheme ..............................................................................................51 8.3 Using Multiple Gateways.....................................................................................52 8.4 Mesh / Node ID ...................................................................................................53 8.5 Mesh Prefix .........................................................................................................53 8.6 Internal and External Subnets.............................................................................54 8.7 DNS / Domain Settings .......................................................................................55 8.8 DNS Proxy Configuration ....................................................................................56 8.9 NetBIOS Server ..................................................................................................57 8.10 SNMP..................................................................................................................58 8.11 Location...............................................................................................................59 8.12 Cluster Name ......................................................................................................60 8.13 Certificate Information .........................................................................................61 8.14 Time Synchronization..........................................................................................61 8.15 Web GUI Console ...............................................................................................63 8.16 OnRamp Configuration Access...........................................................................64
EnRoute50x/51x User’s Guide  TR0153 Rev. E1    6 8.17 CLI Timeout.........................................................................................................65 9 Client Addressing Schemes............................................................................ 66 9.1 Implicit Addressing Scheme ................................................................................67 9.1.1 LAN Prefix.......................................................................................................... 68 9.1.2 Client Address Space Segmentation in Implicit Addressing Mode ..................... 68 9.2 Explicit Addressing Scheme................................................................................71 10 Mesh Radio Configuration............................................................................... 72 10.1 Channel...............................................................................................................72 10.2 Service Set Identifier (SSID) ...............................................................................73 10.3 Encryption ...........................................................................................................74 10.4 Transmit Power Cap ...........................................................................................74 10.5 RSSI Threshold Levels........................................................................................75 10.6 IP Configuration ..................................................................................................76 10.7 Neighbor Status ..................................................................................................76 11 Ethernet Interface Configuration .................................................................... 77 11.1 IP Configuration for Repeater Devices and Their Clients....................................77 11.1.1 Ethernet Client Device Address Space .............................................................. 77 11.1.2 Ethernet Interface IP Configuration .................................................................... 78 11.1.3 IP Configuration of Client Devices via DHCP..................................................... 79 11.1.4 Manual IP Configuration of Client Devices......................................................... 79 11.2 IP Configuration for Gateway Devices ................................................................80 11.2.1 DHCP................................................................................................................. 80 11.2.2 Manual IP Configuration..................................................................................... 81 12 Virtual Access Point (VAP) Configuration ..................................................... 83 12.1 Access Point Interfaces.......................................................................................84 12.2 Enabling and Disabling Access Points ................................................................84 12.3 Virtual Access Point Client Types .......................................................................84 12.4 Access Point Client Device Address Space ........................................................85 12.5 Channel...............................................................................................................87 12.6 ESSID .................................................................................................................88 12.7 IP Configuration of Client Devices.......................................................................89 12.7.1 IP Configuration of Clients Devices via DHCP ................................................... 90 12.7.2 Manual IP Configuration of Client Devices......................................................... 90 12.8 Client Devices .....................................................................................................90 12.9 Encryption and Authentication.............................................................................91 12.9.1 WEP Encryption ................................................................................................. 92 12.9.2 WPA Pre-Shared Key Mode (WPA-PSK)........................................................... 93 12.9.3 WPA EAP Mode................................................................................................. 94 12.10 Transmit Power Cap ...........................................................................................95 12.11 Radio Rate ..........................................................................................................96 12.12 Preamble Length.................................................................................................96 12.13 Beacon Interval ...................................................................................................97 12.14 Maximum Link Distance ......................................................................................97
EnRoute50x/51x User’s Guide  TR0153 Rev. E1    7 13 Client IP Configuration via DHCP ................................................................... 99 13.1 Using the Local DHCP Server.............................................................................99 13.2 Using a Centralized DHCP Server ....................................................................102 13.2.1 Support for Clients with Static IP Addresses.................................................... 103 13.2.2 Configuring the EnRoute500s .......................................................................... 103 13.2.3 Configuring the Central DHCP Server.............................................................. 106 14 Connecting an EnRoute500 Mesh Network to a WAN................................. 107 14.1 Static Routing Configuration on WAN Router....................................................107 14.1.1 “Single Gateway, Implicit Addressing Scheme” Option .................................... 107 14.1.2 “Single Gateway, Explicit Addressing Scheme” Option.................................... 108 14.1.3 “Multiple Gateway, Implicit Addressing Scheme” Option.................................. 108 14.1.4 “Multiple Gateway, Explicit Addressing Scheme” Option ................................. 109 14.2 Network Address Translation (NAT) on Mesh Gateways ..................................109 14.3 Layer 2 Mesh Emulation in DHCP Relay Mode.................................................110 14.4 VPN Access to a Mesh Gateway ......................................................................111 15 Controlling Access to the EnRoute500 ........................................................ 112 15.1 Firewall..............................................................................................................112 15.2 Gateway Firewall...............................................................................................113 15.3 Blocking Client-to-Client Traffic.........................................................................114 15.4 Connection Tracking .........................................................................................116 15.4.1 Limiting Number of TCP Connections Per Client Device.................................. 116 15.4.2 Connection Tracking Table Size ...................................................................... 116 15.4.3 Connection Tracking Timeout .......................................................................... 117 15.5 Custom Firewall Rules ......................................................................................117 15.6 Access Control Lists (ACLs)..............................................................................119 15.6.1 Access Point Access Control Lists (ACLs)....................................................... 119 15.6.2 Mesh ACL ........................................................................................................ 120 16 Quality of Service (QoS) Configuration........................................................ 122 16.1 Priority Levels....................................................................................................122 16.2 Rate Limiting .....................................................................................................125 16.3 Rate Reservation ..............................................................................................127 17 Enabling VLAN Tagging ................................................................................ 130 17.1 Client Access Interface Configuration ...............................................................130 17.2 Gateway Configuration......................................................................................131 18 Integration with Enterprise Equipment ........................................................ 133 18.1 Configuring Splash Pages.................................................................................133 18.1.1 Enabling Splash Pages .................................................................................... 133 18.1.2 Configuring Splash URLs................................................................................. 135 18.1.3 Sample HTML Code for Splash Pages............................................................. 136 18.1.4 Configuring the Authentication Server.............................................................. 137 18.1.5 Trusted MAC Addresses .................................................................................. 138 18.1.6 Bypass Splash Pages for Access to Specific Hosts ......................................... 139
EnRoute50x/51x User’s Guide  TR0153 Rev. E1    8 18.2 Layer 2 Emulation .............................................................................................140 19 Diagnostics Tools .......................................................................................... 143 19.1 Ping...................................................................................................................143 19.2 Traceroute.........................................................................................................144 19.3 Packet Capture .................................................................................................144 19.4 Centralized DHCP Testing ................................................................................147 19.5 RADIUS Server Testing ....................................................................................147 19.6 Diagnostic Dump...............................................................................................148 20 Firmware Management .................................................................................. 150 20.1 Displaying the Firmware Version.......................................................................150 20.2 Upgrading the Firmware....................................................................................150 20.2.1 Upgrading the Firmware on all Devices in a Mesh Neighborhood.................... 151 20.2.2 Upgrading the Firmware on an Individual Device............................................. 153 Glossary …........................................................................................................................... 155 Abbreviations....................................................................................................................... 156
Chapter 1: Working with the EnRoute500  TR0153 Rev. E1    9  1  Working with the EnRoute500 Thank  you  for  choosing  the  Tranzeo  EnRoute500  Wireless  Mesh  Router.  The  EnRoute500 allows a wireless mesh network to be rapidly deployed with minimal configuration required by the  end  user.  This  user’s  guide  presents  a  wide  array  of  configuration  options,  but  only  a limited  number  of  options  have  to  be  configured  in  order  to  deploy  a  mesh  network  of EnRoute500s. 1.1  EnRoute500 Variants The following is a list of Enroute varients, as shown in Table 1.  Model Number  Included Antennas EnRoute500  AP 5dBi, Mesh 8.5dBi EnRoute510   AP 7.5dBi, Mesh 10.5dBi Table 1. EnRoute500 variants The following is a list of supported accessory antennas sold with the Enroute family, as shown in Table 2.  Model Number  Included Antennas TR-ODH24-12  Vertical Omnidrectional 2.4 Ghz 12 dBi TR-ODH24-13  Horizontal Omnidrectional 2.4 Ghz 13 dBi TR-SA24-90-9   Vertical Sector, 2.4 Ghz, 90 degree, 9 dBi TR-24H-90-17  Horizontal Sector, 2.4 Ghz, 90 degree, 17 dBi TR-PAN24-15  Panel, 2.4 Ghz, 15 dBi TR-HTQ-5.8-12  Vertical Omni, 5.8 Ghz, 12 dBi TR-58V-60-17  Vertical Sector, 5.8 Ghz, 60 degree, 17 dBi TR-5.8-32Db-Ant   Parabolic dish, 5.8 Ghz, 32 dBi TR-5X-Ant-24  Panel, 5.8 Ghz, 24 dBi                 Table 2 Supported Accessory antennas   Throughout the manual, “EnRoute500” will be used to collectively refer to this family of products. Where the  functionality of the  variants differ, the actual  model number will be used.
Chapter 1: Working with the EnRoute500  TR0153 Rev. E1    10 1.2  EnRoute500 Capabilities The EnRoute500 is capable of automatically forming a mesh network that allows devices that are  connected  to  it,  either  with  a  wired  or  a  wireless  connection,  to  communicate  with  each other and external networks that are accessed through gateway devices. The EnRoute500 has two  radios,  an  802.11a  mesh  backhaul  radio  and  an  access point  radio  for  802.11b/g-client devices.  An  EnRoute500 will currently  support up  to  four  virtual access points (VAPs),  each with  different  access  and  performance  settings.  It  is  also  possible  to  connect  devices  to  an EnRoute500 using an Ethernet connection.    Figure 1. EnRoute500 sample network – devices attach to  the EnRoute500 through both wired and wireless connections 1.3  Network Topology EnRoute500s  can  be  used  to  create  two  network  topologies:  a  stand-alone  network  or  an Internet extension network that attaches to a network with connectivity to the Internet.
Chapter 1: Working with the EnRoute500  TR0153 Rev. E1    11  Figure 2. Internet extension network  An Internet extension network (shown in Figure 2) is typically used when the goal is to provide Internet  access  to  a  number  of  clients  that  connect  to  the  mesh  network.  Alternatively,  this configuration can be used to provide access for client devices to remote resources on a private network. The  key feature to note is that there is  a gateway device that provides access from the mesh network to an external network.   Figure 3. Stand-alone network In  a  stand-alone  network, as  shown in Figure 3, all devices  are  configured  to operate in the same mode (repeater mode). This network configuration is suitable for applications where the clients using the mesh only need to communicate with each other and do not need to access the Internet or other remote network resources that are not directly connected to the mesh. 1.4  Network Terminology The following terms will be referred to throughout this manual.
Chapter 1: Working with the EnRoute500  TR0153 Rev. E1    12 Mesh  neighborhood  –  a  group  of  two  or  more  EnRoute500  devices  with  at  least  one configured as a gateway   Mesh device – a single EnRoute500 that is part of a mesh network 1.5  EnRoute500 Interfaces The  interfaces  available  on  the  EnRoute500  are  Ethernet  and  two  radio  ports.  On  the EnRoute5x1 models, an external AC power port is also present.          Power  Ethernet Figure 4. EnRoute500 interfaces. EnRoute501 shown AP radio port Mesh radio port
Chapter 1: Working with the EnRoute500  TR0153 Rev. E1    13 Interface  Description Power (EnRoute 5x1 only)  Power input (100-240VAC 50-60 Hz) Mesh radio port  N-type antenna connector for mesh radio AP radio port  N-type antenna connector for access point radio Ethernet  10/100 Mbit Ethernet interface Passive PoE  PoE power input (9-28VDC, 12W) Not compatible with IEEE 802.3af Table 2. EnRoute500 Interfaces 1.5.1  Ethernet and PoE The EnRoute500 has a 10/100 Ethernet port that supports passive Power over Ethernet (PoE). The PoE power injector should supply an input voltage between 9-28VDC and a minimum of 12W. The pinout for the Ethernet interface on the EnRoute500 is provided in Table 3.  The  EnRoute500  is  equipped  with  an  auto-sensing  Ethernet  port  that  allows  both regular and cross-over cables to be used to connect to it.  Pin  Signal  Standard Wire Color 1  Tx+  White/Orange 2  Tx-  Orange 3  Rx+  White/Green 4  PoE V+  Blue 5  PoE V+  White/Blue 6  Rx-  Green 7  Gnd  White/Brown 8  Gnd  Brown Table 3. Ethernet port pinout  To  power  the  EnRoute500,  connect  an  Ethernet  cable  from  the  Ethernet  port  of  the EnRoute500  to  the  port  labeled “CPE”  on  the  supplied  PoE  injector  and  apply  power  to the PoE injector using the supplied power supply
Chapter 1: Working with the EnRoute500  TR0153 Rev. E1    14 DO  NOT  CONNECT  ANY  DEVICE  OTHER  THAN  THE  ENROUTE500  TO  THE PORT  LABELED  “CPE”  ON  THE  PoE  INJECTOR.  NETWORK  EQUIPMENT THAT  DOES  NOT  SUPPORT  PoE  CAN  BE  PERMANENTLY  DAMAGED  BY CONNECTING  TO  A  PoE  SOURCE.  NOTE  THAT  MOST  ETHERNET INTERFACES  ON  PERSONAL  COMPUTERS  (PCs),  LAPTOP/NOTEBOOK COMPUTERS,  AND  OTHER  NETWORK  EQUIPMENT  (E.G.  ETHERNET SWITCHES AND ROUTERS) DO NOT SUPPORT PoE. 1.5.2  Antennas Attach  the  supplied  antennas  to  the  mesh  and  access  point  (AP)  radio  ports  on  the EnRoute500.  The  antennas  used  for  the  two  radios  are  band-specific  and  therefore  it  is important to correctly match the antennas with the radio ports.  The thicker of the two antennas is the 2.4 GHz antenna, which should be attached to the AP connector. The thinner antenna is the 5.8 GHz antenna, which should be attached to the mesh connector. 1.6  Deployment Considerations The  EnRoute500’s  radios  operate  in  the  unlicensed  2.4  GHz  and  5.8  GHz  ISM  bands.  It  is possible  that  there  will  be  other  devices  operating in  these  bands  that  will  interfere  with  the EnRoute500’s radios. Interference from adjacent EnRoute500s can also degrade performance if the EnRoute500s are not configured properly.  It  is  advisable  to  carry  out  a  site  survey  prior  to  installation  to  determine  what  devices  are operating in the two bands that the EnRoute500 uses. To detect the presence of other 802.11 devices, a tool such as Netstumbler (http://www.netstumbler.com/downloads/) can be used. A spectrum analyzer can be used for further characterization of interference in the band. 1.6.1  Mesh Channel Selection The mesh radio channel must be the same for all EnRoute500s in a given mesh neighborhood. Adjacent mesh neighborhoods will get a performance benefit if they are on different channels as  the  neighborhoods  will  not  interfere  with  each  other.  The  802.11a  channels  that  the EnRoute500 mesh radio can be configured to use are all non-overlapping.
Chapter 1: Working with the EnRoute500  TR0153 Rev. E1    15 1.6.2  AP Channel Selection The  access  point  radio  channels  used  by  the  EnRoute500s  in  a  mesh  neighborhood  may differ.  It  is  advisable  to  use  different  access  point  channels  for  adjacent  mesh  devices  to reduce interference.   However, it may be more important to select the access point channel based on the presence of  other  802.11  devices in  the  area  rather  than  configuring  it  to  be  different  than  that  of  an adjacent  EnRoute500.  A  site  survey  should  be  conducted  to  determine  which  access  point channel will provide the best performance.  Some of the 802.11b/g channels that the EnRoute500 access point radio can be configured to use are overlapping. Only channels 1, 6, and 11 are non-overlapping.
Chapter 2: Connecting to the EnRoute500  TR0153 Rev. E1    16 2  Connecting to the EnRoute500 The  EnRoute500  can  be  configured  and  monitored  by  connecting  to  one  of  its  network interfaces.  The  wired  Ethernet  interface  on  the  EnRoute500  should  be  used  for  initial configuration of the device, but other network interfaces can be used to connect to the device after initial configuration has been completed. 2.1  Network Interfaces The EnRoute500 has several network interfaces, as shown in Table 4.   The network interfaces listed in the table below are logical, not hardware, interfaces. Some of the interfaces listed in the table share the same hardware interface.   Interface Hardware Interface  Primary Function Interface Availability Default Address Fixed Address? Wired  Ethernet Connecting to a WAN or supporting wired client connections Enabled by default  10.253.253.225/27  No Static Configuration  Ethernet Configuring the device before a unique Ethernet IP address has been configured  Always present  169.254.253.253/16  Yes OnRamp Configuration  Ethernet Configuring the device before a unique Ethernet IP address has been configured. Unlike the static configuration interface, this interface’s address can be modified, allowing multiple unconfigured EnRoute500s to be attached to a LAN Disabled by default  N/A  No Mesh  Mesh radio  Mesh communication  Always present  172.29.253.253/16  No VAP 1 – 4  AP radio  Connecting to wireless clients Only VAP1 enabled by default 10.253.253.1/26 10.253.253.129/27 10.253.253.161/27 10.253.253.193/27 No Centralized DHCP   Provides a gateway for client devices when using centralized DHCP server mode All disabled by default  N/A  No Table 4. EnRoute500 network interfaces
Chapter 2: Connecting to the EnRoute500  TR0153 Rev. E1    17 Note that the “Static Configuration” interface is the only interface that has a fixed address that cannot be changed by the user. Since this interface is known to always be present, it can be used  for  initial  configuration  and  for  accessing  devices  whose  configuration  settings  are unknown. 2.2  Connecting to an Unconfigured EnRoute500 Use  the  Static  Configuration  interface  with  IP  address  169.254.253.253  and  netmask 255.255.0.0 to establish network connectivity to an unconfigured EnRoute500.  The Static Configuration interface functions only with the EnRoute500’s wired interface. Do not try to access the EnRoute500 over a wireless link using the address of this interface.  To  connect  to  an  EnRoute500  using  its Static  Configuration IP address, you must configure your computer’s IP address to be in the 169.254.253.253/16 subnet, e.g. 169.254.253.1 and connect the computer’s Ethernet cable to the “DATA” port on the EnRoute500’s PoE injector.  ENSURE THAT THE DATA CONNECTION FROM THE PC OR THE LAN IS MADE TO  THE  “PC”  PORT.  DO  NOT  CONNECT  ANY  DEVICE  OTHER  THAN  THE ENROUTE500  TO  THE  PORT  LABELED  “CPE”  ON  THE  PoE  INJECTOR. NETWORK  EQUIPMENT  THAT  DOES  NOT  SUPPORT  PoE  CAN  BE PERMANENTLY DAMAGED BY CONNECTING TO A PoE SOURCE. NOTE THAT MOST  ETHERNET  INTERFACES  ON  PERSONAL  COMPUTERS  (PCs), LAPTOP/NOTEBOOK  COMPUTERS,  AND  OTHER  NETWORK  EQUIPMENT (E.G. ETHERNET SWITCHES AND ROUTERS) DO NOT SUPPORT PoE.  Since the Static Configuration IP address is the same for all EnRoute500s, you should  not  simultaneously  connect  multiple EnRoute500s to a  common LAN and attempt to access them using the Static Configuration IP address.
Chapter 2: Connecting to the EnRoute500  TR0153 Rev. E1    18 If  you  are  configuring  multiple  EnRoute500s  with  the  same  computer  in  rapid succession, it may be necessary to clear the ARP cache since the IP addresses for the  EnRoute500s  will  all  be  the  same,  but  the  MAC  addresses  will  vary.  The following commands can be used to clear the ARP cache  Windows XP (executed in a command prompt window)  arp -d *  to clear the entire cache, or   arp -d 169.254.253.253  to just clear the EnRoute500 entry  Linux  arp -d 169.254.253.253 2.3  Default Login and Password The EnRoute500’s default login is ‘admin’ and the default password is ‘default’. The login and password are the same for the web interface and the CLI. Changing the password using one of the interfaces will change it for the other interface as well. 2.4  Resetting the ‘admin’ Password The  EnRoute500  supports  a  password  recovery  feature  for  the  ‘admin’  account,  should  the password be lost.   Completing  the  password  recovery  procedure  requires  that  you  contact Tranzeo  technical  support.  Please  check  the  Tranzeo  website (www.tranzeo.com)  for  how  to  contact  technical  support  and  hours  of operation.  For security purposes, the ‘admin’ password can only be reset in the first  15 minutes of operation of the device. You will be able to power the unit on and off to be able to reset the password.
Chapter 3: Using the Web Interface  TR0153 Rev. E1    19 3  Using the Web Interface The  EnRoute500  has  a  web  interface  accessible  through  a  browser  that  can  be  used  to configure the device and display status parameters. 3.1  Accessing the Web Interface You  can access the  web interface  by  entering  one of the EnRoute500’s IP addresses in the URL field of a web browser (see section 2.2 for a description of how to access an unconfigured EnRoute500 using its Ethernet interface). When you enter this URL, you will be prompted for a login  and  password.  The  default login and password  used  for the  web interface are  ‘admin’ and ‘default’, respectively.    Figure 5. Login window for web interface  Since  the  certificate  used  in  establishing  the  secure  link  to  the  EnRoute500  has  not  been signed  by  a  Certification  Authority  (CA),  your  browser  will  most  likely  display  one  or  more warnings similar to those shown below. These warnings are expected and can be disregarded.   Figure 6. Certificate warning
Chapter 3: Using the Web Interface  TR0153 Rev. E1    20  A configuration overview page is loaded by default after the login process has been completed. This page contains the following information  •  Firmware version and list of installed patches •  System uptime •  System mode of operation (gateway or repeater)  •  Mesh channel and ESSID •  IP addresses, netmask, and MAC addresses for each client access interface •  Status, channel, ESSID, and encryption type for each virtual access point interface •  VLAN status and ID for all interfaces •  Ethernet interface use (client access or backhaul)  To access the status page from any other page in the web interface, click on the “Status” link in the navigation bar that appears on the left side of the web interface.   Figure 7. Configuration overview page displayed when logging in
Chapter 3: Using the Web Interface  TR0153 Rev. E1    21 3.2  Navigating the Web Interface The web interface uses a three-tiered navigation scheme.   1.  The first tier of navigation is the navigation bar shown on the left side of the screen. This navigation bar is displayed on all pages in the web interface and remains the same on all pages. 2.  The  second  tier  of  navigation is  the  primary  row  of  tabs  shown  across  the  top  of  the screen on many of the pages in the web interface. The labels in these tabs vary based on which page is selected on the navigation bar. 3.  The third tier of navigation is the second row of tabs shown below the first row. These tabs are not present on all pages and their labels vary based on the selections made on the navigation bar and the primary row of tabs.   Figure 8. Web interface navigation components  The time displayed at the top of the navigation bar is the current time of the PC used to log in to the web GUI, not the time kept by the EnRoute500. 3.3  Setting Parameters Many  of  the  web  interface  pages  allow  you  to  set  EnRoute500  operating  parameters.  Each page  that  contains  settable  parameters  has  a  “Save  Changes”  button  at  the  bottom  of  the page.  When  you  have  made  your  changes  on  a  page  and  are  ready  to  commit  the  new 1 2 3
Chapter 3: Using the Web Interface  TR0153 Rev. E1    22 configuration, click on the “Save Changes” button. It typically takes a few seconds to save the changes, after which the page will be reloaded.   For  the changes to take effect, the EnRoute500 must  be rebooted. After a change has been committed, a message reminding the user to reboot the EnRoute500 will be displayed at the top of the screen.   Figure 9. Page showing "Save Changes" button and message prompting the user to reboot 3.4  Help Information Help information is provided on most web  GUI  pages.  The  help information is shown on the right-hand side of the page. The help information can be hidden by clicking on the ‘Hide Help’ link inside the help frame. When help is hidden, it can be displayed by clicking on the ‘Show help’ link. 3.5  Rebooting Click on the “Reboot” link on the left of the page and then click on the “Reboot Now” button to reboot  the  EnRoute500.  Any  changes  made  prior  to  rebooting  will  take  effect  following completion of the boot process.  It takes approximately 3 minutes for the device to reboot.
Chapter 3: Using the Web Interface  TR0153 Rev. E1    23  Figure 10. Rebooting the EnRoute500
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    24 4  Using the Command Line Interface All  configurable  EnRoute500  parameters  can  be  accessed  with  a  Command  Line  Interface (CLI).   The CLI allows you to:  •  Modify and verify all configuration parameters •  Save and restore device configurations •  Reboot the device •  Upgrade the firmware 4.1  Accessing the CLI The  EnRoute500’s  command-line interface  (CLI)  is accessible through its network interfaces using  an  SSH  client.  Any  of  the  network  interfaces  can  be  used  to  establish  the  SSH connection to the EnRoute500. However, connecting through the Ethernet port is required  for devices that have not previously been configured.   Windows  XP  does  not  include  an  SSH  client  application.  You  will  need  to install  a  3rd-party  client  such  as  SecureCRT  from  Van  Dyke  software (http://www.vandyke.com/products/securecrt)  or  the  free  PuTTY  SSH  client (http://www.putty.nl/) to connect to an EnRoute500 using SSH.    When you log in to the EnRoute500, the CLI will present a command prompt. The shell timeout is  displayed above the login prompt. The CLI will automatically log out a user if a session is inactive for longer than the timeout period. Section 8.14 describes how to change the timeout period.  Shell timeout: 3 minutes.  Press '?' for help.. > 4.2  User Account The  user  login  used  to  access  the  EnRoute500  is  ‘admin’.  The  procedure  for  changing  the password for this account is described in section 8.1.
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    25 4.3  CLI Interfaces The  CLI  provides  the  user  with  a  number  of  interfaces  that  contain  related  parameters  and controls. Some of these interfaces are hardware interfaces, such as Ethernet, while others are virtual interfaces that contain a set of related parameters.  The available interfaces are:  •  mesh0 – controls for the mesh radio •  wlan1, wlan2, wlan3, wlan4 – controls for the virtual APs supported by the EnRoute500 •  eth0 – controls for the Ethernet interface •  firewall – controls firewall settings for client device, mesh device and mesh network access •  qos – controls Quality of Service (QoS) settings  •  version – displays version information for the installed firmware •  system – system settings   The currently selected interface is shown as part of the command prompt. For example, when the mesh interface is selected, the command prompt will be  mesh0>   After logging in, no interface is selected by default. Before setting or retrieving any parameters, an interface must be selected. 4.4  CLI Features The  CLI  has  a  number  of  features  to  simplify  the  configuration  of  the  EnRoute500.  These features are explained in the following sub-sections. 4.4.1  Control of the Cursor The  cursor  can  be  moved  to  the  end  of  the  current  line  with  Ctrl+E.  Ctrl+A  moves  it  to  the beginning of the line. 4.4.2  Cancel a Command Ctrl+C cancels the input on the current command line and moves the cursor to  a new, blank command line.
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    26 4.4.3  Searching the Command History The command history can be searched by pressing Ctrl+R and entering a search string. The most  recently  executed  command  that  matches  the  string  entered  will  be  displayed.  Press ‘Enter’ to execute that command.  4.4.4  Executing a Previous Command By using the up and down arrow keys you can select previously executed commands. When you find the command you wish to execute, you can either edit it or press ‘Return’ to execute it.  4.5  CLI Commands The  usage  of  all  CLI  commands  is  explained  in  the  following  subsections.  The  command syntax used is  command <mandatory argument>  command [optional argument] 4.5.1  ‘?’ command Syntax  ?   Description   Pressing ‘?’ at any time in the CLI will display a help menu that provides an overview  of  the  commands  that  are  described  in  this  section.  It  is  not necessary to press ‘Enter’ after pressing ‘?’. 4.5.2  ‘whoami’ command Syntax  whoami   Description   Displays the name of the user you are logged in as.
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    27 4.5.3   ‘help’ command Syntax  help [command|parameter]  where  the  optional  argument  is  either  one  of  the  CLI  commands (“[command]”)  or  a  parameter  in  the  currently  selected  interface (“[parameter]”).   Description   When no argument follows the help command, a help menu showing a list of available commands is displayed. When a command is supplied as the argument, a help message for that particular command is displayed. When a  parameter  in  the  current  interface  is  specified  as  the  argument,  help information for it is displayed.    Example  help get  will  display  the  help  information  for  the  ‘get’  command.  With  the  ‘sys’ interface selected  sys> help scheme  displays help information about that ‘scheme’ parameter, as shown below                scheme : wireless node type 4.5.4   ‘show’ command Syntax  show   Description   Displays  all  available  interfaces.  An  interface  in  this  list  can  be  selected with the ‘use’ command.
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    28 4.5.5   ‘use’ command Syntax  use <interface>  where <interface> is one of the EnRoute500’s interfaces. A complete list of interfaces is available with the ‘show’ command.   Description   Selects  an  interface  to  use.  By  selecting  an  interface  you  can  view  and modify the parameters associated with the interface.    Example  use mesh0  will select the backhaul mesh radio interface and change the CLI prompt to   mesh0>  to reflect the interface selection.
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    29 4.5.6   ‘set’ command Syntax  set <parameter>=<value>  where <parameter> is the parameter being set and <value> is the value it is being set to.    Description   Sets  a  configuration  parameter.  Note  that  is  only  possible  to  set  the parameters  for  the  currently  selected  interface.  If  the  value  of  the parameter  contains  spaces,  the  value  must  be  surrounded  by  double quotes (“ “).  If a valid 'set' command is entered, it will output its result and any effects on other parameters. If changes are made to attributes of other interfaces as a result of changing the parameter, these attributes are preceded by a '/' to signify that they are in another interface.   Changing certain parameters will require the EnRoute500 to be rebooted.    Example  With the ‘sys’ interface selected  set id.node=2  will set the node ID to 2, while   set id.mesh=1  will have an impact on a larger number of  parameters  as can be seen in the output below.               id.mesh : 1 private.nets.default : "172.29.0.0/16 10.1.0.0/16" /mesh0.routes.static : 224.0.0.0/4,10.1.0.0/16 splash.local_network : "172.29.1.0/24 10.1.0.0/16"        /mesh0.cellid : 00:05:88:01:0a:01    /mesh0.ip.address : 172.29.1.7 Reboot needed.  Note  that  changes  were  made  to  variables  in  the  ‘mesh0’  interface,  as indicated by the ‘/’ at the beginning of those lines.
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    30 4.5.7   ‘get’ command Syntax  get <parameter>  where <parameter> is the parameter whose value is being fetched.   Description   Gets  the  value  of  one  or  more  configuration  parameters  for  the  currently selected  interface.  The  ‘*’  character  can  be  used  to  specify  wildcard characters.  This  allows  multiple  values  to  be  fetched  with  a  single command.    Example  With the ‘sys’ interface selected  get id.node  will return the node’s ID, while   get id.*  will return all parameters that begin with ‘id.’   sys.id.lanprefix = 10  sys.id.mesh = 4  sys.id.meshprefix = 172.29  sys.id.node = 7
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    31 4.5.8  ‘list’ command Syntax  list   Description   Lists all parameters for the selected interface    Example  With the ‘firewall’ interface selected  list   will display  firewall.gateway.enable : prevent uninitiated incoming connections past the gateway?  firewall.node.allowc2c.eth0  :  allow  clients  to  see  each other  if .role=access  firewall.node.allowc2c.wlan1 : allow clients to see each other if .role=access  firewall.node.allowc2c.wlan2 : allow clients to see each other if .role=access  firewall.node.allowc2c.wlan3 : allow clients to see each other if .role=access  firewall.node.allowc2c.wlan4 : allow clients to see each other if .role=access  firewall.node.enable  :  firewall  enabled?  if  not,  nothing  else here matters.  firewall.node.tcp.allow.dest  :  tcp  dest  ports  (space  separated) to allow to this node  firewall.node.tcp.allow.source  :  tcp  source  ports  (space separated) to allow to this node  firewall.node.udp.allow.dest  :  udp  dest  ports  (space  separated) to allow to this node  firewall.node.udp.allow.source  :  udp  source  ports  (space separated) to allow to this node 4.5.9  ‘ping’ command Syntax  ping <IP address or hostname>   Description   Pings a remote network device. Halt pinging with Ctrl+C    Example  ping 172.29.1.1
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    32 4.5.10   ‘ifconfig’ command Syntax  ifconfig <eth0|wlan[0-4]>   Description   Displays  information,  such  as  IP  address  and  MAC  address,  for  the specified network interface.    Example  ifconfig wlan1  will display  wlan1     Link encap:Ethernet  HWaddr 00:15:6D:52:01:FD             inet addr:10.2.10.1  Bcast:172.29.255.255  Mask:255.255.0.0           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1           RX packets:0 errors:0 dropped:0 overruns:0 frame:0           TX packets:2434 errors:0 dropped:0 overruns:0 carrier:0           collisions:0 txqueuelen:0            RX bytes:0 (0.0 b)  TX bytes:233128 (227.6 Kb) 4.5.11  ‘route’ command Syntax  route   Description   Displays the current route table. 4.5.12   ‘clear’ command Syntax  clear   Description   Clears the screen
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    33 4.5.13  ‘history’ command Syntax  history   Description   Shows the command history since the EnRoute500 was last rebooted   Example  After switching to the ‘wlan1’ interface, inspecting the ESSID setting, and then changing it  history   will display  1: use wlan1 2: get essid 3: set essid=new_ap_essid
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    34 4.5.14  ‘!’ command Syntax  !<command history number> !<string that matches start of previously-executed command> !!   Description   Executes  a  previously-executed  command  based  either  on  a  command history  number  or  matching  a  string  to  the  start  of  a  previously-executed command. Note that there is no space between the ‘!’ and the argument.  The  ‘history’  command  shows  the  command  history,  with  a  number preceding  each  entry  in  the  command  history.  Use  this  number  as  an argument to the ‘!’ command to execute that command from the history.  When a string is provided as an argument to the ‘!’ command, the string will be  matched against the beginning of previously-executed commands and the most recently executed command that matches will be executed.  Use ‘!!’ to execute the last command again.   Example  If the command history is as follows  1: use wlan1 2: get essid 3: set essid=new_ap_essid1 4: use wlan2 5: set essid=new_ap_essid2  the command  !1  will execute   use wlan1  The command  !use  will execute   use wlan2
Chapter 4: Using the Command Line Interface  TR0153 Rev. E1    35 4.5.15  ‘exit’ command Syntax  exit   Description   Terminates the current CLI session and logs out the user 4.5.16  ‘quit’ command Syntax  quit   Description   Terminates the current CLI session and logs out the user
Chapter 5: Initial Configuration of an EnRoute500  TR0153 Rev. E1    36 5  Initial Configuration of an EnRoute500 This user’s guide provides a comprehensive overview of all of the EnRoute500’s features and configurable  parameters.  However,  it  is  possible  to  deploy  a  network  of  EnRoute500s  while only changing a limited number of parameters. The list below will guide you through a minimal configuration procedure that prepares a network of EnRoute500s for deployment.   1  Change the ‘admin’ password.  The  default  password  should  be  changed  to  prevent unauthorized access to the EnRoute500. See section 8.1 2 Set the operating scheme for the EnRoute500 Most EnRoute500s will be configured as repeaters, with at least one  EnRoute500  per  mesh  neighborhood  configured  as  a gateway. See section 8.2 3  Set the node and mesh IDs The node and mesh IDs uniquely identify an EnRoute500.  See section 8.3 4  Set the DNS servers Specify DNS servers to allow hostnames to be resolved.  See section 8.6 5  Set the mesh radio channel The mesh radios on all EnRoute500s in a mesh neighborhood must be set to operate on the same channel. See section 10.1 6 Set the mesh ESSID Set  the  mesh  interface  ESSID  to  a  common  value  for  all EnRoute500s  in  a  mesh  neighborhood.  It  should  be  different than the ESSID for any adjacent mesh neighborhoods. See section 10.2 7 Set the AES encryption key for the mesh Change the default AES encryption key to prevent unauthorized access  to  the  mesh.  The  mesh  encryption  key  must  be  the same for all EnRoute500s in a mesh neighborhood. See section 10.3 8  Set the mesh radio transmit power Set the mesh power to the maximum allowed value to achieve the best possible connectivity in the mesh. See section 10.4  In  addition  to  setting  the  parameters  on  the  “Minimal  Configuration”  page, OnRamp  access  should  be  disabled  after  initial  programming.  See  section 8.16 for instructions on how to enable OnRamp access to the EnRoute500.
Chapter 5: Initial Configuration of an EnRoute500  TR0153 Rev. E1    37 After  these  settings  have  been  changed,  the  EnRoute500s  will  be  able  to  form  a  mesh neighborhood  so  that  further  configuration  can  be  done  from  a  central  location,  using  the connectivity  of provided by  the  mesh. This minimal  configuration must be performed  prior  to deployment, but all other configuration can be carried out after deployment.  To simplify initial configuration, the web GUI has a page that allows the user to change all the parameters listed in this section on a single page. This page can be accessed by clicking on the ‘Minimal configuration’ link in the web interface navigation bar on the left side of the web interface.
Chapter 5: Initial Configuration of an EnRoute500  TR0153 Rev. E1    38  Figure 11. Initial configuration web page
Chapter 6: Status Information  TR0153 Rev. E1    39 6  Status Information Multiple web interface pages that display status information about the EnRoute500 and client devices  attached  to  it  are  available.  These  web  pages  are  accessible  by  clicking  on  the “Status” link in the navigation bar and then selecting the appropriate tab shown at the top of the page.  The status information is not accessible through the CLI. 6.1  Configuration Overview Page The main status page, which is displayed when clicking on “Status” in the navigation bar and when logging in, is the “Config Overview” page.    Figure 12. Partial configuration overview page  The  configuration  overview  page  shows  a  summary  of  settings  for  the  mesh  interface,  the virtual  access  point  interfaces,  and  the  wired  interface.  The  firmware  version,  uptime  of  the device, and its operating mode are also displayed.
Chapter 6: Status Information  TR0153 Rev. E1    40 Links labeled “(change)” are shown next to the settable parameters. These links take  you to the appropriate page to change the setting. 6.2  Interface Status Traffic and neighbor information for the mesh, virtual AP, and wired interfaces are available on the  “Status”  tab of  the  “Status”  page.  Select  the  appropriate  interface  for  which  you  wish  to view information from the row of tabs below the primary tab row. 6.2.1  Mesh and Virtual AP Interfaces The  sub-tabs  display  status  information  about  the  mesh  and  virtual  AP  interfaces.  Data statistics information for the interface are displayed, showing received and transmitted data in terms of bytes and packets.  In  the  case  of  the  “mesh”  sub-tab,  the  neighboring  mesh  devices  that  this  device  can communicate directly with are displayed. On the “wlan” sub-tabs, the client devices connected to the virtual APs are displayed. The following information is displayed for each mesh neighbor or client device:  •  MAC address •  IP address •  Quantity  of  data  received  from  the  neighbor/client  device  and  transmitted  to  the neighbor/client device •  Received signal strength (RSSI) in dBm and in parentheses the associated signal level based on a noise floor of -95dBm •  Time since last reception from the device •  A summary of the capabilities of the client device’s radio card
Chapter 6: Status Information  TR0153 Rev. E1    41  Figure 13. Mesh status information 6.2.2  Wired Interface Status The  wired  interface  status  pages  is  similar  to  the  wireless  interface  status  pages,  with  the exception that it only displays summary information for the interface and does not break down data transferred on a per-device basis.
Chapter 6: Status Information  TR0153 Rev. E1    42  Figure 14. Wired interface status information 6.3  Routing Table The routing table used by the device can  be displayed  by selecting the “Routing” tab on the “Status” page.   Figure 15. Routing table
Chapter 6: Status Information  TR0153 Rev. E1    43 6.4  ARP Table The device’s ARP table can be displayed by selecting the “ARP” tab on the “Status” page.   Figure 16. ARP table 6.5  Event Log The  main  system  log  for  the  device  is  accessible  by  selecting  “Event  Log”  on  the  “Status” page.  The  log  is  displayed  in  reverse  chronological  order,  with  the  last  recorded  event appearing at the top of the page.
Chapter 6: Status Information  TR0153 Rev. E1    44  Figure 17. Event log  The  time  reported  in  the  Event  Log  corresponds  to  the  time  maintained  by  the EnRoute500and may not be consistent with that shown in the upper left corner of the webpage as this is the time maintained by the computer running the web browser. 6.6  DHCP Event Log The log of  DHCP-related  events for the device is accessible by selecting “DHCP Events” on the “Status” page. The log is displayed in reverse chronological order, with the last recorded event appearing at the top of the page. All times in the log are in UTC time. Messages related to both local and relayed DHCP activity are displayed in the log.
Chapter 6: Status Information  TR0153 Rev. E1    45  Figure 18. DHCP event log  The  time  reported  in  the  DHCP  Log  corresponds  to  the  time  maintained  by  the EnRoute500and may not be consistent with that shown in the upper left corner of the webpage as this is the time maintained by the computer running the web browser.
Chapter 7: Configuration Profile Management  TR0153 Rev. E1    46 7  Configuration Profile Management Configuration  profiles  describe  an  EnRoute500’s  configuration  state  and  can  be  created  to simplify the provisioning and management of devices. The EnRoute500 supports the following configuration profile-related actions:  •  Saving the current configuration as a configuration profile •  Loading, or applying, a configuration profile stored on an EnRoute500 to the device •  Downloading a configuration profile stored on the EnRoute500 to a computer •  Uploading a configuration profile from a computer to the EnRoute500 •  Deleting a configuration profile stored on the EnRoute500  Currently configuration profile management is only supported via the web interface.  7.1  Saving the Current Configuration The current configuration can be saved on the “Save” tab on the “Profile Management” page. Enter a profile name or select an existing profile name from the list of existing configurations, and then click on “Save Profile”. The saved profile is stored locally on the EnRoute500 and will appear in the “Existing profiles” text box. Use the “Download from Node” tab to download it to a different device.   Figure 19. Save a configuration profile
Chapter 7: Configuration Profile Management  TR0153 Rev. E1    47 7.2  Load a Configuration Profile A configuration stored on the EnRoute500 can be applied using the “Load” tab on the “Profile Management”  page.  This  profile  must  either  have  been  saved  earlier  or  uploaded  to  the EnRoute500. Choose a profile name from the “Existing Profiles” box  and then click on “Load Profile”. It is necessary to reboot the EnRoute500 for the loaded profile settings to take effect.  A number of default configuration profiles are available on the EnRoute1000. There is a “FACTORY” profile, which contains the default settings for the firmware version that  is  installed.  By  applying  this  profile,  an  EnRoute500  will  revert  to  the  default settings  for  that  particular  firmware  version. If  the  EnRoute500  firmware  has  been upgraded, there will also be a profile with the same name as  the firmware version, e.g.  ENROUTE500_20060419_00_00_0133.  This  profile  contains  the  settings  that were set when the new firmware was installed. If you wish to roll back to the settings that  were  originally  set when  a  particular  firmware  version  was  installed, apply  the profile with the name that matches the firmware version name.   Figure 20. Load a configuration profile
Chapter 7: Configuration Profile Management  TR0153 Rev. E1    48 After  loading  the  same  profile  to  multiple  EnRoute500s,  at  a  minimum  the node  ID  of  the  devices  must  be  changed  if  they  are  to  operate  on  the  same mesh neighborhood.  It  is  recommended that after the  same  profile is  loaded onto multiple EnRoute500s, the parameters in the minimal configuration web-page are reviewed for each. 7.3  Delete a Configuration Profile A  locally-stored  configuration  profile  can  be  deleted  using  the  “Delete”  tab  on  the  “Profile Management” page. Choose a profile to delete from the profile drop-down box on the page and then click on “Delete Profile”.    Figure 21. Deleting a configuration profile 7.4  Downloading a Configuration Profile from an EnRoute500 A configuration profile can be download from an EnRoute500 using the “Download from node” tab  on  the  “Profile  Management”  page.  The  existing  configuration  profiles  are  listed  on  this page.  Click on the one that is  to be downloaded to your computer and you will be given the option to specify where the profile should be saved on the host computer.
Chapter 7: Configuration Profile Management  TR0153 Rev. E1    49  Figure 22. Downloading a configuration profile from an EnRoute500 7.5  Uploading a Configuration Profile to an EnRoute500 A configuration profile can be uploaded to an EnRoute500 using the “Upload to node” tab on the  “Profile  Management”  page.  Use the  “Browse”  button to  select  a profile file on  your host computer for upload to the EnRoute500. Alternatively, enter the file name by hand in the text box adjacent to the “Browse” button. Click on the “Upload Profile” button to upload the selected file to the EnRoute500.   Figure 23. Uploading a configuration profile to an EnRoute500
Chapter 8: System Settings  TR0153 Rev. E1    50 8  System Settings This section describes settings that are applicable to the overall operation of the EnRoute500, but are not related directly to a particular interface. 8.1  User Password The password for the ‘admin’ user is configurable. The default password is ‘default’.   See section 2.4 for instructions on resetting the ‘admin’ password if it has been lost.  CLI The  password  for  the  ‘admin’  user  can  be  set  using  the  ‘password.admin’  parameter  in  the ‘sys’ interface. The password will not be displayed when using the ‘get’ command with these parameters. The example below shows how to set the ‘admin’ password using the CLI.  > use sys sys> set password.admin=newpass  Web GUI The ‘admin’ password can be changed via the web interface using the “Passwords” tab on the “System Parameters” page.    Figure 24. Passwords page
Chapter 8: System Settings  TR0153 Rev. E1    51 8.2  Operating Scheme The operating scheme determines an EnRoute500’s role in the mesh network. Typically one of two configurations will be used in a network:  •  All  EnRoute500s  will  be  configured  as  repeater  devices  to  create  a  stand-alone  mesh neighborhood •  At least one of the EnRoute500s in a mesh neighborhood will be configured as a gateway device,  with  the  remaining  devices  configured  either  as  gateways  or  repeaters.  The gateway  devices  are  connected  to  an  external  network  using  the  devices’  Ethernet interfaces. This network configuration will create an Internet extension network.  Mode  Description  Ethernet interface Repeater The EnRoute500 will function as a relay in the mesh network. Client devices can connect to the EnRoute500 using both wired (10/100 Ethernet) and wireless (built-in virtual APs) interfaces. The EnRoute500 can provide IP addresses to clients on both the wired and wireless interfaces. Client devices  can connect to it.  IP  addresses  can  be provided to client devices by a DHCP  server  or  be  manually configured. Gateway The EnRoute500 will function as a relay in the mesh network and a gateway to a WAN. Client devices can only connect to the EnRoute500 using the wireless (built-in virtual APs) interfaces. The EnRoute500 can provide IP addresses to clients on the wireless interface.  Used  to  connect  the  mesh neighborhood  to  an  external network. The interface can be provided  an  IP  address  by  a DHCP server or have a static IP address assigned to it. Table 5. EnRoute500 operating schemes  CLI The EnRoute500’s operating scheme is set with the ‘scheme’ parameter in the ‘sys’ interface. Valid  values  are  ‘apgateway’  and  ‘aprepeater’.  For  example,  set  the  operating  scheme  to gateway mode with:  > use sys sys> set scheme=apgateway  Web GUI The operating scheme can be set via the web interface using the “System” tab on the “System Parameters” page.
Chapter 8: System Settings  TR0153 Rev. E1    52  Figure 25. Setting system parameters 8.3  Using Multiple Gateways It  is  possible  to  have  more  than  one  gateway  device  per  mesh  neighborhood  to  provide redundancy. The simplest method for creating a second gateway for a mesh neighborhood is to save the profile from the existing gateway, apply it to the device that will become the second gateway, and change at a minimum the following parameters on the new gateway:  •  Node ID (see section 8.4) •  Base address, if using centralized DHCP server mode (see section 13.2.2) •  Ethernet  IP  configuration,  if  wired  interface  is  not  configured  as  a  DHCP  client  (see section 11.2)  It is also required that L2 MAC forwarding is enabled on all devices in the mesh when multiple gateways are used (see 18.2 for more information on enabling L2 MAC emulation mode) No additional  configuration  of  WAN  devices,  e.g.  routers,  is  necessary  when  using  a  multiple gateway configuration.
Chapter 8: System Settings  TR0153 Rev. E1    53 It is important that all gateways for a common mesh neighborhood connect to the same LAN segment/VLAN trunk, such that the gateways can receive each other's control messages over the wired backhaul. 8.4  Mesh / Node ID An EnRoute500 must be assigned mesh and node IDs before it is deployed as part of a mesh neighborhood.  Together,  these  values  uniquely  identify  an  EnRoute500  within  a  mesh neighborhood  and  no  two  devices  in  a  neighborhood  are  allowed  to  have  the  same combination of mesh and node IDs.  The node and mesh IDs are part of the EnRoute500’s IP address as shown in Figure 26. The allowable range for node IDs is 1 through 254, while mesh IDs must be in the range from 0 to 255.  172.29  .  12  .  107Mesh prefix Mesh ID Node ID  Figure 26. EnRoute500 mesh interface IP address  CLI The mesh ID is set with the ‘id.mesh’ parameter in the ‘sys’ interface as shown below.   > use sys sys> set id.mesh=12  The node ID is set with the ‘id.node’ parameter in the ‘sys’ interface as shown below.  > use sys sys> set id.node=107  Web GUI The  mesh  and  node  IDs  can  be  set  via  the  web  interface  using  the  “System”  tab  on  the “System Parameters” page as shown in Figure 25.  8.5  Mesh Prefix The  mesh  prefix  parameter  sets  the  first  two  octets  of  an  EnRoute500’s  mesh  interface  IP address. It must be set the same for all devices in a given mesh neighborhood.
Chapter 8: System Settings  TR0153 Rev. E1    54 It is recommended that the mesh prefix default value of 172.29 is used.  CLI The mesh prefix is set with the ‘id.meshprefix’ parameter in the ‘sys’ interface as shown in the example below.   > use sys sys> set id.meshprefix=172.29  Web GUI The  mesh  prefix  can  be  set  via  the  web  interface  using  the  “Mesh”  tab  on  the  “Wireless Interfaces” page.    Figure 27. Setting the mesh prefix 8.6  Internal and External Subnets The  EnRoute500s  in  a  mesh  neighborhood  must  be  aware  of  which  addresses  are  located within the mesh and which are external to the mesh. The addresses that fall within the mesh are  considered  internal,  and  those  that  are  located  on  the  WAN-side  of  the  mesh neighborhood’s gateway(s) are considered external.
Chapter 8: System Settings  TR0153 Rev. E1    55 The internal subnets include by default the mesh subnet, the client access interface subnets, and,  if  centralized  DHCP  server  mode  is  enabled,  the  DHCP  client  address  space  subnet. These  subnets  are  automatically  listed  as  internal  without  requiring  the  user  to  specifically identify them as such. It  is  possible to manually add other subnets to the list of subnets that should be considered internal to the mesh.  The external subnets are all possible subnets that have not been defined as internal subnets. The gateway will automatically add the subnet of the gateway interface to the list of external addresses,  even  if  it  would  normally  be  considered  internal.  Any  external  hosts  that  are explicitly defined, such as the DNS servers, will be added to the list of external IP addresses, even if their addresses would normally be considered to fall in internal subnets.  Repeater nodes will inform the gateway what subnets their client access interfaces are using, and  the  gateway  will  then  redistribute  the  combined  internal/external  subnet  lists  to  the repeaters  so  every  device  in  the  mesh  neighborhood  is  consistent.  This  happens automatically, without requiring user intervention or a reboot. 8.7  DNS / Domain Settings At least one DNS server, accessible from the EnRoute500, must be specified for the device to be able to resolve host names. This DNS server is also provided to client devices that acquire an IP address from the local DHCP server on an EnRoute500.  DNS settings are automatically propagated from gateways to repeaters. Unless the EnRoute500s are being used in a stand-alone network without any gateway, it is not necessary to set the DNS server parameter on repeaters. They will get overwritten by the values from the gateway(s) in the mesh neighborhood.  If a gateway device acquires DNS server information through DHCP on its wired interface, this DNS server information will overwrite any manually set DNS server setting. The current DNS settings will be passed to repeater devices that are in the mesh neighborhood that the gateway is serving.  CLI The DNS server(s) used by an EnRoute500 are specified with the ‘dns.servers’ parameter in the  ‘sys’  interface.  To  specify  multiple  DNS  servers,  list  them  as  a  space-delimited  string enclosed by quotes as shown in the example below  > use sys sys> set dns.servers =”10.5.0.5 192.168.5.5”
Chapter 8: System Settings  TR0153 Rev. E1    56 Web GUI A primary and secondary DNS server can be set via the web interface using the “DNS” tab on the “System Parameters” page.    Figure 28. Setting the DNS and Netbios server(s) 8.8  DNS Proxy Configuration DNS proxy entries can be added to an EnRoute500 to force local resolution of host names to IP addresses for the hosts in the  proxy list. Use of a DNS proxy list on the EnRoute500 is a two  step  process,  first  populating  the  host  name/IP  address  pairs,  and  then  enabling  DNS proxy.  CLI A list of hostname/IP address to be resolved locally can be specified using the ‘dnsproxy.hosts’ parameter  in  the  ‘sys’  interface.  If  multiple  hostname/IP  address  entries  are  specified,  they must  be  separated  by  semi-colons,  as  shown  in  the  example  below.  DNS  proxy  must  be explicitly  enabled  using  the  ‘dnsproxy.enable’ parameter  in  the  ‘sys’  interface after the list  of hosts has been specified.  > use sys sys> set dnsproxy.enable=yes sys> set dnsproxy.hosts=”server1.domain.com=10.0.0.1;server2.domain.com=10.0.0.129”
Chapter 8: System Settings  TR0153 Rev. E1    57 Web GUI DNS  proxy  can  be  enabled  on  the  “DNS  Proxy”  sub-tab  on  the  “DNS”  tab  on  the  “System Parameters” page  as  shown  in Figure  29. Hostname/IP  address pairs  can be added on this page as well.   Figure 29. Configuring DNS proxy 8.9  NetBIOS Server The  NetBIOS  server  parameter  is  used  to  define  a  NetBIOS  server’s  IP  address  that  is provided to client devices when they connect to the EnRoute500’s local DHCP server.   CLI The NetBIOS server is set with the ‘netbios.servers’ parameter in the ‘sys’ interface. To specify multiple NetBIOS servers, list them as a space-delimited string enclosed by quotes as shown in the example below  > use sys sys> set netbios.servers =”10.6.0.5 192.168.6.5”  Web GUI A primary and secondary NetBIOS server can be set via the web interface using the “DNS” tab on the “System Parameters” page (see Figure 28).
Chapter 8: System Settings  TR0153 Rev. E1    58 8.10  SNMP The EnRoute500 supports SNMP.  The read-only and read-write passwords and the  port  that SNMP uses can be configured. A contact person and device location can also be specified as part of the SNMP configuration.  CLI The  SNMP  read-only  and  read/write  passwords  are  set  with  the  ‘snmp.community.ro’  and ‘snmp.community.rw’ parameters in the ‘sys’ interface. The example below shows how to set these parameters.  > use sys sys> set snmp.community.ro=”read-only_password” sys> set snmp.community.rw=”read-write_password”  The SNMP port is set with the ‘snmp.port’ parameter in the ‘sys’ interface as shown below. By default this parameter is set to “161”.  > use sys sys> set snmp.port=161  The  contact  person  and  location  of  the  device  located  via  SNMP  are  set  with  the ‘snmp.contact. and ‘snmp.location’ parameters in the ‘sys’ interface as shown below.  > use sys sys> set snmp.contact=”Joe Smith” sys> set snmp.location=”123 Main St., Anytown, USA”  Web GUI The  SNMP-related  parameters  can  be  set  on  the  “SNMP”  tab  on  the  “System”  page  (see Figure 30).
Chapter 8: System Settings  TR0153 Rev. E1    59  Figure 30. SNMP configuration 8.11  Location Two types of device location information can be stored:  •  Latitude/longitude/altitude  •  Postal address or description a device’s location  Note that these values are not automatically updated and must be entered after a device has been  installed.  Altitude  is  in  meters.  Latitude  and  longitude  must  be  given  as  geographic coordinates in decimal degrees, with latitude ranging from -90 to 90 (with negative being south, positive being north) and longitude ranging from -180 to 180 (with negative being west, positive being east).  CLI The  geographic location of the EnRoute500  can  be  stored in the  following  fields in  the ‘sys’ interface:  •  sys.location.gps.altitude •  sys.location.gps.latitude •  sys.location.gps.longitude  For example, you can set the latitude value as follows.
Chapter 8: System Settings  TR0153 Rev. E1    60 > use sys sys> set location.gps.latitude=”34.01”  A  description  of  the  EnRoute500’s  location  can  be  stored  in  the  ‘location.postal’  field  in  the ‘sys’ interface. For example, you can set the location value as shown below.  > use sys sys> set location.postal=”Light post near 123 Main St., Anytown, CA”  Web GUI The  location  information  can  be  set  via  the  web  interface  using  the  “Location”  tab  on  the “System Parameters” page.    Figure 31. Setting location and certificate information 8.12  Cluster Name A name can be assigned to the mesh neighborhood, or cluster. This name will be displayed in the upper right-hand corner of the web interface on all web interface pages. This name can be used to easily identify which device or mesh neighborhood is being accessed with a particular instance  of  the  web  interface.  This  name  does  not  have  any  effect  on  the  formation  of  the mesh and can be different for devices in a mesh neighborhood.
Chapter 8: System Settings  TR0153 Rev. E1    61 CLI The cluster name is set with ‘info.cluster’ parameter in the ‘sys’ interface. This parameter can be set as shown in the example below.  > use sys sys> set info.cluster=”Campus network”  Web GUI The  cluster  name  can  be  set  via  the  web  interface using  the  “Location”  tab  on  the  “System Parameters” page (see Figure 31). Use the “Cluster Name” field to set the cluster name. 8.13  Certificate Information A  certificate  for  use  with  splash  pages  and  the  web  interface  is  locally  generated  on  the EnRoute500. The information embedded in this certificate can be defined by the user. A new certificate  is  automatically  generated  when  the  parameters  describing  the  EnRoute500’s location  are  changed. The  specific  location  parameters  to  which  the  certificate  is  tied  to  are listed in the sections below.  CLI The information used in certificate generation can be set using the ‘organization’ parameters in the ‘sys’ interface. These parameters are:  •  sys.organization.name  –name  of  organization  (must  be  enclosed  in  quotes  if  it  contains spaces) •  sys.organization.city – city name (must be enclosed in quotes if it contains spaces) •  sys.organization.state – state name •  sys.organization.country – two-letter country abbreviation  Web GUI The  certificate  information  can  be  set  via  the  web  interface  using  the  “Location”  tab  on  the “System  Parameters”  page  (see  Figure  31).  Changing  any  of  the  Organization,  City, State/Province, or Country parameters will cause the certificate information to be recalculated. 8.14  Time Synchronization An EnRoute500  configured as a  gateway  can  be configured to  synchronize its internal  clock with  an  external  RFC-868-compliant  time  server.  Devices  configured  as  repeaters  will
Chapter 8: System Settings  TR0153 Rev. E1    62 automatically  synchronize  their  clocks  with  the  mesh  gateway.  The  delay  between  following completion  of  booting  and  when  a  repeater  synchronizes  its  clock  can  be  configured.  This delay is designed so that if the entire mesh network is rebooted at the same time, the gateway can first synchronize to the external time server, then each repeater, following the delay, will synchronize with the gateway.  The time  synchronization will  ensure that  proper time stamps are displayed for entries in the event logs that are available on the web GUI’s “Status” page.  CLI The time synchronization server for a  gateway is set with  the ‘time.rfc868.server’ in the ‘sys’ interface. The example below shows how to set the time synchronization server.  > use sys sys> set time.rfc858.server=”your.time.server.here”  The ‘time.sync_delay’ parameter in the ‘sys’ interface sets the delay used by repeaters before they synchronize their clocks with a gateway device.  > use sys sys> set time.sync_delay=600  It is not possible to manually adjust the device time through the CLI. Please use the web GUI to adjust it.  Web GUI The  synchronization  mode  and  server  can  be  set  on  the  “Time”  tab  on  the  “System”  page  when the device is configured as a gateway (Figure 32)     Figure 32. Automatic time synchronization
Chapter 8: System Settings  TR0153 Rev. E1    63 The  synchronization  delay  and  server  can  be  set    on  the  “Time”  tab  on  the  “System”  page  when the device is configured as a repeater.  When  automatic  synchronization  is  disabled,  the  user  can  set  the  EnRoute500’s  UTC  time (Figure 33). Enter the time using the available drop-down menus and check the “Change Time” checkbox.   Figure 33. Setting the time manually 8.15  Web GUI Console The web interface allows the user to set parameters that are not otherwise settable through the web interface using a console interface. The console is available on the “Console” tab on the “System” page.   CLI  key/value pairs can be entered through the console. The  key  format  used is  “<interface name>.<key>”. For example, “wlan1.channel” is the key to set the channel used by virtual AP wlan1. To use the console, enter one or more key/value pairs in the large text box on the page, either  separating  each  pair  with  a  space  or  placing  each  pair  on  its  own  line.  Click  on  the “Submit Commands” button to set the values entered in the text box.
Chapter 8: System Settings  TR0153 Rev. E1    64  Figure 34. Web interface console 8.16  OnRamp Configuration Access ONRAMP  IS  A  PC-BASED  TOOL  THAT  WILL  BECOME  AVAILABLE  TO SUPPORT INITIAL CONFIGURATION OF THE ENROUTE500. IT HAS NOT BEEN RELEASED  AT  THE  TIME  OF  THE  WRITING  OF  THIS  DOCUMENT.  CHECK WWW.TRANZEO.COM/ONRAMP FOR ONRAMP STATUS.   IT  IS  RECOMMENDED  THAT  ONRAMP  CONFIGURATION  ACCESS  IS DISABLED UNTIL THE TOOL IS MADE AVAILABLE.  The OnRamp utility provides network detection and configuration capabilities for EnRoute500s. The  configuration  capabilities  are  only  intended  for  initial  configuration  and  for  security reasons,  it  is  strongly  recommended  that  OnRamp  configuration  capability  is  disabled  after initial configuration.   You  can  use the CLI, the web  interface,  or OnRamp  to  determine  whether  a  device  can  be configured from OnRamp. In OnRamp, the “Prog” column displays the programming capability from OnRamp.  A  ‘Y” in  this column  indicates that OnRamp  can  configure the  device,  an ‘N’ indicates that it cannot.
Chapter 8: System Settings  TR0153 Rev. E1    65 CLI The OnRamp configuration capability is controlled by the ‘provisioning.enable’ parameter in the ‘sys’ interface. Set this parameter to ‘0’ to disable configuration through OnRamp, as shown in the example below.  > use sys sys> set provisioning.enable=0  Web GUI The OnRamp configuration capability is set on the “OnRamp” tab on the “Security” page (see Figure 35).   Figure 35. OnRamp configuration access 8.17  CLI Timeout The  CLI  will automatically log  out  a user if  the interface  has  remained  inactive  for  a  certain length  of  time.  The  time,  in  seconds,  that  a  shell  must  remain  inactive  before  a  user  is automatically  logged  out  is  set  with  the  ‘shell.timeout’  parameter  in  the  ‘sys’  interface,  as shown  in  the  example  below.  The  maximum  idle  time  that  can  be  set  is  21600  seconds  (6 hours).   > use sys sys> set shell.timeout=300
Chapter 9: Client Addressing Schemes  TR0153 Rev. E1    66 9  Client Addressing Schemes The  choice  of  client  addressing  scheme  affects  how  EnRoute500  client  access  interface addresses  are  assigned.  The  EnRoute500  can  be  configured  to  use  an  implicit  addressing scheme  for its  client access interfaces,  or explicit  addresses  can be  assigned to  each  client access interface. The addressing scheme choice also affects what the addresses of clients will be when the device is not operating in centralized DHCP server mode.   It is not possible to mix devices with implicit and explicit addressing schemes in a common mesh neighborhood.  Table  6  compares  how  the  behavior  of  the  device  differs  depending  upon  the  addressing scheme that is chosen.  Feature  Implicit addressing scheme  Explicit addressing scheme Client access interface addresses Derived from mesh ID, node ID, and LAN prefix settings. They cannot be directly set. Can be set to arbitrary values, with a few reserved address ranges that cannot be used. Size of client address space Each of the active client access interfaces must share a class C address space. The address space size for each client access interface can be set independently and can be of arbitrary size. Default internal subnets Mesh subnet (typically 172.29.0.0/16), client subnet (10.<mesh ID>.0.0/16, and DHCP client address space subnet Mesh subnet (typically 172.29.0.0/16), 10.0.0.0/8, and DHCP client address space subnet Table 6. Differences between explicit and implicit addressing schemes  CLI The  choice  of  implicit  or  explicit  addressing  scheme  is  controlled  by  the  ‘implicit.enable’ parameter in the ‘mesh’ interface. Set this parameter to ‘yes’ to select implicit addressing and to ‘no’ to select explicit addressing. The example below demonstrates how to select the implicit addressing scheme.  > use mesh0 sys> set implicit.enable=yes  Web GUI The addressing scheme is set with the “Implicit Addressing” drop-down menu on the “System” tab of the “System” page. Set this to disabled to choose the explicit addressing scheme.
Chapter 9: Client Addressing Schemes  TR0153 Rev. E1    67  Figure 36. Setting the addressing scheme 9.1  Implicit Addressing Scheme The implicit addressing scheme requires a class C network, which has a unique address within a mesh, to be shared between all active client access interfaces. The subnet address space is based on the mesh ID, node ID, and LAN prefix as shown in Figure 37.  Mesh ID Node ID10   .  12  .  107  .  0 LAN prefix  Figure 37. Subnet address structure  If  the  EnRoute500  is  operating  in  centralized  DHCP  server  mode,  the  addresses used for the implicit addressing scheme have no bearing on the addresses that are assigned to client devices through DHCP.
Chapter 9: Client Addressing Schemes  TR0153 Rev. E1    68 The default division of the class C address space is shown in Table 7. It is possible to change this configuration, assigning larger address spaces to certain interfaces if not all interfaces are enabled.  Interface  Interface address  Broadcast address  Client device address range wlan1  subnet.1  subnet.127  subnet.2-126 wlan2  subnet.129  subnet.159  subnet.130-158 wlan3  subnet.161  subnet.191  subnet.162-190 wlan4  subnet.193  subnet.223  subnet.194-222 eth0  subnet.225  subnet.255  subnet.226-254 subnet = <id.lanprefix>.<id.mesh>.<id.node> Table 7. Default subnet segmentation between interfaces 9.1.1  LAN Prefix The  LAN  prefix  parameter  sets  the  first  octet  of  the  client  access  interface  IP  address. The suggested values for the LAN prefix are 10 and 192. The LAN prefix must be the same for all devices in a mesh neighborhood.  The LAN prefix parameter has no effect when an EnRoute500 is using the explicit addressing scheme.  CLI The  LAN  prefix  is  set  with  the  ‘id.lanprefix’  parameter  in  the  ‘sys’  interface  as  shown  in  the example below.  > use sys sys> id.lanprefix=10  Web GUI The  LAN  prefix  can  be  set  via  the  web  interface  using  the  “System”  tab  on  the  “System Parameters” page (see Figure 36).  9.1.2  Client Address Space Segmentation in Implicit Addressing Mode As mentioned above, the client access interfaces must share a class C address space when the EnRoute500 is using the implicit addressing scheme.  The start address of each  address segment and its size can be set. The following restrictions are placed on the address segment configuration:  •  Each active client access interface must be assigned an address segment.
Chapter 9: Client Addressing Schemes  TR0153 Rev. E1    69 •  The IP address range start address (‘ip.implicit.start.requested’ in the CLI) must be one of the following values: 1, 33, 65, 97, 129, 161, 193, 225. •  The  IP  address  range  size  (‘ip.implicit.size.requested’  in  the  CLI)  must  be  one  of  the following values: 31, 63, 127, 255. •  The  IP  address  range  size  and  start  address  must  be  chosen  such  that  the  address segment does not cross a netmask boundary. Table 8 lists allowed combinations. •  The address spaces for enabled interfaces must start at different addresses. •  The address spaces for enabled interfaces should not overlap.  IP address range size (ip.implicit.size.requested) Address range start (ip.implicit.start.requested)  31  63  127  255 1  Yes  Yes  Yes  Yes 33  Yes  No  No  No 65  Yes  Yes  No  No 97  Yes  No  No  No 129  Yes  Yes  Yes  No 161  Yes  No  No  No 193  Yes  Yes  No  No 225  Yes  No  No  No Table 8. Allowed address segment start address and size combinations  Each of the enabled interfaces’ address segments should be configured to avoid overlap with the  other interfaces’ address segments. In  the  case  where an EnRoute500 is not configured such  that  this  requirement  is  met,  address  spaces  will  be  automatically  reduced  in  size  to prevent overlap.  CLI The  start  and  size  of  client  address  spaces  are  set  with  the  ‘ip.implicit.start.requested’  and ‘ip.implicit.size.requested’  parameters  in  the  ‘eth0’,  ‘wlan1’,  ‘wlan2’,  ‘wlan3’,  and  ‘wlan4’ interfaces. Refer to Table 8 for allowed values for these parameters.    In  the  first  example  below,  the  Ethernet  interface  is  set  to  use  the  entire  class  C  address space  (this  requires that  all  the other  client access  interfaces, wlan1-4, are  disabled). In the second  example,  the  Ethernet  interface  is  set  to  use  the  upper  half  of  the  class  C  address space.  > use eth0 eth0> set ip.implicit.start.requested=1 eth0> set ip.implicit.size.requested=255  > use eth0 eth0> set ip.implicit.start.requested=129 eth0> set ip.implicit.size.requested=127
Chapter 9: Client Addressing Schemes  TR0153 Rev. E1    70 The actual start address and size of a segment are accessible via the ‘ip.implicit.start.actual’ and  ‘ip.implicit.size.actual’  parameters.  These  may  values  may  differ  from  the  requested values if the rules for setting these parameters were not abided by.  Web GUI The address space segments’ start addresses and sizes can be set via the web interface using the “DHCP” sub-tab on the “DHCP” tab on the “System Parameters” page (see Figure 38).    Figure 38. Address space settings when using the implicit addressing scheme
Chapter 9: Client Addressing Schemes  TR0153 Rev. E1    71 9.2  Explicit Addressing Scheme When  using  explicit  addressing  scheme,  the  IP  parameters  for  each  interface  must  be specified manually on the “Wireless Interface” and “Wired/Backhaul Interface” pages.  When  specifying  the  IP  addresses  and  subnet  sizes  for  the  client  access  interfaces,  the following rules should be followed:  •  Specify  IP  address  and  subnet  combinations  that  do  not  lead  to  misalignment,  e.g. 10.0.0.4/24 is not  a properly aligned address/subnet size combination. •  Do not specify subnets that are in the following ranges: o  169.254.0.0/16 o  127.0.0.0/8 o  The class B network used by the mesh (typically 172.29.0.0/16) •  Each  subnet  specified  for  a  client  access  interface  must  not  overlap  with  that  of  any other client access interface in the mesh neighborhood. •  Do not specify any subnets for client access interfaces that overlap with subnets outside the mesh neighborhood that you want mesh clients to be able to connect to.  Do  not  specify  a  gateway  IP  address  for  any  of  the  client  access  interfaces when operating using the explicit addressing scheme. This field should be left blank for each interface.  CLI Set  the  ‘implicit.enable’  parameter  in  the  ‘mesh0’  interface  to  ‘no’  to  select  the  explicit addressing scheme. The example below demonstrates this.  > use mesh0 sys> set implicit.enable=no  See sections 11.1.2 and 12.4 for instructions on how to set the IP addresses for the wired and wireless client access interfaces when using the explicit addressing scheme.  Web GUI The addressing scheme is set with the “Implicit Addressing” drop-down menu on the “System” tab of the “System” page (see Figure 36). Set this to “disabled” to use the explicit addressing scheme.  See sections 11.1.2 and 12.4 for instructions on how to set the IP addresses for the wired and wireless client access interfaces when using the explicit addressing scheme.
Chapter 10: Mesh Radio Configuration  TR0153 Rev. E1    72 10  Mesh Radio Configuration The EnRoute500 has an 802.11a radio dedicated to mesh backhaul traffic. The settings for this radio  are independent of any settings  for the  radio used  for the  EnRoute500’s built-in virtual access  points.  The  channel,  SSID<  and  encryption  settings  for  the  mesh  radio  must  be  the same on all EnRoute500s in a given mesh neighborhood for them to be able to communicate.   Figure 39. Mesh interface parameters 10.1  Channel The 802.11a radio can be set to operate in the channels listed in Table 9. All these channels are non-overlapping.  Channel  Center Frequency (GHz) 149  5.745 153  5.765 157  5.785 161  5.805 165  5.825 Table 9. Mesh radio channels and frequencies
Chapter 10: Mesh Radio Configuration  TR0153 Rev. E1    73 All  the  devices  in  a  mesh  neighborhood  need  to  be  configured  to  use  the  same  802.11a channel.   CLI The mesh radio channel is set with the ‘channel’ parameter in the ‘mesh0’ interface as shown in the example below.  > use mesh0 mesh0> set channel=157  Web GUI The mesh radio channel can be set via the web interface using the “Mesh” tab on the “Wireless Interfaces” page (see Figure 39).  10.2  Service Set Identifier (SSID) The  Service  Set Identifier,  or SSID,  is used  in 802.11 communication  to identify  a  particular network. It  differentiates logical networks that operate on the same radio channel. The  mesh radio SSID for all the devices in a mesh neighborhood must be the same. If you have adjacent mesh  neighborhoods  where  one  or  more  devices  from  each  neighborhood  are  within communication range of each other, the SSID for the neighborhoods must be different if you wish  to  preclude  mesh  communication  between  these  neighborhoods  and  preventing repeaters from autonomously deciding which neighborhood to be part of.  The SSID value must be a text string that has a maximum length of 32 characters. It must only contain  alphanumeric  characters,  spaces,  dashes  (“-“),  and  underscores  (“_”).  The  SSID setting is case sensitive.   CLI The  mesh  radio  SSID  is  set  as  shown  in  the  example  below.  When  setting  an  ESSID  that contains  spaces,  the  SSID  value  must  be  enclosed  by  quotes.  The  quotes  are  optional otherwise.  > use mesh0 mesh0> set essid=”enroute500_mesh”  Web GUI The mesh radio SSID can be set via the web interface using the “Mesh” tab on the “Wireless Interfaces” page (see Figure 39).
Chapter 10: Mesh Radio Configuration  TR0153 Rev. E1    74 10.3  Encryption The  mesh  radio link  can  be  protected  with an  encryption  key  to  prevent  unauthorized  users from  intercepting  or  spoofing  mesh  traffic.  Each  EnRoute500  in  a  mesh  neighborhood  must have the same mesh radio encryption key.   CLI To  enable  encryption,  set  the ‘key’  parameter in  the  ‘mesh0’  interface.  The  examples  below illustrate how to set the encryption key. The ‘key’ parameter can either be specified as a 16-character ASCII string preceded by “s:” or a 32-character hexadecimal string.  Encryption can be enabled using an ASCII key with  > use mesh0 mesh0> set key=”s:abcdefghijklmnop”  or using a hexadecimal key with  > use mesh0 mesh0> set key=”0123456789abcdef0123456789abcdef”  Encryption can be disabled by specifying a blank value as shown below.  > use mesh0 mesh0> set key=  Web GUI The mesh radio encryption key can be set via the web interface using the “Mesh” tab on the “Wireless Interfaces” page (see Figure 39). The same encryption key must be entered in both the “Mesh Key” and “Verify Mesh Key” text boxes for the new key to be accepted.  Only  ASCII  keys  can  be  entered  using  the  web  interface.  Unlike  the  CLI,  an ASCII key should not be preceded by “s:” when entered via the web GUI. 10.4  Transmit Power Cap The maximum transmit power cap of the mesh radio is configurable. Increased output power will improve communication range, but will also extend the interference range of the radios. It is suggested that the transmit power cap is initially set to the maximum level for an installation and is then reduced if it is determined that the transmit power far exceeds the level required to maintain links. It is also recommended that a common transmit power cap value is used for all
Chapter 10: Mesh Radio Configuration  TR0153 Rev. E1    75 devices in a mesh to reduce the likelihood of asymmetric links. The default transmit power is 21 dBm.  If the transmit power is set to a value in excess of what can be supported by the  mesh  radio,  the  actual  radio  output  power  will  be  the  highest  power supported by the mesh radio.  CLI The example below shows how to set the mesh radio’s transmit power cap with the ‘txpower’ parameter  in  the  ‘mesh0’  interface.  The  txpower  parameter  is  specified  in  dBm,  with  a minimum granularity of 0.5 dBm.  > use mesh0 mesh0> set txpower=20  Web GUI The mesh radio’s transmit power cap can be set via the web interface using the “Mesh” tab on the “Wireless Interfaces” page (see Figure 39). The “+” and “-“ buttons can be used to increase or decrease the power cap setting in 0.5 dBm steps, or a value can be entered in the text box. 10.5  RSSI Threshold Levels The mesh networking algorithm evaluates link qualities to neighboring mesh devices and only considers links with a received signal strength indicator (RSSI) value equal to or greater than the ‘RSSI Join’ value specified to be usable. The ‘RSSI  Join’ value is set to 27 by default. This value reflects the lowest RSSI that will allow the mesh radio to operate reliably at its highest data  rate. It  is  possible  to  achieve longer  link  ranges,  at  the  cost  of  reduced  throughput, by reducing the ‘RSSI Join’ value.    In combination with the ‘RSSI Join’ value, the ‘RSSI Margin’ value is used to set the RSSI level at  which links are  dropped.  A link  will  be  considered broken  when  its RSSI drops below  the ‘RSSI Join’ level by the amount specified with ‘RSSI Margin’. For example, with an ‘RSSI Join’ value of 27 and an ‘RSSI Margin’ value of 3, the link will be dropped if the RSSI goes below 24.  The  ‘RSSI  Margin’  protects  the  links  from  the  fluctuation  in  link  strengths  due  to fading. Based  on  empirical  testing  of  the  EnRoute500,  a  value  of  3-5  is  recommended  for  outdoor deployments of the EnRoute500.   CLI The  example  below  shows  how  to  set  the  mesh  radio’s  RSSI  thresholds  with  the ‘fabric.rssi.join’ and ‘fabric.rssi.margin’ parameters in the ‘mesh0’ interface .
Chapter 10: Mesh Radio Configuration  TR0153 Rev. E1    76  > use mesh0 mesh0> set fabric.rssi.join=27 > use mesh0 mesh0> set fabric.rssi.margin=3  Web GUI The mesh radio RSSI thresholds can be set via the web interface using the “Mesh” tab on the “Wireless Interfaces” page (see Figure 39).  10.6  IP Configuration The IP address, broadcast address, and netmask associated with the mesh radio interface can be  viewed  through  the CLI and web interfaces. It is not possible to directly  set these values though.  To  change  the  mesh  interface  IP  settings,  mesh  prefix  and  the  node  and  mesh  ID settings must be changed (see sections 8.3 and 8.5).  CLI In the CLI, the mesh IP settings can be viewed with  > use mesh0 mesh0> get ip.address  ip.address = 172.29.2.4   [read-only] mesh0> get ip.broadcast  ip.broadcast = 172.29.255.255   [read-only]  mesh0> get ip.gateway  ip.gateway =    [read-only] mesh0> get ip.netmask  ip.netmask = 255.255.0.0   [read-only]  Web GUI The mesh radio IP settings are available through the web interface on the “Config Overview” tab on the “Status’ page under the heading “Wireless FabricTM (mesh)”. 10.7  Neighbor Status For a mesh device to be considered a neighbor, a minimum SNR  threshold must be met. The minimum SNR required for a link to be established and maintained are set with the ‘RSSI Join’ and ‘RSSI Margin’ parameters (see section 10.5).  See  section  6.2.1  for  how  to  access  information,  including  RSSI  and  SNR,  about  mesh neighbors.
Chapter 11: Ethernet Interface Configuration  TR0153 Rev. E1    77  11  Ethernet Interface Configuration The function of the Ethernet interface (eth0) depends on the operating scheme that has been selected (see section  8.2).  In repeater  mode,  the  Ethernet interface  can be used to connect client devices to the mesh neighborhood. In gateway mode, the Ethernet interface is used as a backhaul  interface  that  connects  the  mesh  neighborhood  to  a  WAN.  Client  devices  cannot connect through the Ethernet interface in this mode. 11.1  IP Configuration for Repeater Devices and Their Clients When  an  EnRoute500  is  configured  as  a  repeater,  client  devices  can  connect  to  it  via  the Ethernet interface to access the mesh network.  These  client devices can either  be assigned their  IP  configuration  using  DHCP,  either  by  a  centralized  server  or  a  local  one  on  the EnRoute500, or be manually configured.   Figure 40. Wired interface parameters with EnRoute500 in repeater mode 11.1.1  Ethernet Client Device Address Space When an EnRoute500 is in repeater mode, the Ethernet interface is either assigned a segment of  the  EnRoute500’s  class  C  client  address  space,  if  the  EnRoute500  is  using  the  implicit addressing scheme, or an arbitrary address space can be set for the interface when using the explicit addressing scheme. See section 9 for more information on client addressing schemes.
Chapter 11: Ethernet Interface Configuration  TR0153 Rev. E1    78 11.1.2  Ethernet Interface IP Configuration The  EnRoute500’s  Ethernet  interface  IP  configuration  can  be  changed  directly  when  it  is in repeater  mode  and  using  the  explicit  addressing  scheme.  It  should  not  be  changed  directly when the device is in repeater mode and using the implicit addressing scheme.   When an EnRoute500 is configured to use the implicit addressing scheme, set the IP address to  the  desired  value  by  modifying  the  node  ID,  mesh  ID,  and  LAN  prefix  parameters  (see sections 8.3 and 9.1.1). Set the netmask by changing the client address space segments as described in 9.1.2.   When using the explicit addressing scheme, the IP configuration can be set directly. Care must be  taken  to  avoid  using  the  same  or  overlapping  address  spaces  on  different  devices  in  a mesh neighborhood.  CLI You can view the IP settings for the Ethernet interface  with the ‘ip.*’ parameters in the ‘eth0’ interface as shown in the example below.  > use eth0 eth0> get ip.*  ip.address = 10.2.4.225   [read-only]  ip.address_force =   ip.broadcast = 10.2.4.255   [read-only]  ip.broadcast_force =   ip.gateway =    [read-only]  ip.gateway_force =   ip.netmask = 255.255.255.0   [read-only]  ip.netmask_force =   ip.implicit.size.actual =    [read-only]  ip.implicit.size.requested = 31  ip.implicit.start.actual =    [read-only]  ip.implicit.start.requested = 225  When  an  EnRoute500  is  in  repeater  mode  and  using  the  implicit  addressing  scheme,  the Ethernet  IP  settings  can  be  changed  by  altering  the  ‘id.node’,  ‘id.mesh’,  and  ‘id.lanprefix’ parameters  in  the  ‘sys’  interface  and  the  ‘ip.implicit.start.requested’  parameter  in  the  ‘eth0’ interface.  When an EnRoute500 is configured as a repeater, but is using the explicit addressing scheme, the  IP  address,  netmask,  gateway  address,  and  broadcast  address  can  be  set  using  the ‘ip.address_force’,  ‘ip.netmask_force’, ‘ip.gateway_force’, and ‘ip.broadcast_force’ parameters in the ‘eth0’ interface as shown in the example below.  > use eth0 eth0> set ip.address_force= 10.12.7.1 ip.broadcast_force= 10.12.7.255 ip.gateway_force=
Chapter 11: Ethernet Interface Configuration  TR0153 Rev. E1    79 ip.netmask_force=255.255.255.0    Web GUI The  current  Ethernet  IP  settings  can  be  viewed  through  the  web  interface  on  the  “Config Overview” tab on the “Status” page. When using the implicit addressing scheme, the Ethernet IP settings can be changed by altering the node ID, mesh ID, and LAN prefix settings on the “System”  parameters  tab  on  the  “System  Parameters”  page.  When  using  the  explicit addressing scheme, the IP parameters can be set on the “Wired/Backhaul Interface” page. 11.1.3  IP Configuration of Client Devices via DHCP When configured as a repeater, the EnRoute500 can be set to serve IP addresses to clients on the  Ethernet  interface  using  DHCP.  DHCP-provided  addresses  can  be  served  either  from  a local  server  on  the  EnRoute500  or  from  an  external  server.  The  two  DHCP  modes  are described in detail in section 13. 11.1.4  Manual IP Configuration of Client Devices The client devices connected via the Ethernet interface that use static IP addresses must have addresses that are within the subnet of the Ethernet interface.   If the local DHCP server is enabled for the Ethernet interface, IP addresses must be reserved for statically-configured devices by setting the DHCP reserve parameter. This will reserve the specified number of IP addresses at the low end of the IP range for the interface. For example, if the interface has been assigned the IP address 10.2.4.225, the netmask 255.255.255.224, and  the  DHCP  reserve  value  5,  the  IP  addresses  10.2.4.226  through  10.2.4.230  will  be available for use by statically configured devices. The remaining IP addresses in the interfaces address space can be assigned by the DHCP server to other client devices.  CLI The  number  of  IP  addresses  reserved  for  statically-configured  devices  connected  to  the Ethernet interface is set with the ‘dhcp.reserve’ parameter in the ‘eth0’ interface.  Web GUI The DHCP reserve value can be set via the web interface using the “DHCP” sub-tab on the “DHCP” tab on the “System Parameters” page (see Figure 43).
Chapter 11: Ethernet Interface Configuration  TR0153 Rev. E1    80 11.2  IP Configuration for Gateway Devices When  an  EnRoute500 is configured as  a  gateway,  the  Ethernet  interface is used to  provide backhaul capability by connecting it to a WAN or directly to the Internet. Clients cannot connect to the EnRoute500 through the Ethernet interface when operating in this mode. The Ethernet interface  IP  address  can  either  be  acquired  from  a  DHCP  server  on  the  WAN  or  be  set manually.   Figure 41. Wired interface parameters with EnRoute500 using wired interface for backhaul 11.2.1  DHCP When configured as a gateway, the EnRoute500 can be set to obtain an obtain an IP address for  its  Ethernet  interface  using  DHCP.  To  enable  the  DHCP  client  mode  on  the  Ethernet interface,  set  the  Ethernet  DHCP  mode  to  ‘client’.  When  configured  as  a  DHCP  client,  the EnRoute500 will continually attempt to contact a DHCP server until it is successful.
Chapter 11: Ethernet Interface Configuration  TR0153 Rev. E1    81  The  DHCP  reserve  parameter  (described  in  section  13.1)  has  no  effect  when  the DHCP mode parameter is set to ‘client’.  To disable Ethernet DHCP client mode, set the DHCP mode to ‘none’. If DHCP client mode is disabled, the IP configuration must be carried out manually, as described in the next section.  CLI  To  set  the  DHCP  mode  to  ‘client’  on  the  Ethernet interface,  set  the  value  of  the  ‘dhcp.role’ parameter in the ‘eth0’ interface to ‘client’, as shown in the example below.  > use eth0 eth0> set dhcp.role=client  To  disable  Ethernet  DHCP  client  mode,  set  the  DHCP  mode  parameter  to  ‘none’  as  shown below.  > use eth0 eth0> set dhcp.role=none  Web GUI The Ethernet DHCP mode value can be set via the web interface using the “DHCP” sub-tab on the “DHCP” tab on the “System Parameters” page (see Figure 43).  11.2.2  Manual IP Configuration When  an  EnRoute500  is  configured  as  a  gateway,  there  are  no  limitations  imposed  by  the EnRoute500 on the IP address assigned to the Ethernet interface. If the Ethernet DHCP mode is set to ‘none’, the manually configured IP address will be used. The default IP configuration that is assigned to the interface based on the node and mesh ID settings is available through the CLI and the web GUI.  Note that for the manually configured IP address to be used, the Ethernet DHCP mode setting must be set to ‘none’ if the EnRoute500 is connected to a network which provides access to a DHCP server.
Chapter 11: Ethernet Interface Configuration  TR0153 Rev. E1    82 The IP configuration settings  shown in the  ‘eth0’  interface in  the  CLI  and  on the  “Wired/Backhaul  Interface”  page  of the  web  interface  do  not  necessarily reflect  the  current  settings  of  the  interface.  They  are  the  requested  settings and  do  not  take  into  account  whether  the  interface  has  been  configured  via DHCP.  If  the  Ethernet  DHCP  mode  is  set  to  ‘client’,  the  ‘ip.address’, ip.broadcast’, ‘ip.gateway’, and ‘ip.netmask’ parameters will respond to a ‘get’ command with ‘<dhcp>’ to indicate that the parameters will be assigned by a DHCP server instead of any values assigned via the CLI. Use the ‘ifconfig eth0’ command in the CLI  or  access the “Status”  page  in  the  web interface to get current interface settings.  CLI The Ethernet default IP configuration is available through the following read-only parameters:  •  ip.address – IP address •  ip.broadcast – IP broadcast address •  ip.gateway – default gateway •  ip.netmask – netmask  These parameters cannot be set though. These default parameters can be overridden with the parameters listed below.  •  ip.address_force •  ip.broadcast_force •  ip.gateway_force •  ip.netmask_force  The example below, shows how a custom IP address can be set for the Ethernet interface  > use eth0 eth0> set dhcp=none eth0> set ip.address_force=192.168.1.2 eth0> set ip.broadcast_force=192.168.1.255 eth0> set ip.gateway_force=192.168.1.1 eth0> set ip.netmask_force=255.255.255.0  Web GUI When an EnRoute500 is in gateway  mode, the Ethernet IP address, gateway, netmask,  and broadcast  address  parameters  can  be  set  via  the  web  interface  using  the  “Wired/Backhaul Interface” page (see Figure 41). The current IP values can be viewed on the “Status” page.
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    83 12  Virtual Access Point (VAP) Configuration The EnRoute500 has an 802.11b/g radio dedicated to access point traffic. The settings for this radio  are  independent  of  any  settings  for  the  radio  used  for  the  mesh  backhaul  traffic.  The settings  for  the  four  virtual  access  points  supported  by  this  radio  can  vary  from  device  to device in the mesh, but typically it is desirable to set certain parameters to the same value for all the access points in a mesh to allow clients to roam seamlessly within the mesh network.   The  EnRoute500’s  four  virtual  access  points  (VAPs)  can  be  configured  to  suit  different application needs. These VAPs share a common radio, but, with a few exceptions noted in this chapter,  can  be  configured  independently.  The  availability  of  the  four  VAPs  provides  more flexibility in configuration and catering to different user classes than a single AP does.  The interfaces for the VAPs will be referred to as ‘wlanN’ when it applies to any of the four VAPs. ‘wlan1’ will be used in all examples.   Figure 42. Access point interfaces
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    84 12.1  Access Point Interfaces There are four interfaces that are used to configure the VAPs: wlan1, wlan2, wlan3, and wlan4. The  VAPs  have equivalent  configuration  capabilities and there is  no  inherent prioritization  or preference for one VAP. The section on quality-of-service settings (section 16) describes how prioritization on a per-VAP basis can be configured. 12.2  Enabling and Disabling Access Points Access  points  can  be  individually  enabled  or  disabled.  A  VAP  can  be  configured  when  it  is disabled and parameter settings are retained when it is disabled.  CLI A VAP can be enabled with the ‘enable’ parameter in the ‘wlanN’ interface as shown below.  > use wlan1 wlan1> set enable=yes  A VAP can be disabled with the following commands.  > use wlan1 wlan1> set enable=no  Web GUI Each VAP can be enabled or disabled by setting the “State” parameter via the web interface using the appropriate “wlanN” tab on the “Wireless Interfaces” page (see Figure 42).  12.3  Virtual Access Point Client Types The VAPs can be set to support both 802.11b and 802.11g clients, or just 802.11b clients.   CLI A VAP’s client type mode can be set with the ‘iwpriv.mode’ parameter in the ‘wlanN’ interface as shown below. See Table  10 for the mapping between valid values for this parameter and operating modes.  > use wlan1 wlan1> set iwpriv.mode=2
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    85 Mode value  Mode 2  802.11b 3  802.11b/g Table 10. VAP mode value/mode mapping  Web GUI The VAP’s client type mode can be set via the web interface using the appropriate “wlanN” tab on  the  “Wireless  Interfaces”  page  (see  Figure  42).  Two  client  type  options  are  available: “802.11b only” and “802.11b/g”. 12.4  Access Point Client Device Address Space Each VAP interface is either assigned a segment of the EnRoute500’s class C client address space, if the device is using the implicit addressing scheme, or an arbitrary address space can be  set  for  the interface  when  using  the  explicit  addressing  scheme.  See  section  9  for  more information on client addressing schemes.  The  EnRoute500 VAPs’ interface IP configurations can  be  changed  directly  when it is using the explicit addressing scheme. They cannot be changed directly when the device is using the implicit addressing scheme.   When an EnRoute500 is configured to use the implicit addressing scheme, set the IP address to  the  desired  value  by  modifying  the  node  ID,  mesh  ID,  and  LAN  prefix  parameters  (see sections 8.3 and 9.1.1). Set the netmask by changing the client address space segments as described in 9.1.2.   When using the explicit addressing scheme, the IP configuration can be set directly. Care must be  taken  to  avoid  using  the  same  or  overlapping  address  spaces  on  different  devices  in  a common mesh.  CLI You can view the IP settings for the VAP interfaces with the ‘ip.*’ parameters in the appropriate ‘wlanN’ interface as shown in the example below.  > use wlan1 wlan1> get ip.*  ip.address = 10.2.4.1   [read-only]  ip.address_force =   ip.broadcast = 10.2.4.127   [read-only]  ip.broadcast_force =   ip.gateway =    [read-only]  ip.gateway_force =   ip.netmask = 255.255.255.0   [read-only]
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    86  ip.netmask_force =   ip.implicit.size.actual =    [read-only]  ip.implicit.size.requested = 31  ip.implicit.start.actual =    [read-only]  ip.implicit.start.requested = 1  When  an  EnRoute500 is  using  the implicit  addressing  scheme,  the  VAP  IP  settings  can  be changed by altering the ‘id.node’, ‘id.mesh’, and ‘id.lanprefix’ parameters in the ‘sys’ interface and the ‘ip.implicit.start.requested’ parameter in the appropriate ‘wlanN’ interface.  When  an  EnRoute500  is  using  the  explicit  addressing  scheme,  the  IP  address,  netmask, gateway  address,  and  broadcast  address  can  be  set  using  the  ‘ip.address_force’, ‘ip.netmask_force’,  ‘ip.gateway_force’, and ‘ip.broadcast_force’  parameters  in  the appropriate ‘wlanN’ interface as shown in the example below.  > use wlan1 wlan1> set ip.address_force=10.12.8.1 wlan1> set ip.broadcast_force=10.12.8.255 wlan1> set ip.gateway_force= wlan1> set ip.netmask_force=255.255.255.0   Web GUI The current VAP IP settings can be viewed through the web interface on the “Config Overview” tab on the “Status” page. When using the implicit addressing scheme, the VAP IP settings can be  changed  by  altering  the  node  ID,  mesh  ID,  and  LAN  prefix  settings  on  the  “System” parameters  tab  on  the  “System  Parameters”  page.  When  using  the  explicit  addressing scheme, the IP parameters can be set on the appropriate tab on the “Wireless Interface” page.
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    87  Figure 43. Access point and wired DHCP and address space settings 12.5  Channel The 802.11b/g radio can be set to operate in the channels listed in Table 11.
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    88 Channel  Center Frequency (GHz) 1  2.412 2  2.417 3  2.422 4  2.427 5  2.432 6  2.437 7  2.442 8  2.447 9  2.452 10  2.457 11  2.462 Table 11. Access point channels and associated center frequencies  Note that only channels 1, 6, and 11 are non-overlapping.  It is not  possible  to  configure VAPs  to use  different  channels.  If the channel for wlan2 is changed, the channel will be changed for wlan1, wlan3, and wlan4. However, different devices in a mesh neighborhood can be set to use different VAP channels in order to reduce co-channel interference.  CLI The  AP  channel  is  set  with  the  ‘channel’  parameter  in  the  ‘wlanN’  interfaces.  The  example below shows how to set the AP channel to 6.  > use wlan1 wlan1> set channel=6  Web GUI The VAP channel can be set via the web interface using the appropriate “wlanN” tab on the “Wireless Interfaces” page (see Figure 42).  12.6  ESSID The  ESSID,  or  Extended  Service  Set  Identifier,  is  used  in  802.11  infrastructure  networks  to identify  a  particular  network  consisting  of  one  or  more  Basic  Service  Sets.  It  is  used  to differentiate logical networks that operate on the same channel.
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    89 Each VAP can be configured with a different ESSID. This allows network traffic to be separated based on ESSID. Assigning unique ESSIDs to the VAPs in  a mesh has the  benefit  of  allowing  a  user  to  configure  a  client  device  to  connect  to  a  specific device in the mesh. Typically a mesh will be deployed with the VAP ESSIDs having the same set of values for each EnRoute500 in order to support seamless roaming.  The ESSID value must be a text string that has a maximum length of 32 characters. It must only contain alphanumeric characters, spaces, dashes (“-“), and underscores (“_”).The ESSID setting is case sensitive.   It is possible to hide an AP ESSID by restricting it from broadcasting advertisements for that ESSID. Whether it is appropriate for an AP ESSID to be hidden depends on the application.   CLI The VAP ESSID is set as shown in the example below. When setting an ESSID that contains spaces, the ESSID value must be enclosed by quotes – the quotes are optional otherwise.  > use wlan1 wlan1> set essid=”wlan1_ap”  The broadcast of the ESSID can be controlled with the ‘hide_essid’ parameter in the ‘wlanN’ interface. The example below shows how hiding of the ESSID can be enabled.  > use wlan1 wlan1> set hide_essid=yes  Web GUI The  VAP  ESSIDs  and  their  broadcast  state  can  be  set  via  the  web  interface  using  the appropriate “wlanN” tab on the “Wireless Interfaces” page (see Figure 42). 12.7  IP Configuration of Client Devices The  VAP  interfaces  allow  client  devices  to  connect  to  access  the  mesh  network.  The  client devices can either be assigned their IP configuration in one of three ways:  •  Via DHCP from a centralized server  •  Via DHCP from a local server on the mesh device that the client device is connected to •  Be manually configured
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    90 12.7.1  IP Configuration of Clients Devices via DHCP The  EnRoute500  can  be  set  to  serve  IP  addresses  to  clients  on  the  VAP  interfaces  using DHCP.  DHCP-provided  addresses  can  be  served  either  from  a  local  server  on  the EnRoute500  or  from  an  external  server.  The  two  DHCP  modes  are  described  in  detail  in section 13. 12.7.2  Manual IP Configuration of Client Devices Client devices that use static IP addresses must have an IP address that is within the subnet of the VAP interface that they connect to.   If  the local  DHCP  server is  enabled  for  a  VAP interface, IP  addresses must  be  reserved  for statically  configured  devices  by  setting  the  DHCP  reserve  parameter.  This  will  reserve  the specified number of IP addresses at the bottom of the IP range for the interface. For example, if  the  interface  has  the  IP  address  10.2.4.1,  the  netmask  255.255.255.128,  and  the  DHCP reserve  value  5,  the  IP  addresses  10.2.4.2  through  10.2.4.6  will  be  available  for  use  by statically configured devices. The remaining IP addresses in the interface’s address space can be assigned by the DHCP server to other client devices.  CLI The  number  of  IP  addresses  reserved  for  statically-configured  devices  connected  to  the Ethernet interface is set with the ‘dhcp.reserve’ parameter in the ‘eth0’ interface.  Web GUI The  ‘dhcp.reserve’  value  can  be  set  via the web interface  using  the  “DHCP” sub-tab on the “DHCP” tab on the “System Parameters” page (see Figure 43).  12.8  Client Devices Each VAP has a status page that displays information about attached client devices and total throughput through the VAP. The signal strength of each client device, its MAC address, its IP address, and the time since data was last received from it are listed. The status pages can be accessed under the ‘Status’ tab on the ‘Status’ page, as shown in Figure 44.
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    91  Figure 44. Virtual access point client status information 12.9  Encryption and Authentication The  EnRoute500  supports  several  common  encryption/authentication  schemes,  including WEP, WPA, and WPA2, to provide secure wireless access for client devices. WEP keys with 40-bit or 104-bit lengths, pre-shared WPA keys, and multiple WPA-EAP modes.   The WEP  and WPA configuration  settings  for each  VAP are independent. An VAP can  only support one of the encryption/authentication modes at a time, but the APs in the EnRoute500 do not all have to use the same encryption/authentication scheme.
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    92  Figure 45. Access point authentication and encryption settings 12.9.1  WEP Encryption The VAPs can be protected with a WEP-based encryption key to prevent unauthorized users from intercepting or spoofing traffic.   CLI To enable WEP-based encryption, set the ‘key’ parameter in the ‘wlanN’ interface. The length of  the  encryption  key  is  determined  by  the  format  used  to  specify  the  ‘key’  value.  Valid  key formats and the corresponding encryption type and key length are listed in Table 12.  If WPA is enabled for an interface (‘wpa.enable’ CLI parameter in the ‘wlanN’ interfaces),  the  WPA  settings  will  be  used  for  encryption  and  authentication and the ‘key’ value used to enable WEP will be ignored.
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    93 Key format  Encryption format  Encryption key length s:<5 ASCII characters> <10 hex values>  WEP  40 bits s:<13 ASCII characters> <26 hex values>  WEP  104 bits <blank>  None  N/A Table 12. WEP encryption key formats  For example, 104-bit WEP encryption can be enabled using an ASCII key with  > use wlan1 wlan1> set key=”s:abcdefghijklm”  or using a hexadecimal key with  > use wlan1 wlan1> set key=”0123456789abcdef0123456789”  WEP encryption can be disabled by specifying a blank value as shown below.  > use wlan1 wlan1> set key=  Web GUI WEP  encryption  can  be  enabled  and  the  key  can  be  set  via  the  web  interface  using  the “WPA/WEP” sub-tab under the “AAA” tab on the “System Parameters” page (see Figure 45). Select  “WEP”  as  the  type  of  encryption  from  the  drop-down  menu  for  the  VAP  you  wish  to configure and set the WEP key in the text box below the drop-down menu. In the example in Figure 45, ‘wlan1’ has been configured to use WEP. 12.9.2  WPA Pre-Shared Key Mode (WPA-PSK) In  WPA  pre-shared  key  (PSK)  mode,  a  common  passphrase  is  used  for  client  devices connecting to an EnRoute500 AP. To set the WPA-PSK mode, enable WPA for the interface and set the pre-shared key value as shown below. The passphrase must be between 8 and 63 characters in length.   The minimum number of characters required for the WPA passphrase is 8. However, it  is  recommended  that  a  longer  passphrase,  with  at  least  15  characters,  is used. This will increase the strength of the encryption used for the wireless link.
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    94 CLI The  example  below  shows  how  to  enable  WPA-PSK  mode  for  wlan1.  The  ‘wpa.key_mgmt’ parameter must also be set to indicate that PSK mode is being used, as shown below.  > use wlan1 wlan1> set wpa.enable=yes wlan1> set wpa.key_mgmt=”WPA-PSK” wlan1> set wpa.passphrase=long_passphrases_improve_encryption_effectiveness  Web GUI WPA-PSK can be enabled and the pre-shared key can be set via the web interface using the “WPA/WEP” sub-tab under the “AAA” tab on the “System Parameters” page (see Figure 45). Select “WPA-PSK” as the type of encryption/authentication from  the drop-down menu for the VAP you wish to configure and enter the WPA-PSK key in the text box below the drop-down menu. In the example in Figure 45, ‘wlan2’ has been configured to use WPA-PSK. 12.9.3  WPA EAP Mode In  WPA-EAP  mode,  a  client  device  is  authenticated  using  an  802.1x  authentication  server, which is typically a RADIUS server.   The supported EAP modes are:  •  TLS      (X509v3 server & client certificates) •  PEAP-TLS    (X509v3 server & client certificates) •  TTLS      (X509v3 server certificate) •  PEAP-MSCHAPv2  (X509v3 server certificate)  The following information must be provided about the RADIUS server:  •  address – the IP address of the 802.1x server that will be used for authentication •  port – the port that the authentication server is listening on (UDP port 1812 by default) •  secret – the shared secret for the authentication server. The secret must be a string that is no longer than 32 characters in length.  See section 19.5 for instructions on how to test the RADIUS configuration and a specific set of credentials.  CLI To configure the EnRoute500 to support 802.1x authentication, the following parameters in a ‘wlanN’ interface must be set:
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    95 •  wpa.enable •  wpa.key_mgmt •  wpa.auth.server.addr •  wpa.auth.server.port  •  wpa.auth.server.shared_secret  The ‘wpa.key_mgmt’ parameter must be set to indicate that both PSK and EAP modes can be supported, as shown in the example below.  The example below shows how to enable WPA EAP mode.   > use wlan1 wlan1> set wpa.enable=yes wlan1> set wpa.key_mgmt=”WPA-PSK WPA-EAP” wlan1> set wpa.auth.server.addr=1.2.3.4 wlan1> set wpa.auth.server.port=1812 wlan1> set wpa.auth.shared_secret=enroute500_radius_secret  Web GUI WPA-EAP can be enabled and the authentication server parameters can be set via the web interface using the “WPA/WEP” sub-tab under the “AAA” tab on the “System Parameters” page (see  Figure  45).  Select  “WPA-EAP”  as  the  type  of  encryption/authentication  from  the  drop-down  menu for the VAP you  wish to configure and set the authentication server IP address, port,  and  secret  in the  text  boxes  below  the  drop-down  menu.  In  the  example  in  Figure 45, ‘wlan3’ has been configured to use WPA-EAP. 12.10  Transmit Power Cap The transmit power cap of the AP radio is configurable. Increased output power will improve communication  range,  but  will  also  extend  the  interference  range  of  the  radios.  The  default power level is 22 dBm.  If the transmit power is set to a value in excess of what can be supported by the  AP  radio,  the  actual  radio  output  power  will  be  the  highest  power supported by the AP radio.  When  setting  the  output  power  for  a  VAP,  consider  the  output  power  of  the  client devices  that  will  be  communicating  the  VAP.  If  these  devices  have  output  power levels that are far lower than that of the VAP, an asymmetric link may result. Such a link  exists  when  the  received  signal  strength  at  client  device  is  sufficient  for  a downlink to the client device to be established, but the received signal level  at the VAP is not sufficient for an uplink from the client device to be established.
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    96 CLI The example below shows how to set the VAP radio’s maximum transmit power using the CLI. The Tx power is specified in dBm, with a granularity of 0.5 dBm.   > use wlan1 wlan1> set txpower=20  Web GUI The  VAPs’  maximum transmit power  can  be set  via the  web  interface using  the  appropriate “wlanN” tab on the “Wireless Interfaces” page (see Figure 42). The “+” and “-“ buttons can be used to increase or decrease the power setting in 0.5 dBm steps. 12.11  Radio Rate The APs can be set to communicate at a specific rate or to automatically select the best rate available. For most applications, choosing automatic rate selection will be the best choice.  CLI It  is  not  currently  possible  to  set  this  through  the  CLI.  Please  use  the  web  GUI  to  set  this parameter.   Web GUI The VAPs’ communication rate can be set via the web interface using the appropriate “wlanN” tab  on  the  “Wireless  Interfaces”  page  (see  Figure  42).  To  limit  communication  to  a  specific rate,  use  the  drop-down  menu  to  select  the  appropriate  rate  and  verify  that  the  “Auto” checkbox is not selected. To set the device to automatically select the most appropriate rate, click on the “Auto” checkbox to select it. 12.12  Preamble Length The APs can be configured to use short preambles when there are no client devices present that only support long preambles. Alternatively, the device can be forced to always use long preambles.  Using  short  preambles  reduces  communication  overhead,  but  may  not  be supported by older 802.11 client devices.  The preamble  length setting is  uniform across  all VAPs.  Changing  it  for one will automatically change it for all others as well.
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    97 CLI The example below shows how to set the preamble  type used by a VAP using the CLI. The preamble type is set  with  the ‘iwpriv.short_preamble’ parameter  in  the  ‘wlanN’ interfaces. To enable  short  preambles,  set  this  parameter  to  ‘1’.  To  force  use  of  long  preambles,  set  this parameter to ‘0’.   > use wlan1 wlan1> set iwpriv.short_preamble=1  Web GUI The  preamble  types  supported  by  the  VAPs  can  be  set  via  the  web  interface  using  the appropriate “wlanN” tab on the “Wireless Interfaces” page (see Figure 42). To allow support for short preambles, set the “Use Short Preamble” drop-down menu to “Yes”. To limit preambles to long ones, set the drop-down menu to “No”. 12.13  Beacon Interval The APs’ beacon intervals are configurable. The beacon interval must fall in the range from 20 to 500 ms. The beacon interval is set to 100 ms by default.  CLI The example below shows how to set the beacon interval for a VAP using the CLI. The beacon interval  is  set  with  the  ‘iwpriv.beacon_interval’  parameter  in  the  ‘wlanN’  interfaces  and  is specified in milliseconds.  > use wlan1 wlan1> set iwpriv.beacon_interval=100  Web GUI The beacon interval for an AP can be set via the web interface using the appropriate “wlanN” tab on the “Wireless Interfaces” page (see Figure 42). Enter a value specified in milliseconds in the “Beacon Interval” field. 12.14  Maximum Link Distance The 802.11 standard defines delay values in the communication between devices that affect the maximum communication distance that can be supported. By default, the communication distance is limited to approximately 4 km (2.5 mi). The maximum communication distance can
Chapter 12: Virtual Access Point (VAP) Configuration  TR0153 Rev. E1    98 be increased by setting a custom maximum link distance value. This value can be specified in either metric or imperial units.  The maximum link distance setting is uniform across all VAPs. Changing it for one will automatically change it for all others as well.  CLI The example below shows how to  set the maximum link distance supported by a VAP using the  CLI.  The  maximum  link  distance  is  set  with  the  ‘distance’  parameter  in  the  ‘wlanN’ interfaces  and  is  specified  in  either  kilometers  or  miles.  The  ‘units’  parameter  in  the  ‘sys’ interface determines whether the distance units are entered in kilometers or miles. Set ‘units’ to “metric” for kilometers, and to “imperial” for miles.   Set the ‘distance’ parameter to “DEFAULT” or leave it blank to use the default maximum link range.  > use sys sys> set units=”metric” > use wlan1 wlan1> set distance=10  Web GUI The  maximum  link  distance  supported  by  an  AP  can  be  set  via  the  web  interface  using the appropriate “wlanN” tab on the “Wireless Interfaces” page (see Figure 42). Enter a value and specify whether it is in kilometers of miles using the adjacent drop-down menu.  Set the ‘distance’ parameter to “DEFAULT” or leave it blank to use the default maximum link range.
Chapter 13: Client IP Configuration  TR0153 Rev. E1    99 13  Client IP Configuration via DHCP Two configuration options exist for assigning IP addresses to client devices using DHCP:  •  Each  EnRoute500  hosts  a  local  DHCP  server  and  supplies  IP  addresses  to  devices attaching to any of the client access interfaces  •  A centralized DHCP server supplies IP addresses to client devices, with the EnRoute500s relaying DHCP messages between client devices and the centralized server.  The DHCP modes for client access interfaces in a mesh neighborhood can be set individually to  use  a  local  server,  a  centralized  server,  or  be  disabled.  This  allows  a  mesh  to  contain devices  with  client  access  interfaces  supporting  a  combination  of  centralized  and  localized DHCP. 13.1  Using the Local DHCP Server The EnRoute500 can be set to serve IP addresses to client devices on enabled VAP interfaces and the Ethernet interface on repeater devices using DHCP.   The IP addresses provided by the local DHCP server will be in the subnet defined by the LAN prefix, mesh ID, node ID, and the IP address range start address and size parameters in the appropriate client access interface. For example, for the ‘wlan1’ interface, the start and end of the address range are:  Start address =   <LAN prefix>. <Mesh ID>. <Node ID>. <wlan1 IP address range start address> + 1 End address =   <LAN prefix>. <Mesh ID>. <Node ID>. < wlan1 IP address range start address > -  < wlan1 IP address range size > - 2  The EnRoute500 can be configured to set aside a number of IP addresses for client devices that  will  use  a  static  IP  address.  These  IP  addresses  are  taken  from  the  pool  that  DHCP assigns IP addresses from. Thus, increasing the number of IP addresses set aside for devices with static IP  addresses will  reduce  the size of  the DHCP address pool. The  DHCP reserve parameter controls the number of IP addresses that will be reserved for static use. By default, this parameter is set to zero, assigning the maximum possible number of IP addresses to the DHCP pool. You may reserve the entire range of IP addresses, but the EnRoute500 will use at least the highest address in the range for DHCP.
Chapter 13: Client IP Configuration  TR0153 Rev. E1    100 If the ‘dhcp.reserve’ value is non-zero, the DHCP range start address will be affected as shown below  Start address =   <LAN prefix>. <Mesh ID>. <Node ID>. <wlan1 IP address range start address> + 1 - < wlan1 DHCP reserve>  CLI The  DHCP  mode  parameters  in  the  ‘wlanN’  and  ‘eth0’  interfaces  control  DHCP  behavior. When the role is set to ‘server’, the EnRoute500 will respond to DHCP requests received from client devices connected to the interface.   The examples below show how to set the DHCP server state for the ‘wlan1’ interface.  > use wlan1 wlan1> set dhcp.role=server wlan1> set dhcp.relay.enable=no  To disable the DHCP server, set the ‘dhcp.role’ parameter to ‘none’  > use wlan1 wlan1> set dhcp.role=none  The example below shows how to set the DHCP reserve parameter  > use wlan1 wlan1> set dhcp.reserve=5   Web GUI The VAP and wired interface DHCP servers’ state can be set via the web interface using the “DHCP” sub-tab under the “DHCP” tab on the “System Parameters” page (see Figure 46). All of  the  interfaces’  DHCP  settings  can  be  configured  on  this  page.  Set  the  “Mode”  field  to “Server” to set the DHCP mode for a client access interface to be the local server.  The DHCP reserve setting for all VAPs and the wired interface can be set via the web interface using  the  “DHCP”  sub-tab  under  the  “DHCP”  tab  on  the  “System  Parameters”  page  (see Figure 46).
Chapter 13: Client IP Configuration  TR0153 Rev. E1    101  Figure 46. Virtual access point DHCP configuration
Chapter 13: Client IP Configuration  TR0153 Rev. E1    102 13.2  Using a Centralized DHCP Server Centralized DHCP server mode uses DHCP relaying to enable assignment of IP addresses to wireless client devices from a common remote DHCP server. The remote DHCP server may reside either on a host connected to the mesh gateway’s wired segment, or on a server that is beyond one or more routers. When using a common DHCP server, wireless client devices are assigned IP addresses from a single address pool, and will roam seamlessly from AP to AP, assuming sufficiently overlapping AP coverage. In addition, wired clients can also have their IP addresses assigned by a centralized server.  DHCP  relay  as  a  client  IP  configuration  method  is  needed  to  facilitate  seamless roaming  within  a  mesh  neighborhood.  When  enabled  together  with  Layer  2 emulation  mode,  it  facilitates  delivery  of  IP  traffic  regardless  of  a  client’s  point  of attachment to the network. It also puts the mesh network into a mode that makes it behave  like  a  layer  2  distribution  and  access  network  expected  by  most  access controllers.  In  this  mode,  subsequently  called  “layer  2  mesh  emulation  mode”, seamless roaming to and from 3rd party bridged access points is also supported.   There are three classes of entities that must be configured when using this DHCP mode:  1.  The individual EnRoute500s, including the repeaters and the gateway device 2.  The central DHCP server 3.  Any intermediate router(s) in the path between the DHCP server and the mesh neighborhood gateway device  When  using  a  centralized  DHCP  server,  a  Client  Address  Space  (CAS)  from  which  client device IP addresses are assigned must be defined. The active client access interfaces on the EnRoute500s (there  can  be  up to  5  per  EnRoute500) must also have  IP addresses that  fall within  the  CAS.  This  is  to  facilitate  DHCP relay  and  selection  of  client  device  IP  addresses from the correct DHCP scope on servers that serve hosts connected to different subnets. The client access interface IP addresses need to be configured statically and must be contiguous. It is recommended that a contiguous range of IP addresses at either the beginning or the end of the CAS be set aside, one for each client access interface on the mesh devices.  The Client  Address  Space (CAS)  is  not equivalent to the  range  of  addresses served by the DHCP server. The DHCP-served address range is a subset of the CAS. The CAS must also include the addresses for the client access interfaces and  the  address  of  the  EnRoute1000’s  Ethernet  interface  when  the  device  is configured as a gateway.   Consider the example where a mesh neighborhood consists of 3 EnRoute500s, including the gateway device. The DHCP server resides on a host that also acts as the WAN router and is connected to  the  mesh  gateway’s  wired  segment. We will set  aside 15  IP  addresses  for  the mesh devices’ client access interfaces (3 devices, up to 5 interfaces per device). Assuming the
Chapter 13: Client IP Configuration  TR0153 Rev. E1    103 client  address  space  is  192.168.5.0/24,  with  available  addresses  from  192.168.5.1  to 192.168.5.255, we will use 192.168.5.1 for the server hosting  the DHCP server, 192.168.5.2 for the mesh gateway’s backhaul interface, set aside 192.168.5.3 to 192.168.5.18 for the mesh AP interfaces, and configure the remote DHCP server to  serve IP addresses in the range of 192.168.5.19 to 192.168.5.254 to wireless client devices. We will keep 192.168.5.255 as the broadcast address for the mesh neighborhood. 13.2.1  Support for Clients with Static IP Addresses When  using  centralized  DHCP  server  mode  for  a  client  access  interface,  client  devices connected to that interface can be assigned static addresses within the client address space. However, for these  client devices  to roam  successfully,  they  must employ duplicate  address detection  by  sending  out  ARP  requests  for  their  own  IP  address.  Windows-based  devices typically  support  this  requirement.  Please  contact  the  client  device  manufacturer  if  you  are unsure if your client device meets this requirement. 13.2.2  Configuring the EnRoute500s When operating in centralized DHCP server mode, each EnRoute500 client access interface that is to serve DHCP addresses from the centralized server must be  explicitly configured to use  centralized  DHCP  server  mode.  The  EnRoute500s  with  client  access  interfaces  in centralized  DHCP  server  mode  must  also  use  the  same  centralized  DHCP  server.  The  IP address of the central DHCP server is set with the DHCP relay server parameter. The server must be reachable through the mesh neighborhood gateway’s wired backhaul interface.  A gateway router IP address must be entered. This will be supplied to DHCP client devices as their gateway. This IP address can be the same as for the DHCP server, but need not be.  Each  client  access interface  on  the  EnRoute500  that  is  to  support  centralized  DHCP  server mode must have its DHCP mode set to “server” (CLI) or “centralized server” (web GUI) for it to support relay of IP addresses to client devices from a central DHCP server. This configuration is set with the DHCP mode parameter for each of the client access interfaces (eth0, wlan1-4).   It is possible to disable DHCP address assignments to client devices on a per-interface basis and  have  them  use  static  IP  addresses  instead.  To  disable  DHCP  for  an  interface,  set  the DHCP mode parameter associated with the interface to ‘none’.  The  address  space  that  is  to  be  used  for  the  wireless  clients  is  a  subnet  specified  with the Client Address Space parameter. The value must be specified in CIDR notation (a subnet and its size separated by a ‘/’), e.g. ‘192.168.5.0/24’  The IP addresses of the client access interfaces (eth0, wlan1-4) need to be manually assigned to each of  the EnRoute500s in the mesh neighborhood. This is done by setting the Address Base  parameter  for  the  interfaces,  which  is  assigned  to  the  first  enabled  client  access
Chapter 13: Client IP Configuration  TR0153 Rev. E1    104 interface. Addresses for the remaining client access interfaces are determined by successively incrementing  the  Base  Address  by  1.  It  is  recommended  that  the  gateway  in  a  mesh neighborhood  be  assigned  the  lowest  available  value  (3  in  the  example  in  the  CLI  section below) and the repeaters in the mesh neighborhood are given successively higher values, with an  increment  of  5  between  them  (5  is  the  maximum  number  of  client  access  interfaces available on each mesh device, including the Ethernet interface on mesh repeaters).  Layer  2  emulation  must  also  be  enabled  when  operating in  centralized  DHCP  server  mode. This  setting  is  located  on  the  “System”  tab  of  the  “System”  page  of  the  web  interface.  See section 18.2 for more information on layer 2 emulation mode.  CLI Centralized  DHCP  server  mode  is  enabled  using  the  ‘dhcp.relay.enable’  and ‘l2.client_mac_fwd’ parameters in the ‘sys’ interface as shown in the example below. > use sys sys> set dhcp.relay.enable=yes sys> set l2.client_mac_fwd=yes  In  the  example  below,  the  central  DHCP  server  and  next  WAN  router  reside  on  the  same segment to which the mesh gateway’s wired interface is connected.  > use sys sys> set dhcp.relay.server=192.168.5.2 sys> set dhcp.relay.gateway=192.168.5.1  The example below shows how to set the DHCP  mode parameters for the wlan1 and  wlan2 interfaces.  > use wlan1 wlan1> set dhcp=server wlan1> set wlan1.dhcp.relay.enable=yes > use wlan2 wlan2> set dhcp=server wlan1> set wlan2.dhcp.relay.enable=yes  To  disable  distribution  of  centralized  DHCP  addresses  on  an  interface,  set  the  interface’s ‘dhcp.role’ parameter to ‘none’ as shown below.  > use wlan3 wlan3> set dhcp=none  The Client Address Space value is set with the ‘dhcp.relay.dhcp_subnet’ parameter in the ‘sys’ interface.  This value should  be  a  class  A,  B, or,  C  subnet  specified  using CIDR notation  as shown in the example below.  > use sys sys> set dhcp.relay.dhcp_subnet=192.168.5.0/24
Chapter 13: Client IP Configuration  TR0153 Rev. E1    105 The Base Value, which sets the IP address of client access interfaces on an EnRoute500, is set through  the ‘dhcp.relay.base’ parameter in the ‘sys’ interface. The example below shows the configuration for a mesh neighborhood consisting of 3 devices.  On the gateway: > use sys sys> set dhcp.relay.base=192.168.5.3  on the first repeater device: > use sys sys> set dhcp.relay.base=192.168.5.8  and on the second repeater device: > use sys sys> set dhcp.relay.base=192.168.5.13  Note that the value of the fourth octet increases by 5 for each device since that is the number of client access interfaces that each device has, and each interface requires one IP address.  Web GUI Centralized  DHCP  server  mode can  be  enabled  via  the web interface on  the “DHCP Relay” sub-tab under the “DHCP” tab on the “System Parameters” page (see Figure 47). The external DHCP  server  IP  address, the gateway  router  address, the Client  Address Space parameter, and the Base Value can also be set on this page. The DHCP mode parameters for all client access interfaces  can  be  set  on  the “DHCP” sub-tab  under the  “DHCP” tab  on  the  “System Parameters”  page.  Set  the  DHCP  mode  to  “central  server”  for  all  interfaces  whose  client devices should receive addresses from the central DHCP server.  On the “System” tab of the “System” page, set the “L2 Emulation” to “enabled”.   Figure 47. Centralized DHCP server mode settings for use with a centralized DHCP server
Chapter 13: Client IP Configuration  TR0153 Rev. E1    106 13.2.3  Configuring the Central DHCP Server Guidelines for configuring the central DHCP server are provided below. The full configuration of the central DHCP server will depend on the type of DHCP server that is used and is beyond the scope of this document.   Typically the following information must be available in order to configure the server:  1.  The local interface (to the DHCP server) over which the DHCP-related messages from the mesh neighborhood arrive 2.  The parameter(s) that define the address lease time  3.  Whether DNS and domain names are to be provided by the DHCP server to client devices 4.  The  range  of  the  flat  IP  address  that  is  used  for  assigning  IP  addresses  to  client devices. The  range  must  not  include the  IP addresses  set aside  for the client access interfaces on each mesh device.  The following is a segment of the dhcpd.conf file for a Linux DHCP server (ISC DHCP server) that illustrates the scope settings for the mesh network:  subnet 192.168.5.0 netmask 255.255.255.0 {         option broadcast-address        192.168.5.255;         option subnet-mask              255.255.255.0;         option domain-name              "domain.com";         range                           192.168.5.18 192.168.5.254; }   Note that in this definition no “routers” option is needed. If a global “routers” option is defined, the EnRoute500s in a mesh neighborhood will automatically change it to an appropriate value in  DHCP  responses  to  clients  based  on  the  centralized  DHCP  server  settings  on  the EnRoute500s. In this example, the mesh network includes 3 mesh devices, 2 IP addresses are set aside for the DHCP server and the mesh gateway, and therefore the address pool starts from 192.168.5.18.
Chapter 14: Connecting an EnRoute500 Mesh Network to a WAN  TR0153 Rev. E1    107 14  Connecting an EnRoute500 Mesh Network to a WAN The  options  for  connecting  an  EnRoute500  gateway  to  a  WAN  and  establishing  layer  3  IP routing include:  •  Static route configuration on the WAN router •  Source network address translation (NAT) on the mesh gateways •  Layer 2 mesh emulation as part of DHCP relay mode.   Table 13 shows compatibility of single vs. multiple mesh gateways with the use of implicit vs. explicit  addressing  for  the  first  two  configuration  options.  Note  that  different  options  and requirements exist depending on whether a single or multiple gateways devices are used.   Table 13. Supported WAN connection options for single and multi-gateway  mesh neighborhoods using implicit or explicit client addressing schemes 14.1  Static Routing Configuration on WAN Router 14.1.1  “Single Gateway, Implicit Addressing Scheme” Option A  single  EnRoute500  gateway  can  be  directly  connected  to  a  WAN  without  using  Network Address Translation. With this gateway configuration and with the implicit addressing scheme in use, the router on the network that the gateway is attached to must be configured to forward the mesh subnet and the LAN subnets to the gateway’s Ethernet interface. The subnets that need to be forwarded are:  Class B subnet:   <LAN prefix>.<Mesh ID>.0.0 Class C subnet:   <Mesh prefix >.<Mesh ID>.0  Static Route Configuration on WAN Router  NAT on Mesh Gateway  Supported?  Requirements  Supported?  Requirements Single gateway, implicit addressing  Yes Define EnRoute500 mesh gateways as next hop gateway in WAN router or enable L2 emulation mode on mesh gateway Yes Single gateway, explicit addressing  Yes Define EnRoute500 mesh gateway as next hop gateway in WAN router Yes Multiple gateways, implicit addressing  Yes  Enable L2 mode on all mesh gateways  Yes Multiple gateways,  explicit addressing  No  N/A  Yes No client access interface can be in central DHCP mode
Chapter 14: Connecting an EnRoute500 Mesh Network to a WAN  TR0153 Rev. E1    108 In the case where the LAN prefix is 10 and the mesh prefix is 172.29, the subnets the router would need to forward to the gateway are 10.2.0.0/255.255.0.0 and 172.29.0.0/255.255.0.0.  Alternatively, to avoid any configuration of the WAN router, enable L2 emulation mode on the mesh gateway. This will automatically direct traffic destined for the mesh neighborhood’s mesh devices and clients to the mesh gateway. See section 18.2 for instructions on how to enable L2 emulation mode.  CLI The subnet information can be retrieved from the ‘sys’ interface as shown below.  > use sys sys> get id.*  sys.id.lanprefix = 10  sys.id.mesh = 2  sys.id.meshprefix = 172.29  sys.id.node = 4  Web GUI The LAN prefix and mesh prefix can be obtained by inspecting the IP addresses available on the  “Status”  page.  Alternatively,  the  mesh  ID  can  be  obtained  from  the  “Mesh”  tab  on  the “Wireless Interfaces” page and the LAN prefix can be obtained from the “System” tab on the “System” page. 14.1.2  “Single Gateway, Explicit Addressing Scheme” Option A  single  EnRoute500  gateway  can  be  directly  connected  to  a  WAN  without  using  Network Address  Translation.  With  this  gateway  configuration  and  the  explicit  addressing  scheme  in use, the router on the network that the gateway is attached to must be configured to forward the  mesh  subnet and  all  explicitly defined client subnets  used  in  the  mesh  to the gateway’s Ethernet interface.  14.1.3  “Multiple Gateway, Implicit Addressing Scheme” Option Multiple  EnRoute500  gateways  can  be  directly  connected  to  a  WAN  without  using  Network Address  Translation.  With  this  gateway  configuration  and  the  implicit  addressing  scheme  in use, the router on the network that the gateway is attached to must be configured to use L2 emulation  mode  on  all  mesh  gateways.  This  will  automatically  direct  traffic  destined  for  the mesh  neighborhood’s  mesh  devices  and  clients  to  the  appropriate  mesh  gateway,  avoiding any configuration of the WAN router.  See section 18.2 for instructions on how to enable L2 emulation mode.
Chapter 14: Connecting an EnRoute500 Mesh Network to a WAN  TR0153 Rev. E1    109 14.1.4  “Multiple Gateway, Explicit Addressing Scheme” Option This mode of operation is not supported. 14.2  Network Address Translation (NAT) on Mesh Gateways Network  Address  Translation  (NAT)  provides  a  simple  method  for  connecting  a  mesh neighborhood to a WAN router and also prevents hosts that are located on external networks from  initiating  connections  with  client  devices  and  individual  mesh  repeaters.  However,  the mesh  devices,  as  well  as  their  client  devices,  are  able  to  establish  connections  and communicate with hosts connected to networks external to the mesh.  NAT cannot be used if any of the mesh devices in a mesh neighborhood are using centralized DHCP server mode.  The advantages of using NAT are:  •  You  can  easily  attach  a  mesh  neighborhood  to  an  existing  network.  You  do  not need to modify any settings on the WAN router on your existing network to forward IP packets to client devices within your mesh neighborhood. •  The devices in the mesh neighborhood are shielded from the network that the gateway is attached to. •  You only consume a single IP address on your existing network when connecting the mesh neighborhood to it.  The main disadvantages of using NAT is   •  You are not able to initiate connections into the EnRoute500s in the mesh neighborhood or their clients from outside the mesh neighborhood. •  It is not compatible with centralized DHCP server mode.  CLI To set the NAT state, use the commands  > use sys sys> set nat.enable=<yes|no>  Web GUI The NAT state can be set via the web interface on the “Wired/Backhaul Interface” page (Figure 48).
Chapter 14: Connecting an EnRoute500 Mesh Network to a WAN  TR0153 Rev. E1    110  Figure 48. NAT and VPN settings 14.3  Layer 2 Mesh Emulation in DHCP Relay Mode When DHCP relay and layer 2 emulation mode are both enabled, the mesh network emulates a layer 2 distribution and access network. In this case the WAN router configuration is limited to  setting  up  a  static  route  without  a  designated  next-hop  gateway  via  the  router’s  LAN interface. In this configuration, additional static routes to the mesh address space as well as implicit  and  or  explicit  address  spaces  served  by  the  mesh  neighborhood  may  be  added, without the need for specifying a next hop gateway.
Chapter 14: Connecting an EnRoute500 Mesh Network to a WAN  TR0153 Rev. E1    111 14.4  VPN Access to a Mesh Gateway An  EnRoute500  configured  as  a  gateway  can  establish  a  VPN  connection  to  an  OpenVPN server. This VPN connection provides the following capabilities:  •  Any  EnRoute500  in  the  mesh  can  be  contacted  directly  from  a  remote  host,  even  when NAT is enabled on  the gateway device. This allows remote access  to devices to  monitor their behavior or reconfigure them •  A secure path between the mesh and a host, which can be used to monitor and reconfigure the mesh, is established. The control and status traffic passing between the mesh and the host is protected if it passes over a public network at any point.  The state of the VPN client on the EnRoute500 is set with the Enable VPN parameter. The IP address  of  the  VPN  server  and  its  port  are  specified  with  the  VPN  Server  and  VPN  Port parameters. Note that the VPN server parameter can either be an IP address or a resolvable host name.   To allow a connection to be established to an OpenVPN server, appropriate credentials must also be uploaded to the EnRoute500. Contact Tranzeo for information on how to create VPN credentials.  CLI The  example  below  shows  how  to  enable  the  VPN  connection  (‘vpn.enable’  in  the  ‘sys’ interface)  and  set  the  server  and  port  parameters  (‘vpn.server’  and  ‘vpn.port’  in  the  ‘sys’ interface).   > use eth0 sys> set vpn.enable=yes sys> set vpn.server=192.168.0.1 sys> set vpn.port=1194  It is not possible to upload VPN credentials with the CLI. Please use the web interface to do this.  Web GUI These  parameters  can  be  set  via  the  web interface  on  the  “Wired/Backhaul  Interface”  page when the device scheme is set to ‘gateway’ as illustrated in Figure 48.
Chapter 15: Controlling Access to the EnRoute500  TR0153 Rev. E1    112  15  Controlling Access to the EnRoute500 The  EnRoute500  supports  the  following  features  for  restricting  access  to  it,  restricting inter-client device communication and access to mesh devices, and shielding client devices from an external network:  •  Firewall •  Client-to-client communication blocking •  Gateway firewall  It further supports controlled network access by client devices through MAC address black lists and mesh association through MAC white lists. 15.1  Firewall The EnRoute500 has a firewall that blocks certain types of traffic destined for the EnRoute500. This  prevents  client devices attached to  an EnRoute500   and  devices  on the mesh  gateway WAN from connecting to the gateway.   The default firewall rules only affect packets destined for the EnRoute500, and have no  effect  on  packets  forwarded  by  the  device.  The  firewall  should  typically  be enabled  on  all  EnRoute500s  since  it  prevents  undesired  access  to  the  mesh devices.  By default, the ports listed in Table 14 are set to be allowed for connection to the EnRoute500.  Function  Port(s)  Type  Protocol SSH  22  Source & destination  TCP DNS  53  Source & destination  UDP DHCP  67, 68  Destination  UDP HTTP  80  Destination  TCP SNMP  161  Source & destination  UDP HTTPS  443  Destination  TCP HTTP redirect (if splash pages are enabled)  3060  Destination  TCP Roaming support  7202 – 7205, 7207  Destination  UDP OnRamp  20123  Source & destination  UDP Table 14. Source and destination ports allowed by default
Chapter 15: Controlling Access to the EnRoute500  TR0153 Rev. E1    113 CLI The  firewall  is  enabled  by  selecting  the  ‘firewall’  interface  and  setting  the  ‘node.enable’ parameter.  > use firewall firewall> set node.enable=yes  Lists  of  allowed  source  and  destination  ports  for  inbound  TCP  and  UDP  traffic  can  be specified. These lists can be set with the following parameters in the ‘firewall’ interface:  •  node.tcp.allow.dest •  node.tcp.allow.source •  node.udp.allow.dest •  node.udp.allow.source  The list  of allowed ports  must  be  a  space-delimited string enclosed by quotes. The  example below shows how to set the TCP source ports parameters.  > use firewall firewall> set node.tcp.allow.dest=”22 23 80 5280”  Web GUI It is not possible to configure the state of the firewall and the open firewall ports via the web interface. It is enabled by default. 15.2  Gateway Firewall The  gateway  firewall  blocks  connections  originating  outside  the  mesh  neighborhood  from entering the mesh via the gateway, protecting mesh devices and their clients from unwanted traffic.  The  gateway  firewall  will  permit  return  traffic  for  connections that  originate inside  the mesh neighborhood or on mesh clients.  The  gateway  firewall  should  only  be  enabled  on  EnRoute500s  that  are  configured  as gateways.  It  is possible  to  enable  the gateway firewall  on a repeater  device,  but it does not have any effect on the flow of traffic through the device’s Ethernet interface.  If you have enabled NAT (see section 14.2) on the Ethernet interface ‘eth0’, you will have an implicit firewall that limits the type of inbound connections that are possible.
Chapter 15: Controlling Access to the EnRoute500  TR0153 Rev. E1    114 CLI The  state  of  the  gateway  firewall  is  controlled  with  the  ‘gateway’  parameter  in  the  ‘firewall’ interface. Enable the gateway firewall with  > use firewall firewall> set gateway=yes  disable it with  > use firewall firewall> set gateway=no  Web GUI It is not possible to configure the state of the gateway firewall via the web interface. 15.3  Blocking Client-to-Client Traffic Client-to-client traffic can be blocked or permitted on a per-interface basis. By enabling client-to-client traffic blocking for one or more of an EnRoute500’s client access interfaces, the client devices that attach to that particular interface will not be able to communicate with any client devices attached to that or any other client access interface in the mesh. Client-to-client traffic can be controlled for interfaces wlan1, wlan2, wlan3, wlan4, and eth0.  CLI  The parameters that control client-to-client access are all in the ‘firewall’ interface. They are:  •  node.allowc2c.eth0 •  node.allowc2c.wlan1 •  node.allowc2c.wlan2 •  node.allowc2c.wlan3 •  node.allowc2c.wlan4  To  block  client-to-client  traffic,  select  the  ‘firewall’  interface  and  set  the  parameter  for  the appropriate interface to ‘no’, To allow traffic between client devices, set the parameter to ‘yes’. The examples below illustrate how to configure these parameters.   To block client-to-client traffic for client devices attached to wlan1:  > use firewall firewall> set node.allowc2c.wlan1=no  To allow client-to-client traffic for client devices attached to eth0:
Chapter 15: Controlling Access to the EnRoute500  TR0153 Rev. E1    115  > use firewall firewall> set node.allowc2c.eth0=yes  Web GUI The client isolation parameters can be set via the web interface using the “Connections” sub-tab  under  the “Firewall” tab on  the “Security” page  (see  Figure  49). By  setting an interface’s client isolation parameter to ‘yes’, client devices connecting to that interface will not be able to communicate with any other client devices in the mesh.   Figure 49. Connection-related firewall settings  Note that  devices  connected  to  different interfaces can  only  communicate  with  each  other if client-to-client isolation is disabled for both interfaces.   Client-to-client  isolation  is  only  enabled  if  the  EnRoute500  firewall (firewall.node.enable) is enabled (section 15.1).
Chapter 15: Controlling Access to the EnRoute500  TR0153 Rev. E1    116 15.4  Connection Tracking The  firewall  keeps  track  of  existing  TCP  connections.  It  is  advisable  to  enable  connection tracking for public networks that can have large numbers of users. In particular, it is important to  enable  connection tracking  if your  network is  heavily loaded  or if it  has  users running file sharing applications. A number of parameters are available for tuning how connection tracking is handled. 15.4.1  Limiting Number of TCP Connections Per Client Device The number of TCP connections allowed per client device can be limited. For most use cases, setting the connection limit to 30 is sufficient.   Users running file sharing applications may have difficulties establishing connections when  TCP  connection  limiting is enabled  since the  file  sharing application  may  be consuming the maximum number of TCP connections allowed.  CLI The ‘conntrack.connlimit.enable’ parameter in the ‘firewall’ interface is used to set the state of TCP  connection  limiting.  The  ‘conntrack.connlimit.connections’  parameter  is  used  to  set  the maximum number of connections allowed per client device.  > use firewall firewall> set conntrack.connlimit.enable=yes firewall> set conntrack.connlimit.connections=30  Web GUI The  TCP  connection  limit-related  settings  are  set  on  the  “Connections”  sub-tab  on  the “Firewall” tab of the “Security” page (see Figure 49). The “Conntrack Limiting” drop-down box sets  the  state  of  TCP  connection  limiting  and  the  “Conntrack  Connection  Limits”  sets  the maximum number of TCP connections allowed per client device. 15.4.2  Connection Tracking Table Size The size of the connection tracking table can be set. This sets maximum aggregate number of connections that can be supported for all users on all mesh devices in the mesh neighborhood the  gateway  is  servicing.  Allowed  values  are  in  the  range  from  4096  to  16384.  A  larger connection  tracking  table  allows  more  connections  to  be  maintained  without  dropping  older connections.  Typically,  the  default  size  of  8192  is  adequate  for  normal  operation  and  the setting should only be increased on gateway devices with high levels of traffic since they need
Chapter 15: Controlling Access to the EnRoute500  TR0153 Rev. E1    117 to  track  the  connections  for  all  client  devices  connected  to  any  of  the  mesh  devices  in  the gateway’s mesh neighborhood.  CLI The  connection  tracking  table  size  is  set  by  selecting  the  ‘firewall’  interface  and  setting  the ‘conntrack.table_size’ parameter.  > use firewall firewall> set conntrack.table_size=16384  Web GUI The connection tracking table size is set with the “Conntrack Size” field on the “Connections” sub-tab on the “Firewall” tab of the “Security” page (see Figure 49). This field is located under the “Connection Tracking” heading. 15.4.3  Connection Tracking Timeout The connection tracking timeout parameter allows you to flush connections that have been idle for  an  extended  period  of  time  from  the  connection  tracking  table.  This  will  help  limit  the maximum  required  size  of  the  connection  tracking  table.  By  default,  this  parameter is  set  to 3600 seconds (1 hour).  CLI The  connection  tracking  timeout  is  set  by  selecting  the  ‘firewall’  interface  and  setting  the ‘conntrack.tcp_timeout_established’ parameter. The timeout is specified in seconds.  > use firewall firewall> set conntrack.tcp_timeout_established=3600  Web GUI The  connection tracking timeout  is set  with  the “Conntrack Connection Timeout” field  on  the “Connections” sub-tab on the “Firewall” tab of the “Security” page (see Figure 49). This field is located under the “Connection Tracking” heading. Specify the timeout limit in seconds. 15.5  Custom Firewall Rules Custom  firewall  rules  can  be  added  that  control  how  traffic  forwarded  by  an  EnRoute500  is handled. For example, rules can be added to:
Chapter 15: Controlling Access to the EnRoute500  TR0153 Rev. E1    118 •  Block client traffic on certain ports •  Block traffic from a given client access interface to a certain subnet  The custom firewall rules can be added on the “Custom Rules” sub-tab on the “Firewall” tab on the  “Security”  page  as  shown  in  Figure  50. These  rules  are  specified  as  you  would  specify rules  for  iptables,  with  the  exception  of  the  chain  that  they  are  to  be  added  to  cannot  be specified. All rules will be applied to the iptables forwarding chain.  List  one rule  per  line  in the text box  on  the  “Custom  Rules”  tab  and  click on  the “Save and Apply Changes” button when all rules have been entered. The following examples of custom rules illustrate how to use the custom firewall interface.  Blocking SMTP traffic 25   This rule will block all SMTP traffic, which uses port 25.  -dport 25 -j DROP  Limiting Access Based on Client Access Interface  Packets can be filtered based upon which interface they were received through. For example, wlan1 and  wlan2 can be used to provide users with access to two different, private  subnets, while  wlan3  users  have  access  to  neither  of  these  subnets.  Users  of  all  wlans  would  have access to the Internet though. The following rules will:  •  Drop traffic from wlan1 destined for the 192.168.2.0 subnet •  Drop traffic from wlan2 destined for the 192.168.1.0 subnet •  Drop traffic from wlan3 destined for the 192.168.1.0 and 192.168.2.0 subnets  -i wlan1 --dst 192.168.2.0/24 -j DROP -i wlan2 --dst 192.168.1.0/24 -j DROP -i wlan3 --dst 192.168.1.0/24 -j DROP -i wlan3 --dst 192.168.2.0/24 -j DROP
Chapter 15: Controlling Access to the EnRoute500  TR0153 Rev. E1    119  Figure 50. Custom firewall settings 15.6  Access Control Lists (ACLs) Access control lists can be created for each of the VAP interfaces and the mesh interface. 15.6.1  Access Point Access Control Lists (ACLs) The  access  control  lists  (ACLs)  for  the  VAP  interfaces  (wlan1-wlan4)  block  access  to  any device with a MAC address matching those on the list. Individual ACLs can be defined for each VAP.  Web GUI The ACLs can be defined via the web interface on the appropriate “wlanN” sub-tab under the “ACL” tab on the “Security” page as shown in Figure 51. Enter a MAC address and click on the “Add MAC”  button  to  add the  address to  the  ACL  for  that VAP.  Once  an  address has  been added, it will appear at the bottom of the page. To delete a MAC address in an ACL, click on the “Delete MAC” button next to the address.
Chapter 15: Controlling Access to the EnRoute500  TR0153 Rev. E1    120  The  ACL  for  a  VAP  must  be  enabled  after  it  has  been  created.  Choose  “blacklist”  from  the drop-down menu and click on “Change ACL Mode” to enable the list. Choose “none” from the drop-down menu and click on “Change ACL Mode” to disable the ACL.   Figure 51. AP ACL configuration 15.6.2  Mesh ACL The access control list (ACL) for the mesh interface blocks access to the EnRoute500 via the mesh interface for any mesh device whose mesh MAC address is not listed in the ACL.  It is possible to  isolate  a mesh  device  from other  devices  in  the mesh if the mesh ACL is incorrectly configured. If the mesh ACL is enabled and no MAC addresses are present on the list, or the wrong addresses are present, it will not be possible for other mesh devices to communicate with the device.  Web GUI The mesh ACL can be defined via the web interface on the “Mesh” sub-tab under the “ACL” tab on the “Security” page as shown in Figure 52. Enter a MAC address and click on the “Add MAC” button to add the address to the ACL for that VAP. Once an address has been added, it
Chapter 15: Controlling Access to the EnRoute500  TR0153 Rev. E1    121 will appear at the bottom of the page. To delete a MAC address in an ACL, click on the “Delete MAC” button next to the address.  The  ACL  for  a  VAP  must  be  enabled  after  it  has  been  created.  Choose  “whitelist”  from  the drop-down menu and click on “Change ACL Mode” to enable the list. Choose “none” from the drop-down menu and click on “Change ACL Mode” to disable the use of the ACL for the mesh interface.   Figure 52. Mesh ACL configuration
Chapter 16: Quality of Service (QoS) Configuration  TR0153 Rev. E1    122 16  Quality of Service (QoS) Configuration The  EnRoute500 has  extensive  support  for quality  of  service settings  that  allow traffic to be prioritized  based  on  the  source  interface,  destination  interface,  and  type  of  traffic.  The EnRoute500 QoS scheme allows both rate limiting and rate reservation for all interfaces.  16.1  Priority Levels The Flow Priority parameters set the relative priority of outbound traffic based on the source interface. These parameters can be set to an integer value in the range from 0 to 99, with a higher number indicating a higher priority. If a flow priority level parameter is set to ‘inherit’, the associated interface  will  assume  the  default priority  level  set.  The  default  flow  priority  is the flow  priority  ‘inherited’  by  each  interface  if  another  flow  priority  setting  is  not  applied.  The default flow priority is configurable.  Traffic originating  from  an  interface with  a  higher priority will  take priority over  traffic from all interfaces  with  a  lower  priority  value  until  the  higher-priority  interface  has  no  more  data  to send. If multiple interfaces have the same priority level, their traffic will be given equal access to  the  outbound  interface.  Rate  reservation  and  rate  limiting,  described  in  the  following sections,  can  be  used  to  avoid  one  interface  dominating  the  use  of  the  mesh  interface bandwidth.  As  a  rule, locally  generated  traffic  should always  have  the  highest  priority  so  that EnRoute500 control traffic  has precedence over client  traffic and the  mesh  can  be maintained.  The absolute values of the flow priority settings do not have any weighting effect. If a flow  priority  is  higher  for  one  interface  than  another,  the  former  will  always  be prioritized with any remaining bandwidth allocated to the other one.  The Max/Min Hardware Priority parameters can be used to limit the hardware priority queues that  traffic  from  a  particular  interface  can  use  for  outbound  traffic.  Valid  values  for  these parameters are from 1 to 4, which are the priority levels listed in Table 15.   Abbreviation  Description  Priority level VO  Voice  4 (highest) VI  Video  3 BE  Best Effort  2 BK  Background  1 (lowest) Table 15. Hardware flow priority levels
Chapter 16: Quality of Service (QoS) Configuration  TR0153 Rev. E1    123 When sending data out through any of the wireless interfaces (wlanN, mesh0), these hardware priorities map directly to the 802.11e hardware priority output queues on the wireless card. The default level for all traffic is Best Effort.  To  increase  the  hardware  priority  of  all  traffic  originating  from  a  particular  interface,  set  the value of Min Hardware Priority to a value larger than 1. This will force all traffic from the chosen interface to use a hardware queue equal to or greater than the Min Hardware Priority value set. To reduce the maximum hardware priority of traffic from an interface, set the Max Hardware Priority parameter to a value less than 4. To disable hardware prioritization, set the Min/Max Hardware Priority parameters to ‘0’.  Setting an interface’s flow priority above that of another interface results in all traffic originating  on  the  higher  flow  priority interface  blocking  traffic  on  the lower  priority interface until all traffic from the prioritized interface has been sent. In comparison, elevating  the  Min  Hardware  Priority  associated  with  an  interface  will  prioritize,  but not  fully  block  traffic  tagged  with  a  lower  hardware  priority.  Instead  the  medium access  delay  will  be  reduced  (as  dictated  by  the  IEEE  802.11e  standard)  for  the traffic  with  the  elevated  hardware  priority.  Thus,  these  two  priority  types  provide different  gradations of  quality  control, even when applied  en  mass to  an  interface, although further refinements can be set using the EnRoute500 rate limiting features discussed below.   Changing hardware priorities does not affect the rate limiting and reservation (section 16.2), it only affects which output hardware queues that provide the required support for the 802.11e standard.  CLI Flow  priority  levels  are  set  with  the  ‘in.<intf>.flow_priority’  parameters  in  the  ‘qos’  interface, where <intf> is one of the following: default, local, eth0, mesh0, wlan1, wlan2, wlan3, wlan4. ‘local’ refers to traffic originating on the device itself, not from its client devices (in practice this means mesh network control traffic). The example below sets locally generated traffic to have top priority and wlan1 to have priority over all other interfaces.  > use qos qos> set in.default.flow_priority=10 qos> set in.local.flow_priority=90 qos> set in.wlan1.flow_priority=20 qos> set in.wlan2.flow_priority=inherit qos> set in.wlan3.flow_priority=inherit qos> set in.wlan4.flow_priority=inherit qos> set in.eth0.flow_priority=inherit  Hardware  priority  levels  are  set  with  ‘in.<intf>.hwpri{max,min}’  in  the  ‘qos’  interface,  where <intf> is one of the following: default, local, eth0, mesh0, wlan1, wlan2, wlan3, wlan4.
Chapter 16: Quality of Service (QoS) Configuration  TR0153 Rev. E1    124 The example below shows how to configure the system such that all traffic from ‘wlan1’ with a ‘Voice’ or ‘Video’ priority will be reduced to a ‘Best Effort’ priority. Traffic with ‘Best Effort’ and ‘Background’ priorities will not be affected.  > use qos qos> set in.wlan1.hwpri.max=2  The example below shows how to configure the system such that all traffic from ‘wlan2’ with a ‘Background’ or ‘Best Effort’ priority will be increased to a ‘Video’ priority. Traffic with ‘Video’ and ‘Voice’ priorities will not be affected.  > use qos qos> set in.wlan2.hwpri.min=2   Web GUI Flow priorities can be set via the web interface under the “QoS” tab on the “QoS” page (see Figure  53).  The  hardware  priority  levels  can  be  set  for  each  interface  under  the  “Advanced QoS” tab on the “QoS” page (see Figure 54).   Figure 53. QoS settings
Chapter 16: Quality of Service (QoS) Configuration  TR0153 Rev. E1    125   Figure 54. Advanced QoS configuration (only settings for some interfaces are shown) 16.2  Rate Limiting A rate limit can be set at each QoS Control Point shown in Figure 55. The Control Points can be split into three groups, listed below in decreasing order of importance:  •  Interface output limit •  Interface output limit of traffic from a particular interface •  Interface output limit of traffic of a certain type from a particular interface   All  rate  limit  parameter  values  are  in  kbps.  If  no  rate  limit  parameter  is  set,  rate limiting will be disabled for that interface or interface and traffic combination.  The maximum output data rate for interfaces can be limited with the Output Limit parameters for each client access interface. The default output limit value is applied to interfaces that have the Output Limit parameter set to ‘inherit’.
Chapter 16: Quality of Service (QoS) Configuration  TR0153 Rev. E1    126 mesh0local wlan1 wlan2 wlan3 wlan4eth0mesh0 wlan1 wlan2 wlan3 wlan4eth0InputOutputBEBKVIVOBEBKVIVOBEBKVIVOBEBKVIVOBEBKVIVOBEBKVIVOBEBKVIVOQOSQoS Control Point Figure 55. Quality of Service rate limit control points  Data rate limits can also be imposed based on traffic type through an interface. The maximum data rate for a certain type of traffic that enters the EnRoute500 through a particular interface and exits it through another interface can be limited.   There is no standalone input rate limiting. Limiting the input rate of an interface on the  EnRoute500  only  makes  sense  in  the  context  of  the  output  for  another interface(s). In most cases you are concerned with mesh0 as the output interface.   CLI The example below shows how to limit the maximum output rate of the mesh0 interface to 8 Mbps and the maximum output rates of all four wlanN interfaces to 2 Mbps each.  > use qos qos> set out.mesh0.limit=8192 qos> set out.wlan1.limit=2048 qos> set out.wlan2.limit=2048 qos> set out.wlan3.limit=2048 qos> set out.wlan4.limit=2048  The  maximum  data  rate  for  traffic  that enters  the  EnRoute500  through a  particular interface and exits it through another interface can be limited with the ‘out.<output intf>.<input intf>.limit’ parameters  in  the  ‘qos’  interface,  where  <output  intf>  is  one  of  the  following:  default,  eth0, mesh0, wlan1, wlan2, wlan3, wlan4; and <input intf> is one of the following: default, eth0, local,
Chapter 16: Quality of Service (QoS) Configuration  TR0153 Rev. E1    127 mesh0, wlan1, wlan2, wlan3, wlan4. The ‘out.default.default.limit’ value is applied to interfaces that have the ‘out.<output intf>.<input intf>.limit’ parameter set to ‘inherit’ or is left blank.   The example below shows how to limit the maximum output rate of data from  wlan1, wlan2, wlan3, and wlan4 through the mesh0 interface to 2 Mbps, 1 Mbps, 512 kbps, and 256 kbps, respectively.  > use qos qos> set out.mesh0.wlan1.limit=2048 qos> set out.mesh0.wlan2.limit=1024 qos> set out.mesh0.wlan3.limit=512 qos> set out.mesh0.wlan4.limit=256  Traffic  type  limits  can  be  set  with  the  ‘out.<output  intf>.<input  intf>.<traffic  type>.limit.’ parameters  in  the  ‘qos’  interface,  where  <output  intf>  is  one  of  the  following:  default,  eth0, mesh0,  wlan1, wlan2,  wlan3,  wlan4; <input  intf>  is  one  of  the  following: default,  eth0, local, mesh0,  wlan1, wlan2,  wlan3,  wlan4; <traffic type>  is  one  of  the  following:  ‘vo’,  ‘vi’,  ‘be’,  ‘bk’ (see Table 15 for description of traffic types).  The example below shows how to limit the maximum output rate of voice, video, best effort, and background traffic from wlan1 through the mesh0 interface to 256 kbps, 1 Mbps, 256 kbps, and 256 kbps, respectively.  > use qos qos> set out.mesh0.wlan1.vo.limit=256 qos> set out.mesh0.wlan1.vi.limit=1024 qos> set out.mesh0.wlan1.be.limit=256 qos> set out.mesh0.wlan1.bk.limit=256  Web GUI The  interface-  and  traffic-based  Output  Limit  parameters  can  be  set  via  the  web  interface under the “QoS” and “Advanced QoS” tabs on the “QoS” page (see Figure 53 and Figure 54). 16.3  Rate Reservation Rate reservation is used to guarantee bandwidth for certain types of traffic. Rate reservations can be made for traffic based on:  •  The traffic input and output interfaces  •  The traffic type, input interface, and output interface
Chapter 16: Quality of Service (QoS) Configuration  TR0153 Rev. E1    128 For rate reservations to be enforced, a rate limit must be set for the traffic type that the reservation is made for. Setting a rate limit for a broader traffic type, of which the one the reservation is made for is a subset, is also acceptable. For example, when making a rate reservation for voice traffic from wlan1 to mesh0 (‘out.mesh0.wlan1.vo.reserve’),  a  limit  must  be  set  with  ‘out.mesh0.limit’, ‘out.mesh0.wlan1.limit’, or ‘out.mesh0.wlan1.vo.limit’.  Rate  reservations  guarantee  bandwidth  for  a  particular  traffic  type,  but  if  no  such  traffic  is present, the bandwidth reserved will be returned to the pool of available bandwidth for other traffic types to use. The points at which rate reservations can be made are shown in Figure 56. These  points  are  similar  to  where  rate  limits  can  be  placed,  except  that  rate  reservations require both an input and output interface, whereas rate limits can be made without specifying an input interface.  mesh0local wlan1 wlan2 wlan3 wlan4eth0mesh0 wlan1 wlan2 wlan3 wlan4eth0InputOutputBEBKVIVOBEBKVIVOBEBKVIVOBEBKVIVOBEBKVIVOBEBKVIVOBEBKVIVOQOSQoS Control Point  Figure 56. Quality of Service rate reservation control points  All rate reservation parameter values are in kbps. If no rate reservation parameter is set,  rate  reservation  will  be  disabled  for  that  interface  or  interface  and  traffic combination.  A rate reservation, which guarantees a certain amount of bandwidth, can be made for traffic that  enters  the  EnRoute500  through  a  particular  interface  and  exits  it  through  another interface.  Rate  reservations  can  also  be  set  based  on  traffic  type  through  an interface.  The
Chapter 16: Quality of Service (QoS) Configuration  TR0153 Rev. E1    129 default value set  for the EnRoute500 rate  reservation is applied  to interfaces that  have their bandwidth reservation parameters set to ‘inherit’ or are left blank.   CLI The parameters that are used to set these rate reservations are in the ‘qos’ interface and are of the form ‘out.<output intf>.<input intf>.reserve’, where <output intf> is one of the following: default,  eth0,  mesh0,  wlan1,  wlan2,  wlan3,  wlan4;  and  <input  intf>  is  one  of  the  following: default, eth0, local, mesh0, wlan1, wlan2, wlan3, wlan4.  Typically, most  rate  reservations  will  involve  reserving  bandwidth  for  traffic  from  a  particular client  access  interface  to  the  mesh0  interface.  The  example  below  shows  how  to  reserve differing amount of  bandwidth on  mesh0 for traffic  originating  from  the  wlan1, wlan2, wlan3, and wlan4 interfaces.  > use qos qos> set out.mesh0.wlan1.reserve=2048 qos> set out.mesh0.wlan2.limit=1024 qos> set out.mesh0.wlan3.limit=512 qos> set out.mesh0.wlan4.limit=256  A rate reservation for a certain type of traffic that enters the EnRoute500 through a particular interface  and  exits  it  through  another  interface  can  be  set  with  the  ‘out.<output  intf>.<input intf>.<traffic type>.reserve.’ parameters in the ‘qos’ interface, where <output intf> is one of the following: default, eth0, mesh0, wlan1, wlan2, wlan3, wlan4; <input intf> is one of the following: default, eth0, local, mesh0, wlan1, wlan2, wlan3, wlan4; <traffic type> is one of the following: ‘vo’, ‘vi’, ‘be’, ‘bk’ (see Table 15 for description of traffic types).  The  ‘out.default.default.limit’  value  is  applied  to  interfaces  that  have  the  ‘out.<output intf>.<input intf>.reserve’ parameter set to ‘inherit’ or is left blank.  The  example  below  shows  how  to  reserve  bandwidth  for  voice,  video,  best  effort,  and background traffic from wlan1 through the mesh0 interface to 512 kbps, 1 Mbps, 256 kbps, and 128 kbps, respectively.  > use qos qos> set out.mesh0.wlan1.vo.reserve=512 qos> set out.mesh0.wlan1.vi.reserve=1024 qos> set out.mesh0.wlan1.be.reserve=256 qos> set out.mesh0.wlan1.bk.reserve=128  Web GUI The  rate  reservation  parameters  can  be  set  via  the  web  interface  under  the  “QoS”  and “Advanced QoS” tabs on the “QoS” page (see Figure 53 and Figure 54).
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    130 17  Enabling VLAN Tagging The  EnRoute500  supports  VLAN  tagging,  with  each  client  access  interface  capable  of supporting a different VLAN tag. 17.1  Client Access Interface Configuration VLAN tagging can be independently controlled on each client access interface (eth0, wlan1-4). The  Enable  VLAN  parameters  for  the  ‘eth0’,  ‘wlan1’,  ‘wlan2’,  ‘wlan3’,  and  ‘wlan4’  interfaces controls the state of VLAN tagging.   VLAN tagging must be enabled on the backhaul Ethernet interface on a mesh neighborhood’s gateway for VLAN tags to be included in data frames sent to the WAN. See section 17.2 for more details.  The VLAN ID value for each client access interface is set with the VLAN ID parameter for each interface.  The  VLAN  ID  must  be  in  the  range  from  0  to  4095.  Note  that  0  and  4095  are reserved  values  and  1  is  the  default  VLAN  ID.  There  are  no  restrictions  on  VLAN  IDs  for different interfaces or mesh devices having to match or be different.  CLI The example below shows how to enable VLAN tagging on the ‘wlan1’ interface and set the VLAN ID to 12 using the parameters ‘vlan.enable’ and ‘vlan.id’ in the ‘wlan1’ interface.   > use wlan1 wlan1> set vlan.enable=yes > use wlan1 wlan1> set vlan.id=12  Web GUI The  VLAN  Enable  and  VLAN  ID  parameters  can  be  set  via  the  web  interface  under  the “wlanN”  tabs  on  the  “Wireless  Interfaces”  page  and  on  the  “Wired/Backhaul  Interface”  page (see Figure 57).
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    131  Figure 57. Configuring VLAN for VAP interfaces 17.2  Gateway Configuration For VLAN tags to be preserved on traffic that exits a mesh neighborhood, VLAN support must be  enabled  for  the  Ethernet  interface  on  the  mesh  neighborhood’s  gateway  device  (the backhaul interface).  The “Enable VLAN” parameter for the Wired/Backhaul interface controls the state of VLAN tagging. If VLAN tagging is enabled on the gateway’s interface to the WAN, all  outbound  traffic  will  have  its  VLAN  tags  preserved.  If  VLAN  tagging  is  disabled  for  the backhaul  interface,  all  VLAN  tags  will  be  stripped  from  frames  entering  the  mesh neighborhood.  When VLAN is enabled for the backhaul interface, data frames forwarded by the gateway to the WAN will preserve their existing VLAN tag, if they have one. Frames that do not have a tag will  be  tagged  with  the  default  VLAN  ID  for  the  gateway’s  Ethernet  interface.  The  VLAN  ID
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    132 must be in the range from 0 to 4095. Note that 0 and 4095 are reserved values and 1 is the default VLAN ID.  CLI The  example  below  shows  how  to  enable  VLAN  tagging  on  the  backhaul  interface  on  a gateway device using the ‘vlan.enable’ parameter in the ‘eth0’ interface.   > use eth0 eth0> set vlan.enable=yes  The example below shows how to set the VLAN ID for the backhaul Ethernet interface using the ‘vlan.id’ parameter in the ‘eth0’ interface.  > use eth0 eth0> set vlan.id=1  Web GUI The backhaul VLAN parameters are set on the “Wired/Backhaul Interface” page as shown in Figure 58.   Figure 58. Configuring VLAN for backhaul interface
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    133  18  Integration with Enterprise Equipment The  EnRoute500  supports  authentication,  accounting,  and  monitoring  services  that  easily integrate with enterprise equipment. In this section the following topics are described:  •  Splash pages •  Backhaul health monitoring •  Layer 2 client emulation 18.1  Configuring Splash Pages The  EnRoute500  supports  splash  pages, which can  be  used  to  restrict  access  to  the mesh network  and  provide  information  to  users  that  connect  to  the  mesh. When  a  user  connects through  a  client  access  interface  to  an  EnRoute500  with  splash  page  support  enabled, the splash page for the appropriate interface will be displayed and the user will be restricted from accessing  other destinations on  the Internet  until  they  have logged in.  The splash page  can require  the  user  to  enter  logon  credentials  or  simply  click  a  button  to  complete  the  login process.   To use splash pages, a number of URLs for login, successful login, and failed login must be specified.  A  RADIUS  server  that  provides  authentication  services  may  also  need  to  be specified. 18.1.1  Enabling Splash Pages The  enabling  of  splash  pages  can  be  controlled  on  a  per-interface  basis.  Two  splash  page mode are supported – one which requires client device users to login in to gain access to the network  and  another  which  requires  them  to  simply  click  on  a  button  on  the  web  page  to proceed.   CLI Enable  or  disable  splash  pages  with  the  ‘splash.enable.wlanN’  parameters  in  the  ‘sys’ interface. For a splash page to be displayed on an interface, the appropriate parameter must be set to ‘yes’. The example below illustrates how to set the ‘splash.enable.wlan1’ parameter in the ‘sys’ interface to enable splash pages for the wlan1 interface.  > use sys sys> set splash.enable.wlan1=yes  Use the ‘splash.auth.server.wlanN.enable’ parameters in the ‘sys’ interface to select whether a user  is  required  to  provide  login  credentials  for  a  particular  interface.  The  example  below
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    134 illustrates how to set the parameter for the wlan1 interface such that a user will be required to login to access the network.  > use sys sys> set splash.auth.server.enable.wlan1=yes  Web GUI Splash pages can be enabled on a per-interface basis on the “Splash Pages” sub-tab under the “AAA” tab on the “System Parameters” page of the web interface (see Figure 59). Setting whether  client  login  is  required  can  also  be  set  on  this  page  with  the  “Require  Login” parameter.    Figure 59. Splash page configuration
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    135 18.1.2  Configuring Splash URLs The URL that a user is redirected to for login purposes can be individually configured for each client access interface that supports splash pages (wlan1-4). URLs for successful login, failed login, and error conditions can also be specified for each interface.   The ‘login URL’ parameter sets the URL that a user is redirected to when they attach to the interface  and  have  not  yet  been  authenticated.  This  parameter  should  not  be  left  blank  if splash  pages  are  enabled  for  the  interface.  No  client  would  be  able  to  access  the  network through the interface if splash pages are enabled and the login URL parameter does not point to a valid URL.  The  ‘success  URL’  parameter  sets  the  URL  that  a  user  is  redirected  to  when  they  have successfully logged in. If this variable is left blank, a default page that indicates login success will be displayed.  The ‘fail URL’ parameter sets the URL that a user is redirected to when a login attempt fails. If this variable is left blank, a default page that indicates login failure will be displayed.  The  ‘error  URL’ parameter  sets  the  URL  that a  user is  redirected  to  when  a  login  error  has occurred. For example, this page would be displayed if a valid authentication server could not be reached. If this variable is left blank, a default page that indicates an error has occurred will be displayed.  CLI In  the  examples  that  follow,  <intf>  represents  any  of  the  client  access  interfaces  ‘wlan1’, ‘wlan2’, ‘wlan3’, or ‘wlan4’. The ‘splash.url.<intf>.login’ parameters in the ‘sys’ interface set the login  URLs. The  ‘splash.url.<intf>.success’  parameters  in  the  ‘sys’ interface  set  the  success URLs.  The  ‘splash.url.<intf>.fail’  parameters  in  the  ‘sys’  interface  set  the  fail  URLs.  The ‘splash.url.<intf>.error’ parameters in the ‘sys’ interface set the error URLs  The example below shows how the ‘wlan1’ and ‘wlan2’ interfaces can be set to use different URLs for the login process.  > use sys sys> set splash.url.wlan1.login=http://server.domain.com/wlan1_login.htm sys> set splash.url.wlan1.success=http://server.domain.com/wlan1_success.htm sys> set splash.url.wlan1.fail=http://server.domain.com/wlan1_fail.htm sys> set splash.url.wlan1.error=http://server.domain.com/wlan1_error.htm sys> set splash.url.wlan2.login=http://server.domain.com/wlan2_login.htm sys> set splash.url.wlan2.success=http://server.domain.com/wlan2_success.htm sys> set splash.url.wlan2.fail=http://server.domain.com/wlan2_fail.htm sys> set splash.url.wlan2.error=http://server.domain.com/wlan2_error.htm
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    136 Web GUI All of the splash page-related URLs can be set on the “Splash Pages” sub-tab under the “AAA” tab on the “System Parameters” page of the web interface (see Figure 59). 18.1.3  Sample HTML Code for Splash Pages The login HTML page must contain specific form information as shown in the sample code in Figure 60 and Figure 61. Figure 60 contains the code required for an interface that requires a login.  Figure  61  contains  code  for  a  login  page  that  the  user  just  clicks  through  to  unlock network access.   The critical lines in Figure 60 are 6, 12, 15, and 19. The ‘action’ value in line 6 of Figure 60 must point to a server name for which there is a DNS proxy entry on the local mesh device and the last part of  it must be  ‘/radius/login.cgi’. The  DNS  proxy  entry, which  will be different for each mesh device in the network, must be mapped to one of the EnRoute500’s IP addresses (see section 8.8 for more information on how to set the DNS proxy configuration).   The example below shows how to configure the DNS proxy assuming the login page redirects to the host ‘redirect.domain.com’ and the IP address of the wlan1 interface is 10.1.2.1.  > use sys sys> set dnsproxy.enable=yes sys> set dnsproxy.hosts=”dns.proxy.name.here=10.1.2.1”  The DNS proxy setting is used in conjunction with the splash pages to ensure that a common login URL can be used on all mesh devices. The DNS proxy entry directs the results of the login process to the right location – that is, the EnRoute500 that the client device is connected to.  The login page must also contain the ‘input’ fields on lines 12, 15, and 19. These are used to allow  a  user  logging  in  to  provide  their  username  and  password,  and  to  submit  them.  The names of these input fields, ‘username’, ‘password’, and ‘login’, must not be changed.
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    137 1 <html> 2 <head> 3   <title>Test Login Page</title> 4 </head> 5 <body> 6   <form method="POST" action="https://dns.proxy.name.here/radius/login.cgi"> 7   Welcoming text or 'Terms of Service' could go here. <br /> 8  9   <table border="0"> 10   <tr> 11     <td> Username: </td> 12     <td> <input name="username" type="text"><br /> </td> 13   </tr><tr> 14     <td> Password: </td> 15     <td> <input name="password" type="password"> </td> 16   </tr> 17   </table> 18  19     <input name="login" type="submit" value="Submit"> 20   </form> 21 </body> 22 </html> Figure 60. Sample HTML code for login web page with password authentication  If  the  splash  page  is  not  configured  to  require  a  user  to  provide  login  credentials,  the requirements for the login page are slightly different, as shown in Figure 61. The page must still contain a form definition similar to that on line 6 in Figure 61. The ‘action’ value must be set to point to a proxied server name, just as for the case where a user is required to provide login credentials. The last part of the ‘action’ value must be ‘/splash/nologin.cgi’. Also, a button with the name ‘login’ must be defined, as shown on line 8 of Figure 61.  1 <html> 2 <head> 3   <title>Test Login Page</title> 4 </head> 5 <body> 6   <form method="POST" action="https://dns.proxy.name.here/splash/nologin.cgi"> 7   Welcoming text or 'Terms of Service' could go here.<br /> 8     <input name="login" type="submit" value="Continue"> 9   </form> 10 </body> 11 </html> Figure 61. Sample HTML code for web page when authentication is disabled 18.1.4  Configuring the Authentication Server A RADIUS  authentication  server  must  be  specified  when  the  splash  page is  enabled  for  an interface and login is required. The following parameters must be specified:  •  the server address – can be either a hostname or and IP address
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    138 •  the port on the server that the RADIUS server is listening on •  the shared secret – must be a string of alphanumeric characters that is 32 characters or less in length.  CLI The  ‘splash.auth.server.<intf>.host’,  ‘splash.auth.server.<intf>.port’,  and ‘splash.auth.server.<intf>.secret’  parameters  in  the  ‘sys’  interface,  where  <intf>  is  either ‘wlan1’,  ‘wlan2’,  ‘wlan3’,  or  ‘wlan4’,  specify  the  authentication  server  to  use.  The  example below shows how to configure the authentication server for interfaces ‘wlan1’ and ‘wlan2’.  > use sys sys> set splash.auth.server.wlan1.host=auth1.yourserverhere.com sys> set splash.auth.server.wlan1.port=1812 sys> set splash.auth.server.wlan1.secret=authsecret sys> set splash.auth.server.wlan2.host=auth2.yourserverhere.com sys> set splash.auth.server.wlan2.port=1812 sys> set splash.auth.server.wlan2.secret=authsecret  Web GUI The  authentication  server  parameters  can  be  set  on  the  “Splash  Pages”  sub-tab  under  the “AAA”  tab on  the “System Parameters” page  of  the  web interface (see Figure 59) using the fields for “Login Server Address”, “Login Server Port”, and “Login Server Secret”. 18.1.5  Trusted MAC Addresses A  list  of  trusted  MAC  addresses,  which  do  not  require  splash  page  authentication,  can  be defined. When a device with one of these MAC addresses connects to an EnRoute500, it will automatically have full access to the WAN.   CLI The list of trusted MAC addresses is set with the ‘splash.trusted_macs’ parameter in the ‘sys’ interface.  The  MAC  addresses  are  specified  as  a  list  of  48-bit  addresses  separated  by commas. An example of setting this parameter is shown below.  > use sys sys> set splash.trusted_macs="aa:bb:cc:00:00:01,aa:bb:cc:00:00:02"  Web GUI The  authentication  server  parameters  can  be  set  on  the  “Advanced  Splash  Pages”  sub-tab under the “AAA” tab on the “System Parameters” page of the web interface (see Figure 62). The list of trusted MAC addresses is displayed on this page. To delete a trusted MAC from the list, click on the “Delete MAC” button next to the MAC address.
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    139   Figure 62. Adding trusted MAC addresses and accessible hosts 18.1.6  Bypass Splash Pages for Access to Specific Hosts It is possible to specify a list of IP addresses that client devices can access without the client devices having to view a splash screen.   CLI The list of hosts that can be accessed without having to view a splash screen is set with the ‘splash.bypass_hosts’  parameter  in  the  ‘sys’  interface.  The  hosts  are  specified  by  their  IP addresses and must be separated by commas. An example of setting this parameter is shown below.  > use sys sys> set splash.bypass_hosts="1.1.1.1,2.2.2.2"  Web GUI The IP addresses of hosts that can be accessed without having to view a splash screen can be set on the “Advanced Splash Pages” sub-tab under the “AAA” tab on the “System Parameters” page  of  the  web  interface  (see  Figure  62).  The  list  of  IP  addresses  of  bypassed  hosts  is
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    140 displayed on this page. To delete an IP address from the list, click on the “Delete Host” button next to the IP address. 18.2  Layer 2 Emulation Certain back-end systems (e.g. Internet gateways) use the MAC addresses of client devices for  authentication  and  accounting  purposes.  The  EnRoute500  uses  a  layer  3  approach  to mesh routing, which means that the client device MAC addresses are typically not provided to the back-end servers. A layer 2 emulation mode can be enabled on the EnRoute500 to provide the client device MAC address information to back-end systems. Note that layer 2 emulation must be enabled to support seamless roaming  When layer 2 emulation is enabled, a mesh neighborhood gateway will send Ethernet (layer 2) frames to the WAN using the MAC address of the client device the packet originated from as the source address. Mesh  gateways will act as proxies for incoming  client traffic, as well as forward  packets  with  MAC  destination  addresses  of  client  devices  that  are  in  the  mesh neighborhood they service.  In layer 2 emulation mode, a mesh gateway will respond to ARP requests if it has a route to the  target  IP  address  contained  in  the  ARP  request.  If  central  DHCP  mode  is  enabled,  the source MAC address will be set to the client device’s MAC address for which a request has been received, thereby facilitating the emulation of the mesh as a layer 2 network. The list of subnets for which a mesh gateway has routes includes the mesh and implicit/explicit network addresses.  If  central  DHCP  mode  is  enabled,  the  mesh  gateway  routing  table also includes host  routes  to  addresses  in  the  client  address  space.  Thus  care  must  be  taken  that  these subnets are not used elsewhere in the network.   In order to reduce the amount of address space consumed by the mesh, the ARP responses can be limited to a subset of the mesh’s address space. The EnRoute500 can be configured to:  •  Disregard ARP requests for mesh IP addresses (typically in the 172.29.0.0/16 subnet) •  Disregard all ARP requests except for IP addresses within the client address space (if centralized DHCP server mode is enabled). Note that this is a superset of the previous case.  CLI Layer 2 emulation is enabled with the ‘l2.client_mac_fwd’ parameter in the ‘sys’ interface. This parameter should be set to the same value for all devices in a given mesh neighborhood. The example below shows how to enable layer 2 emulation.  > use sys sys> set l2.client_mac_fwd=yes
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    141 To  limit  the  range  of  addresses  for  ARP  requests  that  the  gateway  will  respond  to,  set  the ‘l2.hide_internal.enable’  parameter  in  the  ‘sys’  interface  to  ‘yes’.  Set  the ‘l2.hide_internal.gateway.deny.mesh’ in  the ‘sys’ interface  to  ‘yes’  to  disregard ARP  requests for  IP  addresses  within  the  mesh  subnet  (typically  172.29.0.0/16).  Set ‘l2.hide_internal.gateway.deny.all’ in  the ‘sys’  interface  to ‘yes’ to disregard all  ARP  requests (except  for  addresses  within  the  client  address  space  if  centralized  DHCP  server  mode  is enabled).   The example below shows how to disregard all ARP requests except for those for addresses within the client address space.  > use sys sys> set l2.hide_internal.enable=yes sys> set l2.hide_internal.gateway.deny.all=yes  The  example  below  shows  how  to  disregard  all  ARP  except  for  addresses  within  the  mesh address space.  > use sys sys> set l2.hide_internal.enable=yes sys> set l2.hide_internal.deny.mesh=yes sys> set l2.hide_internal.deny.all=no  Web GUI The state of layer 2 emulation is set on the “System” tab of the “System” page (see Figure 63). The  console  interface in  the  web  GUI  must  be  used  to  configure  which  address  ranges the gateway responds to ARP requests for. See the CLI section above for parameter names and set these using the console interface (see section 8.15).
Chapter 18: Integration with Enterprise Equipment  TR0153 Rev. E1    142  Figure 63. Enabling/disabling layer 2 emulation
Chapter 19: Diagnostics Tools  TR0153 Rev. E1    143  19  Diagnostics Tools The  EnRoute500  has  a  number  of  diagnostics  tools  to  help  the  user  diagnose  and  correct configuration issues. These tools are available on the “Diagnostics” page, accessible from the navigation bar. The individual diagnostics tools are accessible from the row of tabs shown on the “Diagnostics” page. 19.1  Ping The “Ping” tab on the “Diagnostics” page allows the user to check for network connectivity by pinging a remote device (see Figure 64). Either an IP address, e.g. 10.1.2.3, or a hostname, e.g. www.yahoo.com, can be specified. The number of pings to send can be set to 1, 10, or 100.  Click on “Ping Address” to start pinging the device. The results of the pings will appear on the bottom  half  of  the  page  shortly  after  clicking  on  the  button.  There  may  be  a  delay of  a  few seconds to display the ping results if the ping destination is not responsive.   Figure 64. Pinging a remote device
Chapter 19: Diagnostics Tools  TR0153 Rev. E1    144 19.2  Traceroute The  “Traceroute”  tab  on  the  “Diagnostics”  page  allows  the  user  to  determine  the  individual intermediary devices used to route traffic from the EnRoute500 to a remote device (see Figure 65).   Enter the IP address, e.g. 10.1.2.3, or hostname, e.g. www.yahoo.com, of the device you wish to  find the  route  path  to.  Check  the  “Resolve  Names”  box  if  traceroute  should  show  device names,  when  available,  instead  of  just  IP  addresses.  Click  on  the  “Trace  Route”  button  to begin  tracing  the  route.  The  intermediary  nodes  will  be  displayed  on  the  bottom  half  of  the page. Click on “Stop Trace” to stop the tracing process.   Figure 65. Determining the route from the EnRoute500 to a remote device using traceroute 19.3  Packet Capture The “Packet Capture” tab on the “Diagnostics” page allows the user to capture traffic on the EnRoute500’s network interfaces (see Figure 66). The captured data can either be displayed in  the web interface or saved to a  file that can be downloaded and analyzed  using 3rd-party tools, such as Wireshark (http://www.wireshark.org/). At most, 10 captured files can be saved on the EnRoute500 at any given time.  The  full array  of  options available  for  packet  capture  is  described in  Table  16.  A  number  of examples of common packet capture scenarios are also presented below.
Chapter 19: Diagnostics Tools  TR0153 Rev. E1    145 Capturing DHCP Traffic From Client Device on wlan1  1.  Set “Interface” to “wlan1” 2.  Set “Protocol” to “all” 3.  Set “Packet Count” to “20” 4.  Set “Packet length” to 500 5.  Click on “DHCP” next to “Common Protocols” 6.  Set “Output” to “File” 7.  Click on “Start Capture” 8.  Allow the capture to complete automatically when the prescribed number of packets has been captured or click on “Stop Capture” to halt the capture 9.  The captured data is accessible by clicking on the link at the bottom of the page under the  heading  “Available  tcpdump  files”.  The  file  name  format  used  is  “<file prefix>_MMDDYYY.HHMM.  Click  on  this  link  to  save  it  to  your  computer.  The downloaded file can be parsed by packet analyzers such as Wireshark. 10. Click the checkbox next to the filename in the “Available tcpdump list” and click on the “Delete  Selected”  button.  This  will  delete  the  file  from  the  EnRoute500  and  free  up space for other capture files.  Capturing All Traffic From a Specific Client Device  1.  Set “Interface” to the one that the client device is attached to 2.  Set “Protocol” to “all” 3.  Set “Packet Count” to “500” 4.  Set “Packet Length” to 500 5.  Set the “Optional Host” to the IP address of the client device of interest 6.  Set “Output” to “File” 7.  Click on “Start Capture” 8.  Allow the capture to complete automatically when the prescribed number of packets has been captured or click on “Stop Capture” to halt the capture 9.  The captured data is accessible by clicking on the link at the bottom of the page under the  heading  “Available  tcpdump  files”.  The  file  name  format  used  is  “<file prefix>_MMDDYYY.HHMM.  Click  on  this  link  to  save  it  to  your  computer.  The downloaded file can be parsed by packet analyzers such as Wireshark. 10. Click the checkbox next to the filename in the “Available tcpdump list” and click on the “Delete  Selected”  button.  This  will  delete  the  file  from  the  EnRoute500  and  free  up space for other capture files.
Chapter 19: Diagnostics Tools  TR0153 Rev. E1    146  Figure 66. Capturing network traffic  Option  Description Interface Selects the interface from which packets are captured. Note that some packets may be available  on  multiple  interfaces.  For  example,  data  from  a  client  device  connected  to wlan1 destined for a device on the Internet will pass through wlan1 and either the wired interface on a gateway device or the mesh interface on a repeater device Protocol  Data can be captured for the following protocols: TCP, UDP, ICMP,  and ARP. Set  the value to “all” if you do not wish to filter out packets based on protocol type. Packet Count  Sets the number of packets to capture. The provided settings are 20, 50, 100, and 500. Show Host Names  Captured data will show resolved host names instead of IP addresses when this option is selected.  Show MAC addresses In addition to IP address or hostnames, source and destination MAC addresses  will be displayed for each packet when this option is selected. Packet Length Sets the length of each packet that should be captured. If you are only interested in the header contents  of a  packet, this  value can be lowered to  reduce the size of  the  data capture file. If it is set to too low of a value, critical data may be not be captured though. Optional Host  Sets a host name or IP address to use for filtering purposes. All packets with this host as their source OR destination address will be captured. Optional Port Sets  a  port  to  use  for  filtering  purposes.  All  packets  with  this  port  as  their  source  OR destination port will be captured. NOTE: this setting only has an effect on capture of TCP or UDP packets. Common Protocols  Click on the protocol names listed to add filtering parameters for them in the “Additional Parameters” text box. It is possible to select more than one protocol to filter on. Optional Additional Parameters The underlying application used to capture packets is tcpdump. Use this field to specify additional parameters to tcpdump that are not made available through the GUI.  Output Select whether to display the data on the webpage or to save it to a file, which can be downloaded  from  the  device.  The  file  name  format  used  is  “<file prefix>_MMDDYYY.HHMM. Output File Prefix  Sets an optional file prefix for saved files. Table 16. Packet capture options
Chapter 19: Diagnostics Tools  TR0153 Rev. E1    147 19.4  Centralized DHCP Testing The “DHCP” tab on the “Diagnostics” page can be used to test access to an external DHCP server when the EnRoute500 is in centralized DHCP server mode (see Figure 67). Click on the “Test DHCP” button to initiate a test. The results of the test will be displayed at the bottom of the page.   Figure 67. Testing the connection to an external DHCP server 19.5  RADIUS Server Testing The “RADIUS” tab on the “Diagnostics” page can be used to test authentication of credentials by a RADIUS servers used for splash page or WPA authentication (see Figure 68). Use the procedure below to test the validity of credentials with a RADIUS server.  1.  Select the RADIUS server you want to use for the test from the drop-down menu 2.  Enter the credentials you want to test in the “Username” and “Password” fields 3.  Click on the “Test User” button   The  results  of  the  test  will  be  displayed  at  the  bottom  of  the  page.  Three  outcomes  are possible:  •  The credentials were authenticated by the server •  Communication was established with the server, but the credentials were not valid •  It was not possible to establish communication with the server
Chapter 19: Diagnostics Tools  TR0153 Rev. E1    148   Figure 68. Testing credentials with a RADIUS server 19.6  Diagnostic Dump The “Diagnostic Dump” tab on the “Diagnostics” page allows the user to create a snapshot of diagnostic  data  that  can  be  downloaded  to  a  PC  and  sent  to  Tranzeo  technical  support  for analysis (see Figure 69).   Figure 69. Generating a diagnostic dump
Chapter 19: Diagnostics Tools  TR0153 Rev. E1    149  The list of diagnostic dumps available for download is displayed at the bottom of the page. The diagnostic  dumps  can  be  downloaded  by  clicking  on  the  filenames.  To  delete  one  or  more diagnostic dumps, select the check boxes next to the ones you wish to delete and then click on the “Delete Selected” button.
Chapter 20:Firmware Management  TR0153 Rev. E1    150 20  Firmware Management 20.1  Displaying the Firmware Version The firmware version string contains the following information:  •  Build date •  Major version number •  Minor version number •  Build number  These values are embedded in the version string as follows:  enroute500_< Build date >_< Major version >_< Minor version >_< Build number>  CLI Firmware version information is available in the ‘version’ interface. The example below shows how to display the current firmware version.  > use version version> get release  release = ENROUTE500_20060419_00_00_0133  Web GUI The  firmware  version  is  displayed  at  the  top  of  the  “Status”  page  accessible  via  the  web interface. 20.2  Upgrading the Firmware The EnRoute500 supports secure remote firmware upgrade.   When  upgrading  the  firmware,  it  is  important  to  upgrade  the  firmware  on  all devices in a mesh neighborhood.  Prior to upgrading firmware, please contact Tranzeo technical support to find out  if  there  are  any  version-specific  instructions  for  upgrading  from  the firmware version you are currently using.
Chapter 20:Firmware Management  TR0153 Rev. E1    151 There  are  two  approaches  for  upgrading  the  firmware  of  a  number  of  devices  in  a  mesh neighborhood:  •  Upgrade the firmware on each device individually •  Upgrade the firmware for the entire mesh neighborhood from the mesh gateway  The latter method is the recommended approach.  The primary benefit of using the mesh neighborhood upgrade approach is that the gateway will determine the order in which it should start the upgrades of devices in the mesh based on their relative connectivity. If each device is upgraded manually, the user must determine the connectivity between devices to ensure  that they are upgraded  in  an  order  such  that  connectivity  to  devices isn’t  broken.  For  example, consider the following scenario:  •  Device 1 is a gateway •  Device 2 is a repeater connected to device 1 •  Device 3 is a repeater connected to device 2  If the upgrade of device 2 is started before the upgrade of device 3, the connection to device 3 from the gateway will be lost, preventing the user from connecting to that device.  At least the gateway device must have access to the Internet, and specifically the  Tranzeo  upgrade  server,  to  complete  an  upgrade  unless  the  upgrade image has already been downloaded to the device’s non-volatile memory.  If power to the EnRoute500 is lost during the upgrade process,  it is possible that the device will become inoperable.  20.2.1  Upgrading the Firmware on all Devices in a Mesh Neighborhood The  web  GUI  page  for  upgrading  all  devices  in  a  mesh  neighborhood  is  only available on devices configured as gateways.  It is possible to control the firmware upgrade of all devices in a mesh neighborhood from the “Upgrade Mesh” tab on the “Upgrade” page. This page displays the following information:  •  Firmware available on the remote upgrade server •  Firmware available in the non-volatile memory of the EnRoute500 •  Devices in the mesh neighborhood
Chapter 20:Firmware Management  TR0153 Rev. E1    152  Figure 70. Updating firmware on all devices in a mesh neighborhood  Follow the procedure below to upgrade the devices in a mesh neighborhood:  1.  Select the firmware version you want to upgrade to from the “Firmware on Server” box  2.  Click on the button with the arrow to the right of the “Firmware on Server” box. This will begin  the  download  process  of  the  firmware  from  the  Tranzeo  upgrade  server  to  the non-volatile memory on the EnRoute500. While the firmware is downloading, it will be shown in blue in the “Firmware on Gateway Node” box.   If the  completion  percentage does not update, click on the “Upgrade  Node” tab to update it.  3.  When the download has been completed, verify that all the devices you wish to update are listed under the “Nodes Associated with this Gateway” heading. If they are proceed to the next step. 4.  Select the firmware you wish to upgrade to from the “Firmware on Gateway Node” box. 5.  Click on the “Copy to All” button. The upgrade image will be copied to the devices in the mesh that do not already have it. Text indicating progress will be displayed next to the device IP address under the “Nodes Associated with this Gateway” heading (“files being copied”, “copy completed”, and finally “READY TO BE UPGRADED”).  6.  Again,  select  the  firmware  you  wish  to  upgrade  to  from  the  “Firmware  on  Gateway Node” box.
Chapter 20:Firmware Management  TR0153 Rev. E1    153 7.  Click on “Install  All”. Text indicating  that the node is  being upgraded will  be displayed next to the device IP address under the “Nodes Associated with this Gateway” heading. 8.  Wait for the upgrade to complete (approximately 20 minutes). 20.2.2  Upgrading the Firmware on an Individual Device The firmware can be upgraded on an individual device using the “Upgrade Node” tab on the “Upgrade” page. This is the only tab that is available on devices configured as repeaters. This page displays the following information:  •  Firmware currently installed on the EnRoute500 •  Firmware available on the remote upgrade server •  Firmware available in the non-volatile memory of the EnRoute500 •  Space used/available in non-volatile memory for storing upgrade images  Caution should  be  used  when  updating the  firmware  on a single  device  in a mesh neighborhood. It is advisable to upgrade the devices  that are the most hops  away  from  a  gateway  first  and  keep  upgrading  devices  that  are successively closer to the gateway, upgrading the gateway firmware last.  Follow the procedure below to upgrade the firmware on a device:  1.  Select the firmware version you want to upgrade to from the “Firmware on Server” box  2.  Click on the button with the arrow to the right of the “Firmware on Server” box. This will begin  the  download  process  of  the  firmware  from  the  Tranzeo  upgrade  server  to  the non-volatile memory on the EnRoute500. While the firmware is downloading, it will be shown in blue in the “Firmware on Gateway Node” box.   If the  completion  percentage does not update, click on the “Upgrade  Node” tab to update it.  3.  When the  download  has been completed,  select  the  firmware  you wish to  upgrade to from the “Firmware on Node” box. 4.  Click on the “Install” button. 5.  Wait  for  the  install  to  complete.  The  EnRoute500  will  reboot  automatically  when  the upgrade has been completed.
Chapter 20:Firmware Management  TR0153 Rev. E1    154  Figure 71. Updating firmware on a single device
Glossary  TR0153 Rev. E1    155 Glossary Client access interface An interface on the EnRoute500 used by a client device, such as an 802.11-enabled  laptop,  to  connect  to  the  EnRoute500.  The  client access interfaces are the virtual APs wlan1 – wlan4 and, on devices configured as repeaters, the eth0 Ethernet interface. Client address scheme The  method  used  to  assign  address  spaces  to  client  address interfaces. The two supported client address schemes are implicit and explicit. Client device  A device that is connected to one of the EnRoute500’s client access interfaces, e.g. a laptop Mesh neighborhood  A  group  of  two  or  more  EnRoute500  nodes  with  at  least  one configured as a gateway Mesh gateway  A mesh node that, in addition to relaying traffic between neighboring mesh  nodes and supporting wireless clients through its built-in APs, acts as the layer 3 gateway for a mesh neighborhood Mesh node  A single EnRoute500 that is part of a mesh neighborhood Mesh repeater  A  mesh  node  that  relays  traffic  to  neighboring  mesh  nodes  and supports wireless and wired clients. Virtual access point  An  access  point  that  shares  a  single  AP  radio  with  one  or  more access points.
Abbreviations  TR0153 Rev. E1    156  Abbreviations ACL  Access Control List AP  Access Point CLI  Command line interface ESSID  Extended Service Set Identifier LAN  Local-Area Network NAT  Network Address Translation PoE  Power over Ethernet QoS  Quality of Service RSSI  Received signal strength indicator VAP  Virtual Access Point VLAN  Virtual Local-Area Network VPN  Virtual Private Network WAN  Wide-Area Network WLAN  Wireless Local-Area Network WPA  Wi-Fi Protected Access WPA-PSK  Wi-Fi Protected Access Pre-Shared Key

Navigation menu