Cisco 4402 - Wireless LAN Controller Using Manual

Text of Cisco 4402 - Wireless LAN Controller User Guide:

• Cisco 4402 - Wireless LAN Controller, 25 What one selects under QoS depends to some extent on how the organisation otherwise supports QoS in its network. The first QoS options are TOS (Type Of Service) values for IP tagging. Unfortunately this tagging will apply to all clients in this WLAN and therefore in practice is not applicable to eduroam. On the other hand, WMM depends on the relationship between the controller (access point) and clients, and may provide measurable benefits for real-time applications, so “WMM Policy Allowed” is recommended. Under Ad

• Cisco 4402 - Wireless LAN Controller, 55 Step 7: Logging NPS adds log entries in the Event Log and also writes them to a file. Open the Event Viewer and go to “Custom Views”, “Server Roles” and “Network Policy and Access Services”. NPS creates the log entries “Warning” and “Information”, while “Error” entries are only logged in a file (in C:\Windows\System32\LogFiles) Network Policy Server granted access to a user. “Granted access” or “denied access” Account Name: Ola.Nordmann The user name in the user’s domain Account Domai

• Cisco 4402 - Wireless LAN Controller, 44 Step 6: Remote Access Policies Remote Access Policies handle the local authentication and can for example grant different users access to different networks: some to the guest network, some to VLAN 10, VLAN 12, etc. • Right-click on “Remote Access Policies” and select “New Remote Access Policy” • Click on “Next”, select “Set up a custom policy” and type in a name for the policy • Choose descriptive names for policies, such as “Employees with guest network”, “Students in VLAN10”, etc. • Click on “Next” • “Policy conditions” are the criteria which determine whether a user shall use this

• 38 Step 2: Connecting to domain and certificates Go to “Administrative Tools” on the Control Panel. Start “Internet Authentication Service”: Click on “Action” in the file menu. Click on “Register Server in Active Directory” A certificate is required to activate PEAP. To add a certificate

• Cisco 4402 - Wireless LAN Controller, 42 student.school.no is the connection to eduroam and forwards authentication to the employee.school.no RADIUS server. The “Employee” RADIUS server is the last in the series and receives authentications it is to use and forwards them. Criteria for “Connection Policies” on the student.school.no RADIUS server: .*@student.school.no – All students, authenticated locally .*@employee.school.no – All employees, sent to the “Employee” RADIUS server .*@.* – All other users, sent to the “Employee” RADIUS server Criteria for Con

• Cisco 4402 - Wireless LAN Controller, 56 C. Installing a certificate for FreeRADIUS To order and obtain a certificate with the help of UNINETT’s SCS service, see http://forskningsnett.uninett.no/scs/hvordan.html. This also describes how to generate the RADIUS server’s private key (CSR), using openssl. The private key must be submitted via UNINETT’s SCS service and forms the basis for issuing a certificate. When this has been completed, the certificate must be installed on the RADIUS server. FreeRADIUS requires the entire certificate c

• Cisco 4402 - Wireless LAN Controller, 7 1 Network planning 1.1 Necessary components The number of access points and the type of controller(s) may be evaluated depending on the size and layout of the premises. Refer to Chapter 4 Radio planning, for guidelines for estimating the number of access points. Remember to allow for estimated growth in the coming years, bearing in mind the radio-related limitations in effect. The type of controller should be considered on the basis of the estimated total number of access points. For larger installations, the latest 5508 controller (with eight GE ports) is currently recommended. This is capable of handling up to

• Cisco 4402 - Wireless LAN Controller, 35 A.3 RADIUS configuration Go to SECURITY → Server Manager and add the external RADIUS server using the shared secret. Specify the port number of the Authentication Port and Accounting Port, as well as the IP address for EAP Authentication and Accounting (in this case the same RADIUS server).

• Cisco 4402 - Wireless LAN Controller, 37 B. Configuring Microsoft RADIUS servers B.1 Configuring IAS (Windows 2003) NB: This explanation assumes that the Windows 2003 server is registered in the domain. Step 1: Installation of IAS Go to Control Panel → Add or Remove Programs → Add/Remove Windows Components Select “Networking Services” and click on “Details” Tick ”Internet Authentication Service”. Now click on “OK”, “Next” and “Apply” to install IAS.

• Cisco 4402 - Wireless LAN Controller, 40 Step 4: Adding server groups to IAS To enable IAS to forward authentication, a server group must be created. If this RADIUS server is the last in a series of several and is not to forward authentication, it is not necessary to define any server groups. But as in Step 3, if the server is to be in communication with eduroam, eduroam must be added as a server group. Right-click on “Remote RADIUS Server Groups” and select “New Remote RADIUS Server Group” • Click on “Next” • Select “Cu

• 14 3 Configuring a controller Once one has completed network planning and has one’s IP addresses ready (cf. Chapter 1), the controller can be configured. It is even simpler if one also first has the details of the RADIUS server at hand (Chapter 2). This guide applies only to basic functionality and for systems with a single controller. If the system conta

• Cisco 4402 - Wireless LAN Controller, 26 Client Exclusion: Disabled – This is also a security feature. If, for example, a client fails to authenticate itself a certain number of times, there will be a compulsory ban before the client can try again. This can be more irritating than useful, so we recommend “Disabled”. DHCP Server: No Override – Here it is possible to override the DHCP server which has been configured for the virtual interface. DHCP Addr. Assignment: Required – One can set a condition that clients must obtain an IP address from a DHCP server: that is, a client is not permitted to define its own IP address statically. Ideally this should be set to required, but expe

• Cisco 4402 - Wireless LAN Controller, 39 Step 3: Adding clients in IAS The clients are permitted to submit authentication requests to the RADIUS server, which the server then grants locally or forwards. For more information about the structure of eduroam, see the documentation of its infrastructure on the eduroam web page. The clients which can be added here may be access points, a control unit for wireless equipment (such as a Security Switch) or other RADIUS servers forwarding authentication requests here. NB: When a control unit, such as a Security Switch or similar, is used fo

• 51 Step 4: Connection Request Policies Connection Request Policies determine where authorisation shall take place according to certain criteria. One policy may authenticate employees locally and forward all students to the RADIUS server associated with the school domain, while another policy directs all other users to the eduroam core. Since the policies are handled in a specified o

• Cisco 4402 - Wireless LAN Controller, 10 1.5 Access points The network cables connected to access points are often exposed in open areas and can represent a security risk. An unauthorised person tapping into such a cable can potentially gain access to subnets to which he or she should not have access and this may also enable man-in-the-middle attacks on users. The network should therefore be organised in such a way that network access in practice is unusable for anybody tapping into the cable. Here a controller-based system has a major advantage over autonomous access points. In a controller-based system it is not necessary to configure a dot1q trunk into the access point. By locating the a

• Cisco 4402 - Wireless LAN Controller, 16 It should be possible to route this address internally and preferably also externally if, for example, one needs external support. Strict filters should be in place to prevent unwanted units from contacting it, cf. Chapter 1. The access points must obtain access only via UDP on ports 5246/5247 (CAPWAP) or 12222/12223 (LWAPP). In addition, the RADIUS server must have access to this address on UDP ports 1812 and 1813. If one has WCS, MSE and/or LA and they are located in another network, they must also be able to communicate with the WLC’s address using SNMP. Management Interfac

• Cisco 4402 - Wireless LAN Controller, 30 4 Radio planning Carrying out effective radio planning involves a lot of work and can be very time-consuming. The controller assists to the best of its ability by adjusting the channel and power according to the prevailing conditions, but for a good result manual radio planning is essential. Radio planning consists of surveying the radio frequency signal from given positions in order to determine the optimal location of the access points. Radio planning can be based on one of two criteria: • Opti

• Cisco 4402 - Wireless LAN Controller, 15 Management Interface Netmask: 255.255.255.0 Management Interface Default Router: 192.168.0.1 Management Interface VLAN Identifier (0 = untagged): 0 Management Interface Port Num [1 to 4]: 1 Management Interface DHCP Server IP Address: 192.168.0.20 AP Transport Mode [layer2][LAYER3]: LAYER3 AP Manager Interface IP Address: 192.168.0.11 AP-Manager is on Management subnet, using same values AP Manager Interface DHCP Server (192.168.0.20): Virtual Gateway IP Address: 1.1.1.1 Mobility

• Cisco 4402 - Wireless LAN Controller, 52 • If one selects “Authenticate request on this server” the user is authenticated on this RADIUS server and the domain of which the user is a member. Proceed as follows: • Click on the “Attributes” tab • Select “Attribute: User-Name” and click on “Add” • Under “Find”, type: (.*)@(.*) • Under “Replace with”, type: $1 • One may also select “Forward requests to the following remote RADIUS server group for authentication”. The authentication request is then f

Related Products and Documents (Wireless Router):

Comparable Devices:

Similar Resources:

• Air Live BT-302USB (2 pages) Declaration of ConformityRegulatory ApprovalsWe, Manufacturer/ImporterDeclare that the productBluetooth 3.0 Mini USB DongleAirLive BT-302USBis in conformity withIn accordance with R&TTE(1999/5/EC) DirectiveClauseManufacturer/ImporterDescriptionOvisLink Corp.5F., NO.6, Lane 130, Min-Chuan Rd., Hsin-Tien City, Taipei County 231, TaiwanInformation technolog …

• Plantronics Savi 700 Series (2 pages) Lightest DECT™ headset on the marketWireless freedom up to 350 feetMultiple devices. Singular control.With three-way multi-device connectivity, now you can manage PC, mobile and desk phone callswith the most intelligent wireless headset system on the market.Savi® 700 Series …

• D-Link DAP-1350 (76 pages) WIRELESS N TRAVEL ROUTERDAP-1350� …

• Asus WL-500gP (101 pages) Index1.English ........................................................................................... 12.󳘱󰹂󲚉213.� …

• SMC Networks SMC7004WFW (2 pages) www.smc-europe.com www.smc.comWireless BarricadePlusData SheetSMC7004WFW11 Mbps Wireless Cable/DSL Broadband RouterThe Barricade™ Plus Wireless Cable/DSL Broadband Router (SMC7004WFW) is the ideal networking solution for both the home and business user.This platform independent multi-functional router combines a 3-port 10/100 Mbps dual-speed switch, an 80 …

• Huawei E173 (20 pages) Copyright © Huawei Technologies Co., Ltd. 2010. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. The product described in this manual may include copyrighted software of Huawei Technologies Co., Ltd and possible licensors. Customers shall …

Comments, Questions and Opinions: