# AP-2000 Help Contents |
[ Home ] [ORiNOCO website]

## Configuring the ORiNOCO AP-2000 device Since each network is unique, the AP-2000 must be configured to operate in your network environment. Most administrators use the HTTP Interface (web browser) for configuration; however, the Command Line Interface (CLI) provides the same functionality by entering CLI Commands or scripts from Terminal and Telnet sessions. For information about using the CLI, please refer to Using the Command Line Interface. In some scenarios described in this chapter, you need to make configuration choices (for example, which radio channel to use). This guide explains each choice. When in doubt, we suggest you accept the default values. Prerequisites ScanTool Program Set Basic Configuration Parameters Download the Latest Software Setup your TFTP Server Download Updates from your TFTP Server Backup your AP-2000 Configuration File Copy a Configuration File from Another AP-2000 Unit Other Network Settings Configure the AP-2000 Device as a DHCP Server Maintain 802.11b Client Connections using Link Integrity Change your Wireless Interface Settings 802.11a Wireless Interface Card 802.11b Wireless Interface Card Auto Channel Select (ACS) Distance Between APs Multicast Rate Ethernet Settings Set Ethernet Speed and Transmission Mode Configure your Management Interfaces Set HTTP Interface Management Services Configure Serial Port Interface Settings Other Security Configuration Settings Configure your MAC (Address) Access Control Table RADIUS Authentication Settings IEEE 802.1x Security Mode If You Encounter Problems... ## Prerequisites Before configuring the AP-2000, you need to gather certain network information. The following section identifies the information you need. A form has been provided at the end of this guide for you to document the configuration settings of each of the AP-2000 units in your network. Refer to Recording Your Configuration Settings.
Network Name (SSID of the wireless cards) | Each wireless interface of your AP-2000 must be given a Network Name before users can sign on. This is not the same as the System Name, which applies only to the AP-2000 unit. This may apply to the isolated unit, the immediate, active network, or to multiple networks. The network administrator typically provides the Network Name(s).
(HTTP) Password | Each AP-2000 requires a read/write password to access the web interface. The default password is “public”.
Authentication Method | A primary authentication server may be configured; a backup authentication server is also optional. The network administrator typically provides this information.
Authentication Server Shared Secret | This is a kind of password shared between the AP-2000 and the RADIUS authentication server (so both passwords must be the same), and is typically provided by the network administrator.
Authentication Server Authentication Port | This is a port number (default is 1812) and is typically provided by the network administrator.
Client IP Address Pool Allocation Scheme | The AP-2000 can automatically provide IP addresses to clients as they sign on. The network administrator typically provides the IP Pool range.
DNS Server IP Address | The network administrator typically provides this IP Address.
##
| Configuration software comes with the PC Cards used in wireless client computers. The current network profile on the wireless client must contain a valid Network Name; in other words, one of the case-sensitive Network Names defined in the AP-2000’s PC Card “Wireless Interface” properties. For more information, please refer to the PC Card documentation.
## ScanTool Program Use ScanTool to initialize units and download image files for any unit connected to the LAN subnet. You can set the IP Address, IP Address Type (Static or Dynamic), and other values. The ScanTool.exe application is included on the installation CD-ROM.
| ScanTool is very useful because units can be installed without prior bench initialization. To track units, you must record the MAC Address and physical location of each unit during installation. Since ScanTool identifies each unit by its MAC Address, you can install multiple units simultaneously and initialize them from ScanTool.
When sent from the factory, the AP-2000 is set for DHCP operation. If using DHCP, the unit requests an IP Address from the DHCP server when rebooted or powered up. Since the IP Address could come from a large DHCP address pool, it may be difficult to identify the IP Address assigned to the unit. Use the following procedure to open ScanTool and set AP-2000 network parameters. You should have the AP-2000 unit(s) and your computer connected to the same LAN subnet. Install the AP-2000 hardware and connect the unit(s) to the LAN. Power up, reboot, or reset the AP-2000. Result: If set for DHCP, the unit requests an IP Address from the network DHCP server. Open ScanTool. Result: ScanTool scans the subnet and locates all AP-2000 units. The ScanTool Main screen appears, similar to the example below, that shows a single unit in the factory default state. . Scan Tool To re-scan the network and update the display after changing values, click the Rescan button. To change values or download an AP Image, select the desired unit, and then click the Change button. Result: the ScanTool Change screen appears, similar to the following example. Our example shows a unit with factory default settings. Scan Tool Change Screen You may perform the following operations. Note that certain options are available only when selecting Static IP Address mode. MAC Address. This read-only field displays the MAC Address of the selected unit. Name. Enter the System Name of the unit. This is typically descriptive text, such as “Main Lobby”. IP Address Type. Select Static if you wish to enter the IP values manually. Select DHCP to force the unit to request an IP Address from a DHCP server each time it is powered up or rebooted. IP Address. If you selected Static, then enter the IP Address. Subnet Mask. If you selected Static, then enter the Subnet Mask. Gateway IP Address. If you selected Static, then enter the IP Address of the Gateway. TFTP Server IP Address. If you wish to download a new AP Image file, then enter the IP Address of the TFTP server. Image File Name. If you wish to download a new AP Image file, then enter the full directory path and file name. If the file is located in the default TFTP directory, you need enter only the file name. Read/Write Password. Enter the read/write password. The default password is “public”. To reboot the unit to make the changes effective, verify the entered values and then click the OK button. Result: The unit will reboot and the new values will be in effect. To cancel the operation and return to the ScanTool Main screen, click the Cancel button. ## Set Basic Configuration Parameters Once you have a valid IP Address assigned to your AP-2000 and an Ethernet connection, use your web browser to configure the AP-2000 through the Web Interface. ### Log Into the AP-2000 Unit using the Web Interface Ensure any proxies are turned off. Open your browser and enter the IP Address. Press ENTER. Result: The AP-2000 Login screen appears.
| Leave the User Name field empty
Enter public in the Password field. Result: The System Status screen appears. Click the Configure operation button. Result: The System Configuration screen appears. Each tab contains information for specific configuration categories. Configuration through the Web Interface You are now ready to configure each AP-2000 category, depending on your system. In some cases, you will not need to make any changes. If you are in doubt about any setting, we recommend that you use the default values. Configuration Options To set properties for each category, click on the desired tab. Result: The selected configuration screen appears. Each configuration screen allows you to select options, or enter, edit, and delete information. In some cases, the AP-2000 reminds you that it must be rebooted for a change to take effect. In a given session, you can wait to reboot until all changes have been made. After entering or editing information on configuration screens, click OK to save changes, or click Cancel to restore previous settings. You will want to set up a few basic configuration parameters right away when you receive the AP-2000 unit. For example: System name and location Contact information for network administrator IP Address Communication rules for your wireless interface(s) Passwords for the different management interfaces (SNMP, Telnet, HTTP) If you need to upload the latest software, you will also want to setup your TFTP server to communicate with the AP-2000 device. This process is described in downloading the latest software, under Setup your TFTP Server. #### Set System Name, Location and Contact Information System Configuration In the Web Interface, click the Configure button and select the System tab. Enter the name of the AP-2000 device, its location within your network or its physical location, such as “Front Lobby” or Engineering, and the name, phone number and e-mail address of the person responsible for this device. Click OK. #### Set a Static IP Address for the AP-2000 Device In the Web Interface, click the Configure button and select the Network tab. Set the IP Address Assignment Type to Static. Enter a fixed IP Address for your AP-2000 unit, the IP mask, and default gateway IP Address you want to use.
| The IP Mask of the AP-2000 unit needs to match the IP Mask of your network. If you are setting up the AP-2000 device from a client station, check the IP mask of your computer before proceeding.
Click OK when finished. The AP-2000 unit will need to be rebooted for the changes to take effect. Network IP Configuration See Maintain 802.11b Client Connections using Link Integrity and Configuring Advanced Features for information on the other Network features. #### Set Network Names Client stations use the Network Name of the PC Card to connect to the network through the AP-2000 unit. At power up or insertion of either a 2.4 GHz or 5 GHz radio card, the AP-2000 software will automatically detect the card type. The Configuration and Monitoring parameters displayed in the HTTP Interface will be updated accordingly and default values will be assigned. Wireless Interface Configuration
| Not all software features available for the 802.11b cards are available for the 802.11a cards.
In the Web Interface, click the Configure button and select the Interfaces tab. Select the Wireless A or the Wireless B tab. Enter Network Names (SSID) for the PC Cards in wireless Slots A and/or B in the AP-2000 device. Select OK. #### Set WEP Encryption for each Wireless Interface WEP Encryption In the Web Interface, click the Configure button and select the Security tab.
| If you want to use 802.1x security, see IEEE 802.1x Security Mode.
Select the Encryption sub-tab. Click the check box to enable Encryption (WEP) on a wireless card. Type in an Encryption key based on the type of card present in each slot. You can enter the key in either ASCII characters (a-z, A-Z, and 0-9) or hexadecimal digits (A-F, a-f, and 0-9).
| The AP-2000 device supports 802.11b cards that use 64-bit or 128-bit encryption. For 802.11a, the AP-2000 device supports 64-bit, 128-bit, or 152-bit encryption. 64-bit encryption supports key lengths of 5 alphanumeric characters or 10 hexadecimal digits. 128-bit encryption supports key lengths of 13 alphanumeric characters or 26 hexadecimal digits. 152-bit encryption supports key lengths of 16 alphanumeric characters or 32 hexadecimal digits.
An Encryption Key is composed of the secret key (entered by the user) and a 24-bit Initialization Vector (IV). Some products report an Encryption Key Size with the IV and some report a Key Size without the IV. Therefore, 64-bit encryption is also referred to as “40-bit” encryption (without the IV), 128-bit encryption is also referred to as “104-bit” encryption (without the IV), and 152-bit encryption is also referred to as “128-bit” encryption (without the IV). Select a key to use for WEP encryption.
| Client stations must have the same encryption key to be able to communicate with the AP-2000 device.
For 802.11b only, set Deny Non-Encrypted Data to Enable if you want to prevent clients that do not have WEP enabled and the proper keys configured from communicating with the network. Select OK. See Change your Wireless Interface Settings for information on the rest of the wireless configuration parameters. Also, IEEE 802.1x Security Mode for additional security information. #### Set and Change Passwords Setting Interface Passwords In the Web Interface, click the Configure button and select the Management tab. Change the default passwords for the SNMP, Telnet/CLI, and HTTP interfaces. SNMP Read Password, Confirm. Enter each password in both the Read Password field and the Confirm field. The default password is “public”. SNMP Read/Write Password, Confirm. Enter the password in both the Read Password field and the Confirm field. The default password is “public”. Telnet (CLI) Password, Confirm. Enter the password in both the Read Password field and the Confirm field. The default password is “public”. HTTP (Web) Password, Confirm. Enter the password in both the Read Password field and the Confirm field. The default password is “public”.
| For security purposes we recommend changing ALL PASSWORDS from the default “public” immediately, to restrict access to your network devices to authorized personnel. We also recommend that you document your AP-2000 configuration using the work sheets provided for you in Recording Your Configuration Settings. If you lose or forget your password settings, you can always perform the Reset to Factory Default Procedure.
## Download the Latest Software Three types of files can be downloaded to the AP-2000 from a TFTP server: img (AP software image or kernel) config (configuration file) bspbl (BSP/Bootloader firmware file) The latest updates on software and documentation can be found on the ORiNOCO web site at: http://www.orinocowireless.com. Also see SolarWind.net for the latest version of the TFTP server software. ### Setup your TFTP Server The “Trivial File Transfer Protocol” (TFTP) server allows you to transfer files across a network. You can upload files from the AP-2000 for backup or copying, and you can download the files for configuration and AP Image upgrades. The TFTP software is located on the ORiNOCO AP-2000 Installation CD-ROM. If a TFTP server is not configured and running, you will not be able to download and upload images and configuration files to/from the AP-2000. Remember that the TFTP server does not have to be local, so long as you have a valid TFTP IP Address. TFTP does not have to be running for AP-2000 operations that do not transfer files. After the TFTP server is installed: Check to see that TFTP is configured to point to the directory containing the AP Image. Make sure you have the proper TFTP server IP Address, the proper AP Image file name, and that the TFTP server is connected. Make sure the TFTP server is configured to both Transmit and Receive files, with no automatic shutdown or time-out. ### Download Updates from your TFTP Server Download Software Image from TFTP Server Make sure the TFTP server is running and pointing to the directory containing the desired file. In the Web Interface, click the Commands button and select the Download tab. Type in the IP address of your TFTP server. Type in the file name (including the file extension). Select the file type from the pull down menu. The unit will need to be rebooted for the changes to take effect. ### Backup your AP-2000 Configuration File Make sure the TFTP server is running and pointing to the directory where you want to save the file. In the Web Interface, click the Commands button and select the Upload tab. Type in the IP address of your TFTP server. Type in a descriptive name for your configuration file. Select the file type as config from the pull down menu. Click OK to upload this information from your AP-2000 unit to the TFTP server, where it can be retrieved in the event you reset your AP-2000 device to factory defaults at some time.
| Record the name of this configuration file and the IP address of the AP-2000 unit so you can easily find it if you need to download it.
### Copy a Configuration File from Another AP-2000 Unit You can configure multiple units using the same configuration file by uploading the configuration file from one AP-2000 unit to the TFTP server, and then download the configuration file to other AP-2000 units.
| Do not use a static IP address in this configuration file, otherwise you will end up with duplicate IP addresses in your network!
Check to ensure Dynamic IP address is enabled by clicking the Configure button and selecting the IPConfig tab. In the Web Interface, click the Commands button and select the Upload tab. Enter the IP address of your TFTP server. Upload Configuration File to TFTP Server Enter the name of your configuration file and click OK. Wait for the file to transfer from the AP-2000 device to the TFTP server. Access the AP-2000 unit to which you will download the configuration. A system window will notify you when this process is complete. Confirm by clicking OK. Click the Commands button, then select the Download tab. Verify the IP address of your TFTP server and enter the name of the file you wish to transfer (refer to Step 3). Set the file type to config, and click OK. Click Download. The unit will need to be rebooted for the changes to take effect. Repeat this procedure for all the AP-2000 units you want to configure using this specific file. ## Other Network Settings You may want to set other configuration parameters for your AP-2000 unit, such as: Configure the AP-2000 device as a DHCP Server Maintain 802.11b client connections using Link Integrity Change your Wireless Interface settings Configure which physical interface will be used to manage the AP-2000 unit Control access to the AP-2000 device using MAC Address authentication, WEP encryption, or 802.1x security settings Refer to Configuring Advanced Features for more complex network settings. ### Configure the AP-2000 Device as a DHCP Server
| Make sure there is only one DHCP server on the network and do not enable the DHCP server without checking with your network administrator first, as it could bring down the whole network.
Use DHCP configuration to provide dynamic client IP Addresses from one or more IP Pool Tables. Enable the DHCP Server to allow the AP-2000 to assign clients IP Addresses from IP Pool Tables. Deselect the Status check box to prevent client IP Address assignment from the AP-2000.
| You must have at least one entry in the DHCP Server client IP Address assignment table before you can enable the DHCP Server Status feature.
Network Configuration Screens - DHCP Server In the Web Interface, click the Configure button and select the Network tab. Select the DHCP Server sub-tab. Click the Add button in the IP Pool Table. Enter the following information: Start IP Address End IP Address Default Lease Time (optional) - the default time value for clients to retain the assigned IP Address. DHCP automatically renews IP Addresses without client notification. Default is 86400 seconds. Maximum Lease Time (optional) - the maximum time value for clients to retain the assigned IP Address. DHCP automatically renews IP Addresses without client notification. Default is 86400 seconds. Comment (optional) Status - IP Pools are enabled upon entry in the table. Use the Edit button to disable or delete existing table entries. Enter the Default Gateway IP Address, the Primary and Secondary DNS IP Addresses, and select the Enable DHCP Server check box. Reboot the AP-2000 unit for the changes to take affect. ### Maintain 802.11b Client Connections using Link Integrity
| This feature is only applicable to 2.4 GHz (802.11b) cards.
The Link Integrity feature checks the link between the AP-2000 and the nodes on the backbone. These nodes are listed by their IP address on the Link Integrity IP Address Table, and serve as backup. If the link goes down, the client will connect to another AP-2000 in your network that still communicates with the server. #### Configure Link Integrity Link Integrity In the Web Interface, click the Configure button and select the Network tab. Select the Link Integrity sub-tab. Click the Edit button in the Target IP Address Table. Enter the IP Address of the host computer you want to check and add comments to identify the computer if you wish. This Target IP Address is enabled as soon as it is entered in the table. Click OK. Set the following parameters as needed: Poll Interval - the interval between link integrity checks. Range is 500 - 15000 ms in increments of 500 ms; default is 500 ms. Poll Retransmissions - the number of times a poll should be retransmitted before the link is considered down. Click to select the Enable Link Integrity check box. #### Disable Link Integrity To disable Link Integrity check for all clients, deselect the Enable Link Integrity check box. To disable Link Integrity check to a certain host computer, click the Edit button in the T arget IP Address Table and set the Status to Disable. ## Change your Wireless Interface Settings Depending on the type of wireless PC Card installed in the AP-2000 device, the configuration options will be different. Some parameters are the same for 802.11a and 802.11b cards. Others are unique to each card type. You can setup an AP-2000 unit using the following combinations of wireless cards: single 802.11a card with the attached antenna adapter single 802.11b card two 802.11b cards (one in each slot) one 802.11a card with attached antenna and one 802.11b card ### 802.11a Wireless Interface Card 802.11a Wireless Interface Options Network Name. Enter a Network Name for each PC Card. This is the same name used on client machines to connect using the client configuration software. Range is 1 - 31 characters; default is “My Wireless Network A” for card in Slot A and “My Wireless Network B” for card in Slot B. Enable Auto Channel Select (ACS). By default this feature is enabled. The AP-2000 device scans the area for other AP-2000 devices and selects a free or relatively unused communication channel. This helps prevent interference problems and increases network performance. Note that this option is not available for 802.11a products in Europe. See Dynamic Frequency Selection (DFS) for more information. Default is enable. Turbo Mode. An 802.11a card supports an extension of the IEEE 802.11a standard that provides twice the data rate. Note that Turbo mode is not defined in the IEEE 802.11a specification. By default, Turbo mode is disabled. Turbo mode is not available in all countries including European countries and Japan. Default is disable. Frequency Channel. If Auto Channel Select is disabled, use the pull-down menu to select the desired card frequency. Ensure nearby devices do not use the same frequency. The Frequency Channels available will depend on the card type, card mode (standard mode or Turbo mode), and the country of use. Refer to Radio Specifications for details. Transmit Rate. Use the pull-down menu to select a specific transmit rate for the 802.11a card. Choose between 6, 9, 12, 18, 24, 36, 48, 54 Mbits/s, or Auto Fallback for standard 802.11a mode. If Turbo mode is enabled, choose between 12, 18, 24, 36, 48, 72, 98, 108 Mbits/s, or Auto Fallback. The Auto Fallback feature allows the AP-2000 unit to select the best transmit rate based on the cell size. Default is Autofallback. DTIM Period. Deferred Traffic Indicator Map (DTIM) is used with clients that use power management. DTIM should be left at the default value. Range is 1-65535. RTS/CTS Medium Reservation. This value affects message flow control, and should not be changed under normal circumstances. When set to a value between 0 and 2347, the card uses the RTS/CTS mechanism for packets that are the specified size or greater. Range is 0 to 2347; default is 2347 (off). ### 802.11b Wireless Interface Card 802.11b Wireless Interface Options Network Name. Enter a Network Name for each PC Card. This is the same name used on client machines to connect using the client configuration software. Range is 1 - 31 characters; default is “My Wireless Network A” for card in Slot A and “My Wireless Network B” for card in Slot B. Enable Auto Channel Select (ACS). By default this feature is enabled. The AP-2000 device will scan the area for other AP-2000 devices and select a free or relatively unused communication channel. This helps prevent interference problems and increases the performance of the network. However, if you are setting up a Wireless Distribution System (WDS), it must be disabled. See Auto Channel Select (ACS) for additional information on this feature. Default is enable. Frequency Channel. If Auto Channel Select is disabled, use the pull-down menu to select the desired card frequency. Ensure nearby devices do not use the same frequency. The Frequency Channels available will depend on the card type and the country of use. Refer to Radio Specifications for details. Distance Between APs. Set to Large, Medium, Small, Microcell, or Minicell depending on the site survey for your system. The distance value is related to the Multicast Rate (described next). In general, larger systems operate at a slower average rate. This feature is only available for 802.11b wireless cards. Default is large. Multicast Rate. Set the rate at which Multicast messages may be sent. This value is related to the Distance Between APs parameter (described previously). This feature is only available for 802.11b wireless cards. Default is 2 Mbits/sec.
Distance between APs | Multicast Rate
Large | 1 and 2 Mbits/sec
Medium | 1, 2, and 5.5 Mbits/sec
Small | 1, 2, 5.5 and 11 Mbits/sec
Minicell | 1, 2, 5.5 and 11 Mbits/sec
Microcell | 1, 2, 5.5 and 11 Mbits/sec
DTIM Period. Deferred Traffic Indicator Map (DTIM) is used with clients that use power management. DTIM should be left at the default value. Range is 1-65535. RTS/CTS Medium Reservation. This value affects message flow control, and should not be changed under normal circumstances. When set to a value between 0 and 2347, the card uses the RTS/CTS mechanism for packets that are the specified size or greater. Range is 0 to 2347; default is 2347 (off). Enable Interference Robustness. Enable this option if other electrical devices in the 2.4 GHz range may be interfering with the wireless signal. This feature is only available for 802.11b wireless cards. Default is enable. Enable Closed System. Check this box to allow only clients configured with your specific Network Names to access the AP-2000. When disabled, a client configured with the Network Name “ANY” can connect to the AP-2000. This feature is only available for 802.11b wireless cards. Default is disable. Enable Load Balancing. Enable this option so clients can evaluate which access point to associate with, based on current AP loads, to more evenly balance the load between APs. This feature is only available for systems using two 802.11b wireless cards. Default is enable. Enable Medium Density Distribution. Enable this option to automatically notify client stations of roaming thresholds for the nearby APs. This feature is only available for 802.11b wireless cards. Default is enable. ### Auto Channel Select (ACS) When Auto Channel Select is enabled, an AP-2000 selects its own frequency channel based on interference situation, bandwidth usage, and adjacent channel use. This is beneficial when deploying AP-2000 units in a new environment or adding an AP-2000 unit in an existing environment. The first AP-2000 turned on in an area assigns itself the default channel (which differs based on card type and regulatory region). When a second AP-2000 unit is turned on in the vicinity of the first AP-2000 device, the Auto Channel Select feature changes the frequency channel of the second unit so there is no interference between the two units. Multiple AP-2000 units can be turned on simultaneously to establish proper channel selection. In addition, you may override Auto Channel Select and manually configure the AP-2000 device to use a specific Channel. If you plan to use ACS, note the following: The range of available channels varies based upon the regulatory domain of your wireless cards. Some regulatory agencies allow more channels than others. ACS is enabled by default. You must disable ACS and manually configure the AP-2000’s channel if you intend to create a Wireless Distribution System (see Wireless Distribution System (WDS) in Configuring Advanced Features). The ability to enable or disable ACS is not available for 802.11a products sold in Europe. See Dynamic Frequency Selection (DFS) for details. ##### Disabling ACS From the Web interface, select Configuration then click the Interfaces tab. Deselect the check box next to Enable Auto Channel Select. Select a frequency channel from the drop-down menu. The clients automatically sense the channel and will configure themselves to reassociate on the new channel.
| On changing the status you must reboot your AP-2000, which will disconnect all clients from the AP-2000.
##### Enabling ACS From the Web interface, select Configuration then click the Interfaces tab. Select the check box to Enable Auto Channel Select.
| On changing the status you must reboot your AP-2000, which will disconnect all clients from the AP-2000.
### Dynamic Frequency Selection (DFS) 802.11a cards sold in Europe use a technique called Dynamic Frequency Selection (DFS) to automatically select an operating channel. During boot-up, the AP-2000 scans the available frequency and selects a channel that is free of interference. If the AP-2000 subsequently detects interference on its channel, it automatically reboots and selects another channel that is free of interference. DFS only applies to 802.11a cards used in Europe (i.e., cards whose regulatory domain is set to ETSI). The European Telecommunications Standard Institute (ETSI) requires that 802.11a devices use DFS to prevent interference with radar systems and other devices that already occupy the 5 GHz band. If you are using 802.11a cards in Europe, keep in mind the following: DFS is not a configurable parameter. It is always enabled and cannot be disabled. You cannot manually select an operating channel for 802.11a cards; you must let DFS select the channel. You cannot configure the Enable Auto Channel Select option. Within the HTTP interface, this option will always appear enabled. 802.11b cards (and 802.11a cards outside of Europe) use ACS (which can be enabled or disabled, see Auto Channel Select (ACS) for details). ### Distance Between APs
| This feature is only applicable to 2.4 GHz (802.11b) cards.
##### Cells Distance Between APs defines how far apart (physically) your AP-2000 devices are located, which in turn determines the size of your cell. Cells of different sizes have different capacities and therefore suit different applications. For instance, a typical office has many stations requiring high bandwidth and transmit rates for complex, high-speed data processing. In contrast, a typical warehouse has a few forklifts requiring low bandwidth and transmit rates for simple transactions. Cell capacities are compared in the following table, which shows small cells suit most offices, while large cells suit most warehouses:
Small Cell | Large Cell
--- | ---
Physically accommodates few stations | Physically accommodates many stations
High cell bandwidth per station | Lower cell bandwidth per station
High transmit rate | Lower transmit rate
##### ##### Coverage The number of access point units in a set area determines the network coverage for that area. A great number of access point units covering a small area would be a high-density cell. Few access point units, or even a single unit covering the same small area would result in a low-density cell, even though in both cases the actual area did not change- only the number of access points covering the area changed. In a typical office, smalls cells may have a 3 meter (10 ft.) diameter and an AP-2000 device every 6 m (20 ft.), which would be considered high density. In contrast, large cells in a typical warehouse may have a 27.5 meter (90 ft.) diameter and an AP-2000 unit every 60 m (200 ft.), considered low density. Low Density vs. Ultra High Density Network ##### Set the Distance Between APs From the Web interface, click the Configure button, and select the Network tab. Select the Interfaces sub-tab. Select the Wireless Slot tab that corresponds to an 802.11b card. Use the drop-down menu to set the Distance Between APs for the appropriate card. The AP-2000 recognizes the following five values for the Distance Between APs parameter (configurable for each Wireless NIC): Large, Medium, Small, Minicell, and Microcell.
| The distance between APs should not be approximated. It is calculated by means of a manual Site Survey, in which an AP-2000 unit is set up and clients are tested throughout the area to determine signal strength and coverage, and local limits such as physical interference are investigated. From these measurements the appropriate cell size and density is determined, and the optimum distance between APs is calculated to suit your particular business requirements.
### Multicast Rate The multicast rate measures how quickly information is transmitted across your network. This rate is approximated for a cell, since physical proximity to the AP increases throughput. Stations closer to an AP actually have higher multicast rates than stations in the same cell that are located farther from the AP. In addition, a small cell with several stations located close to the AP-2000 unit can actually transmit information faster than a larger cell with only a few stations located farther from the AP-2000 device.
| This feature is only applicable to 2.4 GHz (802.11b) cards.
1 Mbits/s and 11 Mbits/s Multicast Rates
| There is an inter-dependent relationship between the Distance between APs and the Multicast Rate. In general, larger systems operate at a lower average transmit rate.The variation between Multicast Rate and Distance Between APs is presented in the following table:
| 1.0 Mbit/s | 2.0 Mbits/s | 5.5 Mbits/s | 11 Mbits/s
--- | --- | --- | --- | ---
Large | yes | yes |  |
Medium | yes | yes | yes |
Small | yes | yes | yes | yes
Minicell | yes | yes | yes | yes
Microcell | yes | yes | yes | yes
##### ##### Set the Multicast Rate From the Web interface, click the Configure button, and select the Network tab. Select the Interfaces sub-tab. Select the Wireless Slot tab that corresponds to an 802.11b card. Use the drop down menu to select a Multicast rate.
| The Distance Between APs must be set before the Multicast Rate, because when you select the Distance Between APs, the appropriate range of Multicast values automatically populates the drop down menu.
## Ethernet Settings ### Set Ethernet Speed and Transmission Mode Ethernet Interface Select the desired speed and transmission mode from the pull down menu. Half-duplex means that only one side can broadcast at a time, full-duplex allows both sides to transmit, while auto-duplex selects the best transmission mode for the given configuration. The recommended setting is auto-speed-auto-duplex. Choose between: 10 Mbit/s - half duplex, full duplex, or auto duplex 100 Mbit/s - half duplex, full duplex, or auto duplex auto speed - half duplex, auto duplex ## Configure your Management Interfaces Select which interfaces will be available through the Wireless, Ethernet, and Serial Port interfaces of the AP-2000 unit. Management Interface Settings ### Set HTTP Interface Management Services In the Web Interface, click the Configure button and select the Management tab. Choose the Services sub-tab. For each service, there is a list of associated settings. From the drop-down menu, select which physical interface(s) can be used to manage the AP-2000 device using the Web interface. For example, to allow Web configuration via the Ethernet network only, set HTTP Interface Bitmask to Ethernet. The available configuration options are: Disabled (all interfaces) Ethernet only enabled Wireless A only enabled Wireless B only enabled All Interfaces enabled Enter the HTTP communication port number. Default is 80.
| See Configuring Management Service Interfaces for information on the SNMP, Telnet, and other HTTP parameters that can be configured from the Services screen.
### Configure Serial Port Interface Settings The serial port interface on the AP-2000 device is enabled at all times. You can set the following parameters as needed: Baud Rate. Select the serial port speed (bits per second). Choose between 2400, 4800, 9600, 19200, 38400, or 57600; the default Baud Rate is 9600. Flow Control. Select either None (default) or Xon/Xoff (software controlled) data flow control.
| To avoid unexpected performance of your AP-2000, leave the setting Flow Control to its default value (none) unless you are sure what this setting should be.
## Other Security Configuration Settings Control access to the AP-2000 device using MAC Address authentication, WEP encryption, or 802.1x security settings. ### Configure your MAC (Address) Access Control Table The MAC Authentication tab allows you to build a list of stations, identified by their MAC addresses, authorized to access the AP-2000 device within your network. The list is stored inside each AP-2000 within your network. Enable MAC Access Control. Check this box to enable the Control Table. Operation Type. Choose between Passthru and Block. This determines how the stations identified in the MAC Access Control Table are filtered. Security Configuration Screen - MAC Authentication #### Add an Entry to the MAC Access Control Table Click the Add button in the MAC Access Control Table. Enter the MAC address of the client station authorized to manage this AP-2000 device. Add a comment as needed. Entries are automatically enabled. #### Disable or Delete an Entry in the MAC Access Control Table Click the Edit button in the MAC Access Control Table. Select the MAC Address you want to disable or delete. Click OK.
| For larger networks that include multiple AP-2000 devices, you may prefer to maintain this list on a centralized location using the RADIUS Authentication Settings.
### RADIUS Authentication Settings The AP-2000 provides two methods for authenticating wireless clients using a RADIUS Server: MAC Access Control (described below) and IEEE 802.1x Security Mode.
| The AP-2000 supports additional RADIUS features. See Advanced RADIUS Features for details.
#### MAC Access Control Via RADIUS If you want to control wireless access to the network and if your network includes a RADIUS Server, you can store the list of MAC addresses on the RADIUS server rather than configure each AP-2000 individually. From the RADIUS Authentication tab, you can define the IP Address of the server that contains a central list of MAC Address values that identify the authorized stations that may access the wireless network. You must specify information for at least the Primary RADIUS server. The Backup RADIUS server is optional.
| Problems with RADIUS Server configuration or RADIUS Authentication should be referred to the RADIUS Server developer.
Security Configuration Screen - RADIUS Authentication Enable RADIUS MAC Access Control. Click inside the check box to provide authentication by the RADIUS server. Deselect the check box to prevent use of the RADIUS server. Enable the Primary or Backup RADIUS Server. Click in the desired check box to enable the RADIUS Server. You must specify information for at least the Primary RADIUS server. The Backup RADIUS server is optional. Authorization Lifetime (seconds). Enter the time, in seconds, each client session may be active before being automatically re-authenticated. Range is 60 - 43200 seconds (in 60 sec increments); default is 900 sec. MAC Address Format Type. Enter the format in which the 12-digit MAC addresses are listed within the RADIUS server. Options include dash delimited (dash between each pair of digits: xx-yy-zz-aa-bb-cc), colon delimited (colon between each pair of digits: xx:yy:zz:aa:bb:cc), single dash delimited (dash between the sixth and seventh digits: xxyyzz-aabbcc), and no delimiters between pairs of hexadecimal digits (xxyyzzaabbcc). Server Addressing Format. Select either server name or IP address. Use a server name only if you have enabled the DNS Client functionality. See RADIUS DNS Host Name Support. Server Name/IP Address. Enter the server’s IP address or name (depending on the Server Addressing Format setting) in the field provided. Destination Port. Enter the RADIUS Authentication port. The default value is 1812. Shared Secret. The password for the user on the RADIUS Server must be the same as the Shared Secret. Response time (seconds). Enter the maximum time, in seconds, to wait for RADIUS to respond with authentication status. Maximum Retransmissions. Enter the maximum number of times an authentication may be retransmitted. ### IEEE 802.1x Security Mode IEEE 802.1x is a standard that provides a means to authenticate and authorize network devices attached to a LAN port. A port in the context of IEEE 802.1x is a point of attachment to the LAN, either a physical Ethernet connection or a wireless link to an Access Point. 802.1x uses the Extensible Authentication Protocol (EAP) as a standards-based authentication framework, and supports automatic key distribution for enhanced security. The EAP-based authentication framework can easily be upgraded to keep pace with future EAP types. Popular EAP types include: EAPoL (EAP over LAN): Transport protocol used to negotiate the WLAN user’s secure connection to the network. EAP messages are encapsulated in 802.1X messages. EAP-Message Digest 5 (MD5): Username/Password-based authentication; does not support automatic key distribution EAP-Transport Layer Security (TLS): Certificate-based authentication (a certificate is required on the server and each client); supports automatic key distribution EAP-Tunneled Transport Layer Security (TTLS): Certificate-based authentication (a certificate is required on the server; a client’s username/password is tunneled to the server over a secure connection); supports automatic key distribution PEAP - Protected EAP with MS-CHAP v2: Secure username/password-based authentication; supports automatic key distribution Different servers support different EAP types and each EAP type provides different features. Refer to the documentation that came with your RADIUS server to determine which EAP types it supports.
| The AP-2000 supports the following EAP types when 802.1x Security Mode is set to 802.1x: EAP-TLS, PEAP, and EAP-TTLS. When 802.1x Security Mode is set to Mixed, the AP-2000 supports the following EAP types: EAP-TLS, PEAP, EAP-TLLS, and EAP-MD5 (MD5 does not support automatic key distribution; therefore, if you choose this method you need to manually configure each client with the network’s encryption key).
#### Authentication Process There are three main components in the authentication process. The standard refers to them as: supplicant (client PC) authenticator (Access Point) authentication server (RADIUS server) When using 802.1x Security Mode or Mixed mode (802.1x and WEP), you need to configure your RADIUS server for authentication purposes. Prior to successful authentication, an unauthenticated client PC cannot send any data traffic through the AP-2000 device to other systems on the LAN. The AP-2000 device inhibits all data traffic from a particular client PC until the client PC is authenticated. Regardless of its authentication status, a client PC can always exchange 802.1x messages in the clear with the AP-2000 unit (the client begins encrypting data after it has been authenticated). RADIUS Authentication Illustrated The AP-2000 device acts as a pass-through device to facilitate communications between the client PC and the RADIUS server. The AP-2000 unit and the client PC exchange 802.1x messages using an EAPOL (EAP Over LAN) protocol. Messages sent from the client station are encapsulated by the AP-2000 device and transmitted to the RADIUS server using EAP extensions. Upon receiving a reply EAP packet from the RADIUS, the message is typically forwarded to the client PC, after translating it back to the EAPOL format. Negotiations take place between the client PC and the RADIUS server. After the client has been successfully authenticated, the client PC receives an encryption key from the AP-2000 (if the EAP type supports automatic key distribution). The client uses this key to encrypt data after it has been authenticated. For 802.11a, each client receives its own unique encryption key; this is known as Per User Per Session Encryption keys. (This feature is only available when using 802.1x mode; it is not available when in Mixed mode or using WEP encryption only). #### Configuring Security Settings Click the 802.1x tab in the Security Configuration screen to set the 802.1x security mode for the AP-2000. (Note that the configuration settings for standard encryption (that does not use 802.1x) are located on the Encryption page.) The AP-2000 software offers four security settings: No security or encryption Set the 802.1x Security Mode to none on the 802.1x page and disable Encryption for both interface cards on the Encryption page. WEP encryption only on one or both wireless interfaces WEP encryption is the wireless equivalent of the security level available through a wired network. Select the 802.1x Security Mode to none on the 802.1x page. Click the Encryption tab and enable the Encryption status for one or both wireless PC Cards. The available Encryption Key Length varies based on the card type. See Set WEP Encryption for each Wireless Interface. 802.1x security (requires RADIUS server authentication) When you decide to use the 802.1x security mode, you must first configure the RADIUS server to receive an authentication response (see RADIUS Authentication Settings for information on the server settings). Your computer operating system must also be configured to receive and send authenticated packets. Then, set 802.1x Security Mode to 802.1x. In addition, you must select an Encryption Key Length for each wireless interface (key size varies based on card type) and a Re-keying Interval. The rekey feature determines how often your encryption key is changed (the interval between changes) and can be set to any value between 60 - 65535 seconds. Rekeying frustrates hacking attempts without taxing system resources. Setting a fairly frequent rekey value (900 seconds=15 minutes) effectively protects against intrusion without disrupting network activities. For detailed configuration steps, see Setting Up the AP-2000 using 802.1x Security Mode. Mixed mode with 802.1x and WEP encryption Mixed mode supports both 802.1x and WEP encryption simultaneously. To use this option, set 802.1x Security Mode to Mixed and configure the 802.1x settings (Encryption Key Length and Re-keying interval), Encryption settings (enable Encryption and enter key 1), and RADIUS server settings. For Encryption settings, enable Encryption on the required interfaces and enter key 1 (keys 2-4 are not required).
| In Mixed mode, when entering Encryption Key 1 on the Encryption page, you must use the same size key that you configured for Encryption Key Length on the 802.1x page.
##### Setting Up the AP-2000 using 802.1x Security Mode In the Web Interface, click the Configure button and select the Security tab. Select the 802.1x tab. Set the 802.1x Security Mode to 802.1x or Mixed and click OK.
| Ignore the reboot message - this can be done when the entire procedure is finished.
Select the RADIUS tab and the Radius Auth sub-tab. Enable the Primary RADIUS server. (You must specify information for at least the Primary RADIUS server. The Backup RADIUS server is optional.) Enter an Authorization Lifetime (the length of time, in seconds, that can elapse before a client session is automatically re-authenticated). Range is 60 - 43200 seconds (in 60 sec increments); default is 900 sec. Select a Server Addressing Format (either name or IP address). Use a server name only if you have enabled the DNS Client functionality. See RADIUS DNS Host Name Support. Enter the Server Name or IP Address for the Primary RADIUS server. Enter the Destination Port. The default is 1812, however your RADIUS server provider may have another communication port defined. Enter the RADIUS server password in the Shared Secret and Confirm Shared Secret fields. Configure the Response Time (the maximum time, in seconds, to wait for the RADIUS server to respond to a request) and Maximum Retransmission (the maximum number of times a request may be retransmitted) values. Reboot the AP-2000 device for these changes to take effect. Security Configuration Screen - 802.1x Security Mode #### 802.1x Security and Wireless Distribution Systems (WDS) Wireless distribution systems (WDS) are configured using specific ports on the AP-2000 unit and frequency channels in the wireless interface cards. To use 802.1x with WDS, you need to set the 802.1x Security Mode to Mixed (WEP and 802.1x) and confirm that the AP-2000 units communicating in the WDS share the same encryption key (Key 1). See Wireless Distribution System (WDS) for more information.
| WDS is only available for 802.11b cards.
## If You Encounter Problems... Cannot Associate with a Network. When the client starts, it automatically looks for a network. If it cannot associate with a network, confirm that the case-sensitive Network Name (SSID) is properly configured on the client.
| Refer to the documentation that came with your wireless client for assistance with configuring its Network Name.
If the Network Name is the same in both the client and the AP-2000 device, then verify the settings in the Security Properties table, which includes encryption settings. Other Errors. Systematically double-check the AP-2000 unit settings, especially the IP Addresses and the client IP Address Pool. For more information, please refer to Troubleshooting in this guide.