# AP-2000 Help Contents |
[ Home ] [ORiNOCO website]

## Configuring Advanced Features Some of the more complex networking configurations are described in this chapter:
Network Settings Advanced DHCP Server Configuration DHCP IP Pool Table Settings Link Integrity Settings | Set parameters for DHCP server including the IP Pool table. Configure Link Integrity settings and Target IP Address table.
VLAN Support Typical VLAN Configurations VLAN Workgroups and Traffic Management Typical User VLAN Configurations Typical VLAN Management ID Configuration Scenarios | Setup a VLAN network.
Management Settings Managing IP Access Configuring Management Service Interfaces | Configure system management settings such as passwords, management IP Access table, and services’ parameters (SNMP, Telnet, HTTP, Serial).
Setting Filters Setting the Ethernet Protocol Filter Advanced Filtering TCP/UDP Port Filtering | Set AP-2000 device filters including Ethernet filters, Static MAC address filters, and other advanced filters.
Alarms (SNMP Traps) Alarm (Trap) Groups Alarm Host Table Syslog | Set alarms (SNMP Traps) including enabling alarm groups and the alarm host table. Also, configure the Syslog settings.
Bridge Configuration Settings Static MAC Address Filter Spanning Tree Protocol Broadcast Storms and Storm Thresholds Intra BSS Subscriber Blocking Packet Forwarding | Setup the AP-2000 device as a simple bridge or a wireless repeater, setup loop avoidance through the Spanning Tree protocol and Storm Threshold protection. Also, allows you to filter packets based on MAC addresses, prevent wireless clients associated with the same AP-2000 from communicating with each other, and forward all wireless traffic to a specified network node.
Wireless Distribution System (WDS) WDS Setup Procedure Wireless Port Mapping Configuring the AP-2000 Unit as a Wireless Repeater | Establish point-to-point connections with other access points (the wireless backbone).
Advanced RADIUS Features Fallback to Primary RADIUS Server RADIUS Start/Stop Accounting RADIUS DNS Host Name Support | Configure RADIUS server settings to implement advanced features, including RADIUS Accounting and DNS client functionality to support RADIUS server host names.
## ## Network Settings ### Advanced DHCP Server Configuration Configure DHCP to provide dynamic client IP Addresses from one or more IP Pool Tables. Create IP Pool Tables by specifying a Start IP Address and an End IP Address.
| Before enabling this feature, confirm that the IP address pools you have configured are valid addresses on the network and do not overlap the addresses assigned by any other DHCP server on the network. Enabling this feature with incorrect address pools will cause problems on your network.
DHCP Server Configuration Screen Enable DHCP Server. Place a check mark in the box provided to allow the AP-2000 to assign clients IP Addresses from IP Pool Tables. Uncheck the box to prevent client IP Address assignment from the AP-2000.
| You should have at least one entry in the DHCP Server IP Address Pool table before you enable the DHCP Server feature.
Subnet Mask. Read-only value of the AP-2000 mask. Gateway IP Address. Enter the default Gateway IP Address. Primary DNS IP Address. Enter the Domain Name Server IP Address. Secondary DNS IP Address. Enter the Domain Name Server IP Address. ### DHCP IP Pool Table Settings To add an entry, click Add, and then specify the start and end IP Address. Start IP Address. Enter the starting IP Address for this IP Pool Table. End IP Address. Enter the ending IP Address for this IP Pool Table. Comment. Enter related information. Default Lease Time (optional) - the default time value for clients to retain the assigned IP Address. DHCP automatically renews IP Addresses without client notification. Default is 86400 seconds. Maximum Lease Time (optional) - the maximum time value for clients to retain the assigned IP Address. DHCP automatically renews IP Addresses without client notification. Default is 86400 seconds. Status. Shows enabled/disabled status. To edit or delete an entry, click Edit. Edit the information, or select Enable, Disable, or Delete from the Status pull-down menu. ### Link Integrity Settings This feature checks the link between the AP-2000 and connected network server(s). If the link goes down then the client will connect to another AP-2000 in your network that still communicates with the server.
| This feature is only applicable to 2.4 GHz (802.11b) cards.
Link Integrity Configuration Screen Enable Link Integrity. Place a check mark in the box provided to activate the Link Integrity feature. Poll Interval. Set the interval (minimum 500ms and in increments of 500ms) between polls. Poll Retransmissions. Set the number of times a poll should be retransmitted before the link is considered down. #### Target IP Address Table Settings To add an Target IP Address entry, click Add, and then specify the IP Address of the servers you want to check. Target IP Address. Enter the IP Address Comments. Enter related information. Status. Shows enabled/disabled status. A disabled status only means that the AP-2000 is not checking the link, for example, when the network server is being serviced. To edit or delete an entry, click Edit. Edit the information, or select Enable or Disable from the Status pull-down menu. ## VLAN Support Virtual Local Area Networks (VLANs) are logical groupings of network resources. Defined by software settings, VLAN resources appear (to clients) to be in the same room, no matter where they are attached on the physical LAN segment. They simplify traffic flow between clients and their frequently-used or restricted resources. VLANs now extend as far as the access point signal reaches; clients can connect from anywhere in the broadcast area. The broadcast area is defined by the network name configured for the wireless card on the access point device. AP-2000 devices are fully VLAN-ready; however, by default VLAN support is disabled. Before enabling VLAN support, certain network settings should be configured, and network resources such as a VLAN-aware switch, a RADIUS server, and possibly a DHCP server should be available. Once enabled, VLANs are used to more conveniently, efficiently, and easily manage your network. Manage adds, moves, and changes from a single point of contact Define and monitor groups Reduce broadcast and multicast traffic to unnecessary destinations Improve network performance and reduce latency Increase security Secure network restricts members to resources on their own workgroup Clients roam without compromising security ### Typical VLAN Configurations VLANs collect and distribute data through wireless AP-2000 network interface cards (NIC). An Ethernet port on the access point typically connects a wireless cell to a wired backbone. They communicate across a VLAN-capable switch that reviews packet headers and directs traffic to the appropriate ports. On the wired network, a RADIUS server authenticates traffic and a DHCP server manages IP addresses. Resources like servers and printers may be present, and a hub may include multiple APs, extending the network over a larger area. Components of a typical VLAN ### VLAN Workgroups and Traffic Management Traditional, dual-slot access point devices that are not VLAN-capable typically transmit broadcast and multicast traffic to all wireless Network Interface Cards (NICs). This process wastes wireless bandwidth and degrades throughput performance. In comparison, the dual-slot, VLAN-capable AP-2000 device is designed to efficiently manage delivery of broadcast, multicast, and unicast traffic to wireless clients. The AP-2000 device assigns clients to one of two VLANs designated by a network name. First, each one of the wireless NICs in the AP-2000 device is configured with a unique network name and an 802.1Q-compliant VLAN identifier. Each NIC represents a VLAN. Each network client is then assigned one of the two wireless NIC network names. The AP-2000 device matches packets transmitted or received to a network name with the associated VLAN. Traffic received by a VLAN is only sent on the wireless NIC associated with that same VLAN. This eliminates unnecessary traffic on the wireless LAN, conserving bandwidth and maximizing throughput. #### Traffic Management In addition to enhancing wireless traffic management, the VLAN-capable AP-2000 device supports easy assignment of wireless users to workgroups. In a typical scenario, each user VLAN represents a workgroup; for example, one VLAN could be used for an EMPLOYEE workgroup and the other, for a GUEST workgroup. In this scenario, the AP-2000 device would assign every packet it accepted to a VLAN. Each packet would then be identified as EMPLOYEE or GUEST, depending on which wireless NIC received it. The AP-2000 device would insert VLAN headers or “tags” with identifiers into the packets transmitted on the wired backbone to a network switch. Finally, the switch would be configured to route packets from the EMPLOYEE workgroup to the appropriate corporate resources such as printers and servers. Packets from the GUEST workgroup transmitted on the same network as packets from the EMPLOYEE workgroup, could, in contrast, be restricted to a gateway that allowed access to only the Internet. A member of the GUEST workgroup could send and receive e-mail and access the Internet, but would be prevented from accessing servers or hosts on the local corporate network. ### Typical User VLAN Configurations VLANs segment network traffic into workgroups, which enable you to limit broadcast and multicast traffic. Workgroups enable clients from different VLANs to access different resources using the same network infrastructure. Clients using the same physical network are limited to those resources available to their workgroup. The three primary scenarios for use of the VLAN support feature are detailed as follows. Scenario 1: Setting Up Independent VLAN Workgroups (“Tagged” User VLANs) Scenario 2: Setting Up Independent VLAN Workgroups (Tagged & Untagged User VLANs) Scenario 3: Setting Up One VLAN Workgroup (One Tagged VLAN) #### Setting Up Independent VLAN Workgroups (Tagged) The AP-2000 tags all traffic received from wireless clients transmitted on either the wired or the wireless backbone (see description of Wireless Distribution System (WDS) feature) with a header identifying each packet as belonging to one VLAN workgroup or another. To configure this scenario, set up two different workgroups with separate VLAN Identifiers (IDs). VLAN ID for Wireless NIC in Slot A = a number between 1 and 4094 (per the IEEE 802.1Q standard) VLAN ID for Wireless NIC in Slot B = a number between 1 and 4094
| The number configured for the wireless NIC in Slot A must be different than the number configured for the wireless NIC in Slot B.
VLAN Configuration Screen (Wireless A and Wireless Tagged with Different VLAN IDs) In the Web Interface, click the Configure button and select the Interfaces tab. Enter a unique Network Name (SSID) for each wireless network interface card (NIC). Select the Network tab and select the VLAN sub-tab. Set a unique VLAN User ID for each wireless NIC (enter a value between 1 and 4094). Place a checkmark in the Enable VLAN Protocol box. Configure the wireless client with one of the two Network Names based on VLAN membership. #### Setting Up Independent VLAN Workgroups (Tagged & Untagged) The VLAN-capable AP-2000 supports configuration of both “tagged” and “untagged” user VLANs. A “tagged” user VLAN is created when a VLAN ID between 1 and 4094 (per the 802.1Q standard) is configured for one of the wireless NICs and VLAN is enabled. The AP-2000 applies a VLAN header to tag traffic from wireless clients (members of a “tagged” VLAN) and transmits the traffic as appropriate, on either the wired or wireless backbone. An “untagged” User VLAN is created when a VLAN ID of 0 is configured for one of the wireless NICs and VLAN is enabled. Traffic received from wireless clients (members of an “untagged” VLAN) is transmitted as appropriate, on either the wired or wireless backbone. “Untagged” User VLANs enable VLANs to coexist on networks with non-VLAN capable devices such as legacy servers. To configure this scenario, set up only one workgroup by configuring one tagged interface and one untagged interface: VLAN ID for Wireless NIC in Slot A = 0 or a number between 1 and 4094 VLAN ID for Wireless NIC in Slot B = 0 or a number between 1 and 4094
| Either the wireless NIC in Slot A or the wireless NIC in Slot B must be set to 0.
VLAN Configuration Screen (Wireless A Tagged Only) In the Web Interface, click the Configure button and select the Interfaces tab Enter a unique Network Name (SSID) for each NIC. Select the Network tab and select the VLAN sub-tab. Set the VLAN UserID for one NIC to 0. Set the VLAN User ID for the other NIC to a value between 1 and 4094. Place a checkmark in the Enable VLAN Protocol box. Configure the wireless client with one of the two Network Names based on VLAN membership. #### Setting Up a Single VLAN Workgroup The VLAN feature enables all wireless clients that access the network through the same AP-2000 to be configured as members of the same VLAN. In this scenario, each wireless NIC is configured with the same VLAN ID. The same VLAN header or tag is then applied to all traffic received from wireless clients and transmitted on the wired or wireless backbone. All wireless clients become members of the same VLAN. To configure this scenario, set up one, large workgroup: VLAN ID for Wireless NIC in Slot A = 0 or a number between 1 and 4094 VLAN ID for Wireless NIC in Slot B = 0 or a number between 1 and 4094 VLAN Configuration Screen (Wireless A and Wireless B Use Same VLAN ID) In the Web Interface, click the Configure button and select the Interfaces tab. Enter a unique Network Name (SSID) for each wireless network interface card (NIC). Select the Network tab and select the VLAN sub-tab. Set the VLAN UserID for the NIC in Slot A to a value between 1 and 4094. Set the VLAN UserID for the NIC in Slot B to the same value configured for the NIC in Slot A. Place a checkmark in the Enable VLAN Protocol box. Configure the wireless client with one of the two Network Names based on VLAN membership. ### Typical VLAN Management ID Configuration Scenarios #### Making the AP-2000 a VLAN Member to Control Management Access
| Proxim Corporation provides the features in the Advanced Features pages for your convenience only. Dell technical support representatives can not support the configuration options in the Advanced Features portion. All settings are fully documented and are fully explained in this file.
Management access to the AP-2000 can easily be secured by making management stations or hosts and the AP-2000 device itself members of a common VLAN. Simply configure a non-zero management VLAN ID and enable VLAN to restrict management of the AP-2000 device to members of the same VLAN. In the Web Interface, click the Configure button and select the Network tab. Select the VLAN sub-tab. Set the VLAN Management ID to a value between1 and 4094 (a value of 0 disables VLAN management). Place a checkmark in the Enable VLAN Protocol box.
| If a non-zero management VLAN ID is configured then management access to the AP-2000 is restricted to wired or wireless hosts that are members of the same VLAN. Ensure your management platform or host is a member of the same VLAN before attempting to manage the AP-2000 device.
#### Managing the AP-2000 from a Wireless Host The VLAN feature enables wireless clients to manage the AP-2000. If the VLAN Management ID matches a VLAN User ID, then those wireless clients who are members of both VLANs will have AP-2000 management access. In the Web Interface, click the Configure button and select the Interfaces tab. Enter a unique Network Name (SSID) for each wireless NIC. Select the Network tab and the VLAN sub-tab. Set the VLAN User ID for the wireless NICs in Slot A and Slot B to values between 1 and 4094. Set the VLAN Management ID to a value equivalent to one of the VLAN User IDs. Place a checkmark in the Enable VLAN Protocol box.
| Once a VLAN Management ID is configured and is equivalent to one of the VLAN User IDs on the AP-2000, all members of the User VLAN will have management access to the AP-2000. Be careful to restrict VLAN membership to those with legitimate access to the AP-2000 device.
## Management Settings Configure system management settings, including interface access passwords, destination port numbers, and service timeouts. Select new passwords during initial configuration. Management Configuration Screen ### Managing IP Access IP Access Table Configuration Screen The Management IP Access table is used to specify a station or stations that are authorized to manage the AP-2000 device through available management services (SNMP, HTTP [Web], and Telnet [CLI]). To configure this table, click Add and set the following parameters: IP Address. Enter the IP Address for the management station. IP Mask. Enter a mask that will act as a filter to limit access to a range of IP Addresses. Comment. Enter an optional comment such as the station name.
| The IP mask 255.255.255.255 would authorize the single station defined by the IP Address to configure the Access Point device. The Access Point device would ignore commands from any other IP address. In contrast, the IP mask 255.255.255.0 would authorize anyone on the subnet shared by the IP Address to configure the Access Point device. To edit or delete an entry, click Edit. Edit the information, or select Enable, Disable, or Delete from the Status pull-down menu.
### Configuring Management Service Interfaces Management Services Configuration Screen ##### SNMP-Based Management Interface Bitmask Configure the interface or interfaces (Ethernet, Wireless-A, Wireless-B, All Interfaces) from which you will manage the AP-2000 device via SNMP. You can also select Disabled to prevent a user from accessing the AP-2000 device via SNMP. Reboot the AP-2000 for this setting to take effect. ##### HTTP Access Several configuration options are available that restrict access to the Web interface. Reboot the AP-2000 for any changes to take effect. HTTP Interface Bitmap. Configure the interface or interfaces (Ethernet, Wireless-A, Wireless-B, All Interfaces) from which you will manage the AP-2000 device via the Web interface. You can also select Disabled to prevent a user from accessing the AP-2000 device from the Web interface. HTTP Port. Configure the HTTP port from which you will manage the AP-2000 device via the Web interface. By default, the HTTP port is 80. ##### Telnet Configuration Settings Use the Services tab to set the Telnet port, timeout, and session parameters. Telnet Interface Bitmask. Select the interface(s) (Disabled, Ethernet, Wireless A, Wireless B, All Interfaces) from which you can manage the AP-2000 device via telnet. This parameter can also be used to Disable telnet management. Reboot the AP-2000 for this setting to take effect. Telnet Port. Enter the Telnet Port. The default port number is 23. Login Idle Timeout (seconds). Enter the number of seconds the system will wait for a login attempt. The AP-2000 terminates the session when it times out. Session Idle Timeout (seconds). Enter the number of seconds the system will wait during a session while there is no activity. The AP-2000 will terminate the session on timeout.
| See Configure Serial Port Interface Settings for information on the serial port parameters.
## Setting Filters Setting protocol filters through the Ethernet Protocol Filter, TCP/UDP Port Filter, and the Advanced Filtering interface can impact the performance of your network by limiting the amount of unnecessary traffic received from unsupported protocols. In addition, various filters can be set up through the Static MAC Address Table to control the interaction between network devices and to control the types of protocol packets distributed by your network. This section describes the Ethernet Protocol, Advanced, and TCP/UDP Port filtering options. See Static MAC Address Filter for information on the Static MAC address filter. ### Setting the Ethernet Protocol Filter Use the Ethernet Protocol tab to set filters. Enable Ethernet Filter Status. Place a checkmark in the box provided to enable filtering. If disabled, then the AP-2000 will not filter any of the Ethernet protocols listed in the Filter Table. Filter Operation Type. If set to Passthru, only the enabled Ethernet Protocols listed in the Filter Table will pass through the bridge. If set to Block, the bridge will block enabled Ethernet Protocols listed in the Filter Table. Ethernet Filter Configuration Screen ##### Ethernet Protocol Filter Table This table is pre-populated with existing Ethernet Protocol Filters, however, you may enter additional filters by specifying the appropriate parameters. To add an entry, click Add, and then specify the Protocol Number and a Protocol Name. Protocol Number. Enter the protocol number. See http://www.iana.org/assignments/ethernet-numbers for a list of protocol numbers. Protocol Name. Enter related information, typically the protocol name. To edit or delete an entry, click Edit and change the information, or select Enable, Disable, or Delete from the Status pull-down menu. ### Advanced Filtering Advanced Filtering Configuration Screen Enable Proxy ARP. Place a checkmark in the box provided to allow the Access Point to respond to Address Resolution Protocol (ARP) requests for wireless clients. Proxy ARP answers ARP requests for wireless stations without actually forwarding the (broadcast) ARP request to the wireless network. If disabled, the Access Point will bridge ARP requests for wireless clients to the wireless LAN. Enable IP/ARP Filtering. Place a checkmark in the box provided to allow IP/ARP filtering based on the IP/ARP Filtering Address and IP Mask. Leave the box unchecked to prevent filtering. IP/ARP Filtering Address. Enter the Network filtering IP Address. IP/ARP IP Mask. Enter the Network Mask IP Address. The following advanced filtering protocols can filter in the wireless-to-Ethernet direction, the Ethernet-to-wireless direction, or in both directions. Click Edit and use the Status field to Enable or Disable the filter. Deny IPX RIP Deny IPX SAP Deny IPX LSP Deny IP Broadcasts Deny IP Multicasts ### TCP/UDP Port Filtering Port-based filtering enables you to control wireless user access to network services by selectively blocking TCP/UDP protocols through the AP-2000. A user specifies a Protocol Name, Port Number, Port Type (TCP, UDP, or TCP/UDP), and filtering interfaces (all interfaces, no interfaces, or any combination of Wireless Slot A, Wireless Slot B, and Ethernet) in order to block access to services, such as Telnet and FTP, and traffic, such as NETBIOS and HTTP. For example, an AP-2000 with the following configuration would discard frames received on Wireless Slot A with a UDP destination port number of 137, effectively blocking NETBIOS Name Service packets.
Protocol Type (TCP/UDP) | Destination Port Number | Protocol Name | Interface | Status (Enable/Disable)
UDP | 137 | NETBIOS Name Service | Wireless port A | Enable
TCP/UDP Port Filtering Configuration Screen #### Adding TCP/UDP port filters In the Web Interface, click the Configure button and select the Filtering tab. Select the TCP/UDP Port sub-tab. Click the box to Enable TCP/UDP Port Filtering. Under the heading, TCP/UDP Port Filter Table, click Add. Adding a Port to the TCP/UDP Port Filter Table In the TCP/UDP Port Filter Table, enter the Protocol Names to filter. Set the destination Port Number (a value between 0 and 65535) to filter. See the IANA Web site at http://www.iana.org/assignments/port-numbers for a list of assigned port numbers and their descriptions. Set the Port Type for the protocol: TCP, UDP, or both (TCP/UDP). Set the Interface to filter (any combination of the following): Wireless Slot A Wireless Slot B Ethernet Click OK.
| Filters are enabled by default. Frames that the AP-2000 receives on the specified interface(s) with the specified TCP/UDP destination port, are discarded.
#### Editing TCP/UDP port filters In the Web Interface, click the Configure button and select the Filtering tab. Select the TCP/UDP Port sub-tab. Under the heading, TCP/UDP Port Filter Table, click the button marked Edit. Make any changes to the Protocol Name or Port Number for a specific entry, if necessary. In the row that defines the port, set the Status to enable, disable, or delete as appropriate. Select OK. ## Alarms (SNMP Traps) ### Alarm (Trap) Groups Alarm Groups Configuration Screen There are seven alarm groups that can be enabled or disabled: Enable Configuration Alarms. Enable Security Alarms. Enable Wireless Alarms. Enable Operational Alarms. Enable Flash Memory Alarms. Enable TFTP Alarms. Enable Image Alarms. Place a checkmark in the box provided to enable a specific group. Remove the checkmark from the box to disable the alarms. See System Alarms (Traps) for the list of alarms contained in each group. ### Alarm Host Table To add an entry and enable the AP-2000 to send SNMP trap messages to a Trap Host, click Add, and then specify the IP Address and Password for the Trap Host. IP Address. Enter the Trap Host IP Address. Password, Confirm. Enter the password in the Password field and the Confirm field. Comment. Enter an optional comment, such as the alarm (trap) host station name. To edit or delete an entry, click Edit. Edit the information, or select Enable, Disable, or Delete from the Status pull-down menu. ### Syslog The Syslog messaging system enables the AP-2000 to transmit event messages to a central server for monitoring and troubleshooting. The access point logs “Session Start (Log-in)” and “Session Stop (Log-out)” events for each wireless client as an alternative to RADIUS accounting. See RFCs 3164 at http://www.rfc-editor.org/ for more information on the Syslog standard. Syslog Interaction with the Access Point 2000 #### Setting Syslog Event Notifications Syslog Events are logged according to the level of detail specified by the administrator. Logging only urgent system messages will create a far smaller, more easily read log then a log of every event the system encounters. Determine which events to log by selecting a priority defined by the following scale: ##### Event Priority Description
LOG_EMERG | 0 | system is unusable
LOG_ALERT | 1 | action must be taken immediately
LOG_CRIT | 2 | critical conditions
LOG_ERR | 3 | error conditions
LOG_WARNING | 4 | warning conditions
LOG_NOTICE | 5 | normal but significant condition
LOG_INFO | 6 | informational
LOG_DEBUG | 7 | debug-level messages
##### #### Enabling Syslog Event Notifications Syslog Configuration Screen In the Web Interface, click the Configure button and select the Alarms tab. Select the Syslog sub-tab. Place a checkmark in the box provided to Enable Syslog. Enter the IP address of the Syslog server. Enter the Syslog Lowest Priority Logged. The AP-2000 will send event messages to the Syslog server that correspond to the selected priority and below. For example, if set to 6, the AP-2000 will transmit event messages labeled priority 0 to 6 to the Syslog server. Click OK. ## Bridge Configuration Settings The AP-2000 device can be set up as a simple bridge between your wired and wireless network devices. As a bridge, the functions performed by the AP-2000 device include: MAC address learning Forward and filtering decision making Spanning Tree protocol used for loop avoidance Simple Bridge Setup ### MAC Address Learning Once the AP-2000 unit is connected to your network, it learns which devices are connected to it by recording the MAC addresses of each device to which it sends packets during the course of a normal session. To view the Learn Table, click on the Monitor button in the web interface and select the Learn Table tab. The table can hold up to 10,000 entries. ### Static MAC Address Filter The Static MAC Address filter optimizes the performance of a wireless (and wired) network. The filter is an advanced Bridge setup parameter for AP-2000 devices that enables you to deny data traffic between two specific devices via the wireless interface(s) of the AP-2000 bridge. Static MAC Filter Configuration Screen For example, to prevent redundant traffic from being transmitted over the wireless network, you could deny traffic between two particular servers, identified by their MAC Address and their location as perceived by the AP-2000 (on the ‘wired’ or wireless’ port of the bridge). In most situations, however, it is easier to control redundant traffic via other filtering options, such as Protocol Filtering. Wired MAC Address. Enter the device MAC Address. Wired Mask. Enter the Wired Mask value. Wireless MAC Address. Enter the device MAC Address. Wireless Mask. Enter the Wireless Mask value Comment. Enter related information. #### Information Masks The MAC Address combines with the Bit Mask to create a filter. Wired MAC Addresses and their associated masks, and wireless MAC Addresses and their associated masks are known generically as “information masks” and are written in the following format: MAC Address: 00 02 10 12 34 56 Bit Mask: FF FF FF FF 00 00 In this example, all MAC Addresses starting with 00 02 10 12 are filtered. ### Spanning Tree Protocol A Spanning Tree is used to avoid redundant communication loops in networks with multiple bridging devices. Bridges do not have any inherent mechanism to avoid loops, because having redundant systems is a necessity is certain networks. However, redundant systems can cause Broadcast Storms, multiple frame copies, and MAC address table instability problems. Complex network structures can create multiple loops within a network. The Spanning Tree configuration blocks certain ports on AP-2000 devices to control the path of communication within the network, avoiding loops and following a spanning tree structure.
| For more information on Spanning Tree protocol, please see Section 8.0 of the IEEE 802.1d standard.
### Broadcast Storms and Storm Thresholds Storm Threshold is an advanced Bridge setup option that you can use to protect the network against data overload by: Specifying a maximum number of frames per second as received from a single network device (identified by its MAC address). Specifying an absolute maximum number of messages per port. The ‘Storm Threshold’ parameters allow you to specify a set of thresholds for each port of the AP-2000, identifying separate values for the number of broadcast messages/second and Multicast messages/second. When the number of frames for a port or identified station exceeds the maximum value per second, the AP-2000 will ignore all subsequent messages issued by the particular network device, or ignore all messages of that type. Address Threshold. Enter the maximum allowed number of packets per second. Ethernet Threshold Enter the maximum allowed number of packets per second. Wireless-Slot A Threshold Enter the maximum allowed number of packets per second. Wireless-Slot B Threshold Enter the maximum allowed number of packets per second. ### Intra BSS Subscriber Blocking The wireless clients (or subscribers) that associate with a certain AP-2000 form the Basic Service Set (BSS) of a network infrastructure. By default, wireless subscribers in the same BSS can communicate with each other. However, some administrators (such as wireless public spaces) may wish to block traffic between wireless subscribers that are associated with the same AP-2000 to prevent unauthorized communication and to conserve bandwidth. This feature enables you to prevent wireless subscribers within a BSS from exchanging traffic. Although this feature is generally enabled in public access environments, Enterprise LAN administrators use it to conserve wireless bandwidth by limiting communication between wireless clients. For example, this feature prevents peer-to-peer file sharing or gaming over the wireless network. Intra BSS Traffic Blocking #### Blocking Intra BSS Traffic In the Web Interface, click the Configure button and select the Bridge tab. Select the Intra BSS sub-tab. Select `Block` from the Intra BSS Traffic Operation drop-down menu. Click OK. Intra BSS Configuration Screen #### Enabling Intra BSS Traffic In the Web Interface, click on the Configure button and Select the Bridge tab Select the Intra BSS sub-tab Select Passthru from the Intra BSS Traffic Operation drop-down menu Click OK ### Packet Forwarding The Packet Forwarding feature enables you to redirect traffic generated by wireless clients that are all associated to the same AP-2000 to a single MAC address. This filters wireless traffic without burdening the AP-2000 and provides additional security by limiting potential destinations or by routing the traffic directly to a firewall. You can redirect a specific port (Ethernet or WDS) or allow the bridge’s learning process (and the forwarding table entry for the selected MAC address) to determine the optimal port.
| The gateway to which traffic will be redirected should be node on the Ethernet network. It should not be a wireless client.
Packet Forwarding Configuration Screen #### Configuring Interfaces for Packet Forwarding Configure your AP-2000 to forward packets by specifying interface port(s) though which packets are redirected and a destination MAC address. In the Web Interface, click the Configure button and select the Bridge tab. Select the Pkt Forwarding sub-tab. Specify a destination Packet Forwarding MAC Address. The AP-2000 will redirect all unicast, multicast, and broadcast packets received from wireless clients to the address you specify. Click the down arrow to activate the menu and select a Packet Forwarding Interface. You can redirect traffic to: Ethernet A WDS connection (see Wireless Distribution System (WDS) for details) Any (traffic is redirected to a port based on the bridge learning process) Check the box to Enable Packet Forwarding. Click OK to save your changes.
| Only those wireless interfaces corresponding to cards currently inserted and available in the AP-2000 will be visible on the configuration menu.
## Wireless Distribution System (WDS) Wireless Distribution System (WDS) is a wireless method of configuring a network backbone between AP-2000 devices, and functions much like Ethernet. Using wireless cards, WDS allows you to configure up to six (6) point-to-point links between Access Point devices.
| This feature is only applicable to 2.4 GHz (802.11b) cards.
Traffic flow between AP-2000 devices with WDS ### Bridging WDS Each wireless card can support up to six WDS links, and each link is mapped to a logical port on the AP-2000 (WDS ports). WDS ports behave like Ethernet ports on the AP-2000 but BSS ports are handled differently: the AP-2000 learns by association on BSS ports and from frames on WDS/Ethernet ports. AP-2000 Ports: 1. Ethernet Port 2. BSS Port (Wireless Card A) 3-8. WDS ports for Wireless Card A 9. BSS Port (Wireless Card B) 10-15. WDS Ports for Wireless Card B
| The above assumes that the AP-2000 has two 802.11b cards installed.
### Configuring WDS The state of each WDS port in the bridge/spanning tree can be controlled from two places: 802.11 MIB WDS table Bridge MIB port table If you are only using one card, always place it in Slot A. Spanning tree determines the port states if WDS configurations are correct. If there is no partner MAC address configured in the WDS table, the WDS port remains disabled. No two partner MAC addresses should be the same for WDS ports on the same card. Channel settings on the cards should be the same. ### WDS Setup Procedure
| WDS and ACS cannot be Enabled at the same time on the same card.
To setup a wireless backbone follow the steps below for each AP-2000 that you wish to include in the wireless distribution system. Since WDS and ACS cannot be Enabled at the same time on the same card, the first step must be to ensure ACS is disabled. Follow the process described in Disabling ACS in Configuring the Access Point 2000ORiNOCO AP-2000 device. Wireless Interface Screen - WDS Configuration Write down the MAC Address of the PC Card inside the wireless slot of the AP-2000 that you wish to include in the wireless distribution system (this value is printed on a label on the back of the PC Card). In the Web Interface, click the Configure button and select Interfaces. Select the Wireless sub-tab that corresponds to the card’s location (slot A or B). Click the Edit button to update the Wireless Distribution System (WDS) Table. WDS Table Configuration Screen Enter the MAC Address that you registered in Step 2 in the Partner MAC Address field of the Wireless Distribution Setup window. Set the Status of the device to Enable. Select OK. #### Setup the WDS 802.1x Security Mode To set up a Wireless Distribution System (WDS) with 802.1x security mode, set the AP-2000 unit in mixed mode and give each AP-2000 unit in the WDS the same encryption key 1: In the Web Interface, click the Configure button and select the Security tab. In the 802.1x Security Mode field, select Mixed (802.1x and WEP) from the pull-down menu. Select a key length from the pull-down menu.
| A 64-bit card (also sometimes referred to as 40-bit encryption) has a key length of 5 alphanumeric characters or 10 hexadecimal digits, while a 128-bit card (also sometimes referred to as 104-bit encryption) has a key length of 13 characters or 26 hexadecimal digits. Key length varies based on the card type. 802.11a cards do not support WDS.
Click the Encryption and enter a value for Encryption Key 1. This must be the same length as what you choose for the key length in the 802.1x screen.
| Make sure that each AP-2000 unit that is a member of the WDS has the same value for Encryption Key 1.
Click OK. The AP-2000 unit will need to be rebooted for the changes to take affect. ### Wireless Port Mapping When using Spanning Tree to configure WDS links, you must first configure the MAC address of the card to which the wireless link will be established. Data transmitted on the WDS port goes directly, via point-to-point link, to the MAC address of the wireless card you configure.
| Since six (6) WDS ports can be configured for each card, you need to map paths from WDS ports to mutually exclusive wireless port designations for Spanning Tree.
### Configuring the AP-2000 Unit as a Wireless Repeater This configuration requires two or three AP-2000 devices. If you have three devices, a dedicated wireless AP-2000 unit should be configured with Slot A and Slot B of the AP-2000 device wireless distribution link. This AP-2000 unit should not be connected to a wired interface. Please note: A slot may repeat up to six wired links. Also, the other two wired AP-2000 units should be configured so that one slot partners with the Wireless WDS partner. If you have two devices, form a WDS link between them by configuring one wireless card in each AP-2000 as a dedicated WDS port. Additional Information: The AP-2000 unit should only allow client associations on those channels and network names that are configured for a WDS link. Result: The wireless AP-2000 unit functions as a repeater. ## Advanced RADIUS Features This section contains additional information about the AP-2000’s interaction with your network’s RADIUS servers. ### Fallback to Primary RADIUS Server This automatic feature ensures the primary RADIUS server is used to authenticate your network when it is available. If you have configured the AP-2000 with a primary and a backup RADIUS server, the AP-2000 will switch to the backup server if the primary server fails for any reason. After the unit has switched to the backup server, it will periodically check the status of the primary RADIUS server every five (5) minutes. Once the primary RADIUS server is again online, the AP-2000 automatically reverts from the backup RADIUS server back to the primary RADIUS server. All subsequent requests are sent to the primary RADIUS server. ### RADIUS Start/Stop Accounting Using an external RADIUS server, the AP-2000 can track and record the length of client sessions on the access point by sending RADIUS accounting messages per RFC2866. When a wireless client is successfully authenticated, RADIUS accounting is initiated by sending an “Accounting Start” request to the RADIUS server. When the wireless client session ends, an “Accounting Stop” request is sent to the RADIUS server. RADIUS Accounting Configuration Screen #### Session Length Sessions continue when a client reauthenticates to the same AP-2000. Sessions are terminated when: A client disassociates. A client does not transmit any data to the AP-2000 for a fixed amount of time. A client is detected on a different interface. If the client roams from one AP-2000 to another, one session is terminated and a new session is begun.
| This feature requires RADIUS authentication using MAC Access Control or 802.1x. Wireless clients configured in the AP-2000’s static MAC Access Control list are not tracked.
#### Configuring RADIUS Accounting Follow these steps to enable RADIUS accounting on the AP-2000: In the Web Interface, click the Configure button and select RADIUS. Select the RADIUS Acc sub-tab. Place a checkmark in the Enable RADIUS Accounting box to turn on this feature. Place a checkmark in the appropriate box or boxes to enable the primary and backup RADIUS Accounting servers. You must specify information for at least the Primary RADIUS server. The Backup RADIUS server is optional. Enter the session timeout interval in minutes within the Accounting Inactivity Timer field. An accounting session automatically ends for a client that is idle for the period of time specified. Select the Server Addressing Format (either IP address or server name). Use a server name only if you have enabled the DNS Client functionality. See RADIUS DNS Host Name Support. Enter the server’s IP address or name (depending on the Server Addressing Format setting) in the field provided. Enter the Destination Port. The default is 1813, however your RADIUS server provider may have another communication port defined. Enter the RADIUS server password in the Shared Secret and Confirm Shared Secret fields. Configure the Response Time (the maximum time, in seconds, to wait for the RADIUS server to respond to a request) and Maximum Retransmission (the maximum number of times a request may be retransmitted) values. Click OK to save your changes and reboot the AP-2000. ### RADIUS DNS Host Name Support DNS Names are familiar names used to identify network hosts instead of IP addresses. For your convenience, the AP-2000 can be configured as a DNS client to recognize the DNS host name of your RADIUS server (so you can specify a RADIUS Server’s name rather than its IP address in the RADIUS server configuration screens). IP Configuration Screen - Configuring the AP-2000 as a DNS Client #### Using DNS Host Names In the Web Interface, click the Configure button and select the Network tab. Select the IP Configuration sub-tab. Once you have configured the IP information for your AP-2000, select the check box to Enable DNS Client. In the DNS Primary Server IP Address field, enter the IP Address of the Primary DNS server which will resolve the RADIUS Server Host name to an IP address. In the DNS Secondary Server IP Address field, enter the IP Address of the Secondary DNS server which will resolve the RADIUS Server Host name to an IP address, if applicable. Enter the DNS host name, also called the DNS Client Default Domain Name. Select OK to save your changes and reboot the AP-2000.