Cisco ios software configuration guide for cisco aironet access points cisco ios releases 12.4(21a)ja1 and 12.3(8)jec

Cisco IOS Software Configuration Guide
for Cisco Aironet Access Points
Cisco IOS Releases 12.4(21a)JA1 and 12.3(8)JEC
February 2010

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883

Text Part Number: OL-21881-01

CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco
StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip
Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital,
Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch,
AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco
IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum,
EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys,
MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu,
Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its
affiliates in the United States and certain other countries. All other trademarks mentioned in this document or website are the property of their respective owners. The use of
the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
Copyright © 2010 Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface

xix

Audience
Purpose

1-xix
1-xix

Organization

1-xx

Conventions

1-xxi

Related Publications

1-xxiii

Obtaining Documentation, Obtaining Support, and Security Guidelines

CHAPTER

1

Overview

1-1

Features 1-2
Features Introduced in This Release
Management Options
Roaming Client Devices

1-2

1-3
1-3

Network Configuration Examples 1-3
Root Access Point 1-4
Repeater Access Point 1-4
Bridges 1-5
Workgroup Bridge 1-6
Central Unit in an All-Wireless Network

CHAPTER

1

1-xxiv

Using the Web-Browser Interface

1-7

1-1

Using the Web-Browser Interface for the First Time

1-2

Using the Management Pages in the Web-Browser Interface
Using Action Buttons 1-3
Character Restrictions in Entry Fields 1-4

1-2

Enabling HTTPS for Secure Browsing 1-4
CLI Configuration Example 1-12
Deleting an HTTPS Certificate 1-12
Using Online Help 1-13
Changing the Location of Help Files
Disabling the Web-Browser Interface

1-13
1-14

OL-21881-01

iii

Contents

CHAPTER

1

Using the Command-Line Interface
Cisco IOS Command Modes
Getting Help

1-1

1-2

1-3

Abbreviating Commands

1-3

Using no and default Forms of Commands
Understanding CLI Messages

1-4

1-4

Using Command History 1-4
Changing the Command History Buffer Size 1-5
Recalling Commands 1-5
Disabling the Command History Feature 1-5
Using Editing Features 1-6
Enabling and Disabling Editing Features 1-6
Editing Commands Through Keystrokes 1-6
Editing Command Lines that Wrap 1-7
Searching and Filtering Output of show and more Commands
Accessing the CLI 1-9
Opening the CLI with Telnet 1-9
Opening the CLI with Secure Shell

CHAPTER

1

1-8

1-9

Configuring the Access Point for the First Time

1-1

Before You Start 1-2
Resetting the Device to Default Settings 1-2
Resetting to Default Settings Using the MODE Button
Resetting to Default Settings Using the GUI 1-2
Resetting to Default Settings Using the CLI 1-3
Obtaining and Assigning an IP Address
Default IP Address Behavior 1-4

1-2

1-4

Connecting to the 1100 Series Access Point Locally

1-5

Connecting to the 1130 Series Access Point Locally

1-6

Connecting to the 1140,1200, 1230, 1240, and 1250 Series Access Points Locally
Connecting to the 1300 Series Access Point/Bridge Locally
Default Radio Settings

1-6

1-7

1-7

Assigning Basic Settings 1-8
Default Settings on the Express Setup Page
Configuring Basic Security Settings 1-15
Understanding Express Security Settings
Using VLANs 1-16

1-13

1-16


iv

OL-21881-01

Contents

Express Security Types 1-17
Express Security Limitations 1-19
Using the Express Security Page 1-19
CLI Configuration Examples 1-20
Configuring System Power Settings for 1130 and 1240 Series Access Points
Assigning an IP Address Using the CLI
Using a Telnet Session to Access the CLI

1-26
1-26

Configuring the 802.1X Supplicant 1-27
Creating a Credentials Profile 1-27
Applying the Credentials to an Interface or SSID 1-28
Applying the Credentials Profile to the Wired Port 1-28
Applying the Credentials Profile to an SSID Used For the Uplink
Creating and Applying EAP Method Profiles 1-30

CHAPTER

1

Administering the Access Point
Disabling the Mode Button

1-25

1-29

1-1

1-2

Preventing Unauthorized Access to Your Access Point

1-3

Protecting Access to Privileged EXEC Commands 1-3
Default Password and Privilege Level Configuration 1-4
Setting or Changing a Static Enable Password 1-4
Protecting Enable and Enable Secret Passwords with Encryption
Configuring Username and Password Pairs 1-7
Configuring Multiple Privilege Levels 1-8
Setting the Privilege Level for a Command 1-8
Logging Into and Exiting a Privilege Level 1-9

1-6

Controlling Access Point Access with RADIUS 1-9
Default RADIUS Configuration 1-10
Configuring RADIUS Login Authentication 1-10
Defining AAA Server Groups 1-12
Configuring RADIUS Authorization for User Privileged Access and
Network Services 1-14
Displaying the RADIUS Configuration 1-15
Controlling Access Point Access with TACACS+ 1-15
Default TACACS+ Configuration 1-15
Configuring TACACS+ Login Authentication 1-15
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services
Displaying the TACACS+ Configuration 1-17
Configuring Ethernet Speed and Duplex Settings

1-17

1-18

OL-21881-01

v

Contents

Configuring the Access Point for Wireless Network Management

1-18

Configuring the Access Point for Local Authentication and Authorization
Configuring the Authentication Cache and Profile

1-20

Configuring the Access Point to Provide DHCP Service 1-22
Setting up the DHCP Server 1-22
Monitoring and Maintaining the DHCP Server Access Point
Show Commands 1-24
Clear Commands 1-25
Debug Command 1-25
Configuring the Access Point for Secure Shell
Understanding SSH 1-25
Configuring SSH 1-26
Configuring Client ARP Caching 1-26
Understanding Client ARP Caching
Optional ARP Caching 1-26
Configuring ARP Caching 1-27

1-19

1-24

1-25

1-26

Managing the System Time and Date 1-27
Understanding Simple Network Time Protocol 1-27
Configuring SNTP 1-28
Configuring Time and Date Manually 1-28
Setting the System Clock 1-28
Displaying the Time and Date Configuration 1-29
Configuring the Time Zone 1-29
Configuring Summer Time (Daylight Saving Time) 1-30
Defining HTTP Access

1-32

Configuring a System Name and Prompt 1-32
Default System Name and Prompt Configuration
Configuring a System Name 1-32
Understanding DNS 1-33
Default DNS Configuration 1-33
Setting Up DNS 1-34
Displaying the DNS Configuration 1-35
Creating a Banner 1-35
Default Banner Configuration 1-35
Configuring a Message-of-the-Day Login Banner
Configuring a Login Banner 1-37

1-32

1-35

Upgrading Autonomous Cisco Aironet Access Points to Lightweight Mode
Migrating to Japan W52 Domain

1-37

1-37


vi

OL-21881-01

Contents

Verifying the Migration

1-39

Configuring Multiple VLAN and Rate Limiting for Point-to-Multipoint Bridging
CLI Command 1-40

CHAPTER

1

Configuring Radio Settings

1-39

1-1

Enabling the Radio Interface

1-2

Configuring the Role in Radio Network 1-2
Universal Workgroup Bridge Mode 1-5
Configuring Dual-Radio Fallback 1-5
Radio Tracking 1-6
Fast Ethernet Tracking 1-6
MAC-Address Tracking 1-6
Bridge Features Not Supported 1-7
Configuring Radio Data Rates 1-7
Access Points Send Multicast and Management Frames at Highest Basic Rate
Configuring MCS Rates

1-8

1-10

Configuring Radio Transmit Power 1-11
Limiting the Power Level for Associated Client Devices
Configuring Radio Channel Settings 1-14
802.11n Channel Widths 1-15
Dynamic Frequency Selection 1-16
CLI Commands 1-18
Confirming that DFS is Enabled 1-18
Configuring a Channel 1-19
Blocking Channels from DFS Selection
Setting the 802.11n Guard Interval 1-20

1-13

1-19

Configuring Location-Based Services 1-21
Understanding Location-Based Services 1-21
Configuring LBS on Access Points 1-21
Enabling and Disabling World Mode

1-22

Disabling and Enabling Short Radio Preambles
Configuring Transmit and Receive Antennas

1-23
1-24

Enabling and Disabling Gratuitous Probe Response
Disabling and Enabling Aironet Extensions

1-25

1-26

Configuring the Ethernet Encapsulation Transformation Method
Enabling and Disabling Reliable Multicast to Workgroup Bridges
Enabling and Disabling Public Secure Packet Forwarding
Configuring Protected Ports 1-30

1-27
1-28

1-29

OL-21881-01

vii

Contents

Configuring the Beacon Period and the DTIM
Configure RTS Threshold and Retries

1-30

1-31

Configuring the Maximum Data Retries

1-32

Configuring the Fragmentation Threshold

1-32

Enabling Short Slot Time for 802.11g Radios
Performing a Carrier Busy Test

1-33

1-33

Configuring VoIP Packet Handling

1-33

Viewing VoWLAN Metrics 1-34
Viewing Voice Reports 1-34
Viewing Wireless Client Reports 1-37
Viewing Voice Fault Summary 1-38
Configuring Voice QoS Settings 1-38
Configuring Voice Fault Settings 1-39
Configuring ClientLink 1-40
Using the CLI to Configure ClientLink

CHAPTER

1

Configuring Multiple SSIDs

1-40

1-1

Understanding Multiple SSIDs 1-2
Effect of Software Versions on SSIDs

1-2

Configuring Multiple SSIDs 1-4
Default SSID Configuration 1-4
Creating an SSID Globally 1-4
Viewing SSIDs Configured Globally 1-6
Using Spaces in SSIDs 1-6
Using a RADIUS Server to Restrict SSIDs 1-7
Configuring Multiple Basic SSIDs 1-8
Requirements for Configuring Multiple BSSIDs
Guidelines for Using Multiple BSSIDs 1-8
Configuring Multiple BSSIDs 1-8
Displaying Configured BSSIDs 1-10

1-8

Assigning IP Redirection for an SSID 1-11
Guidelines for Using IP Redirection 1-12
Configuring IP Redirection 1-12
Including an SSID in an SSIDL IE
NAC Support for MBSSID 1-13
Configuring NAC for MBSSID

1-13

1-16


viii

OL-21881-01

Contents

CHAPTER

1

Configuring Spanning Tree Protocol

1-1

Understanding Spanning Tree Protocol 1-2
STP Overview 1-2
1300 and 350 Series Bridge Interoperability 1-3
Access Point/Bridge Protocol Data Units 1-3
Election of the Spanning-Tree Root 1-4
Spanning-Tree Timers 1-5
Creating the Spanning-Tree Topology 1-5
Spanning-Tree Interface States 1-5
Blocking State 1-7
Listening State 1-7
Learning State 1-7
Forwarding State 1-8
Disabled State 1-8
Configuring STP Features 1-8
Default STP Configuration 1-8
Configuring STP Settings 1-9
STP Configuration Examples 1-10
Root Bridge Without VLANs 1-10
Non-Root Bridge Without VLANs 1-11
Root Bridge with VLANs 1-11
Non-Root Bridge with VLANs 1-13
Displaying Spanning-Tree Status

CHAPTER

1

1-14

Configuring an Access Point as a Local Authenticator
Understanding Local Authentication

1-1

1-2

Configuring a Local Authenticator 1-2
Guidelines for Local Authenticators 1-3
Configuration Overview 1-3
Configuring the Local Authenticator Access Point 1-3
Configuring Other Access Points to Use the Local Authenticator 1-6
Configuring EAP-FAST Settings 1-7
Configuring PAC Settings 1-7
Configuring an Authority ID 1-8
Configuring Server Keys 1-8
Possible PAC Failures Caused by Access Point Clock 1-8
Limiting the Local Authenticator to One Authentication Type 1-9
Unblocking Locked Usernames 1-9
Viewing Local Authenticator Statistics 1-9
OL-21881-01

ix

Contents

Using Debug Messages

CHAPTER

1

1-10

Configuring Cipher Suites and WEP

1-1

Understanding Cipher Suites and WEP

1-2

Configuring Cipher Suites and WEP 1-3
Creating WEP Keys 1-3
WEP Key Restrictions 1-5
Example WEP Key Setup 1-5
Enabling Cipher Suites and WEP 1-6
Matching Cipher Suites with WPA and CCKM 1-7
Enabling and Disabling Broadcast Key Rotation 1-7

CHAPTER

1

Configuring Authentication Types

1-1

Understanding Authentication Types 1-2
Open Authentication to the Access Point 1-2
Shared Key Authentication to the Access Point 1-3
EAP Authentication to the Network 1-4
MAC Address Authentication to the Network 1-5
Combining MAC-Based, EAP, and Open Authentication 1-6
Using CCKM for Authenticated Clients 1-6
Using WPA Key Management 1-7
Software and Firmware Requirements for WPA, CCKM, CKIP, and WPA-TKIP
Configuring Authentication Types 1-10
Assigning Authentication Types to an SSID 1-10
Configuring WPA Migration Mode 1-13
Configuring Additional WPA Settings 1-14
Configuring MAC Authentication Caching 1-15
Configuring Authentication Holdoffs, Timeouts, and Intervals 1-16
Creating and Applying EAP Method Profiles for the 802.1X Supplicant
Creating an EAP Method Profile 1-18
Applying an EAP Profile to the Fast Ethernet Interface 1-18
Applying an EAP Profile to an Uplink SSID 1-19
Matching Access Point and Client Device Authentication Types

CHAPTER

1

1-8

1-17

1-19

Configuring WDS, Fast Secure Roaming, Radio Management, and Wireless Intrusion Detection
Services 1-1
Understanding WDS 1-2
Role of the WDS Device 1-2
Role of Access Points Using the WDS Device

1-3


x

OL-21881-01

Contents

Understanding Fast Secure Roaming
Understanding Radio Management
Understanding Layer 3 Mobility

1-3
1-5

1-5

Understanding Wireless Intrusion Detection Services

1-6

Configuring WDS 1-7
Guidelines for WDS 1-8
Requirements for WDS 1-8
Configuration Overview 1-8
Configuring Access Points as Potential WDS Devices 1-9
Configuring Access Points to use the WDS Device 1-14
Configuring the Authentication Server to Support WDS 1-15
Configuring WDS Only Mode 1-19
Viewing WDS Information 1-20
Using Debug Messages 1-21
Configuring Fast Secure Roaming 1-21
Requirements for Fast Secure Roaming 1-21
Configuring Access Points to Support Fast Secure Roaming
Configuring Management Frame Protection

1-22

1-24

Management Frame Protection 1-24
Overview 1-25
Protection of Unicast Management Frames 1-25
Protection of Broadcast Management Frames 1-25
Client MFP For Access Points in Root mode 1-25
Configuring Client MFP 1-26
Configuring Radio Management 1-28
Configuring Access Points to Participate in WIDS 1-30
Configuring the Access Point for Scanner Mode 1-30
Configuring the Access Point for Monitor Mode 1-30
Displaying Monitor Mode Statistics 1-31
Configuring Monitor Mode Limits 1-32
Configuring an Authentication Failure Limit 1-32
Configuring WLSM Failover 1-32
Resilient Tunnel Recovery 1-32
Active/Standby WLSM Failover 1-33

OL-21881-01

xi

Contents

CHAPTER

1

Configuring RADIUS and TACACS+ Servers

1-1

Configuring and Enabling RADIUS 1-1
Understanding RADIUS 1-2
RADIUS Operation 1-2
Configuring RADIUS 1-3
Default RADIUS Configuration 1-4
Identifying the RADIUS Server Host 1-4
Configuring RADIUS Login Authentication 1-7
Defining AAA Server Groups 1-9
Configuring RADIUS Authorization for User Privileged Access and Network Services
Configuring Packet of Disconnect 1-12
Starting RADIUS Accounting m 1-13
Selecting the CSID Format 1-14
Configuring Settings for All RADIUS Servers 1-15
Configuring the Access Point to Use Vendor-Specific RADIUS Attributes 1-16
Configuring the Access Point for Vendor-Proprietary RADIUS Server Communication
Configuring WISPr RADIUS Attributes 1-18
Displaying the RADIUS Configuration 1-19
RADIUS Attributes Sent by the Access Point 1-20
Configuring and Enabling TACACS+ 1-23
Understanding TACACS+ 1-23
TACACS+ Operation 1-24
Configuring TACACS+ 1-24
Default TACACS+ Configuration 1-25
Identifying the TACACS+ Server Host and Setting the Authentication Key 1-25
Configuring TACACS+ Login Authentication 1-26
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services
Starting TACACS+ Accounting 1-28
Displaying the TACACS+ Configuration 1-29

CHAPTER

1

Configuring VLANs

1-11

1-17

1-27

1-1

Understanding VLANs 1-2
Related Documents 1-3
Incorporating Wireless Devices into VLANs
Configuring VLANs 1-4
Configuring a VLAN 1-5
Assigning Names to VLANs 1-7
Guidelines for Using VLAN Names
Creating a VLAN Name 1-8

1-4

1-7


xii

OL-21881-01

Contents

Using a RADIUS Server to Assign Users to VLANs 1-8
Using a RADIUS Server for Dynamic Mobility Group Assignment
Viewing VLANs Configured on the Access Point 1-9
VLAN Configuration Example

CHAPTER

1

Configuring QoS

1-9

1-10

1-1

Understanding QoS for Wireless LANs 1-2
QoS for Wireless LANs Versus QoS on Wired LANs
Impact of QoS on a Wireless LAN 1-2
Precedence of QoS Settings 1-3
Using Wi-Fi Multimedia Mode 1-4
Configuring QoS 1-5
Configuration Guidelines 1-5
Configuring QoS Using the Web-Browser Interface
The QoS Policies Advanced Page 1-9
QoS Element for Wireless Phones 1-9
IGMP Snooping 1-10
AVVID Priority Mapping 1-10
WiFi Multimedia (WMM) 1-10
Adjusting Radio Access Categories 1-10
Configuring Nominal Rates 1-12
Optimized Voice Settings 1-12
Configuring Call Admission Control 1-12

1-2

1-5

QoS Configuration Examples 1-14
Giving Priority to Voice Traffic 1-14
Giving Priority to Video Traffic 1-15

CHAPTER

1

Configuring Filters

1-1

Understanding Filters

1-2

Configuring Filters Using the CLI

1-2

Configuring Filters Using the Web-Browser Interface 1-3
Configuring and Enabling MAC Address Filters 1-3
Creating a MAC Address Filter 1-4
Using MAC Address ACLs to Block or Allow Client Association to the Access Point
Creating a Time-Based ACL 1-8
ACL Logging 1-9
Configuring and Enabling IP Filters 1-9
Creating an IP Filter 1-11

1-6

OL-21881-01

xiii

Contents

Configuring and Enabling Ethertype Filters
Creating an Ethertype Filter 1-13

CHAPTER

1

Configuring CDP

1-1

Understanding CDP

1-2

Configuring CDP 1-2
Default CDP Configuration 1-2
Configuring the CDP Characteristics 1-2
Disabling and Enabling CDP 1-3
Disabling and Enabling CDP on an Interface
Monitoring and Maintaining CDP

CHAPTER

1

Configuring SNMP

1-12

1-4

1-4

1-1

Understanding SNMP 1-2
SNMP Versions 1-2
SNMP Manager Functions 1-3
SNMP Agent Functions 1-4
SNMP Community Strings 1-4
Using SNMP to Access MIB Variables

1-4

Configuring SNMP 1-5
Default SNMP Configuration 1-5
Enabling the SNMP Agent 1-5
Configuring Community Strings 1-6
Specifying SNMP-Server Group Names 1-7
Configuring SNMP-Server Hosts 1-8
Configuring SNMP-Server Users 1-8
Configuring Trap Managers and Enabling Traps 1-8
Setting the Agent Contact and Location Information 1-10
Using the snmp-server view Command 1-10
SNMP Examples 1-10
Displaying SNMP Status

CHAPTER

1

1-12

Configuring Repeater and Standby Access Points and Workgroup Bridge Mode
Understanding Repeater Access Points
Configuring a Repeater Access Point
Default Configuration 1-4
Guidelines for Repeaters 1-4
Setting Up a Repeater 1-5

1-1

1-2
1-3


xiv

OL-21881-01

Contents

Aligning Antennas 1-6
Verifying Repeater Operation 1-6
Setting Up a Repeater As a LEAP Client
Setting Up a Repeater As a WPA Client
Understanding Hot Standby

1-7
1-8

1-9

Configuring a Hot Standby Access Point
Verifying Standby Operation 1-12

1-9

Understanding Workgroup Bridge Mode 1-13
Treating Workgroup Bridges as Infrastructure Devices or as Client Devices
Configuring a Workgroup Bridge for Roaming 1-15
Configuring a Workgroup Bridge for Limited Channel Scanning 1-15
Configuring the Limited Channel Set 1-15
Ignoring the CCX Neighbor List 1-16
Configuring a Client VLAN 1-16
Configuring Workgroup Bridge Mode

1-16

The Workgroup Bridge in a Lightweight Environment 1-18
Guidelines for Using Workgroup Bridges in a Lightweight Environment
Sample Workgroup Bridge Configuration 1-20

CHAPTER

1

1-14

Managing Firmware and Configurations

1-18

1-1

Working with the Flash File System 1-1
Displaying Available File Systems 1-2
Setting the Default File System 1-3
Displaying Information About Files on a File System 1-3
Changing Directories and Displaying the Working Directory
Creating and Removing Directories 1-4
Copying Files 1-4
Deleting Files 1-5
Creating, Displaying, and Extracting tar Files 1-5
Creating a tar File 1-5
Displaying the Contents of a tar File 1-6
Extracting a tar File 1-7
Displaying the Contents of a File 1-7

1-3

Working with Configuration Files 1-7
Guidelines for Creating and Using Configuration Files 1-8
Configuration File Types and Location 1-9
Creating a Configuration File by Using a Text Editor 1-9
Copying Configuration Files by Using TFTP 1-9
Preparing to Download or Upload a Configuration File by Using TFTP

1-10

OL-21881-01

xv

Contents

Downloading the Configuration File by Using TFTP 1-10
Uploading the Configuration File by Using TFTP 1-11
Copying Configuration Files by Using FTP 1-11
Preparing to Download or Upload a Configuration File by Using FTP 1-12
Downloading a Configuration File by Using FTP 1-12
Uploading a Configuration File by Using FTP 1-13
Copying Configuration Files by Using RCP 1-14
Preparing to Download or Upload a Configuration File by Using RCP 1-15
Downloading a Configuration File by Using RCP 1-16
Uploading a Configuration File by Using RCP 1-17
Clearing Configuration Information 1-17
Deleting a Stored Configuration File 1-18
Working with Software Images 1-18
Image Location on the Access Point 1-18
tar File Format of Images on a Server or Cisco.com 1-19
Copying Image Files by Using TFTP 1-19
Preparing to Download or Upload an Image File by Using TFTP 1-19
Downloading an Image File by Using TFTP 1-20
Uploading an Image File by Using TFTP 1-22
Copying Image Files by Using FTP 1-22
Preparing to Download or Upload an Image File by Using FTP 1-23
Downloading an Image File by Using FTP 1-24
Uploading an Image File by Using FTP 1-26
Copying Image Files by Using RCP 1-27
Preparing to Download or Upload an Image File by Using RCP 1-27
Downloading an Image File by Using RCP 1-29
Uploading an Image File by Using RCP 1-31
Reloading the Image Using the Web Browser Interface 1-32
Browser HTTP Interface 1-32
Browser TFTP Interface 1-33

CHAPTER

1

Configuring System Message Logging

1-1

Understanding System Message Logging

1-2

Configuring System Message Logging 1-2
System Log Message Format 1-2
Default System Message Logging Configuration 1-3
Disabling and Enabling Message Logging 1-4
Setting the Message Display Destination Device 1-5
Enabling and Disabling Timestamps on Log Messages 1-6


xvi

OL-21881-01

Contents

Enabling and Disabling Sequence Numbers in Log Messages 1-6
Defining the Message Severity Level 1-7
Limiting Syslog Messages Sent to the History Table and to SNMP 1-8
Setting a Logging Rate Limit 1-9
Configuring UNIX Syslog Servers 1-10
Logging Messages to a UNIX Syslog Daemon 1-10
Configuring the UNIX System Logging Facility 1-10
Displaying the Logging Configuration

CHAPTER

1

Troubleshooting

1-12

1-1

Checking the Top Panel Indicators 1-2
Indicators on 1130 Series Access Points 1-6
Indicators on 1140 Series Access Point 1-9
Indicators on 1240 Series Access Points 1-12
Indicators on 1250 Access Points 1-14
Indicators on 1300 Outdoor Access Point/Bridges
Normal Mode LED Indications 1-17
Power Injector 1-19
Checking Power

1-17

1-20

Low Power Condition

1-20

Checking Basic Settings 1-21
SSID 1-21
WEP Keys 1-21
Security Settings 1-21
Resetting to the Default Configuration
Using the MODE Button 1-22
Using the Web Browser Interface
Using the CLI 1-23

1-22

1-23

Reloading the Access Point Image 1-24
Using the MODE button 1-25
Using the Web Browser Interface 1-26
Browser HTTP Interface 1-26
Browser TFTP Interface 1-26
Using the CLI 1-27
Obtaining the Access Point Image File 1-29
Obtaining TFTP Server Software 1-29
MIB List

B-1

Using FTP to Access the MIB Files

B-2

OL-21881-01

xvii

Contents

Conventions

C-2

Software Auto Upgrade Messages

C-3

Association Management Messages
Unzip Messages

C-5

C-6

802.11 Subsystem Messages

C-7

Inter-Access Point Protocol Messages
Local Authenticator Messages
WDS Messages

C-20

C-21

C-23

Mini IOS Messages

C-24

Access Point/Bridge Messages

C-25

Cisco Discovery Protocol Messages

C-25

External Radius Server Error Messages
LWAPP Error Messages
Sensor Messages

C-26

C-27

SNMP Error Messages
SSH Error Messages

C-26

C-28
C-29

INDEX


xviii

OL-21881-01

Preface
Audience
This guide is for the networking professional who installs and manages Cisco Aironet Access Points. To
use this guide, you should have experience working with the Cisco IOS software and be familiar with
the concepts and terminology of wireless local area networks.
The guide covers two Cisco IOS releases: 12.4(21a)JA1 and 12.3(8)JEC. Cisco IOS Release
12.4(21a)JA1 supports the following autonomous 32 Mb platforms:
•

1130 series access point

•


•


•


•

1300 outdoor access point/bridge

Cisco IOS Release 12.3(8)JEC is a maintenance release and supports the following autonomous 16 Mb
platforms:
•
•


•

Note


This guide does not cover lightweight access points. Configuration for these devices can be found in the
appropriate installation and configuration guides on cisco.com.

Purpose
This guide provides the information you need to install and configure your access point. This guide
provides procedures for using the Cisco IOS software commands that have been created or changed for
use with the access point. It does not provide detailed information about these commands. For detailed
information about these commands, refer to the Cisco IOS Command Reference for Cisco Aironet Access
Points and Bridges for this release. For information about the standard Cisco IOS software commands,
refer to the Cisco IOS software documentation set available from the Cisco.com home page at Support
> Documentation. On the Cisco Support Documentation home page, select Release 12.4 from the Cisco
IOS Software drop-down list. Select wireless in the left frame to view the Wireless Support Resources
page, then navigate to the access point or bridge for you are using.

OL-21881-01

xix

Preface
Organization

This guide also includes an overview of the access point web-based interface (APWI), which contains
all the functionality of the command-line interface (CLI). This guide does not provide field-level
descriptions of the APWI windows nor does it provide the procedures for configuring the access point
from the APWI. For all APWI window descriptions and procedures, refer to the access point online help,
which is available from the Help buttons on the APWI pages.

Organization
This guide is organized into these chapters:
Chapter 1, “Overview,” lists the software and hardware features of the access point and describes the
access point’s role in your network.
Chapter 2, “Using the Web-Browser Interface,” describes how to use the web-browser interface to
configure the access point.
Chapter 3, “Using the Command-Line Interface,” describes how to use the command-line interface
(CLI) to configure the access point.
Chapter 4, “Configuring the Access Point for the First Time,” describes how to configure basic settings
on a new access point.
Chapter 5, “Administering the Access Point,” describes how to perform one-time operations to
administer your access point, such as preventing unauthorized access to the access point, setting the
system date and time, and setting the system name and prompt.
Chapter 6, “Configuring Radio Settings,” describes how to configure settings for the access point radio
such as the role in the radio network, transmit power, channel settings, and others.
Chapter 7, “Configuring Multiple SSIDs,” describes how to configure and manage multiple service set
identifiers (SSIDs) and multiple basic SSIDs (BSSIDs) on your access point. You can configure up to
16 SSIDs and up to eight BSSIDs on your access point.
Chapter 8, “Configuring Spanning Tree Protocol,”describes how to configure Spanning Tree Protocol
(STP) on your access point, bridge, or access point operating in a bridge mode. STP prevents bridge
loops from occurring in your network.
Chapter 9, “Configuring an Access Point as a Local Authenticator,” describes how to configure the
access point to act as a local RADIUS server for your wireless LAN. If the WAN connection to your
main RADIUS server fails, the access point acts as a backup server to authenticate wireless devices.
Chapter 10, “Configuring Cipher Suites and WEP,” describes how to configure the cipher suites required
to use authenticated key management, Wired Equivalent Privacy (WEP), and WEP features including
MIC, CMIC, TKIP, CKIP, and broadcast key rotation.
Chapter 11, “Configuring Authentication Types,” describes how to configure authentication types on the
access point. Client devices use these authentication methods to join your network.
Chapter 12, “Configuring WDS, Fast Secure Roaming, Radio Management, and Wireless Intrusion
Detection Services,” describes how to configure the access point to participate in WDS, to allow fast
reassociation of roaming client services, and to participate in radio management.
Chapter 13, “Configuring RADIUS and TACACS+ Servers,” describes how to enable and configure the
RADIUS and Terminal Access Controller Access Control System Plus (TACACS+), which provide
detailed accounting information and flexible administrative control over authentication and
authorization processes.
Chapter 14, “Configuring VLANs,” describes how to configure your access point to interoperate with
the VLANs set up on your wired LAN.


xx

OL-21881-01

Preface
Conventions

Chapter 15, “Configuring QoS,” describes how to configure and manage MAC address, IP, and
Ethertype filters on the access point using the web-browser interface.
Chapter 16, “Configuring Filters,” describes how to configure and manage MAC address, IP, and
Ethertype filters on the access point using the web-browser interface.
Chapter 17, “Configuring CDP,” describes how to configure Cisco Discovery Protocol (CDP) on your
access point. CDP is a device-discovery protocol that runs on all Cisco network equipment.
Chapter 18, “Configuring SNMP,” describes how to configure the Simple Network Management
Protocol (SNMP) on your access point.
Chapter 19, “Configuring Repeater and Standby Access Points and Workgroup Bridge Mode,” describes
how to configure your access point as a hot standby unit or as a repeater unit.
Chapter 20, “Managing Firmware and Configurations,” describes how to manipulate the Flash file
system, how to copy configuration files, and how to archive (upload and download) software images.
Chapter 21, “Configuring System Message Logging,” describes how to configure system message
logging on your access point.
Chapter 22, “Troubleshooting,” provides troubleshooting procedures for basic problems with the access
point.
Appendix A, “Protocol Filters,” lists some of the protocols that you can filter on the access point.
Appendix B, “Supported MIBs,” lists the Simple Network Management Protocol (SNMP) Management
Information Bases (MIBs) that the access point supports for this software release.
Appendix C, “Error and Event Messages,” lists the CLI error and event messages and provides an
explanation and recommended action for each message.

Conventions
This publication uses these conventions to convey instructions and information:
Command descriptions use these conventions:
•

Commands and keywords are in boldface text.

•

Arguments for which you supply values are in italic.

•

Square brackets ([ ]) mean optional elements.

•

Braces ({ }) group required choices, and vertical bars ( | ) separate the alternative elements.

•

Braces and vertical bars within square brackets ([{ | }]) mean a required choice within an optional
element.

Interactive examples use these conventions:
•

Terminal sessions and system displays are in screen font.

•

Information you enter is in boldface screen font.

•

Nonprinting characters, such as passwords or tabs, are in angle brackets (< >).

Notes, cautions, and timesavers use these conventions and symbols:

Tip

Means the following will help you solve a problem. The tips information might not be troubleshooting
or even an action, but could be useful information.

OL-21881-01

xxi

Preface
Conventions

Note

Caution

Warning

Waarschuwing

Means reader take note. Notes contain helpful suggestions or references to materials not contained in
this manual.

Means reader be careful. In this situation, you might do something that could result equipment damage
or loss of data.

This warning symbol means danger. You are in a situation that could cause bodily injury. Before you
work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar
with standard practices for preventing accidents. (To see translations of the warnings that appear
in this publication, refer to the appendix “Translated Safety Warnings.”)
Dit waarschuwingssymbool betekent gevaar. U verkeert in een situatie die lichamelijk letsel kan
veroorzaken. Voordat u aan enige apparatuur gaat werken, dient u zich bewust te zijn van de bij
elektrische schakelingen betrokken risico’s en dient u op de hoogte te zijn van standaard
maatregelen om ongelukken te voorkomen. (Voor vertalingen van de waarschuwingen die in deze
publicatie verschijnen, kunt u het aanhangsel “Translated Safety Warnings” (Vertalingen van
veiligheidsvoorschriften) raadplegen.)

Varoitus

Tämä varoitusmerkki merkitsee vaaraa. Olet tilanteessa, joka voi johtaa ruumiinvammaan. Ennen
kuin työskentelet minkään laitteiston parissa, ota selvää sähkökytkentöihin liittyvistä vaaroista ja
tavanomaisista onnettomuuksien ehkäisykeinoista. (Tässä julkaisussa esiintyvien varoitusten
käännökset löydät liitteestä "Translated Safety Warnings" (käännetyt turvallisuutta koskevat
varoitukset).)

Attention

Ce symbole d’avertissement indique un danger. Vous vous trouvez dans une situation pouvant
entraîner des blessures. Avant d’accéder à cet équipement, soyez conscient des dangers posés par
les circuits électriques et familiarisez-vous avec les procédures courantes de prévention des
accidents. Pour obtenir les traductions des mises en garde figurant dans cette publication, veuillez
consulter l’annexe intitulée « Translated Safety Warnings » (Traduction des avis de sécurité).

Warnung

Dieses Warnsymbol bedeutet Gefahr. Sie befinden sich in einer Situation, die zu einer
Körperverletzung führen könnte. Bevor Sie mit der Arbeit an irgendeinem Gerät beginnen, seien Sie
sich der mit elektrischen Stromkreisen verbundenen Gefahren und der Standardpraktiken zur
Vermeidung von Unfällen bewußt. (Übersetzungen der in dieser Veröffentlichung enthaltenen
Warnhinweise finden Sie im Anhang mit dem Titel “Translated Safety Warnings” (Übersetzung der
Warnhinweise).)

Avvertenza

Questo simbolo di avvertenza indica un pericolo. Si è in una situazione che può causare infortuni.
Prima di lavorare su qualsiasi apparecchiatura, occorre conoscere i pericoli relativi ai circuiti
elettrici ed essere al corrente delle pratiche standard per la prevenzione di incidenti. La traduzione
delle avvertenze riportate in questa pubblicazione si trova nell’appendice, “Translated Safety
Warnings” (Traduzione delle avvertenze di sicurezza).


xxii

OL-21881-01

Preface

Advarsel

Aviso

Dette varselsymbolet betyr fare. Du befinner deg i en situasjon som kan føre til personskade. Før du
utfører arbeid på utstyr, må du være oppmerksom på de faremomentene som elektriske kretser
innebærer, samt gjøre deg kjent med vanlig praksis når det gjelder å unngå ulykker. (Hvis du vil se
oversettelser av de advarslene som finnes i denne publikasjonen, kan du se i vedlegget "Translated
Safety Warnings" [Oversatte sikkerhetsadvarsler].)
Este símbolo de aviso indica perigo. Encontra-se numa situação que lhe poderá causar danos
fisicos. Antes de começar a trabalhar com qualquer equipamento, familiarize-se com os perigos
relacionados com circuitos eléctricos, e com quaisquer práticas comuns que possam prevenir
possíveis acidentes. (Para ver as traduções dos avisos que constam desta publicação, consulte o
apêndice “Translated Safety Warnings” - “Traduções dos Avisos de Segurança”).

¡Advertencia!

Este símbolo de aviso significa peligro. Existe riesgo para su integridad física. Antes de manipular
cualquier equipo, considerar los riesgos que entraña la corriente eléctrica y familiarizarse con los
procedimientos estándar de prevención de accidentes. (Para ver traducciones de las advertencias
que aparecen en esta publicación, consultar el apéndice titulado “Translated Safety Warnings.”)

Varning!

Denna varningssymbol signalerar fara. Du befinner dig i en situation som kan leda till personskada.
Innan du utför arbete på någon utrustning måste du vara medveten om farorna med elkretsar och
känna till vanligt förfarande för att förebygga skador. (Se förklaringar av de varningar som
förekommer i denna publikation i appendix "Translated Safety Warnings" [Översatta
säkerhetsvarningar].)

These documents provide complete information about the access point:
•

Quick Start Guide: Cisco Aironet 1100 Series Access Points

•

Quick Start Guide: Cisco Aironet 1130AG Series Access Point

•

Getting Started Guide: Cisco Aironet 1140 Series Autonomous Access Point

•

Quick Start Guide: Cisco Aironet 1200 Series Access Points

•

Quick Start Guide: Cisco Aironet 1240 Series Access Point

•

Quick Start Guide: Cisco Aironet 1250 Series Access Point

•

Quick Start Guide: Cisco Aironet 1300 Series Outdoor Access Point/Bridge

•

Cisco IOS Command Reference for Cisco Aironet Access Points and Bridges

•

Cisco Aironet Access Point Hardware Installation Guide

•

Installation Instructions for Cisco Aironet Power Injectors

•

Cisco 1140 Series Access Point Deployment Guide

•

Installation Instructions for Cisco Aironet 1250 Series Access Point Power Injector

•

Cisco Aironet 802.11g Radio Upgrade Instructions

•

Cisco Aironet 1250 Series Access Point Radio Upgrade Instructions

•

Release Notes for Cisco Aironet Access Points and Bridges for Cisco IOS Release 12.4(21a)JA1

•

Release Notes for Cisco Aironet 1240 and 1300 Series Access Points for Cisco IOS Release
12.4(10b)JA

OL-21881-01

xxiii

Preface
Obtaining Documentation, Obtaining Support, and Security Guidelines

•

Release Notes for Cisco Aironet 1100 and 1200 Series Access Points for Cisco IOS Release
12.3(8)JEC

Obtaining Documentation, Obtaining Support, and Security
Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback,
security guidelines, and also recommended aliases and general Cisco documents, see the monthly
What’s New in Cisco Product Documentation, which also lists all new and revised Cisco technical
documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html


xxiv

OL-21881-01

C H A P T E R

1

Overview
Cisco Aironet Access Points (hereafter called access points) provide a secure, affordable, and
easy-to-use wireless LAN solution that combines mobility and flexibility with the enterprise-class
features required by networking professionals. With a management system based on Cisco IOS software,
Cisco Aironet access points are Wi-Fi certified, 802.11a-compliant, 802.11b-compliant,
802.11g-compliant, and pre-802.11n-compliant wireless LAN transceivers.

Note

The 802.11n standard has not been ratified. Therefore, references to 802.11n throughout this document
refer to 802.11n Draft 2.0.
An access point serves as the connection point between wireless and wired networks or as the center
point of a stand-alone wireless network. In large installations, wireless users within radio range of an
access point can roam throughout a facility while maintaining seamless, uninterrupted access to the
network.
You can configure and monitor the wireless device using the command-line interface (CLI), the
browser-based management system, or Simple Network Management Protocol (SNMP).
Each access point platform contains one or two radios:
•

The 1100 series access point uses a single, 802.11b, 2.4-GHz mini-PCI radio that can be upgraded
to an 802.11g, 2.4-GHz radio.

•

The 1130 series access point has integrated 802.11g and 802.11a radios and antennas.

•

The 1140 series access point has integrated antennas for its pre-802.11n radios operating on the 2.4or 5-GHz frequency bands.

•

The 1200 series access point can contain two radios: a 2.4-GHz radio in an internal mini-PCI slot
and a 5-GHz radio module in an external, modified cardbus slot. The 1200 series access point
supports one radio of each type, but it does not support two 2.4-GHz or two 5-GHz radios.

•

The 1230 series access point is pre-configured to include both an 802.11g and an 802.11a radio. It
has antenna connectors for externally attached antennas for both radios.

•

The 1240 series access point uses two externally connected antennas for each band instead of
built-in antennas.

•

The 1250 series access point uses three externall connected antennas for its pre-802.11n radios
operating on the 2.4- or 5-GHz frequency bands.

•

The 1300 series outdoor access point/bridge uses an integrated antenna and can be configured to use
external, dual-diversity antennas.

This chapter provides information on the following topics:

OL-21881-01

1-1

Chapter 1

Overview

Features

•

Features, page 1-2

•

Management Options, page 1-3

•

Roaming Client Devices, page 1-3

•

Network Configuration Examples, page 1-3

Features
This section lists features supported on access points running Cisco IOS software.

Note

The proxy Mobile-IP feature is not supported in Cisco IOS Releases 12.3(2)JA and later.

Note

Cisco IOS Release 12.3(8)JEC is a maintenance release only. No new features are included in this
release.

Features Introduced in This Release
Table 1-1 lists the new features in Cisco IOS Release 12.4(21a)JA1 and the supported platforms.
Table 1-1

New Cisco IOS Software Features for Cisco IOS Release 12.4(21a)JA1

Cisco
Aironet
1300 Series
Cisco
Cisco
Cisco
Cisco
Outoor
Aironet
Aironet
Aironet
Aironet
1100 Series 1140 Series 1240 Series 1250 Series Access
Point/Bridg
Access
Access
Access
Access
e
Points
Points
Points
Points

Feature

Cisco
Aironet
1400 Series
Wireless
Bridge

Support for Cisco Aironet 1140 Series Access x
Points

x

x

x

x

x

Support for the Firefox browser

x

x

x

x

x

x

ClientLink

–

x

–

x

–

–

Business-ready 802.11n wireless access

–

x

–

x

–

–

European DFS support for EN 301 893,
version 1.4.1 and 1.5.1

x

x

x

x

–

–

Regulatory update for Japan

x

–

x

–

–

–

Manual channel selection in the 5-GHz bands x

x

x

x

–

–

Point-to-point and Point-to-Multi Point
bridging support for 802.11n platforms

–

x

–

x

–

–

Support for 802.11n Performance on 1250
Series Access Points with Standard 802.3af
PoE

–

–

–

x

–

–


1-2

OL-21881-01

Chapter 1

Overview
Management Options

Table 1-1

New Cisco IOS Software Features for Cisco IOS Release 12.4(21a)JA1 (continued)

Cisco
Aironet
1300 Series
Cisco
Cisco
Cisco
Cisco
Outoor
Aironet
Aironet
Aironet
Aironet
1100 Series 1140 Series 1240 Series 1250 Series Access
Point/Bridg
Access
Access
Access
Access
e
Points
Points
Points
Points

Feature
Cisco Wireless LAN Services Engine
(WLSE) support
Antenna support (AIR-ANT2451NV-R)

Note

Cisco
Aironet
1400 Series
Wireless
Bridge

x

x

x

x

x

x

x

For detailed information on the above features, see Release Notes for Cisco Aironet Access Points and
Bridges for Cisco IOS Release 12.4(21a)JA1.

Management Options
You can use the wireless device management system through the following interfaces:
•

The Cisco IOS command-line interface (CLI), which you use through a console port or Telnet
session. Use the interface dot11radio global configuration command to place the wireless device
into the radio configuration mode. Most of the examples in this manual are taken from the CLI.
Chapter 3, “Using the Command-Line Interface,” provides a detailed description of the CLI.

•

A web-browser interface, which you use through a Web browser. Chapter 2, “Using the
Web-Browser Interface,” provides a detailed description of the web-browser interface.

•

Simple Network Management Protocol (SNMP). Chapter 18, “Configuring SNMP,” explains how
to configure the wireless device for SNMP management.

Roaming Client Devices
If you have more than one wireless device in your wireless LAN, wireless client devices can roam
seamlessly from one wireless device to another. The roaming functionality is based on signal quality,
not proximity. When a client’s signal quality drops, it roams to another access point.
Wireless LAN users are sometimes concerned when a client device stays associated to a distant access
point instead of roaming to a closer access point. However, if a client’s signal to a distant access point
remains strong and the signal quality is high, the client will not roam to a closer access point. Checking
constantly for closer access points would be inefficient, and the extra radio traffic would slow
throughput on the wireless LAN.
Using CCKM and a device providing WDS, client devices can roam from one access point to another so
quickly that there is no perceptible delay in voice or other time-sensitive applications.

Network Configuration Examples
OL-21881-01

1-3

Chapter 1

Overview


This section describes the access point’s role in common wireless network configurations. The access
point’s default configuration is as a root unit connected to a wired LAN or as the central unit in an
all-wireless network. Access points can also be configured as repeater access points, bridges, and
workgroup bridges. These roles require specific configurations.

Root Access Point
An access point connected directly to a wired LAN provides a connection point for wireless users. If
more than one access point is connected to the LAN, users can roam from one area of a facility to another
without losing their connection to the network. As users move out of range of one access point, they
automatically connect to the network (associate) through another access point. The roaming process is
seamless and transparent to the user. Figure 1-1 shows access points acting as root units on a wired LAN.
Figure 1-1

Access Points as Root Units on a Wired LAN

Access point

135445

Access point

Repeater Access Point
An access point can be configured as a stand-alone repeater to extend the range of your infrastructure or
to overcome an obstacle that blocks radio communication. The repeater forwards traffic between
wireless users and the wired LAN by sending packets to either another repeater or to an access point
connected to the wired LAN. The data is sent through the route that provides the best performance for
the client. Figure 1-2 shows an access point acting as a repeater. Consult the “Configuring a Repeater
Access Point” section on page 19-3 for instructions on setting up an access point as a repeater.

Note

Non-Cisco client devices might have difficulty communicating with repeater access points.


1-4

OL-21881-01

Chapter 1

Overview

Figure 1-2

Access Point as Repeater

Repeater

135444

Access point

Bridges
The 1140, 1200, 1240, and 1250 series access points and the 1300 access point/bridge can be configured
as root or non-root bridges. In this role, an access point establishes a wireless link with a non-root bridge.
Traffic is passed over the link to the wired LAN. Access points in root and non-root bridge roles can be
configured to accept associations from clients. Figure 1-3 shows an access point configured as a root
bridge with clients. Figure 1-4 shows two access points configured as a root and non-root bridge, both
accepting client associations. Consult the “Configuring the Role in Radio Network” section on page 6-2
for instructions on setting up an access point as a bridge.
When wirless bridges are used in a point-to-multipoint configuration the throughput is reduced
depending on the number of non-root bridges that associate with the root bridge. The maximum
throughput is about 25 Mbps in a point to point link. The addition of three bridges to form a
point-to-multipoint network reduces the throughput to about 12.5 Mbps.

Access Point as a Root Bridge with Clients

135447

Figure 1-3

Root bridge

Non-root bridge

OL-21881-01

1-5

Chapter 1

Overview


Access Points as Root and Non-root Bridges with Clients

135446

Figure 1-4

Root bridge

Non-root bridge

Workgroup Bridge
You can configure access points as workgroup bridges. In workgroup bridge mode, the unit associates
to another access point as a client and provides a network connection for the devices connected to its
Ethernet port. For example, if you need to provide wireless connectivity for a group of network printers,
you can connect the printers to a hub or to a switch, connect the hub or switch to the access point Ethernet
port, and configure the access point as a workgroup bridge. The workgroup bridge associates to an access
point on your network.
If your access point has multiple radios, either radio can function in workgroup bridge mode. When you
configure one radio interface as a workgroup bridge, the other radio interface is automatically disabled.
Figure 1-5 shows an access point configured as a workgroup bridge. Consult the “Understanding
Workgroup Bridge Mode” section on page 19-13 and the “Configuring Workgroup Bridge Mode”
section on page 19-16 for information on configuring your access point as a workgroup bridge.
Access Point as a Workgroup Bridge

Access point
Workgroup bridge

135448

Figure 1-5


1-6

OL-21881-01

Chapter 1

Overview

Central Unit in an All-Wireless Network
In an all-wireless network, an access point acts as a stand-alone root unit. The access point is not
attached to a wired LAN; it functions as a hub linking all stations together. The access point serves as
the focal point for communications, increasing the communication range of wireless users. Figure 1-6
shows an access point in an all-wireless network.
Figure 1-6

Access Point as Central Unit in All-Wireless Network

135443

Access point

OL-21881-01

1-7

Chapter 1

Overview



1-8

OL-21881-01

CH A P T E R

2

This chapter describes the web-browser interface that you can use to configure the wireless device. This
chapter contains these sections:
•

Using the Web-Browser Interface for the First Time, page 2-2

•

Using the Management Pages in the Web-Browser Interface, page 2-2

•

Enabling HTTPS for Secure Browsing, page 2-4

•

Using Online Help, page 2-13

•

Disabling the Web-Browser Interface, page 2-14

The web-browser interface contains management pages that you use to change the wireless device
settings, upgrade firmware, and monitor and configure other wireless devices on the network.

Note

The wireless device web-browser interface is fully compatible with Microsoft Internet Explorer
version 6.0 on Windows 98, 2000, and XP platforms, Mozilla Firefox version 2 on Windows 98, 2000,
and XP platforms, and with Netscape version 7.0 on Windows 98, 2000, XP, and Solaris platforms.

Note

Avoid using both the CLI and the web-browser interfaces to configure the wireless device. If you
configure the wireless device using the CLI, the web-browser interface might display an inaccurate
interpretation of the configuration. However, the inaccuracy does not necessarily mean that the wireless
device is misconfigured.

OL-21881-01

2-1

Chapter 2



Use the wireless device’s IP address to browse to the management system. See the “Obtaining and
Assigning an IP Address” section on page 4-4 for instructions on assigning an IP address to the wireless
device. Follow these steps to begin using the web-browser interface:
Step 1

Start the browser.

Step 2

Enter the wireless device’s IP address in the browser Location field (Netscape Communicator) or
Address field (Internet Explorer) and press Enter. The Summary Status page appears.

The system management pages use consistent techniques to present and save configuration information.
A navigation bar is on the left side of the page, and configuration action buttons appear at the bottom.
You use the navigation bar to browse to other management pages, and you use the configuration action
buttons to save or cancel changes to the configuration.

Note

It is important to remember that clicking your web-browser’s Back button returns you to the previous
page without saving any changes you have made. Clicking Cancel cancels any changes you made on the
page and keeps you on that page. Changes are only applied when you click Apply.
Figure 2-1 shows the web-browser interface home page.
Figure 2-1

Web-Browser Interface Home Page


2-2

OL-21881-01

Chapter 2


Using Action Buttons
Table 2-1 lists the page links and buttons that appear on most management pages.
Table 2-1

Common Buttons on Management Pages

Button/Link

Description

Navigation Links

Home

Displays wireless device status page with information on the number of radio
devices associated to the wireless device, the status of the Ethernet and radio
interfaces, and a list of recent wireless device activity.

Express Setup

Displays the Express Setup page that includes basic settings such as system
name, IP address, and role in radio network.

Express Security

Displays the Express Security page that you use to create SSID and assign
security settings to them.

Network Map

Displays a list of infrastructure devices on your wireless LAN.

Association

Displays a list of all devices on your wireless LAN, listing their system names,
network roles, and parent-client relationships.

Network Interfaces

Displays status and statistics for the Ethernet and radio interfaces and provides
links to configuration pages for each interface.

Security

Displays a summary of security settings and provides links to security
configuration pages.

Services

Displays status for several wireless device features and links to configuration
pages for Telnet/SSH, CDP, domain name server, filters, QoS, SNMP, SNTP,
and VLANs.

Wireless Services

Displays a summary of wireless services used with CCKM and provides links
to WDS configuration pages.

System Software

Displays the version number of the firmware that the wireless device is
running and provides links to configuration pages for upgrading and managing
firmware.

Event Log

Displays the wireless device event log and provides links to configuration
pages where you can select events to be included in traps, set event severity
levels, and set notification methods.

Configuration Action Buttons

Apply

Saves changes made on the page and remains on the page.

Refresh

Updates status information or statistics displayed on a page.

Cancel

Discards changes to the page and remains on the page.

Back

Discards any changes made to the page and returns to the previous page.

OL-21881-01

2-3

Chapter 2


Enabling HTTPS for Secure Browsing

Character Restrictions in Entry Fields
Because the 1200 series access point uses Cisco IOS software, there are certain characters that you
cannot use in the entry fields on the web-browser interface. You cannot use these characters in entry
fields:
“
]
+
/
Tab
Trailing space

You can protect communication with the access point web-browser interface by enabling HTTPS.
HTTPS protects HTTP browser sessions by using the Secure Socket Layer (SSL) protocol.

Note

When you enable HTTPS, your browser might lose its connection to the access point. If you lose the
connection, change the URL in your browser’s address line from http://ip_address to https://ip_address
and log into the access point again.

Note

When you enable HTTPS, most browsers prompt you for approval each time you browse to a device that
does not have a fully qualified domain name (FQDN). To avoid the approval prompts, complete Step 2
through Step 9 in these instructions to create an FQDN for the access point. However, if you do not want
to create an FQDN, skip to Step 10.
Follow these steps to create an FQDN and enable HTTPS:

Step 1

If your browser uses popup-blocking software, disable the popup-blocking feature.

Step 2

Browse to the Express Setup page. Figure 2-2 shows the Express Setup page.


2-4

OL-21881-01

Chapter 2


Figure 2-2

Express Setup Page

Step 3

Enter a name for the access point in the System Name field and click Apply.

Step 4

Browse to the Services – DNS page. Figure 2-3 shows the Services – DNS page.

OL-21881-01

2-5

Chapter 2



Figure 2-3

Services – DNS Page

Step 5

Select Enable for Domain Name System.

Step 6

In the Domain Name field, enter your company’s domain name. At Cisco Systems, for example, the
domain name is cisco.com.

Step 7

Enter at least one IP address for your DNS server in the Name Server IP Addresses entry fields.

Step 8

Click Apply. The access point’s FQDN is a combination of the system name and the domain name. For
example, if your system name is ap1100 and your domain name is company.com, the FQDN is
ap1100.company.com.

Step 9

Enter the FQDN on your DNS server.

Tip

If you do not have a DNS server, you can register the access point’s FQDN with a dynamic DNS service.
Search the Internet for dynamic DNS to find a fee-based DNS service.


2-6

OL-21881-01

Chapter 2


Step 10

Browse to the Services: HTTP Web Server page. Figure 2-4 shows the HTTP Web Server page:
Figure 2-4

Services: HTTP Web Server Page

Step 11

Select the Enable Secure (HTTPS) Browsing check box and click Apply.

Step 12

Enter a domain name and click Apply.

Note

Although you can enable both standard HTTP and HTTPS, Cisco recommends that you enable
one or the other.

A warning window appears stating that you will use HTTPS to browse to the access point. The window
also instructs you to change the URL that you use to browse to the access point from http to https.
Figure 2-5 shows the warning window:
Figure 2-5

Step 13

HTTPS Warning Window

Click OK. The address in your browser’s address line changes from http://ip-address to
https://ip-address.

OL-21881-01

2-7

Chapter 2



Step 14

Another warning window appears stating that the access point’s security certificate is valid but is not
from a known source. However, you can accept the certificate with confidence because the site in
question is your own access point. Figure 2-6 shows the certificate warning window:
Figure 2-6

Step 15

Certificate Warning Window

Click View Certificate to accept the certificate before proceeding. (To proceed without accepting the
certificate, click Yes, and skip to Step 24 in these instructions.) Figure 2-7 shows the Certificate
window.


2-8

OL-21881-01

Chapter 2


Figure 2-7

Step 16

Certificate Window

On the Certificate window, click Install Certificate. The Microsoft Windows Certificate Import Wizard
appears. Figure 2-8 shows the Certificate Import Wizard window.

OL-21881-01

2-9

Chapter 2



Figure 2-8

Step 17

Click Next. The next window asks where you want to store the certificate. Cisco recommends that you
use the default storage area on your system. Figure 2-9 shows the window that asks about the certificate
storage area.
Figure 2-9

Step 18

Certificate Import Wizard Window

Certificate Storage Area Window

Click Next to accept the default storage area. A window appears that states that you successfully
imported the certificate. Figure 2-10 shows the completion window.


2-10

OL-21881-01

Chapter 2


Figure 2-10

Step 19

Click Finish. Windows displays a final security warning. Figure 2-11 shows the security warning.
Figure 2-11

Step 20

Certificate Completion Window

Certificate Security Warning

Click Yes. Windows displays another window stating that the installation is successful. Figure 2-12
shows the completion window.

OL-21881-01

2-11

Chapter 2



Figure 2-12

Import Successful Window

Step 21

Click OK.

Step 22

On the Certificate window shown in Figure 2-7, which is still displayed, click OK.

Step 23

On the Security Alert window shown in Figure 2-6, click Yes.

Step 24

The access point login window appears and you must log into the access point again. The default user
name is Cisco (case-sensitive) and the default password is Cisco (case-sensitive).

CLI Configuration Example
This example shows the CLI commands that are equivalent to the steps listed in the “Enabling HTTPS
for Secure Browsing” section on page 2-4:
AP# configure terminal
AP(config)# hostname ap1100
AP(config)# ip domain name company.com
AP(config)# ip name-server 10.91.107.18
AP(config)# ip http secure-server
AP(config)# end

In this example, the access point system name is ap1100, the domain name is company.com, and the IP
address of the DNS server is 10.91.107.18.
For complete descriptions of the commands used in this example, consult the Cisco IOS Commands
Master List, Release 12.3. Click this link to browse to the master list of commands:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123mindx/index.htm

Deleting an HTTPS Certificate
The access point generates a certificate automatically when you enable HTTPS. However, if you need
to change the access point’s fully qualified domain name (FQDN) or you need to add an FQDN after
enabling HTTPS, you might need to delete the certificate. Follow these steps:
Step 1

Browse to the Services: HTTP Web Server page.

Step 2

Uncheck the Enable Secure (HTTPS) Browsing check box to disable HTTPS.

Step 3

Click Delete Certificate to delete the certificate.

Step 4

Re-enable HTTPS. The access point generates a new certificate using the new FQDN.


2-12

OL-21881-01

Chapter 2

Using Online Help

Using Online Help
Click the help icon at the top of any page in the web-browser interface to display online help. Figure 2-13
shows the help and print icons.
Figure 2-13

Help and Print Icons

When a help page appears in a new browser window, use the Select a topic drop-down menu to display
the help index or instructions for common configuration tasks, such as configuring VLANs.

Changing the Location of Help Files
Cisco maintains up-to-date HTML help files for access points on the Cisco web site. By default, the
access point opens a help file on Cisco.com when you click the help button on the access point
web-browser interface. However, you can install the help files on your network so your access points
can access them there. Follow these steps to install the help files locally:
Step 1

Download the help files from the Software Center on Cisco.com. Click this link to browse to the
Software Center’s Wireless Software page:
http://tools.cisco.com/support/downloads/pub/MDFTree.x?butype=wireless
Select the help files that match the software version on your access point.

Step 2

Unzip the help files on your network in a directory accessible to your access point. When you unzip the
help files, the HTML help pages are stored in a folder named according to the help version number and
access point model number.

Step 3

Browse to the Services: HTTP Web Server page in the access point web-browser interface.

Step 4

In the Default Help Root URL entry field, enter the complete path to the location where you unzipped
the help files. When you click the access point help button, the access point automatically appends the
help version number and model number to the path that you enter.

Note

Do not add the help version number and device model number to the Default Help Root URL entry. The
access point automatically adds the help version and model number to the help root URL.
If you unzip the help files on your network file server at //myserver/myhelp, your Default Help Root URL
looks like this:
http://myserver/myhelp

OL-21881-01

2-13

Chapter 2



Table 2-2 shows an example help location and Help Root URL for an 1100 series access point.
Table 2-2

Example Help Root URL and Help Location

Files Unzipped at This Location Default Help Root URL
//myserver/myhelp
Step 5

Actual Location of Help Files
//myserver/myhelp/123-02.JA/1100

http://myserver/myhelp

Click Apply.

To prevent all use of the web-browser interface, select the Disable Web-Based Management check box
on the Services: HTTP-Web Server page and click Apply.
To re-enable the web-browser interface, enter this global configuration command on the access point
CLI:
ap(config)# ip http server


2-14

OL-21881-01

CH A P T E R

3

This chapter describes the Cisco IOS command-line interface (CLI) that you can use to configure the
wireless device. It contains these sections:
•

Cisco IOS Command Modes, page 3-2

•

Getting Help, page 3-3

•

Abbreviating Commands, page 3-3

•

Using no and default Forms of Commands, page 3-4

•

Understanding CLI Messages, page 3-4

•

Using Command History, page 3-4

•

Using Editing Features, page 3-6

•

Searching and Filtering Output of show and more Commands, page 3-8

•

Accessing the CLI, page 3-9

OL-21881-01

3-1

Chapter 3



The Cisco IOS user interface is divided into many different modes. The commands available to you
depend on which mode you are currently in. Enter a question mark (?) at the system prompt to obtain a
list of commands available for each command mode.
When you start a session on the wireless device, you begin in user mode, often called user EXEC mode.
A subset of the Cisco IOS commands are available in user EXEC mode. For example, most of the user
EXEC commands are one-time commands, such as show commands, which show the current
configuration status, and clear commands, which clear counters or interfaces. The user EXEC
commands are not saved when the wireless device reboots.
To have access to all commands, you must enter privileged EXEC mode. Normally, you must enter a
password to enter privileged EXEC mode. From this mode, you must enter privileged EXEC mode
before you can enter the global configuration mode.
Using the configuration modes (global, interface, and line), you can make changes to the running
configuration. If you save the configuration, these commands are stored and used when the wireless
device reboots. To access the various configuration modes, you must start at global configuration mode.
From global configuration mode, you can enter interface configuration mode and line configuration
mode.
Table 3-1 describes the main command modes, how to access each one, the prompt you see in that mode, and
how to exit the mode. The examples in the table use the host name ap.
Table 3-1

Command Mode Summary

Mode

Access Method

Prompt

User EXEC

Begin a session with ap>
the wireless device.

Exit Method

About This Mode

Enter logout or quit.

Use this mode to:
•

Change terminal settings

•

Perform basic tests

•

Display system
information

Privileged EXEC

While in user EXEC ap#
mode, enter the
enable command.

Enter disable to exit.

Use this mode to verify
commands. Use a password to
protect access to this mode.

Global configuration

While in privileged
EXEC mode, enter
the configure
command.

ap(config)#

To exit to privileged
Use this mode to configure
EXEC mode, enter exit or parameters that apply to the
end, or press Ctrl-Z.
entire wireless device.

Interface
configuration

While in global
configuration mode,
enter the interface
command (with a
specific interface).

ap(config-if)#

To exit to global
configuration mode, enter
exit. To return to
privileged EXEC mode,
press Ctrl-Z or enter end.

Use this mode to configure
parameters for the Ethernet
and radio interfaces.
The 2.4-GHz radio and the
802.11n 2.4-GHz radio is
radio 0,
The 5-GHz radio and the
802.11n 5-GHz radio radio 1.


3-2

OL-21881-01

Chapter 3

Getting Help

Getting Help
You can enter a question mark (?) at the system prompt to display a list of commands available for each
command mode. You can also obtain a list of associated keywords and arguments for any command, as
shown in Table 3-2.
Table 3-2

Help Summary

Command

Purpose

help

Obtains a brief description of the help system in any command mode.

abbreviated-command-entry?

Obtains a list of commands that begin with a particular character string.
For example:
ap# di?
dir disable

abbreviated-command-entry<Tab>

disconnect

Completes a partial command name.
For example:
ap# sh conf<tab>
ap# show configuration

?

Lists all commands available for a particular command mode.
For example:
ap> ?

command ?

Lists the associated keywords for a command.
For example:
ap> show ?

command keyword ?

Lists the associated arguments for a keyword.
For example:
ap(config)# cdp holdtime ?
<10-255> Length of time (in sec) that receiver must keep this packet

Abbreviating Commands
You have to enter only enough characters for the wireless device to recognize the command as unique.
This example shows how to enter the show configuration privileged EXEC command:
ap# show conf

OL-21881-01

3-3

Chapter 3



Most configuration commands also have a no form. In general, use the no form to disable a feature or
function or reverse the action of a command. For example, the no shutdown interface configuration
command reverses the shutdown of an interface. Use the command without the keyword no to re-enable
a disabled feature or to enable a feature that is disabled by default.
Configuration commands can also have a default form. The default form of a command returns the
command setting to its default. Most commands are disabled by default, so the default form is the same
as the no form. However, some commands are enabled by default and have variables set to certain
default values. In these cases, the default command enables the command and sets variables to their
default values.

Understanding CLI Messages
Table 3-3 lists some error messages that you might encounter while using the CLI to configure the
wireless device.
Table 3-3

Common CLI Error Messages

Error Message

Meaning

How to Get Help

% Ambiguous command:
"show con"

You did not enter enough characters
for the wireless device to recognize
the command.

Re-enter the command followed by a question mark (?)
with a space between the command and the question
mark.
The possible keywords that you can enter with the
command are displayed.

You did not enter all the keywords or Re-enter the command followed by a question mark (?)
values required by this command.
with a space between the command and the question
mark.

% Incomplete command.

% Invalid input detected
at ‘^’ marker.

You entered the command
incorrectly. The caret (^) marks the
point of the error.

Enter a question mark (?) to display all the commands
that are available in this command mode.

Using Command History
The CLI provides a history or record of commands that you have entered. This feature is particularly
useful for recalling long or complex commands or entries, including access lists. You can customize the
command history feature to suit your needs as described in these sections:
•

Changing the Command History Buffer Size, page 3-5

•

Recalling Commands, page 3-5

•

Disabling the Command History Feature, page 3-5


3-4

OL-21881-01

Chapter 3

Using Command History

Changing the Command History Buffer Size
By default, the wireless device records ten command lines in its history buffer. Beginning in privileged
EXEC mode, enter this command to change the number of command lines that the wireless device
records during the current terminal session:
ap# terminal history [size number-of-lines]

The range is from 0 to 256.
Beginning in line configuration mode, enter this command to configure the number of command lines
the wireless device records for all sessions on a particular line:
ap(config-line)# history

[size number-of-lines]

The range is from 0 to 256.

Recalling Commands
To recall commands from the history buffer, perform one of the actions listed in Table 3-4:
Table 3-4

Recalling Commands

Action1

Result

Press Ctrl-P or the up arrow key.

Recall commands in the history buffer, beginning with the most recent command.
Repeat the key sequence to recall successively older commands.

Press Ctrl-N or the down arrow key.

Return to more recent commands in the history buffer after recalling commands
with Ctrl-P or the up arrow key. Repeat the key sequence to recall successively
more recent commands.

show history

While in privileged EXEC mode, list the last several commands that you just
entered. The number of commands that are displayed is determined by the setting
of the terminal history global configuration command and history line
configuration command.

1. The arrow keys function only on ANSI-compatible terminals such as VT100s.

Disabling the Command History Feature
The command history feature is automatically enabled.
To disable the feature during the current terminal session, enter the terminal no history privileged
EXEC command.
To disable command history for the line, enter the no history line configuration command.

OL-21881-01

3-5

Chapter 3


Using Editing Features

This section describes the editing features that can help you manipulate the command line. It contains
these sections:
•

Enabling and Disabling Editing Features, page 3-6

•

Editing Commands Through Keystrokes, page 3-6

•

Editing Command Lines that Wrap, page 3-7

Enabling and Disabling Editing Features
Although enhanced editing mode is automatically enabled, you can disable it.
To re-enable the enhanced editing mode for the current terminal session, enter this command in
privileged EXEC mode:
ap# terminal editing

To reconfigure a specific line to have enhanced editing mode, enter this command in line configuration
mode:
ap(config-line)# editing

To globally disable enhanced editing mode, enter this command in line configuration mode:
ap(config-line)# no editing

Editing Commands Through Keystrokes
Table 3-5 shows the keystrokes that you need to edit command lines.
Table 3-5

Editing Commands Through Keystrokes

Capability

Keystroke1

Purpose

Move around the command line to
make changes or corrections.

Ctrl-B or the left arrow
key

Move the cursor back one character.

Ctrl-F or the right arrow
key

Move the cursor forward one character.

Ctrl-A

Move the cursor to the beginning of the command line.

Ctrl-E

Move the cursor to the end of the command line.

Esc B

Move the cursor back one word.

Esc F

Move the cursor forward one word.

Ctrl-T

Transpose the character to the left of the cursor with the
character located at the cursor.

Recall commands from the buffer
Ctrl-Y
and paste them in the command line. Esc Y
The wireless device provides a buffer
with the last ten items that you
deleted.

Recall the most recent entry in the buffer.
Recall the next buffer entry.
The buffer contains only the last 10 items that you have
deleted or cut. If you press Esc Y more than ten times, you
cycle to the first buffer entry.


3-6

OL-21881-01

Chapter 3


Table 3-5

Editing Commands Through Keystrokes (continued)

Keystroke1

Capability

Purpose

Delete entries if you make a mistake Delete or Backspace
or change your mind.
Ctrl-D

Erase the character to the left of the cursor.
Delete the character at the cursor.

Ctrl-K
Ctrl-U or Ctrl-X

Delete all characters from the cursor to the beginning of
the command line.

Ctrl-W

Delete the word to the left of the cursor.

Esc D

Delete from the cursor to the end of the word.

Esc C

Capitalize at the cursor.

Esc L

Change the word at the cursor to lowercase.

Esc U

Capitalize or lowercase words or
capitalize a set of letters.

Delete all characters from the cursor to the end of the
command line.

Capitalize letters from the cursor to the end of the word.

Designate a particular keystroke as
Ctrl-V or Esc Q
an executable command, perhaps as a
shortcut.
Scroll down a line or screen on
displays that are longer than the
terminal screen can display.
Note

Return

Scroll down one line.

Space

Scroll down one screen.

The More prompt appears for
output that has more lines
than can be displayed on the
terminal screen, including
show command output. You
can use the Return and
Space bar keystrokes
whenever you see the More
prompt.

Redisplay the current command line Ctrl-L or Ctrl-R
if the wireless device suddenly sends
a message to your screen.

Redisplay the current command line.

1. The arrow keys function only on ANSI-compatible terminals such as VT100s.

Editing Command Lines that Wrap
You can use a wraparound feature for commands that extend beyond a single line on the screen. When
the cursor reaches the right margin, the command line shifts ten spaces to the left. You cannot see the
first ten characters of the line, but you can scroll back and check the syntax at the beginning of the
command.
To scroll back to the beginning of the command entry, press Ctrl-B or the left arrow key repeatedly. You
can also press Ctrl-A to immediately move to the beginning of the line.

Note

The arrow keys function only on ANSI-compatible terminals such as VT100s.

OL-21881-01

3-7

Chapter 3



In this example, the access-list global configuration command entry extends beyond one line. When the
cursor first reaches the end of the line, the line is shifted ten spaces to the left and redisplayed. The dollar
sign ($) shows that the line has been scrolled to the left. Each time the cursor reaches the end of the line,
the line is again shifted ten spaces to the left.
ap(config)#
ap(config)#
ap(config)#
ap(config)#

access-list 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1
$ 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1.20 255.25
$t tcp 131.108.2.5 255.255.255.0 131.108.1.20 255.255.255.0 eq
$108.2.5 255.255.255.0 131.108.1.20 255.255.255.0 eq 45

After you complete the entry, press Ctrl-A to check the complete syntax before pressing the Return key
to execute the command. The dollar sign ($) appears at the end of the line to show that the line has been
scrolled to the right:
ap(config)# access-list 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1$

The software assumes you have a terminal screen that is 80 columns wide. If you have a width other than
that, use the terminal width privileged EXEC command to set the width of your terminal.
Use line wrapping with the command history feature to recall and modify previous complex command
entries. For information about recalling previous command entries, see the “Editing Commands Through
Keystrokes” section on page 3-6.

You can search and filter the output for show and more commands. This is useful when you need to sort
through large amounts of output or if you want to exclude output that you do not need to see.
To use this functionality, enter a show or more command followed by the pipe character (|), one of the
keywords begin, include, or exclude, and an expression that you want to search for or filter out:
command | {begin | include | exclude} regular-expression
Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output
are not displayed, but the lines that contain Output are displayed.
This example shows how to include in the output display only lines where the expression protocol
appears:
ap# show interfaces | include protocol
Vlan1 is up, line protocol is up
Vlan10 is up, line protocol is down
GigabitEthernet0/1 is up, line protocol is down
GigabitEthernet0/2 is up, line protocol is up


3-8

OL-21881-01

Chapter 3

Accessing the CLI

Accessing the CLI
You can open the wireless device’s CLI using Telnet or Secure Shell (SSH).

Opening the CLI with Telnet
Follow these steps to open the CLI with Telnet. These steps are for a PC running Microsoft Windows
with a Telnet terminal application. Check your PC operating instructions for detailed instructions for
your operating system.
Step 1

Select Start > Programs > Accessories > Telnet.
If Telnet is not listed in your Accessories menu, select Start > Run, type Telnet in the entry field, and
press Enter.

Step 2

When the Telnet window appears, click Connect and select Remote System.

Note

In Windows 2000, the Telnet window does not contain drop-down menus. To start the Telnet
session in Windows 2000, type open followed by the wireless device’s IP address.

Step 3

In the Host Name field, type the wireless device’s IP address and click Connect.

Step 4

At the username and password prompts, enter your administrator username and password. The default
username is Cisco, and the default password is Cisco. The default enable password is also Cisco.
Usernames and passwords are case-sensitive.

Opening the CLI with Secure Shell
Secure Shell Protocol is a protocol that provides a secure, remote connection to networking devices set
up to use it. Secure Shell (SSH) is a software package that provides secure login sessions by encrypting
the entire session. SSH features strong cryptographic authentication, strong encryption, and integrity
protection. For detailed information on SSH, visit the homepage of SSH Communications Security, Ltd.
at this URL: http://www.ssh.com/
SSH provides more security for remote connections than Telnet by providing strong encryption when a
device is authenticated. SSH versions 1 and 2 are supported in this release. See the “Configuring the
Access Point for Secure Shell” section on page 5-25 for detailed instructions on setting up the wireless
device for SSH access.

OL-21881-01

3-9

Chapter 3


Accessing the CLI


3-10

OL-21881-01

CH A P T E R

4

This chapter describes how to configure basic settings on the wireless device for the first time. The
contents of this chapter are similar to the instructions in the quick start guide that shipped with the
wireless device. You can configure all the settings described in this chapter using the CLI, but it might
be simplest to browse to the wireless device’s web-browser interface to complete the initial
configuration and then use the CLI to enter additional settings for a more detailed configuration.
This chapter contains these sections:
•
•

Obtaining and Assigning an IP Address, page 4-4

•

Connecting to the 1100 Series Access Point Locally, page 4-5

•

Connecting to the 1130 Series Access Point Locally, page 4-6

•

Connecting to the 1140,1200, 1230, 1240, and 1250 Series Access Points Locally, page 4-6

•

Connecting to the 1300 Series Access Point/Bridge Locally, page 4-7

•

Default Radio Settings, page 4-7

•

Assigning Basic Settings, page 4-8

•

Configuring Basic Security Settings, page 4-15

•

Configuring System Power Settings for 1130 and 1240 Series Access Points, page 4-25

•

Assigning an IP Address Using the CLI, page 4-26

•

Assigning an IP Address Using the CLI, page 4-26

•

Using a Telnet Session to Access the CLI, page 4-26

•

Note

Before You Start, page 4-2

Configuring the 802.1X Supplicant, page 4-27

In this release, the access point radio interfaces are disabled by default.

OL-21881-01

4-1

Chapter 4


Before You Start

Before You Start
Before you install the wireless device, make sure you are using a computer connected to the same
network as the wireless device, and obtain the following information from your network administrator:
•

A system name for the wireless device

•

The case-sensitive wireless service set identifier (SSID) for your radio network

•

If not connected to a DHCP server, a unique IP address for the wireless device (such as
172.17.255.115)

•

If the wireless device is not on the same subnet as your PC, a default gateway address and subnet
mask

•

A Simple Network Management Protocol (SNMP) community name and the SNMP file attribute (if
SNMP is in use)

•

If you use IPSU to find the wireless device IP address, the access point MAC address. The MAC
address can be found on the label on the bottom of the access point (such as 00164625854c).

Resetting the Device to Default Settings
If you need to start over during the initial setup process, you can reset the access point to factory default
settings.

Resetting to Default Settings Using the MODE Button
Follow these steps to reset the access point to factory default settings using the access point MODE
button:
Step 1

Disconnect power (the power jack for external power or the Ethernet cable for in-line power) from the
access point.

Step 2

Press and hold the MODE button while you reconnect power to the access point.

Step 3

Hold the MODE button until the Status LED turns amber (approximately 1 to 2 seconds), and release
the button. All access point settings return to factory defaults.

Resetting to Default Settings Using the GUI
Follow these steps to return to default settings using the access point GUI:
Step 1

Open your Internet browser. The web-browser interface is fully compatible with Microsoft Internet
Explorer version 6.0 on Windows 98, 2000 and XP platforms, and with Netscape version 7.0 on
Windows 98, 2000, XP, and Solaris platforms.

Step 2

Enter the wireless device’s IP address in the browser address line and press Enter. An Enter Network
Password window appears.

Step 3

Enter your username in the User Name field. The default username is Cisco.

Step 4

Enter the wireless device password in the Password field and press Enter. The default password is
Cisco. The Summary Status page appears.


4-2

OL-21881-01

Chapter 4

Before You Start

Step 5

Click System Software and the System Software screen appears.

Step 6

Click System Configuration and the System Configuration screen appears.

Step 7

Click the Reset to Defaults button to reset all settings, including the IP address, to factory defaults. To
reset all settings except the IP address to defaults, click the Reset to Defaults (Except IP) button.

Resetting to Default Settings Using the CLI
Caution

You should never delete any of the system files prior to resetting defaults or reloading software.
If you want to reset the access point to its default settings and a static IP address, use the write erase or
erase /all nvram command. If you want to erase everything including the static IP address, in addition
to the above commands, use the erase and erase boot static-ipaddr static-ipmask command.
From the privileged EXEC mode, you can reset the access point/bridge configuration to factory default
values using the CLI by following these steps:

Step 1

Enter erase nvram: to erase all NVRAM files including the startup configuration.

Note
Step 2

The erase nvram command does not erase a static IP address.

Follow the step below to erase a static IP address and subnet mask. Otherwise, go to step 3.
a.

Enter write default-config.

Step 3

Enter Y when the following CLI message displays: Erasing the nvram filesystem will remove all
configuration files! Continue? [confirm].

Step 4

Enter reload when the following CLI message displays: Erase of nvram: complete. This command
reloads the operating system.

Step 5

Enter Y when the following CLI message displays: Proceed with reload? [confirm].

Caution

Do not interrupt the boot process to avoid damaging the configuration file. Wait until the access
point/bridge Install Mode LED begins to blink green before continuing with CLI configuration changes.
You can also see the following CLI message when the load process has finished: Line protocal on
Interface Dot11Radio0, changed state to up.

Step 6

After the access point/bridge reboots, you can reconfigure the access point by using the Web-browser
interface if you previously assigned a static IP address, or the CLI if you did not.
The access point is configured with the factory default values including the IP address (set to receive an
IP address using DHCP). To obtain the access point/bridge’s new IP address, you can use the show
interface bvi1 CLI command.

OL-21881-01

4-3

Chapter 4



To browse to the wireless device’s Express Setup page, you must either obtain or assign the wireless
device’s IP address using one of the following methods:
•

If you have an 1130AG, 1200, 1240 series access point or 1300 series access point/bridge, connect
to the access point console port and assign a static IP address. Follow the steps in the appropriate
section to connect to the device’s console port:
– Connecting to the 1100 Series Access Point Locally, page 4-5
– Connecting to the 1130 Series Access Point Locally, page 4-6
– Connecting to the 1140,1200, 1230, 1240, and 1250 Series Access Points Locally, page 4-6.
– Connecting to the 1300 Series Access Point/Bridge Locally, page 4-7

Note

•

In some terminal emulator applications you may need to set the Flow control parameter to
Xon/Xoff. If you are not able to console into the device with the flow control value set to none,
try changing the flow control value to Xon/Xoff.
Use a DHCP server (if available) to automatically assign an IP address. You can find out the
DHCP-assigned IP address using one of the following methods:
– If you have a 1200 series access point, connect to the wireless device console port and use the

show ip interface brief command to display the IP address. Follow the steps in the “Connecting
to the 1100 Series Access Point Locally” section on page 4-5 or in the “Connecting to the
1140,1200, 1230, 1240, and 1250 Series Access Points Locally” section on page 4-6 to connect
to the console port.
– Provide your network administrator with the wireless device’s Media Access Control (MAC)

address. Your network administrator will query the DHCP server using the MAC address to
identify the IP address. The access point’s MAC address is on label attached to the bottom of
the access point.

Default IP Address Behavior
When you connect a 1130AG, 1140, 1200, 1240, 1250 access point, or 1300 series access point/bridge
with a default configuration to your LAN, the access point requests an IP address from your DHCP
server and, if it does not receive an address, continues to send requests indefinitely.
When you connect an 1100 series access point with a default configuration to your LAN, the 1100 series
access point makes several attempts to get an IP address from the DHCP server. If it does not receive an
address, it assigns itself the IP address 10.0.0.1 for five minutes. During this five-minute window, you
can browse to the default IP address and configure a static address. If after five minutes the access point
is not reconfigured, it discards the 10.0.0.1 address and reverts to requesting an address from the DHCP
server. If it does not receive an address, it sends requests indefinitely. If you miss the five-minute
window for browsing to the access point at 10.0.0.1, you can power-cycle the access point to repeat the
process.
The 1300 series access point/bridge assumes a radio network role of a root access point. To configure it
as a bridge, you must manually place it in install mode in order to align the antennas and establish a link.
To establish the link you must have two access point/bridges configured in the install mode. In the install
mode, one access point/bridge must be configured as a root bridge and the other a non-root bridge. To


4-4

OL-21881-01

Cisco ios software configuration guide for cisco aironet access points cisco ios releases 12.4(21a)ja1 and 12.3(8)jec

Cisco ios software configuration guide for cisco aironet access points cisco ios releases 12.4(21a)ja1 and 12.3(8)jec

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Cisco ios software configuration guide for cisco aironet access points cisco ios releases 12.4(21a)ja1 and 12.3(8)jec

Similar to Cisco ios software configuration guide for cisco aironet access points cisco ios releases 12.4(21a)ja1 and 12.3(8)jec (20)

Recently uploaded

Recently uploaded (20)

Cisco ios software configuration guide for cisco aironet access points cisco ios releases 12.4(21a)ja1 and 12.3(8)jec