FCC ID: LDK102053 802.11a Cardbus radio module

 

Cisco Aironet 1200 Series Access Point Installation and Configuration Guide Cisco IOS Release 12.2(8)JA February 2003 Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 526-4100 Text Part Number: OL-3446-01 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCBs public domain version of the UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED AS IS WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, the Cisco Systems Verified logo, Cisco Unity, Follow Me Browsing, FormShare, iQ Breakthrough, iQ FastTrack, the iQ Logo, iQ Net Readiness Scorecard, Networking Academy, ScriptShare, SMARTnet, TransPath, and Voice LAN are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, The Fastest Way to Increase Your Internet Quotient, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, LightStream, MGX, MICA, the Networkers logo, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, SlideCast, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0301R) Cisco Aironet 1200 Series Access Point Installation and Configuration Guide Copyright 2003, Cisco Systems, Inc. All rights reserved. Preface xvii xvii xvii Audience Purpose Organization Conventions Related Publications xxi Obtaining Documentation xvii xix C O N T E N T S xxi xxi World Wide Web Documentation CD-ROM xxi Ordering Documentation xxii Documentation Feedback xxii Obtaining Technical Assistance xxii Cisco.com xxii Technical Assistance Center xxiii Cisco TAC Web Site xxiii Cisco TAC Escalation Center xxiv C H A P T E R 1 Overview 1-1 Features 1-2 Hardware Features 1-2 Dual-Radio Operation Ethernet Port 1-2 Console Port 1-2 Status Indicators Power Sources 1-3 UL 2043 Certification Anti-Theft Features 1-4 1-3 1-2 1-4 1-4 Software Features Management Options Roaming Client Devices Network Configuration Examples 1-5 1-5 1-6 Root Unit on a Wired LAN 1-6 Repeater Unit that Extends Wireless Range Central Unit in an All-Wireless Network 1-8 1-7 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide iii Contents C H A P T E R 2 Installing the Access Point 2-2 Safety Information 2-1 FCC Safety Compliance Statement General Safety Guidelines 2-2 2-2 2-2 Warnings Unpacking the Access Point 2-3 Basic Installation Guidelines Package Contents 2-3 2-3 Installation Above Suspended Ceilings 2-3 2-4 Before Beginning the Installation Installation Summary Connecting the 2.4-GHz Antennas Connecting the Ethernet and Power Cables 2-5 2-5 2-5 Connecting to an Ethernet Network with an Inline Power Source Connecting to an Ethernet Network with Local Power Powering Up the Access Point 2-7 2-8 2-7 C H A P T E R 3 Configuring the Access Point for the First Time 3-1 Before You Start 3-2 Resetting the Access Point to Default Settings 3-2 Obtaining and Assigning an IP Address Connecting to the Access Point Locally Assigning Basic Settings 3-4 3-3 3-3 Default Settings on the Express Setup Page 3-7 Protecting Your Wireless LAN 3-8 Using the IP Setup Utility 3-8 Obtaining and Installing IPSU Using IPSU to Find the Access Points IP Address Using IPSU to Set the Access Points IP Address and SSID 3-10 3-9 3-9 Assigning an IP Address Using the CLI Using a Telnet Session to Access the CLI 3-11 3-12 C H A P T E R 4 Using the Web-Browser Interface 4-1 Using the Web-Browser Interface for the First Time Using the Management Pages in the Web-Browser Interface 4-2 4-2 Using Action Buttons 4-4 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide iv OL-3446-01 Character Restrictions in Entry Fields 4-5 Using Online Help 4-5 C H A P T E R 5 Using the Command-Line Interface 5-1 5-3 5-2 IOS Command Modes Getting Help Abbreviating Commands Using no and default Forms of Commands Understanding CLI Messages Using Command History 5-4 5-3 5-4 5-3 Changing the Command History Buffer Size Recalling Commands Disabling the Command History Feature 5-5 5-5 5-4 Using Editing Features 5-5 Enabling and Disabling Editing Features Editing Commands Through Keystrokes Editing Command Lines that Wrap 5-7 5-6 5-6 Searching and Filtering Output of show and more Commands Accessing the CLI 5-8 5-8 Opening the CLI with Telnet 5-8 Opening the CLI with Secure Shell 5-9 C H A P T E R 6 Administering the Access Point 6-1 6-2 Preventing Unauthorized Access to Your Access Point Protecting Access to Privileged EXEC Commands 6-2 Default Password and Privilege Level Configuration Setting or Changing a Static Enable Password 6-3 Protecting Enable and Enable Secret Passwords with Encryption Configuring Username and Password Pairs Configuring Multiple Privilege Levels 6-6 6-2 6-5 6-4 Setting the Privilege Level for a Command Logging Into and Exiting a Privilege Level 6-6 6-7 Controlling Access Point Access with RADIUS 6-7 6-8 Default RADIUS Configuration Configuring RADIUS Login Authentication Defining AAA Server Groups Configuring RADIUS Authorization for User Privileged Access and Network Services Displaying the RADIUS Configuration 6-12 6-9 6-8 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide Contents 6-11 v Contents Controlling Access Point Access with TACACS+

6-12 6-13 Default TACACS+ Configuration Configuring TACACS+ Login Authentication Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services Displaying the TACACS+ Configuration 6-13 6-15 6-14 Configuring the Access Point for Local Authentication and Authorization Configuring the Access Point for Secure Shell 6-16 6-15 Understanding SSH Configuring SSH 6-16 6-17 Managing the System Time and Date Understanding the System Clock Understanding Network Time Protocol Configuring NTP 6-19 6-17 6-17 6-18 6-23 6-20 Default NTP Configuration 6-20 Configuring NTP Authentication Configuring NTP Associations 6-22 Configuring NTP Broadcast Service Configuring NTP Access Restrictions Configuring the Source IP Address for NTP Packets Displaying the NTP Configuration Configuring Time and Date Manually 6-28 Setting the System Clock Displaying the Time and Date Configuration Configuring the Time Zone Configuring Summer Time (Daylight Saving Time) 6-27 6-27 6-28 6-24 6-29 6-26 6-30 Configuring a System Name and Prompt 6-32 Default System Name and Prompt Configuration Configuring a System Name Understanding DNS 6-33 6-32 6-32 Default DNS Configuration Setting Up DNS Displaying the DNS Configuration 6-33 6-33 6-34 Creating a Banner 6-34 Default Banner Configuration Configuring a Message-of-the-Day Login Banner Configuring a Login Banner 6-35 6-36 6-35 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide vi OL-3446-01 Contents 7-2 C H A P T E R 7 Configuring Radio Settings 7-1 Disabling and Enabling the Radio Interface Configuring the Role in Radio Network Configuring Radio Data Rates 7-4 Configuring Radio Transmit Power 7-5 7-2 Limiting the Power Level for Associated Client Devices 7-6 7-9 7-7 Configuring Radio Channel Settings Enabling and Disabling World-Mode Disabling and Enabling Short Radio Preambles Configuring Transmit and Receive Antennas Disabling and Enabling Aironet Extensions Configuring the Ethernet Encapsulation Transformation Method Enabling and Disabling Reliable Multicast to Workgroup Bridges Enabling and Disabling Public Secure Packet Forwarding 7-10 7-11 7-13 7-9 7-12 7-12 Configuring Protected Ports 7-14 Configuring the Beacon Period and the DTIM 7-15 Configure RTS Threshold and Retries Configuring the Maximum Data Retries Configuring the Fragmentation Threshold 7-15 7-16 7-16 C H A P T E R 8 Configuring Multiple SSIDs 8-1 Understanding Multiple SSIDs Configuring Multiple SSIDs 8-2 8-2 Default SSID Configuration Creating an SSID Using a RADIUS Server to Restrict SSIDs 8-3 8-3 8-4 C H A P T E R 9 Configuring WEP and WEP Features 9-1 Understanding WEP Configuring WEP and WEP Features 9-2 9-2 9-3 Creating WEP Keys Enabling and Disabling WEP and Enabling TKIP and MIC Enabling and Disabling Broadcast Key Rotation 9-4 9-3 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide vii Contents C H A P T E R 10 Configuring Authentication Types 10-1 Understanding Authentication Types 10-2 Open Authentication to the Access Point 10-2 Shared Key Authentication to the Access Point EAP Authentication to the Network MAC Address Authentication to the Network Combining MAC-Based, EAP, and Open Authentication 10-5 10-2 10-3 10-5 Configuring Authentication Types 10-6 Default Authentication Settings Assigning Authentication Types to an SSID Configuring Authentication Holdoffs, Timeouts, and Intervals 10-6 10-6 10-8 Matching Access Point and Client Device Authentication Types 10-9 C H A P T E R 11 Configuring RADIUS and TACACS+ Servers 11-1 Configuring and Enabling RADIUS 11-2 Understanding RADIUS RADIUS Operation Configuring RADIUS 11-3 11-4 11-2 11-7 Default RADIUS Configuration 11-4 Identifying the RADIUS Server Host 11-4 Configuring RADIUS Login Authentication Defining AAA Server Groups Configuring RADIUS Authorization for User Privileged Access and Network Services Starting RADIUS Accounting Configuring Settings for All RADIUS Servers Configuring the Access Point to Use Vendor-Specific RADIUS Attributes Configuring the Access Point for Vendor-Proprietary RADIUS Server Communication 11-12 11-13 11-13 11-9 Displaying the RADIUS Configuration 11-15 Configuring and Enabling TACACS+

11-16 Understanding TACACS+

TACACS+ Operation Configuring TACACS+

11-17 11-17 11-16 11-18 Default TACACS+ Configuration Identifying the TACACS+ Server Host and Setting the Authentication Key Configuring TACACS+ Login Authentication Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services Starting TACACS+ Accounting 11-18 11-19 11-21 11-11 11-14 11-20 Displaying the TACACS+ Configuration 11-22 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide viii OL-3446-01 Contents C H A P T E R 12 Configuring VLANs 12-1 Understanding VLANs 12-2 Related Documents Incorporating Wireless Devices into VLANs 12-3 12-4 Configuring VLANs 12-4 Configuring a VLAN 12-4 Using a RADIUS Server to Assign Users to VLANs Viewing VLANs Configured on the Access Point 12-6 12-6 VLAN Configuration Example 12-7 C H A P T E R 13 Configuring QoS 13-1 Understanding QoS for Wireless LANs 13-2 QoS for Wireless LANs Versus QoS on Wired LANs Impact of QoS on a Wireless LAN 13-2 Precedence of QoS Settings 13-3 13-2 Configuring QoS 13-3 13-4 Configuration Guidelines Configuring QoS Using the Web-Browser Interface Adjusting Radio Traffic Class Definitions Disabling IGMP Snooping Helper 13-10 13-8 13-4 QoS Configuration Examples 13-10 Giving Priority to Voice Traffic Giving Priority to Video Traffic 13-10 13-12 C H A P T E R 14 Configuring Proxy Mobile IP 14-1 Understanding Proxy Mobile IP 14-2 14-2 Overview 14-2 Components of a Proxy Mobile IP Network How Proxy Mobile IP Works Agent Discovery 14-3 Subnet Map Exchange Registration Tunneling 14-5 14-5 14-3 14-4 14-6 Proxy Mobile IP Security Configuring Proxy Mobile IP Configuration Guidelines Configuring Proxy Mobile IP on Your Wired LAN 14-7 Configuring Proxy Mobile IP on Your Access Point 14-6 14-6 14-7 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide ix Contents C H A P T E R 15 Configuring Filters 15-1 15-2 Understanding Filters Configuring Filters Using the CLI Configuring Filters Using the Web-Browser Interface Configuring and Enabling MAC Address Filters 15-2 15-2 15-3 Creating a MAC Address Filter Configuring and Enabling IP Filters 15-3 15-5 Creating an IP Filter 15-6 Configuring and Enabling Ethertype Filters 15-8 Creating an Ethertype Filter 15-9 C H A P T E R 16 C H A P T E R 17 Configuring CDP 16-1 Understanding CDP Configuring CDP 16-2 16-2 16-2 Default CDP Configuration Configuring the CDP Characteristics Disabling and Enabling CDP 16-3 Disabling and Enabling CDP on an Interface 16-2 16-4 Monitoring and Maintaining CDP 16-4 Configuring SNMP 17-2 17-1 Understanding SNMP SNMP Versions SNMP Manager Functions SNMP Agent Functions SNMP Community Strings Using SNMP to Access MIB Variables 17-2 17-3 17-3 17-3 17-4 Configuring SNMP 17-4 17-5 17-5 Default SNMP Configuration Disabling the SNMP Agent Configuring Community Strings Configuring Trap Managers and Enabling Traps Setting the Agent Contact and Location Information Using the snmp-server view Command SNMP Examples 17-9 17-5 17-9 17-7 17-9 Displaying SNMP Status 17-10 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide x OL-3446-01 C H A P T E R 18 Configuring Repeater and Standby Access Points 18-1 Understanding Repeater Access Points Configuring a Repeater Access Point 18-2 18-3 Contents 18-4 Default Configuration Guidelines for Repeaters Setting Up a Repeater 18-4 Verifying Repeater Operation Setting Up a Repeater As a LEAP Client 18-5 18-4 18-6 Understanding Hot Standby Configuring a Hot Standby Access Point 18-7 18-7 C H A P T E R 19 Managing Firmware and Configurations 19-1 Working with the Flash File System 19-2 19-2 Displaying Available File Systems Setting the Default File System 19-3 Displaying Information About Files on a File System 19-3 Changing Directories and Displaying the Working Directory Creating and Removing Directories Copying Files Deleting Files Creating, Displaying, and Extracting tar Files 19-5 19-5 19-4 19-6 19-4 19-6 Creating a tar File Displaying the Contents of a tar File Extracting a tar File 19-7 19-6 Displaying the Contents of a File 19-8 Working with Configuration Files 19-8 Guidelines for Creating and Using Configuration Files Configuration File Types and Location Creating a Configuration File by Using a Text Editor Copying Configuration Files by Using TFTP 19-10 19-9 19-9 19-10 Preparing to Download or Upload a Configuration File by Using TFTP Downloading the Configuration File by Using TFTP Uploading the Configuration File by Using TFTP 19-11 19-11 Copying Configuration Files by Using FTP 19-12 Preparing to Download or Upload a Configuration File by Using FTP Downloading a Configuration File by Using FTP Uploading a Configuration File by Using FTP 19-15 Copying Configuration Files by Using RCP 19-13 19-14 19-10 19-13 Preparing to Download or Upload a Configuration File by Using RCP 19-16 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xi Contents Downloading a Configuration File by Using RCP Uploading a Configuration File by Using RCP 19-16 19-17 Clearing Configuration Information 19-18 Deleting a Stored Configuration File 19-18 Working with Software Images 19-18 Image Location on the Access Point tar File Format of Images on a Server or Cisco.com 19-19 Copying Image Files by Using TFTP 19-20 19-19 Preparing to Download or Upload an Image File by Using TFTP Downloading an Image File by Using TFTP Uploading an Image File by Using TFTP 19-22 19-21 Copying Image Files by Using FTP 19-23 Preparing to Download or Upload an Image File by Using FTP Downloading an Image File by Using FTP Uploading an Image File by Using FTP 19-27 Copying Image Files by Using RCP 19-24 19-26 Preparing to Download or Upload an Image File by Using RCP Downloading an Image File by Using RCP Uploading an Image File by Using RCP 19-31 19-29 Reloading the Image Using the Web Browser Interface 19-32 Browser HTTP Interface Browser TFTP Interface 19-32 19-33 C H A P T E R 20 Configuring System Message Logging 20-1 Understanding System Message Logging Configuring System Message Logging 20-2 20-2 20-3 20-2 System Log Message Format Default System Message Logging Configuration Disabling and Enabling Message Logging 20-4 Setting the Message Display Destination Device 20-5 Enabling and Disabling Timestamps on Log Messages 20-6 Enabling and Disabling Sequence Numbers in Log Messages Defining the Message Severity Level Limiting Syslog Messages Sent to the History Table and to SNMP Setting a Logging Rate Limit Configuring UNIX Syslog Servers 20-10 20-7 20-9 20-6 19-20 19-23 19-27 20-8 Logging Messages to a UNIX Syslog Daemon Configuring the UNIX System Logging Facility 20-10 20-10 Displaying the Logging Configuration 20-12 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xii OL-3446-01 Contents C H A P T E R 21 Troubleshooting 21-1 Checking the Top Panel Indicators Checking Basic Settings 21-4 21-2 SSID 21-4 WEP Keys 21-4 Security Settings 21-5 Resetting to the Default Configuration 21-5 Using the MODE Button Using the Web Browser Interface 21-5 21-6 Reloading the Access Point Image 21-6 21-7 Using the MODE button Web Browser Interface 21-6 Browser HTTP Interface Browser TFTP Interface 21-7 21-8 Obtaining the Access Point Image File Obtaining the TFTP Server Software 21-8 21-9 Activating and Configuring the TFTP Server 21-9 C H A P T E R 22 2.4-GHz Radio Upgrade 22-1 Upgrade Overview 22-2 Unpacking the Radio 22-2 Opening the Access Cover Removing a Blank Spacer Card Removing a 2.4-GHz Radio Installing a 2.4-GHz Radio 22-3 22-5 22-7 22-4 C H A P T E R 23 5-GHz Radio Module Upgrade 23-1 Upgrade Overview 23-2 Unpacking the Radio Module Removing the 5-GHz Radio Access Cover Removing a 5-GHz Radio Module Installing a 5-GHz Radio Module 23-3 23-2 23-5 23-2 A P P E N D I X A Translated Safety Warnings A-1 Dipole Antenna Installation Warning Explosive Device Proximity Warning Lightning Activity Warning A-4 A-2 A-3 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xiii Contents Installation Warning Circuit Breaker (15A) Warning A-5 A-5 A P P E N D I X B Declarations of Conformity and Regulatory Information B-1 Manufacturers Federal Communication Commission Declaration of Conformity Statement Department of CommunicationsCanada B-3 Canadian Compliance Statement B-3 B-2 European Community, Switzerland, Norway, Iceland, and Liechtenstein B-4 Declaration of Conformity with Regard to the R&TTE Directive 1999/5/EC B-4 Declaration of Conformity for RF Exposure Guidelines for Operating Cisco Aironet Access Points in Japan B-6 B-6 Japanese Translation English Translation B-6 B-7 A P P E N D I X C Channels and Antenna Settings C-1 Channels C-2 IEEE 802.11a IEEE 802.11b C-2 C-3 Maximum Power Levels C-4 C-4 IEEE 802.11a IEEE 802.11b C-4 A P P E N D I X D Mounting Instructions D-1 Overview D-2 Mounting on a Horizontal or Vertical Surface Mounting on a Suspended Ceiling Attaching the Access Point to the Mounting Bracket Securing the Access Point to the Mounting Bracket D-3 D-4 D-5 D-5 A P P E N D I X E Protocol Filters E-1 A P P E N D I X F Supported MIBs F-1 F-1 MIB List Using FTP to Access the MIB Files F-2 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xiv OL-3446-01 Contents A P P E N D I X G Access Point Specifications G-1 A P P E N D I X H Error and Event Messages H-1 A P P E N D I X I Console Cable Pinouts I-1 Overview I-2 Console Port Signals and Pinouts I-2 G L O S S A R Y I N D E X OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xv Contents Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xvi OL-3446-01 Preface Audience Purpose This guide is for the networking professional who installs and manages the Cisco Aironet 1200 Series Access Point, hereafter referred to as the access point. To use this guide, you should have experience working with the Cisco IOS and be familiar with the concepts and terminology of wireless local area networks. This guide provides the information you need to install and configure your access point. This guide provides procedures for using the IOS commands that have been created or changed for use with the access point. It does not provide detailed information about these commands. For detailed information about these commands, refer to the Cisco Aironet 1200 Series Access Point Command Reference for this release. For information about the standard IOS Release 12.2 commands, refer to the IOS documentation set available from the Cisco.com home page at Service and Support > TechnicalDocuments. On the Cisco Product Documentation home page, select Release 12.2 from the Cisco IOS Software drop-down list. This guide also includes an overview of the access point web-based interface (APWI), which contains all the funtionality of the command-line interface (CLI). This guide does not provide field-level descriptions of the APWI windows nor does it provide the procedures for configuring the access point from from the APWI. For all APWI window descriptions and procedures, refer to the access point online help, which is available from the Help buttons on the APWI pages. Organization This guide is organized into these chapters:

Chapter 1, Overview, lists the software and hardware features of the access point and describes the access points role in your network. Chapter 2, Installing the Access Point, describes installing your access point on a desktop, wall, or ceiling, and provides safety warnings and general guidelines. Chapter 3, Configuring the Access Point for the First Time, describes how to configure basic settings on a new access point. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xvii Organization Preface Chapter 4, Using the Web-Browser Interface, describes how to use the web-browser interface to configure the access point. Chapter 5, Using the Command-Line Interface, describes how to use the command-line interface

(CLI) to configure the access point. Chapter 6, Administering the Access Point, describes how to perform one-time operations to administer your access point, such as preventing unauthorized access to the access point, setting the system date and time, and setting the system name and prompt. Chapter 7, Configuring Radio Settings, describes how to configure settings for the access point radio such as the role in the radio network, data rates, transmit power, channel settings, and others. Chapter 8, Configuring Multiple SSIDs, describes how to configure and manage multiple service set identifiers (SSIDs) on your access point. You can configure up to 16 SSIDs on your access point and assign different configuration settings to each SSID. Chapter 9, Configuring WEP and WEP Features, describes how to configure Wired Equivalent Privacy

(WEP), Message Integrity Check (MIC), Temporal Key Integrity Protocol (TKIP), and broadcast key rotation to protect your wireless LAN. Chapter 10, Configuring Authentication Types, describes how to configure authentication types on the access point. Client devices use these authentication methods to join your network. Chapter 11, Configuring RADIUS and TACACS+ Servers, describes how to enable and configure the Remote Authentication Dial-In User Service (RADIUS) and Terminal Access Controller Access Control System Plus (TACACS+), which provide detailed accounting information and flexible administrative control over authentication and authorization processes. Chapter 12, Configuring VLANs, describes how to configure your access point to interoperate with the VLANs set up on your wired LAN. Chapter 13, Configuring QoS, describes how to configure quality of service (QoS) on your access point. With this feature, you can provide preferential treatment to certain traffic at the expense of others. Chapter 14, Configuring Proxy Mobile IP, describes how to configure your access points proxy mobile IP feature. When you enable proxy mobile IP on your access point and on your wired network, the access point helps client devices from other networks remain connected to their home networks. Chapter 15, Configuring Filters, describes how to configure and manage MAC address, IP, and Ethertype filters on the access point using the web-browser interface. Chapter 16, Configuring CDP, describes how to configure Cisco Discovery Protocol (CDP) on your access point. CDP is a device-discovery protocol that runs on all Cisco network equipment. Chapter 17, Configuring SNMP, describes how to configure the Simple Network Management Protocol (SNMP) on your access point. Chapter 18, Configuring Repeater and Standby Access Points, descibes how to configure your access point as a hot standby unit or as a repeater unit. Chapter 19, Managing Firmware and Configurations, describes how to manipulate the Flash file system, how to copy configuration files, and how to archive (upload and download) software images. Chapter 20, Configuring System Message Logging, describes how to configure system message logging on your access point. Chapter 21, Troubleshooting, provides troubleshooting procedures for basic problems with the access point. Chapter 22, 2.4-GHz Radio Upgrade, provides instructions for upgrading the access point 2.4-GHz radio. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xviii OL-3446-01 Preface Conventions Chapter 23, 5-GHz Radio Module Upgrade, provides instructions for upgrading the access point 5-GHz radio. Appendix A, Translated Safety Warnings, provides translations of the safety warnings that appear in this publication. Appendix B, Declarations of Conformity and Regulatory Information, provides declarations of conformity and regulatory information for the access point. Appendix C, Channels and Antenna Settings, lists the access point radio channels and the maximum power levels supported by the worlds regulatory domains. Appendix D, Mounting Instructions, describes how to mount the access point on a desktop, wall, or ceiling. Appendix E, Protocol Filters, lists some of the protocols that you can filter on the access point. Appendix F, Supported MIBs, lists the Simple Network Management Protocol (SNMP) Management Information Bases (MIBs) that the access point supports for this software release. Appendix G, Access Point Specifications, lists technical specifications for the access point. Appendix H, Error and Event Messages, lists the CLI error and event messages and provides an explanation and recommended action for each message. Appendix I, Console Cable Pinouts, identifies the pinouts for the serial console cable that connects to the access points serial console port. Conventions This publication uses these conventions to convey instructions and information:

Command descriptions use these conventions:

Commands and keywords are in boldface text. Arguments for which you supply values are in italic. Square brackets ([ ]) mean optional elements. Braces ({ }) group required choices, and vertical bars ( | ) separate the alternative elements. Braces and vertical bars within square brackets ([{ | }]) mean a required choice within an optional element. Interactive examples use these conventions:

Terminal sessions and system displays are in screen font. Information you enter is in boldface screen font. Nonprinting characters, such as passwords or tabs, are in angle brackets (< >). Notes, cautions, and timesavers use these conventions and symbols:

Tip Means the following will help you solve a problem. The tips information might not be troubleshooting or even an action, but could be useful information. Note Means reader take note. Notes contain helpful suggestions or references to materials not contained in this manual. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xix Conventions Preface Caution Means reader be careful. In this situation, you might do something that could result equipment damage or loss of data. Warning This warning symbol means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standard practices for preventing accidents. (To see translations of the warnings that appear in this publication, refer to the appendix Translated Safety Warnings.) Waarschuwing Dit waarschuwingssymbool betekent gevaar. U verkeert in een situatie die lichamelijk letsel kan veroorzaken. Voordat u aan enige apparatuur gaat werken, dient u zich bewust te zijn van de bij elektrische schakelingen betrokken risicos en dient u op de hoogte te zijn van standaard maatregelen om ongelukken te voorkomen. (Voor vertalingen van de waarschuwingen die in deze publicatie verschijnen, kunt u het aanhangsel Translated Safety Warnings (Vertalingen van veiligheidsvoorschriften) raadplegen.) Varoitus Attention Warnung Avvertenza Advarsel Tm varoitusmerkki merkitsee vaaraa. Olet tilanteessa, joka voi johtaa ruumiinvammaan. Ennen kuin tyskentelet minkn laitteiston parissa, ota selv shkkytkentihin liittyvist vaaroista ja tavanomaisista onnettomuuksien ehkisykeinoista. (Tss julkaisussa esiintyvien varoitusten knnkset lydt liitteest "Translated Safety Warnings" (knnetyt turvallisuutta koskevat varoitukset).) Ce symbole davertissement indique un danger. Vous vous trouvez dans une situation pouvant entraner des blessures. Avant daccder cet quipement, soyez conscient des dangers poss par les circuits lectriques et familiarisez-vous avec les procdures courantes de prvention des accidents. Pour obtenir les traductions des mises en garde figurant dans cette publication, veuillez consulter lannexe intitule Translated Safety Warnings (Traduction des avis de scurit). Dieses Warnsymbol bedeutet Gefahr. Sie befinden sich in einer Situation, die zu einer Krperverletzung fhren knnte. Bevor Sie mit der Arbeit an irgendeinem Gert beginnen, seien Sie sich der mit elektrischen Stromkreisen verbundenen Gefahren und der Standardpraktiken zur Vermeidung von Unfllen bewut. (bersetzungen der in dieser Verffentlichung enthaltenen Warnhinweise finden Sie im Anhang mit dem Titel Translated Safety Warnings (bersetzung der Warnhinweise).) Questo simbolo di avvertenza indica un pericolo. Si in una situazione che pu causare infortuni. Prima di lavorare su qualsiasi apparecchiatura, occorre conoscere i pericoli relativi ai circuiti elettrici ed essere al corrente delle pratiche standard per la prevenzione di incidenti. La traduzione delle avvertenze riportate in questa pubblicazione si trova nellappendice, Translated Safety Warnings (Traduzione delle avvertenze di sicurezza). Dette varselsymbolet betyr fare. Du befinner deg i en situasjon som kan fre til personskade. Fr du utfrer arbeid p utstyr, m du vre oppmerksom p de faremomentene som elektriske kretser innebrer, samt gjre deg kjent med vanlig praksis nr det gjelder unng ulykker. (Hvis du vil se oversettelser av de advarslene som finnes i denne publikasjonen, kan du se i vedlegget "Translated Safety Warnings" [Oversatte sikkerhetsadvarsler].) Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xx OL-3446-01 Preface Related Publications Aviso Este smbolo de aviso indica perigo. Encontra-se numa situao que lhe poder causar danos fisicos. Antes de comear a trabalhar com qualquer equipamento, familiarize-se com os perigos relacionados com circuitos elctricos, e com quaisquer prticas comuns que possam prevenir possveis acidentes. (Para ver as tradues dos avisos que constam desta publicao, consulte o apndice Translated Safety Warnings - Tradues dos Avisos de Segurana). Advertencia!

Este smbolo de aviso significa peligro. Existe riesgo para su integridad fsica. Antes de manipular cualquier equipo, considerar los riesgos que entraa la corriente elctrica y familiarizarse con los procedimientos estndar de prevencin de accidentes. (Para ver traducciones de las advertencias que aparecen en esta publicacin, consultar el apndice titulado Translated Safety Warnings.) Varning!

Denna varningssymbol signalerar fara. Du befinner dig i en situation som kan leda till personskada. Innan du utfr arbete p ngon utrustning mste du vara medveten om farorna med elkretsar och knna till vanligt frfarande fr att frebygga skador. (Se frklaringar av de varningar som frekommer i denna publikation i appendix "Translated Safety Warnings" [versatta skerhetsvarningar].) Related Publications These documents provide complete information about the access point:

Release Notes for 1200 Series Access Points Cisco Aironet 1200 Series Access Point Command Reference Click this link to browse to the Cisco Aironet documentation home page:

http://www.cisco.com/univercd/cc/td/doc/product/wireless/index.htm To browse to the 1200 series access point documentation, select Aironet 1200 Series Wireless LAN Products > Cisco Aironet 1200 Series Access Points. Obtaining Documentation Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems. Cisco.com You can access the most current Cisco documentation on the World Wide Web at this URL:

http://www.cisco.com/univercd/home/home.htm You can access the Cisco website at this URL:

http://www.cisco.com International Cisco web sites can be accessed from this URL:

http://www.cisco.com/public/countries_languages.shtml OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xxi Obtaining Documentation Documentation CD-ROM Preface Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which might have shipped with your product. The Documentation CD-ROM is updated monthly and might be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual subscription. Registered Cisco.com users can order the Documentation CD-ROM (product number DOC-CONDOCCD=) through the online Subscription Store:

http://www.cisco.com/go/subscription Ordering Documentation You can find instructions for ordering documentation at this URL:

http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm You can order Cisco documentation in these ways:

Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace:

http://www.cisco.com/en/US/partner/ordering/index.shtml Registered Cisco.com users can order the Documentation CD-ROM (Customer Order Number DOC-CONDOCCD=) through the online Subscription Store:

http://www.cisco.com/go/subscription Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, U.S.A.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387). Documentation Feedback You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page. You can email your comments to bug-doc@cisco.com. You can submit your comments by mail by using the response card behind the front cover of your document or by writing to the following address:

Cisco Systems Attn: Customer Document Ordering 170 West Tasman Drive San Jose, CA 95134-9883 We appreciate your comments. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xxii OL-3446-01 Preface Obtaining Technical Assistance Obtaining Technical Assistance Cisco provides Cisco.com, which includes the Cisco Technical Assistance Center (TAC) Website, as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from the Cisco TAC website. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC website, including TAC tools and utilities. Cisco.com Cisco.com offers a suite of interactive, networked services that let you access Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world. Cisco.com provides a broad range of features and services to help you with these tasks:

Streamline business processes and improve productivity Resolve technical issues with online support Download and test software packages Order Cisco learning materials and merchandise Register for online skill assessment, training, and certification programs To obtain customized information and service, you can self-register on Cisco.com at this URL:

http://www.cisco.com Technical Assistance Center The Cisco TAC is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two levels of support are available: the Cisco TAC website and the Cisco TAC Escalation Center. The avenue of support that you choose depends on the priority of the problem and the conditions stated in service contracts, when applicable. We categorize Cisco TAC inquiries according to urgency:

Priority level 4 (P4)You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration. Priority level 3 (P3)Your network performance is degraded. Network functionality is noticeably impaired, but most business operations continue. Priority level 2 (P2)Your production network is severely degraded, affecting significant aspects of business operations. No workaround is available. Priority level 1 (P1)Your production network is down, and a critical impact to business operations will occur if service is not restored quickly. No workaround is available. Cisco TAC Website You can use the Cisco TAC website to resolve P3 and P4 issues yourself, saving both cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To access the Cisco TAC website, go to this URL:

http://www.cisco.com/tac OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xxiii Obtaining Additional Publications and Information Preface All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC website. Some services on the Cisco TAC website require a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register:

http://tools.cisco.com/RPF/register/register.do If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC website, you can open a case online at this URL:

http://www.cisco.com/en/US/support/index.html If you have Internet access, we recommend that you open P3 and P4 cases through the Cisco TAC website so that you can describe the situation in your own words and attach any necessary files. Cisco TAC Escalation Center The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case. To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL:

http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml Before calling, please check with your network operations center to determine the level of Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number. Obtaining Additional Publications and Information Information about Cisco products, technologies, and network solutions is available from various online and printed sources. The Cisco Product Catalog describes the networking products offered by Cisco Systems as well as ordering and customer support services. Access the Cisco Product Catalog at this URL:

http://www.cisco.com/en/US/products/products_catalog_links_launch.html Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL:

http://www.ciscopress.com Packet magazine is the Cisco monthly periodical that provides industry professionals with the latest information about the field of networking. You can access Packet magazine at this URL:

http://www.cisco.com/en/US/about/ac123/ac114/about_cisco_packet_magazine.html iQ Magazine is the Cisco monthly periodical that provides business leaders and decision makers with the latest information about the networking industry. You can access iQ Magazine at this URL:

http://business.cisco.com/prod/tree.taf%3fasset_id=44699&public_view=true&kbns=1.html Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xxiv OL-3446-01 Preface Obtaining Additional Publications and Information Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in the design, development, and operation of public and private internets and intranets. You can access the Internet Protocol Journal at this URL:

http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.html TrainingCisco offers world-class networking training, with current offerings in network training listed at this URL:

http://www.cisco.com/en/US/learning/le31/learning_recommended_training_list.html OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xxv Obtaining Additional Publications and Information Preface Cisco Aironet 1200 Series Access Point Installation and Configuration Guide xxvi OL-3446-01 C H A P T E R 1 Overview Cisco Aironet 1200 Series Access Points (hereafter called access points) provide a secure, affordable, and easy-to-use wireless LAN solution that combines mobility and flexibility with the enterprise-class features required by networking professionals. With a management system based on Cisco IOS software, the 1200 series is a Wi-Fi certified, 802.11b-compliant and 802.11a-compliant wireless LAN transceiver. The 1200 series access point can contain two radios: a 2.4-GHz radio in an internal mini-PCI slot and a 5-GHz radio module in an external, modified cardbus slot. The access point supports one radio of each type, but it does not support two 2.4-GHz or two 5-GHz radios. You can configure the radios separately, using different settings on each radio. The access point serves as the connection point between wireless and wired networks or as the center point of a stand-alone wireless network. In large installations, wireless users within radio range of an access point can roam throughout a facility while maintaining seamless, uninterrupted access to the network. You can configure and monitor the access point using the command-line interface (CLI), the browser-based management system, or Simple Network Management Protocol (SNMP). This chapter provides information on the following topics:

Features, page 1-2 Management Options, page 1-5 Roaming Client Devices, page 1-5 Network Configuration Examples, page 1-6 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 1-1 Features Features Chapter 1 Overview This section describes access point features. Refer to Appendix G, Access Point Specifications, for a list of access point specifications. Hardware Features Key hardware features of the 1200 series access point include:

Dual-Radio Operation, page 1-2 Ethernet Port, page 1-2 Console Port, page 1-2 Status Indicators, page 1-3 Power Sources, page 1-3 UL 2043 Certification, page 1-4 Anti-Theft Features, page 1-4 Dual-Radio Operation The 1200 series access point can be initially configured from the factory for single- or dual-radio operation. You can also upgrade an access point configured for single-radio operation to support dual-radio operation using a 5-GHz radio module or a 2.4-GHz mini-PCI radio card. The 2.4-GHz mini-PCI radio card connects to an internal mini-PCI slot. The 5-GHz radio module connects to the access points modified card bus connector. The module incorporates an Unlicensed National Information Infrastructure (UNII) radio transceiver operating in two of the UNII 5-GHz frequency bands and supporting up to 8 channels. The module contains dual integrated omnidirectional antennas and directional patch antennas for diversity operation. The 2.4-GHz radio is called Radio 0 and the 5-GHz radio is called Radio 1. The auto-sensing Ethernet port accepts an RJ-45 connector, linking the access point to your 10BASE-T or 100BASE-T Ethernet LAN. The access point can receive power through the Ethernet cable from a power injector, switch, or power patch panel. The Ethernet MAC address is printed on the label on the back of the access point. The console port provides access to the access points command-line interface (CLI) using a terminal emulator program. Use an RJ-45 to DB-9 serial cable to connect your computers COM port to the access points serial console port. (Refer to Appendix I, Console Cable Pinouts, for a description of the console port pinouts.) Assign the following port settings to a terminal emulator to open the management system pages: 9600 baud, 8 data bits, No parity, 1 stop bit and no flow control. Ethernet Port Console Port Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 1-2 OL-3446-01 Chapter 1 Overview Status Indicators Features The three indicators on the top of the access point report Ethernet activity, association status, and radio activity. The Ethernet indicator signals Ethernet traffic on the wired LAN, or Ethernet infrastructure. This indicator is normally green when an Ethernet cable is connected and blinks green when a packet is received or transmitted over the Ethernet infrastructure. The indicator is off when the Ethernet cable is not connected. The status indicator signals operational status. Green indicates that the access point is associated with at least one wireless client. Blinking green indicates that the access point is operating normally but is not associated with any wireless devices. The radio indicator signals wireless traffic over the radio interface. The light is normally off, but it blinks green whenever a packet is received or transmitted over the access point radio. Figure 1-1 shows the three status indicators. Figure 1-1 Access Point Indicators Ethernet Status Radio 4 0 7 6 8 Power Sources The access point can receive power from an external power module or through inline power using the Ethernet cable. Using inline power, you do not need to run a separate power cord to the access point. The access point supports the following power sources:

Power supply (input 100240 VAC, 5060 Hz, output 48 VDC, 0.2A minimum) Inline power from:

Cisco Aironet Power Injector for 1100 and 1200 series access points A switch capable of providing inline power, such as Cisco Catalyst 3500XL, 3550, 4500, or 6500 switches OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 1-3 Features Chapter 1 Overview An inline power patch panel, such as the Cisco Catalyst Inline Power Patch Panel Note The Catalyst 3550-24 PWR switch supports power for access points configured with both 2.4-GHz and 5-GHz radios. Other switches and patch panels might not provide enough power for the 5-GHz radio. UL 2043 Certification Caution The 1200 series power injectors are not tested to UL 2043 and should not be placed in a buildings environmental air space, such as above suspended ceilings. The access point is encased in a durable metal case having adequate fire resistance and low smoke-producing characteristics suitable for operation in a building's environmental air space, such as above suspended ceilings, in accordance with Section 300-22(c) of the NEC, and with Sections 2-128, 12-010(3) and 12-100 of the Canadian Electrical Code, Part 1, C22.1. Anti-Theft Features There are two methods of securing the access point to help prevent theft:

Security cable keyholeYou can use the security cable slot to secure the access point using a standard security cable, such as those used on laptop computers. Security haspWhen you mount the access point on a wall or ceiling using the mounting bracket and the security hasp, you can lock the access point to the bracket with a padlock. Compatible padlocks are Master Lock models 120T and 121T or equivalent. Software Features In addition to all the standard access point features, 1200 series access points also offer these software features:

World modeUse this feature to communicate the access points regulatory setting information, including maximum transmit power and available channels, to world mode-enabled clients. Clients using world mode can be used in countries with different regulatory settings and automatically conform to local regulations. World mode is supported only on the 2.4-GHz radio. Repeater modeConfigure the access point as a wireless repeater to extend the coverage area of your wireless network. Standby modeConfigure the access point as a standby unit that monitors another access point and assumes its role in the network if the monitored access point fails. Multiple SSIDsCreate up to 16 SSIDs on your access point and assign any combination of these settings to each SSID:

Broadcast SSID mode for guests on your network Client authentication methods Maximum number of client associations VLAN identifier Proxy Mobile IP Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 1-4 OL-3446-01 Chapter 1 Overview Management Options RADIUS accounting list identifier A separate SSID for infrastructure devices such as repeaters and workgroup bridges VLANsAssign VLANs to the SSIDs on your access point (one VLAN per SSID) to differentiate policies and services among users. QoSUse this feature to support quality of service for prioritizing traffic from the Ethernet to the access point. The access point also supports the voice-prioritization schemes used by 802.11b wireless phones such as Spectralink's Netlink and Symbols Netvision. Proxy Mobile IPUse this feature to configure the access point to provide proxy Mobile IP service for clients that do not have mobile IP software installed. RADIUS AccountingEnable accounting on the access point to send accounting data about wireless client devices to a RADIUS server on your network. TACACS+ adminstrator authenticationEnable TACACS+ for server-based, detailed accounting information and flexible administrative control over authentication and authorization processes. It provides secure, centralized validation of administrators attempting to gain access to your access point. Enhanced securityEnable three advanced security features to protect against sophisticated attacks on your wireless network's WEP keys: Message Integrity Check (MIC), WEP key hashing, and broadcast WEP key rotation. Enhanced authentication servicesSet up repeater access points to authenticate to your network like other wireless client devices. After you provide a network username and password for the repeater, it authenticates to your network using LEAP, Cisco's wireless authentication method, and receives and uses dynamic WEP keys. Management Options You can use the access point management system through the following interfaces:

The IOS command-line interface (CLI), which you use through a Telnet session. Most of the examples in this manual are taken from the CLI. Chapter 5, Using the Command-Line Interface, provides a detailed description of the CLI. A web-browser interface, which you use through a web browser. Chapter 4, Using the Web-Browser Interface, provides a detailed description of the web-browser interface. Simple Network Management Protocol (SNMP). Chapter 17, Configuring SNMP, explains how to configure your access point for SNMP management. Roaming Client Devices If you have more than one access point in your wireless LAN, wireless client devices can roam seamlessly from one access point to another. The roaming functionality is based on signal quality, not proximity. When a clients signal quality drops, it roams to another access point. Wireless LAN users are sometimes concerned when a client device stays associated to a distant access point instead of roaming to a closer access point. However, if a clients signal to a distant access point remains strong and the signal quality is high, the client will not roam to a closer access point. Checking constantly for closer access points would be inefficient, and the extra radio traffic would slow throughput on the wireless LAN. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 1-5 Network Configuration Examples Chapter 1 Overview Network Configuration Examples This section describes the access points role in three common wireless network configurations. The access points default configuration is as a root unit connected to a wired LAN or as the central unit in an all-wireless network. The repeater role requires a specific configuration. Root Unit on a Wired LAN An access point connected directly to a wired LAN provides a connection point for wireless users. If more than one access point is connected to the LAN, users can roam from one area of a facility to another without losing their connection to the network. As users move out of range of one access point, they automatically connect to the network (associate) through another access point. The roaming process is seamless and transparent to the user. Figure 1-2 shows access points acting as root units on a wired LAN. Figure 1-2 Access Points as Root Units on a Wired LAN Access Point

(Root Unit) Wired LAN Access Point

(Root Unit) 9 9 9 5 6 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 1-6 OL-3446-01 Chapter 1 Overview Network Configuration Examples Repeater Unit that Extends Wireless Range An access point can be configured as a stand-alone repeater to extend the range of your infrastructure or to overcome an obstacle that blocks radio communication. The repeater forwards traffic between wireless users and the wired LAN by sending packets to either another repeater or to an access point connected to the wired LAN. The data is sent through the route that provides the best performance for the client. Figure 1-3 shows an access point acting as a repeater. Consult the Configuring a Repeater Access Point section on page 18-3 for instructions on setting up an access point as a repeater. Note Non-Cisco client devices might have difficulty communicating with repeater access points. Figure 1-3 Access Point as Repeater Access Point

(Root Unit) Wired LAN Access Point

(Repeater) 0 0 0 6 6 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 1-7 Network Configuration Examples Chapter 1 Overview Central Unit in an All-Wireless Network In an all-wireless network, an access point acts as a stand-alone root unit. The access point is not attached to a wired LAN; it functions as a hub linking all stations together. The access point serves as the focal point for communications, increasing the communication range of wireless users. Figure 1-4 shows an access point in an all-wireless network. Figure 1-4 Access Point as Central Unit in All-Wireless Network Access Point

(Root Unit) 8 9 9 5 6 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 1-8 OL-3446-01 C H A P T E R 2 Installing the Access Point This chapter describes the setup of the access point and includes the following sections:

Safety Information, page 2-2 Warnings, page 2-2 Unpacking the Access Point, page 2-3 Basic Installation Guidelines, page 2-3 Before Beginning the Installation, page 2-4 Installation Summary, page 2-5 Connecting the 2.4-GHz Antennas, page 2-5 Connecting the Ethernet and Power Cables, page 2-5 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 2-1 Safety Information Safety Information Chapter 2 Installing the Access Point Follow the guidelines in this section to ensure proper operation and safe use of the access point. FCC Safety Compliance Statement The FCC with its action in ET Docket 96-8 has adopted a safety standard for human exposure to radio frequency (RF) electromagnetic energy emitted by FCC certified equipment. When used with approved Cisco Aironet antennas, Cisco Aironet products meet the uncontrolled environmental limits found in OET-65 and ANSI C95.1, 1991. Proper installation of this radio according to the instructions found in this manual will result in user exposure that is substantially below the FCC recommended limits. General Safety Guidelines Do not touch or move antenna(s) while the unit is transmitting or receiving. Do not hold any component containing a radio so that the antenna is very close to or touching any exposed parts of the body, especially the face or eyes, while transmitting. The use of wireless devices in hazardous locations is limited to the constraints posed by the local codes, the national codes, and the safety directors of such environments. Warnings Translated versions of the following safety warnings are provided in Appendix A, Translated Safety Warnings. Warning In order to comply with FCC radio frequency (RF) exposure limits, dipole antennas should be located at a minimum of 7.9 inches (20 cm) or more from the body of all persons. Warning Do not operate your wireless network device near unshielded blasting caps or in an explosive environment unless the device has been modified to be especially qualified for such use. Warning Do not work on the system or connect or disconnect cables during periods of lightning activity. Warning Read the installation instructions before you connect the system to its power source. Warning This product relies on the building's installation for short-circuit (overcurrent) protection. Ensure that a fuse or circuit breaker no larger than 120 VAC, 15A U.S. (240 VAC, 10A international) is used on the phase conductors (all current-carrying conductors). Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 2-2 OL-3446-01 Chapter 2 Installing the Access Point Unpacking the Access Point Unpacking the Access Point Follow these steps to unpack the access point:

Step 1 Step 2 Step 3 Open the shipping container and carefully remove the contents. Return all packing materials to the shipping container and save it. Ensure that all items listed in the Package Contents section are included in the shipment. Check each item for damage. If any item is damaged or missing, notify your authorized Cisco sales representative. Package Contents Each access point package contains the following items:

Cisco Aironet 1200 Series Access Point Cisco Aironet 1200 Series Power Module (Universal power supply) Quick Start Guide: Cisco Aironet 1200 Series Access Point Cisco product registration and Cisco documentation feedback cards Basic Installation Guidelines Because the access point is a radio device, it is susceptible to common causes of interference that can reduce throughput and range. Follow these basic guidelines to ensure the best possible performance:

Install the access point in an area where large steel structures such as shelving units, bookcases, and filing cabinets do not block the radio signals to and from the access point. Install the access point away from microwave ovens. Microwave ovens operate on the same frequency as the access point and can cause signal interference. Installation Above Suspended Ceilings The access point uses a metal enclosure having adequate fire resistance and low smoke-producing characteristics suitable for operation in a buildings environmental air space in accordance with Section 300-22(c) of the NEC, such as above suspended ceilings. For mounting instructions, refer to Appendix D, Mounting Instructions. Caution Cisco Aironet power injectors are not tested to UL 2043 and should not be placed in a buildings environmental air space, such as above suspended ceilings. Note If you plan to mount the access point in environmental air space and will upgrade to a 5-GHz radio, Cisco recommends that you mount the access point horizontally with its antennas pointing down. Doing so will result in the access point complying with regulatory requirements for environmental air space after the 5-GHz radio is installed. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 2-3 Before Beginning the Installation Chapter 2 Installing the Access Point Before Beginning the Installation Before you begin the installation process, please refer to Figure 2-1 and Figure 2-2 to become familiar with the access points layout, connectors, and 5-GHz module location. Figure 2-1 Access Point Layout and Connectors 1 2 3 4 5 6 7 1 1 2 3 4 2.4-GHz antenna connectors 48 VDC power port Ethernet port (RJ-45) Console port (RJ-45) Figure 2-2 5-GHz Radio Module 7 4 8 5 6 5 6 7 Mode button Status LEDs Mounting bracket 1 1 2 3 1 2 5-GHz radio module mounting screws 5-GHz radio module antenna (patch position) 3 Access point 1 3 6 4 7 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 2-4 OL-3446-01 Chapter 2 Installing the Access Point Installation Summary Installation Summary While installing the access point, you must perform the following operations:

If your access point has a 2.4-GHz radio, connect a single antenna or dual diversity antennas (refer to the Connecting the Ethernet and Power Cables section on page 2-5). Connect Ethernet and power cables (refer to the Connecting the Ethernet and Power Cables section on page 2-5). Configure basic settings (refer to Chapter 3, Configuring the Access Point for the First Time). Configure security and other access point options. Use the mounting kit to install the access point on a convenient flat horizontal or vertical surface, such as a desktop, book shelf, file cabinet, wall, or ceiling. For additional information on mounting, refer to Appendix D, Mounting Instructions. Connecting the 2.4-GHz Antennas The access point supports a single antenna or dual diversity antennas. Two R-TNC antenna connectors are provided on the back of the unit for the 2.4-GHz radio. If you are using a Cisco Aironet 2 dBi antenna, follow the steps below:

Step 1 Attach an antenna to the Right/Primary 2.4-GHz (R-TNC) antenna connector on the back of the access point and tighten hand tight. If you are using two antennas for diversity coverage, attach the second antenna to the Left 2.4-GHz (R-TNC) antenna connector. Step 2 Orient the antenna depending on how you intend to mount the access point. On a table or desk, orient the antenna straight up. On a vertical surface, such as a wall, orient the antenna straight up. On a ceiling, orient the antenna straight down. If you are using another Cisco Aironet antenna, refer to the instructions that came with your antenna. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 2-5 Connecting the Ethernet and Power Cables Chapter 2 Installing the Access Point Connecting the Ethernet and Power Cables The access point receives power through the Ethernet cable or an external power module. Figure 2-3 shows the power options for the access point. Figure 2-3 Access Point Power Options Option 1 Option 2 Switch

(without inline power) Option 3 Switch

(without inline power) Switch with inline power SYST RPS STAT UTIL DUPLX SPEED MODE 1 2 3 4 5 6 7 8 9 10 11 10Base-T / 100Base-TX 12 13 14 15 16 17 18 19 20 21 22 23 Catalyst 2950 SERIES 100Base-FX 23 24 24 SYST RPS STAT UTIL DUPLX SPEED MODE 1 2 3 4 5 6 7 8 9 10 11 10Base-T / 100Base-TX 12 13 14 15 16 17 18 19 20 21 22 23 Catalyst 2950 SERIES 100Base-FX 23 24 24 SYST RPS STAT UTIL DUPLX SPEED MODE 1 2 3 4 5 6 7 8 9 10 11 10Base-T / 100Base-TX 12 13 14 15 16 17 18 19 20 21 22 23 Catalyst 2950 SERIES 100Base-FX 23 24 24 Inline Power Patch Panel SYST RPS STAT UTIL DUPLX SPEED MODE Access Point Power injector K R O W O T T E N T O A P

B R I D G E Power cord Universal power supply Option 4 4 6 1 4 7 The access point power options are listed below:

A switch with inline power, such as a Cisco Catalyst 3500XL, 3550-24 PWR, 4000, or 6500 switch An inline power patch panel, such as a Cisco Catalyst Inline Power Patch Panel A power injector A power module (Universal power supply) Note Currently, the Catalyst 3550-24 PWR switch supports power for both the 2.4-GHz radio and the 5-GHz radio. Other switches and power patch panels might not provide enough power for the 5-GHz radio. Note If you use in-line power from a switch or patch panel, do not connect the power module to the access point. Using two power sources on the access point might cause the switch or patch panel to shut down the port to which the access point is connected. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 2-6 OL-3446-01 Chapter 2 Installing the Access Point Connecting the Ethernet and Power Cables Connecting to an Ethernet Network with an Inline Power Source Caution The Cisco Aironet Power Injector for the 1100 and 1200 series is designed for use with 1100 series or 1200 series access points only. Using the power injector with other Ethernet-ready devices can damage the equipment. Caution The Cisco Aironet Power Injector for the 1100 and 1200 series is not tested to UL 2043 and should not be placed in a building's environmental air space, such as above suspended ceilings. Follow these steps to connect the access point to the Ethernet LAN when you have an inline power source:

Step 1 Step 2 Connect the Ethernet cable to the RJ-45 Ethernet connector labeled Ethernet on the access point. Connect the other end of the Ethernet cable to one of the following:

A switch with inline power, such as a Cisco Catalyst 3500XL, 3550-24 PWR, 4000, or 6500 switch. An inline power switch panel, such as a Cisco Catalyst Inline Power Patch Panel. The end of a Cisco Aironet power injector labeled To AP/Bridge. Connect the other end labeled To Network to the 10/100 Ethernet LAN. Note If you use a power supply or power injector to power the access point, you must use the power supply included with your access point and the Cisco Aironet Power Injector for the 1100 and 1200 series access points. Connecting to an Ethernet Network with Local Power Follow these steps to connect the access point to an Ethernet LAN when you are using a local power source:

Step 1 Step 2 Step 3 Connect the Ethernet cable to the RJ-45 Ethernet connector labeled Ethernet on the access point. Plug the other end of the Ethernet cable into an unpowered Ethernet port on your network. Connect the power modules output connector to the 48-VDC power port labeled 48VDC on the access point. Step 4 Plug the other end of the power module into an approved 100- to 240-VAC outlet. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 2-7 Connecting the Ethernet and Power Cables Chapter 2 Installing the Access Point Powering Up the Access Point When power is applied to the access point, it begins a routine power-up sequence that you can monitor by observing the three LEDs on top of the access point. After you observe all three LEDs turning green to indicate the starting of the IOS operating system, the Status LED blinks green signifying that IOS is operational. When in an operational status, the Ethernet LED is steady green when no traffic is being passed and dark during periods when traffic is being passed. The sequence takes about 1 minute to complete. Refer to Chapter 21, Troubleshooting, for LED descriptions. When the sequence is complete, you are ready to obtain the access points IP address and perform an initial configuration. Refer to Chapter 3, Configuring the Access Point for the First Time, for instructions on assigning basic settings to the access point. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 2-8 OL-3446-01 C H A P T E R 3 Configuring the Access Point for the First Time This chapter describes how to configure basic settings on your access point for the first time. The contents of this chapter are similar to the instructions in the quick start guide that shipped with your access point. You can configure all the settings described in this chapter using the CLI, but it might be simplest to browse to the access points web-browser interface to complete the initial configuration and then use the CLI to enter additional settings for a more detailed configuration. This chapter contains these sections:

Before You Start, page 3-2 Obtaining and Assigning an IP Address, page 3-3 Connecting to the Access Point Locally, page 3-3 Assigning Basic Settings, page 3-4 Protecting Your Wireless LAN, page 3-8 Using the IP Setup Utility, page 3-8 Assigning an IP Address Using the CLI, page 3-11 Using a Telnet Session to Access the CLI, page 3-12 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-1 Before You Start Before You Start Chapter 3 Configuring the Access Point for the First Time Before you install the access point, make sure you are using a computer connected to the same network as the access point, and obtain the following information from your network administrator:

A system name for the access point The case-sensitive wireless service set identifier (SSID) for your radio network If not connected to a DHCP server, a unique IP address for your access point (such as 172.17.255.115) If the access point is not on the same subnet as your PC, a default gateway address and subnet mask A Simple Network Management Protocol (SNMP) community name and the SNMP file attribute (if SNMP is in use) If you use IPSU to find or assign the access point IP address, the MAC address from the label on the bottom of the access point (such as 00164625854c) Resetting the Access Point to Default Settings Step 1 Step 2 Step 3 Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 If you need to start over during the initial setup process, follow these steps to reset the access point to factory default settings using the access point MODE button:

Disconnect power (the power jack for external power or the Ethernet cable for in-line power) from the access point. Press and hold the MODE button while you reconnect power to the access point. Hold the MODE button until the Status LED turns amber (approximately 1 to 2 seconds), and release the button. All access point settings return to factory defaults. Follow these steps to return to default settings using the web-browser interface:

Open your Internet browser. You must use Microsoft Internet Explorer (version 5.x or later) or Netscape Navigator (version 4.x). Enter the access points IP address in the browser address line and press Enter. An Enter Network Password window appears. Enter your username in the User Name field. The default username is Cisco. Enter the access point password in the Password field and press Enter. The default password is Cisco. The Summary Status page appears. Click System Software and the System Software screen appears. Click System Configuration and the System Configuration screen appears. Click the Reset to Defaults button. Note If the access point is configured with a static IP address, the IP address does not change. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-2 OL-3446-01 Chapter 3 Configuring the Access Point for the First Time Obtaining and Assigning an IP Address Obtaining and Assigning an IP Address To browse to the access points Express Setup page, you must either obtain or assign the access points IP address using one of the following methods:

Connect to the access point console port and assign a static IP address. Follow the steps in the Connecting to the Access Point Locally section on page 3-3 to connect to the console port. Use a DHCP server (if available) to automatically assign an IP address. You can find out the DHCP-assigned IP address using one of the following methods:

Connect to the access point console port and use the show ip interface brief command to display the IP address. Follow the steps in the Connecting to the Access Point Locally section on page 3-3 to connect to the console port. Provide your organizations network administrator with your access points Media Access Control (MAC) address. Your network administrator will query the DHCP server using the MAC address to identify the IP address. The access points MAC address is on label attached to the bottom of the access point. Use the Cisco IP Setup Utility (IPSU) to identify the assigned address. You can also use IPSU to assign an IP address to the access point if it did not receive an IP address from the DHCP server. IPSU runs on most Microsoft Windows operating systems: Windows 9x, 2000, Me, NT, and XP. You can download IPSU from the Software Center on Cisco.com. Click this link to browse to the Software Center:

http://www.cisco.com/public/sw-center/sw-wireless.shtml OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-3 Connecting to the Access Point Locally Chapter 3 Configuring the Access Point for the First Time Connecting to the Access Point Locally If you need to configure the access point locally (without connecting the access point to a wired LAN), you can connect a PC to its console port using a DB-9 to RJ-45 serial cable. Follow these steps to open the CLI by connecting to the access point console port:

Step 1 Connect a nine-pin, female DB-9 to RJ-45 serial cable to the RJ-45 serial port on the access point and to the COM port on a computer. Figure 3-1 shows the serial port connection. Figure 3-1 Connecting the Serial Cable DB-9 to RJ-45 serial cable RJ-45 serial connector 5 0 0 4 7 Note The Cisco part number for the DB-9 to RJ-45 serial cable is AIR-CONCAB1200. Browse to http://www.cisco.com/go/marketplace to order a serial cable. Step 2 Set up a terminal emulator to communicate with the access point. Use the following settings for the terminal emulator connection: 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control. Assigning Basic Settings After you determine or assign the access points IP address, you can browse to the access points Express Setup page and perform an initial configuration:

Step 1 Step 2 Step 3 Step 4 Open your Internet browser. You must use Microsoft Internet Explorer (version 5.x or later) or Netscape Navigator (version 4.x). Enter the access points IP address in the browser address line and press Enter. An Enter Network Password screen appears. Press Tab to bypass the Username field and advance to the Password field. Enter the case-sensitive password Cisco and press Enter. The Summary Status page appears. Figure 3-2 shows the Summary Status page. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-4 OL-3446-01 Chapter 3 Configuring the Access Point for the First Time Assigning Basic Settings Figure 3-2 Summary Status Page Step 5 Click Express Setup. The Express Setup screen appears. Figure 3-3 shows the Express Setup page. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-5 Assigning Basic Settings Chapter 3 Configuring the Access Point for the First Time Figure 3-3 Express Setup Page Step 6 Enter the configuration settings you obtained from your system administrator. The configurable settings include:

System Name The system name, while not an essential setting, helps identify the access point on your network. The system name appears in the titles of the management system pages. Configuration Server ProtocolClick on the button that matches the networks method of IP Note address assignment. DHCPIP addresses are automatically assigned by your networks DHCP server. Static IPThe access point uses a static IP address that you enter in the IP address field. IP AddressUse this setting to assign or change the access points IP address. If DHCP is enabled for your network, leave this field blank. If the access points IP address changes while you are configuring the access point using the web-browser interface or a Telnet session over the wired LAN, you lose your connection to the access point. If you lose your connection, reconnect to the access point using its new IP address. Follow the steps in the Resetting the Access Point to Default Settings section on page 3-2 if you need to start over. IP Subnet MaskEnter the IP subnet mask provided by your network administrator so the IP address can be recognized on the LAN. If DHCP is enabled, leave this field blank. Default GatewayEnter the default gateway IP address provided by your network administrator. If DHCP is enabled, leave this field blank. Radio Service Set ID (SSID)Enter the case-sensitive SSID (32 alphanumeric characters maximum) provided by your network administrator. The SSID is a unique identifier that client devices use to associate with the access point. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-6 OL-3446-01 Chapter 3 Configuring the Access Point for the First Time Assigning Basic Settings Broadcast SSID in BeaconUse this setting to allow devices that do not specify an SSID to associate with the access point. YesThis is the default setting; it allows devices that do not specify an SSID to associate with the access point. NoDevices must specify an SSID to associate with the access point. With No selected, the SSID used by the client devices must match exactly the access points SSID. Role in Radio NetworkClick on the button that describes the role of the access point on your network. Select Access Point (Root) if your access point is connected to the wired LAN. Select Repeater (Non-Root) if it is not connected to the wired LAN. Optimize Radio Network forUse this setting to select either preconfigured settings for the access point radio or customized settings for the access point radio. ThroughputMaximizes the data volume handled by the access point but might reduce its range. RangeMaximizes the access points range but might reduce throughput. CustomThe access point uses settings you enter on the Network Interfaces: Radio-802.11b Settings page. Clicking Custom takes you to the Network Interfaces: Radio-802.11b Settings page. Aironet ExtensionsEnable this setting if there are only Cisco Aironet devices on your wireless LAN. SNMP CommunityIf your network is using SNMP, enter the SNMP Community name provided by your network administrator and select the attributes of the SNMP data (also provided by your network administrator). Step 7 Click Apply to save your settings. If you changed the IP address, you lose your connection to the access point. Browse to the new IP address to reconnect to the access point. Your access point is now running but probably requires additional configuring to conform to your networks operational and security requirements. Consult the chapters in this manual for the information you need to complete the configuration. Note You can restore the access point to its factory defaults by unplugging the power jack and plugging it back in while holding down the Mode button for a few seconds, or until the Status LED turns amber. Default Settings on the Express Setup Page Table 3-1 lists the default settings for the settings on the Express Setup page. Table 3-1 Default Settings on the Express Setup Page Setting System Name Configuration Server Protocol Default ap DHCP OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-7 Protecting Your Wireless LAN Chapter 3 Configuring the Access Point for the First Time Table 3-1 Default Settings on the Express Setup Page (continued) Setting IP Address IP Subnet Mask Default Gateway Radio Service Set ID (SSID) Broadcast SSID in Beacon Role in Radio Network Optimize Radio Network for Aironet Extensions SNMP Community Default Assigned by DHCP by default; if DHCP is disabled, the default setting is 10.0.0.1 Assigned by DHCP by default; if DHCP is disabled, the default setting is 255.255.255.224 Assigned by DHCP by default; if DHCP is disabled, the default setting is 0.0.0.0 tsunami Yes1 Access point (root) Throughput Enable defaultCommunity 1. When you assign multiple SSIDs, this setting no longer appears. Protecting Your Wireless LAN After you assign basic settings to your access point, you must configure security settings to prevent unauthorized access to your network. Because it is a radio device, the access point can communicate beyond the physical boundaries of your building. Configure some combination of these security features to protect your network from intruders:

Unique SSIDs that are not broadcast in the access point beacon (see Chapter 8, Configuring Multiple SSIDs.) WEP and additional WEP features, such as TKIP and broadcast key rotation (see Chapter 9, Configuring WEP and WEP Features.) Dynamic WEP and client authentication (see Chapter 10, Configuring Authentication Types.) Using the IP Setup Utility IPSU enables you to find the access points IP address when it has been assigned by a DHCP server. You can also use IPSU to set the access points IP address and SSID if they have not been changed from the default settings. This section explains how to install the utility, how to use it to find the access points IP address, and how to use it to set the IP address and the SSID. Note IPSU can be used only on the following operating systems: Windows 95, 98, NT, 2000, ME, or XP. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-8 OL-3446-01 Chapter 3 Configuring the Access Point for the First Time Using the IP Setup Utility Tip Another simple way to find the access points IP address is to look on the Status screen in the Aironet Client Utility on a client device associated to the access point. Obtaining and Installing IPSU IPSU is available on the Cisco web site. Follow these steps to obtain and install IPSU:

Step 1 Use your Internet browser to access the Cisco Software Center at the following URL:

Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 http://www.cisco.com/public/sw-center/sw-wireless.shtml Click Cisco Aironet Wireless LAN Client Adapters. Scroll down to the Windows Utility section. Click Cisco Aironet Client Utility (ACU) for Windows. Click the file IPSUvxxxxx.exe. The vxxxxxx identifies the software package version number. Read and accept the terms and conditions of the Software License Agreement. Download and save the file to a temporary directory on your hard drive and then exit the Internet browser. Double-click IPSUvxxxxxx.exe in the temporary directory to expand the file. Double-click Setup.exe and follow the steps provided by the installation wizard to install IPSU. The IPSU icon appears on your computer desktop. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-9 Using the IP Setup Utility Chapter 3 Configuring the Access Point for the First Time Using IPSU to Find the Access Points IP Address If your access point receives an IP address from a DHCP server, you can use IPSU to find its IP address. Because IPSU sends a reverse-ARP request based on the access point MAC address, you must run IPSU from a computer on the same subnet as the access point. Follow these steps to find the access points IP address:

Step 1 Double-click the IPSU icon on your computer desktop to start the utility. The IPSU screen appears (see Figure 3-4). Figure 3-4 IPSU Get IP Address Screen Step 2 When the utility window opens, make sure the Get IP addr radio button in the Function box is selected. Step 3 Enter the access points MAC address in the Device MAC ID field. The access points MAC address is printed on the label on the bottom of the unit. It should contain six pairs of hexadecimal digits. Your access points MAC address might look like the following example:

000164xxxxxx Note The MAC address field is not case-sensitive. Step 4 Click Get IP Address. Step 5 When the access points IP address appears in the IP Address field, write it down. If IPSU reports that the IP address is 10.0.0.1, the default IP address, then the access point did not receive a DHCP-assigned IP address. To change the access point IP address from the default value using IPSU, refer to the Using IPSU to Set the Access Points IP Address and SSID section on page 3-10. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-10 OL-3446-01 Chapter 3 Configuring the Access Point for the First Time Using the IP Setup Utility Using IPSU to Set the Access Points IP Address and SSID If you want to change the default IP address (10.0.0.1) of the access point, you can use IPSU. You can also set the access points SSID at the same time. Note IPSU can change the access points IP address and SSID only from their default settings. After the IP address and SSID have been changed, IPSU cannot change them again. Note The computer you use to assign an IP address to the access point must have an IP address in the same subnet as the access point (10.0.0.x). Follow these steps to assign an IP address and an SSID to the access point:

Step 1 Step 2 Double-click the IPSU icon on your computer desktop to start the utility. Click the Set Parameters radio button in the Function box (see Figure 3-5). Figure 3-5 IPSU Set Parameters Screen Step 3 Enter the access points MAC address in the Device MAC ID field. The access points MAC address is printed on the label on the bottom of the unit. It should contain six pairs of hexadecimal digits. Your access points MAC address might look like this example:

004096xxxxxx Note The MAC address field is not case-sensitive. Step 4 Step 5 Enter the IP address you want to assign to the access point in the IP Address field. Enter the SSID you want to assign to the access point in the SSID field. Note You cannot set the SSID without also setting the IP address. However, you can set the IP address without setting the SSID. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-11 Assigning an IP Address Using the CLI Chapter 3 Configuring the Access Point for the First Time Step 6 Step 7 Click Set Parameters to change the access points IP address and SSID settings. Click Exit to exit IPSU. Assigning an IP Address Using the CLI When you connect the access point to the wired LAN, the access point links to the network using a bridge virtual interface (BVI) that it creates automatically. Instead of tracking separate IP addresses for the access points Ethernet and radio ports, the network uses the BVI. When you assign an IP address to the access point using the CLI, you must assign the address to the BVI. Beginning in privileged EXEC mode, follow these steps to assign an IP address to the access points BVI:

Step 1 Step 2 Step 3 Command configure terminal interface bvi1 ip address address mask Purpose Enter global configuration mode. Enter interface configuration mode for the BVI. Assign an IP address and address mask to the BVI. Note If you are connected to the access point using a Telnet session, you lose your connection to the access point when you assign a new IP address to the BVI. If you need to continue configuring the access point using Telnet, use the new IP address to open another Telnet session to the access point. Using a Telnet Session to Access the CLI Follow these steps to browse to access the CLI using a Telnet session. These steps are for a PC running Microsoft Windows with a Telnet terminal application. Check your PC operating instructions for detailed instructions for your operating system. Step 1 Select Start > Programs > Accessories > Telnet. If Telnet is not listed in your Accessories menu, select Start > Run, type Telnet in the entry field, and press Enter. Step 2 When the Telnet window appears, click Connect and select Remote System. Note In Windows 2000, the Telnet window does not contain drop-down menus. To start the Telnet session in Windows 2000, type open followed by the access points IP address. Step 3 In the Host Name field, type the access points IP address and click Connect. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 3-12 OL-3446-01 C H A P T E R 4 Using the Web-Browser Interface This chapter describes the web-browser interface that you can use to configure the access point. It contains these sections:

Using the Web-Browser Interface for the First Time, page 4-2 Using the Management Pages in the Web-Browser Interface, page 4-2 Using Online Help, page 4-5 The web-browser interface contains management pages that you use to change access point settings, upgrade firmware, and monitor and configure other wireless devices on the network. Note The access point web-browser interface is fully compatible with Microsoft Internet Explorer (version 5.x or later) or Netscape Navigator (version 4.x). OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 4-1 Using the Web-Browser Interface for the First Time Chapter 4 Using the Web-Browser Interface Using the Web-Browser Interface for the First Time Use the access points IP address to browse to the management system. See the Obtaining and Assigning an IP Address section on page 3-3 for instructions on assigning an IP address to the access point. Follow these steps to begin using the web-browser interface:

Step 1 Step 2 Start the browser. Enter the access points IP address in the browser Location field (Netscape Communicator) or Address field (Internet Explorer) and press Enter. The Summary Status page appears. Using the Management Pages in the Web-Browser Interface The system management pages use consistent techniques to present and save configuration information. A navigation bar is on the left side of the page, and configuration action buttons appear at the bottom. You use the navigation bar to browse to other management pages, and you use the configuration action buttons to save or cancel changes to the configuration. Note Its important to remember that clicking your browsers Back button returns you to the previous page without saving any changes you have made. Clicking Cancel cancels any changes you made on the page and keeps you on that page. Changes are only applied when you click Apply. Figure 4-1 shows the web-browser interface home page. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 4-2 OL-3446-01 Chapter 4 Using the Web-Browser Interface Using the Management Pages in the Web-Browser Interface Figure 4-1 Web-Browser Interface Home Page OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 4-3 Using the Management Pages in the Web-Browser Interface Chapter 4 Using the Web-Browser Interface Using Action Buttons Table 4-1 lists the page links and buttons that appear on most management pages. Table 4-1 Common Buttons on Management Pages Button/Link Navigation Links Home Express Setup Network Map Association Network Interfaces Security Services System Software Event Log Description Displays access point status page with information on the number of radio devices associated to the access point, the status of the Ethernet and radio interfaces, and a list of recent access point activity. Displays the Express Setup page that includes basic settings such as system name, IP address, and SSID. Displays a list of infrastructure devices on your wireless LAN. Displays a list of all devices on your wireless LAN, listing their system names, network roles, and parent-client relationships. Displays status and statistics for the Ethernet and radio interfaces and provides links to configuration pages for each interface. Displays a summary of security settings and provides links to security configuration pages. Displays status for several access point features and links to configuration pages for Telnet/SSH, CDP, domain name server, filters, proxy Mobile IP, QoS, SNMP, SNTP, and VLANs. Displays the version number of the firmware that the access point is running and provides links to configuration pages for upgrading and managing firmware. Displays the access point event log and provides links to configuration pages where you can select events to be included in traps, set event severity levels, and set notification methods. Configuration Action Buttons Apply Refresh Cancel Back Saves changes made on the page and remains on the page. Updates status information or statistics displayed on a page. Discards changes to the page and remains on the page. Discards any changes made to the page and returns to the previous page. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 4-4 OL-3446-01 Chapter 4 Using the Web-Browser Interface Using Online Help Character Restrictions in Entry Fields Because the 1200 series access point uses Cisco IOS software, there are certain characters that you cannot use in the entry fields on the web-browser interface. Table 4-2 lists the illegal characters and the fields in which you cannot use them. Table 4-2 Illegal Characters for Web-Browser Interface Entry Fields Entry Field Type Password entry fields All other entry fields Illegal Characters

You also cannot use these three characters as the first character in an entry field:

Using Online Help Click the help icon at the top of any page in the web-browser interface to display online help. Figure 4-2 shows the print and help icons. Figure 4-2 Print and Help Icons When a help page appears in a new browser window, use the Select a topic drop-down menu to display the help index or instructions for common configuration tasks, such as configuring VLANs. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 4-5 Using Online Help Chapter 4 Using the Web-Browser Interface Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 4-6 OL-3446-01 C H A P T E R 5 Using the Command-Line Interface This chapter describes the IOS command-line interface (CLI) that you can use to configure your access point. It contains these sections:

IOS Command Modes, page 5-2 Getting Help, page 5-3 Abbreviating Commands, page 5-3 Using no and default Forms of Commands, page 5-3 Understanding CLI Messages, page 5-4 Using Command History, page 5-4 Using Editing Features, page 5-5 Searching and Filtering Output of show and more Commands, page 5-8 Accessing the CLI, page 5-8 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 5-1 IOS Command Modes IOS Command Modes Chapter 5 Using the Command-Line Interface The Cisco IOS user interface is divided into many different modes. The commands available to you depend on which mode you are currently in. Enter a question mark (?) at the system prompt to obtain a list of commands available for each command mode. When you start a session on the access point, you begin in user mode, often called user EXEC mode. Only a limited subset of the commands are available in user EXEC mode. For example, most of the user EXEC commands are one-time commands, such as show commands, which show the current configuration status, and clear commands, which clear counters or interfaces. The user EXEC commands are not saved when the access point reboots. To have access to all commands, you must enter privileged EXEC mode. Normally, you must enter a password to enter privileged EXEC mode. From this mode, you must enter privileged EXEC mode before you can enter the global configuration mode. Using the configuration modes (global, interface, and line), you can make changes to the running configuration. If you save the configuration, these commands are stored and used when the access point reboots. To access the various configuration modes, you must start at global configuration mode. From global configuration mode, you can enter interface configuration mode and line configuration mode. Table 5-1 describes the main command modes, how to access each one, the prompt you see in that mode, and how to exit the mode. The examples in the table use the host name ap. Table 5-1 Command Mode Summary Mode User EXEC Access Method Begin a session with your access point. Prompt ap>

Exit Method Enter logout or quit. About This Mode Use this mode to:

Change terminal settings Perform basic tests Display system information Use this mode to verify commands. Use a password to protect access to this mode. Use this mode to configure parameters that apply to the entire access point. Privileged EXEC While in user EXEC mode, enter the enable command. ap#

Enter disable to exit. ap(config)#

To exit to privileged EXEC mode, enter exit or end, or press Ctrl-Z. Global configuration While in privileged EXEC mode, enter the configure command. While in global configuration mode, enter the interface command (with a specific interface). Interface configuration ap(config-if)#

To exit to global configuration mode, enter exit. To return to privileged EXEC mode, press Ctrl-Z or enter end. Use this mode to configure parameters for the Ethernet and radio interfaces. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 5-2 OL-3446-01 Chapter 5 Using the Command-Line Interface Getting Help Getting Help You can enter a question mark (?) at the system prompt to display a list of commands available for each command mode. You can also obtain a list of associated keywords and arguments for any command, as shown in Table 5-2. Table 5-2 Help Summary Command help abbreviated-command-entry?

Purpose Obtains a brief description of the help system in any command mode. Obtains a list of commands that begin with a particular character string. For example:

ap# di?

dir disable disconnect abbreviated-command-entry<Tab>

Completes a partial command name. For example:

ap# sh conf<tab>

ap# show configuration

Lists all commands available for a particular command mode. For example:

ap> ?

command ?

Lists the associated keywords for a command. command keyword ?

Lists the associated arguments for a keyword. For example:

ap> show ?

For example:

ap(config)# cdp holdtime ?

<10-255> Length of time (in sec) that receiver must keep this packet Abbreviating Commands You have to enter only enough characters for the access point to recognize the command as unique. This example shows how to enter the show configuration privileged EXEC command:

ap# show conf Using no and default Forms of Commands Most configuration commands also have a no form. In general, use the no form to disable a feature or function or reverse the action of a command. For example, the no shutdown interface configuration command reverses the shutdown of an interface. Use the command without the keyword no to re-enable a disabled feature or to enable a feature that is disabled by default. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 5-3 Understanding CLI Messages Chapter 5 Using the Command-Line Interface Configuration commands can also have a default form. The default form of a command returns the command setting to its default. Most commands are disabled by default, so the default form is the same as the no form. However, some commands are enabled by default and have variables set to certain default values. In these cases, the default command enables the command and sets variables to their default values. Understanding CLI Messages Table 5-3 lists some error messages that you might encounter while using the CLI to configure your access point. Table 5-3 Common CLI Error Messages Error Message

% Ambiguous command:

"show con"

Meaning You did not enter enough characters for your access point to recognize the command. How to Get Help Re-enter the command followed by a question mark (?) with a space between the command and the question mark.

% Incomplete command. You did not enter all the keywords or values required by this command.

% Invalid input detected at ^ marker. You entered the command incorrectly. The caret (^) marks the point of the error. Using Command History The possible keywords that you can enter with the command are displayed. Re-enter the command followed by a question mark (?) with a space between the command and the question mark. The possible keywords that you can enter with the command are displayed. Enter a question mark (?) to display all the commands that are available in this command mode. The possible keywords that you can enter with the command are displayed. The IOS provides a history or record of commands that you have entered. This feature is particularly useful for recalling long or complex commands or entries, including access lists. You can customize the command history feature to suit your needs as described in these sections:

Changing the Command History Buffer Size, page 5-4 Recalling Commands, page 5-5 Disabling the Command History Feature, page 5-5 Changing the Command History Buffer Size By default, the access point records ten command lines in its history buffer. Beginning in privileged EXEC mode, enter this command to change the number of command lines that the access point records during the current terminal session:

ap# terminal history [size number-of-lines]

Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 5-4 OL-3446-01 Chapter 5 Using the Command-Line Interface Using Editing Features The range is from 0 to 256. Beginning in line configuration mode, enter this command to configure the number of command lines the access point records for all sessions on a particular line:

ap(config-line)# history [size number-of-lines]

The range is from 0 to 256. Recalling Commands To recall commands from the history buffer, perform one of the actions listed in Table 5-4:

Table 5-4 Recalling Commands Action1 Press Ctrl-P or the up arrow key. Press Ctrl-N or the down arrow key. show history Result Recall commands in the history buffer, beginning with the most recent command. Repeat the key sequence to recall successively older commands. Return to more recent commands in the history buffer after recalling commands with Ctrl-P or the up arrow key. Repeat the key sequence to recall successively more recent commands. While in privileged EXEC mode, list the last several commands that you just entered. The number of commands that are displayed is determined by the setting of the terminal history global configuration command and history line configuration command. 1. The arrow keys function only on ANSI-compatible terminals such as VT100s. Disabling the Command History Feature The command history feature is automatically enabled. To disable the feature during the current terminal session, enter the terminal no history privileged EXEC command. To disable command history for the line, enter the no history line configuration command. Using Editing Features This section describes the editing features that can help you manipulate the command line. It contains these sections:

Enabling and Disabling Editing Features, page 5-6 Editing Commands Through Keystrokes, page 5-6 Editing Command Lines that Wrap, page 5-7 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 5-5 Using Editing Features Chapter 5 Using the Command-Line Interface Enabling and Disabling Editing Features Although enhanced editing mode is automatically enabled, you can disable it. To re-enable the enhanced editing mode for the current terminal session, enter this command in privileged EXEC mode:

ap# terminal editing To reconfigure a specific line to have enhanced editing mode, enter this command in line configuration mode:

ap(config-line)# editing To globally disable enhanced editing mode, enter this command in line configuration mode:

ap(config-line)# no editing Editing Commands Through Keystrokes Table 5-5 shows the keystrokes that you need to edit command lines. Table 5-5 Editing Commands Through Keystrokes Capability Move around the command line to make changes or corrections. Keystroke1 Ctrl-B or the left arrow key Ctrl-F or the right arrow key Ctrl-A Ctrl-E Esc B Esc F Ctrl-T Recall commands from the buffer and paste them in the command line. The access point provides a buffer with the last ten items that you deleted. Ctrl-Y Esc Y Delete entries if you make a mistake or change your mind. Delete or Backspace Ctrl-D Ctrl-K Ctrl-U or Ctrl-X Ctrl-W Esc D Purpose Move the cursor back one character. Move the cursor forward one character. Move the cursor to the beginning of the command line. Move the cursor to the end of the command line. Move the cursor back one word. Move the cursor forward one word. Transpose the character to the left of the cursor with the character located at the cursor. Recall the most recent entry in the buffer. Recall the next buffer entry. The buffer contains only the last 10 items that you have deleted or cut. If you press Esc Y more than ten times, you cycle to the first buffer entry. Erase the character to the left of the cursor. Delete the character at the cursor. Delete all characters from the cursor to the end of the command line. Delete all characters from the cursor to the beginning of the command line. Delete the word to the left of the cursor. Delete from the cursor to the end of the word. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 5-6 OL-3446-01 Chapter 5 Using the Command-Line Interface Using Editing Features Table 5-5 Editing Commands Through Keystrokes (continued) Capability Capitalize or lowercase words or capitalize a set of letters. Designate a particular keystroke as an executable command, perhaps as a shortcut. Scroll down a line or screen on displays that are longer than the terminal screen can display. Note The More prompt appears for output that has more lines than can be displayed on the terminal screen, including show command output. You can use the Return and Space bar keystrokes whenever you see the More prompt. Redisplay the current command line if the access point suddenly sends a message to your screen. Keystroke1 Esc C Esc L Esc U Ctrl-V or Esc Q Purpose Capitalize at the cursor. Change the word at the cursor to lowercase. Capitalize letters from the cursor to the end of the word. Return Space Scroll down one line. Scroll down one screen. Ctrl-L or Ctrl-R Redisplay the current command line. 1. The arrow keys function only on ANSI-compatible terminals such as VT100s. Editing Command Lines that Wrap You can use a wraparound feature for commands that extend beyond a single line on the screen. When the cursor reaches the right margin, the command line shifts ten spaces to the left. You cannot see the first ten characters of the line, but you can scroll back and check the syntax at the beginning of the command. To scroll back to the beginning of the command entry, press Ctrl-B or the left arrow key repeatedly. You can also press Ctrl-A to immediately move to the beginning of the line. Note The arrow keys function only on ANSI-compatible terminals such as VT100s. In this example, the access-list global configuration command entry extends beyond one line. When the cursor first reaches the end of the line, the line is shifted ten spaces to the left and redisplayed. The dollar sign ($) shows that the line has been scrolled to the left. Each time the cursor reaches the end of the line, the line is again shifted ten spaces to the left. ap(config)# access-list 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1 ap(config)# $ 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1.20 255.25 ap(config)# $t tcp 131.108.2.5 255.255.255.0 131.108.1.20 255.255.255.0 eq ap(config)# $108.2.5 255.255.255.0 131.108.1.20 255.255.255.0 eq 45 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 5-7 Searching and Filtering Output of show and more Commands Chapter 5 Using the Command-Line Interface After you complete the entry, press Ctrl-A to check the complete syntax before pressing the Return key to execute the command. The dollar sign ($) appears at the end of the line to show that the line has been scrolled to the right:

ap(config)# access-list 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1$

The software assumes you have a terminal screen that is 80 columns wide. If you have a width other than that, use the terminal width privileged EXEC command to set the width of your terminal. Use line wrapping with the command history feature to recall and modify previous complex command entries. For information about recalling previous command entries, see the Editing Commands Through Keystrokes section on page 5-6. Searching and Filtering Output of show and more Commands You can search and filter the output for show and more commands. This is useful when you need to sort through large amounts of output or if you want to exclude output that you do not need to see. To use this functionality, enter a show or more command followed by the pipe character (|), one of the keywords begin, include, or exclude, and an expression that you want to search for or filter out:

command | {begin | include | exclude} regular-expression Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. This example shows how to include in the output display only lines where the expression protocol appears:

ap# show interfaces | include protocol Vlan1 is up, line protocol is up Vlan10 is up, line protocol is down GigabitEthernet0/1 is up, line protocol is down GigabitEthernet0/2 is up, line protocol is up Accessing the CLI You can open the access points CLI using Telnet or Secure Shell (SSH). Opening the CLI with Telnet Follow these steps to open the CLI with Telnet. These steps are for a PC running Microsoft Windows with a Telnet terminal application. Check your PC operating instructions for detailed instructions for your operating system. Step 1 Select Start > Programs > Accessories > Telnet. If Telnet is not listed in your Accessories menu, select Start > Run, type Telnet in the entry field, and press Enter. Step 2 When the Telnet window appears, click Connect and select Remote System. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 5-8 OL-3446-01 Chapter 5 Using the Command-Line Interface Accessing the CLI Note In Windows 2000, the Telnet window does not contain drop-down menus. To start the Telnet session in Windows 2000, type open followed by the access points IP address. Step 3 Step 4 In the Host Name field, type the access points IP address and click Connect. At the username and password prompts, enter your administrator username and password. The default username is Cisco, and the default password is Cisco. The default enable password is also Cisco. Usernames and passwords are case-sensitive. Opening the CLI with Secure Shell Secure Shell Protocol is a protocol that provides a secure, remote connection to networking devices set up to use it. Secure Shell (SSH) is a software package that provides secure login sessions by encrypting the entire session. SSH features strong cryptographic authentication, strong encryption, and integrity protection. For detailed information on SSH, visit the homepage of SSH Communications Security, Ltd. at this URL: http://www.ssh.com/

SSH provides more security for remote connections than Telnet by providing strong encryption when a device is authenticated. See the Configuring the Access Point for Secure Shell section on page 6-16 for detailed instructions on setting up the access point for SSH access. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 5-9 Accessing the CLI Chapter 5 Using the Command-Line Interface Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 5-10 OL-3446-01 C H A P T E R 6 Administering the Access Point This chapter describes how to administer your access point. This chapter contains these sections:

Preventing Unauthorized Access to Your Access Point, page 6-2 Protecting Access to Privileged EXEC Commands, page 6-2 Controlling Access Point Access with RADIUS, page 6-7 Controlling Access Point Access with TACACS+, page 6-12 Configuring the Access Point for Local Authentication and Authorization, page 6-15 Configuring the Access Point for Secure Shell, page 6-16 Managing the System Time and Date, page 6-17 Configuring a System Name and Prompt, page 6-32 Creating a Banner, page 6-34 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-1 Preventing Unauthorized Access to Your Access Point Chapter 6 Administering the Access Point Preventing Unauthorized Access to Your Access Point You can prevent unauthorized users from reconfiguring your access point and viewing configuration information. Typically, you want network administrators to have access to the access point while you restrict access to users who connect through a terminal or workstation from within the local network. To prevent unauthorized access to your access point, you should configure one of these security features:

Username and password pairs, which are locally stored on the access point. These pairs authenticate each user before that user can access the access point. You can also assign a specific privilege level

(read only or read/write) to each username and password pair. For more information, see the Configuring Username and Password Pairs section on page 6-5. The default username is Cisco, and the default password is Cisco. Usernames and passwords are case-sensitive. Username and password pairs stored centrally in a database on a security server. For more information, see the Controlling Access Point Access with RADIUS section on page 6-7. Protecting Access to Privileged EXEC Commands A simple way of providing terminal access control in your network is to use passwords and assign privilege levels. Password protection restricts access to a network or network device. Privilege levels define what commands users can issue after they have logged into a network device. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Security Command Reference for Release 12.2. This section describes how to control access to the configuration file and privileged EXEC commands. It contains this configuration information:

Default Password and Privilege Level Configuration, page 6-2 Setting or Changing a Static Enable Password, page 6-3 Protecting Enable and Enable Secret Passwords with Encryption, page 6-4 Configuring Username and Password Pairs, page 6-5 Configuring Multiple Privilege Levels, page 6-6 Default Password and Privilege Level Configuration Table 6-1 shows the default password and privilege level configuration. Table 6-1 Default Password and Privilege Levels Feature Username and password Enable password and privilege level Default Setting Default username is Cisco and the default password is Cisco. Default password is Cisco. The default is level 15 (privileged EXEC level). The password is encrypted in the configuration file. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-2 OL-3446-01 Chapter 6 Administering the Access Point Protecting Access to Privileged EXEC Commands Table 6-1 Default Password and Privilege Levels (continued) Feature Enable secret password and privilege level Line password Default Setting The default enable password is Cisco. The default is level 15 (privileged EXEC level). The password is encrypted before it is written to the configuration file. Default password is Cisco. The password is encrypted in the configuration file. Setting or Changing a Static Enable Password The enable password controls access to the privileged EXEC mode. Note The no enable password global configuration command removes the enable password, but you should use extreme care when using this command. If you remove the enable password, you are locked out of the EXEC mode. Beginning in privileged EXEC mode, follow these steps to set or change a static enable password:

Command configure terminal enable password password Step 1 Step 2 Step 3 Step 4 Step 5 end show running-config copy running-config startup-config Purpose Enter global configuration mode. Define a new password or change an existing password for access to privileged EXEC mode. The default password is Cisco. For password, specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces but ignores leading spaces. It can contain the question mark (?) character if you precede the question mark with the key combination Crtl-V when you create the password; for example, to create the password abc?123, do this:

1. Enter abc. 2. Enter Crtl-V. 3. Enter ?123. When the system prompts you to enter the enable password, you need not precede the question mark with the Ctrl-V; you can simply enter abc?123 at the password prompt. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. The enable password is not encrypted and can be read in the access point configuration file. This example shows how to change the enable password to l1u2c3k4y5. The password is not encrypted and provides access to level 15 (traditional privileged EXEC mode access):

AP(config)# enable password l1u2c3k4y5 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-3 Protecting Access to Privileged EXEC Commands Chapter 6 Administering the Access Point Protecting Enable and Enable Secret Passwords with Encryption To provide an additional layer of security, particularly for passwords that cross the network or that are stored on a Trivial File Transfer Protocol (TFTP) server, you can use either the enable password or enable secret global configuration commands. Both commands accomplish the same thing; that is, you can establish an encrypted password that users must enter to access privileged EXEC mode (the default) or any privilege level you specify. We recommend that you use the enable secret command because it uses an improved encryption algorithm. If you configure the enable secret command, it takes precedence over the enable password command;

the two commands cannot be in effect simultaneously. Beginning in privileged EXEC mode, follow these steps to configure encryption for enable and enable secret passwords:

Step 1 Step 2 Command configure terminal enable password [level level] {password |

encryption-type encrypted-password}

or enable secret [level level] {password |

encryption-type encrypted-password}

Step 3 service password-encryption Step 4 Step 5 end copy running-config startup-config Purpose Enter global configuration mode. Define a new password or change an existing password for access to privileged EXEC mode. or Define a secret password, which is saved using a nonreversible encryption method.

(Optional) For level, the range is from 0 to 15. Level 1 is normal user EXEC mode privileges. The default level is 15 (privileged EXEC mode privileges). For password, specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces but ignores leading spaces. By default, no password is defined.

(Optional) For encryption-type, only type 5, a Cisco proprietary encryption algorithm, is available. If you specify an encryption type, you must provide an encrypted passwordan encrypted password you copy from another access point configuration. Note If you specify an encryption type and then enter a clear text password, you can not re-enter privileged EXEC mode. You cannot recover a lost encrypted password by any method.

(Optional) Encrypt the password when the password is defined or when the configuration is written. Encryption prevents the password from being readable in the configuration file. Return to privileged EXEC mode.

(Optional) Save your entries in the configuration file. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-4 OL-3446-01 Chapter 6 Administering the Access Point Protecting Access to Privileged EXEC Commands If both the enable and enable secret passwords are defined, users must enter the enable secret password. Use the level keyword to define a password for a specific privilege level. After you specify the level and set a password, give the password only to users who need to have access at this level. Use the privilege level global configuration command to specify commands accessible at various levels. For more information, see the Configuring Multiple Privilege Levels section on page 6-6. If you enable password encryption, it applies to all passwords including username passwords, authentication key passwords, the privileged command password, and console and virtual terminal line passwords. To remove a password and level, use the no enable password [level level] or no enable secret [level level] global configuration command. To disable password encryption, use the no service password-encryption global configuration command. This example shows how to configure the encrypted password $1$FaD0$Xyti5Rkls3LoyxzS8 for privilege level 2:

AP(config)# enable secret level 2 5 $1$FaD0$Xyti5Rkls3LoyxzS8 Configuring Username and Password Pairs You can configure username and password pairs, which are locally stored on the access point. These pairs are assigned to lines or interfaces and authenticate each user before that user can access the access point. If you have defined privilege levels, you can also assign a specific privilege level (with associated rights and privileges) to each username and password pair. Beginning in privileged EXEC mode, follow these steps to establish a username-based authentication system that requests a login username and a password:

Step 1 Step 2 Command configure terminal username name [privilege level]

{password encryption-type password}

Step 3 login local Step 4 Step 5 Step 6 end show running-config copy running-config startup-config Purpose Enter global configuration mode. Enter the username, privilege level, and password for each user. For name, specify the user ID as one word. Spaces and quotation marks are not allowed.

(Optional) For level, specify the privilege level the user has after gaining access. The range is 0 to 15. Level 15 gives privileged EXEC mode access. Level 1 gives user EXEC mode access. For encryption-type, enter 0 to specify that an unencrypted password will follow. Enter 7 to specify that a hidden password will follow. For password, specify the password the user must enter to gain access to the access point. The password must be from 1 to 25 characters, can contain embedded spaces, and must be the last option specified in the username command. Enable local password checking at login time. Authentication is based on the username specified in Step 2. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-5 Protecting Access to Privileged EXEC Commands Chapter 6 Administering the Access Point To disable username authentication for a specific user, use the no username name global configuration command. To disable password checking and allow connections without a password, use the no login line configuration command. Note You must have at least one username configured and you must have login local set to open a Telnet session to the access point. If you enter no username for the only username, you can be locked out of the access point. Configuring Multiple Privilege Levels By default, the IOS software has two modes of password security: user EXEC and privileged EXEC. You can configure up to 16 hierarchical levels of commands for each mode. By configuring multiple passwords, you can allow different sets of users to have access to specified commands. For example, if you want many users to have access to the clear line command, you can assign it level 2 security and distribute the level 2 password fairly widely. But if you want more restricted access to the configure command, you can assign it level 3 security and distribute that password to a more restricted group of users. This section includes this configuration information:

Setting the Privilege Level for a Command, page 6-6 Logging Into and Exiting a Privilege Level, page 6-7 Setting the Privilege Level for a Command Beginning in privileged EXEC mode, follow these steps to set the privilege level for a command mode:

Command configure terminal privilege mode level level command Step 1 Step 2 Purpose Enter global configuration mode. Set the privilege level for a command. For mode, enter configure for global configuration mode, exec for EXEC mode, interface for interface configuration mode, or line for line configuration mode. For level, the range is from 0 to 15. Level 1 is for normal user EXEC mode privileges. Level 15 is the level of access permitted by the enable password. For command, specify the command to which you want to restrict access. Step 3 enable password level level password Specify the enable password for the privilege level. For level, the range is from 0 to 15. Level 1 is for normal user EXEC mode privileges. For password, specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces but ignores leading spaces. By default, no password is defined. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-6 OL-3446-01 Chapter 6 Administering the Access Point Controlling Access Point Access with RADIUS Command end show running-config or show privilege copy running-config startup-config Step 4 Step 5 Step 6 Purpose Return to privileged EXEC mode. Verify your entries. The first command displays the password and access level configuration. The second command displays the privilege level configuration.

(Optional) Save your entries in the configuration file. When you set a command to a privilege level, all commands whose syntax is a subset of that command are also set to that level. For example, if you set the show ip route command to level 15, the show commands and show ip commands are automatically set to privilege level 15 unless you set them individually to different levels. To return to the default privilege for a given command, use the no privilege mode level level command global configuration command. This example shows how to set the configure command to privilege level 14 and define SecretPswd14 as the password users must enter to use level 14 commands:

AP(config)# privilege exec level 14 configure AP(config)# enable password level 14 SecretPswd14 Logging Into and Exiting a Privilege Level Beginning in privileged EXEC mode, follow these steps to log in to a specified privilege level and to exit to a specified privilege level:

Command enable level Step 1 Step 2 disable level Purpose Log in to a specified privilege level. For level, the range is 0 to 15. Exit to a specified privilege level. For level, the range is 0 to 15. Controlling Access Point Access with RADIUS This section describes how to control administrator access to the access point using Remote Authentication Dial-In User Service (RADIUS). For complete instructions on configuring the access point to support RADIUS, see Chapter 11, Configuring RADIUS and TACACS+ Servers. RADIUS provides detailed accounting information and flexible administrative control over authentication and authorization processes. RADIUS is facilitated through AAA and can be enabled only through AAA commands. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Security Command Reference for Release 12.2. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-7 Controlling Access Point Access with RADIUS Chapter 6 Administering the Access Point These sections describe RADIUS configuration:

Default RADIUS Configuration, page 6-8 Configuring RADIUS Login Authentication, page 6-8 (required) Defining AAA Server Groups, page 6-9 (optional) Configuring RADIUS Authorization for User Privileged Access and Network Services, page 6-11

(optional) Displaying the RADIUS Configuration, page 6-12 Default RADIUS Configuration RADIUS and AAA are disabled by default. To prevent a lapse in security, you cannot configure RADIUS through a network management application. When enabled, RADIUS can authenticate users accessing the access point through the CLI. Configuring RADIUS Login Authentication To configure AAA authentication, you define a named list of authentication methods and then apply that list to various interfaces. The method list defines the types of authentication to be performed and the sequence in which they are performed; it must be applied to a specific interface before any of the defined authentication methods are performed. The only exception is the default method list (which, by coincidence, is named default). The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. A method list describes the sequence and authentication methods to be queried to authenticate a user. You can designate one or more security protocols to be used for authentication, thus ensuring a backup system for authentication in case the initial method fails. The software uses the first method listed to authenticate users; if that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cyclemeaning that the security server or local username database responds by denying the user accessthe authentication process stops, and no other authentication methods are attempted. Beginning in privileged EXEC mode, follow these steps to configure login authentication. This procedure is required. Command configure terminal aaa new-model Step 1 Step 2 Purpose Enter global configuration mode. Enable AAA. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-8 OL-3446-01 Chapter 6 Administering the Access Point Controlling Access Point Access with RADIUS Step 3 Command aaa authentication login {default |

list-name} method1 [method2...]

Step 4 Step 5 line [console | tty | vty] line-number

[ending-line-number]

login authentication {default |

list-name}

Purpose Create a login authentication method list. To create a default list that is used when a named list is not specified in the login authentication command, use the default keyword followed by the methods that are to be used in default situations. The default method list is automatically applied to all interfaces. For list-name, specify a character string to name the list you are creating. For method1..., specify the actual method the authentication algorithm tries. The additional methods of authentication are used only if the previous method returns an error, not if it fails. Select one of these methods:

localUse the local username database for authentication. You must enter username information in the database. Use the username password global configuration command. radiusUse RADIUS authentication. You must configure the RADIUS server before you can use this authentication method. For more information, see the Identifying the RADIUS Server Host section on page 11-4. Enter line configuration mode, and configure the lines to which you want to apply the authentication list. Apply the authentication list to a line or set of lines. If you specify default, use the default list created with the aaa authentication login command. For list-name, specify the list created with the aaa authentication login command. Step 6 Step 7 Step 8 end show running-config copy running-config startup-config Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable AAA, use the no aaa new-model global configuration command. To disable AAA authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global configuration command. To either disable RADIUS authentication for logins or to return to the default value, use the no login authentication {default | list-name} line configuration command. Defining AAA Server Groups You can configure the access point to use AAA server groups to group existing server hosts for authentication. You select a subset of the configured server hosts and use them for a particular service. The server group is used with a global server-host list, which lists the IP addresses of the selected server hosts. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-9 Controlling Access Point Access with RADIUS Chapter 6 Administering the Access Point Server groups also can include multiple host entries for the same server if each entry has a unique identifier (the combination of the IP address and UDP port number), allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. If you configure two different host entries on the same RADIUS server for the same service (such as accounting), the second configured host entry acts as a fail-over backup to the first one. You use the server group server configuration command to associate a particular server with a defined group server. You can either identify the server by its IP address or identify multiple host instances or entries by using the optional auth-port and acct-port keywords. Beginning in privileged EXEC mode, follow these steps to define the AAA server group and associate a particular RADIUS server with it:

Step 1 Step 2 Step 3 Command configure terminal aaa new-model radius-server host {hostname |

ip-address} [auth-port port-number]

[acct-port port-number] [timeout seconds] [retransmit retries] [key string]

Purpose Enter global configuration mode. Enable AAA. Specify the IP address or host name of the remote RADIUS server host.

(Optional) For auth-port port-number, specify the UDP destination port for authentication requests.

(Optional) For acct-port port-number, specify the UDP destination port for accounting requests.

(Optional) For timeout seconds, specify the time interval that the access point waits for the RADIUS server to reply before retransmitting. The range is 1 to 1000. This setting overrides the radius-server timeout global configuration command setting. If no timeout is set with the radius-server host command, the setting of the radius-server timeout command is used.

(Optional) For retransmit retries, specify the number of times a RADIUS request is resent to a server if that server is not responding or responding slowly. The range is 1 to 1000. If no retransmit value is set with the radius-server host command, the setting of the radius-server retransmit global configuration command is used.

(Optional) For key string, specify the authentication and encryption key used between the access point and the RADIUS daemon running on the RADIUS server. Note The key is a text string that must match the encryption key used on the RADIUS server. Always configure the key as the last item in the radius-server host command. Leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks are part of the key. To configure the access point to recognize more than one host entry associated with a single IP address, enter this command as many times as necessary, making sure that each UDP port number is different. The access point software searches for hosts in the order in which you specify them. Set the timeout, retransmit, and encryption key values to use with the specific RADIUS host. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-10 OL-3446-01 Chapter 6 Administering the Access Point Controlling Access Point Access with RADIUS Command aaa group server radius group-name Purpose Define the AAA server-group with a group name. Step 4 Step 5 server ip-address end show running-config copy running-config startup-config Step 6 Step 7 Step 8 Step 9 This command puts the access point in a server group configuration mode. Associate a particular RADIUS server with the defined server group. Repeat this step for each RADIUS server in the AAA server group. Each server in the group must be previously defined in Step 2. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Enable RADIUS login authentication. See the Configuring RADIUS Login Authentication section on page 6-8. To remove the specified RADIUS server, use the no radius-server host hostname | ip-address global configuration command. To remove a server group from the configuration list, use the no aaa group server radius group-name global configuration command. To remove the IP address of a RADIUS server, use the no server ip-address server group configuration command. In this example, the access point is configured to recognize two different RADIUS group servers (group1 and group2). Group1 has two different host entries on the same RADIUS server configured for the same services. The second host entry acts as a fail-over backup to the first entry. AP(config)# aaa new-model AP(config)# radius-server host 172.20.0.1 auth-port 1000 acct-port 1001 AP(config)# radius-server host 172.10.0.1 auth-port 1645 acct-port 1646 AP(config)# aaa group server radius group1 AP(config-sg-radius)# server 172.20.0.1 auth-port 1000 acct-port 1001 AP(config-sg-radius)# exit AP(config)# aaa group server radius group2 AP(config-sg-radius)# server 172.20.0.1 auth-port 2000 acct-port 2001 AP(config-sg-radius)# exit Configuring RADIUS Authorization for User Privileged Access and Network Services AAA authorization limits the services available to a user. When AAA authorization is enabled, the access point uses information retrieved from the users profile, which is in the local user database or on the security server, to configure the users session. The user is granted access to a requested service only if the information in the user profile allows it. You can use the aaa authorization global configuration command with the radius keyword to set parameters that restrict a users network access to privileged EXEC mode. The aaa authorization exec radius local command sets these authorization parameters:

Use RADIUS for privileged EXEC access authorization if authentication was performed by using RADIUS. Use the local database if authentication was not performed by using RADIUS. Note Authorization is bypassed for authenticated users who log in through the CLI even if authorization has been configured. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-11 Controlling Access Point Access with TACACS+

Chapter 6 Administering the Access Point Beginning in privileged EXEC mode, follow these steps to specify RADIUS authorization for privileged EXEC access and network services:

Command configure terminal aaa authorization network radius Step 1 Step 2 Step 3 aaa authorization exec radius Step 4 Step 5 Step 6 end show running-config copy running-config startup-config Purpose Enter global configuration mode. Configure the access point for user RADIUS authorization for all network-related service requests. Configure the access point for user RADIUS authorization to determine if the user has privileged EXEC access. The exec keyword might return user profile information (such as autocommand information). Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable authorization, use the no aaa authorization {network | exec} method1 global configuration command. Displaying the RADIUS Configuration To display the RADIUS configuration, use the show running-config privileged EXEC command. Controlling Access Point Access with TACACS+

This section describes how to control administrator access to the access point using Terminal Access Controller Access Control System Plus (TACACS+). For complete instructions on configuring the access point to support TACACS+, see Chapter 11, Configuring RADIUS and TACACS+ Servers. TACACS+ provides detailed accounting information and flexible administrative control over authentication and authorization processes. TACACS+ is facilitated through AAA and can be enabled only through AAA commands. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Security Command Reference for Release 12.2. These sections describe TACACS+ configuration:

Default TACACS+ Configuration, page 6-13 Configuring TACACS+ Login Authentication, page 6-13 Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services, page 6-14 Displaying the TACACS+ Configuration, page 6-15 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-12 OL-3446-01 Chapter 6 Administering the Access Point Controlling Access Point Access with TACACS+

Default TACACS+ Configuration TACACS+ and AAA are disabled by default. To prevent a lapse in security, you cannot configure TACACS+ through a network management application.When enabled, TACACS+ can authenticate administrators accessing the access point through the CLI. Configuring TACACS+ Login Authentication To configure AAA authentication, you define a named list of authentication methods and then apply that list to various interfaces. The method list defines the types of authentication to be performed and the sequence in which they are performed; it must be applied to a specific interface before any of the defined authentication methods are performed. The only exception is the default method list (which, by coincidence, is named default). The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. A defined method list overrides the default method list. A method list describes the sequence and authentication methods to be queried to authenticate a user. You can designate one or more security protocols to be used for authentication, thus ensuring a backup system for authentication in case the initial method fails. The software uses the first method listed to authenticate users; if that method fails, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cyclemeaning that the security server or local username database responds by denying the user accessthe authentication process stops, and no other authentication methods are attempted. Beginning in privileged EXEC mode, follow these steps to configure login authentication. This procedure is required. Command configure terminal aaa new-model Step 1 Step 2 Purpose Enter global configuration mode. Enable AAA. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-13 Controlling Access Point Access with TACACS+

Chapter 6 Administering the Access Point Step 3 Command aaa authentication login {default |

list-name} method1 [method2...]

Step 4 Step 5 line [console | tty | vty] line-number

[ending-line-number]

login authentication {default |

list-name}

Purpose Create a login authentication method list. To create a default list that is used when a named list is not specified in the login authentication command, use the default keyword followed by the methods that are to be used in default situations. The default method list is automatically applied to all interfaces. For list-name, specify a character string to name the list you are creating. For method1..., specify the actual method the authentication algorithm tries. The additional methods of authentication are used only if the previous method returns an error, not if it fails. Select one of these methods:

localUse the local username database for authentication. You must enter username information into the database. Use the username password global configuration command. tacacs+Use TACACS+ authentication. You must configure the TACACS+ server before you can use this authentication method. Enter line configuration mode, and configure the lines to which you want to apply the authentication list. Apply the authentication list to a line or set of lines. If you specify default, use the default list created with the aaa authentication login command. For list-name, specify the list created with the aaa authentication login command. Step 6 Step 7 Step 8 end show running-config copy running-config startup-config Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable AAA, use the no aaa new-model global configuration command. To disable AAA authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global configuration command. To either disable TACACS+ authentication for logins or to return to the default value, use the no login authentication {default | list-name} line configuration command. Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services AAA authorization limits the services available to a user. When AAA authorization is enabled, the access point uses information retrieved from the users profile, which is located either in the local user database or on the security server, to configure the users session. The user is granted access to a requested service only if the information in the user profile allows it. You can use the aaa authorization global configuration command with the tacacs+ keyword to set parameters that restrict a users network access to privileged EXEC mode. The aaa authorization exec tacacs+ local command sets these authorization parameters:

Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-14 OL-3446-01 Chapter 6 Administering the Access Point Configuring the Access Point for Local Authentication and Authorization Use TACACS+ for privileged EXEC access authorization if authentication was performed by using TACACS+. Use the local database if authentication was not performed by using TACACS+. Note Authorization is bypassed for authenticated users who log in through the CLI even if authorization has been configured. Beginning in privileged EXEC mode, follow these steps to specify TACACS+ authorization for privileged EXEC access and network services:

Command configure terminal aaa authorization network tacacs+

Step 1 Step 2 Step 3 aaa authorization exec tacacs+

Step 4 Step 5 Step 6 end show running-config copy running-config startup-config Purpose Enter global configuration mode. Configure the access point for user TACACS+ authorization for all network-related service requests. Configure the access point for user TACACS+ authorization to determine if the user has privileged EXEC access. The exec keyword might return user profile information (such as autocommand information). Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable authorization, use the no aaa authorization {network | exec} method1 global configuration command. Displaying the TACACS+ Configuration To display TACACS+ server statistics, use the show tacacs privileged EXEC command. Configuring the Access Point for Local Authentication and Authorization You can configure AAA to operate without a server by setting the access point to implement AAA in local mode. The access point then handles authentication and authorization. No accounting is available in this configuration. Beginning in privileged EXEC mode, follow these steps to configure the access point for local AAA:

Command configure terminal aaa new-model Step 1 Step 2 Purpose Enter global configuration mode. Enable AAA. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-15 Configuring the Access Point for Secure Shell Chapter 6 Administering the Access Point Command aaa authentication login default local Step 3 Step 4 aaa authorization exec local Step 5 aaa authorization network local Step 6 username name [privilege level]

{password encryption-type password}

Purpose Set the login authentication to use the local username database. The default keyword applies the local user database authentication to all interfaces. Configure user AAA authorization to determine if the user is allowed to run an EXEC shell by checking the local database. Configure user AAA authorization for all network-related service requests. Enter the local database, and establish a username-based authentication system. Repeat this command for each user. For name, specify the user ID as one word. Spaces and quotation marks are not allowed.

(Optional) For level, specify the privilege level the user has after gaining access. The range is 0 to 15. Level 15 gives privileged EXEC mode access. Level 0 gives user EXEC mode access. For encryption-type, enter 0 to specify that an unencrypted password follows. Enter 7 to specify that a hidden password follows. For password, specify the password the user must enter to gain access to the access point. The password must be from 1 to 25 characters, can contain embedded spaces, and must be the last option specified in the username command. Step 7 Step 8 Step 9 end show running-config copy running-config startup-config Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable AAA, use the no aaa new-model global configuration command. To disable authorization, use the no aaa authorization {network | exec} method1 global configuration command. Configuring the Access Point for Secure Shell This section describes how to configure the Secure Shell (SSH) feature. Note For complete syntax and usage information for the commands used in this section, refer to the Secure Shell Commands section in the Cisco IOS Security Command Reference for Release 12.2. Understanding SSH SSH is a protocol that provides a secure, remote connection to a Layer 2 or a Layer 3 device. There are two versions of SSH: SSH version 1 and SSH version 2. This software release supports only SSH version 1. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-16 OL-3446-01 Chapter 6 Administering the Access Point Managing the System Time and Date SSH provides more security for remote connections than Telnet by providing strong encryption when a device is authenticated. The SSH feature has an SSH server and an SSH integrated client. The client supports these user authentication methods:

RADIUS (for more information, see the Controlling Access Point Access with RADIUS section on page 6-7) Local authentication and authorization (for more information, see the Configuring the Access Point for Local Authentication and Authorization section on page 6-15) For more information about SSH, refer to the Configuring Secure Shell section in the Cisco IOS Security Configuration Guide for Release 12.2. Note The SSH feature in this software release does not support IP Security (IPSec). Configuring SSH Before configuring SSH, download the crypto software image from Cisco.com. For more information, refer to the release notes for this release. For information about configuring SSH and displaying SSH settings, refer to the Configuring Secure Shell section in the Cisco IOS Security Configuration Guide for Release 12.2. Managing the System Time and Date You can manage the system time and date on your access point automatically, using the Network Time Protocol (NTP), or manually, by setting the time and date on the access point. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.2. This section contains this configuration information:

Understanding the System Clock, page 6-17 Understanding Network Time Protocol, page 6-18 Configuring NTP, page 6-19 Configuring Time and Date Manually, page 6-27 Understanding the System Clock The heart of the time service is the system clock. This clock runs from the moment the system starts up and keeps track of the date and time. The system clock can then be set from these sources:

Network Time Protocol Manual configuration The system clock can provide time to these services:

OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-17 Managing the System Time and Date Chapter 6 Administering the Access Point User show commands Logging and debugging messages The system clock determines time internally based on Universal Time Coordinated (UTC), also known as Greenwich Mean Time (GMT). You can configure information about the local time zone and summer time (daylight saving time) so that the time is correctly displayed for the local time zone. The system clock keeps track of whether the time is authoritative or not (that is, whether it has been set by a time source considered to be authoritative). If it is not authoritative, the time is available only for display purposes and is not redistributed. For configuration information, see the Configuring Time and Date Manually section on page 6-27. Understanding Network Time Protocol The NTP is designed to time-synchronize a network of devices. NTP runs over User Datagram Protocol

(UDP), which runs over IP. NTP is documented in RFC 1305. An NTP network usually gets its time from an authoritative time source, such as a radio clock or an atomic clock attached to a time server. NTP then distributes this time across the network. NTP is extremely efficient; no more than one packet per minute is necessary to synchronize two devices to within a millisecond of one another. NTP uses the concept of a stratum to describe how many NTP hops away a device is from an authoritative time source. A stratum 1 time server has a radio or atomic clock directly attached, a stratum 2 time server receives its time through NTP from a stratum 1 time server, and so on. A device running NTP automatically chooses as its time source the device with the lowest stratum number with which it communicates through NTP. This strategy effectively builds a self-organizing tree of NTP speakers. NTP avoids synchronizing to a device whose time might not be accurate by never synchronizing to a device that is not synchronized. NTP also compares the time reported by several devices and does not synchronize to a device whose time is significantly different than the others, even if its stratum is lower. The communications between devices running NTP (known as associations) are usually statically configured; each device is given the IP address of all devices with which it should form associations. Accurate timekeeping is possible by exchanging NTP messages between each pair of devices with an association. However, in a LAN environment, NTP can be configured to use IP broadcast messages instead. This alternative reduces configuration complexity because each device can simply be configured to send or receive broadcast messages. However, in that case, information flow is one-way only. The time kept on a device is a critical resource; you should use the security features of NTP to avoid the accidental or malicious setting of an incorrect time. Two mechanisms are available: an access-list-based restriction scheme and an encrypted authentication mechanism. Ciscos implementation of NTP does not support stratum 1 service; it is not possible to connect to a radio or atomic clock. We recommend that the time service for your network be derived from the public NTP servers available on the IP Internet. Figure 6-1 shows a typical network example using NTP. If the network is isolated from the Internet, Ciscos implementation of NTP allows a device to act as though it is synchronized through NTP, when in fact it has determined the time by using other means. Other devices then synchronize to that device through NTP. When multiple sources of time are available, NTP is always considered to be more authoritative. NTP time overrides the time set by any other method. Several manufacturers include NTP software for their host systems, and a publicly available version for systems running UNIX and its various derivatives is also available. This software allows host systems to be time-synchronized as well. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-18 OL-3446-01 Chapter 6 Administering the Access Point Managing the System Time and Date Figure 6-1 Typical NTP Network Configuration Catalyst 6500 series switch

(NTP master) Local workgroup servers Catalyst 3550 switch Catalyst 3550 switch Catalyst 3550 switch These switches are configured in NTP server mode (server association) with the Catalyst 6500 series switch. Catalyst 3550 switch This switch is configured as an NTP peer to the upstream and downstream Catalyst 3550 switches. Workstations Catalyst 3550 switch Workstations 9 6 2 3 4 Configuring NTP Cisco Aironet 1100 Series Access Points do not have a hardware-supported clock, and they cannot function as an NTP master clock to which peers synchronize themselves when an external NTP source is not available. These access points also have no hardware support for a calendar. As a result, the ntp update-calendar and the ntp master global configuration commands are not available. This section contains this configuration information:

Default NTP Configuration, page 6-20 Configuring NTP Authentication, page 6-20 Configuring NTP Associations, page 6-22 Configuring NTP Broadcast Service, page 6-23 Configuring NTP Access Restrictions, page 6-24 Configuring the Source IP Address for NTP Packets, page 6-26 Displaying the NTP Configuration, page 6-27 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-19 Managing the System Time and Date Default NTP Configuration Chapter 6 Administering the Access Point Table 6-2 shows the default NTP configuration. Table 6-2 Default NTP Configuration Feature NTP authentication NTP peer or server associations NTP broadcast service NTP access restrictions NTP packet source IP address Default Setting Disabled. No authentication key is specified. None configured. Disabled; no interface sends or receives NTP broadcast packets. No access control is specified. The source address is determined by the outgoing interface. NTP is disabled by default. Configuring NTP Authentication This procedure must be coordinated with the administrator of the NTP server; the information you configure in this procedure must be matched by the servers used by the access point to synchronize its time to the NTP server. Beginning in privileged EXEC mode, follow these steps to authenticate the associations (communications between devices running NTP that provide for accurate timekeeping) with other devices for security purposes:

Command configure terminal ntp authenticate Step 1 Step 2 Step 3 ntp authentication-key number md5 value Purpose Enter global configuration mode. Enable the NTP authentication feature, which is disabled by default. Define the authentication keys. By default, none are defined. For number, specify a key number. The range is 1 to 4294967295. md5 specifies that message authentication support is provided by using the message digest algorithm 5 (MD5). For value, enter an arbitrary string of up to eight characters for the key. The access point does not synchronize to a device unless both have one of these authentication keys, and the key number is specified by the ntp trusted-key key-number command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-20 OL-3446-01 Chapter 6 Administering the Access Point Managing the System Time and Date Command ntp trusted-key key-number Step 4 Step 5 Step 6 Step 7 end show running-config copy running-config startup-config Purpose Specify one or more key numbers (defined in Step 3) that a peer NTP device must provide in its NTP packets for this access point to synchronize to it. By default, no trusted keys are defined. For key-number, specify the key defined in Step 3. This command provides protection against accidentally synchronizing the access point to a device that is not trusted. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable NTP authentication, use the no ntp authenticate global configuration command. To remove an authentication key, use the no ntp authentication-key number global configuration command. To disable authentication of the identity of a device, use the no ntp trusted-key key-number global configuration command. This example shows how to configure the access point to synchronize only to devices providing authentication key 42 in the devices NTP packets:

AP(config)# ntp authenticate AP(config)# ntp authentication-key 42 md5 aNiceKey AP(config)# ntp trusted-key 42 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-21 Managing the System Time and Date Configuring NTP Associations Chapter 6 Administering the Access Point An NTP association can be a peer association (this access point can either synchronize to the other device or allow the other device to synchronize to it), or it can be a server association (meaning that only this access point synchronizes to the other device, and not the other way around). Beginning in privileged EXEC mode, follow these steps to form an NTP association with another device:

Step 1 Step 2 Command configure terminal ntp peer ip-address [version number]

[key keyid] [source interface] [prefer]

Purpose Enter global configuration mode. Configure the access point system clock to synchronize a peer or to be synchronized by a peer (peer association). or ntp server ip-address [version number]

[key keyid] [source interface] [prefer]

or Configure the access point system clock to be synchronized by a time server (server association). No peer or server associations are defined by default. For ip-address in a peer association, specify either the IP address of the peer providing, or being provided, the clock synchronization. For a server association, specify the IP address of the time server providing the clock synchronization.

(Optional) For number, specify the NTP version number. The range is 1 to 3. By default, version 3 is selected.

(Optional) For keyid, enter the authentication key defined with the ntp authentication-key global configuration command.

(Optional) For interface, specify the interface from which to pick the IP source address. By default, the source IP address is taken from the outgoing interface.

(Optional) Enter the prefer keyword to make this peer or server the preferred one that provides synchronization. This keyword reduces switching back and forth between peers and servers. Step 3 Step 4 Step 5 end show running-config copy running-config startup-config Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. You need to configure only one end of an association; the other device can automatically establish the association. If you are using the default NTP version (version 3) and NTP synchronization does not occur, try using NTP version 2. Many NTP servers on the Internet run version 2. To remove a peer or server association, use the no ntp peer ip-address or the no ntp server ip-address global configuration command. This example shows how to configure the access point to synchronize its system clock with the clock of the peer at IP address 172.16.22.44 using NTP version 2:

AP(config)# ntp server 172.16.22.44 version 2 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-22 OL-3446-01 Chapter 6 Administering the Access Point Managing the System Time and Date Configuring NTP Broadcast Service The communications between devices running NTP (known as associations) are usually statically configured; each device is given the IP addresses of all devices with which it should form associations. Accurate timekeeping is possible by exchanging NTP messages between each pair of devices with an association. However, in a LAN environment, NTP can be configured to use IP broadcast messages instead. This alternative reduces configuration complexity because each device can simply be configured to send or receive broadcast messages. However, the information flow is one-way only. The access point can send or receive NTP broadcast packets on an interface-by-interface basis if there is an NTP broadcast server, such as a router, broadcasting time information on the network. The access point can send NTP broadcast packets to a peer so that the peer can synchronize to it. The access point can also receive NTP broadcast packets to synchronize its own clock. This section provides procedures for both sending and receiving NTP broadcast packets. Beginning in privileged EXEC mode, follow these steps to configure the access point to send NTP broadcast packets to peers so that they can synchronize their clock to the access point:

Command configure terminal interface interface-id ntp broadcast [version number] [key keyid]

[destination-address]

end show running-config copy running-config startup-config Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Purpose Enter global configuration mode. Enter interface configuration mode, and specify the interface to send NTP broadcast packets. Enable the interface to send NTP broadcast packets to a peer. By default, this feature is disabled on all interfaces.

(Optional) For number, specify the NTP version number. The range is 1 to 3. If you do not specify a version, version 3 is used.

(Optional) For keyid, specify the authentication key to use when sending packets to the peer.

(Optional) For destination-address, specify the IP address of the peer that is synchronizing its clock to this access point. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Configure the connected peers to receive NTP broadcast packets as described in the next procedure. To disable the interface from sending NTP broadcast packets, use the no ntp broadcast interface configuration command. This example shows how to configure an interface to send NTP version 2 packets:

AP(config)# interface gigabitethernet0/1 AP(config-if)# ntp broadcast version 2 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-23 Managing the System Time and Date Chapter 6 Administering the Access Point Beginning in privileged EXEC mode, follow these steps to configure the access point to receive NTP broadcast packets from connected peers:

Command configure terminal interface interface-id Step 1 Step 2 Step 3 ntp broadcast client Step 4 Step 5 exit ntp broadcastdelay microseconds Purpose Enter global configuration mode. Enter interface configuration mode, and specify the interface to receive NTP broadcast packets. Enable the interface to receive NTP broadcast packets. By default, no interfaces receive NTP broadcast packets. Return to global configuration mode.

(Optional) Change the estimated round-trip delay between the access point and the NTP broadcast server. Step 6 Step 7 Step 8 end show running-config copy running-config startup-config The default is 3000 microseconds; the range is 1 to 999999. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable an interface from receiving NTP broadcast packets, use the no ntp broadcast client interface configuration command. To change the estimated round-trip delay to the default, use the no ntp broadcastdelay global configuration command. This example shows how to configure an interface to receive NTP broadcast packets:

AP(config)# interface gigabitethernet0/1 AP(config-if)# ntp broadcast client Configuring NTP Access Restrictions You can control NTP access on two levels as described in these sections:

Creating an Access Group and Assigning a Basic IP Access List, page 6-25 Disabling NTP Services on a Specific Interface, page 6-26 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-24 OL-3446-01 Chapter 6 Administering the Access Point Managing the System Time and Date Creating an Access Group and Assigning a Basic IP Access List Beginning in privileged EXEC mode, follow these steps to control access to NTP services by using access lists:

Step 1 Step 2 Command configure terminal ntp access-group {query-only |

serve-only | serve | peer}

access-list-number Purpose Enter global configuration mode. Create an access group, and apply a basic IP access list. The keywords have these meanings:

query-onlyAllows only NTP control queries. Step 3 access-list access-list-number permit source [source-wildcard]

serve-onlyAllows only time requests. serveAllows time requests and NTP control queries, but does not allow the access point to synchronize to the remote device. peerAllows time requests and NTP control queries and allows the access point to synchronize to the remote device. For access-list-number, enter a standard IP access list number from 1 to 99. Create the access list. For access-list-number, enter the number specified in Step 2. Enter the permit keyword to permit access if the conditions are matched. For source, enter the IP address of the device that is permitted access to the access point.

(Optional) For source-wildcard, enter the wildcard bits to be applied to the source. Note When creating an access list, remember that, by default, the end of the access list contains an implicit deny statement for everything if it did not find a match before reaching the end. Step 4 Step 5 Step 6 end show running-config copy running-config startup-config Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. The access group keywords are scanned in this order, from least restrictive to most restrictive:

1. peerAllows time requests and NTP control queries and allows the access point to synchronize 2. itself to a device whose address passes the access list criteria. serveAllows time requests and NTP control queries, but does not allow the access point to synchronize itself to a device whose address passes the access list criteria. serve-onlyAllows only time requests from a device whose address passes the access list criteria. 3. 4. query-onlyAllows only NTP control queries from a device whose address passes the access list criteria. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-25 Managing the System Time and Date Chapter 6 Administering the Access Point If the source IP address matches the access lists for more than one access type, the first type is granted. If no access groups are specified, all access types are granted to all devices. If any access groups are specified, only the specified access types are granted. To remove access control to the access point NTP services, use the no ntp access-group {query-only |

serve-only | serve | peer} global configuration command. This example shows how to configure the access point to allow itself to synchronize to a peer from access list 99. However, the access point restricts access to allow only time requests from access list 42:

AP# configure terminal AP(config)# ntp access-group peer 99 AP(config)# ntp access-group serve-only 42 AP(config)# access-list 99 permit 172.20.130.5 AP(config)# access list 42 permit 172.20.130.6 Disabling NTP Services on a Specific Interface NTP services are enabled on all interfaces by default. Beginning in privileged EXEC mode, follow these steps to disable NTP packets from being received on an interface:

Command configure terminal interface interface-id ntp disable Purpose Enter global configuration mode. Enter interface configuration mode, and specify the interface to disable. Disable NTP packets from being received on the interface. end show running-config copy running-config startup-config By default, all interfaces receive NTP packets. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 To re-enable receipt of NTP packets on an interface, use the no ntp disable interface configuration command. Configuring the Source IP Address for NTP Packets When the access point sends an NTP packet, the source IP address is normally set to the address of the interface through which the NTP packet is sent. Use the ntp source global configuration command when you want to use a particular source IP address for all NTP packets. The address is taken from the specified interface. This command is useful if the address on an interface cannot be used as the destination for reply packets. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-26 OL-3446-01 Chapter 6 Administering the Access Point Managing the System Time and Date Beginning in privileged EXEC mode, follow these steps to configure a specific interface from which the IP source address is to be taken:

Command configure terminal ntp source type number Step 1 Step 2 Step 3 Step 4 Step 5 end show running-config copy running-config startup-config Purpose Enter global configuration mode. Specify the interface type and number from which the IP source address is taken. By default, the source address is determined by the outgoing interface. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. The specified interface is used for the source address for all packets sent to all destinations. If a source address is to be used for a specific association, use the source keyword in the ntp peer or ntp server global configuration command as described in the Configuring NTP Associations section on page 6-22. Displaying the NTP Configuration You can use two privileged EXEC commands to display NTP information:

show ntp associations [detail]

show ntp status For detailed information about the fields in these displays, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. Configuring Time and Date Manually If no other source of time is available, you can manually configure the time and date after the system is restarted. The time remains accurate until the next system restart. We recommend that you use manual configuration only as a last resort. If you have an outside source to which the access point can synchronize, you do not need to manually set the system clock. This section contains this configuration information:

Setting the System Clock, page 6-28 Displaying the Time and Date Configuration, page 6-28 Configuring the Time Zone, page 6-29 Configuring Summer Time (Daylight Saving Time), page 6-30 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-27 Managing the System Time and Date Setting the System Clock Chapter 6 Administering the Access Point If you have an outside source on the network that provides time services, such as an NTP server, you do not need to manually set the system clock. Beginning in privileged EXEC mode, follow these steps to set the system clock:

Command clock set hh:mm:ss day month year Step 1 or clock set hh:mm:ss month day year Purpose Manually set the system clock using one of these formats. For hh:mm:ss, specify the time in hours (24-hour format), minutes, and seconds. The time specified is relative to the configured time zone. Step 2 Step 3 show running-config copy running-config startup-config For day, specify the day by date in the month. For month, specify the month by name. For year, specify the year (no abbreviation). Verify your entries.

(Optional) Save your entries in the configuration file. This example shows how to manually set the system clock to 1:32 p.m. on July 23, 2001:

AP# clock set 13:32:00 23 July 2001 Displaying the Time and Date Configuration To display the time and date configuration, use the show clock [detail] privileged EXEC command. The system clock keeps an authoritative flag that shows whether the time is authoritative (believed to be accurate). If the system clock has been set by a timing source such as NTP, the flag is set. If the time is not authoritative, it is used only for display purposes. Until the clock is authoritative and the authoritative flag is set, the flag prevents peers from synchronizing to the clock when the peers time is invalid. The symbol that precedes the show clock display has this meaning:

*Time is not authoritative.

(blank)Time is authoritative. Time is authoritative, but NTP is not synchronized. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-28 OL-3446-01 Chapter 6 Administering the Access Point Configuring the Time Zone Managing the System Time and Date Beginning in privileged EXEC mode, follow these steps to manually configure the time zone:

Step 1 Step 2 Command configure terminal clock timezone zone hours-offset

[minutes-offset]

Purpose Enter global configuration mode. Set the time zone. The access point keeps internal time in universal time coordinated (UTC), so this command is used only for display purposes and when the time is manually set. For zone, enter the name of the time zone to be displayed when standard time is in effect. The default is UTC. For hours-offset, enter the hours offset from UTC.

(Optional) For minutes-offset, enter the minutes offset from UTC. Step 3 Step 4 Step 5 end show running-config copy running-config startup-config Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. The minutes-offset variable in the clock timezone global configuration command is available for those cases where a local time zone is a percentage of an hour different from UTC. For example, the time zone for some sections of Atlantic Canada (AST) is UTC-3.5, where the 3 means 3 hours and .5 means 50 percent. In this case, the necessary command is clock timezone AST -3 30. To set the time to UTC, use the no clock timezone global configuration command. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-29 Managing the System Time and Date Chapter 6 Administering the Access Point Configuring Summer Time (Daylight Saving Time) Beginning in privileged EXEC mode, follow these steps to configure summer time (daylight saving time) in areas where it starts and ends on a particular day of the week each year:

Step 1 Step 2 Command configure terminal clock summer-time zone recurring

[week day month hh:mm week day month hh:mm [offset]]

Purpose Enter global configuration mode. Configure summer time to start and end on the specified days every year. Summer time is disabled by default. If you specify clock summer-time zone recurring without parameters, the summer time rules default to the United States rules. For zone, specify the name of the time zone (for example, PDT) to be displayed when summer time is in effect.

(Optional) For week, specify the week of the month (1 to 5 or last).

(Optional) For day, specify the day of the week (Sunday, Monday...).

(Optional) For month, specify the month (January, February...).

(Optional) For hh:mm, specify the time (24-hour format) in hours and minutes.

(Optional) For offset, specify the number of minutes to add during summer time. The default is 60. Step 3 Step 4 Step 5 end show running-config copy running-config startup-config Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. The first part of the clock summer-time global configuration command specifies when summer time begins, and the second part specifies when it ends. All times are relative to the local time zone. The start time is relative to standard time. The end time is relative to summer time. If the starting month is after the ending month, the system assumes that you are in the southern hemisphere. This example shows how to specify that summer time starts on the first Sunday in April at 02:00 and ends on the last Sunday in October at 02:00:

AP(config)# clock summer-time PDT recurring 1 Sunday April 2:00 last Sunday October 2:00 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-30 OL-3446-01 Chapter 6 Administering the Access Point Managing the System Time and Date Beginning in privileged EXEC mode, follow these steps if summer time in your area does not follow a recurring pattern (configure the exact date and time of the next summer time events):

Step 1 Step 2 Command configure terminal clock summer-time zone date [month date year hh:mm month date year hh:mm

[offset]]

or clock summer-time zone date [date month year hh:mm date month year hh:mm [offset]]

Purpose Enter global configuration mode. Configure summer time to start on the first date and end on the second date. Summer time is disabled by default. For zone, specify the name of the time zone (for example, PDT) to be displayed when summer time is in effect.

(Optional) For week, specify the week of the month (1 to 5 or last).

(Optional) For day, specify the day of the week (Sunday, Monday...).

(Optional) For month, specify the month (January, February...).

(Optional) For hh:mm, specify the time (24-hour format) in hours and minutes.

(Optional) For offset, specify the number of minutes to add during summer time. The default is 60. Step 3 Step 4 Step 5 end show running-config copy running-config startup-config Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. The first part of the clock summer-time global configuration command specifies when summer time begins, and the second part specifies when it ends. All times are relative to the local time zone. The start time is relative to standard time. The end time is relative to summer time. If the starting month is after the ending month, the system assumes that you are in the southern hemisphere. To disable summer time, use the no clock summer-time global configuration command. This example shows how to set summer time to start on October 12, 2000, at 02:00, and end on April 26, 2001, at 02:00:

AP(config)# clock summer-time pdt date 12 October 2000 2:00 26 April 2001 2:00 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-31 Configuring a System Name and Prompt Chapter 6 Administering the Access Point Configuring a System Name and Prompt You configure the system name on the access point to identify it. By default, the system name and prompt are ap. If you have not configured a system prompt, the first 20 characters of the system name are used as the system prompt. A greater-than symbol (>) is appended. The prompt is updated whenever the system name changes, unless you manually configure the prompt by using the prompt global configuration command. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Configuration Fundamentals Command Reference and the Cisco IOS IP and IP Routing Command Reference for Release 12.1. This section contains this configuration information:

Default System Name and Prompt Configuration, page 6-32 Configuring a System Name, page 6-32 Understanding DNS, page 6-33 Default System Name and Prompt Configuration The default access point system name and prompt is ap. Configuring a System Name Beginning in privileged EXEC mode, follow these steps to manually configure a system name:

Command configure terminal hostname name Step 1 Step 2 Purpose Enter global configuration mode. Manually configure a system name. The default setting is ap. Step 3 Step 4 Step 5 end show running-config copy running-config startup-config The name must follow the rules for ARPANET host names. They must start with a letter, end with a letter or digit, and have as interior characters only letters, digits, and hyphens. Names can be up to 63 characters. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. When you set the system name, it is also used as the system prompt. To return to the default host name, use the no hostname global configuration command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-32 OL-3446-01 Chapter 6 Administering the Access Point Understanding DNS Configuring a System Name and Prompt The DNS protocol controls the Domain Name System (DNS), a distributed database with which you can map host names to IP addresses. When you configure DNS on your access point, you can substitute the host name for the IP address with all IP commands, such as ping, telnet, connect, and related Telnet support operations. IP defines a hierarchical naming scheme that allows a device to be identified by its location or domain. Domain names are pieced together with periods (.) as the delimiting characters. For example, Cisco Systems is a commercial organization that IP identifies by a com domain name, so its domain name is cisco.com. A specific device in this domain, such as the File Transfer Protocol (FTP) system, is identified as ftp.cisco.com. To keep track of domain names, IP has defined the concept of a domain name server, which holds a cache

(or database) of names mapped to IP addresses. To map domain names to IP addresses, you must first identify the host names, specify the name server that is present on your network, and enable the DNS. This section contains this configuration information:

Default DNS Configuration, page 6-33 Setting Up DNS, page 6-33 Displaying the DNS Configuration, page 6-34 Default DNS Configuration Table 6-3 shows the default DNS configuration. Table 6-3 Default DNS Configuration Feature DNS enable state DNS default domain name DNS servers Default Setting Disabled. None configured. No name server addresses are configured. Setting Up DNS Beginning in privileged EXEC mode, follow these steps to set up your access point to use the DNS:

Command configure terminal ip domain-name name Step 1 Step 2 Purpose Enter global configuration mode. Define a default domain name that the software uses to complete unqualified host names (names without a dotted-decimal domain name). Do not include the initial period that separates an unqualified name from the domain name. At boot time, no domain name is configured; however, if the access point configuration comes from a BOOTP or Dynamic Host Configuration Protocol

(DHCP) server, then the default domain name might be set by the BOOTP or DHCP server (if the servers were configured with this information). OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-33 Creating a Banner Chapter 6 Administering the Access Point Step 3 Command ip name-server server-address1

[server-address2 ... server-address6]

Step 4 ip domain-lookup Step 5 Step 6 Step 7 end show running-config copy running-config startup-config Purpose Specify the address of one or more name servers to use for name and address resolution. You can specify up to six name servers. Separate each server address with a space. The first server specified is the primary server. The access point sends DNS queries to the primary server first. If that query fails, the backup servers are queried.

(Optional) Enable DNS-based host name-to-address translation on your access point. This feature is enabled by default. If your network devices require connectivity with devices in networks for which you do not control name assignment, you can dynamically assign device names that uniquely identify your devices by using the global Internet naming scheme

(DNS). Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. If you use the access point IP address as its host name, the IP address is used and no DNS query occurs. If you configure a host name that contains no periods (.), a period followed by the default domain name is appended to the host name before the DNS query is made to map the name to an IP address. The default domain name is the value set by the ip domain-name global configuration command. If there is a period (.) in the host name, the IOS software looks up the IP address without appending any default domain name to the host name. To remove a domain name, use the no ip domain-name name global configuration command. To remove a name server address, use the no ip name-server server-address global configuration command. To disable DNS on the access point, use the no ip domain-lookup global configuration command. Displaying the DNS Configuration To display the DNS configuration information, use the show running-config privileged EXEC command. Creating a Banner You can configure a message-of-the-day (MOTD) and a login banner. The MOTD banner appears on all connected terminals at login and is useful for sending messages that affect all network users (such as impending system shutdowns). The login banner also appears on all connected terminals. It appears after the MOTD banner and before the login prompts. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.2. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-34 OL-3446-01 Chapter 6 Administering the Access Point Creating a Banner This section contains this configuration information:

Default Banner Configuration, page 6-35 Configuring a Message-of-the-Day Login Banner, page 6-35 Configuring a Login Banner, page 6-36 Default Banner Configuration The MOTD and login banners are not configured. Configuring a Message-of-the-Day Login Banner You can create a single or multiline message banner that appears on the screen when someone logs into the access point. Beginning in privileged EXEC mode, follow these steps to configure a MOTD login banner:

Command configure terminal banner motd c message c Step 1 Step 2 Purpose Enter global configuration mode. Specify the message of the day. For c, enter the delimiting character of your choice, such as a pound sign

(#), and press the Return key. The delimiting character signifies the beginning and end of the banner text. Characters after the ending delimiter are discarded. For message, enter a banner message up to 255 characters. You cannot use the delimiting character in the message. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Step 3 Step 4 Step 5 end show running-config copy running-config startup-config To delete the MOTD banner, use the no banner motd global configuration command. This example shows how to configure a MOTD banner for the access point using the pound sign (#) symbol as the beginning and ending delimiter:

AP(config)# banner motd #

This is a secure site. Only authorized users are allowed. For access, contact technical support.

AP(config)#

This example shows the banner displayed from the previous configuration:

Unix> telnet 172.2.5.4 Trying 172.2.5.4... Connected to 172.2.5.4. Escape character is '^]'. This is a secure site. Only authorized users are allowed. For access, contact technical support. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-35 Creating a Banner Chapter 6 Administering the Access Point User Access Verification Password:

Configuring a Login Banner You can configure a login banner to appear on all connected terminals. This banner appears after the MOTD banner and before the login prompt. Beginning in privileged EXEC mode, follow these steps to configure a login banner:

Command configure terminal banner login c message c Step 1 Step 2 Purpose Enter global configuration mode. Specify the login message. For c, enter the delimiting character of your choice, such as a pound sign

(#), and press the Return key. The delimiting character signifies the beginning and end of the banner text. Characters after the ending delimiter are discarded. For message, enter a login message up to 255 characters. You cannot use the delimiting character in the message. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Step 3 Step 4 Step 5 end show running-config copy running-config startup-config To delete the login banner, use the no banner login global configuration command. This example shows how to configure a login banner for the access point using the dollar sign ($) symbol as the beginning and ending delimiter:

AP(config)# banner login $

Access for authorized users only. Please enter your username and password.

AP(config)#

Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 6-36 OL-3446-01 C H A P T E R 7 Configuring Radio Settings This chapter describes how to configure radio settings for your access point. This chapter includes these sections:

Disabling and Enabling the Radio Interface, page 7-2 Configuring the Role in Radio Network, page 7-2 Configuring Radio Data Rates, page 7-4 Configuring Radio Transmit Power, page 7-5 Configuring Radio Channel Settings, page 7-7 Enabling and Disabling World-Mode, page 7-9 Disabling and Enabling Short Radio Preambles, page 7-9 Configuring Transmit and Receive Antennas, page 7-10 Disabling and Enabling Aironet Extensions, page 7-11 Configuring the Ethernet Encapsulation Transformation Method, page 7-12 Enabling and Disabling Reliable Multicast to Workgroup Bridges, page 7-12 Enabling and Disabling Public Secure Packet Forwarding, page 7-13 Configuring the Beacon Period and the DTIM, page 7-15 Configure RTS Threshold and Retries, page 7-15 Configuring the Maximum Data Retries, page 7-16 Configuring the Fragmentation Threshold, page 7-16 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-1 Disabling and Enabling the Radio Interface Chapter 7 Configuring Radio Settings Disabling and Enabling the Radio Interface The access point radios are enabled by default. Beginning in privileged EXEC mode, follow these steps to disable the access point radio:

Command configure terminal interface dot11radio { 0 | 1 }

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Disable the radio port. Return to privileged EXEC mode. shutdown end copy running-config startup-config (Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Use the no form of the shutdown command to enable the radio port. Configuring the Role in Radio Network You can configure your access point as a root device that is connected to the wired LAN or as a repeater

(non-root) device that is not connected to the wired LAN. Figure 7-1 shows a root access point and a repeater access point. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-2 OL-3446-01 Chapter 7 Configuring Radio Settings Configuring the Role in Radio Network Figure 7-1 Root and Repeater Access Points Access Point

(Root Unit) Wired LAN Access Point

(Repeater) 0 0 0 6 6 See Chapter 18, Configuring Repeater and Standby Access Points, for detailed instructions on setting up repeaters. You can also configure a fallback role for the access point radio. The access point automatically assumes the fallback role when its Ethernet port is disabled or disconnected from the wired LAN. There are two possible fallback roles:

RepeaterWhen the Ethernet port is disabled, the access point becomes a repeater and associates to a nearby root access point. ShutdownThe access point shuts down its radio and disassociates all client devices. Beginning in privileged EXEC mode, follow these steps to set the access points radio network role and fallback role:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-3 Configuring Radio Data Rates Chapter 7 Configuring Radio Settings Step 3 Command station role repeater | root

[ fallback { shutdown | repeater } ]

Purpose Set the access point role. Set the role to repeater or root.

(Optional) Select the radios fallback role. If the access points Ethernet port is disabled or disconnected from the wired LAN, the access point can either shut down its radio port or become a repeater access point associated to a nearby root access point. Step 4 Step 5 end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Configuring Radio Data Rates You use the data rate settings to choose the data rates the access point uses for data transmission. The rates are expressed in megabits per second. The access point always attempts to transmit at the highest data rate set to Basic, also called Require on the browser-based interface. If there are obstacles or interference, the access point steps down to the highest rate that allows data transmission. You can set each data rate (1, 2, 5.5, and 11 megabits per second) to one of three states:

Basic (this is the default state for all data rates)Allows transmission at this rate for all packets, both unicast and multicast. At least one of the access point's data rates must be set to Basic. EnabledThe access point transmits only unicast packets at this rate; multicast packets are sent at one of the data rates set to Basic. DisabledThe access point does not transmit data at this rate. Note At least one data rate must be set to basic. You can use the Data Rate settings to set up an access point to serve client devices operating at specific data rates. For example, to set up the 2.4-GHz radio for 11 megabits per second (Mbps) service only, set the 11-Mbps rate to Basic and set the other data rates to Enabled. To set up the access point to serve only client devices operating at 1 and 2 Mbps, set 1 and 2 to Basic and set the rest of the data rates to Enabled. To set up the 5-GHz radio for 54 Mbps service only, set the 54-Mbps rate to Basic and set the other data rates to Enabled. You can also configure the access point to set the data rates automatically to optimize either range or throughput. When you enter range for the data rate setting, the access point sets the 1 Mbps rate to basic and the other rates to enabled. When you enter throughput for the data rate setting, the access point sets all four data rates to basic. Beginning in privileged EXEC mode, follow these steps to configure the radio data rates:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-4 OL-3446-01 Chapter 7 Configuring Radio Settings Configuring Radio Transmit Power Command speed Step 3 These options are available for the 2.4-GHz radio:

{[1.0] [11.0] [2.0] [5.5] [basic-1.0]

[basic-11.0] [basic-2.0] [basic-5.5] |

range | throughput}

These options are available for the 5-GHz radio:

{[6.0] [9.0] [12.0] [18.0] [24.0]

[36.0] [48.0] [54.0] [basic-6.0]

[basic-9.0] [basic-12.0] [basic-18.0]

[basic-24.0] [basic-36.0]

[basic-48.0] [basic-54.0] |

range | throughput}

Purpose Set each data rate to basic or enabled, or enter range to optimize access point range or throughput to optimize throughput.

(Optional) Enter 1.0, 2.0, 5.5, and 11.0 to set these data rates to enabled on the 2.4-GHz radio. Enter 6.0, 9.0, 12.0, 18.0, 24.0, 36.0, 48.0, and 54.0 to set these data rates to enabled on the 5-GHz radio.

(Optional) Enter basic-1.0, basic-2.0, basic-5.5, and basic-11.0 to set these data rates to basic on the 2.4-GHz radio. Enter basic-6.0, basic-9.0, basic-12.0, basic-18.0, basic-24.0, basic-36.0, basic-48.0, and basic-54.0 to set these data rates to basic on the 5-GHz radio.

(Optional) Enter range or throughput to automatically optimize radio range or throughput. When you enter range, The access point sets the lowest data rate to basic and the other rates to enabled. When you enter throughput, the access point sets all data rates to basic. Step 4 Step 5 end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Use the no form of the speed command to disable data rates. When you use the no form of the command, all data rates are disabled except the rates you name in the command. This example shows how to disable data rate 1.0:

ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# no speed basic-2.0 basic-5.5 basic-11.0 ap1200(config-if)# end Data rate 1 is disabled, and the rest of the rates are set to basic. This example shows how to set up the access point for 11-Mbps service only:

ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# no speed basic-11.0 ap1200(config-if)# end Data rate 11 is set to basic, and the rest of the data rates are set to disabled. Configuring Radio Transmit Power Beginning in privileged EXEC mode, follow these steps to set the transmit power on your access point radio:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-5 Configuring Radio Transmit Power Chapter 7 Configuring Radio Settings Command power local Step 3 These options are available for the 2.4-GHz radio:

{ 1 | 5 | 20 | 30 | 50 | 100 | maximum }

Purpose Set the transmit power to one of the power levels allowed in your regulatory domain. All settings are in mW. Note The settings allowed in your regulatory domain might differ from the settings listed here. These options are available for the 5-GHz radio:

{ 5 | 10 | 20 | 40 | maximum }

end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Step 4 Step 5 Use the no form of the power command to return the power setting to maximum, the default setting. Limiting the Power Level for Associated Client Devices You can also limit the power level on client devices that associate to the access point. When a client device associates to the access point, the access point sends the maximum power level setting to the client. Beginning in privileged EXEC mode, follow these steps to specify a maximum allowed power setting on all client devices that associate to the access point:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Step 3 power client These options are available for 2.4-GHz clients:

{ 1 | 5 | 20 | 30 | 50 | 100 | maximum}

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Set the maximum power level allowed on client devices that associate to the access point. All settings are in mW. Note The settings allowed in your regulatory domain might differ from the settings listed here. These options are available for 5-GHz clients:

{ 5 | 10 | 20 | 40 | maximum }

end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Step 4 Step 5 Use the no form of the client power command to disable the maximum power level for associated clients. Note Aironet extensions must be enabled to limit the power level on associated client devices. Aironet extensions are enabled by default. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-6 OL-3446-01 Chapter 7 Configuring Radio Settings Configuring Radio Channel Settings Configuring Radio Channel Settings The default channel setting for the access point radios is least congested; at startup, the access point scans for and selects the least-congested channel. For most consistent performance after a site survey, however, we recomend that you assign a static channel setting for each access point. The channel settings on your access point correspond to the frequencies available in your regulatory domain. See Appendix C, Channels and Antenna Settings, for the frequencies allowed in your domain. Each 2.4-GHz channel covers 22 MHz. The bandwidth for channels 1, 6, and 11 does not overlap, so you can set up multiple access points in the same vicinity without causing interference. The 5-GHz radio operates on eight channels from 5180 to 5320 MHz. Each channel covers 20 MHz, and the bandwidth for the channels overlaps slightly. For best performance, use channels that are not adjacent

(44 and 46, for example) for radios that are close to each other. Note Too many access points in the same vicinity creates radio congestion that can reduce throughput. A careful site survey can determine the best placement of access points for maximum radio coverage and throughput. Beginning in privileged EXEC mode, follow these steps to set the access points radio channel:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-7 Configuring Radio Channel Settings Chapter 7 Configuring Radio Settings Step 3 Command channel frequency | least-congested Purpose Set the default channel for the access point radio. To search for the least-congested channel on startup, enter least-congested. These are the available frequencies (in MHz) for the 2.4-GHz radio:

channel 12412 (Americas, EMEA, Japan, and China) channel 22417 (Americas, EMEA, Japan, and China) channel 32422 (Americas, EMEA, Japan, Israel, and China) channel 42427 (Americas, EMEA, Japan, Israel, and China) channel 52432 (Americas, EMEA, Japan, Israel, and China) channel 62437 (Americas, EMEA, Japan, Israel, and China) channel 72442 (Americas, EMEA, Japan, Israel, and China) channel 82447 (Americas, EMEA, Japan, Israel, and China) channel 92452 (Americas, EMEA, Japan, Israel, and China) channel 102457 (Americas, EMEA, Japan, and China) channel 112462 (Americas, EMEA, Japan, and China) channel 122467 (EMEA and Japan only) channel 132472 (EMEA and Japan only) channel 142484 (Japan only) These are the available frequencies (in MHz) for the 5-GHz radio:

channel 345170 (Japan only) channel 365180 (Americas and Singapore) channel 385190 (Japan only) channel 405200 (Americas and Singapore) channel 425210 (Japan only) channel 445220 (Americas and Singapore) channel 465230 (Japan only) channel 485240 (Americas and Singapore) channel 525260 (Americas and Taiwan) channel 565280 (Americas and Taiwan) channel 605300 (Americas and Taiwan) channel 645320 (Americas and Taiwan) Step 4 Step 5 end copy running-config startup-config Note The frequencies allowed in your regulatory domain might differ from the frequencies listed here. Return to privileged EXEC mode.

(Optional) Save your entries in the configuration file. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-8 OL-3446-01 Chapter 7 Configuring Radio Settings Enabling and Disabling World-Mode Enabling and Disabling World-Mode When you enable world mode, the access point adds channel carrier set information to its beacon. Client devices with world mode enabled receive the carrier set information and adjust their settings automatically. For example, a client device used primarily in Japan could rely on world mode to adjust its channel and power settings automatically when it travels to Italy and joins a network there. World mode is disabled by default. World mode is not supported on the 5-GHz radio. Beginning in privileged EXEC mode, follow these steps to enable world mode:

Command configure terminal interface dot11radio 0 Purpose Enter global configuration mode. Enter interface configuration mode for the 2.4-GHz radio interface. Enable world mode. Return to privileged EXEC mode. world-mode end copy running-config startup-config (Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Use the no form of the command to disable world mode. Note Aironet extensions must be enabled for world mode operation. Aironet extensions are enabled by default. Disabling and Enabling Short Radio Preambles The radio preamble (sometimes called a header) is a section of data at the head of a packet that contains information that the access point and client devices need when sending and receiving packets. You can set the radio preamble to long or short:

ShortA short preamble improves throughput performance. Cisco Aironet Wireless LAN Client Adapters support short preambles. Early models of Cisco Aironet's Wireless LAN Adapter (PC4800 and PC4800A) require long preambles. LongA long preamble ensures compatibility between the access point and all early models of Cisco Aironet Wireless LAN Adapters (PC4800 and PC4800A). If these client devices do not associate to your access points, you should use short preambles. You cannot configure short or long radio preambles on the 5-GHz radio. Beginning in privileged EXEC mode, follow these steps to disable short radio preambles:

Command configure terminal interface dot11radio 0 Step 1 Step 2 Step 3 no preamble-short Purpose Enter global configuration mode. Enter interface configuration mode for the 2.4-GHz radio interface. Disable short preambles and enable long preambles. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-9 Configuring Transmit and Receive Antennas Chapter 7 Configuring Radio Settings Command end copy running-config startup-config (Optional) Save your entries in the configuration file. Purpose Return to privileged EXEC mode. Step 4 Step 5 Short preambles are enabled by default. Use the preamble-short command to enable short preambles if they are disabled. Configuring Transmit and Receive Antennas You can select the antenna the access point uses to receive and transmit data. There are three options for both the receive and the transmit antenna:

DiversityThis default setting tells the access point to use the antenna that receives the best signal. If your access point has two fixed (non-removeable) antennas, you should use this setting for both receive and transmit. RightIf your access point has removeable antennas and you install a high-gain antenna on the access point's right connector, you should use this setting for both receive and transmit. When you look at the access point's back panel, the right antenna is on the right. LeftIf your access point has removeable antennas and you install a high-gain antenna on the access point's left connector, you should use this setting for both receive and transmit. When you look at the access point's back panel, the left antenna is on the left. Beginning in privileged EXEC mode, follow these steps to select the antennas the access point uses to receive and transmit data:

Step 1 Step 2 Step 3 Command configure terminal interface dot11radio { 0 | 1 }

antenna receive

{diversity | left | right}

Step 4 antenna transmit

{diversity | left | right}

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Set the receive antenna to diversity, left, or right. Note For best performance, leave the receive antenna setting at the default setting, diversity. Set the transmit antenna to diversity, left, or right. Note For best performance, leave the transmit antenna setting at the default setting, diversity. Step 5 Step 6 end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-10 OL-3446-01 Chapter 7 Configuring Radio Settings Disabling and Enabling Aironet Extensions Disabling and Enabling Aironet Extensions By default, the access point uses Cisco Aironet 802.11 extensions to detect the capabilities of Cisco Aironet client devices and to support features that require specific interaction between the access point and associated client devices. Aironet extensions must be enabled to support these features:

Load balancingThe access point uses Aironet extensions to direct client devices to an access point that provides the best connection to the network based on factors such as number of users, bit error rates, and signal strength. Message Integrity Check (MIC)MIC is an additional WEP security feature that prevents attacks on encrypted packets called bit-flip attacks. The MIC, implemented on both the access point and all associated client devices, adds a few bytes to each packet to make the packets tamper-proof. Temporal Key Integrity Protocol (TKIP)TKIP, also known as WEP key hashing, is an additional WEP security feature that defends against an attack on WEP in which the intruder uses an unencrypted segment called the initialization vector (IV) in encrypted packets to calculate the WEP key. Repeater modeAironet extensions must be enabled on repeater access points and on the root access points to which they associate. World modeClient devices with world mode enabled receive carrier set information from the access point and adjust their settings automatically. Limiting the power level on associated client devicesWhen a client device associates to the access point, the access point sends the maximum allowed power level setting to the client. Disabling Aironet extensions disables the features listed above, but it sometimes improves the ability of non-Cisco client devices to associate to the access point. Aironet extensions are enabled by default. Beginning in privileged EXEC mode, follow these steps to disable Aironet extensions:

Command configure terminal interface dot11radio { 0 | 1 }

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Disable Aironet extensions. Return to privileged EXEC mode. no dot11 extension aironet end copy running-config startup-config (Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Use the dot11 extension aironet command to enable Aironet extensions if they are disabled. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-11 Configuring the Ethernet Encapsulation Transformation Method Chapter 7 Configuring Radio Settings Configuring the Ethernet Encapsulation Transformation Method When the access point receives data packets that are not 802.3 packets, the access point must format the packets to 802.3 using an encapsulation transformation method. These are the two transformation methods:

802.1HThis method provides optimum performance for Cisco Aironet wireless products. This is the default setting. RFC1042Use this setting to ensure interoperability with non-Cisco Aironet wireless equipment. RFC1042 does not provide the interoperability advantages of 802.1H but is used by other manufacturers of wireless equipment. Beginning in privileged EXEC mode, follow these steps to configure the encapsulation transformation method:

Command configure terminal interface dot11radio { 0 | 1 }

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Set the encapsulation transformation method to RFC1042

(snap) or 802.1h (dot1h, the default setting). payload-encapsulation snap | dot1h end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Step 1 Step 2 Step 3 Step 4 Step 5 Enabling and Disabling Reliable Multicast to Workgroup Bridges Reliable multicast messages from the access point to workgroup bridges allow approximately 20 Cisco Aironet Workgroup Bridges to associate to the access point. The default setting, disabled, allows more than 20 workgroup bridges to associate to the access point. Access points and bridges normally treat workgroup bridges not as client devices but as infrastructure devices, like access points or bridges. Treating a workgroup bridge as an infrastructure device means that the access point reliably delivers multicast packets, including Address Resolution Protocol (ARP) packets, to the workgroup bridge. The performance cost of reliable multicast deliveryduplication of each multicast packet sent to each workgroup bridgelimits the number of infrastructure devices, including workgroup bridges, that can associate to the access point. To increase beyond 20 the number of workgroup bridges that can associate to the access point, the access point must reduce the delivery reliability of multicast packets to workgroup bridges. With reduced reliability, the access point cannot confirm whether multicast packets reach the intended workgroup bridge, so workgroup bridges at the edge of the access point's coverage area might lose IP connectivity. When you treat workgroup bridges as client devices, you increase performance but reduce reliability. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-12 OL-3446-01 Chapter 7 Configuring Radio Settings Enabling and Disabling Public Secure Packet Forwarding Note This feature is best suited for use with stationary workgroup bridges. Mobile workgroup bridges might encounter spots in the access point's coverage area where they do not receive multicast packets and lose communication with the access point even though they are still associated to it. A Cisco Aironet Workgroup Bridge provides a wireless LAN connection for up to eight Ethernet-enabled devices. This feature is not supported on the 5-GHz radio. Beginning in privileged EXEC mode, follow these steps to configure the encapsulation transformation method:

Command configure terminal interface dot11radio 0 Purpose Enter global configuration mode. Enter interface configuration mode for the 2.4-GHz radio interface. Enable reliable multicast messages to workgroup bridges. Return to privileged EXEC mode. infrastructure-client end copy running-config startup-config (Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Use the no form of the command to disable reliable multicast messages to workgroup bridges. Enabling and Disabling Public Secure Packet Forwarding Public Secure Packet Forwarding (PSPF) prevents client devices associated to an access point from inadvertently sharing files or communicating with other client devices associated to the access point. It provides Internet access to client devices without providing other capabilities of a LAN. This feature is useful for public wireless networks like those installed in airports or on college campuses. Note To prevent communication between clients associated to different access points, you must set up protected ports on the switch to which your access points are connected. See the Configuring Protected Ports section on page 7-14 for instructions on setting up protected ports. To enable and disable PSPF using IOS commands on your access point, you use bridge groups. You can find a detailed explanation of bridge groups and instructions for implementing them in this document:

Cisco IOS Bridging and IBM Networking Configuration Guide, Release 12.2. Click this link to browse to the Configuring Transparent Bridging chapter:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fibm_c/bcfpart1/bcftb. htm You can also enable and disable PSPF using the web-browser interface. The PSPF setting is on the Radio Settings pages. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-13 Enabling and Disabling Public Secure Packet Forwarding Chapter 7 Configuring Radio Settings PSPF is disabled by default. Beginning in privileged EXEC mode, follow these steps to enable PSPF:

Command configure terminal interface dot11radio { 0 | 1 }

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. bridge-group group port-protected Enable PSPF. end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Step 1 Step 2 Step 3 Step 4 Step 5 Use the no form of the command to disable PSPF. Configuring Protected Ports To prevent communication between client devices associated to different access points on your wireless LAN, you must set up protected ports on the switch to which your access points are connected. Follow these steps to set up protected ports on your switch:

Beginning in privileged EXEC mode, follow these steps to define a port on your switch as a protected port:

Command configure terminal interface interface-id Purpose Enter global configuration mode. Enter interface configuration mode, and enter the type and number of the switchport interface to configure, such as gigabitethernet0/1. Configure the interface to be a protected port. Return to privileged EXEC mode. Verify your entries. switchport protected end show interfaces interface-id switchport copy running-config startup-config (Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 To disable protected port, use the no switchport protected interface configuration command. For detailed information on protected ports and port blocking, refer to the Configuring Port-Based Traffic Control chapter in the Catalyst 3550 Multilayer Switch Software Configuration Guide, 12.1(12c)EA1. Click this link to browse to that guide:

http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_guide_book09186a 008011591c.html Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-14 OL-3446-01 Chapter 7 Configuring Radio Settings Configuring the Beacon Period and the DTIM Configuring the Beacon Period and the DTIM The beacon period is the amount of time between access point beacons in Kilomicroseconds. One Ksec equals 1,024 microseconds. The Data Beacon Rate, always a multiple of the beacon period, determines how often the beacon contains a delivery traffic indication message (DTIM). The DTIM tells power-save client devices that a packet is waiting for them. For example, if the beacon period is set at 100, its default setting, and the data beacon rate is set at 2, its default setting, then the access point sends a beacon containing a DTIM every 200 Ksecs. One Ksec equals 1,024 microseconds. The default beacon period is 100, and the default DTIM is 2. Beginning in privileged EXEC mode, follow these steps to configure the beacon period and the DTIM:

Command configure terminal interface dot11radio { 0 | 1 }

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Set the beacon period. Enter a value in Kilomicroseconds. Set the DTIM. Enter a value in Kilomicroseconds. Return to privileged EXEC mode. beacon period value beacon dtim-period value end copy running-config startup-config (Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Configure RTS Threshold and Retries The RTS threshold determines the packet size at which the access point issues a request to send (RTS) before sending the packet. A low RTS Threshold setting can be useful in areas where many client devices are associating with the access point, or in areas where the clients are far apart and can detect only the access point and not each other. You can enter a setting ranging from 0 to 2339 bytes. Maximum RTS Retries is the maximum number of times the access point issues an RTS before stopping the attempt to send the packet over the radio. Enter a value from 1 to 128. The default RTS threshold is 2312, and the default maximum RTS retries setting is 32. Beginning in privileged EXEC mode, follow these steps to configure the RTS threshold and maximum RTS retries:

Command configure terminal interface dot11radio { 0 | 1 }

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Set the RTS threshold. Enter an RTS threshold from 0 to 2339. Set the maximum RTS retries. Enter a setting from 1 to 128. Return to privileged EXEC mode. rts threshold value rts retries value end copy running-config startup-config (Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Use the no form of the command to reset the RTS settings to defaults. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-15 Configuring the Maximum Data Retries Chapter 7 Configuring Radio Settings Configuring the Maximum Data Retries The maximum data retries setting determines the number of attempts the access point makes to send a packet before giving up and dropping the packet. The default setting is 32. Beginning in privileged EXEC mode, follow these steps to configure the maximum data retries:

Command configure terminal interface dot11radio { 0 | 1 }

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Set the maximum data retries. Enter a setting from 1 to 128. Return to privileged EXEC mode. packet retries value end copy running-config startup-config (Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Use the no form of the command to reset the setting to defaults. Configuring the Fragmentation Threshold The fragmentation threshold determines the size at which packets are fragmented (sent as several pieces instead of as one block). Use a low setting in areas where communication is poor or where there is a great deal of radio interference. The default setting is 2338 bytes. Beginning in privileged EXEC mode, follow these steps to configure the fragmentation threshold:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Step 3 fragment-threshold value Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Set the fragmentation threshold. Enter a setting from 256 to 2338 bytes for the 2.4-GHz radio. Enter a setting from 256 to 2346 bytes for the 5-GHz radio. Return to privileged EXEC mode. Step 4 Step 5 end copy running-config startup-config (Optional) Save your entries in the configuration file. Use the no form of the command to reset the setting to defaults. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 7-16 OL-3446-01 C H A P T E R 8 Configuring Multiple SSIDs This chapter describes how to configure and manage multiple service set identifiers (SSIDs) on the access point. This chapter contains these sections:

Understanding Multiple SSIDs, page 8-2 Configuring Multiple SSIDs, page 8-2 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 8-1 Understanding Multiple SSIDs Chapter 8 Configuring Multiple SSIDs Understanding Multiple SSIDs The SSID is a unique identifier that wireless networking devices use to establish and maintain wireless connectivity. Multiple access points on a network or sub-network can use the same SSIDs. SSIDs are case sensitive and can contain up to 32 alphanumeric characters. Do not include spaces in your SSIDs. You can configure up to 16 SSIDs on your 1200 series access point and assign different configuration settings to each SSID. All the SSIDs are active at the same time; that is, client devices can associate to the access point using any of the SSIDs. These are the settings you can assign to each SSID:

VLAN Client authentication method Note For detailed information on client authentication types, see Chapter 10, Configuring Authentication Types. Maximum number of client associations using the SSID Proxy mobile IP RADIUS accounting for traffic using the SSID Guest mode Repeater mode, including authentication username and password If you want the access point to allow associations from client devices that do not specify an SSID in their configurations, you can set up a guest SSID. The access point includes the guest SSID in its beacon. The access points default SSID, tsunami, is set to guest mode. However, to keep your network secure, you should disable the guest mode SSID on most access points. If your access point will be a repeater or will be a root access point that acts as a parent for a repeater, you can set up an SSID for use in repeater mode. You can assign an authentication username and password to the repeater-mode SSID to allow the repeater to authenticate to your network like a client device. If your network uses VLANs, you can assign an SSID to a VLAN, and client devices using the SSID are grouped in that VLAN. Configuring Multiple SSIDs These sections contain configuration information for multiple SSIDs:

Default SSID Configuration, page 8-3 Creating an SSID, page 8-3 Using a RADIUS Server to Restrict SSIDs, page 8-4 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 8-2 OL-3446-01 Chapter 8 Configuring Multiple SSIDs Configuring Multiple SSIDs Default SSID Configuration Table 8-1 shows the default SSID configuration:

Table 8-1 Default SSID Configuration Feature SSID Guest Mode SSID Default Setting tsunami tsunami (The access point broadcasts this SSID in its beacon and allows client devices with no SSID to associate.) Creating an SSID Beginning in privileged EXEC mode, follow these steps to create an SSID:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Step 3 ssid ssid-string Step 4 authentication client username username password password Step 5 accounting list-name Step 6 vlan vlan-id Step 7 guest-mode Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Create an SSID and enter SSID configuration mode for the new SSID. The SSID can consist of up to 32 alphanumeric characters. SSIDs are case sensitive. Note Do not include spaces in your SSIDs.

(Optional) Set an authentication username and password that the access point uses to authenticate to the network when in repeater mode. Set the username and password on the SSID that the repeater access point uses to associate to a root access point, or with another repeater.

(Optional) Enable RADIUS accounting for this SSID. For list-name, specify the accounting method list. Click this link for more information on method lists:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios 122/122cgcr/fsecur_c/fsaaa/scfacct.htm#xtocid2

(Optional) Assign the SSID to a VLAN on your network. Client devices that associate using the SSID are grouped into this VLAN.

(Optional) Designate the SSID as your access points guest-mode SSID. The access point includes the SSID in its beacon and allows associations from client devices that do not specify an SSID. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 8-3 Configuring Multiple SSIDs Chapter 8 Configuring Multiple SSIDs Command infrastructure-ssid [optional]

Step 8 Purpose

(Optional) Designate the SSID as the SSID that other access points and workgroup bridges use to associate to this access point. If you do not designate an SSID as the infrastructure SSID, infrastructure devices can associate to the access point using any SSID. If you designate an SSID as the infrastructure SSID, infrastructure devices must associate to the access point using that SSID unless you also enter the optional keyword. Return to privileged EXEC mode. Step 9 Step 10 end copy running-config startup-config (Optional) Save your entries in the configuration file. Note You use the ssid commands authentication options to configure an authentication type for each SSID. See Chapter 10, Configuring Authentication Types, for instructions on configuring authentication types. Use the no form of the command to disable the SSID or to disable SSID features. This example shows how to:

Name an SSID Configure the SSID for RADIUS accounting Set the maximum number of client devices that can associate using this SSID to 15 Assign the SSID to a VLAN ap1200# configure terminal ap1200(config)# configure interface dot11radio 0 ap1200(config-if)# ssid batman ap1200(config-ssid)# accounting accounting-method-list ap1200(config-ssid)# max-associations 15 ap1200(config-ssid)# vlan 3762 ap1200(config-ssid)# end Using a RADIUS Server to Restrict SSIDs To prevent client devices from associating to the access point using an unauthorized SSID, you can create a list of authorized SSIDs that clients must use on your RADIUS authentication server. The SSID authorization process consists of these steps:

1. A client device associates to the access point using any SSID configured on the access point. 2. The client begins RADIUS authentication. 3. The RADIUS server returns a list of SSIDs that the client is allowed to use. The access point checks the list for a match of the SSID used by the client. There are three possible outcomes:

a. b. If the SSID that the client used to associate to the access point matches an entry in the allowed list returned by the RADIUS server, the client is allowed network access after completing all authentication requirements. If the access point does not find a match for the client in the allowed list of SSIDs, the access point disassociates the client. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 8-4 OL-3446-01 Chapter 8 Configuring Multiple SSIDs Configuring Multiple SSIDs c. If the RADIUS server does not return any SSIDs (no list) for the client, then the administrator has not configured the list, and the client is allowed to associate and attempt to authenticate. The allowed list of SSIDs from the RADIUS server are in the form of Cisco VSAs. The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the access point and the RADIUS server by using the vendor-specific attribute

(attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option by using the format recommended in the specification. Ciscos vendor-ID is 9, and the supported option has vendor-type 1, which is named cisco-avpair. The Radius server is allowed to have zero or more SSID VSAs per client. In this example, the following AV pair adds the SSID batman to the list of allowed SSIDs for a user:

cisco-avpair= ssid=batman For instructions on configuring the access point to recognize and use VSAs, see the Configuring the Access Point to Use Vendor-Specific RADIUS Attributes section on page 11-13. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 8-5 Configuring Multiple SSIDs Chapter 8 Configuring Multiple SSIDs Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 8-6 OL-3446-01 C H A P T E R 9 Configuring WEP and WEP Features This chapter describes how to configure Wired Equivalent Privacy (WEP), Message Integrity Check

(MIC), Temporal Key Integrity Protocol (TKIP), and broadcast key rotation. This chapter contains these sections:

Understanding WEP, page 9-2 Configuring WEP and WEP Features, page 9-2 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 9-1 Understanding WEP Understanding WEP Chapter 9 Configuring WEP and WEP Features Just as anyone within range of a radio station can tune to the station's frequency and listen to the signal, any wireless networking device within range of an access point can receive the access point's radio transmissions. Because WEP is the first line of defense against intruders, Cisco recommends that you use full encryption on your wireless network. WEP encryption scrambles the communication between the access point and client devices to keep the communication private. Both the access point and client devices use the same WEP key to encrypt and unencrypt radio signals. WEP keys encrypt both unicast and multicast messages. Unicast messages are addressed to just one device on the network. Multicast messages are addressed to multiple devices on the network. Extensible Authentication Protocol (EAP) authentication provides dynamic WEP keys to wireless users. Dynamic WEP keys are more secure than static, or unchanging, WEP keys. If an intruder passively receives enough packets encrypted by the same WEP key, the intruder can perform a calculation to learn the key and use it to join your network. Because they change frequently, dynamic WEP keys prevent intruders from performing the calculation and learning the key. See Chapter 10, Configuring Authentication Types, for detailed information on EAP and other authentication types. Three additional security features defend your wireless network's WEP keys:

Message Integrity Check (MIC)MIC prevents attacks on encrypted packets called bit-flip attacks. During a bit-flip attack, an intruder intercepts an encrypted message, alters it slightly, and retransmits it, and the receiver accepts the retransmitted message as legitimate. The MIC, implemented on both the access point and all associated client devices, adds a few bytes to each packet to make the packets tamper proof. TKIP (Temporal Key Integrity Protocol, also known as WEP key hashing)This feature defends against an attack on WEP in which the intruder uses the unencrypted initialization vector (IV) in encrypted packets to calculate the WEP key. TKIP removes the predictability that an intruder relies on to determine the WEP key by exploiting IVs. Broadcast key rotationEAP authentication provides dynamic unicast WEP keys for client devices but uses static broadcast keys. When you enable broadcast WEP key rotation, the access point provides a dynamic broadcast WEP key and changes it at the interval you select. Broadcast key rotation is an excellent alternative to TKIP if your wireless LAN supports wireless client devices that are not Cisco devices or that cannot be upgraded to the latest firmware for Cisco client devices. Configuring WEP and WEP Features These sections describe how to configure WEP and additional WEP features such as MIC, TKIP, and broadcast key rotation:

Creating WEP Keys, page 9-3 Enabling and Disabling WEP and Enabling TKIP and MIC, page 9-3 Enabling and Disabling Broadcast Key Rotation, page 9-4 WEP, TKIP, MIC, and broadcast key rotation are disabled by default. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 9-2 OL-3446-01 Chapter 9 Configuring WEP and WEP Features Configuring WEP and WEP Features Creating WEP Keys Beginning in privileged EXEC mode, follow these steps to create a WEP key and set the key properties:

Step 1 Step 2 Step 3 Command configure terminal interface dot11radio { 0 | 1 }

encryption

[vlan vlan-id]

key 1-4 size { 40 | 128 } encryption-key

[transmit-key]

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Create a WEP key and set up its properties.

(Optional) Select the VLAN for which you want to create a key. Name the key slot in which this WEP key resides. You can assign up to 4 WEP keys for each VLAN. Enter the key and set the size of the key, either 40-bit or 128-bit. 40-bit keys contain 10 hexadecimal digits; 128-bit keys contain 26 hexadecimal digits.

(Optional) Set this key as the transmit key. The key in slot 1 is the transmit key by default, but you can set any key as the transmit key. Step 4 Step 5 end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. This example shows how to create a 128-bit WEP key in slot 1 for VLAN 22 and sets the key as the transmit key:

ap1200# configure terminal ap1200(config)# configure interface dot11radio 0 ap1200(config-if)# encryption vlan 22 key 1 size 128 12345678901234567890123456 transmit-key ap1200(config-ssid)# end Enabling and Disabling WEP and Enabling TKIP and MIC Beginning in privileged EXEC mode, follow these steps to enable WEP, TKIP, and MIC:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 9-3 Configuring WEP and WEP Features Chapter 9 Configuring WEP and WEP Features Step 3 Command encryption

[vlan vlan-id]

mode wep {optional [key-hash] |

mandatory [mic] [key-hash]}

Purpose Enable WEP, MIC, and TKIP.

(Optional) Select the VLAN for which you want to enable WEP and WEP features. Set the WEP level and enable TKIP and MIC. If you enter optional, client devices can associate to the access point with or without WEP enabled. You can enable TKIP with WEP set to optional but you cannot enable MIC. If you enter mandatory, client devices must have WEP enabled to associate to the access point. You can enable both TKIP and MIC with WEP set to mandatory. Step 4 Step 5 end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Use the no form of the encryption command to disable WEP or to disable WEP features. This example sets WEP to mandatory for VLAN 22 and enables MIC and TKIP. ap1200# configure terminal ap1200(config)# configure interface dot11radio 0 ap1200(config-if)# encryption vlan 22 mode wep mandatory mic key-hash ap1200(config-ssid)# end Enabling and Disabling Broadcast Key Rotation Broadcast key rotation is disabled by default. Beginning in privileged EXEC mode, follow these steps to enable broadcast key rotation:

Step 1 Step 2 Step 3 Command configure terminal interface dot11radio { 0 | 1 }

broadcast-key change seconds

[vlan vlan-id]

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Enable broadcast key rotation. Enter the number of seconds between each rotation of the broadcast key.

(Optional) Enter a VLAN for which you want to enable broadcast key rotation. Step 4 Step 5 end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Use the no form of the encryption command to disable broadcast key rotation. This example enables broadcast key rotation on VLAN 22 and sets the rotation interval to 300 seconds:

ap1200# configure terminal ap1200(config)# configure interface dot11radio 0 ap1200(config-if)# broadcast-key vlan 22 change 300 ap1200(config-ssid)# end Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 9-4 OL-3446-01 C H A P T E R 10 Configuring Authentication Types This chapter describes how to configure authentication types on the access point. This chapter contains these sections:

Understanding Authentication Types, page 10-2 Configuring Authentication Types, page 10-6 Matching Access Point and Client Device Authentication Types, page 10-9 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-1 Understanding Authentication Types Chapter 10 Configuring Authentication Types Understanding Authentication Types This section describes the authentication types that you can configure on the access point. The authentication types are tied to the SSIDs that you configure for the access point. If you want to serve different types of client devices with the same access point, you can configure multiple SSIDs. See Chapter 8, Configuring Multiple SSIDs, for complete instructions on configuring multiple SSIDs. Before a wireless client device can communicate on your network through the access point, it must authenticate to the access point using open or shared-key authentication. For maximum security, client devices should also authenticate to your network using MAC-address or EAP authentication, authentication types that rely on an authentication server on your network. The access point uses four authentication mechanisms or types and can use more than one at the same time. These sections explain each authentication type:

Open Authentication to the Access Point, page 10-2 Shared Key Authentication to the Access Point, page 10-2 EAP Authentication to the Network, page 10-3 MAC Address Authentication to the Network, page 10-5 Combining MAC-Based, EAP, and Open Authentication, page 10-5 Open Authentication to the Access Point Open authentication allows any device to authenticate and then attempt to communicate with the access point. Using open authentication, any wireless device can authenticate with the access point, but the device can communicate only if its WEP keys match the access points. Devices not using WEP do not attempt to authenticate with an access point that is using WEP. Open authentication does not rely on a RADIUS server on your network. Figure 10-1 shows the authentication sequence between a device trying to authenticate and an access point using open authentication. In this example, the devices WEP key does not match the access points key, so it can authenticate but not pass data. Figure 10-1 Sequence for Open Authentication Client device with WEP key = 321 1. Authentication request 2. Authentication response Access point or bridge with WEP key = 123 3 8 5 4 5 Shared Key Authentication to the Access Point Cisco provides shared key authentication to comply with the IEEE 802.11b standard. However, because of shared keys security flaws, we recommend that you avoid using it. During shared key authentication, the access point sends an unencrypted challenge text string to any device attempting to communicate with the access point. The device requesting authentication encrypts the challenge text and sends it back to the access point. If the challenge text is encrypted correctly, the Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-2 OL-3446-01 Chapter 10 Configuring Authentication Types Understanding Authentication Types access point allows the requesting device to authenticate. Both the unencrypted challenge and the encrypted challenge can be monitored, however, which leaves the access point open to attack from an intruder who calculates the WEP key by comparing the unencrypted and encrypted text strings. Because of this weakness, shared key authentication can be less secure than open authentication. Like open authentication, shared key authentication does not rely on a RADIUS server on your network. Figure 10-2 shows the authentication sequence between a device trying to authenticate and an access point using shared key authentication. In this example the devices WEP key matches the access points key, so it can authenticate and communicate. Figure 10-2 Sequence for Shared Key Authentication Client device with WEP key = 123 1. Authentication request 2. Unencrypted challenge 3. Encrypted challenge response 4. Authentication response Access point or bridge with WEP key = 123 4 8 5 4 5 EAP Authentication to the Network This authentication type provides the highest level of security for your wireless network. By using the Extensible Authentication Protocol (EAP) to interact with an EAP-compatible RADIUS server, the access point helps a wireless client device and the RADIUS server to perform mutual authentication and derive a dynamic unicast WEP key. The RADIUS server sends the WEP key to the access point, which uses it for all unicast data signals that it sends to or receives from the client. The access point also encrypts its broadcast WEP key (entered in the access points WEP key slot 1) with the clients unicast key and sends it to the client. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-3 Understanding Authentication Types Chapter 10 Configuring Authentication Types When you enable EAP on your access points and client devices, authentication to the network occurs in the sequence shown in Figure 10-3:

Figure 10-3 Sequence for EAP Authentication Wired LAN Client device Access point or bridge Server 1. Authentication request 2. Identity request 3. Username

(relay to client)

(relay to server) 4. Authentication challenge 5. Authentication response

(relay to server)

(relay to client) 6. Authentication success 7. Authentication challenge

(relay to server)

(relay to client) 8. Authentication response 9. Successful authentication

(relay to server) 3 8 5 5 6 In Steps 1 through 9 in Figure 10-3, a wireless client device and a RADIUS server on the wired LAN use 802.1x and EAP to perform a mutual authentication through the access point. The RADIUS server sends an authentication challenge to the client. The client uses a one-way encryption of the user-supplied password to generate a response to the challenge and sends that response to the RADIUS server. Using information from its user database, the RADIUS server creates its own response and compares that to the response from the client. When the RADIUS server authenticates the client, the process repeats in reverse, and the client authenticates the RADIUS server. When mutual authentication is complete, the RADIUS server and the client determine a WEP key that is unique to the client and provides the client with the appropriate level of network access, thereby approximating the level of security in a wired switched segment to an individual desktop. The client loads this key and prepares to use it for the logon session. During the logon session, the RADIUS server encrypts and sends the WEP key, called a session key, over the wired LAN to the access point. The access point encrypts its broadcast key with the session key and sends the encrypted broadcast key to the client, which uses the session key to decrypt it. The client and access point activate WEP and use the session and broadcast WEP keys for all communications during the remainder of the session. There is more than one type of EAP authentication, but the access point behaves the same way for each type: it relays authentication messages from the wireless client device to the RADIUS server and from the RADIUS server to the wireless client device. See the Assigning Authentication Types to an SSID section on page 10-6 for instructions on setting up EAP on the access point. Note If you use EAP authentication, you can select open or shared key authentication, but you dont have to. EAP authentication controls authentication both to your access point and to your network. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-4 OL-3446-01 Chapter 10 Configuring Authentication Types Understanding Authentication Types MAC Address Authentication to the Network The access point relays the wireless client devices MAC address to a RADIUS server on your network, and the server checks the address against a list of allowed MAC addresses. Intruders can create counterfeit MAC addresses, so MAC-based authentication is less secure than EAP authentication. However, MAC-based authentication provides an alternate authentication method for client devices that do not have EAP capability. See the Assigning Authentication Types to an SSID section on page 10-6 for instructions on enabling MAC-based authentication. Tip If you dont have a RADIUS server on your network, you can create a list of allowed MAC addresses on the access points Advanced Security: MAC Address Authentication page. Devices with MAC addresses not on the list are not allowed to authenticate. When you create the list of allowed MAC addresses, use lower case for all letters in the addresses that you enter. Figure 10-4 shows the authentication sequence for MAC-based authentication. Figure 10-4 Sequence for MAC-Based Authentication Wired LAN Client device Access point or bridge 1. Authentication request 2. Authentication success 3. Association request 4. Association response

(block traffic from client) Server 4 8 5 5 6 5. Authentication request 6. Success 7. Access point or bridge unblocks traffic from client Combining MAC-Based, EAP, and Open Authentication You can set up the access point to authenticate client devices using a combination of MAC-based and EAP authentication. When you enable this feature, client devices that associate to the access point using 802.11 open authentication first attempt MAC authentication; if MAC authentication succeeds, the client device joins the network. If MAC authentication fails, the access point waits for the client device to attempt EAP authentication. See the Assigning Authentication Types to an SSID section on page 10-6 for instructions on setting up this combination of authentications. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-5 Configuring Authentication Types Chapter 10 Configuring Authentication Types Configuring Authentication Types This section describes how to configure authentication types. You attach configuration types to the access points SSIDs. See Chapter 8, Configuring Multiple SSIDs, for details on setting up multiple SSIDs. This section contains these topics:

Default Authentication Settings, page 10-6 Assigning Authentication Types to an SSID, page 10-6 Configuring Authentication Holdoffs, Timeouts, and Intervals, page 10-8 Default Authentication Settings The default SSID on the access point is tsunami. Table 10-1 shows the default authentication settings for the default SSID:

Table 10-1 Default Authentication Configuration Feature SSID Guest Mode SSID Authentication type assigned to tsunami Assigning Authentication Types to an SSID Default Setting tsunami tsunami (The access point broadcasts this SSID in its beacon and allows client devices with no SSID to associate.) open Beginning in privileged EXEC mode, follow these steps to configure authentication types for SSIDs:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Step 3 ssid ssid-string Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Create an SSID and enter SSID configuration mode for the new SSID. The SSID can consist of up to 32 alphanumeric characters. SSIDs are case sensitive. Note Do not include spaces in SSIDs. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-6 OL-3446-01 Chapter 10 Configuring Authentication Types Configuring Authentication Types Step 4 Command authentication open

[mac-address list-name [alternate]]

[eap list-name]

Purpose

(Optional) Set the authentication type to open for this SSID. Open authentication allows any device to authenticate and then attempt to communicate with the access point.

(Optional) Set the SSIDs authentication type to open with MAC address authentication. The access point forces all client devices to perform MAC-address authentication before they are allowed to join the network. For list-name, specify the authentication method list. Click this link for more information on method lists:

http://www.cisco.com/univercd/cc/td/doc/product/softwar e/ios122/122cgcr/fsecur_c/fsaaa/scfathen.htm#xtocid2 Use the alternate keyword to allow client devices to join the network using either MAC or EAP authentication;

clients that successfully complete either authentication are allowed to join the network.

(Optional) Set the SSIDs authentication type to open with EAP authentication. The access point forces all client devices to perform EAP authentication before they are allowed to join the network. For list-name, specify the authentication method list. Note An access point configured for EAP authentication forces all client devices that associate to perform EAP authentication. Client devices that do not use EAP cannot use the access point.

(Optional) Set the authentication type for the SSID to shared key. Note Note Because of shared key's security flaws, Cisco recommends that you avoid using it. You can assign shared key athentication to only one SSID.

(Optional) Set the SSIDs authentication type to shared key with MAC address authentication. For list-name, specify the authentication method list.

(Optional) Set the SSIDs authentication type to shared key with EAP authentication. For list-name, specify the authentication method list. Step 5 authentication shared

[mac-address list-name]

[eap list-name]

OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-7 Configuring Authentication Types Chapter 10 Configuring Authentication Types Step 6 Command authentication network-eap list-name

[mac-address list-name]

Purpose

(Optional) Set the authentication type for the SSID to Network-EAP. Using the Extensible Authentication Protocol

(EAP) to interact with an EAP-compatible RADIUS server, the access point helps a wireless client device and the RADIUS server to perform mutual authentication and derive a dynamic unicast WEP key. However, the access point does not force all client devices to perform EAP authentication.

(Optional) Set the SSIDs authentication type to Network-EAP with MAC address authentication. All client devices that associate to the access point are required to perform MAC-address authentication. For list-name, specify the authentication method list. Step 7 Step 8 end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Use the no form of the SSID commands to disable the SSID or to disable SSID features. This example sets the authentication type for the SSID batman to open with a combination of MAC-address and EAP authentication. Client devices using the batman SSID first attempt MAC-address authentication using a server named adam. If MAC authentication succeeds, they join the network, but if it fails, they attempt EAP authentication using the same server. ap1200# configure terminal ap1200(config)# configure interface dot11radio 0 ap1200(config-if)# ssid batman ap1200(config-ssid)# authentication open mac adam alternate eap adam ap1200(config-ssid)# end Configuring Authentication Holdoffs, Timeouts, and Intervals Beginning in privileged EXEC mode, follow these steps to configure holdoff times, reauthentication periods, and authentication timeouts for client devices authenticating through your access point:

Command configure terminal dot11 holdoff-time seconds Step 1 Step 2 Step 3 interface dot11radio { 0 | 1 }

Step 4 dot1x client-timeout seconds Purpose Enter global configuration mode. Enter the number of seconds a client device must wait before it can reattempt to authenticate following a failed authentication. Enter a value from 1 to 65555 seconds. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Enter the number of seconds the access point should wait for a reply from a client attempting to authenticate before the authentication fails. Enter a value from 1 to 65555 seconds. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-8 OL-3446-01 Chapter 10 Configuring Authentication Types Matching Access Point and Client Device Authentication Types Step 5 Command dot1x reauth-period seconds

[server]

Purpose Enter the interval in seconds that the access point waits before forcing an authenticated client to reauthenticate.

(Optional) Enter the server keyword to configure the access point to use the rauthentication period specified by the authentication server. If you use this option, configure your authentication server with RADIUS attribute 27, Session-Timeout. This attribute sets the maximum number of seconds of service to be provided to the client before termination of the session or prompt. The server sends this attribute to the access point when a client device performs EAP authentication. Step 6 Step 7 end copy running-config startup-config (Optional) Save your entries in the configuration file. Return to privileged EXEC mode. Use the no form of these commands to reset the values to default settings. Matching Access Point and Client Device Authentication Types To use the authentication types described in this section, the access point authentication settings must match the authentication settings on the client adapters that associate to the access point. Refer to the Cisco Aironet Wireless LAN Client Adapters Installation and Configuration Guide for Windows for instructions on setting authentication types on wireless client adapters. Refer to Chapter 9, Configuring WEP and WEP Features, for instructions on configuring WEP on the access point. Table 10-2 lists the client and access point settings required for each authentication type. Table 10-2 Client and Access Point Security Settings Security Feature Static WEP with open authentication Static WEP with shared key authentication LEAP authentication Client Setting Create a WEP key and enable Use Static WEP Keys and Open Authentication Create a WEP key and enable Use Static WEP Keys and Shared Key Authentication Enable LEAP Access Point Setting Set up and enable WEP and enable Open Authentication Set up and enable WEP and enable Shared Key Authentication Set up and enable WEP and enable Network-EAP OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-9 Matching Access Point and Client Device Authentication Types Chapter 10 Configuring Authentication Types Table 10-2 Client and Access Point Security Settings (continued) Security Feature EAP-TLS authentication If using ACU to configure card If using Windows XP to configure card EAP-MD5 authentication If using ACU to configure card If using Windows XP to configure card PEAP authentication If using ACU to configure card If using Windows XP to configure card Client Setting Access Point Setting Enable Host Based EAP and Use Dynamic WEP Keys in ACU and select Enable network access control using IEEE 802.1X and Smart Card or Other Certificate as the EAP Type in Windows 2000

(with Service Pack 3) or Windows XP Select Enable network access control using IEEE 802.1X and Smart Card or other Certificate as the EAP Type Create a WEP key, enable Host Based EAP, and enable Use Static WEP Keys in ACU and select Enable network access control using IEEE 802.1X and MD5-Challenge as the EAP Type in Windows 2000 (with Service Pack 3) or Windows XP Select Enable network access control using IEEE 802.1X and MD5-Challenge as the EAP Type Enable Host Based EAP and Use Dynamic WEP Keys in ACU and select Enable network access control using IEEE 802.1X and PEAP as the EAP Type in Windows 2000 (with Service Pack 3) or Windows XP Select Enable network access control using IEEE 802.1X and PEAP as the EAP Type Set up and enable WEP and enable EAP and Open authentication Set up and enable WEP and enable EAP and Open Authentication Set up and enable WEP and enable EAP and Open authentication Set up and enable WEP and enable EAP and Open Authentication Set up and enable WEP and enable EAP and Open authentication Set up and enable WEP and enable Require EAP and Open Authentication Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-10 OL-3446-01 Chapter 10 Configuring Authentication Types Matching Access Point and Client Device Authentication Types Table 10-2 Client and Access Point Security Settings (continued) Security Feature EAP-SIM authentication If using ACU to configure card If using Windows XP to configure card Client Setting Access Point Setting Enable Host Based EAP and Use Dynamic WEP Keys in ACU and select Enable network access control using IEEE 802.1X and SIM Authentication as the EAP Type in Windows 2000 (with Service Pack 3) or Windows XP Select Enable network access control using IEEE 802.1X and SIM Authentication as the EAP Type Set up and enable WEP with full encryption and enable EAP and Open authentication Set up and enable WEP with full encryption and enable Require EAP and Open Authentication OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-11 Matching Access Point and Client Device Authentication Types Chapter 10 Configuring Authentication Types Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 10-12 OL-3446-01 C H A P T E R 11 Configuring RADIUS and TACACS+ Servers This chapter describes how to enable and configure the Remote Authentication Dial-In User Service

(RADIUS) and Terminal Access Controller Access Control System Plus (TACACS+), which provide detailed accounting information and flexible administrative control over authentication and authorization processes. RADIUS and TACACS+ are facilitated through AAA and can be enabled only through AAA commands. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco IOS Security Command Reference for Release 12.2. This chapter contains these sections:

Configuring and Enabling RADIUS, page 11-2 Configuring and Enabling TACACS+, page 11-16 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-1 Configuring and Enabling RADIUS Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling RADIUS This section describes how to configure and enable RADIUS. These sections describe RADIUS configuration:

Understanding RADIUS, page 11-2 RADIUS Operation, page 11-3 Configuring RADIUS, page 11-4 Displaying the RADIUS Configuration, page 11-15 Understanding RADIUS RADIUS is a distributed client/server system that secures networks against unauthorized access. RADIUS clients run on supported Cisco devices and send authentication requests to a central RADIUS server, which contains all user authentication and network service access information. The RADIUS host is normally a multiuser system running RADIUS server software from Cisco (Cisco Secure Access Control Server version 3.0), Livingston, Merit, Microsoft, or another software provider. For more information, refer to the RADIUS server documentation. Use RADIUS in these network environments, which require access security:

Networks with multiple-vendor access servers, each supporting RADIUS. For example, access servers from several vendors use a single RADIUS server-based security database. In an IP-based network with multiple vendors access servers, dial-in users are authenticated through a RADIUS server that is customized to work with the Kerberos security system. Turnkey network security environments in which applications support the RADIUS protocol, such as an access environment that uses a smart card access control system. In one case, RADIUS has been used with Enigmas security cards to validate users and to grant access to network resources. Networks already using RADIUS. You can add a Cisco access point containing a RADIUS client to the network. Networks that require resource accounting. You can use RADIUS accounting independently of RADIUS authentication or authorization. The RADIUS accounting functions allow data to be sent at the start and end of services, showing the amount of resources (such as time, packets, bytes, and so forth) used during the session. An Internet service provider might use a freeware-based version of RADIUS access control and accounting software to meet special security and billing needs. RADIUS is not suitable in these network security situations:

Multiprotocol access environments. RADIUS does not support AppleTalk Remote Access (ARA), NetBIOS Frame Control Protocol (NBFCP), NetWare Asynchronous Services Interface (NASI), or X.25 PAD connections. Switch-to-switch or router-to-router situations. RADIUS does not provide two-way authentication. RADIUS can be used to authenticate from one device to a non-Cisco device if the non-Cisco device requires authentication. Networks using a variety of services. RADIUS generally binds a user to one service model. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-2 OL-3446-01 Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling RADIUS RADIUS Operation When a wireless user attempts to log in and authenticate to an access point whose access is controlled by a RADIUS server, authentication to the network occurs in the steps shown in Figure 11-1:

Figure 11-1 Sequence for EAP Authentication Wired LAN Client device Access point or bridge Server 1. Authentication request 2. Identity request 3. Username

(relay to client)

(relay to server) 4. Authentication challenge 5. Authentication response

(relay to server)

(relay to client) 6. Authentication success 7. Authentication challenge

(relay to server)

(relay to client) 8. Authentication response 9. Successful authentication

(relay to server) 3 8 5 5 6 In Steps 1 through 9 in Figure 11-1, a wireless client device and a RADIUS server on the wired LAN use 802.1x and EAP to perform a mutual authentication through the access point. The RADIUS server sends an authentication challenge to the client. The client uses a one-way encryption of the user-supplied password to generate a response to the challenge and sends that response to the RADIUS server. Using information from its user database, the RADIUS server creates its own response and compares that to the response from the client. When the RADIUS server authenticates the client, the process repeats in reverse, and the client authenticates the RADIUS server. When mutual authentication is complete, the RADIUS server and the client determine a WEP key that is unique to the client and provides the client with the appropriate level of network access, thereby approximating the level of security in a wired switched segment to an individual desktop. The client loads this key and prepares to use it for the logon session. During the logon session, the RADIUS server encrypts and sends the WEP key, called a session key, over the wired LAN to the access point. The access point encrypts its broadcast key with the session key and sends the encrypted broadcast key to the client, which uses the session key to decrypt it. The client and access point activate WEP and use the session and broadcast WEP keys for all communications during the remainder of the session. There is more than one type of EAP authentication, but the access point behaves the same way for each type: it relays authentication messages from the wireless client device to the RADIUS server and from the RADIUS server to the wireless client device. See the Assigning Authentication Types to an SSID section on page 10-6 for instructions on setting up client authentication using a RADIUS server. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-3 Configuring and Enabling RADIUS Configuring RADIUS Chapter 11 Configuring RADIUS and TACACS+ Servers This section describes how to configure your access point to support RADIUS. At a minimum, you must identify the host or hosts that run the RADIUS server software and define the method lists for RADIUS authentication. You can optionally define method lists for RADIUS authorization and accounting. A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts on a user. You can use method lists to designate one or more security protocols to be used, thus ensuring a backup system if the initial method fails. The software uses the first method listed to authenticate, to authorize, or to keep accounts on users; if that method does not respond, the software selects the next method in the list. This process continues until there is successful communication with a listed method or the method list is exhausted. You should have access to and should configure a RADIUS server before configuring RADIUS features on your access point. This section contains this configuration information:

Default RADIUS Configuration, page 11-4 Identifying the RADIUS Server Host, page 11-4 (required) Configuring RADIUS Login Authentication, page 11-7 (required) Defining AAA Server Groups, page 11-9 (optional) Configuring RADIUS Authorization for User Privileged Access and Network Services, page 11-11

(optional) Starting RADIUS Accounting, page 11-12 (optional) Configuring Settings for All RADIUS Servers, page 11-13 (optional) Configuring the Access Point to Use Vendor-Specific RADIUS Attributes, page 11-13 (optional) Configuring the Access Point for Vendor-Proprietary RADIUS Server Communication, page 11-14

(optional) Note The RADIUS server CLI commands are disabled until you enter the aaa new-model command. Default RADIUS Configuration RADIUS and AAA are disabled by default. To prevent a lapse in security, you cannot configure RADIUS through a network management application. When enabled, RADIUS can authenticate users accessing the access point through the CLI. Identifying the RADIUS Server Host Access point-to-RADIUS-server communication involves several components:

Host name or IP address Authentication destination port Accounting destination port Key string Timeout period Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-4 OL-3446-01 Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling RADIUS Retransmission value You identify RADIUS security servers by their host name or IP address, host name and specific UDP port numbers, or their IP address and specific UDP port numbers. The combination of the IP address and the UDP port number creates a unique identifier allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. This unique identifier enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same servicesuch as accountingthe second host entry configured acts as a fail-over backup to the first one. Using this example, if the first host entry fails to provide accounting services, the access point tries the second host entry configured on the same device for accounting services. (The RADIUS host entries are tried in the order that they are configured.) A RADIUS server and the access point use a shared secret text string to encrypt passwords and exchange responses. To configure RADIUS to use the AAA security commands, you must specify the host running the RADIUS server daemon and a secret text (key) string that it shares with the access point. The timeout, retransmission, and encryption key values can be configured globally per server for all RADIUS servers or in some combination of global and per-server settings. To apply these settings globally to all RADIUS servers communicating with the access point, use the three unique global configuration commands: radius-server timeout, radius-server retransmit, and radius-server key. To apply these values on a specific RADIUS server, use the radius-server host global configuration command. Note If you configure both global and per-server functions (timeout, retransmission, and key commands) on the access point, the per-server timer, retransmission, and key value commands override global timer, retransmission, and key value commands. For information on configuring these setting on all RADIUS servers, see the Configuring Settings for All RADIUS Servers section on page 11-13. You can configure the access point to use AAA server groups to group existing server hosts for authentication. For more information, see the Defining AAA Server Groups section on page 11-9. Beginning in privileged EXEC mode, follow these steps to configure per-server RADIUS server communication. This procedure is required. Command configure terminal aaa new-model Step 1 Step 2 Purpose Enter global configuration mode. Enable AAA. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-5 Configuring and Enabling RADIUS Chapter 11 Configuring RADIUS and TACACS+ Servers Step 3 Command radius-server host {hostname |

ip-address} [auth-port port-number]

[acct-port port-number] [timeout seconds] [retransmit retries] [key string]

Purpose Specify the IP address or host name of the remote RADIUS server host.

(Optional) For auth-port port-number, specify the UDP destination port for authentication requests.

(Optional) For acct-port port-number, specify the UDP destination port for accounting requests.

(Optional) For timeout seconds, specify the time interval that the access point waits for the RADIUS server to reply before retransmitting. The range is 1 to 1000. This setting overrides the radius-server timeout global configuration command setting. If no timeout is set with the radius-server host command, the setting of the radius-server timeout command is used.

(Optional) For retransmit retries, specify the number of times a RADIUS request is resent to a server if that server is not responding or responding slowly. The range is 1 to 1000. If no retransmit value is set with the radius-server host command, the setting of the radius-server retransmit global configuration command is used.

(Optional) For key string, specify the authentication and encryption key used between the access point and the RADIUS daemon running on the RADIUS server. Note The key is a text string that must match the encryption key used on the RADIUS server. Always configure the key as the last item in the radius-server host command. Leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks are part of the key. To configure the access point to recognize more than one host entry associated with a single IP address, enter this command as many times as necessary, making sure that each UDP port number is different. The access point software searches for hosts in the order in which you specify them. Set the timeout, retransmit, and encryption key values to use with the specific RADIUS host. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Step 4 Step 5 Step 6 end show running-config copy running-config startup-config To remove the specified RADIUS server, use the no radius-server host hostname | ip-address global configuration command. This example shows how to configure one RADIUS server to be used for authentication and another to be used for accounting:

AP(config)# radius-server host 172.29.36.49 auth-port 1612 key rad1 AP(config)# radius-server host 172.20.36.50 acct-port 1618 key rad2 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-6 OL-3446-01 Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling RADIUS This example shows how to configure host1 as the RADIUS server and to use the default ports for both authentication and accounting:

AP(config)# radius-server host host1 Note You also need to configure some settings on the RADIUS server. These settings include the IP address of the access point and the key string to be shared by both the server and the access point. For more information, refer to the RADIUS server documentation. Configuring RADIUS Login Authentication To configure AAA authentication, you define a named list of authentication methods and then apply that list to various interfaces. The method list defines the types of authentication to be performed and the sequence in which they are performed; it must be applied to a specific interface before any of the defined authentication methods are performed. The only exception is the default method list (which, by coincidence, is named default). The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. A method list describes the sequence and authentication methods to be queried to authenticate a user. You can designate one or more security protocols to be used for authentication, thus ensuring a backup system for authentication in case the initial method fails. The software uses the first method listed to authenticate users; if that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cyclemeaning that the security server or local username database responds by denying the user accessthe authentication process stops, and no other authentication methods are attempted. Beginning in privileged EXEC mode, follow these steps to configure login authentication. This procedure is required. Command configure terminal aaa new-model Step 1 Step 2 Purpose Enter global configuration mode. Enable AAA. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-7 Configuring and Enabling RADIUS Chapter 11 Configuring RADIUS and TACACS+ Servers Step 3 Command aaa authentication login {default |

list-name} method1 [method2...]

Step 4 Step 5 line [console | tty | vty] line-number

[ending-line-number]

login authentication {default |

list-name}

Purpose Create a login authentication method list. To create a default list that is used when a named list is not specified in the login authentication command, use the default keyword followed by the methods that are to be used in default situations. The default method list is automatically applied to all interfaces. For more information on list names, click this link:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/1 22cgcr/fsecur_c/fsaaa/scfathen.htm#xtocid2 For method1..., specify the actual method the authentication algorithm tries. The additional methods of authentication are used only if the previous method returns an error, not if it fails. Select one of these methods:

lineUse the line password for authentication. You must define a line password before you can use this authentication method. Use the password password line configuration command. localUse the local username database for authentication. You must enter username information in the database. Use the username password global configuration command. radiusUse RADIUS authentication. You must configure the RADIUS server before you can use this authentication method. For more information, see the Identifying the RADIUS Server Host section on page 11-4. Enter line configuration mode, and configure the lines to which you want to apply the authentication list. Apply the authentication list to a line or set of lines. If you specify default, use the default list created with the aaa authentication login command. For list-name, specify the list created with the aaa authentication login command. Step 6 Step 7 Step 8 Step 9 radius-server attribute 32 include-in-access-req format %h end show running-config copy running-config startup-config Configure the access point to send its system name in the NAS_ID attribute for authentication. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable AAA, use the no aaa new-model global configuration command. To disable AAA authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global configuration command. To either disable RADIUS authentication for logins or to return to the default value, use the no login authentication {default | list-name} line configuration command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-8 OL-3446-01 Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling RADIUS Defining AAA Server Groups You can configure the access point to use AAA server groups to group existing server hosts for authentication. You select a subset of the configured server hosts and use them for a particular service. The server group is used with a global server-host list, which lists the IP addresses of the selected server hosts. Server groups also can include multiple host entries for the same server if each entry has a unique identifier (the combination of the IP address and UDP port number), allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. If you configure two different host entries on the same RADIUS server for the same service (such as accounting), the second configured host entry acts as a fail-over backup to the first one. You use the server group server configuration command to associate a particular server with a defined group server. You can either identify the server by its IP address or identify multiple host instances or entries by using the optional auth-port and acct-port keywords. Beginning in privileged EXEC mode, follow these steps to define the AAA server group and associate a particular RADIUS server with it:

Command configure terminal aaa new-model Step 1 Step 2 Purpose Enter global configuration mode. Enable AAA. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-9 Configuring and Enabling RADIUS Chapter 11 Configuring RADIUS and TACACS+ Servers Step 3 Command radius-server host {hostname |

ip-address} [auth-port port-number]

[acct-port port-number] [timeout seconds] [retransmit retries] [key string]

Purpose Specify the IP address or host name of the remote RADIUS server host.

(Optional) For auth-port port-number, specify the UDP destination port for authentication requests.

(Optional) For acct-port port-number, specify the UDP destination port for accounting requests.

(Optional) For timeout seconds, specify the time interval that the access point waits for the RADIUS server to reply before retransmitting. The range is 1 to 1000. This setting overrides the radius-server timeout global configuration command setting. If no timeout is set with the radius-server host command, the setting of the radius-server timeout command is used.

(Optional) For retransmit retries, specify the number of times a RADIUS request is resent to a server if that server is not responding or responding slowly. The range is 1 to 1000. If no retransmit value is set with the radius-server host command, the setting of the radius-server retransmit global configuration command is used.

(Optional) For key string, specify the authentication and encryption key used between the access point and the RADIUS daemon running on the RADIUS server. Note The key is a text string that must match the encryption key used on the RADIUS server. Always configure the key as the last item in the radius-server host command. Leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks are part of the key. To configure the access point to recognize more than one host entry associated with a single IP address, enter this command as many times as necessary, making sure that each UDP port number is different. The access point software searches for hosts in the order in which you specify them. Set the timeout, retransmit, and encryption key values to use with the specific RADIUS host. Define the AAA server-group with a group name. This command puts the access point in a server group configuration mode. Associate a particular RADIUS server with the defined server group. Repeat this step for each RADIUS server in the AAA server group. Each server in the group must be previously defined in Step 2. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Enable RADIUS login authentication. See the Configuring RADIUS Login Authentication section on page 11-7. Step 4 aaa group server radius group-name Step 5 server ip-address end show running-config copy running-config startup-config Step 6 Step 7 Step 8 Step 9 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-10 OL-3446-01 Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling RADIUS To remove the specified RADIUS server, use the no radius-server host hostname | ip-address global configuration command. To remove a server group from the configuration list, use the no aaa group server radius group-name global configuration command. To remove the IP address of a RADIUS server, use the no server ip-address server group configuration command. In this example, the access point is configured to recognize two different RADIUS group servers (group1 and group2). Group1 has two different host entries on the same RADIUS server configured for the same services. The second host entry acts as a fail-over backup to the first entry. AP(config)# aaa new-model AP(config)# radius-server host 172.20.0.1 auth-port 1000 acct-port 1001 AP(config)# radius-server host 172.10.0.1 auth-port 1645 acct-port 1646 AP(config)# aaa group server radius group1 AP(config-sg-radius)# server 172.20.0.1 auth-port 1000 acct-port 1001 AP(config-sg-radius)# exit AP(config)# aaa group server radius group2 AP(config-sg-radius)# server 172.20.0.1 auth-port 2000 acct-port 2001 AP(config-sg-radius)# exit Configuring RADIUS Authorization for User Privileged Access and Network Services AAA authorization limits the services available to a user. When AAA authorization is enabled, the access point uses information retrieved from the users profile, which is in the local user database or on the security server, to configure the users session. The user is granted access to a requested service only if the information in the user profile allows it. Note This section describes setting up authorization for access point adminsitrators, not for wireless client devices. You can use the aaa authorization global configuration command with the radius keyword to set parameters that restrict a users network access to privileged EXEC mode. The aaa authorization exec radius local command sets these authorization parameters:

Use RADIUS for privileged EXEC access authorization if authentication was performed by using RADIUS. Use the local database if authentication was not performed by using RADIUS. Note Authorization is bypassed for authenticated users who log in through the CLI even if authorization has been configured. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-11 Configuring and Enabling RADIUS Chapter 11 Configuring RADIUS and TACACS+ Servers Beginning in privileged EXEC mode, follow these steps to specify RADIUS authorization for privileged EXEC access and network services:

Command configure terminal aaa authorization network radius Step 1 Step 2 Step 3 aaa authorization exec radius Step 4 Step 5 Step 6 end show running-config copy running-config startup-config Purpose Enter global configuration mode. Configure the access point for user RADIUS authorization for all network-related service requests. Configure the access point for user RADIUS authorization to determine if the user has privileged EXEC access. The exec keyword might return user profile information (such as autocommand information). Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable authorization, use the no aaa authorization {network | exec} method1 global configuration command. Starting RADIUS Accounting The AAA accounting feature tracks the services that users are accessing and the amount of network resources that they are consuming. When AAA accounting is enabled, the access point reports user activity to the RADIUS security server in the form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server. This data can then be analyzed for network management, client billing, or auditing. Beginning in privileged EXEC mode, follow these steps to enable RADIUS accounting for each Cisco IOS privilege level and for network services:

Command configure terminal aaa accounting network start-stop radius ip radius source-interface bvi1 Purpose Enter global configuration mode. Enable RADIUS accounting for all network-related service requests. Configure the access point to send its BVI IP address in the NAS_IP_ADDRESS attribute for accounting records. aaa accounting update periodic minutes Enter an accounting update interval in minutes. end show running-config copy running-config startup-config Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 To disable accounting, use the no aaa accounting {network | exec} {start-stop} method1... global configuration command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-12 OL-3446-01 Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling RADIUS Configuring Settings for All RADIUS Servers Beginning in privileged EXEC mode, follow these steps to configure global communication settings between the access point and all RADIUS servers:

Command configure terminal radius-server key string Step 1 Step 2 Step 3 radius-server retransmit retries Step 4 radius-server timeout seconds Step 5 radius-server deadtime minutes Purpose Enter global configuration mode. Specify the shared secret text string used between the access point and all RADIUS servers. Note The key is a text string that must match the encryption key used on the RADIUS server. Leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks are part of the key. Specify the number of times the access point sends each RADIUS request to the server before giving up. The default is 3; the range 1 to 1000. Specify the number of seconds an access point waits for a reply to a RADIUS request before resending the request. The default is 5 seconds; the range is 1 to 1000. Use this command to cause the Cisco IOS software to mark as dead any RADIUS servers that fail to respond to authentication requests, thus avoiding the wait for the request to time out before trying the next configured server. A RADIUS server marked as dead is skipped by additional requests for the duration of minutes that you specify, or unless there are no servers not marked dead. Note If you set up more than one RADIUS server, you must configure the RADIUS server deadtime for optimal performance. Step 6 Step 7 Step 8 Step 9 radius-server attribute 32 include-in-access-req format %h end show running-config copy running-config startup-config Configure the access point to send its system name in the NAS_ID attribute for authentication. Return to privileged EXEC mode. Verify your settings.

(Optional) Save your entries in the configuration file. To return to the default setting for the retransmit, timeout, and deadtime, use the no forms of these commands. Configuring the Access Point to Use Vendor-Specific RADIUS Attributes The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the access point and the RADIUS server by using the vendor-specific attribute (attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option by using the format recommended in the specification. Ciscos vendor ID is 9, and the supported option has vendor type 1, which is named cisco-avpair. The value is a string with this format:

protocol : attribute sep value *

OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-13 Configuring and Enabling RADIUS Chapter 11 Configuring RADIUS and TACACS+ Servers Protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and value are an appropriate AV pair defined in the Cisco TACACS+ specification, and sep is = for mandatory attributes and the asterisk (*) for optional attributes. This allows the full set of features available for TACACS+ authorization to also be used for RADIUS. For example, the following AV pair activates Ciscos multiple named ip address pools feature during IP authorization (during PPPs IPCP address assignment):

cisco-avpair= ip:addr-pool=first The following example shows how to provide a user logging in from an access point with immediate access to privileged EXEC commands:

cisco-avpair= shell:priv-lvl=15 Other vendors have their own unique vendor IDs, options, and associated VSAs. For more information about vendor IDs and VSAs, refer to RFC 2138, Remote Authentication Dial-In User Service

(RADIUS). Beginning in privileged EXEC mode, follow these steps to configure the access point to recognize and use VSAs:

Step 1 Step 2 Command configure terminal radius-server vsa send [accounting |

authentication]

Purpose Enter global configuration mode. Enable the access point to recognize and use VSAs as defined by RADIUS IETF attribute 26.

(Optional) Use the accounting keyword to limit the set of recognized vendor-specific attributes to only accounting attributes.

(Optional) Use the authentication keyword to limit the set of recognized vendor-specific attributes to only authentication attributes. If you enter this command without keywords, both accounting and authentication vendor-specific attributes are used. Return to privileged EXEC mode. Verify your settings.

(Optional) Save your entries in the configuration file. Step 3 Step 4 Step 5 end show running-config copy running-config startup-config For a complete list of RADIUS attributes or more information about VSA 26, refer to the RADIUS Attributes appendix in the Cisco IOS Security Configuration Guide for Release 12.2. Configuring the Access Point for Vendor-Proprietary RADIUS Server Communication Although an IETF draft standard for RADIUS specifies a method for communicating vendor-proprietary information between the access point and the RADIUS server, some vendors have extended the RADIUS attribute set in a unique way. Cisco IOS software supports a subset of vendor-proprietary RADIUS attributes. As mentioned earlier, to configure RADIUS (whether vendor-proprietary or IETF draft-compliant), you must specify the host running the RADIUS server daemon and the secret text string it shares with the access point. You specify the RADIUS host and secret text string by using the radius-server global configuration commands. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-14 OL-3446-01 Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling RADIUS Beginning in privileged EXEC mode, follow these steps to specify a vendor-proprietary RADIUS server host and a shared secret text string:

Step 1 Step 2 Step 3 Purpose Enter global configuration mode. Command configure terminal radius-server host {hostname | ip-address} non-standard Specify the IP address or host name of the remote RADIUS server host and identify that it is using a vendor-proprietary implementation of RADIUS. Specify the shared secret text string used between the access point and the vendor-proprietary RADIUS server. The access point and the RADIUS server use this text string to encrypt passwords and exchange responses. radius-server key string Step 4 Step 5 Step 6 end show running-config copy running-config startup-config Note The key is a text string that must match the encryption key used on the RADIUS server. Leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks are part of the key. Return to privileged EXEC mode. Verify your settings.

(Optional) Save your entries in the configuration file. To delete the vendor-proprietary RADIUS host, use the no radius-server host {hostname | ip-address}

non-standard global configuration command. To disable the key, use the no radius-server key global configuration command. This example shows how to specify a vendor-proprietary RADIUS host and to use a secret key of rad124 between the access point and the server:

AP(config)# radius-server host 172.20.30.15 nonstandard AP(config)# radius-server key rad124 Displaying the RADIUS Configuration To display the RADIUS configuration, use the show running-config privileged EXEC command. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-15 Configuring and Enabling TACACS+

Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling TACACS+

This section contains this configuration information:

Understanding TACACS+, page 11-16 TACACS+ Operation, page 11-17 Configuring TACACS+, page 11-17 Displaying the TACACS+ Configuration, page 11-22 Understanding TACACS+

TACACS+ is a security application that provides centralized validation of users attempting to gain access to your access point. Unlike RADIUS, TACACS+ does not authenticate client devices associated to the access point. TACACS+ services are maintained in a database on a TACACS+ daemon typically running on a UNIX or Windows NT workstation. You should have access to and should configure a TACACS+ server before configuring TACACS+ features on your access point. TACACS+ provides for separate and modular authentication, authorization, and accounting facilities. TACACS+ allows for a single access control server (the TACACS+ daemon) to provide each serviceauthentication, authorization, and accountingindependently. Each service can be tied into its own database to take advantage of other services available on that server or on the network, depending on the capabilities of the daemon. TACACS+, administered through the AAA security services, can provide these services:

AuthenticationProvides complete control of authentication of administrators through login and password dialog, challenge and response, and messaging support. The authentication facility can conduct a dialog with the administrator (for example, after a username and password are provided, to challenge a user with several questions, such as home address, mothers maiden name, service type, and social security number). The TACACS+

authentication service can also send messages to administrator screens. For example, a message could notify administrators that their passwords must be changed because of the companys password aging policy. AuthorizationProvides fine-grained control over administrator capabilities for the duration of the administrators session, including but not limited to setting autocommands, access control, session duration, or protocol support. You can also enforce restrictions on the commands that an administrator can execute with the TACACS+ authorization feature. AccountingCollects and sends information used for billing, auditing, and reporting to the TACACS+ daemon. Network managers can use the accounting facility to track administrator activity for a security audit or to provide information for user billing. Accounting records include administrator identities, start and stop times, executed commands (such as PPP), number of packets, and number of bytes. The TACACS+ protocol provides authentication between the access point and the TACACS+ daemon, and it ensures confidentiality because all protocol exchanges between the access point and the TACACS+

daemon are encrypted. You need a system running the TACACS+ daemon software to use TACACS+ on your access point. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-16 OL-3446-01 Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling TACACS+

TACACS+ Operation When an administrator attempts a simple ASCII login by authenticating to an access point using TACACS+, this process occurs:

1. When the connection is established, the access point contacts the TACACS+ daemon to obtain a username prompt, which is then displayed to the administrator. The administrator enters a username, and the access point then contacts the TACACS+ daemon to obtain a password prompt. The access point displays the password prompt to the administrator, the administrator enters a password, and the password is then sent to the TACACS+ daemon. TACACS+ allows a conversation to be held between the daemon and the administrator until the daemon receives enough information to authenticate the administrator. The daemon prompts for a username and password combination, but can include other items, such as the users mothers maiden name. 2. The access point eventually receives one of these responses from the TACACS+ daemon:

ACCEPTThe administrator is authenticated and service can begin. If the access point is configured to require authorization, authorization begins at this time. REJECTThe administrator is not authenticated. The administrator can be denied access or is prompted to retry the login sequence, depending on the TACACS+ daemon. ERRORAn error occurred at some time during authentication with the daemon or in the network connection between the daemon and the access point. If an ERROR response is received, the access point typically tries to use an alternative method for authenticating the administrator. CONTINUEThe administrator is prompted for additional authentication information. After authentication, the administrator undergoes an additional authorization phase if authorization has been enabled on the access point. Administrators must first successfully complete TACACS+

authentication before proceeding to TACACS+ authorization. 3. If TACACS+ authorization is required, the TACACS+ daemon is again contacted, and it returns an ACCEPT or REJECT authorization response. If an ACCEPT response is returned, the response contains data in the form of attributes that direct the EXEC or NETWORK session for that administrator, determining the services that the administrator can access:

Telnet, rlogin, or privileged EXEC services Connection parameters, including the host or client IP address, access list, and administrator timeouts Configuring TACACS+

This section describes how to configure your access point to support TACACS+. At a minimum, you must identify the host or hosts maintaining the TACACS+ daemon and define the method lists for TACACS+ authentication. You can optionally define method lists for TACACS+ authorization and accounting. A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts on an administrator. You can use method lists to designate one or more security protocols to be used, thus ensuring a backup system if the initial method fails. The software uses the first method listed to authenticate, to authorize, or to keep accounts on administrators; if that method does not respond, the software selects the next method in the list. This process continues until there is successful communication with a listed method or the method list is exhausted. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-17 Configuring and Enabling TACACS+

Chapter 11 Configuring RADIUS and TACACS+ Servers This section contains this configuration information:

Default TACACS+ Configuration, page 11-18 Identifying the TACACS+ Server Host and Setting the Authentication Key, page 11-18 Configuring TACACS+ Login Authentication, page 11-19 Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services, page 11-20 Starting TACACS+ Accounting, page 11-21 Default TACACS+ Configuration TACACS+ and AAA are disabled by default. To prevent a lapse in security, you cannot configure TACACS+ through a network management application. When enabled, TACACS+ can authenticate administrators accessing the access point through the CLI. Identifying the TACACS+ Server Host and Setting the Authentication Key You can configure the access point to use a single server or AAA server groups to group existing server hosts for authentication. You can group servers to select a subset of the configured server hosts and use them for a particular service. The server group is used with a global server-host list and contains the list of IP addresses of the selected server hosts. Beginning in privileged EXEC mode, follow these steps to identify the IP host or host maintaining TACACS+ server and optionally set the encryption key:

Step 1 Step 2 Command configure terminal tacacs-server host hostname [port integer] [timeout integer] [key string]

Purpose Enter global configuration mode. Identify the IP host or hosts maintaining a TACACS+ server. Enter this command multiple times to create a list of preferred hosts. The software searches for hosts in the order in which you specify them. For hostname, specify the name or IP address of the host.

(Optional) For port integer, specify a server port number. The default is port 49. The range is 1 to 65535.

(Optional) For timeout integer, specify a time in seconds the access point waits for a response from the daemon before it times out and declares an error. The default is 5 seconds. The range is 1 to 1000 seconds.

(Optional) For key string, specify the encryption key for encrypting and decrypting all traffic between the access point and the TACACS+

daemon. You must configure the same key on the TACACS+ daemon for encryption to be successful. Step 3 Step 4 aaa new-model aaa group server tacacs+ group-name Enable AAA.

(Optional) Define the AAA server-group with a group name. This command puts the access point in a server group subconfiguration mode. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-18 OL-3446-01 Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling TACACS+

Command server ip-address Step 5 Purpose

(Optional) Associate a particular TACACS+ server with the defined server group. Repeat this step for each TACACS+ server in the AAA server group. Step 6 Step 7 Step 8 end show tacacs copy running-config startup-config Each server in the group must be previously defined in Step 2. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To remove the specified TACACS+ server name or address, use the no tacacs-server host hostname global configuration command. To remove a server group from the configuration list, use the no aaa group server tacacs+ group-name global configuration command. To remove the IP address of a TACACS+ server, use the no server ip-address server group subconfiguration command. Configuring TACACS+ Login Authentication To configure AAA authentication, you define a named list of authentication methods and then apply that list to various interfaces. The method list defines the types of authentication to be performed and the sequence in which they are performed; it must be applied to a specific interface before any of the defined authentication methods are performed. The only exception is the default method list (which, by coincidence, is named default). The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. A defined method list overrides the default method list. A method list describes the sequence and authentication methods to be queried to authenticate an administrator. You can designate one or more security protocols to be used for authentication, thus ensuring a backup system for authentication in case the initial method fails. The software uses the first method listed to authenticate users; if that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cyclemeaning that the security server or local username database responds by denying the administrator accessthe authentication process stops, and no other authentication methods are attempted. Beginning in privileged EXEC mode, follow these steps to configure login authentication:

Command configure terminal aaa new-model Step 1 Step 2 Purpose Enter global configuration mode. Enable AAA. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-19 Configuring and Enabling TACACS+

Chapter 11 Configuring RADIUS and TACACS+ Servers Step 3 Command aaa authentication login {default |

list-name} method1 [method2...]

Step 4 Step 5 line [console | tty | vty] line-number

[ending-line-number]

login authentication {default |

list-name}

Purpose Create a login authentication method list. To create a default list that is used when a named list is not specified in the login authentication command, use the default keyword followed by the methods that are to be used in default situations. The default method list is automatically applied to all interfaces. For list-name, specify a character string to name the list you are creating. For method1..., specify the actual method the authentication algorithm tries. The additional methods of authentication are used only if the previous method returns an error, not if it fails. Select one of these methods:

lineUse the line password for authentication. You must define a line password before you can use this authentication method. Use the password password line configuration command. localUse the local username database for authentication. You must enter username information into the database. Use the username password global configuration command. tacacs+Uses TACACS+ authentication. You must configure the TACACS+ server before you can use this authentication method. Enter line configuration mode, and configure the lines to which you want to apply the authentication list. Apply the authentication list to a line or set of lines. If you specify default, use the default list created with the aaa authentication login command. For list-name, specify the list created with the aaa authentication login command. Step 6 Step 7 Step 8 end show running-config copy running-config startup-config Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable AAA, use the no aaa new-model global configuration command. To disable AAA authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global configuration command. To either disable TACACS+ authentication for logins or to return to the default value, use the no login authentication {default | list-name} line configuration command. Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services AAA authorization limits the services available to an administrator. When AAA authorization is enabled, the access point uses information retrieved from the administrators profile, which is located either in the local user database or on the security server, to configure the administrators session. The administrator is granted access to a requested service only if the information in the administrator profile allows it. You can use the aaa authorization global configuration command with the tacacs+ keyword to set parameters that restrict an administrators network access to privileged EXEC mode. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-20 OL-3446-01 Chapter 11 Configuring RADIUS and TACACS+ Servers Configuring and Enabling TACACS+

The aaa authorization exec tacacs+ local command sets these authorization parameters:

Use TACACS+ for privileged EXEC access authorization if authentication was performed by using TACACS+. Use the local database if authentication was not performed by using TACACS+. Note Authorization is bypassed for authenticated administrators who log in through the CLI even if authorization has been configured. Beginning in privileged EXEC mode, follow these steps to specify TACACS+ authorization for privileged EXEC access and network services:

Command configure terminal aaa authorization network tacacs+

Step 1 Step 2 Step 3 aaa authorization exec tacacs+

Step 4 Step 5 Step 6 end show running-config copy running-config startup-config Purpose Enter global configuration mode. Configure the access point for administrator TACACS+ authorization for all network-related service requests. Configure the access point for administrator TACACS+ authorization to determine if the administrator has privileged EXEC access. The exec keyword might return user profile information (such as autocommand information). Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable authorization, use the no aaa authorization {network | exec} method1 global configuration command. Starting TACACS+ Accounting The AAA accounting feature tracks the services that administrators are accessing and the amount of network resources that they are consuming. When AAA accounting is enabled, the access point reports administrator activity to the TACACS+ security server in the form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server. This data can then be analyzed for network management, client billing, or auditing. Beginning in privileged EXEC mode, follow these steps to enable TACACS+ accounting for each Cisco IOS privilege level and for network services:

Command configure terminal aaa accounting network start-stop tacacs+

aaa accounting exec start-stop tacacs+

Step 1 Step 2 Step 3 Step 4 end OL-3446-01 Purpose Enter global configuration mode. Enable TACACS+ accounting for all network-related service requests. Enable TACACS+ accounting to send a start-record accounting notice at the beginning of a privileged EXEC process and a stop-record at the end. Return to privileged EXEC mode. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-21 Configuring and Enabling TACACS+

Chapter 11 Configuring RADIUS and TACACS+ Servers Command show running-config copy running-config startup-config Step 5 Step 6 Purpose Verify your entries.

(Optional) Save your entries in the configuration file. To disable accounting, use the no aaa accounting {network | exec} {start-stop} method1... global configuration command. Displaying the TACACS+ Configuration To display TACACS+ server statistics, use the show tacacs privileged EXEC command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 11-22 OL-3446-01 C H A P T E R 12 Configuring VLANs This chapter describes how to configure your access point to operate with the VLANs set up on your wired LAN. These sections describe how to configure your access point to support VLANs:

Understanding VLANs, page 12-2 Configuring VLANs, page 12-4 VLAN Configuration Example, page 12-7 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 12-1 Understanding VLANs Understanding VLANs Chapter 12 Configuring VLANs A VLAN is a switched network that is logically segmented, by functions, project teams, or applications rather than on a physical or geographical basis. For example, all workstations and servers used by a particular workgroup team can be connected to the same VLAN, regardless of their physical connections to the network or the fact that they might be intermingled with other teams. You use VLANs to reconfigure the network through software rather than physically unplugging and moving devices or wires. A VLAN can be thought of as a broadcast domain that exists within a defined set of switches. A VLAN consists of a number of end systems, either hosts or network equipment (such as bridges and routers), connected by a single bridging domain. The bridging domain is supported on various pieces of network equipment such as LAN switches that operate bridging protocols between them with a separate group for each VLAN. VLANs provide the segmentation services traditionally provided by routers in LAN configurations. VLANs address scalability, security, and network management. You should consider several key issues when designing and building switched LAN networks:

LAN segmentation Security Broadcast control Performance Network management Communication between VLANs You extend VLANs into a wireless LAN by adding IEEE 802.11Q tag awareness to the access point. Frames destined for different VLANs are transmitted by the access point wirelessly on different SSIDs with different WEP keys. Only the clients associated with that VLAN receive those packets. Conversely, packets coming from a client associated with a certain VLAN are 802.11Q tagged before they are forwarded onto the wired network. Figure 12-1 shows the difference between traditional physical LAN segmentation and logical VLAN segmentation with wireless devices connected. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 12-2 OL-3446-01 Chapter 12 Configuring VLANs Understanding VLANs Figure 12-1 LAN and VLAN Segmentation with Wireless Devices Traditional LAN segmentation VLAN segmentation VLAN 1 VLAN 2 VLAN 3 LAN 1 Catalyst VLAN switch Catalyst VLAN switch Shared hub Floor 3 LAN 2 Shared hub Floor 2 LAN 3 Shared hub Floor 1 Catalyst VLAN switch Trunk port SSID 1 = VLAN1 SSID 2 = VLAN2 SSID 3 = VLAN3 SSID 0 SSID 0 SSID 0 SSID 1 SSID 2 SSID 3 2 5 6 1 8 Related Documents These documents provide more detailed information pertaining to VLAN design and configuration:

Cisco IOS Switching Services Configuration Guide. Click this link to browse to this document:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fswtch_c/index.htm Cisco Internetwork Design Guide. Click this link to browse to this document:

http://www.cisco.com/univercd/cc/td/doc/cisintwk/idg4/index.htm Cisco Internetworking Technology Handbook. Click this link to browse to this document:

http://www.cisco.com/univercd/cc/td/doc/cisintwk/ito_doc/index.htm Cisco Internetworking Troubleshooting Guide. Click this link to browse to this document:

http://www.cisco.com/univercd/cc/td/doc/cisintwk/itg_v1/index.htm OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 12-3 Configuring VLANs Chapter 12 Configuring VLANs Incorporating Wireless Devices into VLANs The basic wireless components of a VLAN consist of an access point and a client associated to it using wireless technology. The access point is physically connected through a trunk port to the network VLAN switch on which the VLAN is configured. The physical connection to the VLAN switch is through the access points Ethernet port. In fundamental terms, the key to configuring an access point to connect to a specific VLAN is by configuring its SSID to recognize that VLAN. Since VLANs are identified by a VLAN ID, it follows that if the SSID on an access point is configured to recognize a specific VLAN ID, a connection to the VLAN is established. When this connection is made, associated wireless client devices having the same SSID can access the VLAN through the access point. The VLAN processes data to and from the clients the same way that it processes data to and from wired connections. You can configure up to 16 SSIDs on your access point, so you can support up to 16 VLANs. You can use the VLAN feature to deploy wireless devices with greater efficiency and flexibility. For example, one access point can now handle the specific requirements of multiple users having widely varied network access and permissions. Without VLAN capability, multiple access points would have to be employed to serve classes of users based on the access and permissions they were assigned. These are two common strategies for deploying wireless VLANs:

Segmentation by user groups: You can segment your wireless LAN user community and enforce a different security policy for each user group. For example, you can create three wired and wireless VLANs in an enterprise environment for full-time and part-time employees and also provide guest access. Segmentation by device types: You can segment your wireless LAN to allow different devices with different security capabilities to join the network. For example, some wireless users might have handheld devices that support only static WEP, and some wireless users might have more sophisticated devices using dynamic WEP. You can group and isolate these devices into separate VLANs. Configuring VLANs These sections describe how to configure VLANs on your access point:

Configuring a VLAN, page 12-4 Using a RADIUS Server to Assign Users to VLANs, page 12-6 Viewing VLANs Configured on the Access Point, page 12-6 Configuring a VLAN Configuring your access point to support VLANs is a three-step process:

1. Assign SSIDs to VLANs. 2. Assign authentication settings to SSIDs. 3. Enable the VLAN on the radio and Ethernet ports. This section describes how to assign SSIDs to VLANs and how to enable a VLAN on the access point radio and Ethernet ports. For detailed instructions on assigning authentication types to SSIDs, see Chapter 10, Configuring Authentication Types. For instructions on assigning other settings to SSIDs, see Chapter 8, Configuring Multiple SSIDs. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 12-4 OL-3446-01 Chapter 12 Configuring VLANs Configuring VLANs You can configure up to 16 SSIDs on the access point, so you can support up to 16 VLANs that are configured on your LAN. Beginning in privileged EXEC mode, follow these steps to assign an SSID to a VLAN and enable the VLAN on the access point radio and Ethernet ports:

Command configure terminal interface dot11radio0 ssid ssid-string Step 1 Step 2 Step 3 Step 4 vlan vlan-id Step 5 Step 6 Step 7 exit interface dot11radio0.x encapsulation dot1q vlan-id

[native]

Step 8 Step 9 exit interface fastEthernet0.x Step 10 encapsulation dot1q vlan-id

[native]

Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. Create an SSID and enter SSID configuration mode for the new SSID. The SSID can consist of up to 32 alphanumeric characters. SSIDs are case sensitive. Note You use the ssid commands authentication options to configure an authentication type for each SSID. See Chapter 10, Configuring Authentication Types, for instructions on configuring authentication types.

(Optional) Assign the SSID to a VLAN on your network. Client devices that associate using the SSID are grouped into this VLAN. Enter a VLAN ID from 1 to 4095. Return to interface configuration mode for the radio interface. Enter interface configuration mode for the radio VLAN sub interface. Enable a VLAN on the radio interface.

(Optional) Designate the VLAN as the native VLAN. On many networks, the native VLAN is VLAN 1. Return to global configuration mode. Enter interface configuration mode for the Ethernet VLAN subinterface. Enable a VLAN on the Ethernet interface.

(Optional) Designate the VLAN as the native VLAN. On many networks, the native VLAN is VLAN 1. Return to privileged EXEC mode. Step 11 Step 12 end copy running-config startup-config (Optional) Save your entries in the configuration file. This example shows how to:

Name an SSID Assign the SSID to a VLAN Enable the VLAN on the radio and Ethernet ports as the native VLAN ap1200# configure terminal ap1200(config)# interface dot11radio0 ap1200(config-if)# ssid batman ap1200(config-ssid)# vlan 1 ap1200(config-ssid)# exit ap1200(config)# interface dot11radio0.1 ap1200(config-subif)# encapsulation dot1q 1 native ap1200(config-subif)# exit OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 12-5 Configuring VLANs Chapter 12 Configuring VLANs ap1200(config)# interface fastEthernet0.1 ap1200(config-subif)# encapsulation dot1q 1 native ap1200(config-subif)# exit ap1200(config)# end Using a RADIUS Server to Assign Users to VLANs You can configure your RADIUS authentication server to assign users or groups of users to a specific VLAN when they authenticate to the network. The VLAN-mapping process consists of these steps:

1. A client device associates to the access point using any SSID configured on the access point. 2. The client begins RADIUS authentication. 3. When the client authenticates sucessfully, the RADIUS server maps the client to a specific VLAN, regardless of the VLAN mapping defined for the SSID the client is using on the access point. If the server does not return any VLAN attribute for the client, the client is assigned to the VLAN specified by the SSID mapped locally on the access point. These are the RADIUS user attributes used for vlan-id assignment. Each attribute must have a common Tag value to identify the grouped relationship. IETF 64 (Tunnel Type): Set this attribute to VLAN IETF 65 (Tunnel Medium Type): Set this attribute to 802 IETF 81 (Tunnel Private Group ID): Set this attribute to vlan-id Viewing VLANs Configured on the Access Point In privileged EXEC mode, use the show vlan command to view the VLANs that the access point supports. This is sample output from a show vlan command:

Virtual LAN ID: 1 (IEEE 802.1Q Encapsulation) vLAN Trunk Interfaces: Dot11Radio0 FastEthernet0 Virtual-Dot11Radio0 This is configured as native Vlan for the following interface(s) :

Dot11Radio0 FastEthernet0 Virtual-Dot11Radio0 Protocols Configured: Address: Received: Transmitted:

Bridging Bridge Group 1 201688 0 Bridging Bridge Group 1 201688 0 Bridging Bridge Group 1 201688 0 Virtual LAN ID: 2 (IEEE 802.1Q Encapsulation) vLAN Trunk Interfaces: Dot11Radio0.2 FastEthernet0.2 Virtual-Dot11Radio0.2 Protocols Configured: Address: Received: Transmitted:

Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 12-6 OL-3446-01 Chapter 12 Configuring VLANs VLAN Configuration Example VLAN Configuration Example This example shows how to use VLANs to manage wireless devices on a college campus. In this example, three levels of access are available through VLANs configured on the wired network:

Management accessHighest level of access; users can access all internal drives and files, departmental databases, top-level financial information, and other sensitive information. Management users are required to authenticate using Cisco LEAP. Faculty accessMedium level of access; users can access schools Intranet and Internet, access internal files, access student databases, and view internal information such as human resources, payroll, and other faculty-related material. Faculty users are required to authenticate using Cisco LEAP. Student accessLowest level of access; users can access schools Intranet and the Internet, obtain class schedules, view grades, make appointments, and perform other student-related activities. Students are allowed to join the network using static WEP. In this scenario, a minimum of three VLAN connections are required, one for each level of access. Because the access point can handle up to 16 SSIDs, you can use the basic design shown in Table 12-1. Table 12-1 Access Level SSID and VLAN Assignment Level of Access Management Faculty Student SSID boss teach learn VLAN ID 01 02 03 Managers configure their wireless client adapters to use SSID boss, faculty members configure their clients to use SSID teach, and students configure their wireless client adapters to use SSID learn. When these clients associate to the access point, they automatically belong to the correct VLAN. You would complete these steps to support the VLANs in this example:

1. Configure or confirm the configuration of these VLANs on one of the switches on your LAN. 2. On the access point, assign an SSID to each VLAN. 3. Assign authentication types to each SSID. 4. Configure VLAN 1, the Management VLAN, on both the fastethernet and dot11radio interfaces on the access point. You should make this VLAN the native VLAN. 5. Configure VLANs 2 and 3 on both the fastethernet and dot11radio interfaces on the access point. 6. Configure the client devices. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 12-7 VLAN Configuration Example Chapter 12 Configuring VLANs Table 12-2 shows the commands needed to configure the three VLANs in this example. Table 12-2 Configuration Commands for VLAN Example Configuring VLAN 2 ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# ssid teach ap1200(config-ssid)# vlan 02 ap1200(config-ssid)# end Configuring VLAN 3 ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# ssid learn ap1200(config-ssid)# vlan 03 ap1200(config-ssid)# end ap1200(config) interface FastEthernet0.2 ap1200(config-subif) encapsulation dot1Q 2 ap1200(config-subif) bridge-group 2 ap1200(config-subif) exit ap1200(config) interface FastEthernet0.3 ap1200(config-subif) encapsulation dot1Q 3 ap1200(config-subif) bridge-group 3 ap1200(config-subif) exit ap1200(config) interface Dot11Radio0.2 ap1200(config-subif) encapsulation dot1Q 2 ap1200(config-subif) bridge-group 2 ap1200(config-subif) exit ap1200(config) interface Dot11Radio0.3 ap1200(config-subif) encapsulation dot1Q 3 ap1200(config-subif) bridge-group 3 ap1200(config-subif) exit Configuring VLAN 1 ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# ssid boss ap1200(config-ssid)# vlan 01 ap1200(config-ssid)# end ap1200 configure terminal ap1200(config) interface FastEthernet0.1 ap1200(config-subif) encapsulation dot1Q 1 native ap1200(config-subif) exit ap1200(config)# interface Dot11Radio0.1 ap1200(config-subif)#

encapsulation dot1Q 1 native ap1200(config-subif)# exit Note You do not need to configure a bridge group on the subinterface that you set up as the native VLAN. This bridge group is moved to the native subinterface automatically to maintain the link to bridge virtual interface (BVI) 1, which represents both the radio and Ethernet interfaces. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 12-8 OL-3446-01 Chapter 12 Configuring VLANs VLAN Configuration Example Table 12-3 shows the results of the configuration commands in Table 12-2. Use the show running command to display the running configuration on the access point. Table 12-3 Results of Example Configuration Commands VLAN 1 Interfaces interface Dot11Radio0.1 encapsulation dot1Q 1 native no ip route-cache no cdp enable bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled VLAN 2 Interfaces interface Dot11Radio0.2 encapsulation dot1Q 2 no ip route-cache no cdp enable bridge-group 2 bridge-group 2 subscriber-loop-control bridge-group 2 block-unknown-source no bridge-group 2 source-learning no bridge-group 2 unicast-flooding bridge-group 2 spanning-disabled VLAN 3 Interfaces interface Dot11Radio0.3 encapsulation dot1Q 3 no ip route-cache bridge-group 3 bridge-group 3 subscriber-loop-control bridge-group 3 block-unknown-source no bridge-group 3 source-learning no bridge-group 3 unicast-flooding bridge-group 3 spanning-disabled interface FastEthernet0.1 encapsulation dot1Q 1 native no ip route-cache bridge-group 1 no bridge-group 1 source-learning bridge-group 1 spanning-disabled interface FastEthernet0.2 encapsulation dot1Q 2 no ip route-cache bridge-group 2 no bridge-group 2 source-learning bridge-group 2 spanning-disabled interface FastEthernet0.3 encapsulation dot1Q 3 no ip route-cache bridge-group 3 no bridge-group 3 source-learning bridge-group 3 spanning-disabled Notice that when you configure a bridge group on the radio interface, these commands are set automatically:

bridge-group 2 subscriber-loop-control bridge-group 2 block-unknown-source no bridge-group 2 source-learning no bridge-group 2 unicast-flooding bridge-group 2 spanning-disabled When you configure a bridge group on the FastEthernet interface, these commands are set automatically:

no bridge-group 2 source-learning bridge-group 2 spanning-disabled OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 12-9 VLAN Configuration Example Chapter 12 Configuring VLANs Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 12-10 OL-3446-01 C H A P T E R 13 Configuring QoS This chapter describes how to configure quality of service (QoS) on your access point. With this feature, you can provide preferential treatment to certain traffic at the expense of others. Without QoS, the access point offers best-effort service to each packet, regardless of the packet contents or size. It sends the packets without any assurance of reliability, delay bounds, or throughput. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco Aironet 1200 Series Access Point Command Reference for this release. This chapter consists of these sections:

Understanding QoS for Wireless LANs, page 13-2 Configuring QoS, page 13-3 QoS Configuration Examples, page 13-10 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-1 Understanding QoS for Wireless LANs Chapter 13 Configuring QoS Understanding QoS for Wireless LANs Typically, networks operate on a best-effort delivery basis, which means that all traffic has equal priority and an equal chance of being delivered in a timely manner. When congestion occurs, all traffic has an equal chance of being dropped. When you configure QoS on the access point, you can select specific network traffic, prioritize it, and use congestion-management and congestion-avoidance techniques to provide preferential treatment. Implementing QoS in your wireless LAN makes network performance more predictable and bandwidth utilization more effective. When you configure QoS, you create QoS policies and apply the policies to the VLANs configured on your access point. If you do not use VLANs on your network, you can apply your QoS policies to the access points Ethernet and radio ports. QoS for Wireless LANs Versus QoS on Wired LANs The QoS implementation for wireless LANs differs from QoS implementations on other Cisco devices. With QoS enabled, access points perform the following:

They do not classify packets; they prioritize packets based on DSCP value, client type (such as a wireless phone), or the priority value in the 802.1q or 802.1p tag. They do not match packets using ACL; they use only MQC class-map for matching clauses. They do not construct internal DSCP values; they only support mapping by assigning IP DSCP, Precedence, or Protocol values to Layer 2 COS values. They carry out EDCF like queuing on the radio egress port only. They do only FIFO queueing on the Ethernet egress port. They support only 802.1Q/P tagged packets. Access points do not support ISL. They support only MQC policy-map set cos action. They prioritize the traffic from voice clients (such as Symbol phones) over traffic from other clients when the QoS Element for Wireless Phones feature is enabled. They support Spectralink phones using the class-map IP protocol clause with the protocol value set to 119. To contrast the wireless LAN QoS implementation with the QoS implementation on other Cisco network devices, see the Cisco IOS Quality of Service Solutions Configuration Guide at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fqos_c/index.htm Impact of QoS on a Wireless LAN Wireless LAN QoS features are a subset of the proposed 802.11e draft. QoS on wireless LANs provides prioritization of traffic from the access point over the WLAN based on traffic classification. Just as in other media, you might not notice the effects of QoS on a lightly loaded wireless LAN. The benefits of QoS become more obvious as the load on the wireless LAN increases, keeping the latency, jitter, and loss for selected traffic types within an acceptable range. QoS on the wireless LAN focuses on downstream prioritization from the access point. Figure 13-1 shows the upstream and downstream traffic flow. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-2 OL-3446-01 Chapter 13 Configuring QoS Configuring QoS Figure 13-1 Upstream and Downstream Traffic Flow Radio downstream Ethernet downstream Client device Radio upstream Access point Ethernet upstream Wired LAN 2 3 7 1 8 The radio downstream flow is traffic transmitted out the access point radio to a wireless client device. This traffic is the main focus for QoS on a wireless LAN. The radio upstream flow is traffic transmitted out the wireless client device to the access point. QoS for wireless LANs does not affect this traffic. The Ethernet downstream flow is traffic sent from a switch or a router to the Ethernet port on the access point. If QoS is enabled on the switch or router, the switch or router might prioritize and rate-limit traffic to the access point. The Ethernet upstream flow is traffic sent from the access point Ethernet port to a switch or router on the wired LAN. The access point does not prioritize traffic that it sends to the wired LAN based on traffic classification. Precedence of QoS Settings When you enable QoS, the access point queues packets based on the Layer 2 class of service value for each packet. The access point applies QoS policies in this order:

1. Packets already classifiedWhen the access point receives packets from a QoS-enabled switch or router that has already classified the packets with non-zero 802.1Q/P user_priority values, the access point uses that classification and does not apply other QoS policy rules to the packets. An existing classification takes precedence over all other policies on the access point. 2. QoS Element for Wireless Phones settingIf you enable the QoS Element for Wireless Phones setting, traffic from voice clients takes priority over other traffic regardless of other policy settings. The QoS Element for Wireless Phones setting takes precedence over other policies, second only to previously assigned packet classifications. 3. Policies you create on the access pointQoS Policies that you create and apply to VLANs or to the access point interfaces are third in precedence after previously classified packets and the QoS Element for Wireless Phones setting. 4. Default classification for all packets on VLANIf you set a default classification for all packets on a VLAN, that policy is fourth in the precedence list. Configuring QoS QoS is disabled by default. This section describes how to configure QoS on your access point. It contains this configuration information:

Configuration Guidelines, page 13-4 Configuring QoS Using the Web-Browser Interface, page 13-4 Adjusting Radio Traffic Class Definitions, page 13-8 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-3 Configuring QoS Configuration Guidelines Chapter 13 Configuring QoS Before configuring QoS on your access point, you should be aware of this information:

The most important guideline in QoS deployment is to be familiar with the traffic on your wireless LAN. If you know the applications used by wireless client devices, the applications sensitivity to delay, and the amount of traffic associated with the applications, you can configure QoS to improve performance. QoS does not create additional bandwidth for your wireless LAN; it helps control the allocation of bandwidth. If you have plenty of bandwidth on your wireless LAN, you might not need to configure QoS. Configuring QoS Using the Web-Browser Interface This section describes configuring QoS using the web-browser interface. For a list of IOS commands for configuring QoS using the CLI, consult the Cisco Aironet 1100 Series Access Point Command Reference. Follow these steps to browse to the command reference:

1. Click this link to browse to the Cisco Aironet documentation home page:

http://www.cisco.com/univercd/cc/td/doc/product/wireless/index.htm 2. Follow this path to the product, document, and chapter:

Aironet 1100 Series Wireless LAN Products > Cisco Aironet 1100 Series Access Points >

Cisco Aironet 1100 Series Access Point Command Reference Follow these steps to configure QoS:

Step 1 Step 2 If you use VLANs on your wireless LAN, make sure the necessary VLANs are configured on your access point before configuring QoS. Click Services in the task menu on the left side of any page in the web-browser interface. When the list of Services expands, click QoS. The QoS Policies page appears. Figure 13-2 shows the QoS Policies page. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-4 OL-3446-01 Chapter 13 Configuring QoS Configuring QoS Figure 13-2 QoS Policies Page Step 3 With <NEW> selected in the Create/Edit Policy field, type a name for the QoS policy in the Policy Name entry field. The name can contain up to 25 alphanumeric characters. Do not include spaces in the policy name. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-5 Configuring QoS Chapter 13 Configuring QoS Step 4 If the packets that you need to prioritize contain IP precedence information in the IP header TOS field, select an IP precedence classification from the IP Precedence drop-down menu. Menu selections include:

Routine (0) Priority (1) Immediate (2) Flash (3) Flash Override (4) Critic/CCP (5) Internet Control (6) Network Control (7) Step 5 Use the Apply Class of Service drop-down menu to select the class of service that the access point will apply to packets of the type that you selected from the IP Precedence menu. The access point matches your IP Precedence selection with your class of service selection. Settings in the Apply Class of Service menu include:

Best Effort (0) Background (1) Spare (2) Excellent (3) Control Lead (4) Video <100ms Latency (5) Voice <100ms Latency (6) Step 6 Step 7 Network Control (7) Click the Add button beside the Class of Service menu for IP Precedence. The classification appears in the Classifications field. To delete a classification, select it and click the Delete button beside the Classifications field. If the packets that you need to prioritize contain IP DSCP precedence information in the IP header TOS field, select an IP DSCP classification from the IP DSCP drop-down menu. Menu selections include:

Best Effort Assured Forwarding Class 1 Low Assured Forwarding Class 1 Medium Assured Forwarding Class 1 High Assured Forwarding Class 2 Low Assured Forwarding Class 2 Medium Assured Forwarding Class 2 High Assured Forwarding Class 3 Low Assured Forwarding Class 3 Medium Assured Forwarding Class 3 High Assured Forwarding Class 4 Low Assured Forwarding Class 4 Medium Assured Forwarding Class 4 High Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-6 OL-3446-01 Chapter 13 Configuring QoS Configuring QoS Class Selector 1 Class Selector 2 Class Selector 3 Class Selector 4 Class Selector 5 Class Selector 6 Class Selector 7 Expedited Forwarding Step 8 Step 9 Step 10 Use the Apply Class of Service drop-down menu to select the class of service that the access point will apply to packets of the type that you selected from the IP DSCP menu. The access point matches your IP DSCP selection with your class of service selection. Click the Add button beside the Class of Service menu for IP DSCP. The classification appears in the Classifications field. If you need to prioritize the packets from Spectralink phones (IP Protocol 119) on your wireless LAN, use the Apply Class of Service drop-down menu to select the class of service that the access point will apply to Spectralink phone packets. The access point matches Spectralink phone packets with your class of service selection. Step 11 Click the Add button beside the Class of Service menu for IP Protocol 119. The classification appears in the Classifications field. Step 12 If you need to assign a priority to filtered packets, use the Filter drop-down menu to select a Filter to include in the policy. (If no filters are defined on the access point, a link to the Apply Filters page appears instead of the Filter drop-down menu.) For example, you could assign a high priority to a MAC address filter that includes the MAC addresses of IP phones. Note The access list you use in QoS does not affect the access points packet forwarding decisions. Step 13 Use the Apply Class of Service drop-down menu to select the class of service that the access point will apply to packets that match the filter that you selected from the Filter menu. The access point matches your filter selection with your class of service selection. Step 14 Click the Add button beside the Class of Service menu for Filter. The classification appears in the Classifications field. Step 15 If you want to set a default classification for all packets on a VLAN, use the Apply Class of Service drop-down menu to select the class of service that the access point will apply to all packets on a VLAN. The access point matches all packets with your class of service selection. Step 16 Click the Add button beside the Class of Service menu for Default classification for packets on the VLAN. The classification appears in the Classifications field. Step 17 When you finish adding classifications to the policy, click the Apply button under the Apply Class of Service drop-down menus. To cancel the policy and reset all fields to defaults, click the Cancel button under the Apply Class of Service drop-down menus. To delete the entire policy, click the Delete button under the Apply Class of Service drop-down menus. Step 18 Use the Apply Policies to Interface/VLANs drop-down menus to apply policies to the access point Ethernet and radio ports. If VLANs are configured on the access point, drop-down menus for each VLANs virtual ports appear in this section. If VLANs are not configured on the access point, drop-down menus for each interface appear. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-7 Configuring QoS Chapter 13 Configuring QoS Step 19 Click the Apply button at the bottom of the page to apply the policies to the access point ports. Step 20 If you want the access point to give priority to all voice packets regardless of VLAN, click the Advanced tab. Figure 13-3 shows the QoS Policies - Advanced page. Figure 13-3 QoS Policies - Advanced Page Select Enable and click Apply to give top priority to all voice packets. Adjusting Radio Traffic Class Definitions The access point uses the radio traffic class definitions to calculate backoff times for each packet. As a rule, high-priority packets have short backoff times. The default values in the Min and Max Contention Window fields and in the Slot Time fields are based on settings recommended in IEEE Draft Standard 802.11e. For detailed information on these values, consult that standard. We strongly recommend that you use the default settings on the Radio Traffic Classes page. Changing these values can lead to unexpected blockages of traffic on your wireless LAN, and the blockages might be difficult to diagnose. If you change these values and find that you need to reset them to defaults, use the default settings listed in Table 13-1. The values listed in Table 13-1 are to the power of 2. The access point computes Contention Window values with this equation:

CW = 2 ** X minus 1 where X is the value from Table 13-1. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-8 OL-3446-01 Chapter 13 Configuring QoS Configuring QoS Table 13-1 Default QoS Radio Traffic Class Definitions Class of Service Best Effort Background Spare Excellent Effort Controlled Load Video <100ms Latency Voice <100ms Latency Network Control Min Contention Window 5 6 5 5 4 4 2 3 Max Contention Window 10 10 10 10 10 8 8 8 Fixed Slot Time 2 3 3 2 2 2 2 2 Figure 13-4 shows the Radio Traffic Classes page. Figure 13-4 Radio Traffic Classes Page OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-9 QoS Configuration Examples Chapter 13 Configuring QoS Disabling IGMP Snooping Helper When Internet Group Membership Protocol (IGMP) snooping is enabled on a switch and a client roams from one access point to another, the clients multicast session is dropped. When the access points IGMP snooping helper is enabled, the access point sends a general IGMP query to the network infrastructure on behalf of the client every time the client associates or reassociates to the access point. By doing so, the multicast stream is maintained for the client as it roams. The IGMP snooping helper is enabled by default. To disable it, browse to the QoS Policies - Advanced page, select Disable, and click Apply. Figure 13-3 shows the QoS Policies - Advanced page. QoS Configuration Examples These sections describe two common uses for QoS:

Giving Priority to Voice Traffic, page 13-10 Giving Priority to Video Traffic, page 13-12 Giving Priority to Voice Traffic This section demonstrates how you can apply a QoS policy to your wireless networks voice VLAN to give priority to wireless phone traffic. In this example, the network administrator creates a policy named voice_policy that applies voice class of service to traffic from Spectralink phones (protocol 119 packets). The user applies the voice_policy to the incoming and outgoing radio ports and to the outgoing Ethernet port for VLAN 77. Figure 13-5 shows the administrators QoS Policies page. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-10 OL-3446-01 Chapter 13 Configuring QoS QoS Configuration Examples Figure 13-5 QoS Policies Page for Voice Example The network administrator also enables the QoS element for wireless phones setting on the QoS Policies - Advanced page. This setting gives priority to all voice traffic regardless of VLAN. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-11 QoS Configuration Examples Giving Priority to Video Traffic Chapter 13 Configuring QoS This section demonstrates how you could apply a QoS policy to a VLAN on your network dedicated to video traffic. In this example, the network administrator creates a policy named video_policy that applies video class of service to video traffic. The user applies the video_policy to the incoming and outgoing radio ports and to the outgoing Ethernet port for VLAN 87. Figure 13-6 shows the administrators QoS Policies page. Figure 13-6 QoS Policies Page for Video Example Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 13-12 OL-3446-01 C H A P T E R 14 Configuring Proxy Mobile IP This chapter describes how to configure your access points proxy Mobile IP feature. This chapter contains these sections:

Understanding Proxy Mobile IP, page 14-2 Configuring Proxy Mobile IP, page 14-6 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 14-1 Understanding Proxy Mobile IP Chapter 14 Configuring Proxy Mobile IP Understanding Proxy Mobile IP These sections explain how access points conduct proxy Mobile IP:

Overview, page 14-2 Components of a Proxy Mobile IP Network, page 14-2 How Proxy Mobile IP Works, page 14-3 Proxy Mobile IP Security, page 14-6 Overview The access points proxy Mobile IP feature works in conjunction with the Mobile IP feature in IOS. When you enable proxy Mobile IP on your access point and on your wired network, the access point helps client devices from other networks remain connected to their home networks. The visiting client devices do not need special software; the access point provides proxy Mobile IP services on their behalf. Any wireless client can participate. Mobile IP provides users the freedom to roam beyond their home subnets while maintaining their home IP addresses. This enables transparent routing of IP datagrams to mobile users during their movement, so that data sessions can be initiated to them while they roam. For example, a client device with an IP address of 192.95.5.2 could associate to an access point on a network whose IP addresses are in the 209.165.200.x range. The guest client device keeps its 192.95.5.2 IP address, and the access point forwards its packets through a Mobile IP enabled router across the Internet to a router on the clients home network. Access points with proxy Mobile IP enabled attempt to provide proxy service for any client device that associates and does not perform the following:

Does not issue a DHCP request to get a new IP address. Does not support a Mobile IP stack. If a device supports a Mobile IP stack, the access point assumes that the device will perform its own Mobile IP functions. You enable proxy Mobile IP for specific SSIDs on the access point, providing support only for clients that use those SSIDs. Proxy Mobile IP does not support VLANs. You can pause proxy Mobile IP support without losing your proxy Mobile IP configuration. Proxy Mobile IP is disabled by default. Note Guest client devices do not receive broadcast and multicast packets. Components of a Proxy Mobile IP Network Five devices participate in proxy Mobile IP:

A visiting client device. The visiting client device is any device such as a personal digital assistant or a laptop that can associate to a wireless access point. It does not need any special proxy Mobile IP software. An access point with proxy Mobile IP enabled. The access point proxies on behalf of the visiting client device, performing all Mobile IP services for the device. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 14-2 OL-3446-01 Chapter 14 Configuring Proxy Mobile IP Understanding Proxy Mobile IP An authoritative access point on your network supporting proxy Mobile IP. The authoritative access point uses a subnet map to keep track of the home agent information for all visiting client devices. A home agent. The home agent is a router on the visiting clients home network that serves as the anchor point for communication with the access point and the visiting client. The home agent tunnels packets from a correspondent node on the Internet to the visiting client device. A foreign agent. The foreign agent is a router on your network that serves as the point of attachment for the visiting client device when it is on your network, delivering packets from the home agent to the visiting client. Figure 14-1 shows the five participating devices. Figure 14-1 Participating Devices in Proxy Mobile IP Client device visiting foreign network Client device at home Access point supporting proxy mobile IP Foreign agent Internet Home agent Authoritative access point supporting proxy mobile IP Access point supporting proxy mobile IP 3 5 6 1 8 How Proxy Mobile IP Works The proxy Mobile IP process has four main phases. These sections describe each phase:

Agent Discovery, page 14-3 Subnet Map Exchange, page 14-4 Registration, page 14-5 Tunneling, page 14-5 Agent Discovery During the agent discovery phase, the home agent and the foreign agent advertise their services on the network by using the ICMP Router Discovery Protocol (IRDP). The access point listens to these advertisements. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 14-3 Understanding Proxy Mobile IP Chapter 14 Configuring Proxy Mobile IP The IRDP advertisements carry Mobile IP extensions that specify whether an agent is a home agent, foreign agent, or both; its care-of address; the types of services it provides, such as reverse tunneling and generic routing encapsulation (GRE); and the allowed registration lifetime or roaming period for visiting client devices. Rather than waiting for agent advertisements, an access point can send out an agent solicitation. This solicitation forces any agents on the network to immediately send an agent advertisement. When an access point determines that a client device is connected to a foreign network, it acquires a care-of address for the visiting client. The care-of address is an IP address of a foreign agent that has an interface on the network being visited by a client device. An access point can share this address among many visiting client devices. When the visiting client associates to an access point, the access point compares the clients IP address with that of its own IP network information and detects that the client is a visitor from another network. The access point then begins the registration. However, before the access point can begin the registration process on behalf of the visiting client, it needs to know the home agent IP address of the visiting client. It gets the home agents IP address by looking it up on a subnet map table. Subnet Map Exchange Each access point with proxy Mobile IP enabled maintains a subnet map table. The subnet map table consists of a list of home agent IP addresses and their subnet masks. Table 14-1 is an example of a subnet map table. Table 14-1 Example of a Subnet Map Table Home Agent 10.10.10.1 10.10.4.2 10.3.4.4 10.12.1.1 Subnet Mask 255.255.255.0 255.255.255.0 255.255.255.248 255.255.0.0 Access points use the subnet map table to determine the IP address of the visiting clients home agent. When an access point boots up or when proxy Mobile IP is first enabled on an access point, it obtains its own home agent information using the agent discovery mechanism. It sends this information to another access point called an authoritative access point (AAP). The AAP is an access point that is responsible for keeping the latest subnet map table. When the AAP receives the new information, it replies to the access point with a copy of the latest subnet map table. The new access point now has the latest subnet map table locally and it is ready to perform proxy Mobile IP for visiting clients. Having the subnet map table locally helps the access point do a quick lookup for the home agent information. Meanwhile, the AAP adds the new access point to its list of access points and the home agent information to its subnet map table. The AAP then updates all the other access points with this additional piece of information. You can designate up to three AAPs on your wireless LAN. If an access point fails to reach the first AAP, it tries the next configured AAP. The AAPs compare their subnet map tables periodically to make sure they have the same subnet map table. If the AAP detects that there are no more access points for a particular home agent, it sends a deregistration packet on behalf of the broadcast address of the home agent subnet to see if the home agent is still active. If the home agent responds, the AAP keeps the home agent entry in the subnet map table even though there are no access points in the home agent's subnet. This process supports client devices that have already roamed to foreign networks. If the home agent does not respond, the AAP deletes the home agent entry from the subnet map table. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 14-4 OL-3446-01 Chapter 14 Configuring Proxy Mobile IP Understanding Proxy Mobile IP Registration Tunneling When a client device associates to an access point and the access point determines that the client is visiting from another network, the access point performs a longest-match lookup on its subnet map table and obtains the home agent address for the visiting client. When the access point has the home agent address, it can proceed to the registration step. The access point is configured with the mobility security association (which includes the shared key) of all potential visiting clients with their corresponding home agents. You can enter the mobility security association information locally on the access point or on a RADIUS server on your network, and access points with proxy Mobile IP enabled can access it there. The access point uses the security association information, the visiting clients IP address, and the information that it learns from the foreign agent advertisements to form a Mobile IP registration request on behalf of the visiting client. It sends the registration request to the visiting clients home agent through the foreign agent. The foreign agent checks the validity of the registration request, which includes checking that the requested lifetime does not exceed its limitations and that the requested tunnel encapsulation is available. If the registration request is valid, the foreign agent relays the request to the home agent. The home agent checks the validity of the registration request, which includes authentication of the visiting client. If the registration request is valid, the home agent creates a mobility binding (an association of the visiting client with its care-of address), a tunnel to the care-of address, and a routing entry for forwarding packets to the home address through the tunnel. The home agent then sends a registration reply to the visiting client through the foreign agent (because the registration request was received through the foreign agent). The foreign agent checks the validity of the registration reply, including ensuring that an associated registration request exists in its pending list. If the registration reply is valid, the foreign agent adds the visiting client to its visitor list, establishes a tunnel to the home agent, and creates a routing entry for forwarding packets to the home address. It then relays the registration reply to the visiting client. Finally, the access point checks the validity of the registration reply. If the registration reply specifies that the registration is accepted, the access point is able to confirm that the mobility agents are aware of the visiting client's roaming. Subsequently, the access point intercepts all packets from the visiting client and sends them to the foreign agent. The access point re-registers on behalf of the visiting client before its registration lifetime expires. The home agent and foreign agent update their mobility binding and visitor entry, respectively, during re-registration. A successful Mobile IP registration by the access point on behalf of the visiting client sets up the routing mechanism for transporting packets to and from the visiting client as it roams. The visiting client sends packets using its home IP address, effectively maintaining the appearance that it is always on its home network. Even while the visiting client is roaming on foreign networks, its movements are transparent to correspondent nodes (other devices with which the visiting client communicates). Data packets addressed to the visiting client are routed to its home network, where the home agent intercepts and tunnels them to the care-of address toward the visiting client. Tunneling has two primary functions: encapsulation of the data packet to reach the tunnel endpoint, and decapsulation when the packet is delivered at that endpoint. The tunnel mode that the access point supports is IP Encapsulation within IP Encapsulation. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 14-5 Configuring Proxy Mobile IP Chapter 14 Configuring Proxy Mobile IP Typically, the visiting client sends packets as it normally would. The access point intercepts these packets and sends them to the foreign agent, which routes them to their final destination, the correspondent node. Proxy Mobile IP Security Mobile IP uses a strong authentication scheme to protect communications to and from visiting clients. All registration messages between a visiting client and the home agent must contain the Mobile-Home Authentication Extension (MHAE). Proxy Mobile IP also implements this requirement in the registration messages sent by the access point on behalf of the visiting clients to the home agent. The integrity of the registration messages is protected by a shared 128-bit key between the access point

(on behalf of the visiting client) and the home agent. You can enter the shared key on the access point or on a RADIUS server. The keyed message digest algorithm 5 (MD5) in prefix+suffix mode is used to compute the authenticator value in the appended MHAE. Mobile IP and proxy Mobile IP also support the hash-based message authentication code (HMAC-MD5). The receiver compares the authenticator value it computes over the message with the value in the extension to verify the authenticity. Optionally, the Mobile-Foreign Authentication Extension and the Foreign-Home Authentication Extension are appended to protect message exchanges between a visiting client and foreign agent and between a foreign agent and home agent, respectively. Replay protection uses the identification field in the registration messages as a timestamp and sequence number. The home agent returns its time stamp to synchronize the visiting client for registration. In proxy Mobile IP, the visiting clients are not synchronized to their home agents because the access point intercepts all home agent messages. Configuring Proxy Mobile IP These sections describe how to configure proxy Mobile IP:

Configuration Guidelines, page 14-6 Configuring Proxy Mobile IP on Your Wired LAN, page 14-7 Configuring Proxy Mobile IP on Your Access Point, page 14-7 Configuration Guidelines Before configuring proxy Mobile IP, you should consider these guidelines:

You can enable proxy Mobile IP only on root access points (units connected to the wired LAN). You cannot enable proxy Mobile IP on repeater access points. Access points participating in proxy Mobile IP should be configured with gateway addresses. You can configure the gateways manually, or the access points can receive gateways through DHCP. The foreign and home agents must reside on the network gateways where you want to support proxy Mobile IP. If your authoritative access points receive their IP addresses through DHCP, use the access point host names to specify the AAPs in the proxy Mobile IP configuration. Proxy Mobile IP does not support broadcast and multicast traffic for visiting clients. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 14-6 OL-3446-01 Chapter 14 Configuring Proxy Mobile IP Configuring Proxy Mobile IP To use proxy Mobile IP with DHCP-enabled client devices, you must disable Media Sense on the client devices. You can find instructions for disabling Media Sense in Microsoft Knowledge Base Article Q239924. Click this URL to browse to this article:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q239924&

Proxy Mobile IP does not support VLANs. If you disable proxy Mobile IP on your access point, the entire proxy Mobile IP configuration is cleared. To disable proxy Mobile IP without clearing the configuration, use the ip proxy-mobile pause command. Configuring Proxy Mobile IP on Your Wired LAN Proxy Mobile IP on access points works in conjunction with Mobile IP configured on your network routers. For instructions on configuring Mobile IP on a router on your network, refer to the Mobile IP chapter in 12.2 T New Features (Early Deployment Releases). Click this link to browse to the Mobile IP chapter:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120t/120t1/mobileip.htm Configuring Proxy Mobile IP on Your Access Point Beginning in privileged EXEC mode, follow these steps to configure proxy Mobile IP on your access point:

Step 1 Step 2 Step 3 Command configure terminal ip proxy-mobile enable ip proxy-mobile aap ip-address

[ip-address] [ip-address]

Step 4 ip proxy-mobile secure node address-start address-end spi spi key { hex | ascii } key Purpose Enter global configuration mode. Enable proxy Mobile IP on the access point. Designate the access points that serve as the authoritative access points (the access points with which this access point compares its subnet table). Note You should specify at least two access points as AAPs in case one AAP fails. If you designate only one AAP and it goes offline, you lose all the information in the subnet map table. Create security association settings for an IP address or for a range of IP addresses. Enter an IP address, or the starting and ending addresses in an IP range. Enter the security parameter index. Enter a key for the security parameter. Specify whether the key contains hexadecimal or ASCII characters. If you choose hexadecimal, the key must contain 32 characters. If you choose ASCII, the key can contain up to 16 characters with no minimum length. Step 5 Step 6 interface fastethernet 0 ip proxy-mobile Enter interface configuration mode for the Ethernet port. Enable proxy Mobile IP on the Ethernet port. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 14-7 Configuring Proxy Mobile IP Chapter 14 Configuring Proxy Mobile IP Command exit interface dot11radio { 0 | 1 }

Step 7 Step 8 Step 9 Step 10 ip proxy-mobile ssid ssid Purpose Return to global config mode. Enter interface configuration mode for the radio port. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Enable proxy Mobile IP on the radio port. Enter an SSID for which you want to enable proxy Mobile IP. Note Proxy Mobile IP functionality is not supported on SSIDs where VLAN is also enabled. Step 11 Step 12 Step 13 Step 14 Step 15 Step 16 ip proxy-mobile exit interface bvi1 Enable proxy Mobile IP for the SSID. Return to global config mode. Enter interface configuration mode for the bridge virtual interface (BVI). Enable proxy Mobile IP on the BVI. Return to privileged EXEC mode. ip proxy-mobile end copy running-config startup-config (Optional) Save your entries in the configuration file. Use the no form of the ip proxy-mobile commands to disable proxy Mobile IP. Use the ip proxy-mobile pause command to disable proxy Mobile IP without losing your proxy Mobile IP configuration. This example shows how to enable proxy Mobile IP on an access point for the SSID tsunami for IP addresses from 10.91.7.151 to 10.91.7.176:

ap1200# configure terminal ap1200(config)# ip proxy-mobile enable ap1200(config)# ip proxy-mobile aap 192.168.15.22 192.168.15.24 192.168.15.28 ap1200(config)# ip proxy-mobile secure node 10.91.7.151 10.91.7.176 spi 102 key ascii 0987654 ap1200(config)# interface fastethernet 0 ap1200(config-if)# ip proxy-mobile ap1200(config-if)# interface dot11radio 0 ap1200(config-if)# ip proxy-mobile ap1200(config-if)# ssid tsunami ap1200(config-if-ssid)# ip proxy-mobile ap1200(config-if-ssid)# exit ap1200(config-if)# exit ap1200(config)# interface bvi1 ap1200(config-if)# ip proxy-mobile ap1200(config-if-ssid)# end Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 14-8 OL-3446-01 C H A P T E R 15 Configuring Filters This chapter describes how to configure and manage MAC address, IP, and Ethertype filters on the access point using the web-browser interface. This chapter contains these sections:

Understanding Filters, page 15-2 Configuring Filters Using the CLI, page 15-2 Configuring Filters Using the Web-Browser Interface, page 15-2 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 15-1 Understanding Filters Understanding Filters Chapter 15 Configuring Filters Protocol filters (IP protocol, IP port, and Ethertype) prevent or allow the use of specific protocols through the access points Ethernet and radio ports. You can set up individual protocol filters or sets of filters. You can filter protocols for wireless client devices, users on the wired LAN, or both. For example, an SNMP filter on the access points radio port prevents wireless client devices from using SNMP with the access point but does not block SNMP access from the wired LAN. IP address and MAC address filters allow or disallow the forwarding of unicast and multicast packets either sent from or addressed to specific IP or MAC addresses. You can create a filter that passes traffic to all addresses except those you specify, or you can create a filter that blocks traffic to all addresses except those you specify. You can configure filters using the web-browser interface or by entering commands in the CLI. Tip You can include filters in the access points QoS policies. Refer to Chapter 13, Configuring QoS, for detailed instructions on setting up QoS policies. Configuring Filters Using the CLI To configure filters using IOS commands, you use access control lists (ACLs) and bridge groups. You can find explanations of these concepts and instructions for implementing them in these documents:

Cisco IOS Bridging and IBM Networking Configuration Guide, Release 12.2. Click this link to browse to the Configuring Transparent Bridging chapter:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fibm_c/bcfpart1/bcftb. htm Catalyst 4908G-L3 Cisco IOS Release 12.0(10)W5(18e) Software Feature and Configuration Guide. Click this link to browse to the Command Reference chapter:

http://www.cisco.com/univercd/cc/td/doc/product/l3sw/4908g_l3/ios_12/10w518e/config/cmd_ref. htm Configuring Filters Using the Web-Browser Interface This section describes how to configure and enable filters using the web-browser interface. You complete two steps to configure and enable a filter:

1. Name and configure the filter using the filter setup pages. 2. Enable the filter using the Apply Filters page. These sections describe setting up and enabling three filter types:

Configuring and Enabling MAC Address Filters, page 15-3 Configuring and Enabling IP Filters, page 15-5 Configuring and Enabling Ethertype Filters, page 15-8 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 15-2 OL-3446-01 Chapter 15 Configuring Filters Configuring Filters Using the Web-Browser Interface Configuring and Enabling MAC Address Filters MAC address filters allow or disallow the forwarding of unicast and multicast packets either sent from or addressed to specific MAC addresses. You can create a filter that passes traffic to all MAC addresses except those you specify, or you can create a filter that blocks traffic to all MAC addresses except those you specify. You can apply the filters you create to either or both the Ethernet and radio ports and to either or both incoming and outgoing packets. Note MAC address filters are powerful, and you can lock yourself out of the access point if you make a mistake setting up the filters. If you accidentally lock yourself out of your access point, use the CLI to disable the filters. Use the MAC Address Filters page to create MAC address filters for the access point. Figure 15-1 shows the MAC Address Filters page. Figure 15-1 MAC Address Filters Page Follow this link path to reach the Address Filters page:

1. Click Services in the page navigation bar. 2. 3. On the Apply Filters page, click the MAC Address Filters tab at the top of the page. In the Services page list, click Filters. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 15-3 Configuring Filters Using the Web-Browser Interface Chapter 15 Configuring Filters Creating a MAC Address Filter Follow these steps to create a MAC address filter:

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Follow the link path to the MAC Address Filters page. If you are creating a new MAC address filter, make sure <NEW> (the default) is selected in the Create/Edit Filter Index menu. To edit a filter, select the filter number from the Create/Edit Filter Index menu. In the Filter Index field, name the filter with a number from 700 to 799. The number you assign creates an access control list (ACL) for the filter. Enter a MAC address in the Add MAC Address field. Enter the address with periods separating the three groups of four characters (0040.9612.34ab, for example). Note To make sure the filter operates properly, use lower case for all the letters in the MAC addresses that you enter. Use the Mask entry field to indicate how many bits, from left to right, the filter checks against the MAC address. For example, to require an exact match with the MAC address (to check all bits) enter FFFF.FFFF.FFFF. To check only the first 4 bytes, enter FFFF.FFFF.0000. Select Forward or Block from the Action menu. Click Add. The MAC address appears in the Filters Classes field. To remove the MAC address from the Filters Classes list, select it and click Delete Class. Repeat Step 4 through Step 7 to add addresses to the filter. Select Forward All or Block All from the Default Action menu. The filters default action must be the opposite of the action for at least one of the addresses in the filter. For example, if you enter several addresses and you select Block as the action for all of them, you must choose Forward All as the filters default action. Tip You can create a list of allowed MAC addresses on an authentication server on your network. Consult the Configuring Authentication Types section on page 10-6 for instructions on using MAC-based authentication. Step 10 Click Apply. The filter is saved on the access point, but it is not enabled until you apply it on the Apply Filters page. Step 11 Click the Apply Filters tab to return to the Apply Filters page. Figure 15-2 shows the Apply Filters page. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 15-4 OL-3446-01 Chapter 15 Configuring Filters Configuring Filters Using the Web-Browser Interface Figure 15-2 Apply Filters Page Step 12 Select the filter number from one of the MAC drop-down menus. You can apply the filter to either or both the Ethernet and radio ports, and to either or both incoming and outgoing packets. Step 13 Click Apply. The filter is enabled on the selected ports. If clients are not filtered immediately, click Reload on the System Configuration page to restart the access point. To reach the System Configuration page, click System Software on the task menu and then click System Configuration. Note Client devices with blocked MAC addresses cannot send or receive data through the access point, but they might remain in the Association Table as unauthenticated client devices. Client devices with blocked MAC addresses disappear from the Association Table when the access point stops monitoring them, when the access point reboots, or when the clients associate with another access point. Configuring and Enabling IP Filters IP filters (IP address, IP protocol, and IP port) prevent or allow the use of specific protocols through the access points Ethernet and radio ports, and IP address filters allow or prevent the forwarding of unicast and multicast packets either sent from or addressed to specific IP addresses. You can create a filter that passes traffic to all addresses except those you specify, or you can create a filter that blocks traffic to all addresses except those you specify. You can create filters that contain elements of one, two, or all three IP filtering methods. You can apply the filters you create to either or both the Ethernet and radio ports and to either or both incoming and outgoing packets. Use the IP Filters page to create IP filters for the access point. Figure 15-3 shows the IP Filters page. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 15-5 Configuring Filters Using the Web-Browser Interface Chapter 15 Configuring Filters Figure 15-3 IP Filters Page Follow this link path to reach the IP Filters page:

1. Click Services in the page navigation bar. In the Services page list, click Filters. 2. 3. On the Apply Filters page, click the IP Filters tab at the top of the page. Creating an IP Filter Follow these steps to create an IP filter:

Step 1 Step 2 Follow the link path to the IP Filters page. If you are creating a new filter, make sure <NEW> (the default) is selected in the Create/Edit Filter Index menu. To edit an existing filter, select the filter name from the Create/Edit Filter Index menu. Step 3 Enter a descriptive name for the new filter in the Filter Name field. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 15-6 OL-3446-01 Chapter 15 Configuring Filters Configuring Filters Using the Web-Browser Interface Step 4 Select Forward all or Block all as the filters default action from the Default Action menu. The filters default action must be the opposite of the action for at least one of the addresses in the filter. For example, if you create a filter containing an IP address, an IP protocol, and an IP port and you select Block as the action for all of them, you must choose Forward All as the filters default action. Step 5 To filter an IP address, enter an address in the IP Address field. Note If you plan to block traffic to all IP addresses except those you specify as allowed, put the address of your own PC in the list of allowed addresses to avoid losing connectivity to the access point. Type the mask for the IP address in the Mask field. Enter the mask with periods separating the groups of characters (112.334.556.778, for example). If you enter 255.255.255.255 as the mask, the access point accepts any IP address. If you enter 0.0.0.0, the access point looks for an exact match with the IP address you entered in the IP Address field. The mask you enter in this field behaves the same way that a mask behaves when you enter it in the CLI. Select Forward or Block from the Action menu. Click Add. The address appears in the Filters Classes field. To remove the address from the Filters Classes list, select it and click Delete Class. Repeat Step 5 through Step 8 to add addresses to the filter. If you do not need to add IP protocol or IP port elements to the filter, skip to Step 15 to save the filter on the access point. Step 6 Step 7 Step 8 Step 9 To filter an IP protocol, select one of the commmon protocols from the IP Protocol drop-down menu, or select the Custom radio button and enter the number of an existing ACL in the Custom field. Enter an ACL number from 0 to 255. See Appendix E, Protocol Filters, for a list of IP protocols and their numeric designators. Select Forward or Block from the Action menu. Step 10 Step 11 Click Add. The protocol appears in the Filters Classes field. To remove the protocol from the Filters Classes list, select it and click Delete Class. Repeat Step 9 to Step 11 to add protocols to the filter. If you do not need to add IP port elements to the filter, skip to Step 15 to save the filter on the access point. Step 12 To filter a TCP or UDP port protocol, select one of the commmon port protocols from the TCP Port or UDP Port drop-down menus, or select the Custom radio button and enter the number of an existing protocol in one of the Custom fields. Enter a protocol number from 0 to 65535. See Appendix E, Protocol Filters, for a list of IP port protocols and their numeric designators. Select Forward or Block from the Action menu. Step 13 Step 14 Click Add. The protocol appears in the Filters Classes field. To remove the protocol from the Filters Classes list, select it and click Delete Class. Repeat Step 12 to Step 14 to add protocols to the filter. Step 15 When the filter is complete, click Apply. The filter is saved on the access point, but it is not enabled until you apply it on the Apply Filters page. Step 16 Click the Apply Filters tab to return to the Apply Filters page. Figure 15-4 shows the Apply Filters page. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 15-7 Configuring Filters Using the Web-Browser Interface Chapter 15 Configuring Filters Figure 15-4 Apply Filters Page Step 17 Select the filter name from one of the IP drop-down menus. You can apply the filter to either or both the Ethernet and radio ports, and to either or both incoming and outgoing packets. Step 18 Click Apply. The filter is enabled on the selected ports. Configuring and Enabling Ethertype Filters Ethertype filters prevent or allow the use of specific protocols through the access points Ethernet and radio ports. You can apply the filters you create to either or both the Ethernet and radio ports and to either or both incoming and outgoing packets. Use the Ethertype Filters page to create Ethertype filters for the access point. Figure 15-5 shows the Ethertype Filters page. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 15-8 OL-3446-01 Chapter 15 Configuring Filters Configuring Filters Using the Web-Browser Interface Figure 15-5 Ethertype Filters Page Follow this link path to reach the Ethertype Filters page:

1. Click Services in the page navigation bar. In the Services page list, click Filters. 2. 3. On the Apply Filters page, click the Ethertype Filters tab at the top of the page. Creating an Ethertype Filter Follow these steps to create an Ethertype filter:

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Follow the link path to the Ethertype Filters page. If you are creating a new filter, make sure <NEW> (the default) is selected in the Create/Edit Filter Index menu. To edit an existing filter, select the filter number from the Create/Edit Filter Index menu. In the Filter Index field, name the filter with a number from 200 to 299. The number you assign creates an access control list (ACL) for the filter. Enter an Ethertype number in the Add Ethertype field. See Appendix E, Protocol Filters, for a list of protocols and their numeric designators. Enter the mask for the Ethertype in the Mask field. Select Forward or Block from the Action menu. Click Add. The Ethertype appears in the Filters Classes field. To remove the Ethertype from the Filters Classes list, select it and click Delete Class. Repeat Step 4 through Step 7 to add Ethertypes to the filter. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 15-9 Configuring Filters Using the Web-Browser Interface Chapter 15 Configuring Filters Step 8 Step 9 Select Forward All or Block All from the Default Action menu. The filters default action must be the opposite of the action for at least one of the Ethertypes in the filter. For example, if you enter several Ethertypes and you select Block as the action for all of them, you must choose Forward All as the filters default action. Click Apply. The filter is saved on the access point, but it is not enabled until you apply it on the Apply Filters page. Step 10 Click the Apply Filters tab to return to the Apply Filters page. Figure 15-6 shows the Apply Filters page. Figure 15-6 Apply Filters Page Step 11 Select the filter number from one of the Ethertype drop-down menus. You can apply the filter to either or both the Ethernet and radio ports, and to either or both incoming and outgoing packets. Step 12 Click Apply. The filter is enabled on the selected ports. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 15-10 OL-3446-01 C H A P T E R 16 Configuring CDP This chapter describes how to configure Cisco Discovery Protocol (CDP) on your access point. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco Aironet 1200 Series Access Point Command Reference for this release and the Cisco IOS Configuration Fundamentals Command Reference for Release 12.2. This chapter contains these sections:

Understanding CDP, page 16-2 Configuring CDP, page 16-2 Monitoring and Maintaining CDP, page 16-4 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 16-1 Understanding CDP Understanding CDP Chapter 16 Configuring CDP Cisco Discovery Protocol (CDP) is a device-discovery protocol that runs on all Cisco network equipment. Each device sends identifying messages to a multicast address, and each device monitors the messages sent by other devices. Information in CDP packets is used in network management software such as CiscoWorks2000. CDP is enabled on the access points Ethernet port by default. However, CDP is enabled on the access points radio port only when the radio is associated to another wireless infrastructure device, such as an access point or a bridge. Note For best performance on your wireless LAN, disable CDP on all radio interfaces and on sub-interfaces if VLANs are enabled on the access point. Configuring CDP This section contains CDP configuration information and procedures:

Default CDP Configuration, page 16-2 Configuring the CDP Characteristics, page 16-2 Disabling and Enabling CDP, page 16-3 Disabling and Enabling CDP on an Interface, page 16-4 Default CDP Configuration Table 16-1 lists the default CDP settings. Table 16-1 Default CDP Configuration Feature CDP global state CDP interface state CDP holdtime (packet holdtime in seconds) CDP timer (packets sent every x seconds) Default Setting Enabled Enabled 180 60 Configuring the CDP Characteristics You can configure the CDP holdtime (the number of seconds before the access point discards CDP packets) and the CDP timer (the number of seconds between each CDP packets the access point sends). Beginning in Priveleged Exec mode, follow these steps to configure the CDP holdtime and CDP timer. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 16-2 OL-3446-01 Chapter 16 Configuring CDP Configuring CDP Command configure terminal cdp holdtime seconds Step 1 Step 2 Step 3 cdp timer seconds Step 4 end Purpose Enter global configuration mode.

(Optional) Specify the amount of time a receiving device should hold the information sent by your device before discarding it. The range is from 10 to 255 seconds; the default is 180 seconds.

(Optional) Set the transmission frequency of CDP updates in seconds. The range is from 5 to 254; the default is 60 seconds. Return to Privileged Exec mode. Use the no form of the CDP commands to return to the default settings. This example shows how to configure and verify CDP characteristics:

AP# configure terminal AP(config)# cdp holdtime 120 AP(config)# cdp timer 50 AP(config)# end AP# show cdp Global CDP information:

Sending a holdtime value of 120 seconds Sending CDP packets every 50 seconds For additional CDP show commands, see the Monitoring and Maintaining CDP section on page 16-4. Disabling and Enabling CDP CDP is enabled by default. Beginning in Priveleged Exec mode, follow these steps to disable the CDP device discovery capability. Command configure terminal no cdp run end Step 1 Step 2 Step 3 Purpose Enter global configuration mode. Disable CDP. Return to Privileged Exec mode. Beginning in privileged EXEC mode, follow these steps to enable CDP:

Command configure terminal cdp run end Step 1 Step 2 Step 3 Purpose Enter global configuration mode. Enable CDP after disabling it. Return to privileged EXEC mode. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 16-3 Monitoring and Maintaining CDP Chapter 16 Configuring CDP This example shows how to enable CDP. AP# configure terminal AP(config)# cdp run AP(config)# end Disabling and Enabling CDP on an Interface CDP is enabled by default on all supported interfaces to send and receive CDP information. Beginning in privileged EXEC mode, follow these steps to disable CDP on an interface:

Command configure terminal interface interface-id no cdp enable end copy running-config startup-config Purpose Enter global configuration mode. Enter interface configuration mode, and enter the interface on which you are disabling CDP. Disable CDP on an interface. Return to privileged EXEC mode.

(Optional) Save your entries in the configuration file. Beginning in privileged EXEC mode, follow these steps to enable CDP on an interface:

Command configure terminal interface interface-id cdp enable end copy running-config startup-config Purpose Enter global configuration mode. Enter interface configuration mode, and enter the interface on which you are enabling CDP. Enable CDP on an interface after disabling it. Return to privileged EXEC mode.

(Optional) Save your entries in the configuration file. Step 1 Step 2 Step 3 Step 4 Step 5 Step 1 Step 2 Step 3 Step 4 Step 5 This example shows how to enable CDP on an interface. AP# configure terminal AP(config)# interface x AP(config-if)# cdp enable AP(config-if)# end Monitoring and Maintaining CDP To monitor and maintain CDP on your device, perform one or more of these tasks, beginning in privileged EXEC mode. Command clear cdp counters clear cdp table Description Reset the traffic counters to zero. Delete the CDP table of information about neighbors. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 16-4 OL-3446-01 Chapter 16 Configuring CDP Command show cdp show cdp entry entry-name

[protocol | version]

show cdp interface [type number]

show cdp neighbors [type number]

[detail]

show cdp traffic Monitoring and Maintaining CDP Description Display global information, such as frequency of transmissions and the holdtime for packets being sent. Display information about a specific neighbor. You can enter an asterisk (*) to display all CDP neighbors, or you can enter the name of the neighbor about which you want information. You can also limit the display to information about the protocols enabled on the specified neighbor or information about the version of software running on the device. Display information about interfaces where CDP is enabled. You can limit the display to the type of interface or the number of the interface about which you want information (for example, entering gigabitethernet 0/1 displays information only about Gigabit Ethernet port 1). Display information about neighbors, including device type, interface type and number, holdtime settings, capabilities, platform, and port ID. You can limit the display to neighbors on a specific type or number of interface or expand the display to provide more detailed information. Display CDP counters, including the number of packets sent and received and checksum errors. Below are six examples of output from the CDP show privileged EXEC commands:

AP# show cdp Global CDP information:

Sending CDP packets every 50 seconds Sending a holdtime value of 120 seconds AP# show cdp entry *

Device ID: AP Entry address(es):

IP address: 10.1.1.66 Platform: cisco WS-C3550-12T, Capabilities: Switch IGMP Interface: GigabitEthernet0/2, Port ID (outgoing port): GigabitEthernet0/2 Holdtime : 129 sec Version :

Cisco Internetwork Operating System Software IOS (tm) C3550 Software (C3550-I5Q3L2-M), Experimental Version 12.1(20010612:021 316) [jang-flamingo 120]

Copyright (c) 1986-2001 by cisco Systems, Inc. Compiled Fri 06-Jul-01 18:18 by jang advertisement version: 2 Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=27, value=0000000 0FFFFFFFF010221FF00000000000000024B293A00FF0000 VTP Management Domain: ''

Duplex: full

Device ID: idf2-1-lab-l3.cisco.com Entry address(es):

IP address: 10.1.1.10 Platform: cisco WS-C3524-XL, Capabilities: Trans-Bridge Switch OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 16-5 Monitoring and Maintaining CDP Chapter 16 Configuring CDP Interface: GigabitEthernet0/1, Port ID (outgoing port): FastEthernet0/10 Holdtime : 141 sec Version :

Cisco Internetwork Operating System Software IOS (tm) C3500XL Software (C3500XL-C3H2S-M), Version 12.0(5.1)XP, MAINTENANCE IN TERIM SOFTWARE Copyright (c) 1986-1999 by cisco Systems, Inc. Compiled Fri 10-Dec-99 11:16 by cchang advertisement version: 2 Protocol Hello: OUI=0x00000C, Protocol ID=0x0112; payload len=25, value=0000000 0FFFFFFFF010101FF000000000000000142EFA400FF VTP Management Domain: ''

AP# show cdp entry * protocol Protocol information for talSwitch14 :

IP address: 172.20.135.194 Protocol information for tstswitch2 :

IP address: 172.20.135.204 IP address: 172.20.135.202 Protocol information for tstswitch2 :

IP address: 172.20.135.204 IP address: 172.20.135.202 AP# show cdp interface GigabitEthernet0/1 is up, line protocol is up Encapsulation ARPA Sending CDP packets every 60 seconds Holdtime is 180 seconds GigabitEthernet0/2 is up, line protocol is down Encapsulation ARPA Sending CDP packets every 60 seconds Holdtime is 180 seconds GigabitEthernet0/3 is administratively down, line protocol is down Encapsulation ARPA Sending CDP packets every 60 seconds Holdtime is 180 seconds GigabitEthernet0/4 is up, line protocol is down Encapsulation ARPA Sending CDP packets every 60 seconds Holdtime is 180 seconds GigabitEthernet0/5 is up, line protocol is up Encapsulation ARPA Sending CDP packets every 60 seconds Holdtime is 180 seconds GigabitEthernet0/6 is up, line protocol is up Encapsulation ARPA Sending CDP packets every 60 seconds Holdtime is 180 seconds GigabitEthernet0/7 is up, line protocol is down Encapsulation ARPA Sending CDP packets every 60 seconds Holdtime is 180 seconds GigabitEthernet0/8 is up, line protocol is down Encapsulation ARPA Sending CDP packets every 60 seconds Holdtime is 180 seconds AP# show cdp neighbor Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge S - Switch, H - Host, I - IGMP, r - Repeater Device ID Local Intrfce Holdtme Capability Platform Port ID Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 16-6 OL-3446-01 Chapter 16 Configuring CDP Monitoring and Maintaining CDP Perdido2 Perdido2 Gig 0/6 Gig 0/5 125 125 R S I R S I WS-C3550-1Gig WS-C3550-1Gig 0/6 0/5 AP# show cdp traffic CDP counters :

Total packets output: 50882, Input: 52510 Hdr syntax: 0, Chksum error: 0, Encaps failed: 0 No memory: 0, Invalid packet: 0, Fragmented: 0 CDP version 1 advertisements output: 0, Input: 0 CDP version 2 advertisements output: 50882, Input: 52510 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 16-7 Monitoring and Maintaining CDP Chapter 16 Configuring CDP Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 16-8 OL-3446-01 C H A P T E R 17 Configuring SNMP This chapter describes how to configure the Simple Network Management Protocol (SNMP) on your access point. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco Aironet 1200 Series Access Point Command Reference for this release and to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.2. This chapter consists of these sections:

Understanding SNMP, page 17-2 Configuring SNMP, page 17-4 Displaying SNMP Status, page 17-10 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 17-1 Understanding SNMP Understanding SNMP Chapter 17 Configuring SNMP SNMP is an application-layer protocol that provides a message format for communication between SNMP managers and agents. The SNMP manager can be part of a network management system (NMS) such as CiscoWorks. The agent and management information base (MIB) reside on the access point. To configure SNMP on the access point, you define the relationship between the manager and the agent. The SNMP agent contains MIB variables whose values the SNMP manager can request or change. A manager can get a value from an agent or store a value into the agent. The agent gathers data from the MIB, the repository for information about device parameters and network data. The agent can also respond to a managers requests to get or set data. An agent can send unsolicited traps to the manager. Traps are messages alerting the SNMP manager to a condition on the network. Traps can mean improper user authentication, restarts, link status (up or down), MAC address tracking, closing of a TCP connection, loss of connection to a neighbor, or other significant events. This section includes these concepts:

SNMP Versions, page 17-2 SNMP Manager Functions, page 17-3 SNMP Agent Functions, page 17-3 SNMP Community Strings, page 17-3 Using SNMP to Access MIB Variables, page 17-4 SNMP Versions This software release supports these SNMP versions:

SNMPv1The Simple Network Management Protocol, a full Internet standard, defined in RFC 1157. SNMPv2C, which has these features:

SNMPv2Version 2 of the Simple Network Management Protocol, a draft Internet standard, defined in RFCs 1902 through 1907. SNMPv2CThe Community-based Administrative Framework for SNMPv2, an experimental Internet protocol defined in RFC 1901. SNMPv2C replaces the Party-based Administrative and Security Framework of SNMPv2Classic with the Community-based Administrative Framework of SNMPv2C while retaining the bulk retrieval and improved error handling of SNMPv2Classic. Both SNMPv1 and SNMPv2C use a community-based form of security. The community of managers able to access the agents MIB is defined by an IP address access control list and password. SNMPv2C includes a bulk retrieval mechanism and more detailed error message reporting to management stations. The bulk retrieval mechanism retrieves tables and large quantities of information, minimizing the number of round-trips required. The SNMPv2C improved error-handling includes expanded error codes that distinguish different kinds of error conditions; these conditions are reported through a single error code in SNMPv1. Error return codes now report the error type. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 17-2 OL-3446-01 Chapter 17 Configuring SNMP Understanding SNMP You must configure the SNMP agent to use the version of SNMP supported by the management station. An agent can communicate with multiple managers; therefore, you can configure the software to support communications with one management station using the SNMPv1 protocol and another using the SNMPv2 protocol. SNMP Manager Functions The SNMP manager uses information in the MIB to perform the operations described in Table 17-1. Table 17-1 SNMP Operations Operation get-request get-next-request get-bulk-request2 get-response set-request trap Description Retrieves a value from a specific variable. Retrieves a value from a variable within a table.1 Retrieves large blocks of data that would otherwise require the transmission of many small blocks of data, such as multiple rows in a table. Replies to a get-request, get-next-request, and set-request sent by an NMS. Stores a value in a specific variable. An unsolicited message sent by an SNMP agent to an SNMP manager when some event has occurred. 1. With this operation, an SNMP manager does not need to know the exact variable name. A sequential search is performed to find the needed variable from within a table. 2. The get-bulk command works only with SNMPv2. SNMP Agent Functions The SNMP agent responds to SNMP manager requests as follows:

Get a MIB variableThe SNMP agent begins this function in response to a request from the NMS. The agent retrieves the value of the requested MIB variable and responds to the NMS with that value. Set a MIB variableThe SNMP agent begins this function in response to a message from the NMS. The SNMP agent changes the value of the MIB variable to the value requested by the NMS. The SNMP agent also sends unsolicited trap messages to notify an NMS that a significant event has occurred on the agent. Examples of trap conditions include, but are not limited to, when a port or module goes up or down, when spanning-tree topology changes occur, and when authentication failures occur. SNMP Community Strings SNMP community strings authenticate access to MIB objects and function as embedded passwords. In order for the NMS to access the access point, the community string definitions on the NMS must match at least one of the three community string definitions on the access point. A community string can have one of these attributes:

Read-onlyGives read access to authorized management stations to all objects in the MIB except the community strings, but does not allow write access OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 17-3 Configuring SNMP Chapter 17 Configuring SNMP Read-writeGives read and write access to authorized management stations to all objects in the MIB, but does not allow access to the community strings Read-write-allGives read and write access to authorized management stations to all objects in the MIB, including the community strings Using SNMP to Access MIB Variables An example of an NMS is the CiscoWorks network management software. CiscoWorks 2000 software uses the access point MIB variables to set device variables and to poll devices on the network for specific information. The results of a poll can be displayed as a graph and analyzed to troubleshoot internetworking problems, increase network performance, verify the configuration of devices, monitor traffic loads, and more. As shown in Figure 17-1, the SNMP agent gathers data from the MIB. The agent can send traps

(notification of certain events) to the SNMP manager, which receives and processes the traps. Traps are messages alerting the SNMP manager to a condition on the network such as improper user authentication, restarts, link status (up or down), MAC address tracking, and so forth. The SNMP agent also responds to MIB-related queries sent by the SNMP manager in get-request, get-next-request, and set-request format. Figure 17-1 SNMP Network NMS get-request, get-next-request, get-bulk, set-request Network device SNMP manager get-response, traps MIB SNMP agent 9 4 9 1 8 For information on supported MIBs and how to access them, see Appendix F, Supported MIBs. Configuring SNMP This section describes how to configure SNMP on your access point. It contains this configuration information:

Default SNMP Configuration, page 17-5 Disabling the SNMP Agent, page 17-5 Configuring Community Strings, page 17-5 Configuring Trap Managers and Enabling Traps, page 17-7 Setting the Agent Contact and Location Information, page 17-9 Using the snmp-server view Command, page 17-9 SNMP Examples, page 17-9 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 17-4 OL-3446-01 Chapter 17 Configuring SNMP Configuring SNMP Default SNMP Configuration Table 17-2 shows the default SNMP configuration. Table 17-2 Default SNMP Configuration Feature SNMP agent SNMP community strings SNMP trap receiver SNMP traps Default Setting Enabled Read-Only: Public Read-Write: Private Read-Write-all: Secret None configured None enabled Disabling the SNMP Agent Beginning in privileged EXEC mode, follow these steps to disable the SNMP agent:

Command configure terminal no snmp-server end show running-config copy running-config startup-config Step 1 Step 2 Step 3 Step 4 Step 5 Purpose Enter global configuration mode. Disable the SNMP agent operation. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. No specific IOS command exists to enable SNMP. The first snmp-server global configuration command that you enter enables SNMPv1 and SNMPv2. Configuring Community Strings You use the SNMP community string to define the relationship between the SNMP manager and the agent. The community string acts like a password to permit access to the agent on the access point. Optionally, you can specify one or more of these characteristics associated with the string:

An access list of IP addresses of the SNMP managers that are permitted to use the community string to gain access to the agent A MIB view, which defines the subset of all MIB objects accessible to the given community Read and write or read-only permission for the MIB objects accessible to the community OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 17-5 Configuring SNMP Chapter 17 Configuring SNMP Beginning in privileged EXEC mode, follow these steps to configure a community string on the access point:

Step 1 Step 2 Command configure terminal snmp-server community string [ro | rw]

[access-list-number]

Step 3 access-list access-list-number {deny |

permit} source [source-wildcard]

Step 4 Step 5 Step 6 end show running-config copy running-config startup-config Purpose Enter global configuration mode. Configure the community string. For string, specify a string that acts like a password and permits access to the SNMP protocol. You can configure one or more community strings of any length.

(Optional) Specify either read-only (ro) if you want authorized management stations to retrieve MIB objects, or specify read/write (rw) if you want authorized management stations to retrieve and modify MIB objects. By default, the community string permits read-only access to all objects.

(Optional) For access-list-number, enter an IP standard access list numbered from 1 to 99 and 1300 to 1999.

(Optional) If you specified an IP standard access list number in Step 2, then create the list, repeating the command as many times as necessary. For access-list-number, enter the access list number specified in Step 2. The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. For source, enter the IP address of the SNMP managers that are permitted to use the community string to gain access to the agent.

(Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Note To disable access for an SNMP community, set the community string for that community to the null string (do not enter a value for the community string). To remove a specific community string, use the no snmp-server community string global configuration command. This example shows how to assign the string comaccess to SNMP, to allow read-only access, and to specify that IP access list 4 can use the community string to gain access to the access point SNMP agent:

AP(config)# snmp-server community comaccess ro 4 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 17-6 OL-3446-01 Chapter 17 Configuring SNMP Configuring SNMP Configuring Trap Managers and Enabling Traps A trap manager is a management station that receives and processes traps. Traps are system alerts that the access point generates when certain events occur. By default, no trap manager is defined, and no traps are issued. Access points running this IOS release can have an unlimited number of trap managers. Community strings can be any length. Table 17-3 describes the supported access point traps (notification types). You can enable any or all of these traps and configure a trap manager to receive them. Table 17-3 Notification Types Notification Type authenticate-fail config deauthenticate disassociate dot11-qos entity rogue-ap snmp switch-over syslog wlan-wep Description Enable traps for authentication failures. Enable traps for SNMP configuration changes. Enable traps for client device deauthentications. Enable traps for client device disassociations. Enable traps for QoS changes. Enable traps for SNMP entity changes. Enable traps for rogue access point detections. Enable traps for SNMP events. Enable traps for switch-overs. Enable syslog traps. Enable WEP traps. Some notification types cannot be controlled with the snmp-server enable global configuration command, such as tty and udp-port. These notification types are always enabled. You can use the snmp-server host global configuration command to a specific host to receive the notification types listed in Table 17-3. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 17-7 Configuring SNMP Chapter 17 Configuring SNMP Beginning in privileged EXEC mode, follow these steps to configure the access point to send traps to a host:

Step 1 Step 2 Command configure terminal snmp-server host host-addr {traps | informs} {version {1

| 2c}} community-string notification-type Step 3 snmp-server enable traps notification-types Step 4 Step 5 Step 6 end show running-config copy running-config startup-config Purpose Enter global configuration mode. Specify the recipient of the trap message. For host-addr, specify the name or address of the host (the targeted recipient). Specify traps (the default) to send SNMP traps to the host. Specify informs to send SNMP informs to the host. Specify the SNMP version to support. Version 1, the default, is not available with informs. Note Though visible in the command-line help string, the version 3 keyword (SNMPv3) is not supported. For community-string, specify the string to send with the notification operation. Though you can set this string using the snmp-server host command, we recommend that you define this string by using the snmp-server community command before using the snmp-server host command. For notification-type, use the keywords listed in Table 17-3 on page 17-7. Enable the access point to send specific traps. For a list of traps, see Table 17-3 on page 17-7. To enable multiple types of traps, you must issue a separate snmp-server enable traps command for each trap type. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To remove the specified host from receiving traps, use the no snmp-server host host global configuration command. To disable a specific trap type, use the no snmp-server enable traps notification-types global configuration command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 17-8 OL-3446-01 Chapter 17 Configuring SNMP Configuring SNMP Setting the Agent Contact and Location Information Beginning in privileged EXEC mode, follow these steps to set the system contact and location of the SNMP agent so that these descriptions can be accessed through the configuration file:

Command configure terminal snmp-server contact text Step 1 Step 2 Purpose Enter global configuration mode. Set the system contact string. For example:

Step 3 snmp-server location text Set the system location string. snmp-server contact Dial System Operator at beeper 21555. Step 4 Step 5 Step 6 end show running-config copy running-config startup-config For example:

snmp-server location Building 3/Room 222 Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Using the snmp-server view Command In global configuration mode, use the snmp-server view command to access Standard IEEE 802.11 MIB objects through IEEE view and the dot11 read-write community string. This example shows how to enable IEEE view and dot11 read-write community string:

AP(config)# snmp-server view ieee ieee802dot11 included AP(config)# snmp-server community dot11 view ieee RW SNMP Examples This example shows how to enable SNMPv1 and SNMPv2C. The configuration permits any SNMP manager to access all objects with read-only permissions using the community string public. This configuration does not cause the access point to send any traps. AP(config)# snmp-server community public This example shows how to permit any SNMP manager to access all objects with read-only permission using the community string public. The access point also sends config traps to the hosts 192.180.1.111 and 192.180.1.33 using SNMPv1 and to the host 192.180.1.27 using SNMPv2C. The community string public is sent with the traps. AP(config)# snmp-server community public AP(config)# snmp-server enable traps config AP(config)# snmp-server host 192.180.1.27 version 2c public AP(config)# snmp-server host 192.180.1.111 version 1 public AP(config)# snmp-server host 192.180.1.33 public OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 17-9 Displaying SNMP Status Chapter 17 Configuring SNMP This example shows how to allow read-only access for all objects to members of access list 4 that use the comaccess community string. No other SNMP managers have access to any objects. SNMP Authentication Failure traps are sent by SNMPv2C to the host cisco.com using the community string public. AP(config)# snmp-server community comaccess ro 4 AP(config)# snmp-server enable traps snmp authentication AP(config)# snmp-server host cisco.com version 2c public This example shows how to send Entity MIB traps to the host cisco.com. The community string is restricted. The first line enables the access point to send Entity MIB traps in addition to any traps previously enabled. The second line specifies the destination of these traps and overwrites any previous snmp-server host commands for the host cisco.com. AP(config)# snmp-server enable traps entity AP(config)# snmp-server host cisco.com restricted entity This example shows how to enable the access point to send all traps to the host myhost.cisco.com using the community string public:

AP(config)# snmp-server enable traps AP(config)# snmp-server host myhost.cisco.com public Displaying SNMP Status To display SNMP input and output statistics, including the number of illegal community string entries, errors, and requested variables, use the show snmp privileged EXEC command. For information about the fields in this display, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.2. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 17-10 OL-3446-01 C H A P T E R 18 Configuring Repeater and Standby Access Points This chapter descibes how to configure your access point as a hot standby unit or as a repeater unit. This chapter contains these sections:

Understanding Repeater Access Points, page 18-2 Configuring a Repeater Access Point, page 18-3 Understanding Hot Standby, page 18-7 Configuring a Hot Standby Access Point, page 18-7 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 18-1 Understanding Repeater Access Points Chapter 18 Configuring Repeater and Standby Access Points Understanding Repeater Access Points A repeater access point is not connected to the wired LAN; it is placed within radio range of an access point connected to the wired LAN to extend the range of your infrastructure or to overcome an obstacle that blocks radio communication. You can configure either the 2.4-GHz radio or the 5-GHz radio as a repeater. In access points with two radios, only one radio can be a repeater; the other radio must be configured as a root radio. The repeater forwards traffic between wireless users and the wired LAN by sending packets to either another repeater or to an access point connected to the wired LAN. The data is sent through the route that provides the best performance for the client. When you configure an access point as a repeater, the access points Ethernet port does not forward traffic. You can set up a chain of several repeater access points, but throughput for client devices at the end of the repeater chain will be quite low. Because each repeater must receive and then re-transmit each packet on the same channel, throughput is cut in half for each repeater you add to the chain. A repeater access point associates to the access point with which it has the best connectivity. However, you can specify the access point to which the repeater associates. Setting up a static, specific association between a repeater and a root access point improves repeater performance. To set up repeaters, you must enable Aironet extensions on both the parent (root) access point and the repeater access points. Aironet extensions, which are enabled by default, improve the access point's ability to understand the capabilities of Cisco Aironet client devices associated with the access point. Disabling Aironet extensions sometimes improves the interoperability between the access point and non-Cisco client devices. Non-Cisco client devices might have difficulty communicating with repeater access points and the root access point to which repeaters are associated. Figure 18-1 shows an access point acting as a repeater. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 18-2 OL-3446-01 Chapter 18 Configuring Repeater and Standby Access Points Configuring a Repeater Access Point Figure 18-1 Access Point as a Repeater Access Point

(Root Unit) Wired LAN Access Point

(Repeater) 0 0 0 6 6 Configuring a Repeater Access Point This section provides instructions for setting up an access point as a repeater and includes these sections:

Default Configuration, page 18-4 Guidelines for Repeaters, page 18-4 Setting Up a Repeater, page 18-4 Verifying Repeater Operation, page 18-5 Setting Up a Repeater As a LEAP Client, page 18-6 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 18-3 Configuring a Repeater Access Point Default Configuration Chapter 18 Configuring Repeater and Standby Access Points Access points are configured as root units by default. Table 18-1 shows the default values for settings that control the access points role in the wireless LAN. Table 18-1 Default Settings for Role in Wireless LAN Feature Station role Parent Extensions Default Setting Root none Aironet Guidelines for Repeaters Follow these guidelines when configuring repeater access points:

Use repeaters to serve client devices that do not require high throughput. Repeaters extend the coverage area of your wireless LAN, but they drastically reduce throughput. Use repeaters when most if not all client devices that associate with the repeaters are Cisco Aironet clients. Non-Cisco client devices sometimes have trouble communicating with repeater access points. Setting Up a Repeater Beginning in Privileged Exec mode, follow these steps to configure an access point as a repeater:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Step 3 ssid ssid-string Step 4 infrastructure-ssid [optional]

Step 5 exit Step 6 Step 7 station-role repeater dot11 extensions aironet Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Create the SSID that the repeater uses to associate to a root access point; in the next step designate this SSID as an infrastructure SSID. If you created an infrastructure SSID on the root access point, create the same SSID on the repeater, also. Designate the SSID as an infrastructure SSID. The repeater uses this SSID to associate to the root access point. Infrastructure devices must associate to the repeater access point using this SSID unless you also enter the optional keyword. Exit SSID configuration mode and return to radio interface configuration mode. Set the access points role in the wireless LAN to repeater. If Aironet extensions are disabled, enable Aironet extensions. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 18-4 OL-3446-01 Chapter 18 Configuring Repeater and Standby Access Points Configuring a Repeater Access Point Step 8 Command parent {1-4} mac-address

[timeout]

Purpose

(Optional) Enter the MAC address for the access point to which the repeater should associate. You can enter MAC addresses for up to four parent access points. The repeater attempts to associate to MAC address 1 first; if that access point does not respond, the repeater tries the next access point in its parent list.

(Optional) You can also enter a timeout value in seconds that determines how long the repeater attempts to associate to a parent access point before trying the next parent in the list. Enter a timeout value from 0 to 65535 seconds. Return to privileged EXEC mode.

(Optional) Save your entries in the configuration file. Step 9 Step 10 end copy running-config startup-config This example shows how to set up a repeater acess point with three potential parents:

AP# configure terminal AP(config)# interface dot11radio 0 AP(config-if)# ssid chicago AP(config-ssid)# infrastructure-ssid AP(config-ssid)# exit AP(config-if)# station-role repeater AP(config-if)# dot11 extensions aironet AP(config-if)# parent 1 0987.1234.h345 900 AP(config-if)# parent 2 7809.b123.c345 900 AP(config-if)# parent 3 6543.a456.7421 900 AP(config-if)# end Verifying Repeater Operation After you set up the repeater, check the LEDs on top of the repeater access point. If your repeater is functioning correctly, the LEDs on the repeater and the root access point to which it is associated behave like this:

The status LED on the root access point is steady green, indicating that at least one client device is associated with it (in this case, the repeater). The status LED on the repeater access point is steady green when it is associated with the root access point and the repeater has client devices associated to it. The repeater's status LED flashes (steady green for 7/8 of a second and off for 1/8 of a second) when it is associated with the root access point but the repeater has no client devices associated to it. The repeater access point should also appear as associated with the root access point in the root access point's Association Table. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 18-5 Configuring a Repeater Access Point Chapter 18 Configuring Repeater and Standby Access Points Setting Up a Repeater As a LEAP Client You can set up a repeater access point to authenticate to your network like other wireless client devices. After you provide a network username and password for the repeater access point, it authenticates to your network using LEAP, Cisco's wireless authentication method, and receives and uses dynamic WEP keys. Setting up a repeater as a LEAP client requires three major steps:

1. Create an authentication username and password for the repeater on your authentication server. 2. Configure LEAP authentication on the root access point to which the repeater associates. See Chapter 10, Configuring Authentication Types, for instructions on setting up authentication on the access point. 3. Configure the repeater to act as a LEAP client. Beginning in Privileged Exec mode, follow these instructions to set up the repeater as a LEAP client:

Command configure terminal interface dot11radio { 0 | 1 }

Step 1 Step 2 Step 3 ssid ssid-string Step 4 authentication network-eap list-name Step 5 authentication client username username password password Step 6 infrastructure ssid [optional]

Step 7 Step 8 end copy running-config startup-config Purpose Enter global configuration mode. Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1. Create an SSID and enter SSID configuration mode for the new SSID. The SSID can consist of up to 32 alphanumeric characters, but they should not include spaces. SSIDs are case-sensitive. Enable LEAP authentication on the repeater so that LEAP-enabled client devices can authenticate through the repeater. For list-name, specify the name or IP address of the authentication server. Configure the username and password that the repeater uses when it performs LEAP authentication. This username and password must match the username and password that you set up for the repeater on the authentication server.

(Optional) Designate the SSID as the SSID that other access points and workgroup bridges use to associate to this access point. If you do not designate an SSID as the infrastructure SSID, infrastructure devices can associate to the access point using any SSID. If you designate an SSID as the infrastructure SSID, infrastructure devices must associate to the access point using that SSID unless you also enter the optional keyword. Return to privileged EXEC mode.

(Optional) Save your entries in the configuration file. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 18-6 OL-3446-01 Chapter 18 Configuring Repeater and Standby Access Points Understanding Hot Standby Understanding Hot Standby Hot Standby mode designates an access point as a backup for another access point. The standby access point is placed near the access point it monitors, configured exactly the same as the monitored access point. The standby access point associates with the monitored access point as a client and queries the monitored access point regularly through both the Ethernet and the radio ports. If the monitored access point fails to respond, the standby access point comes online and takes the monitored access points place in the network. Except for the IP address, the standby access points settings should be identical to the settings on the monitored access point. If the monitored access point goes offline and the standby access point takes its place in the network, matching settings ensures that client devices can switch easily to the standby access point. Hot standby mode is disabled by default. Note If the monitored access point malfunctions and the standby access point takes its place, repeat the hot standby setup on the standby access point when you repair or replace the monitored access point. The standby access point does not revert to standby mode automatically. Configuring a Hot Standby Access Point When you set up the standby access point, you must enter the MAC address of the access point that the standby unit will monitor. Record the MAC address of the monitored access point before you configure the standby access point. The standby access point also must duplicate several key settings on the monitored access point. These settings are:

Primary SSID (as well as additional SSIDs configured on the monitored access point) Default IP Subnet Mask Default Gateway Data rates WEP settings Authentication Types Check the monitored access point and record these settings before you set up the standby access point. Note Wireless client devices associated to the standby access point lose their connections during the hot standby setup process. Beginning in Privileged Exec mode, follow these steps to enable hot standby mode on an access point:

Command configure terminal iapp standby mac-address Step 1 Step 2 Purpose Enter global configuration mode. Puts the access point into standby mode and specifies the MAC address of the monitored access point. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 18-7 Configuring a Hot Standby Access Point Chapter 18 Configuring Repeater and Standby Access Points Command interface dot11radio 0 Step 3 Purpose Enter interface configuration mode for the radio interface. Step 4 ssid ssid-string Step 5 infrastructure-ssid [optional]

Step 6 exit Step 7 iapp standby poll-frequency seconds Step 8 iapp standby timeout seconds Step 9 show iapp standby-parms Step 10 Step 11 end copy running-config startup-config Note Hot Standby mode is available only for the 2.4-GHz radio. Create the SSID that the standby access point uses to associate to the monitored access point; in the next step designate this SSID as an infrastructure SSID. If you created an infrastructure SSID on the monitored access point, create the same SSID on the repeater, also. Designate the SSID as an infrastructure SSID. The standby uses this SSID to associate to the monitored access point. If the standby access point takes the place of the monitored access point, infrastructure devices must associate to the standby access point using this SSID unless you also enter the optional keyword. Exit SSID configuration mode and return to radio interface configuration mode. Sets the number of seconds between queries that the standby access point sends to the monitored access points radio and Ethernet ports. Sets the number of seconds the standby access point waits for a response from the monitored access point before it assumes that the monitored access point has malfunctioned. Verify your entries. If the access point is in standby mode, this command displays the standby parameters, including the MAC address of the monitored access point and the poll-frequency and timeout values. If the access point is not in standby mode, no iapp standby mac-address appears. Return to privileged EXEC mode.

(Optional) Save your entries in the configuration file. After you enable standby mode, configure the settings that you recorded from the monitored access point to match on the standby access point. Use this command to check the standby configuration:

show iapp standby-parms This command displays the MAC address of the standby access point, the standby timeout, and the poll-frequency values. If no standby access point is configured, this message appears:

no iapp standby mac-address Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 18-8 OL-3446-01 C H A P T E R 19 Managing Firmware and Configurations This chapter describes how to manipulate the Flash file system, how to copy configuration files, and how to archive (upload and download) software images. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco Aironet 1200 Series Access Point Command Reference for this release and the Cisco IOS Configuration Fundamentals Command Reference for Release 12.2. This chapter consists of these sections:

Working with the Flash File System, page 19-2 Working with Configuration Files, page 19-8 Working with Software Images, page 19-18 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-1 Working with the Flash File System Chapter 19 Managing Firmware and Configurations Working with the Flash File System The Flash file system on your access point provides several commands to help you manage software image and configuration files. The Flash file system is a single Flash device on which you can store files. This Flash device is called flash:. This section contains this information:

Displaying Available File Systems, page 19-2 Setting the Default File System, page 19-3 Displaying Information About Files on a File System, page 19-3 Changing Directories and Displaying the Working Directory, page 19-4 Creating and Removing Directories, page 19-4 Copying Files, page 19-5 Deleting Files, page 19-5 Creating, Displaying, and Extracting tar Files, page 19-6 Displaying the Contents of a File, page 19-8 Displaying Available File Systems To display the available file systems on your access point, use the show file systems privileged EXEC command as shown in this example:

ap# show file systems File Systems:

Size(b) Free(b) Type Flags Prefixes

* 16128000 11118592 flash rw flash:

16128000 11118592 unknown rw zflash:

32768 26363 nvram rw nvram:

- - network rw tftp:

- - opaque rw null:

- - opaque rw system:

- - opaque ro xmodem:

- - opaque ro ymodem:

- - network rw rcp:

- - network rw ftp:

Table 19-1 lists field descriptions for the show file systems command. Table 19-1 show file systems Field Descriptions Field Size(b) Free(b) Value Amount of memory in the file system in bytes. Amount of free memory in the file system in bytes. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-2 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with the Flash File System Table 19-1 show file systems Field Descriptions (continued) Field Type Flags Prefixes Value Type of file system. flashThe file system is for a Flash memory device. networkThe file system is for a network device. nvramThe file system is for a nonvolatile RAM (NVRAM) device. opaqueThe file system is a locally generated pseudo file system (for example, the system) or a download interface, such as brimux. unknownThe file system is an unknown type. Permission for file system. roread-only. rwread/write. wowrite-only. Alias for file system. flash:Flash file system. ftp:File Transfer Protocol network server. Used to transfer files to or from the network device. nvram:Non-volatile RAM memory (NVRAM). null:Null destination for copies. You can copy a remote file to null to determine its size. rcp:Remote Copy Protocol (RCP) network server. system:Contains the system memory, including the running configuration. tftp:Trivial File Transfer Protocol (TFTP) network server. zflash:Read-only file decompression file system, which mirrors the contents of the Flash file system. Setting the Default File System You can specify the file system or directory that the system uses as the default file system by using the cd filesystem: privileged EXEC command. You can set the default file system to omit the filesystem:

argument from related commands. For example, for all privileged EXEC commands that have the optional filesystem: argument, the system uses the file system specified by the cd command. By default, the default file system is flash:. You can display the current default file system as specified by the cd command by using the pwd privileged EXEC command. Displaying Information About Files on a File System You can view a list of the contents of a file system before manipulating its contents. For example, before copying a new configuration file to Flash memory, you might want to verify that the file system does not already contain a configuration file with the same name. Similarly, before copying a Flash configuration file to another location, you might want to verify its filename for use in another command. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-3 Working with the Flash File System Chapter 19 Managing Firmware and Configurations To display information about files on a file system, use one of the privileged EXEC commands in Table 19-2:

Table 19-2 Commands for Displaying Information About Files Command dir [/all] [filesystem:][filename]

show file systems show file information file-url show file descriptors Description Display a list of files on a file system. Display more information about each of the files on a file system. Display information about a specific file. Display a list of open file descriptors. File descriptors are the internal representations of open files. You can use this command to see if another user has a file open. Changing Directories and Displaying the Working Directory Beginning in privileged EXEC mode, follow these steps to change directories and display the working directory. Command dir filesystem:

Step 1 Step 2 cd new_configs Step 3 pwd Purpose Display the directories on the specified file system. For filesystem:, use flash: for the system board Flash device. Change to the directory of interest. The command example shows how to change to the directory named new_configs. Display the working directory. Creating and Removing Directories Beginning in privileged EXEC mode, follow these steps to create and remove a directory:

Command dir filesystem:

Step 1 Step 2 mkdir old_configs Purpose Display the directories on the specified file system. For filesystem:, use flash: for the system board Flash device. Create a new directory. The command example shows how to create the directory named old_configs. Directory names are case sensitive. Directory names are limited to 45 characters between the slashes (/); the name cannot contain control characters, spaces, deletes, slashes, quotes, semicolons, or colons. Verify your entry. Step 3 dir filesystem:

To delete a directory with all its files and subdirectories, use the delete /force /recursive filesystem:/file-url privileged EXEC command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-4 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with the Flash File System Use the /recursive keyword to delete the named directory and all subdirectories and the files contained in it. Use the /force keyword to suppress the prompting that confirms a deletion of each file in the directory. You are prompted only once at the beginning of this deletion process. Use the /force and

/recursive keywords for deleting old software images that were installed by using the archive download-sw command but are no longer needed. For filesystem, use flash: for the system board Flash device. For file-url, enter the name of the directory to be deleted. All the files in the directory and the directory are removed. Caution When files and directories are deleted, their contents cannot be recovered. Copying Files To copy a file from a source to a destination, use the copy [/erase] source-url destination-url privileged EXEC command. For the source and destination URLs, you can use running-config and startup-config keyword shortcuts. For example, the copy running-config startup-config command saves the currently running configuration file to the NVRAM section of Flash memory to be used as the configuration during system initialization. Network file system URLs include ftp:, rcp:, and tftp: and have the following syntax:

File Transfer Protocol (FTP)ftp:[[//username [:password]@location]/directory]/filename Remote Copy Protocol (RCP)rcp:[[//username@location]/directory]/filename Trivial File Transfer Protocol (TFTP)tftp:[[//location]/directory]/filename Local writable file systems include flash:. Some invalid combinations of source and destination exist. Specifically, you cannot copy these combinations:

From a running configuration to a running configuration From a startup configuration to a startup configuration From a device to the same device (for example, the copy flash: flash: command is invalid) For specific examples of using the copy command with configuration files, see the Working with Configuration Files section on page 19-8. To copy software images either by downloading a new version or uploading the existing one, use the archive download-sw or the archive upload-sw privileged EXEC command. For more information, see the Working with Software Images section on page 19-18. Deleting Files When you no longer need a file on a Flash memory device, you can permanently delete it. To delete a file or directory from a specified Flash device, use the delete [/force] [/recursive] [filesystem:]/file-url privileged EXEC command. Caution When files are deleted, their contents cannot be recovered. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-5 Working with the Flash File System Chapter 19 Managing Firmware and Configurations Use the /recursive keyword for deleting a directory and all subdirectories and the files contained in it. Use the /force keyword to suppress the prompting that confirms a deletion of each file in the directory. You are prompted only once at the beginning of this deletion process. Use the /force and /recursive keywords for deleting old software images that were installed by using the archive download-sw command but are no longer needed. If you omit the filesystem: option, the access point uses the default device specified by the cd command. For file-url, you specify the path (directory) and the name of the file to be deleted. This example shows how to delete the file myconfig from the default Flash memory device:

ap# delete myconfig Creating, Displaying, and Extracting tar Files You can create a tar file and write files into it, list the files in a tar file, and extract the files from a tar file as described in the next sections. Creating a tar File To create a tar file and write files into it, use this privileged EXEC command:

archive tar /create destination-url flash:/file-url For destination-url, specify the destination URL alias for the local or network file system and the name of the tar file to create. These options are supported:

For the local Flash file system, the syntax is flash:/file-url For the File Transfer Protocol (FTP), the syntax is ftp:[[//username[:password]@location]/directory]/tar-filename.tar For the Remote Copy Protocol (RCP), the syntax is rcp:[[//username@location]/directory]/tar-filename.tar For the Trivial File Transfer Protocol (TFTP), the syntax is tftp:[[//location]/directory]/tar-filename.tar The tar-filename.tar is the tar file to be created. For flash:/file-url, specify the location on the local Flash file system from which the new tar file is created. You can also specify an optional list of files or directories within the source directory to write to the new tar file. If none are specified, all files and directories at this level are written to the newly created tar file. This example shows how to create a tar file. This command writes the contents of the new-configs directory on the local Flash device to a file named saved.tar on the TFTP server at 172.20.10.30:

ap# archive tar /create tftp:172.20.10.30/saved.tar flash:/new-configs Displaying the Contents of a tar File To display the contents of a tar file on the screen, use this privileged EXEC command:

archive tar /table source-url Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-6 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with the Flash File System For source-url, specify the source URL alias for the local or network file system. These options are supported:

For the local Flash file system, the syntax is flash:

For the File Transfer Protocol (FTP), the syntax is ftp:[[//username[:password]@location]/directory]/tar-filename.tar For the Remote Copy Protocol (RCP), the syntax is rcp:[[//username@location]/directory]/tar-filename.tar For the Trivial File Transfer Protocol (TFTP), the syntax is tftp:[[//location]/directory]/tar-filename.tar The tar-filename.tar is the tar file to display. You can also limit the display of the files by specifying an optional list of files or directories after the tar file; then only these files are displayed. If none are specified, all files and directories are displayed. This example shows how to display the contents of the c1200-k9w7-mx.122-8.JA.tar file that is in Flash memory:

ap# archive tar /table flash:c1200-k9w7-mx.122-8.JA.tar info (219 bytes) c1200-k9w7-mx.122-8.JA/ (directory) c1200-k9w7-mx.122-8.JA/html/ (directory) c1200-k9w7-mx.122-8.JA/html/foo.html (0 bytes) c1200-k9w7-mx.122-8.JA/c1200-k9w7-mx.122-8.JA.bin (610856 bytes) c1200-k9w7-mx.122-8.JA/info (219 bytes) info.ver (219 bytes) This example shows how to display only the c1200-k9w7-mx.122-8.JA/html directory and its contents:

ap# archive tar /table flash:c1200-k9w7-mx.122-8.JA/html c1200-k9w7-mx.122-8.JA/html/ (directory) c1200-k9w7-mx.122-8.JA/html/foo.html (0 bytes) Extracting a tar File To extract a tar file into a directory on the Flash file system, use this privileged EXEC command:

archive tar /xtract source-url flash:/file-url For source-url, specify the source URL alias for the local or network file system. These options are supported:

For the local Flash file system, the syntax is flash:

For the File Transfer Protocol (FTP), the syntax is ftp:[[//username[:password]@location]/directory]/tar-filename.tar For the Remote Copy Protocol (RCP), the syntax is rcp:[[//username@location]/directory]/tar-filename.tar For the Trivial File Transfer Protocol (TFTP), the syntax is tftp:[[//location]/directory]/tar-filename.tar The tar-filename.tar is the tar file from which to extract files. For flash:/file-url, specify the location on the local Flash file system into which the tar file is extracted. You can also specify an optional list of files or directories within the tar file for extraction. If none are specified, all files and directories are extracted. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-7 Working with Configuration Files Chapter 19 Managing Firmware and Configurations This example shows how to extract the contents of a tar file located on the TFTP server at 172.20.10.30. This command extracts just the new-configs directory into the root directory on the local Flash file system. The remaining files in the saved.tar file are ignored. ap# archive tar /xtract tftp://172.20.10.30/saved.tar flash:/new-configs Displaying the Contents of a File To display the contents of any readable file, including a file on a remote file system, use the more [/ascii

| /binary | /ebcdic] file-url privileged EXEC command:

This example shows how to display the contents of a configuration file on a TFTP server:

ap# more tftp://serverA/hampton/savedconfig

! Saved configuration on server

version 11.3 service timestamps log datetime localtime service linenumber service udp-small-servers service pt-vty-logging

<output truncated>

Working with Configuration Files This section describes how to create, load, and maintain configuration files. Configuration files contain commands entered to customize the function of the Cisco IOS software. To better benefit from these instructions, your access point contains a minimal default running configuration for interacting with the system software. You can copy (download) configuration files from a TFTP, FTP, or RCP server to the running configuration of the access point for various reasons:

To restore a backed-up configuration file. To use the configuration file for another access point. For example, you might add another access point to your network and want it to have a configuration similar to the original access point. By copying the file to the new access point, you can change the relevant parts rather than recreating the whole file. To load the same configuration commands on all the access points in your network so that all the access points have similar configurations. You can copy (upload) configuration files from the access point to a file server by using TFTP, FTP, or RCP. You might perform this task to back up a current configuration file to a server before changing its contents so that you can later restore the original configuration file from the server. The protocol you use depends on which type of server you are using. The FTP and RCP transport mechanisms provide faster performance and more reliable delivery of data than TFTP. These improvements are possible because FTP and RCP are built on and use the Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which is connection oriented. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-8 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Configuration Files This section includes this information:

Guidelines for Creating and Using Configuration Files, page 19-9 Configuration File Types and Location, page 19-9 Creating a Configuration File by Using a Text Editor, page 19-10 Copying Configuration Files by Using TFTP, page 19-10 Copying Configuration Files by Using FTP, page 19-12 Copying Configuration Files by Using RCP, page 19-15 Clearing Configuration Information, page 19-18 Guidelines for Creating and Using Configuration Files Creating configuration files can aid in your access point configuration. Configuration files can contain some or all of the commands needed to configure one or more access points. For example, you might want to download the same configuration file to several access points that have the same hardware configuration. Use these guidelines when creating a configuration file:

If no passwords have been set on the access point, you must set them on each access point by entering the enable secret secret-password global configuration command. Enter a blank line for this command. The password is saved in the configuration file as clear text. If passwords already exist, you cannot enter the enable secret secret-password global configuration command in the file because the password verification will fail. If you enter a password in the configuration file, the access point mistakenly attempts to execute the passwords as commands as it executes the file. The copy {ftp: | rcp: | tftp:} system:running-config privileged EXEC command loads the configuration files on the access point as if you were entering the commands at the command line. The access point does not erase the existing running configuration before adding the commands. If a command in the copied configuration file replaces a command in the existing configuration file, the existing command is erased. For example, if the copied configuration file contains a different IP address in a particular command than the existing configuration, the IP address in the copied configuration is used. However, some commands in the existing configuration might not be replaced or negated. In this case, the resulting configuration file is a mixture of the existing configuration file and the copied configuration file, with the copied configuration file having precedence. To restore a configuration file to an exact copy of a file stored on a server, copy the configuration file directly to the startup configuration (by using the copy {ftp: | rcp: | tftp:}

nvram:startup-config privileged EXEC command), and reload the access point. Configuration File Types and Location Startup configuration files are used during system startup to configure the software. Running configuration files contain the current configuration of the software. The two configuration files can be different. For example, you might want to change the configuration for a short time period rather than permanently. In this case, you would change the running configuration but not save the configuration by using the copy running-config startup-config privileged EXEC command. The running configuration is saved in DRAM; the startup configuration is stored in the NVRAM section of Flash memory. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-9 Working with Configuration Files Chapter 19 Managing Firmware and Configurations Creating a Configuration File by Using a Text Editor When creating a configuration file, you must list commands logically so that the system can respond appropriately. This is one method of creating a configuration file:

Step 1 Copy an existing configuration from an access point to a server. For more information, see the Downloading the Configuration File by Using TFTP section on page 19-11, the Downloading a Configuration File by Using FTP section on page 19-13, or the Downloading a Configuration File by Using RCP section on page 19-16. Open the configuration file in a text editor such as vi or emacs on UNIX or Notepad on a PC. Extract the portion of the configuration file with the desired commands, and save it in a new file. Copy the configuration file to the appropriate server location. For example, copy the file to the TFTP directory on the workstation (usually /tftpboot on a UNIX workstation). Step 2 Step 3 Step 4 Step 5 Make sure the permissions on the file are set to world-read. Copying Configuration Files by Using TFTP You can configure the access point by using configuration files you create, download from another access point, or download from a TFTP server. You can copy (upload) configuration files to a TFTP server for storage. This section includes this information:

Preparing to Download or Upload a Configuration File by Using TFTP, page 19-10 Downloading the Configuration File by Using TFTP, page 19-11 Uploading the Configuration File by Using TFTP, page 19-11 Preparing to Download or Upload a Configuration File by Using TFTP Before you begin downloading or uploading a configuration file by using TFTP, perform these tasks:

Ensure that the workstation acting as the TFTP server is properly configured. On a Sun workstation, make sure that the /etc/inetd.conf file contains this line:

tftp dgram udp wait root /usr/etc/in.tftpd in.tftpd -p -s /tftpboot Make sure that the /etc/services file contains this line:

tftp 69/udp Note You must restart the inetd daemon after modifying the /etc/inetd.conf and /etc/services files. To restart the daemon, either stop the inetd process and restart it, or enter a fastboot command (on the SunOS 4.x) or a reboot command (on Solaris 2.x or SunOS 5.x). For more information on the TFTP daemon, refer to the documentation for your workstation. Ensure that the access point has a route to the TFTP server. The access point and the TFTP server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the TFTP server by using the ping command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-10 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Configuration Files Ensure that the configuration file to be downloaded is in the correct directory on the TFTP server

(usually /tftpboot on a UNIX workstation). For download operations, ensure that the permissions on the file are set correctly. The permission on the file should be world-read. Before uploading the configuration file, you might need to create an empty file on the TFTP server. To create an empty file, enter the touch filename command, where filename is the name of the file you will use when uploading it to the server. During upload operations, if you are overwriting an existing file (including an empty file, if you had to create one) on the server, ensure that the permissions on the file are set correctly. Permissions on the file should be world-write. Downloading the Configuration File by Using TFTP To configure the access point by using a configuration file downloaded from a TFTP server, follow these steps:

Step 1 Step 2 Step 3 Step 4 Copy the configuration file to the appropriate TFTP directory on the workstation. Verify that the TFTP server is properly configured by referring to the Preparing to Download or Upload a Configuration File by Using TFTP section on page 19-10. Log into the access point through a Telnet session. Download the configuration file from the TFTP server to configure the access point. Specify the IP address or host name of the TFTP server and the name of the file to download. Use one of these privileged EXEC commands:

copy tftp:[[[//location]/directory]/filename] system:running-config copy tftp:[[[//location]/directory]/filename] nvram:startup-config The configuration file downloads, and the commands are executed as the file is parsed line-by-line. This example shows how to configure the software from the file tokyo-confg at IP address 172.16.2.155:

ap# copy tftp://172.16.2.155/tokyo-confg system:running-config Configure using tokyo-confg from 172.16.2.155? [confirm] y Booting tokyo-confg from 172.16.2.155:!!! [OK - 874/16000 bytes]

Uploading the Configuration File by Using TFTP To upload a configuration file from an access point to a TFTP server for storage, follow these steps:

Step 1 Step 2 Step 3 Verify that the TFTP server is properly configured by referring to the Preparing to Download or Upload a Configuration File by Using TFTP section on page 19-10. Log into the access point through a Telnet session. Upload the access point configuration to the TFTP server. Specify the IP address or host name of the TFTP server and the destination filename. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-11 Working with Configuration Files Chapter 19 Managing Firmware and Configurations Use one of these privileged EXEC commands:

copy system:running-config tftp:[[[//location]/directory]/filename]

copy nvram:startup-config tftp:[[[//location]/directory]/filename]

The file is uploaded to the TFTP server. This example shows how to upload a configuration file from an access point to a TFTP server:

ap# copy system:running-config tftp://172.16.2.155/tokyo-confg Write file tokyo-confg on host 172.16.2.155? [confirm] y

Writing tokyo-confg!!! [OK]

Copying Configuration Files by Using FTP You can copy configuration files to or from an FTP server. The FTP protocol requires a client to send a remote username and password on each FTP request to a server. When you copy a configuration file from the access point to a server by using FTP, the Cisco IOS software sends the first valid username in this list:

The username specified in the copy command if a username is specified. The username set by the ip ftp username username global configuration command if the command is configured. Anonymous. The access point sends the first valid password in this list:

The password specified in the copy command if a password is specified. The password set by the ip ftp password password global configuration command if the command is configured. The access point forms a password named username@apname.domain. The variable username is the username associated with the current session, apname is the configured host name, and domain is the domain of the access point. The username and password must be associated with an account on the FTP server. If you are writing to the server, the FTP server must be properly configured to accept your FTP write request. Use the ip ftp username and ip ftp password commands to specify a username and password for all copies. Include the username in the copy command if you want to specify only a username for that copy operation. If the server has a directory structure, the configuration file is written to or copied from the directory associated with the username on the server. For example, if the configuration file resides in the home directory of a user on the server, specify that user's name as the remote username. For more information, refer to the documentation for your FTP server. This section includes this information:

Preparing to Download or Upload a Configuration File by Using FTP, page 19-13 Downloading a Configuration File by Using FTP, page 19-13 Uploading a Configuration File by Using FTP, page 19-14 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-12 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Configuration Files Preparing to Download or Upload a Configuration File by Using FTP Before you begin downloading or uploading a configuration file by using FTP, perform these tasks:

Ensure that the access point has a route to the FTP server. The access point and the FTP server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the FTP server by using the ping command. If you are accessing the access point through a Telnet session and you do not have a valid username, make sure that the current FTP username is the one that you want to use for the FTP download. You can enter the show users privileged EXEC command to view the valid username. If you do not want to use this username, create a new FTP username by using the ip ftp username username global configuration command during all copy operations. The new username is stored in NVRAM. If you are accessing the access point through a Telnet session and you have a valid username, this username is used, and you do not need to set the FTP username. Include the username in the copy command if you want to specify a username for only that copy operation. When you upload a configuration file to the FTP server, it must be properly configured to accept the write request from the user on the access point. For more information, refer to the documentation for your FTP server. Downloading a Configuration File by Using FTP Beginning in privileged EXEC mode, follow these steps to download a configuration file by using FTP:

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Command configure terminal ip ftp username username ip ftp password password end copy ftp:[[[//[username[:password]@]location]/directory]

/filename] system:running-config or copy ftp:[[[//[username[:password]@]location]/directory]

/filename] nvram:startup-config Purpose Verify that the FTP server is properly configured by referring to the Preparing to Download or Upload a Configuration File by Using FTP section on page 19-13. Log into the access point through a Telnet session. Enter global configuration mode on the access point. This step is required only if you override the default remote username or password (see Steps 4, 5, and 6).

(Optional) Change the default remote username.

(Optional) Change the default password. Return to privileged EXEC mode. Using FTP, copy the configuration file from a network server to the running configuration or to the startup configuration file. This example shows how to copy a configuration file named host1-confg from the netadmin1 directory on the remote server with an IP address of 172.16.101.101 and to load and run those commands on the access point:

ap# copy ftp://netadmin1:mypass@172.16.101.101/host1-confg system:running-config Configure using host1-confg from 172.16.101.101? [confirm]

OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-13 Working with Configuration Files Chapter 19 Managing Firmware and Configurations Connected to 172.16.101.101 Loading 1112 byte file host1-confg:![OK]

ap#

%SYS-5-CONFIG: Configured from host1-config by ftp from 172.16.101.101 This example shows how to specify a remote username of netadmin1. The software copies the configuration file host2-confg from the netadmin1 directory on the remote server with an IP address of 172.16.101.101 to the access point startup configuration. ap# configure terminal ap(config)# ip ftp username netadmin1 ap(config)# ip ftp password mypass ap(config)# end ap# copy ftp: nvram:startup-config Address of remote host [255.255.255.255]? 172.16.101.101 Name of configuration file[rtr2-confg]? host2-confg Configure using host2-confg from 172.16.101.101?[confirm]

Connected to 172.16.101.101 Loading 1112 byte file host2-confg:![OK]

[OK]

ap#

%SYS-5-CONFIG_NV:Non-volatile store configured from host2-config by ftp from 172.16.101.101 Uploading a Configuration File by Using FTP Beginning in privileged EXEC mode, follow these steps to upload a configuration file by using FTP:

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Command configure terminal ip ftp username username ip ftp password password end copy system:running-config ftp:[[[//[username[:password]@]location]/directory]

/filename]

or copy nvram:startup-config ftp:[[[//[username[:password]@]location]/directory]

/filename]

Purpose Verify that the FTP server is properly configured by referring to the Preparing to Download or Upload a Configuration File by Using FTP section on page 19-13. Log into the access point through a Telnet session. Enter global configuration mode. This step is required only if you override the default remote username or password (see Steps 4, 5, and 6).

(Optional) Change the default remote username.

(Optional) Change the default password. Return to privileged EXEC mode. Using FTP, store the access point running or startup configuration file to the specified location. This example shows how to copy the running configuration file named ap2-confg to the netadmin1 directory on the remote host with an IP address of 172.16.101.101:

ap# copy system:running-config ftp://netadmin1:mypass@172.16.101.101/ap2-confg Write file ap2-confg on host 172.16.101.101?[confirm]

Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-14 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Configuration Files Building configuration...[OK]

Connected to 172.16.101.101 ap#

This example shows how to store a startup configuration file on a server by using FTP to copy the file:

ap# configure terminal ap(config)# ip ftp username netadmin2 ap(config)# ip ftp password mypass ap(config)# end ap# copy nvram:startup-config ftp:

Remote host[]? 172.16.101.101 Name of configuration file to write [ap2-confg]?

Write file ap2-confg on host 172.16.101.101?[confirm]

![OK]

Copying Configuration Files by Using RCP The Remote Copy Protocol (RCP) provides another method of downloading, uploading, and copying configuration files between remote hosts and the access point. Unlike TFTP, which uses User Datagram Protocol (UDP), a connectionless protocol, RCP uses TCP, which is connection-oriented. To use RCP to copy files, the server from or to which you will be copying files must support RCP. The RCP copy commands rely on the rsh server (or daemon) on the remote system. To copy files by using RCP, you do not need to create a server for file distribution as you do with TFTP. You only need to have access to a server that supports the remote shell (rsh). (Most UNIX systems support rsh.) Because you are copying a file from one place to another, you must have read permission on the source file and write permission on the destination file. If the destination file does not exist, RCP creates it for you. The RCP requires a client to send a remote username with each RCP request to a server. When you copy a configuration file from the access point to a server, the Cisco IOS software sends the first valid username in this list:

The username specified in the copy command if a username is specified. The username set by the ip rcmd remote-username username global configuration command if the command is configured. The remote username associated with the current TTY (terminal) process. For example, if the user is connected to the router through Telnet and was authenticated through the username command, the access point software sends the Telnet username as the remote username. The access point host name. For a successful RCP copy request, you must define an account on the network server for the remote username. If the server has a directory structure, the configuration file is written to or copied from the directory associated with the remote username on the server. For example, if the configuration file is in the home directory of a user on the server, specify that user's name as the remote username. This section includes this information:

Preparing to Download or Upload a Configuration File by Using RCP, page 19-16 Downloading a Configuration File by Using RCP, page 19-16 Uploading a Configuration File by Using RCP, page 19-17 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-15 Working with Configuration Files Chapter 19 Managing Firmware and Configurations Preparing to Download or Upload a Configuration File by Using RCP Before you begin downloading or uploading a configuration file by using RCP, perform these tasks:

Ensure that the workstation acting as the RCP server supports the remote shell (rsh). Ensure that the access point has a route to the RCP server. The access point and the server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the RCP server by using the ping command. If you are accessing the access point through a Telnet session and you do not have a valid username, make sure that the current RCP username is the one that you want to use for the RCP download. You can enter the show users privileged EXEC command to view the valid username. If you do not want to use this username, create a new RCP username by using the ip rcmd remote-username username global configuration command to be used during all copy operations. The new username is stored in NVRAM. If you are accessing the access point through a Telnet session and you have a valid username, this username is used, and you do not need to set the RCP username. Include the username in the copy command if you want to specify a username for only that copy operation. When you upload a file to the RCP server, it must be properly configured to accept the RCP write request from the user on the access point. For UNIX systems, you must add an entry to the .rhosts file for the remote user on the RCP server. For example, suppose that the access point contains these configuration lines:

hostname ap1 ip rcmd remote-username User0 If the access point IP address translates to ap1.company.com, the .rhosts file for User0 on the RCP server should contain this line:

ap1.company.com ap1 For more information, refer to the documentation for your RCP server. Downloading a Configuration File by Using RCP Beginning in privileged EXEC mode, follow these steps to download a configuration file by using RCP:

Command configure terminal Step 1 Step 2 Step 3 Step 4 ip rcmd remote-username username Purpose Verify that the RCP server is properly configured by referring to the Preparing to Download or Upload a Configuration File by Using RCP section on page 19-16. Log into the access point through a Telnet session. Enter global configuration mode. This step is required only if you override the default remote username (see Steps 4 and 5).

(Optional) Specify the remote username. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-16 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Configuration Files Step 5 Step 6 Command end copy rcp:[[[//[username@]location]/directory]/filename]

system:running-config Purpose Return to privileged EXEC mode. Using RCP, copy the configuration file from a network server to the running configuration or to the startup configuration file. or copy rcp:[[[//[username@]location]/directory]/filename]

nvram:startup-config This example shows how to copy a configuration file named host1-confg from the netadmin1 directory on the remote server with an IP address of 172.16.101.101 and load and run those commands on the access point:

ap# copy rcp://netadmin1@172.16.101.101/host1-confg system:running-config Configure using host1-confg from 172.16.101.101? [confirm]

Connected to 172.16.101.101 Loading 1112 byte file host1-confg:![OK]

ap#

%SYS-5-CONFIG: Configured from host1-config by rcp from 172.16.101.101 This example shows how to specify a remote username of netadmin1. Then it copies the configuration file host2-confg from the netadmin1 directory on the remote server with an IP address of 172.16.101.101 to the startup configuration:

ap# configure terminal ap(config)# ip rcmd remote-username netadmin1 ap(config)# end ap# copy rcp: nvram:startup-config Address of remote host [255.255.255.255]? 172.16.101.101 Name of configuration file[rtr2-confg]? host2-confg Configure using host2-confg from 172.16.101.101?[confirm]

Connected to 172.16.101.101 Loading 1112 byte file host2-confg:![OK]

[OK]

ap#

%SYS-5-CONFIG_NV:Non-volatile store configured from host2-config by rcp from 172.16.101.101 Uploading a Configuration File by Using RCP Beginning in privileged EXEC mode, follow these steps to upload a configuration file by using RCP:

Command configure terminal Step 1 Step 2 Step 3 Step 4 ip rcmd remote-username username Purpose Verify that the RCP server is properly configured by referring to the Preparing to Download or Upload a Configuration File by Using RCP section on page 19-16. Log into the access point through a Telnet session. Enter global configuration mode. This step is required only if you override the default remote username (see Steps 4 and 5).

(Optional) Specify the remote username. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-17 Working with Software Images Chapter 19 Managing Firmware and Configurations Step 5 Step 6 Command end copy system:running-config rcp:[[[//[username@]location]/directory]/filename]

Purpose Return to privileged EXEC mode. Using RCP, copy the configuration file from an access point running or startup configuration file to a network server. or copy nvram:startup-config rcp:[[[//[username@]location]/directory]/filename]

This example shows how to copy the running configuration file named ap2-confg to the netadmin1 directory on the remote host with an IP address of 172.16.101.101:

ap# copy system:running-config rcp://netadmin1@172.16.101.101/ap2-confg Write file ap-confg on host 172.16.101.101?[confirm]

Building configuration...[OK]

Connected to 172.16.101.101 ap#

This example shows how to store a startup configuration file on a server:

ap# configure terminal ap(config)# ip rcmd remote-username netadmin2 ap(config)# end ap# copy nvram:startup-config rcp:

Remote host[]? 172.16.101.101 Name of configuration file to write [ap2-confg]?

Write file ap2-confg on host 172.16.101.101?[confirm]

![OK]

Clearing Configuration Information This section describes how to clear configuration information. Deleting a Stored Configuration File Caution You cannot restore a file after it has been deleted. To delete a saved configuration from Flash memory, use the delete flash:filename privileged EXEC command. Depending on the setting of the file prompt global configuration command, you might be prompted for confirmation before you delete a file. By default, the access point prompts for confirmation on destructive file operations. For more information about the file prompt command, refer to the Cisco IOS Command Reference for Release 12.1. Working with Software Images This section describes how to archive (download and upload) software image files, which contain the system software, IOS code, radio firmware, and the web management HTML files. You download an access point image file from a TFTP, FTP, or RCP server to upgrade the access point software. You upload an access point image file to a TFTP, FTP, or RCP server for backup purposes. You can use this uploaded image for future downloads to the same access point or another of the same type. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-18 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Software Images The protocol you use depends on which type of server you are using. The FTP and RCP transport mechanisms provide faster performance and more reliable delivery of data than TFTP. These improvements are possible because FTP and RCP are built on and use the Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which is connection-oriented. This section includes this information:

Image Location on the Access Point, page 19-19 tar File Format of Images on a Server or Cisco.com, page 19-19 Copying Image Files by Using TFTP, page 19-20 Copying Image Files by Using FTP, page 19-23 Copying Image Files by Using RCP, page 19-27 Reloading the Image Using the Web Browser Interface, page 19-32 Note For a list of software images and supported upgrade paths, refer to the release notes for your access point. Image Location on the Access Point The IOS image is stored in a directory that shows the version number. A subdirectory contains the HTML files needed for web management. The image is stored on the system board Flash memory (flash:). You can use the show version privileged EXEC command to see the software version that is currently running on your access point. In the display, check the line that begins with System image file is... It shows the directory name in Flash memory where the image is stored. You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images you might have stored in Flash memory. tar File Format of Images on a Server or Cisco.com Software images located on a server or downloaded from Cisco.com are provided in a tar file format, which contains these files:

info file The info file is always at the beginning of the tar file and contains information about the files within it. IOS image Web management files needed by the HTTP server on the access point radio firmware 5000.img file info.ver file The info.ver file is always at the end of the tar file and contains the same information as the info file. Because it is the last file in the tar file, its existence means that all files in the image have been downloaded. Note The tar file sometimes ends with an extension other than .tar. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-19 Working with Software Images Chapter 19 Managing Firmware and Configurations Copying Image Files by Using TFTP You can download an access point image from a TFTP server or upload the image from the access point to a TFTP server. You download an access point image file from a server to upgrade the access point software. You can overwrite the current image with the new one. You upload an access point image file to a server for backup purposes; this uploaded image can be used for future downloads to the same or another access point of the same type. This section includes this information:

Preparing to Download or Upload an Image File by Using TFTP, page 19-20 Downloading an Image File by Using TFTP, page 19-21 Uploading an Image File by Using TFTP, page 19-22 Preparing to Download or Upload an Image File by Using TFTP Before you begin downloading or uploading an image file by using TFTP, perform these tasks:

Ensure that the workstation acting as the TFTP server is properly configured. On a Sun workstation, make sure that the /etc/inetd.conf file contains this line:

tftp dgram udp wait root /usr/etc/in.tftpd in.tftpd -p -s /tftpboot Make sure that the /etc/services file contains this line:

tftp 69/udp Note You must restart the inetd daemon after modifying the /etc/inetd.conf and /etc/services files. To restart the daemon, either stop the inetd process and restart it, or enter a fastboot command (on the SunOS 4.x) or a reboot command (on Solaris 2.x or SunOS 5.x). For more information on the TFTP daemon, refer to the documentation for your workstation. Ensure that the access point has a route to the TFTP server. The access point and the TFTP server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the TFTP server by using the ping command. Ensure that the image to be downloaded is in the correct directory on the TFTP server (usually

/tftpboot on a UNIX workstation). For download operations, ensure that the permissions on the file are set correctly. The permission on the file should be world-read. Before uploading the image file, you might need to create an empty file on the TFTP server. To create an empty file, enter the touch filename command, where filename is the name of the file you will use when uploading the image to the server. During upload operations, if you are overwriting an existing file (including an empty file, if you had to create one) on the server, ensure that the permissions on the file are set correctly. Permissions on the file should be world-write. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-20 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Software Images Downloading an Image File by Using TFTP You can download a new image file and replace the current image or keep the current image. Caution For the download and upload algorithms to operate properly, do not rename image directories. Beginning in privileged EXEC mode, follow Steps 1 through 3 to download a new image from a TFTP server and overwrite the existing image. Command

. Step 1 Step 2 Step 3 archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name Step 4 archive download-sw /leave-old-sw /reload tftp:[[//location]/directory]/image-name Purpose Copy the image to the appropriate TFTP directory on the workstation. Make sure the TFTP server is properly configured; see the Preparing to Download or Upload an Image File by Using TFTP section on page 19-20 Log into the access point through a Telnet session. Download the image file from the TFTP server to the access point, and overwrite the current image. The /overwrite option overwrites the software image in Flash with the downloaded image. The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved. For //location, specify the IP address of the TFTP server. For /directory/image-name, specify the directory (optional) and the image to download. Directory and image names are case sensitive. Download the image file from the TFTP server to the access point, and keep the current image. The /leave-old-sw option keeps the old software version after a download. The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved. For //location, specify the IP address of the TFTP server. For /directory/image-name, specify the directory (optional) and the image to download. Directory and image names are case sensitive. Note To avoid an unsuccessful download, use the archive download-sw /safe command, which downloads the image first and does not delete the current running version until the download succeeds. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-21 Working with Software Images Chapter 19 Managing Firmware and Configurations The download algorithm verifies that the image is appropriate for the access point model and that enough DRAM is present, or it aborts the process and reports an error. If you specify the /overwrite option, the download algorithm removes the existing image on the Flash device whether or not it is the same as the new one, downloads the new image, and then reloads the software. Note If the Flash device has sufficient space to hold two images and you want to overwrite one of these images with the same version, you must specify the /overwrite option. If you specify the /leave-old-sw, the existing files are not removed. If there is not enough space to install the new image and keep the current running image, the download process stops, and an error message is displayed. The algorithm installs the downloaded image on the system board Flash device (flash:). The image is placed into a new directory named with the software version string, and the system boot path variable is updated to point to the newly installed image. If you kept the old image during the download process (you specified the /leave-old-sw keyword), you can remove it by entering the delete /force /recursive filesystem:/file-url privileged EXEC command. For filesystem, use flash: for the system board Flash device. For file-url, enter the directory name of the old image. All the files in the directory and the directory are removed. Uploading an Image File by Using TFTP You can upload an image from the access point to a TFTP server. You can later download this image to the access point or to another access point of the same type. Caution For the download and upload algorithms to operate properly, do not rename image directories. Beginning in privileged EXEC mode, follow these steps to upload an image to a TFTP server:

Command Step 1 Step 1 Step 2 archive upload-sw tftp:[[//location]/directory]/image-name.tar Purpose Make sure the TFTP server is properly configured; see the Preparing to Download or Upload an Image File by Using TFTP section on page 19-20. Log into the access point through a Telnet session. Upload the currently running access point image to the TFTP server. For //location, specify the IP address of the TFTP server. For /directory/image-name.tar, specify the directory (optional) and the name of the software image to be uploaded. Directory and image names are case sensitive. The image-name.tar is the name of the software image to be stored on the server. The archive upload-sw privileged EXEC command builds an image file on the server by uploading these files in order: info, the IOS image, the HTML files, and info.ver. After these files are uploaded, the upload algorithm creates the tar file format. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-22 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Software Images Copying Image Files by Using FTP You can download an access point image from an FTP server or upload the image from the access point to an FTP server. You download an access point image file from a server to upgrade the access point software. You can overwrite the current image with the new one or keep the current image after a download. You upload an access point image file to a server for backup purposes. You can use this uploaded image for future downloads to the access point or another access point of the same type. This section includes this information:

Preparing to Download or Upload an Image File by Using FTP, page 19-23 Downloading an Image File by Using FTP, page 19-24 Uploading an Image File by Using FTP, page 19-26 Preparing to Download or Upload an Image File by Using FTP You can copy images files to or from an FTP server. The FTP protocol requires a client to send a remote username and password on each FTP request to a server. When you copy an image file from the access point to a server by using FTP, the Cisco IOS software sends the first valid username in this list:

The username specified in the archive download-sw or archive upload-sw privileged EXEC command if a username is specified. The username set by the ip ftp username username global configuration command if the command is configured. Anonymous. The access point sends the first valid password in this list:

The password specified in the archive download-sw or archive upload-sw privileged EXEC command if a password is specified. The password set by the ip ftp password password global configuration command if the command is configured. The access point forms a password named username@apname.domain. The variable username is the username associated with the current session, apname is the configured host name, and domain is the domain of the access point. The username and password must be associated with an account on the FTP server. If you are writing to the server, the FTP server must be properly configured to accept the FTP write request from you. Use the ip ftp username and ip ftp password commands to specify a username and password for all copies. Include the username in the archive download-sw or archive upload-sw privileged EXEC command if you want to specify a username only for that operation. If the server has a directory structure, the image file is written to or copied from the directory associated with the username on the server. For example, if the image file resides in the home directory of a user on the server, specify that user's name as the remote username. Before you begin downloading or uploading an image file by using FTP, perform these tasks:

Ensure that the access point has a route to the FTP server. The access point and the FTP server must be in the same subnetwork if you do not have a router to route traffic between subnets. Verify connectivity to the FTP server by using the ping command. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-23 Working with Software Images Chapter 19 Managing Firmware and Configurations If you are accessing the access point through a Telnet session and you do not have a valid username, make sure that the current FTP username is the one that you want to use for the FTP download. You can enter the show users privileged EXEC command to view the valid username. If you do not want to use this username, create a new FTP username by using the ip ftp username username global configuration command. This new name will be used during all archive operations. The new username is stored in NVRAM. If you are accessing the access point through a Telnet session and you have a valid username, this username is used, and you do not need to set the FTP username. Include the username in the archive download-sw or archive upload-sw privileged EXEC command if you want to specify a username for that operation only. When you upload an image file to the FTP server, it must be properly configured to accept the write request from the user on the access point. For more information, refer to the documentation for your FTP server. Downloading an Image File by Using FTP You can download a new image file and overwrite the current image or keep the current image. Caution For the download and upload algorithms to operate properly, do not rename image directories. Beginning in privileged EXEC mode, follow Steps 1 through 7 to download a new image from an FTP server and overwrite the existing image. To keep the current image, skip Step 7. Command configure terminal Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 ip ftp username username ip ftp password password end Purpose Verify that the FTP server is properly configured by referring to the Preparing to Download or Upload an Image File by Using FTP section on page 19-23. Log into the access point through a Telnet session. Enter global configuration mode. This step is required only if you override the default remote username or password (see Steps 4, 5, and 6).

(Optional) Change the default remote username.

(Optional) Change the default password. Return to privileged EXEC mode. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-24 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Software Images Step 7 Command archive download-sw /overwrite /reload ftp:[[//username[:password]@location]/directory]

/image-name.tar Purpose Download the image file from the FTP server to the access point, and overwrite the current image. The /overwrite option overwrites the software image in Flash with the downloaded image. The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved. For //username[:password], specify the username and password; these must be associated with an account on the FTP server. For more information, see the Preparing to Download or Upload an Image File by Using FTP section on page 19-23. For @location, specify the IP address of the FTP server. For directory/image-name.tar, specify the directory

(optional) and the image to download. Directory and image names are case sensitive. Step 8 archive download-sw /leave-old-sw /reload ftp:[[//username[:password]@location]/directory]

/image-name.tar Download the image file from the FTP server to the access point, and keep the current image. The /leave-old-sw option keeps the old software version after a download. The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved. For //username[:password], specify the username and password. These must be associated with an account on the FTP server. For more information, see the Preparing to Download or Upload an Image File by Using FTP section on page 19-23. For @location, specify the IP address of the FTP server. For directory/image-name.tar, specify the directory

(optional) and the image to download. Directory and image names are case sensitive. Note To avoid an unsuccessful download, use the archive download-sw /safe command, which downloads the image first and does not delete the current running version until the download succeeds. The download algorithm verifies that the image is appropriate for the access point model and that enough DRAM is present, or it aborts the process and reports an error. If you specify the /overwrite option, the download algorithm removes the existing image on the Flash device, whether or not it is the same as the new one, downloads the new image, and then reloads the software. Note If the Flash device has sufficient space to hold two images and you want to overwrite one of these images with the same version, you must specify the /overwrite option. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-25 Working with Software Images Chapter 19 Managing Firmware and Configurations If you specify the /leave-old-sw, the existing files are not removed. If there is not enough space to install the new image and keep the running image, the download process stops, and an error message is displayed. The algorithm installs the downloaded image onto the system board Flash device (flash:). The image is placed into a new directory named with the software version string, and the BOOT path-list is updated to point to the newly installed image. Use the privileged EXEC mode show boot command to display boot attributes, and use the global configuration boot command to change the boot attributes. If you kept the old image during the download process (you specified the /leave-old-sw keyword), you can remove it by entering the delete /force /recursive filesystem:/file-url privileged EXEC command. For filesystem, use flash: for the system board Flash device. For file-url, enter the directory name of the old software image. All the files in the directory and the directory are removed. Uploading an Image File by Using FTP You can upload an image from the access point to an FTP server. You can later download this image to the same access point or to another access point of the same type. Caution For the download and upload algorithms to operate properly, do not rename image directories. The upload feature is available only if the HTML pages associated with the Cluster Management Suite

(CMS) have been installed with the existing image. Beginning in privileged EXEC mode, follow these steps to upload an image to an FTP server:

Command configure terminal Step 1 Step 2 Step 3 Step 4 Step 5 ip ftp username username ip ftp password password Purpose Verify that the FTP server is properly configured by referring to the Preparing to Download or Upload a Configuration File by Using FTP section on page 19-13. Log into the access point through a Telnet session. Enter global configuration mode. This step is required only if you override the default remote username or password (see Steps 4, 5, and 6).

(Optional) Change the default remote username.

(Optional) Change the default password. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-26 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Software Images Step 6 Step 7 Command end archive upload-sw ftp:[[//[username[:password]@]location]/directory]/

image-name.tar Purpose Return to privileged EXEC mode. Upload the currently running access point image to the FTP server. For //username:password, specify the username and password. These must be associated with an account on the FTP server. For more information, see the Preparing to Download or Upload an Image File by Using FTP section on page 19-23. For @location, specify the IP address of the FTP server. For /directory/image-name.tar, specify the directory

(optional) and the name of the software image to be uploaded. Directory and image names are case sensitive. The image-name.tar is the name of the software image to be stored on the server. The archive upload-sw command builds an image file on the server by uploading these files in order:

info, the IOS image, the HTML files, and info.ver. After these files are uploaded, the upload algorithm creates the tar file format. Copying Image Files by Using RCP You can download an access point image from an RCP server or upload the image from the access point to an RCP server. You download an access point image file from a server to upgrade the access point software. You can overwrite the current image with the new one or keep the current image after a download. You upload an access point image file to a server for backup purposes. You can use this uploaded image for future downloads to the same access point or another of the same type. This section includes this information:

Preparing to Download or Upload an Image File by Using RCP, page 19-27 Downloading an Image File by Using RCP, page 19-29 Uploading an Image File by Using RCP, page 19-31 Preparing to Download or Upload an Image File by Using RCP RCP provides another method of downloading and uploading image files between remote hosts and the access point. Unlike TFTP, which uses User Datagram Protocol (UDP), a connectionless protocol, RCP uses TCP, which is connection-oriented. To use RCP to copy files, the server from or to which you will be copying files must support RCP. The RCP copy commands rely on the rsh server (or daemon) on the remote system. To copy files by using RCP, you do not need to create a server for file distribution as you do with TFTP. You only need to have access to a server that supports the remote shell (rsh). (Most UNIX systems support rsh.) Because you are copying a file from one place to another, you must have read permission on the source file and write permission on the destination file. If the destination file does not exist, RCP creates it for you. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-27 Working with Software Images Chapter 19 Managing Firmware and Configurations RCP requires a client to send a remote username on each RCP request to a server. When you copy an image from the access point to a server by using RCP, the Cisco IOS software sends the first valid username in this list:

The username specified in the archive download-sw or archive upload-sw privileged EXEC command if a username is specified. The username set by the ip rcmd remote-username username global configuration command if the command is entered. The remote username associated with the current TTY (terminal) process. For example, if the user is connected to the router through Telnet and was authenticated through the username command, the access point software sends the Telnet username as the remote username. The access point host name. For the RCP copy request to execute successfully, an account must be defined on the network server for the remote username. If the server has a directory structure, the image file is written to or copied from the directory associated with the remote username on the server. For example, if the image file resides in the home directory of a user on the server, specify that users name as the remote username. Before you begin downloading or uploading an image file by using RCP, do these tasks:

Ensure that the workstation acting as the RCP server supports the remote shell (rsh). Ensure that the access point has a route to the RCP server. The access point and the server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the RCP server by using the ping command. If you are accessing the access point through a Telnet session and you do not have a valid username, make sure that the current RCP username is the one that you want to use for the RCP download. You can enter the show users privileged EXEC command to view the valid username. If you do not want to use this username, create a new RCP username by using the ip rcmd remote-username username global configuration command to be used during all archive operations. The new username is stored in NVRAM. If you are accessing the access point through a Telnet session and you have a valid username, this username is used, and there is no need to set the RCP username. Include the username in the archive download-sw or archive upload-sw privileged EXEC command if you want to specify a username only for that operation. When you upload an image to the RCP to the server, it must be properly configured to accept the RCP write request from the user on the access point. For UNIX systems, you must add an entry to the .rhosts file for the remote user on the RCP server. For example, suppose the access point contains these configuration lines:

hostname ap1 ip rcmd remote-username User0 If the access point IP address translates to ap1.company.com, the .rhosts file for User0 on the RCP server should contain this line:

ap1.company.com ap1 For more information, refer to the documentation for your RCP server. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-28 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Software Images Downloading an Image File by Using RCP You can download a new image file and replace or keep the current image. Caution For the download and upload algorithms to operate properly, do not rename image directories. Beginning in privileged EXEC mode, follow Steps 1 through 6 to download a new image from an RCP server and overwrite the existing image. To keep the current image, skip Step 6. Command configure terminal Step 1 Step 2 Step 3 Step 4 Step 5 ip rcmd remote-username username end Purpose Verify that the RCP server is properly configured by referring to the Preparing to Download or Upload an Image File by Using RCP section on page 19-27. Log into the access point through a Telnet session. Enter global configuration mode. This step is required only if you override the default remote username (see Steps 4 and 5).

(Optional) Specify the remote username. Return to privileged EXEC mode. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-29 Working with Software Images Chapter 19 Managing Firmware and Configurations Step 6 Command archive download-sw /overwrite /reload rcp:[[[//[username@]location]/directory]/image-na me.tar]

Purpose Download the image file from the RCP server to the access point, and overwrite the current image. The /overwrite option overwrites the software image in Flash with the downloaded image. The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved. For //username, specify the username. For the RCP copy request to execute successfully, an account must be defined on the network server for the remote username. For more information, see the Preparing to Download or Upload an Image File by Using RCP section on page 19-27. For @location, specify the IP address of the RCP server. For /directory/image-name.tar, specify the directory

(optional) and the image to download. Directory and image names are case sensitive. Step 7 archive download-sw /leave-old-sw /reload rcp:[[[//[username@]location]/directory]/image-na me.tar]

Download the image file from the RCP server to the access point, and keep the current image. The /leave-old-sw option keeps the old software version after a download. The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved. For //username, specify the username. For the RCP copy request to execute, an account must be defined on the network server for the remote username. For more information, see the Preparing to Download or Upload an Image File by Using RCP section on page 19-27. For @location, specify the IP address of the RCP server. For /directory]/image-name.tar, specify the directory

(optional) and the image to download. Directory and image names are case sensitive. Note To avoid an unsuccessful download, use the archive download-sw /safe command, which downloads the image first and does not delete the current running version until the download succeeds. The download algorithm verifies that the image is appropriate for the access point model and that enough DRAM is present, or it aborts the process and reports an error. If you specify the /overwrite option, the download algorithm removes the existing image on the Flash device whether or not it is the same as the new one, downloads the new image, and then reloads the software. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-30 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Software Images Note If the Flash device has sufficient space to hold two images and you want to overwrite one of these images with the same version, you must specify the /overwrite option. If you specify the /leave-old-sw, the existing files are not removed. If there is not enough room to install the new image an keep the running image, the download process stops, and an error message is displayed. The algorithm installs the downloaded image onto the system board Flash device (flash:). The image is placed into a new directory named with the software version string, and the BOOT environment variable is updated to point to the newly installed image. If you kept the old software during the download process (you specified the /leave-old-sw keyword), you can remove it by entering the delete /force /recursive filesystem:/file-url privileged EXEC command. For filesystem, use flash: for the system board Flash device. For file-url, enter the directory name of the old software image. All the files in the directory and the directory are removed. Uploading an Image File by Using RCP You can upload an image from the access point to an RCP server. You can later download this image to the same access point or to another access point of the same type. Caution For the download and upload algorithms to operate properly, do not rename image directories. The upload feature is available only if the HTML pages associated with the Cluster Management Suite

(CMS) have been installed with the existing image. Beginning in privileged EXEC mode, follow these steps to upload an image to an RCP server:

Command configure terminal Step 1 Step 2 Step 3 Step 4 ip rcmd remote-username username Purpose Verify that the RCP server is properly configured by referring to the Preparing to Download or Upload an Image File by Using RCP section on page 19-27. Log into the access point through a Telnet session. Enter global configuration mode. This step is required only if you override the default remote username (see Steps 4 and 5).

(Optional) Specify the remote username. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-31 Working with Software Images Chapter 19 Managing Firmware and Configurations Step 5 Step 6 Command end archive upload-sw rcp:[[[//[username@]location]/directory]/image-na me.tar]

Purpose Return to privileged EXEC mode. Upload the currently running access point image to the RCP server. For //username, specify the username; for the RCP copy request to execute, an account must be defined on the network server for the remote username. For more information, see the Preparing to Download or Upload an Image File by Using RCP section on page 19-27. For @location, specify the IP address of the RCP server. For /directory]/image-name.tar, specify the directory

(optional) and the name of the software image to be uploaded. Directory and image names are case sensitive. The image-name.tar is the name of software image to be stored on the server. The archive upload-sw privileged EXEC command builds an image file on the server by uploading these files in order: info, the IOS image, the HTML files, and info.ver. After these files are uploaded, the upload algorithm creates the tar file format. Reloading the Image Using the Web Browser Interface You can also use the Web browser interface to reload the access point image file. The Web broswer interface supports loading the image file using HTTP or TFTP interfaces. Note Your access point configuration is not changed when using the browser to reload the image file. Browser HTTP Interface The HTTP interface allows you to browse to the access point image file on your PC and download the image to the access point. Follow the instructions below to use the HTTP interface:

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Open your Internet browser. You must use Microsoft Internet Explorer (version 5.x or later) or Netscape Navigator (version 4.x). Enter the access points IP address in the browser address line and press Enter. An Enter Network Password screen appears. Enter your username in the User Name field. Enter the access point password in the Password field and press Enter. The Summary Status page appears. Click the System Software tab and then click Software Upgrade. The HTTP Upgrade screen appears. Click the Browse button to locate the image file on your PC. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-32 OL-3446-01 Chapter 19 Managing Firmware and Configurations Working with Software Images Step 7 Click the Upload button. For additional information, click the Help icon on the Software Upgrade screen. Browser TFTP Interface The TFTP interface allows you to use a TFTP server on a network device to load the access point image file. Follow the instructions below to use a TFTP server:

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Open your Internet browser. You must use Microsoft Internet Explorer (version 5.x or later) or Netscape Navigator (version 4.x). Enter the access points IP address in the browser address line and press Enter. An Enter Network Password screen appears. Enter your username in the User Name field. Enter the access point password in the Password field and press Enter. The Summary Status page appears. Click the System Software tab and then click Software Upgrade. The HTTP Upgrade screen appears. Click the TFTP Upgrade tab. Enter the IP address for the TFTP server in the TFTP Server field. Enter the file name for the access point image file in the Upload New System Image Tar File field. If the file is located in a subdirectory of the TFTP server root directory, include the relative path of the TFTP server root directory with the filename. If the file is located in the TFTP root directory, enter only the filename. Click the Upload button. For additional information click the Help icon on the Software Upgrade screen. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-33 Working with Software Images Chapter 19 Managing Firmware and Configurations Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 19-34 OL-3446-01 C H A P T E R 20 Configuring System Message Logging This chapter describes how to configure system message logging on your access point. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.2. This chapter consists of these sections:

Understanding System Message Logging, page 20-2 Configuring System Message Logging, page 20-2 Displaying the Logging Configuration, page 20-12 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-1 Understanding System Message Logging Chapter 20 Configuring System Message Logging Understanding System Message Logging By default, access points send the output from system messages and debug privileged EXEC commands to a logging process. The logging process controls the distribution of logging messages to various destinations, such as the logging buffer, terminal lines, or a UNIX syslog server, depending on your configuration. The process also sends messages to the console. Note The syslog format is compatible with 4.3 BSD UNIX. When the logging process is disabled, messages are sent only to the console. The messages are sent as they are generated, so message and debug output are interspersed with prompts or output from other commands. Messages are displayed on the console after the process that generated them has finished. You can set the severity level of the messages to control the type of messages displayed on the console and each of the destinations. You can timestamp log messages or set the syslog source address to enhance real-time debugging and management. You can access logged system messages by using the access point command-line interface (CLI) or by saving them to a properly configured syslog server. The access point software saves syslog messages in an internal buffer. You can remotely monitor system messages by accessing the access point through Telnet or by viewing the logs on a syslog server. Configuring System Message Logging This section describes how to configure system message logging. It contains this configuration information:

System Log Message Format, page 20-2 Default System Message Logging Configuration, page 20-3 Disabling and Enabling Message Logging, page 20-4 Setting the Message Display Destination Device, page 20-5 Enabling and Disabling Timestamps on Log Messages, page 20-6 Enabling and Disabling Sequence Numbers in Log Messages, page 20-6 Defining the Message Severity Level, page 20-7 Limiting Syslog Messages Sent to the History Table and to SNMP, page 20-8 Setting a Logging Rate Limit, page 20-9 Configuring UNIX Syslog Servers, page 20-10 System Log Message Format System log messages can contain up to 80 characters and a percent sign (%), which follows the optional sequence number or timestamp information, if configured. Messages are displayed in this format:

seq no:timestamp: %facility-severity-MNEMONIC:description The part of the message preceding the percent sign depends on the setting of the service sequence-numbers, service timestamps log datetime, service timestamps log datetime [localtime]

[msec] [show-timezone], or service timestamps log uptime global configuration command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-2 OL-3446-01 Chapter 20 Configuring System Message Logging Configuring System Message Logging Table 20-1 describes the elements of syslog messages. Table 20-1 System Log Message Elements Element seq no:

timestamp formats:

mm/dd hh:mm:ss or hh:mm:ss (short uptime) or d h (long uptime) facility severity MNEMONIC description Description Stamps log messages with a sequence number only if the service sequence-numbers global configuration command is configured. For more information, see the Enabling and Disabling Sequence Numbers in Log Messages section on page 20-6. Date and time of the message or event. This information appears only if the service timestamps log [datetime | log] global configuration command is configured. For more information, see the Enabling and Disabling Timestamps on Log Messages section on page 20-6. The facility to which the message refers (for example, SNMP, SYS, and so forth). A facility can be a hardware device, a protocol, or a module of the system software. It denotes the source or the cause of the system message. Single-digit code from 0 to 7 that is the severity of the message. For a description of the severity levels, see Table 20-3 on page 20-8. Text string that uniquely describes the message. Text string containing detailed information about the event being reported. This example shows a partial access point system message:

00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up 00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up 00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to up 00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down 00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down 2

*Mar 1 18:46:11: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) 18:47:02: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36)

*Mar 1 18:48:50.483 UTC: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) Default System Message Logging Configuration Table 20-2 shows the default system message logging configuration. Table 20-2 Default System Message Logging Configuration Feature System message logging to the console Console severity Logging buffer size Logging history size Default Setting Enabled Debugging (and numerically lower levels;

see Table 20-3 on page 20-8) 4096 bytes 1 message OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-3 Configuring System Message Logging Chapter 20 Configuring System Message Logging Table 20-2 Default System Message Logging Configuration (continued) Feature Timestamps Synchronous logging Logging server Syslog server IP address Server facility Server severity Default Setting Disabled Disabled Disabled None configured Local7 (see Table 20-4 on page 20-11) Informational (and numerically lower levels; see Table 20-3 on page 20-8) Disabling and Enabling Message Logging Message logging is enabled by default. It must be enabled to send messages to any destination other than the console. When enabled, log messages are sent to a logging process, which logs messages to designated locations asynchronously to the processes that generated the messages. Beginning in privileged EXEC mode, follow these steps to disable message logging:

Command configure terminal no logging on end show running-config or show logging copy running-config startup-config Step 1 Step 2 Step 3 Step 4 Step 5 Purpose Enter global configuration mode. Disable message logging. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Disabling the logging process can slow down the access point because a process must wait until the messages are written to the console before continuing. When the logging process is disabled, messages are displayed on the console as soon as they are produced, often appearing in the middle of command output. The logging synchronous global configuration command also affects the display of messages to the console. When this command is enabled, messages appear only after you press Return. For more information, see the Enabling and Disabling Timestamps on Log Messages section on page 20-6. To re-enable message logging after it has been disabled, use the logging on global configuration command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-4 OL-3446-01 Chapter 20 Configuring System Message Logging Configuring System Message Logging Setting the Message Display Destination Device If message logging is enabled, you can send messages to specific locations in addition to the console. Beginning in privileged EXEC mode, use one or more of the following commands to specify the locations that receive messages:

Command configure terminal logging buffered [size] [level]

Step 1 Step 2 Purpose Enter global configuration mode. Log messages to an internal buffer. The default buffer size is 4096. The range is 4096 to 2147483647 bytes. Levels include emergencies 0, alerts 1, critical 2, errors 3, warnings 4, notifications 5, informational 6, and debugging 7. Note Do not make the buffer size too large because the access point could run out of memory for other tasks. Use the show memory privileged EXEC command to view the free processor memory on the access point; however, this value is the maximum available, and you should not set the buffer size to this amount. Step 3 logging host Log messages to a UNIX syslog server host. For host, specify the name or IP address of the host to be used as the syslog server. To build a list of syslog servers that receive logging messages, enter this command more than once. For complete syslog server configuration steps, see the Configuring UNIX Syslog Servers section on page 20-10. Return to privileged EXEC mode. Log messages to a non-console terminal during the current session. Terminal parameter-setting commands are set locally and do not remain in effect after the session has ended. You must perform this step for each session to see the debugging messages. Verify your entries.

(Optional) Save your entries in the configuration file. Step 4 Step 5 end terminal monitor Step 6 Step 7 show running-config copy running-config startup-config The logging buffered global configuration command copies logging messages to an internal buffer. The buffer is circular, so newer messages overwrite older messages after the buffer is full. To display the messages that are logged in the buffer, use the show logging privileged EXEC command. The first message displayed is the oldest message in the buffer. To clear the contents of the buffer, use the clear logging privileged EXEC command. To disable logging to the console, use the no logging console global configuration command. To disable logging to a file, use the no logging file [severity-level-number | type] global configuration command. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-5 Configuring System Message Logging Chapter 20 Configuring System Message Logging Enabling and Disabling Timestamps on Log Messages By default, log messages are not timestamped. Beginning in privileged EXEC mode, follow these steps to enable timestamping of log messages:

Command configure terminal service timestamps log uptime Step 1 Step 2 Purpose Enter global configuration mode. Enable log timestamps. or service timestamps log datetime [msec] [localtime]

[show-timezone]

Step 3 Step 4 Step 5 end show running-config copy running-config startup-config The first command enables timestamps on log messages, showing the time since the system was rebooted. The second command enables timestamps on log messages. Depending on the options selected, the timestamp can include the date, time in milliseconds relative to the local time zone, and the time zone name. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable timestamps for both debug and log messages, use the no service timestamps global configuration command. This example shows part of a logging display with the service timestamps log datetime global configuration command enabled:

*Mar 1 18:46:11: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) This example shows part of a logging display with the service timestamps log uptime global configuration command enabled:

00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up Enabling and Disabling Sequence Numbers in Log Messages Because there is a chance that more than one log message can have the same timestamp, you can display messages with sequence numbers so that you can unambiguously refer to a single message. By default, sequence numbers in log messages are not displayed. Beginning in privileged EXEC mode, follow these steps to enable sequence numbers in log messages:

Command configure terminal service sequence-numbers end show running-config copy running-config startup-config Step 1 Step 2 Step 3 Step 4 Step 5 Purpose Enter global configuration mode. Enable sequence numbers. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To disable sequence numbers, use the no service sequence-numbers global configuration command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-6 OL-3446-01 Chapter 20 Configuring System Message Logging Configuring System Message Logging This example shows part of a logging display with sequence numbers enabled:

000019: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) Defining the Message Severity Level You can limit messages displayed to the selected device by specifying the severity level of the message, which are described in Table 20-3. Beginning in privileged EXEC mode, follow these steps to define the message severity level:

Command configure terminal logging console level Step 1 Step 2 Purpose Enter global configuration mode. Limit messages logged to the console. Step 3 logging monitor level Step 4 logging trap level Step 5 Step 6 end show running-config or show logging copy running-config startup-config Step 7 By default, the console receives debugging messages and numerically lower levels (see Table 20-3 on page 20-8). Limit messages logged to the terminal lines. By default, the terminal receives debugging messages and numerically lower levels (see Table 20-3 on page 20-8). Limit messages logged to the syslog servers. By default, syslog servers receive informational messages and numerically lower levels (see Table 20-3 on page 20-8). For complete syslog server configuration steps, see the Configuring UNIX Syslog Servers section on page 20-10. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. Note Specifying a level causes messages at that level and numerically lower levels to be displayed at the destination. To disable logging to the console, use the no logging console global configuration command. To disable logging to a terminal other than the console, use the no logging monitor global configuration command. To disable logging to syslog servers, use the no logging trap global configuration command. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-7 Configuring System Message Logging Chapter 20 Configuring System Message Logging Table 20-3 describes the level keywords. It also lists the corresponding UNIX syslog definitions from the most severe level to the least severe level. Table 20-3 Message Logging Level Keywords Level Keyword emergencies alerts critical errors warnings notifications informational debugging Level 0 1 2 3 4 5 6 7 Description System unstable Immediate action needed Critical conditions Error conditions Warning conditions Normal but significant condition Informational messages only Debugging messages Syslog Definition LOG_EMERG LOG_ALERT LOG_CRIT LOG_ERR LOG_WARNING LOG_NOTICE LOG_INFO LOG_DEBUG The software generates four other categories of messages:

Error messages about software or hardware malfunctions, displayed at levels warnings through emergencies. These types of messages mean that the functionality of the access point is affected. Output from the debug commands, displayed at the debugging level. Debug commands are typically used only by the Technical Assistance Center (TAC). Interface up or down transitions and system restart messages, displayed at the notifications level. This message is only for information; access point functionality is not affected. Reload requests and low-process stack messages, displayed at the informational level. This message is only for information; access point functionality is not affected. Limiting Syslog Messages Sent to the History Table and to SNMP If you have enabled syslog message traps to be sent to an SNMP network management station by using the snmp-server enable trap global configuration command, you can change the level of messages sent and stored in the access point history table. You can also change the number of messages that are stored in the history table. Messages are stored in the history table because SNMP traps are not guaranteed to reach their destination. By default, one message of the level warning and numerically lower levels (see Table 20-3 on page 20-8) are stored in the history table even if syslog traps are not enabled. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-8 OL-3446-01 Chapter 20 Configuring System Message Logging Configuring System Message Logging Beginning in privileged EXEC mode, follow these steps to change the level and history table size defaults:

Command configure terminal logging history level1 Step 1 Step 2 Step 3 logging history size number Step 4 Step 5 Step 6 end show running-config copy running-config startup-config Purpose Enter global configuration mode. Change the default level of syslog messages stored in the history file and sent to the SNMP server. See Table 20-3 on page 20-8 for a list of level keywords. By default, warnings, errors, critical, alerts, and emergencies messages are sent. Specify the number of syslog messages that can be stored in the history table. The default is to store one message. The range is 1 to 500 messages. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. 1. Table 20-3 lists the level keywords and severity level. For SNMP usage, the severity level values increase by 1. For example, emergencies equal 1, not 0, and critical equals 3, not 2. When the history table is full (it contains the maximum number of message entries specified with the logging history size global configuration command), the oldest message entry is deleted from the table to allow the new message entry to be stored. To return the logging of syslog messages to the default level, use the no logging history global configuration command. To return the number of messages in the history table to the default value, use the no logging history size global configuration command. Setting a Logging Rate Limit You can enable a limit on the number of messages that the access point logs per second. You can enable the limit for all messages or for messages sent to the console, and you can specify that messages of a specific severity are exempt from the limit. Beginning in privileged EXEC mode, follow these steps to enable a logging rate limit:

Step 1 Step 2 Command configure terminal logging rate-limit seconds

[all | console]

[except severity]

Purpose Enter global configuration mode. Enable a logging rate limit in seconds.

(Optional) Apply the limit to all logging or only to messages logged to the console.

(Optional) Exempt a specific severity from the limit. Step 3 Step 4 end copy running-config startup-config Return to privileged EXEC mode.

(Optional) Save your entries in the configuration file. To disable the rate limit, use the no logging rate-limit global configuration command. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-9 Configuring System Message Logging Chapter 20 Configuring System Message Logging Configuring UNIX Syslog Servers The next sections describe how to configure the 4.3 BSD UNIX server syslog daemon and define the UNIX system logging facility. Logging Messages to a UNIX Syslog Daemon Before you can send system log messages to a UNIX syslog server, you must configure the syslog daemon on a UNIX server. Log in as root, and perform these steps:

Note Some recent versions of UNIX syslog daemons no longer accept by default syslog packets from the network. If this is the case with your system, use the UNIX man syslogd command to determine what options must be added to or removed from the syslog command line to enable logging of remote syslog messages. Step 1 Add a line such as the following to the file /etc/syslog.conf:

local7.debug /usr/adm/logs/cisco.log The local7 keyword specifies the logging facility to be used; see Table 20-4 on page 20-11 for information on the facilities. The debug keyword specifies the syslog level; see Table 20-3 on page 20-8 for information on the severity levels. The syslog daemon sends messages at this level or at a more severe level to the file specified in the next field. The file must already exist, and the syslog daemon must have permission to write to it. Step 2 Create the log file by entering these commands at the UNIX shell prompt:

$ touch /usr/adm/log/cisco.log

$ chmod 666 /usr/adm/log/cisco.log Step 3 Make sure the syslog daemon reads the new changes by entering this command:

$ kill -HUP `cat /etc/syslog.pid`

For more information, see the man syslog.conf and man syslogd commands on your UNIX system. Configuring the UNIX System Logging Facility When sending system log messages to an external device, you can cause the access point to identify its messages as originating from any of the UNIX syslog facilities. Beginning in privileged EXEC mode, follow these steps to configure UNIX system facility message logging:

Command configure terminal logging host Step 1 Step 2 Purpose Enter global configuration mode. Log messages to a UNIX syslog server host by entering its IP address. To build a list of syslog servers that receive logging messages, enter this command more than once. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-10 OL-3446-01 Chapter 20 Configuring System Message Logging Configuring System Message Logging Command logging trap level Step 3 Purpose Limit messages logged to the syslog servers. Step 4 logging facility facility-type Step 5 Step 6 Step 7 end show running-config copy running-config startup-config Be default, syslog servers receive informational messages and lower. See Table 20-3 on page 20-8 for level keywords. Configure the syslog facility. See Table 20-4 on page 20-11 for facility-type keywords. The default is local7. Return to privileged EXEC mode. Verify your entries.

(Optional) Save your entries in the configuration file. To remove a syslog server, use the no logging host global configuration command, and specify the syslog server IP address. To disable logging to syslog servers, enter the no logging trap global configuration command. Table 20-4 lists the 4.3 BSD UNIX system facilities supported by the Cisco IOS software. For more information about these facilities, consult the operators manual for your UNIX operating system. Table 20-4 Logging Facility-Type Keywords Facility Type Keyword auth cron daemon kern local0-7 lpr mail news sys9 sys10 sys11 sys12 sys13 sys14 syslog user uucp Description Authorization system Cron facility System daemon Kernel Locally defined messages Line printer system Mail system USENET news System use System use System use System use System use System use System log User process UNIX-to-UNIX copy system OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-11 Displaying the Logging Configuration Chapter 20 Configuring System Message Logging Displaying the Logging Configuration To display the current logging configuration and the contents of the log buffer, use the show logging privileged EXEC command. For information about the fields in this display, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.2. To display the logging history file, use the show logging history privileged EXEC command. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 20-12 OL-3446-01 C H A P T E R 21 Troubleshooting This chapter provides troubleshooting procedures for basic problems with the access point. For the most up-to-date, detailed troubleshooting information, refer to the Cisco TAC website at the following URL

(select Top Issues and then select Wireless Technologies):

http://www.cisco.com/tac Sections in this chapter include:

Checking the Top Panel Indicators, page 21-2

Checking Basic Settings, page 21-4

Resetting to the Default Configuration, page 21-4

Reloading the Access Point Image, page 21-6 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 21-1 Checking the Top Panel Indicators Chapter 21 Troubleshooting Checking the Top Panel Indicators If your access point is not communicating, check the three LED indicators on the top panel. You can use them to quickly assess the units status. Figure 21-1 shows the indicators. Figure 21-1 Access Point Indicators Ethernet Status Radio 4 0 7 6 8 The indicators signals have the following meanings (for additional details refer to Table 21-1):

The Ethernet indicator signals traffic on the wired LAN, or Ethernet infrastructure. This indicator is normally green when an Ethernet cable is connected, and blinks green when a packet is received or transmitted over the Ethernet infrastructure. The indicator is off when the Ethernet cable is not connected.

The status indicator signals operational status. Steady green indicates that the access point is associated with at least one wireless client. Blinking green indicates that the access point is operating normally but is not associated with any wireless devices.

The radio indicator blinks green to indicate radio traffic activity. The light is normally off, but it blinks green whenever a packet is received or transmitted over the access points radio. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 21-2 OL-3446-01 Chapter 21 Troubleshooting Checking the Top Panel Indicators Table 21-1 Top Panel Indicator Signals Message type Boot loader status Association status Operating status Boot Loader Errors Operation Errors Ethernet indicator Green Amber Green Green Blinking green Red Red Amber Red Amber Blinking amber Configuration Reset Failure Red Firmware Upgrade Status indicator Amber Blinking green Green Green Green Blinking green Green Red Red Green Green Amber Green

Radio indicator Green Red Blinking green Green Blinking green Red Red Amber Red Amber Blinking amber Meaning DRAM memory test. Board initialization test Flash memory test. Ethernet initialization test. Starting IOS. At least one wireless client device is associated with the unit. No client devices are associated; check the units SSID and WEP settings. Transmitting/receiving radio packets. Ethernet link is operational. Transmitting/receiving Ethernet packets. DRAM memory test failure. File system failure. Ethernet failure during image recovery. Boot environment error. No IOS image file. Boot failure. Maximum retries or buffer full occurred on the radio. Transmit/receive Ethernet errors. Blinking amber Amber Red Red Red General warning. Resetting the configuration options to factory defaults. Firmware failure; try disconnecting and reconnecting unit power. Loading new firmware image. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 21-3 Checking Basic Settings Checking Basic Settings Chapter 21 Troubleshooting Mismatched basic settings are the most common causes of lost connectivity with wireless clients. If the access point does not communicate with client devices, check the following areas. Wireless clients attempting to associate with the access point must use the same SSID as the access point. If a client devices SSID does not match the SSID of an access point in radio range, the client device will not associate. The access point default SSID is tsunami. SSID WEP Keys The WEP key you use to transmit data must be set up exactly the same on your access point and any wireless devices with which it associates. For example, if you set WEP Key 3 on your client adapter to 0987654321 and select it as the transmit key, you must also set WEP Key 3 on the access point to exactly the same value. The access point does not need to use Key 3 as its transmit key, however. Refer to Chapter 9, Configuring WEP and WEP Features, for instructions on setting the access points WEP keys. Security Settings Wireless clients attempting to authenticate with your access point must support the same security options configured in the access point, such as EAP or LEAP, MAC address authentication, Message Integrity Check (MIC), WEP key hashing, and 802.1X protocol versions. If a wireless client is unable to authenticate with your access point, contact the system administrator for proper security settings in the client adapter and for the client adapter driver and firmware versions that are compatible with the access point settings. Note The access point MAC address that appears on the Status page in the Aironet Client Utility (ACU) is the MAC address for the access point radio. The MAC address for the access point Ethernet port is printed on the label on the back of the access point. Resetting to the Default Configuration If you forget the password that allows you to configure the access point, you may need to completely reset the configuration. You can use the MODE button on the access point or the web-browser interface. Note The following steps reset all configuration settings to factory defaults, including passwords, WEP keys, the IP address, and the SSID. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 21-4 OL-3446-01 Chapter 21 Troubleshooting Using the MODE Button Resetting to the Default Configuration Follow these steps to delete the current configuration and return all access point settings to the factory defaults using the MODE button:

Step 1 Step 2 Step 3 Step 4 Disconnect power (the power jack for external power or the Ethernet cable for in-line power) from the access point. Press and hold the MODE button while you reconnect power to the access point. Hold the MODE button until the Status LED turns amber (approximately 1 to 2 seconds), and release the button. After the access point reboots, you must reconfigure the access point by using the Web browser interface, the Telnet interface, or IOS commands. Note The access point is configured with the factory default values including the IP address (set to receive an IP address using DHCP). Using the Web Browser Interface Follow the steps below to delete the current configuration and return all access point settings to the factory defaults using the web browser interface. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Open your Internet browser. You must use Microsoft Internet Explorer (version 5.x or later) or Netscape Navigator (version 4.x). Enter the access points IP address in the browser address line and press Enter. An Enter Network Password screen appears. Enter your username in the User Name field. Enter the access point password in the Password field and press Enter. The Summary Status page appears. Click System Software and the System Software screen appears. Click System Configuration and the System Configuration screen appears. Click the Reset to Defaults button. Note If the access point is configured with a static IP address, the IP address does not change. Step 8 After the access point reboots, you must reconfigure the access point by using the Web browser interface, the Telnet interface, or IOS commands. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 21-5 Reloading the Access Point Image Chapter 21 Troubleshooting Reloading the Access Point Image If your access point has a firmware failure, you must reload the complete access point image file using the Web browser interface or by pressing and holding the MODE button for around 30 seconds. You can use the browser interface if the access point firmware is still fully operational and you want to upgrade the firmware image. However, you can use the MODE button when the access point has a corrupt firmware image. Using the MODE button You can use the MODE button on the access point to reload the access point image file from an active Trivial File Transfer Protocol (TFTP) server on your network or on a PC connected to the access point Ethernet port. Note If your access point experiences a firmware failure or a corrupt firmware image, indicated by three red LED indicators, you must reload the image from a connected TFTP server. Note This process resets all configuration settings to factory defaults, including passwords, WEP keys, the access point IP address, and SSIDs. Follow the steps below to reload the access point image file:

Step 1 The PC you intend to use must be configured with a static IP address in the range of 10.0.0.2 to 10.0.0.30. Step 2 Make sure the PC contains the access point image file (c1100-k9w7-tar.default) in the TFTP server folder and the TFTP server is activated. For additional information, refer to the Obtaining the Access Point Image File and Obtaining the TFTP Server Software sections. Step 3 Step 4 Step 5 Step 6 Connect the PC to the access point using a Category 5 (CAT5) Ethernet cable. Disconnect power (the power jack for external power or the Ethernet cable for in-line power) from the access point. Press and hold the MODE button while you reconnect power to the access point. Hold the MODE button until the status LED turns red (approximately 20 to 30 seconds), and release the MODE button. Step 7 Wait until the access point reboots as indicated by all LEDs turning green followed by the Status LED blinking green. Step 8 After the access point reboots, you must reconfigure the access point by using the Web interface, the Telnet interface, or IOS commands. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 21-6 OL-3446-01 Chapter 21 Troubleshooting Web Browser Interface Reloading the Access Point Image You can also use the Web browser interface to reload the access point image file. The Web broswer interface supports loading the image file using HTTP or TFTP interfaces. Note Your access point configuration is not changed when using the browser to reload the image file. Browser HTTP Interface The HTTP interface enables you to browse to the access point image file on your PC and download the image to the access point. Follow the instructions below to use the HTTP interface:

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Open your Internet browser. You must use Microsoft Internet Explorer (version 5.x or later) or Netscape Navigator (version 4.x). Enter the access points IP address in the browser address line and press Enter. An Enter Network Password screen appears. Enter your username in the User Name field. Enter the access point password in the Password field and press Enter. The Summary Status page appears. Click the System Software tab and then click Software Upgrade. The HTTP Upgrade screen appears. Click the Browse button to locate the image file on your PC. Click the Upload button. For additional information, click the Help icon on the Software Upgrade screen. Browser TFTP Interface The TFTP interface allows you to use a TFTP server on a network device to load the access point image file. Follow the instructions below to use a TFTP server:

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Open your Internet browser. You must use Microsoft Internet Explorer (version 5.x or later) or Netscape Navigator (version 4.x). Enter the access points IP address in the browser address line and press Enter. An Enter Network Password screen appears. Enter your username in the User Name field. Enter the access point password in the Password field and press Enter. The Summary Status page appears. Click the System Software tab and then click Software Upgrade. The HTTP Upgrade screen appears. Click the TFTP Upgrade tab. Enter the IP address for the TFTP server in the TFTP Server field. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 21-7 Reloading the Access Point Image Chapter 21 Troubleshooting Step 8 Step 9 Enter the file name for the access point image file in the Upload New System Image Tar File field. If the file is located in a subdirectory of the TFTP server root directory, include the relative path of the TFTP server root directory with the filename. If the file is located in the TFTP root directory, enter only the filename. Click the Upload button. For additional information click the Help icon on the Software Upgrade screen. Obtaining the Access Point Image File The access point image file can be obtained from the Cisco.com software center using the following steps:

Step 1 Use your Internet browser to access the Cisco Software Center at the following URL:

http://www.cisco.com/public/sw-center/sw-wireless.shtml Step 2 Step 3 Step 4 Locate the access point firmware and utilities section and click on the link for the 1100 series access point. Double-click the latest firmware image file (c1100-k9w7-tar.122-4.JA). Download the access point image file to a directory on your PC hard drive. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 21-8 OL-3446-01 Chapter 21 Troubleshooting Reloading the Access Point Image Obtaining the TFTP Server Software The TFTP server software (self-extracting and installing file) can be obtained from the Cisco.com software center using the following URL:

http://www.cisco.com/public/sw-center/sw-web.shtml Download the file to a temporary directory on your PC hard drive. To install the TFTP server, double-click the downloaded file and follow the installer program instructions. Activating and Configuring the TFTP Server Follow the steps below to activate the TFTP server and specify the location of the access point image file:

Step 1 Step 2 Step 3 Step 4 Double-click the Cisco TFTP Server icon on your PCs desktop to activate the server program. Select Options from the View drop-down menu. The Options screen appears. Click the Browse button of the TFTP server root directory field and locate the access point image file. Click OK. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 21-9 Reloading the Access Point Image Chapter 21 Troubleshooting Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 21-10 OL-3446-01 C H A P T E R 22 2.4-GHz Radio Upgrade This chapter provides upgrade instructions for the 2.4-GHz radio module and includes the following sections:

Upgrade Overview, page 22-2 Opening the Access Cover, page 22-3 Removing a Blank Spacer Card, page 22-4 Removing a 2.4-GHz Radio, page 22-5 Installing a 2.4-GHz Radio, page 22-7 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 22-1 Upgrade Overview Upgrade Overview Chapter 22 2.4-GHz Radio Upgrade This section provides instructions for upgrading the access point 2.4-GHz radio. The following operations summarize the upgrade procedure:

Remove all cables and power connections from the access point. Follow standard electrostatic discharge (ESD) procedures. Place the access point on an ESD-protected work surface. Open the access points 2.4-GHz radio access cover. For an access point without the 2.4-GHz radio feature, remove the blank spacer card. For an access point with the 2.4-GHz radio feature, remove the existing 2.4-GHz card. Install the new 2.4-GHz radio card. Close the access point 2.4-GHz radio access cover. Caution ESD can damage the Cisco Aironet radio and the internal components of the access point. It is recommended that the 2.4-GHz radio upgrade procedures be performed by an ESD-trained service technician at an ESD-protected workstation. Note After you install the new radio, all configurable radio settings will be at default values. Refer to Chapter 7, Configuring Radio Settings, for complete instructions on configuring the new radio. Unpacking the Radio Each 2.4-GHz radio is shipped with the following items:

Quick start guide A product registration card A T-10 tamper-resistant Torx L-wrench A 2.4-GHz radio product compliance label If anything is missing or damaged, contact your Cisco representative for support. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 22-2 OL-3446-01 Chapter 22 2.4-GHz Radio Upgrade Opening the Access Cover Opening the Access Cover To open the 2.4-GHz radio access cover, follow the steps below:

Step 1 Step 2 Step 3 Step 4 Remove all cables and power connections from the access point. Remove all static-generating items from the work area, such as plastic material, styrofoam cups, and other similar items. Place the access point and the new 2.4-GHz radio (in its antistatic bag) on an antistatic work surface. Discharge any static buildup on your body by touching a grounded surface (antistatic work surface) before proceeding. Step 5 Position the access point so that the bottom cover is facing up. Caution The internal access point components and the 2.4-GHz radio can be damaged by ESD from improper handling. Step 6 Remove the bottom access cover (see Figure 22-1) using the T-10 tamper-resistant Torx L-wrench provided with your Cisco radio card. Figure 22-1 Location of 2.4-GHz Radio Access Cover Screw 1 8 5 4 4 7 1 Access Cover Screw If your access point was not configured with a 2.4-GHz radio, go to the Removing a Blank Spacer Card section. If you are replacing an existing 2.4-GHz radio, go to the Removing a 2.4-GHz Radio section. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 22-3 Removing a Blank Spacer Card Chapter 22 2.4-GHz Radio Upgrade Removing a Blank Spacer Card When your access point is not factory-configured with a 2.4-GHz radio, it contains a blank spacer card in the internal mini-PCI connector. You must remove the blank spacer card prior to installing a new 2.4-GHz radio card. Caution Handle all components carefully and observe all ESD precautions. The internal access point components and the 2.4-GHz radio can be damaged by ESD from improper handling. To remove the blank spacer card from the mini-PCI connector, following the steps below:

Step 1 Push the card-retaining clips (on each side of card) away from the card (see Figure 22-2). When released, the board springs up. Figure 22-2 Location of Retaining Clips on Blank Spacer Card 1 2 3 1 1 2 Card-retaining clips Antenna connector (white wire) 3 Antenna connector (black wire) 8 4 2 4 7 Step 2 Carefully bend the card near the slots in opposite directions to provide enough clearance to remove the antenna wires. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 22-4 OL-3446-01 Chapter 22 2.4-GHz Radio Upgrade Removing a 2.4-GHz Radio Step 3 Remove the antenna wires from the blank spacer card. Caution To avoid damaging the antenna wire assemblies, handle them by their connectors. Step 4 Remove the blank spacer card from the mini-PCI connector. For instructions on installing the radio card, go to the Installing a 2.4-GHz Radio section. Removing a 2.4-GHz Radio To remove a 2.4-GHz radio card from your access point, follow the steps below:

Caution The internal access point components and the 2.4-GHz radio can be damaged by ESD from improper handling. Step 1 Use your fingers to carefully remove the antenna wire connectors from the 2.4-GHz radio card. Caution The antenna connectors can be damaged by using a pair of long-nose pliers during the removal process. Caution To avoid damaging the antenna wire assemblies, handle them by their connectors. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 22-5 Removing a 2.4-GHz Radio Chapter 22 2.4-GHz Radio Upgrade Step 2 Remove the 2.4-GHz radio card from the mini-PCI connector by performing the following operations:

a. Push the card-retaining clips (on each side of card) away from the card (see Figure 22-3). When released, the radio card springs up (see Figure 22-4). Figure 22-3 Location of Retaining Clips on 2.4-GHz Radio Card 1 1 MAIN AUX 1 Card-retaining clips 3 5 2 4 7 b. Grasp the radio card only on the edges, being careful not to touch components on the board or the gold connector pins. c. Remove the 2.4-GHz card from the mini-PCI connector. Step 3 Place the removed 2.4GHz radio card into an anti-static bag. For instructions on installing a new radio card, go to the Installing a 2.4-GHz Radio section. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 22-6 OL-3446-01 Chapter 22 2.4-GHz Radio Upgrade Installing a 2.4-GHz Radio Installing a 2.4-GHz Radio To install a new 2.4-GHz radio card into the access point, follow the steps below. Caution The internal access point components and the 2.4-GHz radio can be damaged by ESD from improper handling. Step 1 Step 2 Step 3 Carefully remove the Cisco Aironet 2.4-GHz radio card from its anti-static bag. Grasp the radio card only on the edges, being careful not to touch components on the board or the gold connector pins. Connect the black antenna wire connector to the radio card antenna connector marked by the black label

(see Figure 22-4). Caution To avoid damaging the antenna wire assemblies, handle them by their connectors. Figure 22-4 Antenna Connector Labels and Mini-PCI Connector U X A AIN M 1 2 3 1 5 2 4 7 1 2 Antenna connector (black wire) Antenna connector (white wire) 3 Mini-PCI connector Step 4 Connect the white antenna wire connector to the radio card antenna connector marked by the white label

(see Figure 22-4). OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 22-7 Installing a 2.4-GHz Radio Chapter 22 2.4-GHz Radio Upgrade Step 5 Insert the radio card into the access points mini-PCI connector by following the steps below:

a. Tilt the radio card at approximately 20o to 30o so that its gold pins are aligned with the mini-PCI connector (see Figure 22-4). b. Push the card into the mini-PCI connector until it clicks into place. Step 6 Carefully push the card down (towards the access points motherboard) until the card-retaining clips lock into the notches on the side of the radio card (you will hear a click). Step 7 Carefully position the antenna wires so that the metal connectors do not touch each other. Caution Damage to the radio could occur if the antenna connectors are touching when power is applied. If they are touching, carefully rotate them in opposite directions until they are separated. Step 8 Reinstall the 2.4-GHz radio access cover and use the T-10 tamper-resistant Torx L-wrench to tighten the covers retaining screw. Step 9 Remove the backing paper from the 2.4-GHz radio product compliance label. Step 10 Carefully attach the label in the space provided below the access points product compliance label as shown in Figure 22-5. Figure 22-5 Location of Product Compliance Labels 1 2 1 2.4-GHz radio product compliance label 2 Access point product compliance label 6 4 2 4 7 Note If your access point contains a 5-GHz radio module, there will also be a 5-GHz radio product compliance label on the back of the unit. The radio card installation is now complete. To configure the radio with your wireless network settings, refer to Chapter 7, Configuring Radio Settings. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 22-8 OL-3446-01 C H A P T E R 23 5-GHz Radio Module Upgrade This chapter provides upgrade instructions for the 5-GHz radio module and includes the following sections:

Upgrade Overview, page 23-2 Removing the 5-GHz Radio Access Cover, page 23-2 Removing a 5-GHz Radio Module, page 23-3 Installing a 5-GHz Radio Module, page 23-5 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 23-1 Upgrade Overview Upgrade Overview Chapter 23 5-GHz Radio Module Upgrade This section provides instructions for upgrading the access point 5-GHz radio module. The following operations summarize the upgrade procedure:

1. Remove all cables and power connections from the access point. 2. Place your access point on a flat surface. 3. For an access point without the 5-GHz radio feature, remove the 5-GHz radio access cover. 4. For an access point with the 5-GHz radio feature, remove the existing 5-GHz radio module. 5. Install the new 5-GHz radio module. Note After you install the radio module, all configurable radio settings will be at default values. Refer to Chapter 7, Configuring Radio Settings, for complete instructions on configuring the new radio. Unpacking the Radio Module Each 5-GHz radio module is shipped with the following items:

Quick start guide A product registration card A T-10 tamper-resistant Torx L-wrench A 5-GHz radio product compliance label If anything is missing or damaged, contact your Cisco representative for support. Removing the 5-GHz Radio Access Cover To remove the 5-GHz radio access cover, follow the instructions below:

Step 1 Step 2 Remove all cables and power connections from the access point. Place the access point on a flat surface so that the unit is upright with the front end facing you. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 23-2 OL-3446-01 Chapter 23 5-GHz Radio Module Upgrade Removing a 5-GHz Radio Module Step 3 Remove the 5-GHz access cover (see Figure 23-1) using the supplied Torx L-wrench. Figure 23-1 5-GHz Radio Access Cover 1 2 1 1 Access Cover Screws 2 Access Cover 2 3 6 4 7 Removing a 5-GHz Radio Module To remove the 5-GHz radio module, follow the instructions below:

Step 1 Step 2 Step 3 Remove all cables and power connections from the access point. Place the access point on a flat surface so that the unit is upright with the front end facing you. Unscrew the two mounting screws using the supplied Torx L-wrench (Figure 23-2). Figure 23-2 5-GHz Radio Module 1 1 2 3 1 2 Mounting screws 5-GHz radio module antenna 1 3 6 4 7 3 Access point Note Do not attempt to remove the mounting screws from the module; they are captured in the module housing. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 23-3 Removing a 5-GHz Radio Module Chapter 23 5-GHz Radio Module Upgrade Step 4 Insert your fingers into the base of the 5-GHz radio module (closest to the access point) and pull straight out from the access point (see Figure 23-3). Figure 23-3 Removing the 5-GHz Radio Module Step 5 Fold the antenna down (towards the attached radio card) and insert the module into a static protected bag. 9 2 6 4 7 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 23-4 OL-3446-01 Chapter 23 5-GHz Radio Module Upgrade Installing a 5-GHz Radio Module Installing a 5-GHz Radio Module To install a new 5-GHz radio module into your access point, follow the steps below:

Step 1 Step 2 Step 3 Before you can install a new 5-GHz radio module, you must remove the access cover or an existing 5-GHz radio module (refer to Removing the 5-GHz Radio Access Cover or Removing a 5-GHz Radio Module). Place the access point on a flat surface so that the unit is upright with the front end facing you. Grasp the new 5-GHz radio module by its base (with the antenna pointing up) and insert the card into the access points card-bus slot (see Figure 23-4). Figure 23-4 Installing a 5-GHz Radio Module 1 2 3 4 4 0 6 4 7 1 2 Access point 5-GHz radio module antenna 3 4 Access point card-bus slot 5-GHz radio card Step 4 Push the 5-GHz radio module into the slot until you hear a slight click. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 23-5 Installing a 5-GHz Radio Module Chapter 23 5-GHz Radio Module Upgrade Step 5 Tighten the 5-GHz radio module mounting screws (see Figure 23-5) using the supplied Torx L-wrench. Figure 23-5 Location of Mounting Screws 1 2 1 5-GHz radio module antenna 2 2 0 3 6 4 7 Mounting screws Step 6 Step 7 Remove the backing paper from the 5-GHz radio product compliance label. Carefully attach the label in the space provided below the product compliance label (see Figure 23-6). Figure 23-6 5-GHz Radio Product Compliance Label 1 2 1 5-GHz radio product compliance label 2 Access point product compliance label 6 4 2 4 7 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 23-6 OL-3446-01 Chapter 23 5-GHz Radio Module Upgrade Installing a 5-GHz Radio Module Note If your access point contains an internal 2.4-GHz radio, there will also be a 2.4-GHz radio product compliance label on the back of the unit. The 5-GHz radio module installation is now complete and radio settings are at default values. To configure the 5-GHz radio with your wireless network settings refer to Chapter 7, Configuring Radio Settings. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 23-7 Installing a 5-GHz Radio Module Chapter 23 5-GHz Radio Module Upgrade Cisco Aironet 1200 Series Access Point Installation and Configuration Guide 23-8 OL-3446-01 C H A P T E R A Translated Safety Warnings This appendix provides translations of the safety warnings that appear in this publication. These translated warnings apply to other documents in which they appear in English. The following safety warnings appear in this appendix:

Dipole Antenna Installation Warning, page A-2 Explosive Device Proximity Warning, page A-3 Lightning Activity Warning, page A-4 Installation Warning, page A-5 Circuit Breaker (15A) Warning, page A-5 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide A-1 Dipole Antenna Installation Warning Chapter A Translated Safety Warnings Dipole Antenna Installation Warning Warning In order to comply with FCC radio frequency (RF) exposure limits, dipole antennas should be located at a minimum of 7.9 inches (20 cm) or more from the body of all persons. Waarschuwing Om te voldoen aan de FCC radiofrequentie (RF) blootstellingslimieten dienen dipoolantennes zich minstens 20 cm of meer van de lichamen van alle personen bevinden. Varoitus FCC:n antamien radiotaajuuksille altistumista koskevien rajoitusten mukaan dipoliantennien on sijaittava vhintn 20 cm:n pss kaikista henkilist. Attention Warnung Pour se conformer aux limites dexposition la frquence radio prconises par la FCC (Federal Communications Commission), les antennes diples doivent se situer un minimum de 20 cm de toute personne. Um die in den FCC-Richtlinien festgelegten Expositionshchstgrenzen fr Radiofrequenzen (RF) nicht zu berschreiten, sollten Dipolantennen mindestens 20 cm (7,9 Zoll) vom Krper aller Person entfernt aufgestellt werden. Avvertenza Per conformarsi ai limiti FCC di esposizione a radiofrequenza (RF), le antenne a dipolo devono stare ad una distanza minima di 20 cm dal corpo di ogni persona. Advarsel I henhold til eksponeringsgrensene for radiofrekvenser (RF), skal dipole antenner befinne seg p en avstand av minst 20 cm eller mer fra mennesker. Aviso Para estar de acordo com as normas FCC de limites de exposio para freqncia de rdio (RF), as antenas dipolo devem estar distantes no mnimo 20 cm (7,9 pol) do corpo de qualquer pessoa. Advertencia!

Para cumplir con los lmites de exposicin de radio frecuencia (RF) de la Comisin Federal de Comunicaciones (FCC) es preciso ubicar las antenas dipolo a un mnimo de 20 cm (7,9 pulgadas) o ms del cuerpo de las personas. Varning!

Fr att flja FCC-exponeringsgrnserna fr radiofrekvens (RF), br dipolsantenner placeras p minst 20 cm avstnd frn alla mnniskor. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide A-2 OL-3446-01 Chapter A Translated Safety Warnings Explosive Device Proximity Warning Explosive Device Proximity Warning Warning Do not operate your wireless network device near unshielded blasting caps or in an explosive environment unless the device has been modified to be especially qualified for such use. Waarschuwing Gebruik dit draadloos netwerkapparaat alleen in de buurt van onbeschermde ontstekers of in een omgeving met explosieven indien het apparaat speciaal is aangepast om aan de eisen voor een dergelijk gebruik te voldoen. Varoitus l kyt johdotonta verkkolaitetta suojaamattomien rjytysnallien lheisyydess tai rjytysalueella, jos laitetta ei ole erityisesti muunnettu sopivaksi sellaiseen kyttn.oen. Attention Ne jamais utiliser un quipement de rseau sans fil proximit d'un dtonateur non blind ou dans un lieu prsentant des risques d'explosion, sauf si l'quipement a t modifi cet effet. Warnung Benutzen Sie Ihr drahtloses Netzwerkgert nicht in der Nhe ungeschtzter Sprengkapseln oder anderer explosiver Stoffe, es sei denn, Ihr Gert wurde eigens fr diesen Gebrauch modifiziert und bestimmt. Avvertenza Non utilizzare la periferica di rete senza fili in prossimit di un detonatore non protetto o di esplosivi a meno che la periferica non sia stata modificata a tale proposito. Advarsel Ikke bruk den trdlse nettverksenheten nrt inntil uisolerte fenghetter eller i et eksplosivt milj med mindre enheten er modifisert slik at den tler slik bruk. Aviso No opere o dispositivo de rede sem fios perto de cpsulas explosivas no protegidas ou num ambiente explosivo, a no ser que o dispositivo tenha sido modificado para se qualificar especialmente para essa utilizao. Advertencia!

No utilizar un aparato de la red sin cable cerca de un detonador que no est protegido ni tampoco en un entorno explosivo a menos que el aparato haya sido modificado con ese fin. Varning!

Anvnd inte den trdlsa ntverksenheten i nrheten av oskyddade tndhattar eller i en explosiv milj om inte enheten modifierats fr att kunna anvndas i sdana sammanhang. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide A-3 Lightning Activity Warning Chapter A Translated Safety Warnings Lightning Activity Warning Warning Do not work on the system or connect or disconnect cables during periods of lightning activity. Waarschuwing Tijdens onweer dat gepaard gaat met bliksem, dient u niet aan het systeem te werken of kabels aan te sluiten of te ontkoppelen. Varoitus l tyskentele jrjestelmn parissa lk yhdist tai irrota kaapeleita ukkosilmalla. Attention Ne pas travailler sur le systme ni brancher ou dbrancher les cbles pendant un orage. Warnung Arbeiten Sie nicht am System und schlieen Sie keine Kabel an bzw. trennen Sie keine ab, wenn es gewittert. Avvertenza Non lavorare sul sistema o collegare oppure scollegare i cavi durante un temporale con fulmini. Advarsel Utfr aldri arbeid p systemet, eller koble kabler til eller fra systemet nr det tordner eller lyner. Aviso No trabalhe no sistema ou ligue e desligue cabos durante perodos de mau tempo (trovoada). Advertencia!

No operar el sistema ni conectar o desconectar cables durante el transcurso de descargas elctricas en la atmsfera. Varning!

Vid ska skall du aldrig utfra arbete p systemet eller ansluta eller koppla loss kablar. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide A-4 OL-3446-01 Chapter A Translated Safety Warnings Installation Warning Installation Warning Warning Read the installation instructions before you connect the system to its power source. Waarschuwing Raadpleeg de installatie-aanwijzingen voordat u het systeem met de voeding verbindt. Varoitus Lue asennusohjeet ennen jrjestelmn yhdistmist virtalhteeseen. Attention Avant de brancher le systme sur la source d'alimentation, consulter les directives d'installation. Warnung Lesen Sie die Installationsanweisungen, bevor Sie das System an die Stromquelle anschlieen. Avvertenza Consultare le istruzioni di installazione prima di collegare il sistema allalimentatore. Advarsel Les installasjonsinstruksjonene fr systemet kobles til strmkilden. Aviso Leia as instrues de instalao antes de ligar o sistema sua fonte de energia. Advertencia!

Ver las instrucciones de instalacin antes de conectar el sistema a la red de alimentacin. Varning!

Ls installationsanvisningarna innan du kopplar systemet till dess strmfrsrjningsenhet. Circuit Breaker (15A) Warning Warning This product relies on the buildings installation for short-circuit (overcurrent) protection. Ensure that a fuse or circuit breaker no larger than 120 VAC, 15A U.S. (240 VAC, 10A international) is used on the phase conductors (all current-carrying conductors). Waarschuwing Dit produkt is afhankelijk van de installatie van het gebouw voor kortsluit- (overstroom)beveiliging. Controleer of er een zekering of stroomverbreker van niet meer dan 120 Volt wisselstroom, 15 A voor de V.S. (240 Volt wisselstroom, 10 A internationaal) gebruikt wordt op de fasegeleiders (alle geleiders die stroom voeren). Varoitus Attention Tm tuote on riippuvainen rakennukseen asennetusta oikosulkusuojauksesta

(ylivirtasuojauksesta). Varmista, ett vaihevirtajohtimissa (kaikissa virroitetuissa johtimissa) kytetn Yhdysvalloissa alle 120 voltin, 15 ampeerin ja monissa muissa maissa 240 voltin, 10 ampeerin sulaketta tai suojakytkint. Pour ce qui est de la protection contre les courts-circuits (surtension), ce produit dpend de l'installation lectrique du local. Vrifier qu'un fusible ou qu'un disjoncteur de 120 V alt., 15 A U.S. maximum (240 V alt., 10 A international) est utilis sur les conducteurs de phase (conducteurs de charge). OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide A-5 Circuit Breaker (15A) Warning Chapter A Translated Safety Warnings Warnung Dieses Produkt ist darauf angewiesen, da im Gebude ein Kurzschlu- bzw. berstromschutz installiert ist. Stellen Sie sicher, da eine Sicherung oder ein Unterbrecher von nicht mehr als 240 V Wechselstrom, 10 A (bzw. in den USA 120 V Wechselstrom, 15 A) an den Phasenleitern (allen stromfhrenden Leitern) verwendet wird. Avvertenza Questo prodotto dipende dallinstallazione delledificio per quanto riguarda la protezione contro cortocircuiti (sovracorrente). Verificare che un fusibile o interruttore automatico, non superiore a 120 VCA, 15 A U.S. (240 VCA, 10 A internazionale) sia stato usato nei fili di fase (tutti i conduttori portatori di corrente). Advarsel Dette produktet er avhengig av bygningens installasjoner av kortslutningsbeskyttelse (overstrm). Kontroller at det brukes en sikring eller strmbryter som ikke er strre enn 120 VAC, 15 A (USA) (240 VAC, 10 A internasjonalt) p faselederne (alle strmfrende ledere). Aviso Este produto depende das instalaes existentes para proteco contra curto-circuito

(sobrecarga). Assegure-se de que um fusvel ou disjuntor no superior a 240 VAC, 10A utilizado nos condutores de fase (todos os condutores de transporte de corrente). Advertencia!

Este equipo utiliza el sistema de proteccin contra cortocircuitos (o sobrecorrientes) del propio edificio. Asegurarse de que se utiliza un fusible o interruptor automtico de no ms de 240 voltios en corriente alterna (VAC), 10 amperios del estndar internacional (120 VAC, 15 amperios del estndar USA) en los hilos de fase (todos aqullos portadores de corriente). Varning!

Denna produkt r beroende av i byggnaden installerat kortslutningsskydd (verstrmsskydd). Kontrollera att skring eller verspnningsskydd anvnds p fasledarna (samtliga strmfrande ledare) fr internationellt bruk max. 240 V vxelstrm, 10 A (i USA max. 120 V vxelstrm, 15 A). Cisco Aironet 1200 Series Access Point Installation and Configuration Guide A-6 OL-3446-01 A P P E N D I X B Declarations of Conformity and Regulatory Information This appendix provides declarations of conformity and regulatory information for the Cisco Aironet 1200 Series Access Points. This appendix contains the following sections:

Manufacturers Federal Communication Commission Declaration of Conformity Statement Department of CommunicationsCanada European Community, Switzerland, Norway, Iceland, and Liechtenstein Declaration of Conformity for RF Exposure Guidelines for Operating Cisco Aironet Access Points in Japan OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide B-1 Manufacturers Federal Communication Commission Declaration of Conformity Statement Appendix B Declarations of Conformity and Regulatory Information Manufacturers Federal Communication Commission Declaration of Conformity Statement Tested To Comply With FCC Standards FOR HOME OR OFFICE USE Models:

AIR-AP1200 with AIR-MP20B-A-K9 and/or AIR-RM20A-A-K9, AIR-AP1210, AIR-AP1220B-A-K9, AIR-AP1230B-A-K9, AIR-AP1220A-A-K9, AIR- AP1230A-A-K9, FCC Certification number:

LDK 102042 (AIR-MP20B-A-K9) LDK 102045 (AIR-RM20A-A-K9) Manufacturer:

Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA This device complies with Part 15 rules. Operation is subject to the following two conditions:

1. This device may not cause harmful interference, and 2. This device must accept any interference received, including interference that may cause undesired operation. This equipment has been tested and found to comply with the limits of a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a residential environment. This equipment generates, uses, and radiates radio frequency energy, and if not installed and used in accordance with the instructions, may cause harmful interference. However, there is no guarantee that interference will not occur. If this equipment does cause interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to correct the interference by one of the following measures:

Reorient or relocate the receiving antenna. Increase separation between the equipment and receiver. Connect the equipment to an outlet on a circuit different from which the receiver is connected. Consult the dealer or an experienced radio/TV technician. Caution The Part 15 radio device operates on a non-interference basis with other devices operating at this frequency when using integrated antennas or those listed in Table B-1. Any changes or modification to the product not expressly approved by Cisco could void the users authority to operate this device. Caution Within the 5.15-5.25 GHz band (5 GHz radio channels 34-48) the U-NII devices are restricted to indoor operations to reduce any potential for harmful interference to co-channel Mobile Satellite System (MSS) operations. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide B-2 OL-3446-01 Appendix B Declarations of Conformity and Regulatory Information Department of CommunicationsCanada Table B-1 Access Point 2.4-GHz Antennas Cisco Part Number AIR-ANT1949 AIR-ANT4121 AIR-ANT3549 AIR-ANT2012 AIR-ANT1729 AIR-ANT2506 AIR-ANT3213 AIR-ANT1728 AIR-ANT3195 AIR-ANT5959 AIR-ANT4941 Model Yagi Omni-directional Patch Spatial diversity Patch Omni-directional Omni-directional Omni-directional Patch Omni-directional Dipole Gain 13.5 12.0 8.5 6.5 6.0 5.1 5.0 5.0 3.0 2.0 2.2 Department of CommunicationsCanada Canadian Compliance Statement This Class B Digital apparatus meets all the requirements of the Canadian Interference-Causing Equipment Regulations. Cet appareil numerique de la classe B respecte les exigences du Reglement sur le material broilleur du Canada. This device complies with Class B Limits of Industry Canada. Operation is subject to the following two conditions:

1. This device may not cause harmful interference, and 2. This device must accept any interference received, including interference that may cause undesired operation. Cisco Aironet 11-Mbps, 2.4-GHz Access Points are certified to the requirements of RSS-210 for 2.4-GHz spread spectrum devices, and Cisco Aironet 54-Mbps, 5-GHz Access Points are certified to the requirements of RSS-210 for 5-GHz spread spectrum devices.The use of this device in a system operating either partially or completely outdoors may require the user to obtain a license for the system according to the Canadian regulations. For further information, contact your local Industry Canada office. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide B-3 European Community, Switzerland, Norway, Iceland, and Liechtenstein Appendix B Declarations of Conformity and Regulatory Information European Community, Switzerland, Norway, Iceland, and Liechtenstein Declaration of Conformity with Regard to the R&TTE Directive 1999/5/EC English:

Deutsch:

Dansk:

Espaol:

Franais:

slenska:

Italiano:

Nederlands:

Norsk:

Portugus:

This equipment is in compliance with the essential requirements and other relevant provisions of Directive 1999/5/EC. Dieses Gert entspricht den grundlegenden Anforderungen und den weiteren entsprecheneden Vorgaben der Richtlinie 1999/5/EU. Dette udstyr er i overensstemmelse med de vsentlige krav og andre relevante bestemmelser i Directiv 1999/5/EF. Este equipo cumple con los requisitos esenciales asi como con otras disposiciones de la Directive 1999/5/EC.

1999/5/E. Cet appareil est conforme aux exigencies essentialles et aux autres dispositions pertinantes de la Directive 1999/5/EC. essi bnaur samrmist lgbonum krfum og rum kvum tilskipunar 1999/5/ESB. Questo apparato conforme ai requisiti essenziali ed agli altri principi sanciti dalla Direttiva 1999/5/EC. Deze apparatuur voldoet aan de belangrijkste eisen en andere voorzieningen van richtlijn 1999/5/EC. Dette utstyret er i samsvar med de grunnleggende krav og andre relevante bestemmelser i EU-directiv 1999/5/EC. Este equipamento satisfaz os requisitos essenciais e outras provises da Directiva 1999/5/EC. Suomalainen:

Tm laite tytt direktiivin 1999/5/EY oleelliset vaatimukset ja on siin asetettujen muidenkin ehtojen mukainen. Svenska:

Denna utrustning r i verensstmmelse med de vsentliga kraven och andra relevanta bestmmelser i Direktiv 1999/5/EC. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide B-4 OL-3446-01 Appendix B Declarations of Conformity and Regulatory Information European Community, Switzerland, Norway, Iceland, and Liechtenstein The Declaration of Conformity related to this product can be found at the following URL:

http://www.ciscofax.com For 11 Mbps, 2.4 GHz access points with 100 mW radios, the following standards were applied:

Radio:

EMC:

Safety:

EN 300.328-1, EN 300.328-2 EN 301.489-1, EN 301.89-17 EN 60950 The following CE mark is affixed to the 11 Mbps, 2.4 GHz access points with 100 mW radios:

Note Note This equipment is intended to be used in all EU and EFTA countries. Outdoor use may be restricted to certain frequencies and/or may require a license for operation. For more details, contact Cisco Corporate Compliance. Combinations of power levels and antennas resulting in a radiated power level above 100 mW equivalent isotropic radiated power (EIRP) are considered as not compliant with the above mentioned directive and are not allowed for use within the European community and other countries that have adopted the European R&TTE directive 1999/5/EC or the CEPT recommendation Rec 70.03 or both. For more details on legal combinations of power levels and antennas, refer to the . For 54 Mbps, 5 GHz access points with 40 mW radios, the following standards were applied:

Radio:

EMC:

Safety:

EN 301.893 EN 301.489-1, EN 301.489-17 EN 60950 The following CE mark is affixed to the 54 Mbps, 5 GHz access points with 40 mW radios:

5 2 3 9 4 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide B-5 Declaration of Conformity for RF Exposure Appendix B Declarations of Conformity and Regulatory Information Declaration of Conformity for RF Exposure The radio module has been found to be compliant to the requirements set forth in CFR 47 Sections 2.1091, 2.1093, and 15.247 (b) (4) addressing RF Exposure from radio frequency devices as defined in Evaluating Compliance with FCC Guidelines for Human Exposure to Radio Frequency Electromagnetic Fields. For antennas, AIR-ANT4121 and AIR-ANT1949, the equipment should be positioned more than 2 m from your body or nearby persons. For all other approved antennas the equipment shoud be installed more than 20 cm from your body or nearby persons. The access point (with 5 GHz integrated antenna) must be installed to maintain a minimum 20 cm

(7.9 in) co-located separation distance from other FCC approved indoor/outdoor antennas used with the access point. Any antennas or transmitters not approved by the FCC cannot be co-located with the access point antennas. The access points co-located 2.4 GHz (2.2 dBi) and 5 GHz integrated antennas support a minimum separation distance of 10 cm (3.9 in) and are compliant with the applicable FCC RF exposure limit when transmitting simultaneously. Note Dual antennas used for diversity operation are not considered co-located. Guidelines for Operating Cisco Aironet Access Points in Japan This section provides guidelines for avoiding interference when operating Cisco Aironet access points in Japan. These guidelines are provided in both Japanese and English. Japanese Translation 03-5549-6500 8 6 7 3 4 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide B-6 OL-3446-01 Appendix B Declarations of Conformity and Regulatory Information Guidelines for Operating Cisco Aironet Access Points in Japan English Translation This equipment operates in the same frequency bandwidth as industrial, scientific, and medical devices such as microwave ovens and mobile object identification (RF-ID) systems (licensed premises radio stations and unlicensed specified low-power radio stations) used in factory production lines. 1. Before using this equipment, make sure that no premises radio stations or specified low-power radio stations of RF-ID are used in the vicinity. 2. 3. If this equipment causes RF interference to a premises radio station of RF-ID, promptly change the frequency or stop using the device; contact the number below and ask for recommendations on avoiding radio interference, such as setting partitions. If this equipment causes RF interference to a specified low-power radio station of RF-ID, contact the number below. Contact Number: 03-5549-6500 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide B-7 Guidelines for Operating Cisco Aironet Access Points in Japan Appendix B Declarations of Conformity and Regulatory Information Cisco Aironet 1200 Series Access Point Installation and Configuration Guide B-8 OL-3446-01 A P P E N D I X C Channels and Antenna Settings This appendix lists the access point radio channels and the maximum power levels supported by the worlds regulatory domains. The following topics are covered in this appendix:

Channels, page C-2 Maximum Power Levels, page C-4 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide C-1 Channels Channels IEEE 802.11a Appendix C Channels and Antenna Settings The channel identifiers, channel center frequencies, and regulatory domains of each IEEE 802.11a 20-MHz-wide channel are listed in Table C-1. Table C-1 Channels for IEEE 802.11a Channel Identifier 34 36 38 40 42 44 46 48 52 56 60 64 149 153 157 161 Frequency in Regulatory Domains MHz 5170 5180 5190 5200 5210 5220 5230 5240 5260 5280 5300 5320 5745 5765 5785 5805 Americas (-A) Japan (-J) Singapore (-S) Taiwan (-T)

X

X

X

X X X X X

X

X

X

X

X

X

X

X

X X X X

Note All channel sets are restricted to indoor usage except the Americas (-A), which allows for indoor and outdoor use on channels 52 through 64 in the United States. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide C-2 OL-3446-01 Appendix C Channels and Antenna Settings Channels IEEE 802.11b The channel identifiers, channel center frequencies, and regulatory domains of each IEEE 802.11b 22-MHz-wide channel are listed in Table C-2. Table C-2 Channels for IEEE 802.11b Channel Identifier 1 2 3 4 5 6 7 8 9 10 11 12 13 14 Frequency in Regulatory Domains MHz 2412 2417 2422 2427 2432 2437 2442 2447 2452 2457 2462 2467 2472 2484 Americas (-A) EMEA (-E) Israel (-I) China (-C) Japan (-J) X X X X X X X X X X X

X X X X X X X X X X X X X

X X X X X X X

X X X X X X X X X X X

X X X X X X X X X X X X X X Note Mexico is included in the Americas regulatory domain; however, channels 1 through 8 are for indoor use only while channels 9 through 11 can be used indoors and outdoors. Users are responsible for ensuring that the channel set configuration complies with the regulatory standards of Mexico. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide C-3 Maximum Power Levels Appendix C Channels and Antenna Settings Maximum Power Levels This section lists the maximum radio power levels and antenna gains for each regulatory domain. For additional information on setting radio transmit power, refer to the Configuring Radio Transmit Power section on page 7-5. IEEE 802.11a An improper combination of power level and antenna gain can result in equivalent isotropic radiated power (EIRP) above the amount allowed per regulatory domain. Table C-3 lists the maximum power levels and antenna gains allowed for each IEEE 802.11a regulatory domain. Table C-3 Maximum Power Levels Per Antenna Gain for IEEE 802.11a Regulatory Domain Americas (-A)

(160 mW EIRP maximum on channels 36-48, 800 mW EIRP maximum on channels 52-64) Japan (-J)

(10 mW/MHz EIRP maximum) Singapore (-S)

(100 mW EIRP maximum) Taiwan (-T)

(800 mW EIRP maximum) Maximum Power Level (mW) with 6-dBi Antenna Gain 40 40 20 40 An improper combination of power level and antenna gain can result in equivalent isotropic radiated power (EIRP) above the amount allowed per regulatory domain. Table C-4 lists the maximum power levels and antenna gains allowed for each IEEE 802.11b regulatory domain. Table C-4 Maximum Power Levels Per Antenna Gain for IEEE 802.11b Regulatory Domain Americas (-A)

(4W EIRP maximum) Antenna Gain (dBi) Maximum Power Level (mW) 0 2.2 5.2 6 8.5 12 13.5 100 100 100 100 100 100 100 IEEE 802.11b Cisco Aironet 1200 Series Access Point Installation and Configuration Guide C-4 OL-3446-01 Appendix C Channels and Antenna Settings Maximum Power Levels Table C-4 Maximum Power Levels Per Antenna Gain for IEEE 802.11b (continued) Regulatory Domain EMEA (-E)

(100 mW EIRP maximum) Israel (-I)

(100 mW EIRP maximum) China (-C)

(10 mW EIRP maximum) Japan (-J)

(10 mW/MHz EIRP maximum) Antenna Gain (dBi) Maximum Power Level (mW) 0 2.2 5.2 6 8.5 12 13.5 21 0 2.2 5.2 6 8.5 12 13.5 21 0 2.2 5.2 6 8.5 12 13.5 21 0 2.2 5.2 6 8.5 12 13.5 21 100 50 30 30 5 5 5 1 100 50 30 30 5 5 5 1 5 5 n/a n/a n/a n/a n/a n/a 50 30 30 30 n/a n/a 5 n/a OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide C-5 Maximum Power Levels Appendix C Channels and Antenna Settings Cisco Aironet 1200 Series Access Point Installation and Configuration Guide C-6 OL-3446-01 A P P E N D I X D Mounting Instructions This appendix provides instructions for mounting the access point to suspended ceilings, vertical surfaces, or horizontal surfaces using the access point mounting bracket. The following sections are included in this chapter:

Overview, page D-2 Mounting on a Horizontal or Vertical Surface, page D-3 Mounting on a Suspended Ceiling, page D-4 Attaching the Access Point to the Mounting Bracket, page D-5 Securing the Access Point to the Mounting Bracket, page D-5 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide D-1 Overview Overview Appendix D Mounting Instructions You can mount the access point on any of the following surfaces:

Horizontal or vertical flat surfaces, such as walls or ceilings Suspended ceilings The access point ships with a detachable mounting bracket and the necessary mounting hardware. Because it is detachable, you can use the mounting bracket as a template to mark the positions of the mounting holes for your installation. You then install the mounting bracket and attach the access point when you are ready. Refer to Figure D-1 to locate the various mounting holes for the method you intend to use. The Cisco Aironet 1200 Series Access Point provides adequate fire resistance and low smoke-producing characteristics suitable for operation in a building's environmental air space in accordance with Section 300-22(C) of the National Electrical Code (NEC), such as above suspended ceilings. If you plan to mount the access point in environmental air space and will upgrade to a 5-GHz radio, Cisco recommends that you mount the access point horizontally with its antennas pointing down. Doing so will result in the access point complying with regulatory requirements for environmental air space after the 5-GHz radio is installed. Note Note Note When mounting the access point in a buildings environmental air space, you must use Ethernet cable suitable for operation in environmental air space in accordance with Section 300-22(C) of the National Electrical Code (NEC). Figure D-1 Mounting Bracket 1 2 3 4 2 8 3 7 6 4 5 3 6 8 5 6 1 Access point mount 2 Cable tie points 3 Ceiling mount holes 4 Access point mounts Locking detent 5 6 Wall cable access 7 8 Suspended ceiling cable access Security hasp Cisco Aironet 1200 Series Access Point Installation and Configuration Guide D-2 OL-3446-01 Appendix D Mounting Instructions Mounting on a Horizontal or Vertical Surface A mounting hardware kit is provided that contains the hardware and fasteners necessary to mount the access point. Refer to the Table D-1 to identify the materials you need to mount your access point, then go to the section containing the specific mounting procedure. Table D-1 Material Needed to Mount Access Point Mounting Method Horizontal or vertical surface Suspended ceiling Materials Required Four #8 x 1 in. (25.4 mm) screws Four wall anchors 3/16 in. (4.7 mm) or 3/32 in. (2.3 mm) drill bit Drill Standard screwdriver Two caddy fasteners with studs Two plastic spacers Two 1/420 Keps nuts with built-in washers Standard screwdriver Appropriate wrench or pliers In Kit Yes Yes No No No Yes Yes Yes No No Mounting on a Horizontal or Vertical Surface Follow these steps to mount the access point on a horizontal or vertical surface. Step 1 Step 2 Step 3 Step 4 Use the mounting bracket as a template to mark the locations of the four mounting holes. Drill one of the following sized holes at the locations you marked:

3/16 in. (4.7 mm) if you are using wall anchors 1/8 in. (6.3 mm) if you are not using wall anchors Install the anchors into the wall if you are using them. Otherwise, go to Step 4. Secure the mounting bracket to the surface using the #8 fasteners. Note On a vertical surface, mount the bracket with its security hasp facing down. Step 5 Attach the access point to the mounting bracket. Note You can make your installation more secure by mounting it to a stud or major structural member and using the appropriate fasteners. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide D-3 Mounting on a Suspended Ceiling Appendix D Mounting Instructions Mounting on a Suspended Ceiling Note To comply with NEC code, a #10-24 grounding lug is provided on the mounting bracket. You should review Figure D-2 before beginning the mounting process. Figure D-2 Mounting Bracket Parts 2 3 5 1 2 3 4 5 1 2 1 4 7 1 2 3 Suspended ceiling T-rail Caddy fastener Plastic spacer 4 Mounting bracket 5 Keps nut (contains an attached lock washer) Cisco Aironet 1200 Series Access Point Installation and Configuration Guide D-4 OL-3446-01 Appendix D Mounting Instructions Attaching the Access Point to the Mounting Bracket Follow these steps to mount your access point on a suspended ceiling:

Determine the location where you want to mount the access point. Attach two caddy fasteners to the suspended ceiling T-rail. Use the mounting bracket to adjust the distance between the caddy fasteners so that they align with the holes in the mounting bracket. Use a standard screwdriver to tighten the caddy fastener studs in place on the suspended ceiling T-rail. Do not overtighten. Install a plastic spacer on each caddy fastener stud. The spacers legs should contact the suspended ceiling T-rail. Attach the mounting bracket to the caddy fastener studs and start a Keps nut on each stud. Use a wrench or pliers to tighten the Keps nuts. Do not overtighten. Attach the access point to the mounting bracket. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Attaching the Access Point to the Mounting Bracket Follow these steps to attach the access point to the mounting bracket:

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Line up the three mounting pins on the access point with the large ends of the keyhole-shaped holes on the mounting bracket. Insert the access point into the keyhole shaped holes and maintain a slight pressure to hold it in place. Slide the access points mounting pins into the small ends of the keyhole-shaped holes on the mounting bracket and push the connector end of the access point. You will hear a click when the locking detent contacts the access point and locks it into place. Attach and adjust the antenna(s) or antenna cables. Connect the Ethernet cable to the access points Ethernet port. Insert the 1200 series power module cable connector into the access points 48 VDC power port (if you are using a local power source). Securing the Access Point to the Mounting Bracket The security hasp on the mounting bracket allows you to lock the access point to the bracket to make it more secure. When the access point is properly installed on the mounting bracket, the holes in the security hasps line up so you can install a padlock. Known compatible padlocks are Master Lock models 120T or 121T. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide D-5 Securing the Access Point to the Mounting Bracket Appendix D Mounting Instructions Cisco Aironet 1200 Series Access Point Installation and Configuration Guide D-6 OL-3446-01 A P P E N D I X E Protocol Filters The tables in this appendix list some of the protocols that you can filter on the access point. The tables include:

Table E-1, Ethertype Protocols Table E-2, IP Protocols Table E-3, IP Port Protocols In each table, the Protocol column lists the protocol name, the Additional Identifier column lists other names for the same protocol, and the ISO Designator column lists the numeric designator for each protocol. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide E-1 Appendix E Protocol Filters Table E-1 Ethertype Protocols Protocol ARP RARP IP Berkeley Trailer Negotiation LAN Test X.25 Level3 Banyan CDP DEC XNS DEC MOP Dump/Load DEC MOP DEC LAT Ethertalk Appletalk ARP IPX 802.2 IPX 802.3 Novell IPX (old) Novell IPX (new) EAPOL (old) EAPOL (new) Telxon TXP Aironet DDP Enet Config Test NetBUI Additional Identifier X.25 XNS MOP LAT Appletalk AARP IPX TXP DDP ISO Designator 0x0806 0x8035 0x0800 0x1000 0x0708 0x0805 0x0BAD 0x2000 0x6000 0x6001 0x6002 0x6004 0x809B 0x80F3 0x00E0 0x00FF 0x8137 0x8138 0x8180 0x888E 0x8729 0x872D 0x9000 0xF0F0 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide E-2 OL-3446-01 Appendix E Protocol Filters Table E-2 IP Protocols Protocol dummy Internet Control Message Protocol Internet Group Management Protocol Transmission Control Protocol Exterior Gateway Protocol PUP CHAOS User Datagram Protocol XNS-IDP ISO-TP4 ISO-CNLP Banyan VINES Encapsulation Header Spectralink Voice Protocol raw Additional Identifier ICMP IGMP TCP EGP UDP IDP TP4 CNLP VINES encap_hdr SVP Spectralink ISO Designator 0 1 2 6 8 12 16 17 22 29 80 83 98 119 255 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide E-3 Additional Identifier tcpmux qotd quote msp chargen ftp-data ftp ssh Table E-3 IP Port Protocols Protocol TCP port service multiplexer echo discard (9) systat (11) daytime (13) netstat (15) Quote of the Day Message Send Protocol ttytst source FTP Data FTP Control (21) Secure Shell (22) Telnet Simple Mail Transport Protocol SMTP time Resource Location Protocol IEN 116 Name Server whois Domain Name Server MTP BOOTP Server BOOTP Client TFTP gopher rje finger Hypertext Transport Protocol ttylink Kerberos v5 supdup hostname mail timserver RLP name nicname 43 DNS domain netrjs HTTP www link Kerberos krb5 hostnames Appendix E Protocol Filters ISO Designator 1 7 9 11 13 15 17 18 19 20 21 22 23 25 37 39 42 43 53 57 67 68 69 70 77 79 80 87 88 95 101 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide E-4 OL-3446-01 Appendix E Protocol Filters Table E-3 IP Port Protocols (continued) Protocol TSAP CSO Name Server Remote Telnet Postoffice v2 Postoffice v3 Sun RPC tap ident authentication sftp uucp-path Network News Transfer Protocol USENET News Transfer Protocol Additional Identifier iso-tsap cso-ns csnet-ns rtelnet POP2 POP v2 POP3 POP v3 sunrpc auth Network News readnews nntp Network News readnews nntp ntp netbios-ns netbios-dgm netbios-ssn Network Time Protocol NETBIOS Name Service NETBIOS Datagram Service NETBIOS Session Service Interim Mail Access Protocol v2 Interim Mail Access Protocol IMAP2 SNMP Simple Network Management Protocol SNMP Traps ISO CMIP Management Over IP CMIP Management snmp-trap ISO CMIP Agent Over IP X Display Manager Control Protocol NeXTStep Window Server Border Gateway Protocol Prospero Internet Relay Chap Over IP cmip-man CMOT cmip-agent xdmcp NeXTStep BGP IRC ISO Designator 102 105 107 109 110 111 113 115 117 119 119 123 137 138 139 143 161 162 163 164 177 178 179 191 194 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide E-5 Appendix E Protocol Filters Table E-3 IP Port Protocols (continued) Protocol SNMP Unix Multiplexer AppleTalk Routing AppleTalk name binding AppleTalk echo AppleTalk Zone Information NISO Z39.50 database IPX Interactive Mail Access Protocol v3 Unix Listserv syslog Unix spooler talk ntalk route timeserver newdate courier conference netnews netwall UUCP Daemon Kerberos rlogin Kerberos rsh rfs_server Kerberos kadmin network dictionary SUP server swat for SAMBA SUP debugging ingreslock Prospero non-priveleged RADIUS Concurrent Versions System Cisco IAPP Radio Free Ethernet Additional Identifier smux at-rtmp at-nbp at-echo at-zis z3950 imap3 ISO Designator 199 201 202 204 206 210 213 220 ulistserv spooler RIP timed tempo RPC chat wall UUCP uucpd klogin kshell remotefs kerberos-adm webster supfilesrv swat supfiledbg prospero-np CVS RFE 372 514 515 517 518 520 525 526 530 531 532 533 540 543 544 556 749 765 871 901 1127 1524 1525 1812 2401 2887 5002 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide E-6 OL-3446-01 A P P E N D I X F Supported MIBs This appendix lists the Simple Network Management Protocol (SNMP) Management Information Bases

(MIBs) that the access point supports for this software release. The Cisco IOS SNMP agent supports both SNMPv1 and SNMPv2. This appendix contains these sections:

MIB List, page F-1 Using FTP to Access the MIB Files, page F-2 MIB List IEEE802dot11-MIB Q-BRIDGE-MIB P-BRIDGE-MIB CISCO-DOT11-IF-MIB CISCO-WLAN-VLAN-MIB CISCO-IETF-DOT11-QOS-MIB CISCO-IETF-DOT11-QOS-EXT-MIB CISCO-DOT11-ASSOCIATION-MIB CISCO-L2-DEV-MONITORING-MIB CISCO-DDP-IAPP-MIB CISCO-IP-PROTOCOL-FILTER-MIB CISCO-SYSLOG-EVENT-EXT-MIB CISCO-TBRIDGE-DEV-IF-MIB BRIDGE-MIB CISCO-CDP-MIB CISCO-CONFIG-COPY-MIB CISCO-CONFIG-MAN-MIB CISCO-FLASH-MIB CISCO-IMAGE-MIB CISCO-MEMORY-POOL-MIB OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide F-1 Using FTP to Access the MIB Files Appendix F Supported MIBs CISCO-PROCESS-MIB CISCO-PRODUCTS-MIB CISCO-SMI-MIB CISCO-TC-MIB CISCO-SYSLOG-MIB ENTITY-MIB IF-MIB OLD-CISCO-CHASSIS-MIB OLD-CISCO-SYS-MIB OLD-CISCO-SYSTEM-MIB OLD-CISCO-TS-MIB RFC1213-MIB RFC1398-MIB SNMPv2-MIB SNMPv2-SMI SNMPv2-TC Using FTP to Access the MIB Files Follow these steps to obtain each MIB file by using FTP:

Step 1 Step 2 Step 3 Step 4 Step 5 Use FTP to access the server ftp.cisco.com. Log in with the username anonymous. Enter your e-mail username when prompted for the password. At the ftp> prompt, change directories to /pub/mibs/v1 or /pub/mibs/v2. Use the get MIB_filename command to obtain a copy of the MIB file. Note You can also access information about MIBs on the Cisco web site:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml Cisco Aironet 1200 Series Access Point Installation and Configuration Guide F-2 OL-3446-01 A P P E N D I X G Access Point Specifications This appendix provides technical specifications for the Cisco Aironet 1200 Series Access Point. Table G-1 lists the technical specifications for the access point. Table G-1 Access Point Specifications Category Size Status Indicators Connectors Input Voltage Input Current Access Point with 2.4-GHz Radio 6.56 in. W x 7.23 in. D x 1.66 in. H 16.67 cm W x 18.36 cm D x 4.22 cm H Access Point with 5-GHz Radio Module With the 5-GHz antenna in the patch position:

6.56 in. W x 8.04 in. D x 2.21 in. H 16.67 cm W x 20.42 cm D x 5.61 Three indicators on the top panel: Ethernet traffic, status, and radio traffic Back panel (left to right): reverse-TNC antenna connector; power connector (for plug-in AC power module); RJ-45 connector for 10BASE-T or 100BASE-T Ethernet connections; upside down RJ-45 connector for serial connections; reverse-TNC antenna connector. Front Panel: Card Bus connector used for the 5-GHz radio module. 48 VDC nominal. Operational up to 60 VDC. Voltage higher than 60 VDC can damage the unit. With 2.4 GHz radio:

125 mA (typical) With 5-GHz radio:

165 mA (typical) With 2.4-GHz and 5-GHz radios 225 mA (typical) The access point is capable of drawing 380 mA depending upon the current radios and future radios installed in the unit. Operating Temperature Access point:

4 to 131oF (20 to 55oC) Access point (with 2.4-GHz and 5-GHz radio):

4 to 122oF (20 to 50oC) Storage Temperature Weight 1200 series power injector:

32 to 104oF (0 to 40oC) 40 to 185oF (40 to 85oC) Without mounting bracket:

1200 series power injector:

32 to 104oF (0 to 40oC) 40 to 185oF (40 to 85oC) Without mounting bracket:

1.6 lbs (0.73 kg) with 2.4-GHz radio module 1.87 lbs (0.85 kg) with 5-Ghz radio module 1.97 lbs (0.89 kg) with 5-GHz radio module and 2.4-GHz radio OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide G-1 Appendix G Access Point Specifications Table G-1 Access Point Specifications (continued) Category Power Output Access Point with 2.4-GHz Radio 100, 50, 30, 20, 5, or 1 mW

(Depending on the regulatory domain in which the access point is installed) Access Point with 5-GHz Radio Module 40 mW (16 dBm) 20 mW (13 dBm) 10 mW (10 dBm) 5 mW (7 dBm) Frequency 2.400 to 2.497 GHz

(Depending on the regulatory domain in which the access point is installed) Range Indoor:

Note These values are based on the FCC peak measurement method as defined in FCC 15.407 (A)(4) UNII 15.15 to 5.25 GHz UNII 25.25 to 5.35 GHz

(Depending on the regulatory domain in which the access point is installed) Indoor:

150 ft at 11 Mbps 350 ft at 1 Mbps Outdoor:

800 ft at 11 Mbps 2000 ft at 1 Mbps 170 ft at 6 Mbps 130 ft at 18 Mbps 60 ft at 54 Mbps Outdoor:

1000 ft at 6 Mbps 100 ft at 54 Mbps Modulation Data rates Antenna Compliance Direct Sequence Spread Spectrum (DSSS) 1, 2, 5.5, and 11 Mbps A diversity system with two reverse-TNC connectors (Cisco antennas are sold separately). The 1200 series access point complies with UL 2043 for products installed in a buildings environmental air handling spaces, such as above suspended ceilings. Orthogonal Frequency Division Multiplex (OFDM) 6, 9, 12, 18, 24, 36, 48, and 54 Mbps A diversity system consisting of two integrated omnidirectional and two integrated directional antennas. Caution The 1200 series power injectors are not tested to UL 2043 and should not be placed in a buildings environmental air space, such as above suspended ceilings. Note If you plan to mount the access point in environmental air space using a 5-GHz radio, Cisco recommends that you mount the access point horizontally with its antennas pointing down. Doing so results in the access point complying with regulatory requirements for environmental air space with the 5-GHz radio installed. Safety Designed to meet:

UL 1950 Third Edition CSA 22.2 No. 950-95 Designed to meet:

UL 1950 Third Edition CSA 22.2 No. 950-95 IEC 60950 Second Edition, including Amendments 1-4 with all deviations IEC 60950 Second Edition, including Amendments 1-4 with all deviations EN 60950 Second Edition, including EN 60950 Second Edition, including Amendments 1-4 Amendments 1-4 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide G-2 OL-3446-01 Appendix G Access Point Specifications Table G-1 Access Point Specifications (continued) Category Radio Approvals Access Point with 2.4-GHz Radio FCC Part 15.247 Canada RSS-210 Japan Telec 33B EN 300.328 Access Point with 5-GHz Radio Module FCC Part 15.407 Canada RSS-210 Japan ARIB STD-T71 EN 301.893 EMI and Susceptibility FCC Part 15.107 and 15.109 Class B ICES-003 Class B (Canada) EN 55022 B AS/NZS 3548 Class B VCCI Class B EN 55024 EN 301.489-1 EN 301.489-17 OET-65C RSS-102 ANSI C95.1 RF Exposure OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide G-3 Appendix G Access Point Specifications Cisco Aironet 1200 Series Access Point Installation and Configuration Guide G-4 OL-3446-01 A P P E N D I X H Error and Event Messages This appendix lists the CLI error and event messages. Table H-1 lists the errors and events and provides an explanation and recommended action for each message. Explanation Recommended Action Table H-1 Error and Event Messages Message Software Auto Upgrade Messages SW_AUTO_UPGRADE-FATAL:

Attempt to upgrade software failed, software on Flash may be deleted. Please copy software into Flash. SW_AUTO_UPGRADE-7-FAILURE:

dhcp_client_start_stop failed SW_AUTO_UPGRADE-7-FAILURE:

Failed to obtain ip addr from dhcp server Auto upgrade of the software failed. The software on the Flash memory might have been deleted. Copy software into the Flash memory. Auto upgrade of the software failed due to error in starting/stopping DHCP client process. Auto upgrade of the software failed. SW_AUTO_UPGRADE-7-FAILURE:

boot_file_pathent creation failed Auto upgrade of the software failed due to error in creation of pathent (internal data structure). Association Management Messages DOT11-3-BADSTATE: [mac-address]

[chars] [chars] -> [chars]

DOT11-6-ASSOC: Interface [interface], Station [char] [mac] Associated DOT11-6-ADD: Interface [interface], Station [mac] Associated to Parent

[mac]

802.11 Association and management uses a table-driven state machine to keep track and transition an Association through various states. A state transition occurs when an Association receives one of many possible events. When this error occurs, it means that an Association received an event that it did not expect while in this state. A station associated to an access point. A station associated to an access point. None. Copy software before rebooting the unit. Copy the error message exactly as it appears and report it to your technical support representative. Copy the error message exactly as it appears and report it to your technical support representative. Copy the error message exactly as it appears and report it to your technical support representative. The system can continue but may lose the Association that generates this error. Copy the message exactly as it appears and report it to your technical service representative. None. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide H-1 Table H-1 Error and Event Messages (continued) Appendix H Error and Event Messages Explanation A station disassociated from an access point. Recommended Action None. A station has roamed to a new access point. None. Message DOT11-6-DISASSOC: Interface

[interface], Deauthenticating Station

[mac] [char]

DOT11-6-ROAMED: Station

[mac-address] Roamed to [mac-address]

Proxy Mobile IP Subsystem Messages PMIP-3-REG_FAIL: Mobile Node 10.4.1.3 mobile ip registration failed PMIP-3-REG_AUTH_FAIL: Mobile Node 10.4.1.3 registration failed due to authentication failure PMIP-3-REG_FA_FAIL: Mobile Node 10.4.1.3 registration failed due to Foreign Agent denial PMIP-3-REG_HA_FAIL: Mobile Node 10.4.1.3 registration failed due to Home Agent denial PMIP-3-AUTH_UNAVAIL:

Authentication for 10.4.1.3 unavailable PMIP-3-HAFA_UNAVAIL: No response from the Mobile IP Agent to our registration requests When a mobile node (MN) moves to a foreign network, the access point registers the MN to its Home Agent. This message indicates that the registration failed. When a mobile node (MN) moves to a foreign network, the access point registers the MN to its Home Agent. This message indicates that the registration failed because the HA or FA failed to authenticate each other or the MN. When a Mobile node (MN) moves to a foreign network, the access point registers the MN to its Home Agent. This message indicates that the registration was denied by the Foreign Agent. When a Mobile node (MN) moves to a foreign network, the access point registers the MN to its Home Agent. This message indicates that the registration was denied by the Home Agent. Proxy Mobile IP failed to obtain the Mobile Node's authentication information either locally or from a AAA server. Proxy Mobile IP failed to access the Home or Foreign Agent while trying to register the Mobile Node. PMIP-6-HAFA_DOWN: Mobile IP Agent 10.4.1.1 is down or unavailable Mobile IP Home or Foreign agent has gone down or is inaccessible to the access point. PMIP-3-AAP_UNAVAIL: Authoritative Access Point is unavailable The authoritative access point cannot be reached to obtains subnet map table. PMIP-6-START: Proxy Mobile IP services has started Proxy Mobile IP service has started. Check for correct configuration of Mobile IP agents and the access point. Make sure the correct authentication information is configured on the Home Agent, the Foreign Agent, and the access point. Make sure the correct authentication information is configured on the Home Agent, the Foreign Agent, and the access point. Make sure the correct authentication information is configured on the Home Agent, the Foreign Agent, and the access point. Make sure the correct Mobile Node information is configured locally or on the AAA server. Make sure the HA or FA is not down or is network inaccessible. Also check that the subnet map information regarding the Home Agent is correct. Make sure there is at least one Home and Foreign Agent configured on that subnet and is accessible to the access point. Make sure all the access points have the same information regarding Authoritative and regular access points. None. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide H-2 OL-3446-01 Appendix H Error and Event Messages Table H-1 Error and Event Messages (continued) Message PMIP-6-STOP: Proxy Mobile IP services have stopped PMIP-6-REPEATER_STOP: AP is now operating as a repeater, disabling Proxy Mobile IP services Unzip Messages SOAP-4-UNZIP_OVERFLOW: Failed to unzip Flash:/c1200-k9w7-mx.122-3.6.JA1/ht ml/level15/ap_xxx.htm.gz, exceeds maximum uncompressed html size 802.11 Subsystem Messages DOT11-6-FREQ_INUSE: Radio frequency [int] is in use DOT11-6-FREQ_USED: Radio frequency [int] selected DOT11-4-VERSION_MISMATCH:

Require radio version [hex].[int], found version [hex].[int]

DOT11-2-VERSION_INVALID:

Unable to find required radio version

[hex].[int]

DOT11-4-NO_SSID: No SSIDs configured, radio not started DOT11-4-FLASHING_RADIO:

Flashing the radio firmware ([chars]) DOT11-2-NO_FIRMWARE: No radio firmware file ([chars]) was found DOT11-2-BAD_FIRMWARE: Radio firmware file ([chars]) is invalid DOT11-4-FLASH_RADIO_DONE:

Flashing the radio firmware completed DOT11-4-LINK_DOWN: Radio parent lost: [chars]

Explanation Proxy Mobile IP service has stopped. Recommended Action None. Proxy Mobile IP does not run on repeaters or workgroup bridges, and it is disabled automatically when the access point is in repeater mode. None. The HTTP server cannot retrieve a compressed file in response to an HTTP GET request because the size of the file is too large for the buffers used in the uncompression process. Make sure file is a valid HTML page. If so, you'll have to copy an uncompressed version of the file into Flash to retrieve it through HTTP. When scanning for an unused frequency, the unit recognized another radio using the displayed frequency. After scanning for an unused frequency, the unit selected the displayed frequency. When starting the radio, the wrong firmware version was found. The radio will be loaded with the required version. When trying to re-flash the radio firmware, the access point recognized that the radio firmware packaged with the IOS firmware had the incorrect version. All SSIDs were deleted from the configuration. At least one must be configured for the radio to run. The radio has been stopped to load new firmware. When trying to Flash new firmware into the radio, the file for the radio was not found in the Flash file system. When trying to Flash new firmware into the radio, the file was found to be invalid. The radio firmware Flash is complete, and the radio will be restarted with the new firmware. The connection to the parent access point was lost for the displayed reason. The unit will try to find a new parent access point. None. None. None. None. Configure at least one SSID on the access point. None. The wrong image has been loaded into the unit. Locate the correct image based on the type of radio used. Put the correct firmware image file in the place where the unit is looking. None. None. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide H-3 Appendix H Error and Event Messages Table H-1 Error and Event Messages (continued) Message DOT11-4-CANT_ASSOC: Cannot associate: [chars]

Explanation The unit could not establish a connection to a parent access point for the displayed reason. Recommended Action Check the configuration of both the parent access point and this unit to make sure the basic settings (SSID, WEP, and others) match. Inter-Access Point Protocol Messages DOT11-6-ROAMED: Station

[mac-address] Roamed to [mac-address]

DOT11-6-STANDBY_ACTIVE:

Standby to Active, Reason = [chars]

([int]) DOT11-6-ROGUE_AP: Rogue AP

[mac-address] reported. Reason: [chars]

SCHED-3-UNEXPECTEDMESSAGE:

Unknown message [hex] received (ptr arg [hex], num arg [hex]). SCHED-3-UNEXPECTEDEVENT:

Process received unknown event (maj

[hex], min [hex]). A station has roamed to a new access point. The access point is transitioning from standby mode to active mode. A station has reported a potential rogue access point for the stated reason. A process can register to be notified when various events occur in the router. This message indicates that a process received a message from another process that it does not know how to handle. A process can register to be notified when various events occur in the router. This message indicates that a process received an event that it did not know how to handle. None. None. None. Copy the error message exactly as it appears, and report it to your technical support representative. Copy the error message exactly as it appears, and report it to your technical support representative. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide H-4 OL-3446-01 A P P E N D I X I Console Cable Pinouts This appendix identifies the pinouts for the serial console cable that connects to the access points serial console port. The appendix contains the following sections:

Overview, page I-2 Console Port Signals and Pinouts, page I-2 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide I-1 Overview Overview Appendix I Console Cable Pinouts The access point requires a special serial cable that connects the access point serial console port (RJ-45 connector) to your PCs COM port (DB-9 connector). This cable can be purchased from Cisco (part number AIR-CONCAB1200) or can be built using the pinouts in this appendix. Console Port Signals and Pinouts Use the console RJ-45 to DB-9 serial cable to connect the access points console port to the COM port of your PC running a terminal emulation program. Note Both the Ethernet and console ports use RJ-45 connectors. Be careful to avoid accidently connecting the serial cable to the Ethernet port connector. Table I-1 lists the signals and pinouts for the console RJ-45 to DB-9 serial cable. Table I-1 Signals and Pinouts for a Console RJ-45 to DB-9 Serial Cable Console Port RJ-45 Pins 1 2 3 4 5 6 7 8 Signals1 NC NC TXD GND GND RXD NC NC PC COM Port DB-9 Pins Signals

2 5 5 3

RXD GND GND TXD

1. NC indicates not connected. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide I-2 OL-3446-01 G L O S S A R Y 802.11 802.11a 802.11b A Access Point The IEEE standard that specifies carrier sense media access control and physical layer specifications for 1- and 2-megabit-per-second (Mbps) wireless LANs operating in the 2.4-GHz band. The IEEE standard that specifies carrier sense media access control and physical layer specifications for wireless LANs operating in the 5-GHz frequency band. The IEEE standard that specifies carrier sense media access control and physical layer specifications for 5.5- and 11-Mbps wireless LANs operating in the 2.4-GHz frequency band. A wireless LAN data transceiver that uses radio waves to connect a wired network with wireless stations. Ad Hoc Network A wireless network composed of stations without Access Points. Antenna Gain The gain of an antenna is a measure of the antennas ability to direct or focus radio energy over a region of space. High gain antennas have a more focused radiation pattern in a specific direction. Associated A station is configured properly to allow it to wirelessly communicate with an Access Point. B Beacon BOOTP BPSK A wireless LAN packet that signals the availability and presence of the wireless device. Beacon packets are sent by access points and base stations; however, client radio cards send beacons when operating in computer to computer (Ad Hoc) mode. Boot Protocol. A protocol used for the static assignment of IP addresses to devices on the network. A modulation technique used by IEEE 802.11b-compliant wireless LANs for transmission at 1 Mbps. Broadcast Packet A single data message (packet) sent to all addresses on the same subnet. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide GL-1 Glossary C CCK Cell Client CSMA D Data Rates dBi DHCP Complementary code keying. A modulation technique used by IEEE 802.11b-compliant wireless LANs for transmission at 5.5 and 11 Mbps. The area of radio range or coverage in which the wireless devices can communicate with the base station. The size of the cell depends upon the speed of the transmission, the type of antenna used, and the physical environment, as well as other factors. A radio device that uses the services of an Access Point to communicate wirelessly with other devices on a local area network. Carrier sense multiple access. A wireless LAN media access method specified by the IEEE 802.11 specification. The range of data transmission rates supported by a device. Data rates are measured in megabits per second (Mbps). A ratio of decibels to an isotropic antenna that is commonly used to measure antenna gain. The greater the dBi value, the higher the gain, and the more acute the angle of coverage. Dynamic host configuration protocol. A protocol available with many operating systems that automatically issues IP addresses within a specified range to devices on the network. The device retains the assigned address for a specific administrator-defined period. Dipole A type of low-gain (2.2-dBi) antenna consisting of two (often internal) elements. Domain Name DNS DSSS The text name that refers to a grouping of networks or network resources based on organization-type or geography; for example: name.comcommercial;

name.edueducational; name.govgovernment; ISPname.netnetwork provider (such as an ISP); name.arArgentina; name.auAustralia; and so on. Domain Name System server. A server that translates text names into IP addresses. The server maintains a database of host alphanumeric names and their corresponding IP addresses. Direct sequence spread spectrum. A type of spread spectrum radio transmission that spreads its signal continuously over a wide frequency band. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide GL-2 OL-3446-01 Glossary E EAP Ethernet F File Server Extensible Authentication Protocol. An optional IEEE 802.1x security feature ideal for organizations with a large user base and access to an EAP-enabled Remote Authentication Dial-In User Service (RADIUS) server. The most widely used wired local area network. Ethernet uses carrier sense multiple access (CSMA) to allow computers to share a network and operates at 10, 100, or 1000 Mbps, depending on the physical layer used. A repository for files so that a local area network can share files, mail, and programs. Firmware Software that is programmed on a memory chip. G Gateway A device that connects two otherwise incompatible networks together. GHz I IEEE Gigahertz. One billion cycles per second. A unit of measure for frequency. Institute of Electrical and Electronic Engineers. A professional society serving electrical engineers through its publications, conferences, and standards development activities. The body responsible for the Ethernet 802.3 and wireless LAN 802.11 specifications. Infrastructure The wired Ethernet network. IP Address The Internet Protocol (IP) address of a station. IP Subnet Mask The number used to identify the IP subnetwork, indicating whether the IP address can be recognized on the LAN or if it must be reached through a gateway. This number is expressed in a form similar to an IP address; for example: 255.255.255.0. Isotropic An antenna that radiates its signal 360 degrees both vertically and horizontally in a perfect sphere. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide GL-3 Glossary M MAC Media Access Control address. A unique 48-bit number used in Ethernet data packets to identify an Ethernet device, such as an access point or your client adapter. Modulation Any of several techniques for combining user information with a transmitters carrier signal. Multipath The echoes created as a radio signal bounces off of physical objects. Multicast Packet A single data message (packet) sent to multiple addresses. O Omni-directional This typically refers to a primarily circular antenna radiation pattern. Orthogonal Frequency Division Multiplex (OFDM) A modulation technique used by IEEE 802.11a-compliant wireless LANs for transmission at 6, 9, 12, 18, 24, 36, 48, and 54 Mbps. P Packet Q A basic message unit for communication across a network. A packet usually includes routing information, data, and sometimes error detection information. Quadruple Phase Shift Keying A modulation technique used by IEEE 802.11b-compliant wireless LANs for transmission at 2 Mbps. R Range A linear measure of the distance that a transmitter can send a signal. Receiver Sensitivity A measurement of the weakest signal a receiver can receive and still correctly translate it into data. RF Radio frequency. A generic term for radio-based technology. Cisco Aironet 1200 Series Access Point Installation and Configuration Guide GL-4 OL-3446-01 Glossary Roaming RP-TNC A feature of some Access Points that allows users to move through a facility while maintaining an unbroken connection to the LAN. A connector type unique to Cisco Aironet radios and antennas. Part 15.203 of the FCC rules covering spread spectrum devices limits the types of antennas that may be used with transmission equipment. In compliance with this rule, Cisco Aironet, like all other wireless LAN providers, equips its radios and antennas with a unique connector to prevent attachment of non-approved antennas to radios. S Spread Spectrum SSID T A radio transmission technology that spreads the user information over a much wider bandwidth than otherwise required in order to gain benefits such as improved interference tolerance and unlicensed operation. Service Set Identifier (also referred to as Radio Network Name). A unique identifier used to identify a radio network and which stations must use to be able to communicate with each other or to an access point. The SSID can be any alphanumeric entry up to a maximum of 32 characters. Transmit Power The power level of radio transmission. U UNII UNII-1 UNII-2 UNII-3 Unlicensed National Information Infrastructureregulations for UNII devices operating in the 5.15 to 5.35 GHz and 5.725 to 5.825 GHz frequency bands. Regulations for UNII devices operating in the 5.15 to 5.25 GHz frequency band. Regulations for UNII devices operating in the 5.25 to 5.35 GHz frequency band. Regulations for UNII devices operating in the 5.725 to 5.825 GHz frequency band. Unicast Packet A single data message (packet) sent to a specific IP address. W WEP Wired Equivalent Privacy. An optional security mechanism defined within the 802.11 standard designed to make the link integrity of wireless devices equal to that of a cable. Workstation A computing device with an installed client adapter. OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide GL-5 Glossary Cisco Aironet 1200 Series Access Point Installation and Configuration Guide GL-6 OL-3446-01 A abbreviating commands access point 5-3 security settings access point image accounting 10-9 21-6 with RADIUS 11-12 with TACACS+ 11-16, 11-21 antenna connectors G-2 gains warnings A-1 C-5 4-4 Apply button attributes, RADIUS vendor-proprietary vendor-specific 11-14 11-13 authentication local mode with AAA 6-15 NTP associations RADIUS 6-20 key login 11-5 6-8, 11-7 TACACS+

11-16 defined key login 11-18 6-13, 11-19 authentication server EAP 10-4, 11-3 authentication types Network-EAP 10-3 open shared key 10-2 10-3 I N D E X authoritative time source, described authorization 6-18 with RADIUS 6-11, 11-11 with TACACS+ 6-14, 11-16, 11-20 B Back button banners 4-4 configuring 6-36 login message-of-the-day login 6-35 default configuration 6-34 when displayed basic settings checking 21-4 broadcast key rotation 9-1 C Cancel button CDP 4-4 disabling for routing device enabling and disabling 16-4 on an interface 16-4 monitoring 6-35 16-4 channels, supported by regulatory domains Cisco TAC 21-1 CiscoWorks 2000 CLI 17-4 C-2, C-3 abbreviating commands command modes editing features 5-2 5-3 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide IN-1 Index 5-7 enabling and disabling 5-6 keystroke editing wrapped lines error messages filtering command output getting help history 5-4 5-3 5-4 changing the buffer size described disabling recalling commands 5-5 5-5 5-6 5-8 5-4 uploading 19-10, 19-13, 19-16 preparing 19-8 reasons for using FTP 19-14 using RCP 19-17 using TFTP 19-11 6-16 connections, secure remote connectors G-1, G-2 console port crypto software image I-2 6-16 no and default forms of commands terminal emulator settings client power level, limiting clock 3-4 7-6 5-3 See system clock command-line interface See CLI command modes commands 5-2 D data rates G-2 daylight saving time declarations of conformity B-1 default 6-30 configuration, resetting 21-5 default commands default configuration 5-3 5-3 abbreviating no and default setting privilege levels 5-3 6-6 community strings 17-5 configuring overview 17-3 configuration files 19-10 19-18 creating using a text editor deleting a stored configuration downloading preparing 19-8 reasons for using FTP 19-13 using RCP 19-16 using TFTP 19-11 19-10, 19-13, 19-16 19-9 guidelines for creating and using invalid combinations when copying system contact and location information types and location 19-9 19-5 6-35 banners DNS 6-33 NTP 6-20 password and privilege level RADIUS 6-8, 11-4 SNMP 17-5 system message logging system name and prompt TACACS+ 6-13, 11-18 20-3 6-32 6-2 directories changing creating and removing displaying the working 19-4 19-4 19-4 DNS 6-33 default configuration displaying the configuration overview 6-33 6-33 setting up 6-34 domain names 17-9 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide IN-2 OL-3446-01 DNS 6-33 Domain Name System See DNS downloading configuration files 19-10, 19-13, 19-16 preparing 19-8 reasons for using FTP 19-13 using RCP 19-16 using TFTP 19-11 image files 19-22 19-20, 19-23, 19-27 deleting old image preparing 19-18 reasons for using FTP 19-24 using RCP 19-29 using TFTP 19-21 E EAP authentication overview 10-3 EAP-MD5 authentication setting on client and access point 10-10 EAP-SIM authentication setting on client and access point 10-11 EAP-TLS authentication Index 20-5 setting the display destination device severity levels system message format 21-2 20-2 20-7 Ethernet indicator extended temperature range 2-3 F 7-3 fallback role FCC Declaration of Conformity B-2 FCC Safety Compliance files 2-2 19-5 19-5 copying deleting displaying the contents of tar 19-6 creating displaying the contents of extracting image file format 19-19 19-7 19-8 19-6 file system 19-2 displaying available file systems 19-3 displaying file information local file system names network file system names setting the default 19-3 19-5 19-2 filtering setting on client and access point 10-10 show and more command output 5-8 editing features enabling and disabling keystrokes used wrapped lines 5-6 5-7 5-6 EIRP, maximum C-4 to C-5 6-4 enable password enable secret password encrypted software image encryption for passwords error messages 6-4 6-16 6-4 during command entry 5-4 OL-3446-01 19-2 Flash device, number of C-2, C-3 frequencies frequency range G-2 FTP accessing MIB files configuration files F-2 19-13 downloading overview 19-12 preparing the server uploading image files 19-14 19-13 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide IN-3 Index deleting old image 19-24 downloading preparing the server uploading 19-26 19-26 19-23 G 17-3 17-3, 17-4 get-bulk-request operation get-next-request operation get-request operation get-response operation global configuration mode 17-3, 17-4 17-3 5-2 5-3 5-4 H help, for the command line history changing the buffer size described disabling recalling commands 5-4 5-5 5-5 history table, level and number of syslog messages Home button 4-4 20-8 I L LEAP authentication setting on client and access point 10-9 LED indicators 21-2 Ethernet radio traffic 21-2 status 21-2 limiting client power level login authentication 7-6 with RADIUS 6-8, 11-7 with TACACS+ 6-13, 11-19 login banners log messages 6-34 See system message logging M MAC 3-10, 3-11 management options CLI 5-1 Message Integrity Check messages 9-1 to users through banners 6-34 MIBs accessing files with FTP F-2 location of files overview 17-2 SNMP interaction with 17-4 F-2 21-2 13-10 IGMP snooping helper indicators input power G-1 installation guidelines interface configuration mode IP address, finding and setting IPSU 3-8 ISO designators for protocols 2-3 K key features 1-2 5-2 3-9 E-1 MIC 9-1 Mode button modulation G-2 monitoring 21-6 CDP 16-4 N Network-EAP 10-3 Network Time Protocol Cisco Aironet 1200 Series Access Point Installation and Configuration Guide IN-4 OL-3446-01 See NTP no commands NTP associations 5-3 6-20 authenticating 6-18 defined enabling broadcast messages peer server 6-22 6-22 6-23 6-20 default configuration displaying the configuration overview 6-18 restricting access 6-27 creating an access group disabling NTP services per interface 6-25 6-26 6-26 source IP address, configuring stratum 6-18 synchronizing devices time 6-22 6-18 services synchronizing 6-18 O OK button operating temperature G-1 4-4 P package contents password reset passwords 2-3 21-5 default configuration encrypting overview 6-2 setting 6-4 6-3 enable enable secret 6-4 6-2 Index with usernames PEAP authentication 6-5 setting on client and access point 10-10 I-2 pinouts, serial cable ports, protected power 7-14 2-5 2-6 connecting injector input G-1 output G-2 power level maximum C-4 to C-5 7-6 on client devices preferential treatment of traffic See QoS 6-2 5-2 preventing unauthorized access privileged EXEC mode privilege levels 6-7 exiting 6-7 logging into overview 6-2, 6-6 setting a command with 6-6 Public Secure Packet Forwarding 7-13 Q QoS configuration guidelines overview 13-2 quality of service 13-4 See QoS R radio indicator 21-2 RADIUS attributes OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide IN-5 Index vendor-proprietary vendor-specific 11-13 11-14 configuring 11-12 6-8, 11-4 6-8, 11-7 6-11, 11-11 accounting authentication authorization communication, global communication, per-server 11-5 multiple UDP ports default configuration defining AAA server groups displaying the configuration 11-4 identifying the server limiting the services to the user method list, defined operation of overview 11-2 suggested network environments tracking services accessed by user 11-4 11-3 11-5, 11-13 11-4, 11-5 6-9, 11-9 6-12, 11-15 6-11, 11-11 range G-2 rate limit, logging RCP 20-9 configuration files 19-16 downloading overview 19-15 preparing the server uploading image files 19-17 deleting old image downloading preparing the server uploading 19-31 19-29 19-16 19-31 19-27 regulatory B-1 domains C-2, C-3 reloading access point image Remote Authentication Dial-In User Service 21-6 See RADIUS Remote Copy Protocol See RCP repeater chain of access points 18-2 restricting access 6-24 NTP services overview 6-2 passwords and privilege levels RADIUS 6-7, 11-1 TACACS+ 6-12 6-2 RFC 17-2 1157, SNMPv1 1305, NTP 6-18 1901, SNMPv2C 17-2 1902 to 1907, SNMPv2 17-2 RF exposure B-6 roaming rotation, broadcast key 1-5 9-1 11-2 11-12 S safety warnings, translated A-1 6-16 secure remote connections Secure Shell See SSH security features synchronizing 10-9 sequence numbers in log messages serial 20-6 I-2 cable Cisco cable I-2 17-4 set-request operation severity levels, defining in system messages shared key show cdp traffic command Simple Network Management Protocol 10-5 16-5 20-7 See SNMP size G-1 SNMP accessing MIB variables with agent 17-4 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide IN-6 OL-3446-01 17-3 described disabling 17-5 community strings configuring overview 17-3 17-5 17-9 17-5 configuration examples default configuration limiting system log messages to NMS 20-8 manager functions MIBs 17-3 location of F-2 overview 17-2, 17-4 snmp-server view 17-9 17-10 status, displaying system contact and location trap manager, configuring traps 17-9 17-8 17-3 17-7 described enabling overview 17-2, 17-4 types of 17-7 versions supported 17-2 snooping helper, IGMP 13-10 software images 19-19 location in Flash tar file format, described 19-19 SSH 5-9 6-17 configuring crypto software image described displaying settings SSH Communications Security, Ltd. 6-16 6-16 6-17 5-9 SSID multiple SSIDs troubleshooting 8-1 21-4 static WEP with open authentication, setting on client and access point 10-9 Index with shared key authentication, setting on client and access point 10-9 statistics 17-10 CDP 16-4 SNMP input and output 21-2, G-1 status indicators storage temperature G-1 stratum, NTP 6-18 6-30 summer time switchport protected command syslog See system message logging 7-14 system clock configuring 6-30 6-28 daylight saving time manually summer time time zones 6-30 6-29 displaying the time and date overview 6-17 See also NTP 6-28 20-7 20-3 20-4 20-4 20-12 20-11 system message logging default configuration defining error message severity levels disabling displaying the configuration enabling facility keywords, described level keywords, described limiting messages message format overview 20-2 20-9 rate limit sequence numbers, enabling and disabling 20-5 setting the display destination device timestamps, enabling and disabling UNIX syslog servers 20-8 20-2 20-8 20-6 configuring the daemon configuring the logging facility 20-10 20-10 20-6 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide IN-7 Index facilities supported 20-11 system name default configuration manual configuration See also DNS system prompt default setting 6-32 6-32 6-32 T TAC 21-1 TACACS+

accounting, defined authentication, defined authorization, defined configuring 11-16 11-16 11-16 terminal emulator TFTP 3-4 configuration files 19-11 19-11 downloading preparing the server uploading image files deleting downloading preparing the server uploading 19-22 19-21 19-22 19-10 19-20 TFTP server time 21-6 See NTP and system clock timestamps in log messages time zones TKIP 9-1 traps 6-29 20-6 17-7 17-3 17-7 configuring managers defined enabling notification types overview 17-2, 17-4 21-1 troubleshooting 17-7 11-21 11-18 6-14, 11-20 6-13, 11-19 6-13, 11-18 accounting authentication key authorization login authentication default configuration displaying the configuration 11-18 identifying the server limiting the services to the user operation of overview 11-16 tracking services accessed by user 11-17 6-15, 11-22 6-14, 11-20 tar files 19-6 creating displaying the contents of extracting image file format 19-19 19-7 3-12 Telnet temperature operating G-1 storage G-1 Temporal Key Integrity Protocol Terminal Access Controller Access Control System Plus 9-1 with CiscoWorks with system message logging 17-4 20-2 11-21 U 19-6 UNIX syslog servers daemon configuration facilities supported message logging configuration 20-11 20-10 20-10 unpacking upgrading software images 2-3 See downloading uploading configuration files See TACACS+

preparing 19-10, 19-13, 19-16 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide IN-8 OL-3446-01 Index 19-8 reasons for using FTP 19-14 using RCP 19-17 using TFTP 19-11 19-20, 19-23, 19-27 image files preparing 19-18 reasons for using FTP 19-26 using RCP 19-31 using TFTP 19-22 5-2 user EXEC mode username-based authentication 6-5 V voltage range G-1 W 2-2, A-1 warnings Web-based interface 4-4 common buttons compatible browsers 4-1 web site Cisco Software Center 3-9, 21-8 weight G-1 WEP 9-1 with EAP 10-3 WEP key 21-4 OL-3446-01 Cisco Aironet 1200 Series Access Point Installation and Configuration Guide IN-9 Index Cisco Aironet 1200 Series Access Point Installation and Configuration Guide IN-10 OL-3446-01

 

 

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Regulatory, Safety, and Product Information This document contains the following sections:

Declarations of Conformity and Regulatory Information, page 2

Channels and Maximum Power Levels, page 4

Translated Safety Warnings, page 6

Related Documentation, page 10

Obtaining Documentation, page 10

Documentation Feedback, page 11

Obtaining Technical Assistance, page 11

Obtaining Additional Publications and Information, page 12 Corporate Headquarters:

Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA Copyright 2004 Cisco Systems, Inc. All rights reserved. Declarations of Conformity and Regulatory Information

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Declarations of Conformity and Regulatory Information This section provides declarations of conformity and regulatory information for the Cisco Aironet 1200 Series Access Points and contains the following topics:

Manufacturers Federal Communication Commission Declaration of Conformity Statement, page 2

Department of CommunicationsCanada, page 3

Declaration of Conformity for RF Exposure, page 4 Manufacturers Federal Communication Commission Declaration of Conformity Statement Tested To Comply With FCC Standards FOR HOME OR OFFICE USE Models:

AIR-AP12THD-A-K9 or AIR-AP12THD-N-K9 FCC Certification number:

LDK102049 (AIR-MP21G-A-K9) and LDK102053 (AIR-RM21A-A-K9-THD) Manufacturer:

Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA This device complies with Part 15 rules. Operation is subject to the following two conditions:

1. This device may not cause harmful interference, and 2. This device must accept any interference received, including interference that may cause undesired operation. This equipment has been tested and found to comply with the limits of a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a residential environment. This equipment generates, uses, and radiates radio frequency energy, and if not installed and used in accordance with the instructions, may cause harmful interference. However, there is no guarantee that interference will not occur. If this equipment does cause interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to correct the interference by one of the following measures:

Reorient or relocate the receiving antenna.

Increase separation between the equipment and receiver.

Connect the equipment to an outlet on a circuit different from which the receiver is connected.

Consult the dealer or an experienced radio/TV technician. Regulatory, Safety, and Product Information 2 78-xxxxx-xx

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Declarations of Conformity and Regulatory Information Caution The Part 15 radio device operates on a non-interference basis with other devices operating at this frequency when using integrated antennas or those listed in Table 1. Any changes or modification to the product not expressly approved by Cisco could void the users authority to operate this device. Caution Within the 5.15 to 5.25 GHz band (5 GHz radio channels 36 to 48) the U-NII devices are restricted to indoor operations to reduce any potential for harmful interference to co-channel Mobile Satellite System

(MSS) operations. Table 1 Access Point 2.4-GHz Antennas Radio IEEE 802.11g Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Cisco Part Number AIR-ANT2410Y-R AIR-ANT3549 AIR-ANT2012 AIR-ANT1729 AIR-ANT2506 AIR-ANT3213 AIR-ANT1728 AIR-ANT3195 AIR-ANT5959 AIR-ANT4941 Antenna Model Yagi-directional Patch Spatial diversity Patch Omni-directional Omni-directional Omni-directional Patch Omni-directional Dipole Gain (dBi) 10.0 8.5 6.5 6.0 5.1 5.0 5.0 3.0 2.0 2.2 Department of CommunicationsCanada Canadian Compliance Statement This Class B Digital apparatus meets all the requirements of the Canadian Interference-Causing Equipment Regulations. Cet appareil numerique de la classe B respecte les exigences du Reglement sur le material broilleur du Canada. This device complies with Class B Limits of Industry Canada. Operation is subject to the following two conditions:

1. This device may not cause harmful interference, and 2. This device must accept any interference received, including interference that may cause undesired operation. Cisco Aironet 2.4-GHz Access Points are certified to the requirements of RSS-210 for 2.4-GHz spread spectrum devices, and Cisco Aironet 54-Mbps, 5-GHz Access Points are certified to the requirements of RSS-210 for 5-GHz spread spectrum devices.The use of this device in a system operating either partially or completely outdoors may require the user to obtain a license for the system according to the Canadian regulations. For further information, contact your local Industry Canada office. 78-xxxxx-xx Regulatory, Safety, and Product Information 3 Channels and Maximum Power Levels

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Declaration of Conformity for RF Exposure The radio module has been found to be compliant to the requirements set forth in CFR 47 Sections 2.1091, and 15.247 (b) (4) addressing RF Exposure from radio frequency devices as defined in Evaluating Compliance with FCC Guidelines for Human Exposure to Radio Frequency Electromagnetic Fields. For all approved antennas, the equipment shoud be installed more than 20 cm (7.9 in.) from your body or nearby persons. The access point (with 5 GHz integrated antenna) must be installed to maintain a minimum 20 cm

(7.9 in.) co-located separation distance from other FCC approved indoor/outdoor antennas used with the access point. Any antennas or transmitters not approved by the FCC cannot be co-located with the access point antennas. Note Dual antennas used for diversity operation are not considered co-located. Channels and Maximum Power Levels This section lists the IEEE 802.11g (2.4-GHz) and IEEE 802.11a (5-GHz) channels and maximum power levels for the access point in the Americas (-A) regulatory domain. IEEE 802.11g (2.4-GHz Band) Table 2 lists the IEEE 802.11g channel identifiers, channel center frequencies, and the maximum power levels allowed when using a 2.2 dBi antenna in the Americas (-A) regulatory domain. Table 2 IEEE 802.11g Channels and Maximum Power Levels for a .2.2 dBi Antenna Channel Identifier 1 2 3 4 5 6 7 8 9 10 11 12 Center Frequency

(MHz) 2412 2417 2422 2427 2432 2437 2442 2447 2452 2457 2462 2467 Americas (A Regulatory Domains Maximum Power Level OFDM CCK 30 mW 30 mW 30 mW 30 mW 30 mW 30 mW 30 mW 30 mW 30 mW 30 mW 30 mW 100 mW 100 mW 100 mW 100 mW 100 mW 100 mW 100 mW 100 mW 100 mW 100 mW 100 mW Regulatory, Safety, and Product Information 4 78-xxxxx-xx

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Table 2 IEEE 802.11g Channels and Maximum Power Levels for a .2.2 dBi Antenna (Continued) Channels and Maximum Power Levels Channel Identifier 13 14 Center Frequency

(MHz) 2472 2484 Americas (A Regulatory Domains Maximum Power Level OFDM CCK IEEE 802.11a (5-GHz Band) Table 3 lists the IEEE 802.11a channel identifiers, channel center frequencies, and maximum power levels allowed when using a 5 dBi antenna in the Americas (-A) regulatory domain. Table 3 IEEE 802.11a Channels and Maximum Power Levels for a 5 dBi Antenna Band UNII-1 UNII-2 UNII-3 Channel ID 36 40 44 48 52 56 60 64 149 153 157 161 Center Frequency

(MHz) 5180 5200 5220 5240 5260 5280 5300 5320 5745 5765 5785 5805 Americas (-A) Regulatory Domain Maximum Power Level 15 dBm 15 dBm 15 dBm 15 dBm 17 dBm 17 dBm 17 dBm 17 dBm 17 dBm 17 dBm 17 dBm 17 dBm Caution Within the 5.15 to 5.25 GHz band (5 GHz radio channels 36 to 48) the U-NII devices are restricted to indoor operations to reduce any potential for harmful interference to co-channel Mobile Satellite System

(MSS) operations. 78-xxxxx-xx Regulatory, Safety, and Product Information 5 Translated Safety Warnings

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Translated Safety Warnings This section contains the following translated safety warnings:

Dipole Antenna Installation Warning, page 6

Explosive Device Proximity Warning, page 7

Lightning Activity Warning, page 7

Installation Warning, page 8

Circuit Breaker (15A) Warning, page 9 Dipole Antenna Installation Warning Warning In order to comply with FCC radio frequency (RF) exposure limits, dipole antennas should be located at a minimum of 7.9 inches (20 cm) or more from the body of all persons. Waarschuwing Om te voldoen aan de FCC radiofrequentie (RF) blootstellingslimieten dienen dipoolantennes zich minstens 20 cm of meer van de lichamen van alle personen bevinden. Varoitus FCC:n antamien radiotaajuuksille altistumista koskevien rajoitusten mukaan dipoliantennien on sijaittava vhintn 20 cm:n pss kaikista henkilist. Attention Warnung Pour se conformer aux limites dexposition la frquence radio prconises par la FCC (Federal Communications Commission), les antennes diples doivent se situer un minimum de 20 cm de toute personne. Um die in den FCC-Richtlinien festgelegten Expositionshchstgrenzen fr Radiofrequenzen (RF) nicht zu berschreiten, sollten Dipolantennen mindestens 20 cm (7,9 Zoll) vom Krper aller Person entfernt aufgestellt werden. Avvertenza Per conformarsi ai limiti FCC di esposizione a radiofrequenza (RF), le antenne a dipolo devono stare ad una distanza minima di 20 cm dal corpo di ogni persona. Advarsel I henhold til eksponeringsgrensene for radiofrekvenser (RF), skal dipole antenner befinne seg p en avstand av minst 20 cm eller mer fra mennesker. Aviso Para estar de acordo com as normas FCC de limites de exposio para freqncia de rdio (RF), as antenas dipolo devem estar distantes no mnimo 20 cm (7,9 pol) do corpo de qualquer pessoa. Advertencia!

Para cumplir con los lmites de exposicin de radio frecuencia (RF) de la Comisin Federal de Comunicaciones (FCC) es preciso ubicar las antenas dipolo a un mnimo de 20 cm (7,9 pulgadas) o ms del cuerpo de las personas. Varning!

Fr att flja FCC-exponeringsgrnserna fr radiofrekvens (RF), br dipolsantenner placeras p minst 20 cm avstnd frn alla mnniskor. Regulatory, Safety, and Product Information 6 78-xxxxx-xx

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Translated Safety Warnings Explosive Device Proximity Warning Warning Do not operate your wireless network device near unshielded blasting caps or in an explosive environment unless the device has been modified to be especially qualified for such use. Waarschuwing Gebruik dit draadloos netwerkapparaat alleen in de buurt van onbeschermde ontstekers of in een omgeving met explosieven indien het apparaat speciaal is aangepast om aan de eisen voor een dergelijk gebruik te voldoen. Varoitus l kyt johdotonta verkkolaitetta suojaamattomien rjytysnallien lheisyydess tai rjytysalueella, jos laitetta ei ole erityisesti muunnettu sopivaksi sellaiseen kyttn.oen. Attention Ne jamais utiliser un quipement de rseau sans fil proximit d'un dtonateur non blind ou dans un lieu prsentant des risques d'explosion, sauf si l'quipement a t modifi cet effet. Warnung Benutzen Sie Ihr drahtloses Netzwerkgert nicht in der Nhe ungeschtzter Sprengkapseln oder anderer explosiver Stoffe, es sei denn, Ihr Gert wurde eigens fr diesen Gebrauch modifiziert und bestimmt. Avvertenza Non utilizzare la periferica di rete senza fili in prossimit di un detonatore non protetto o di esplosivi a meno che la periferica non sia stata modificata a tale proposito. Advarsel Ikke bruk den trdlse nettverksenheten nrt inntil uisolerte fenghetter eller i et eksplosivt milj med mindre enheten er modifisert slik at den tler slik bruk. Aviso No opere o dispositivo de rede sem fios perto de cpsulas explosivas no protegidas ou num ambiente explosivo, a no ser que o dispositivo tenha sido modificado para se qualificar especialmente para essa utilizao. Advertencia!

No utilizar un aparato de la red sin cable cerca de un detonador que no est protegido ni tampoco en un entorno explosivo a menos que el aparato haya sido modificado con ese fin. Varning!

Anvnd inte den trdlsa ntverksenheten i nrheten av oskyddade tndhattar eller i en explosiv milj om inte enheten modifierats fr att kunna anvndas i sdana sammanhang. Lightning Activity Warning Warning Do not work on the system or connect or disconnect cables during periods of lightning activity. Waarschuwing Tijdens onweer dat gepaard gaat met bliksem, dient u niet aan het systeem te werken of kabels aan te sluiten of te ontkoppelen. Varoitus l tyskentele jrjestelmn parissa lk yhdist tai irrota kaapeleita ukkosilmalla. 78-xxxxx-xx Regulatory, Safety, and Product Information 7 Translated Safety Warnings

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Attention Ne pas travailler sur le systme ni brancher ou dbrancher les cbles pendant un orage. Warnung Arbeiten Sie nicht am System und schlieen Sie keine Kabel an bzw. trennen Sie keine ab, wenn es gewittert. Avvertenza Non lavorare sul sistema o collegare oppure scollegare i cavi durante un temporale con fulmini. Advarsel Utfr aldri arbeid p systemet, eller koble kabler til eller fra systemet nr det tordner eller lyner. Aviso No trabalhe no sistema ou ligue e desligue cabos durante perodos de mau tempo (trovoada). Advertencia!

No operar el sistema ni conectar o desconectar cables durante el transcurso de descargas elctricas en la atmsfera. Varning!

Vid ska skall du aldrig utfra arbete p systemet eller ansluta eller koppla loss kablar. Installation Warning Warning Read the installation instructions before you connect the system to its power source. Waarschuwing Raadpleeg de installatie-aanwijzingen voordat u het systeem met de voeding verbindt. Varoitus Lue asennusohjeet ennen jrjestelmn yhdistmist virtalhteeseen. Attention Avant de brancher le systme sur la source d'alimentation, consulter les directives d'installation. Warnung Lesen Sie die Installationsanweisungen, bevor Sie das System an die Stromquelle anschlieen. Avvertenza Consultare le istruzioni di installazione prima di collegare il sistema allalimentatore. Advarsel Les installasjonsinstruksjonene fr systemet kobles til strmkilden. Aviso Leia as instrues de instalao antes de ligar o sistema sua fonte de energia. Advertencia!

Ver las instrucciones de instalacin antes de conectar el sistema a la red de alimentacin. Varning!

Ls installationsanvisningarna innan du kopplar systemet till dess strmfrsrjningsenhet. Regulatory, Safety, and Product Information 8 78-xxxxx-xx

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Translated Safety Warnings Circuit Breaker (15A) Warning Warning This product relies on the buildings installation for short-circuit (overcurrent) protection. Ensure that a fuse or circuit breaker no larger than 120 VAC, 15A U.S. (240 VAC, 10A international) is used on the phase conductors (all current-carrying conductors). Waarschuwing Dit produkt is afhankelijk van de installatie van het gebouw voor kortsluit- (overstroom)beveiliging. Controleer of er een zekering of stroomverbreker van niet meer dan 120 Volt wisselstroom, 15 A voor de V.S. (240 Volt wisselstroom, 10 A internationaal) gebruikt wordt op de fasegeleiders (alle geleiders die stroom voeren). Varoitus Attention Warnung Tm tuote on riippuvainen rakennukseen asennetusta oikosulkusuojauksesta

(ylivirtasuojauksesta). Varmista, ett vaihevirtajohtimissa (kaikissa virroitetuissa johtimissa) kytetn Yhdysvalloissa alle 120 voltin, 15 ampeerin ja monissa muissa maissa 240 voltin, 10 ampeerin sulaketta tai suojakytkint. Pour ce qui est de la protection contre les courts-circuits (surtension), ce produit dpend de l'installation lectrique du local. Vrifier qu'un fusible ou qu'un disjoncteur de 120 V alt., 15 A U.S. maximum (240 V alt., 10 A international) est utilis sur les conducteurs de phase (conducteurs de charge). Dieses Produkt ist darauf angewiesen, da im Gebude ein Kurzschlu- bzw. berstromschutz installiert ist. Stellen Sie sicher, da eine Sicherung oder ein Unterbrecher von nicht mehr als 240 V Wechselstrom, 10 A (bzw. in den USA 120 V Wechselstrom, 15 A) an den Phasenleitern (allen stromfhrenden Leitern) verwendet wird. Avvertenza Questo prodotto dipende dallinstallazione delledificio per quanto riguarda la protezione contro cortocircuiti (sovracorrente). Verificare che un fusibile o interruttore automatico, non superiore a 120 VCA, 15 A U.S. (240 VCA, 10 A internazionale) sia stato usato nei fili di fase (tutti i conduttori portatori di corrente). Advarsel Dette produktet er avhengig av bygningens installasjoner av kortslutningsbeskyttelse (overstrm). Kontroller at det brukes en sikring eller strmbryter som ikke er strre enn 120 VAC, 15 A (USA) (240 VAC, 10 A internasjonalt) p faselederne (alle strmfrende ledere). Aviso Este produto depende das instalaes existentes para proteco contra curto-circuito

(sobrecarga). Assegure-se de que um fusvel ou disjuntor no superior a 240 VAC, 10A utilizado nos condutores de fase (todos os condutores de transporte de corrente). Advertencia!

Este equipo utiliza el sistema de proteccin contra cortocircuitos (o sobrecorrientes) del propio edificio. Asegurarse de que se utiliza un fusible o interruptor automtico de no ms de 240 voltios en corriente alterna (VAC), 10 amperios del estndar internacional (120 VAC, 15 amperios del estndar USA) en los hilos de fase (todos aqullos portadores de corriente). Varning!

Denna produkt r beroende av i byggnaden installerat kortslutningsskydd (verstrmsskydd). Kontrollera att skring eller verspnningsskydd anvnds p fasledarna (samtliga strmfrande ledare) fr internationellt bruk max. 240 V vxelstrm, 10 A (i USA max. 120 V vxelstrm, 15 A). 78-xxxxx-xx Regulatory, Safety, and Product Information 9 Related Documentation

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Related Documentation These documents provide information about the access point:

Release Notes for Cisco Aironet 1200 Series Access Point

Cisco Aironet 1200 Series Access Point Command Reference

Cisco IOS Software Configuration Guide for Cisco Aironet Access Points Click this link to browse to the Cisco Aironet documentation home page:

http://www.cisco.com/univercd/cc/td/doc/product/wireless/index.htm To browse to the 1200 series access point documentation, select Aironet 1200 Series Wireless LAN Products > Cisco Aironet 1200 Series Access Points. Obtaining Documentation Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems. Cisco.com You can access the most current Cisco documentation on the World Wide Web at this URL:

http://www.cisco.com/univercd/home/home.htm You can access the Cisco website at this URL:

http://www.cisco.com International Cisco websites can be accessed from this URL:

http://www.cisco.com/public/countries_languages.shtml Ordering Documentation You can find instructions for ordering documentation at this URL:

http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm You can order Cisco documentation in these ways:

Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Ordering tool:

http://www.cisco.com/en/US/partner/ordering/index.shtml

Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387). Regulatory, Safety, and Product Information 10 78-xxxxx-xx

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Documentation Feedback Documentation Feedback You can submit e-mail comments about technical documentation to bug-doc@cisco.com. You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:

Cisco Systems Attn: Customer Document Ordering 170 West Tasman Drive San Jose, CA 95134-9883 We appreciate your comments. Obtaining Technical Assistance For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco Technical Assistance Center (TAC) provides 24-hour-a-day, award-winning technical support services, online and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical assistance. If you do not hold a valid Cisco service contract, please contact your reseller. Cisco TAC Website The Cisco TAC website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC website is available 24 hours a day, 365 days a year. The Cisco TAC website is located at this URL:

http://www.cisco.com/tac Accessing all the tools on the Cisco TAC website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a login ID or password, register at this URL:

http://tools.cisco.com/RPF/register/register.do Opening a TAC Case Using the online TAC Case Open Tool is the fastest way to open P3 and P4 cases. (P3 and P4 cases are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Case Open Tool automatically recommends resources for an immediate solution. If your issue is not resolved using the recommended resources, your case will be assigned to a Cisco TAC engineer. The online TAC Case Open Tool is located at this URL:

http://www.cisco.com/tac/caseopen For P1 or P2 cases (P1 and P2 cases are those in which your production network is down or severely degraded) or if you do not have Internet access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2 cases to help keep your business operations running smoothly. To open a case by telephone, use one of the following numbers:

Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227) EMEA: +32 2 704 55 55 USA: 1 800 553-2447 78-xxxxx-xx Regulatory, Safety, and Product Information 11 Obtaining Additional Publications and Information

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L For a complete listing of Cisco TAC contacts, go to this URL:

http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml TAC Case Priority Definitions To ensure that all cases are reported in a standard format, Cisco has established case priority definitions. Priority 1 (P1)Your network is down or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation. Priority 2 (P2)Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation. Priority 3 (P3)Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels. Priority 4 (P4)You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations. Obtaining Additional Publications and Information Information about Cisco products, technologies, and network solutions is available from various online and printed sources.

Cisco Marketplace provides a variety of Cisco books, reference guides, and logo merchandise. Go to this URL to visit the company store:

http://www.cisco.com/go/marketplace/

The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL:

http://cisco.com/univercd/cc/td/doc/pcat/

Cisco Press publishes a wide range of general networking, training and certification titles. Both new and experienced users will benefit from these publications. For current Cisco Press titles and other information, go to Cisco Press online at this URL:

http://www.ciscopress.com

Packet magazine is the Cisco quarterly publication that provides the latest networking trends, technology breakthroughs, and Cisco products and solutions to help industry professionals get the most from their networking investment. Included are networking deployment and troubleshooting tips, configuration examples, customer case studies, tutorials and training, certification information, and links to numerous in-depth online resources. You can access Packet magazine at this URL:

http://www.cisco.com/packet

iQ Magazine is the Cisco bimonthly publication that delivers the latest information about Internet business strategies for executives. You can access iQ Magazine at this URL:

http://www.cisco.com/go/iqmagazine Regulatory, Safety, and Product Information 12 78-xxxxx-xx

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L Obtaining Additional Publications and Information

Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:

http://www.cisco.com/ipj

TrainingCisco offers world-class networking training. Current offerings in network training are listed at this URL:

http://www.cisco.com/en/US/learning/index.html 78-xxxxx-xx Regulatory, Safety, and Product Information 13 Obtaining Additional Publications and Information

( D R A F T L A B E L ) A L P H A D R A F T - C I S C O C O N F I D E N T I A L This document is to be used in conjunction with the documents listed in the Related Documentation section. CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0403R) Copyright 2004 Cisco Systems, Inc. All rights reserved. Printed in the USA on recycled paper containing 10% postconsumer waste. Regulatory, Safety, and Product Information 14 78-xxxxx-xx