FCC ID: KA2WL3600APA1 802.11n single band Unified Access Point

Unified Access Point Administrator's Guide Product Model: DWL-3600AP DWL-6600AP DWL-8600AP Unified Wired & Wireless Access System Release 2.0 November 2011 Copyright 2011. All rights reserved. UnifiedAccessPointAdministratorsGuide D-Link November2011 UnifiedAccessPointAdministratorsGuide Page2 UnifiedAccessPointAdministratorsGuide TableofContents Section1:AboutThisDocument ..................................................................................... 12 DocumentOrganization ............................................................................................................................... 12 AdditionalDocumentation...........................................................................................................................12 DocumentConventions................................................................................................................................13 OnlineHelp,SupportedBrowsers,andLimitations ....................................................................................14 Section2:GettingStarted ............................................................................................... 15 AdministratorsComputerRequirements ...................................................................................................16 WirelessClientRequirements......................................................................................................................17 DynamicandStaticIPAddressingontheAP...............................................................................................17 RecoveringanIPAddress.......................................................................................................................18 DiscoveringaDynamicallyAssignedIPAddress ....................................................................................18 InstallingtheUAP.........................................................................................................................................19 BasicSettings................................................................................................................................................22 ConnectingtotheAPWebInterfacebyUsingtheIPv6Address...........................................................24 UsingtheCLItoViewtheIPAddress...........................................................................................................24 ConfiguringtheEthernetSettings................................................................................................................25 UsingtheCLItoConfigureEthernetSettings.........................................................................................26 ConfiguringIEEE802.1XAuthentication......................................................................................................27 UsingtheCLItoConfigure802.1XAuthenticationInformation ............................................................27 VerifyingtheInstallation..............................................................................................................................28 ConfiguringSecurityontheWirelessAccessPoint .....................................................................................29 Section3:ViewingAccessPointStatus ............................................................................ 30 ViewingInterfaceStatus ..............................................................................................................................31 WiredSettings(InternalInterface) ........................................................................................................31 WirelessSettings....................................................................................................................................31 ViewingEvents .............................................................................................................................................32 ConfiguringPersistentLoggingOptions.................................................................................................32 ConfiguringtheLogRelayHostforKernelMessages ............................................................................34 EnablingorDisablingtheLogRelayHostontheEventsPage ...............................................................34 ViewingTransmitandReceiveStatistics .....................................................................................................36 ViewingAssociatedWirelessClientInformation ........................................................................................38 ViewingTSPECClientAssociations ..............................................................................................................39 LinkIntegrityMonitoring .......................................................................................................................41 ViewingRogueAPDetection .......................................................................................................................41 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page3 UnifiedAccessPointAdministratorsGuide SavingandImportingtheKnownAPList ...............................................................................................44 ViewingManagedAPDHCPInformation.....................................................................................................45 ViewingTSPECStatusandStatisticsInformation........................................................................................45 ViewingTSPECAPStatisticsInformation.....................................................................................................47 ViewingRadioStatisticsInformation ..........................................................................................................48 ViewingEmailAlertOperationalStatus ......................................................................................................50 Section4:ManagingtheAccessPoint.............................................................................. 51 EthernetSettings ..........................................................................................................................................51 WirelessSettings ..........................................................................................................................................54 Usingthe802.11hWirelessMode.........................................................................................................57 EnablingAeroScoutEngineSupport ...................................................................................................57 ModifyingRadioSettings .............................................................................................................................58 ConfiguringRadioandVAPScheduler .........................................................................................................65 SchedulerAssociationSettings ....................................................................................................................68 VirtualAccessPointSettings........................................................................................................................70 None(Plaintext)....................................................................................................................................74 StaticWEP..............................................................................................................................................74 StaticWEPRules .............................................................................................................................76 IEEE802.1X ............................................................................................................................................76 WPAPersonal ........................................................................................................................................78 WPAEnterprise......................................................................................................................................79 ConfiguringtheWirelessDistributionSystem(WDS) .................................................................................81 WEPonWDSLinks .................................................................................................................................84 WPA/PSKonWDSLinks .........................................................................................................................84 ControllingAccessbyMACAuthentication .................................................................................................85 ConfiguringaMACFilterandStationListontheAP..............................................................................85 ConfiguringMACAuthenticationontheRADIUSServer .......................................................................87 ConfiguringLoadBalancing..........................................................................................................................88 ManagedAccessPointOverview.................................................................................................................89 TransitioningBetweenModes...............................................................................................................89 ConfiguringManagedAccessPointSettings..........................................................................................90 Configuring802.1XAuthentication..............................................................................................................92 CreatingaManagementAccessControlList ...............................................................................................94 Section5:ConfiguringAccessPointServices.................................................................... 95 ConfiguringSNMPontheAccessPoint .......................................................................................................95 WebServerSettings .....................................................................................................................................99 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page4 UnifiedAccessPointAdministratorsGuide SettingtheSSHStatus ................................................................................................................................101 SettingtheTelnetStatus............................................................................................................................101 ConfiguringQualityofService....................................................................................................................102 ConfiguringEmailAlert ..............................................................................................................................106 EnablingtheTimeSettings(NTP)...............................................................................................................109 Section6:ConfiguringSNMPv3 ..................................................................................... 111 ConfiguringSNMPv3Views........................................................................................................................111 ConfiguringSNMPv3Groups......................................................................................................................113 ConfiguringSNMPv3Users ........................................................................................................................115 ConfiguringSNMPv3Targets .....................................................................................................................116 Section7:MaintainingtheAccessPoint ........................................................................ 117 SavingtheCurrentConfigurationtoaBackupFile....................................................................................117 RestoringtheConfigurationfromaPreviouslySavedFile........................................................................118 PerformingAPMaintenance......................................................................................................................120 ResettingtheFactoryDefaultConfiguration .......................................................................................120 RebootingtheAccessPoint .................................................................................................................120 UpgradingtheFirmware ............................................................................................................................120 PacketCaptureConfigurationandSettings...............................................................................................122 PacketCaptureStatus..........................................................................................................................124 PacketCaptureParameterConfiguration............................................................................................124 PacketFileCapture ..............................................................................................................................125 RemotePacketCapture .......................................................................................................................125 PacketCaptureFileDownload.............................................................................................................127 Section8:ConfiguringClientQualityofService ............................................................. 128 ConfiguringVAPQoSParameters ..............................................................................................................128 ManagingClientQoSACLs .........................................................................................................................131 IPv4andIPv6ACLs ...............................................................................................................................131 MACACLs.............................................................................................................................................131 ACLConfigurationProcess ...................................................................................................................131 CreatingaDiffServClassMap ....................................................................................................................138 DefiningDiffServ ..................................................................................................................................138 CreatingaDiffServPolicyMap...................................................................................................................144 ClientQoSStatus ........................................................................................................................................146 ConfiguringRADIUSAssignedClientQoSParameters..............................................................................147 Section9:ClusteringMultipleAPs................................................................................. 149 ManagingAccessPointsintheCluster ......................................................................................................149 DLink November2011 UnifiedAccessPointAdministratorsGuide Page5 UnifiedAccessPointAdministratorsGuide ClusteringSingleandDualRadioAPs ..................................................................................................149 ViewingandConfiguringClusterMembers .........................................................................................149 RemovinganAccessPointfromtheCluster ........................................................................................151 AddinganAccessPointtoaCluster.....................................................................................................152 NavigatingtoConfigurationInformationforaSpecificAP..................................................................152 NavigatingtoanAPbyUsingitsIPAddressinaURL...........................................................................152 ManagingClusterSessions.........................................................................................................................153 SortingSessionInformation.................................................................................................................154 ConfiguringandViewingChannelManagementSettings.........................................................................154 Stopping/StartingAutomaticChannelAssignment .............................................................................155 ViewingCurrentChannelAssignmentsandSettingLocks...................................................................156 ViewingtheLastProposedSetofChanges..........................................................................................156 ConfiguringAdvancedSettings ............................................................................................................157 ViewingWirelessNeighborhoodInformation...........................................................................................158 ViewingDetailsforaClusterMember.................................................................................................160 AppendixA:DefaultAPSettings.................................................................................... 161 AppendixB:ConfigurationExamples............................................................................. 164 ConfiguringaVAP.......................................................................................................................................164 VAPConfigurationfromtheWebInterface.........................................................................................164 VAPConfigurationfromtheCLI...........................................................................................................165 VAPConfigurationUsingSNMP ...........................................................................................................166 ConfiguringRadioSettings .........................................................................................................................166 RadioConfigurationfromtheWebInterface ......................................................................................166 RadioConfigurationfromtheCLI ........................................................................................................168 RadioConfigurationUsingSNMP ........................................................................................................168 ConfiguringtheWirelessDistributionSystem...........................................................................................169 WDSConfigurationfromtheWebInterface .......................................................................................169 WDSConfigurationfromtheCLI..........................................................................................................170 WDSConfigurationUsingSNMP..........................................................................................................171 ClusteringAccessPoints.............................................................................................................................172 ClusteringAPsbyUsingtheWebInterface .........................................................................................172 ClusteringAPsbyUsingtheCLI............................................................................................................173 ClusteringAPsbyUsingSNMP.............................................................................................................174 ConfiguringClientQoS ............................................................................................................................... 174 ConfiguringQoSbyUsingtheWebInterface ......................................................................................174 ACLConfiguration.........................................................................................................................174 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page6 UnifiedAccessPointAdministratorsGuide DiffServConfiguration .................................................................................................................. 176 ConfiguringQoSbyUsingtheCLI ........................................................................................................179 ACLConfiguration.........................................................................................................................179 DiffServConfiguration .................................................................................................................. 179 ACLConfiguration.........................................................................................................................180 DiffServConfiguration .................................................................................................................. 182 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page7 UnifiedAccessPointAdministratorsGuide ListofFigures Figure1: AdministratorUIOnlineHelp ............................................................................................................14 Figure2: ViewingInterfaceStatus....................................................................................................................31 Figure3: ViewingEvents ..................................................................................................................................32 Figure4: PersistentLoggingOptions................................................................................................................33 Figure5: LogRelayHost ...................................................................................................................................34 Figure6: ViewingTrafficStatistics....................................................................................................................36 Figure7: ViewingClientAssociationInformation ............................................................................................38 Figure8: ViewingTSPECClientAssociations ....................................................................................................39 Figure9: ViewingRogueandKnownAccessPoints .........................................................................................41 Figure10: ViewingTSPECStatusandStatistics ................................................................................................45 Figure11: RadioStatistics ................................................................................................................................48 Figure12: EmailAlertOperationalStatus ........................................................................................................50 Figure13: EthernetSettings.............................................................................................................................52 Figure14: WirelessInterfaceConfiguration.....................................................................................................54 Figure15: ConfiguringRadioSettings ..............................................................................................................58 Figure16: ConfiguringRadioSettings(Continued) ..........................................................................................59 Figure17: SchedulerConfiguration.................................................................................................................. 65 Figure18: ModifyRuleConfiguration ..............................................................................................................67 Figure19: SchedulerAssociation .....................................................................................................................68 Figure20: SettingUpVirtualAccessPoints......................................................................................................71 Figure21: ConfiguringWDSSettings................................................................................................................82 Figure22: ConfiguringMACAuthentication ....................................................................................................86 Figure23: ConfiguringLoadBalancing .............................................................................................................88 Figure24: ConfiguringManagedAccessPointSettings ...................................................................................90 Figure25: IEEE802.1XAuthentication.............................................................................................................92 Figure26: ManagementACL ............................................................................................................................ 94 Figure27: ModifyingSNMPSettings................................................................................................................96 Figure28: ConfiguringWebServerSettings.....................................................................................................99 Figure29: SSHStatus......................................................................................................................................101 Figure30: TelnetStatus..................................................................................................................................101 Figure31: ConfiguringQoSSettings...............................................................................................................103 Figure32: ConfiguringEmailAlert..................................................................................................................106 Figure33: SettingtheSystemTime................................................................................................................109 Figure34: SNMPv3Views...............................................................................................................................111 Figure35: SNMPv3Groups ............................................................................................................................113 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page8 UnifiedAccessPointAdministratorsGuide Figure36: SNMPv3Users ...............................................................................................................................115 Figure37: SNMPv3Target..............................................................................................................................116 Figure38: Maintenance .................................................................................................................................120 Figure39: PacketCaptureConfiguration .......................................................................................................123 Figure40: VAPQoSParameters ..................................................................................................................... 129 Figure41: ClientQoSACL...............................................................................................................................132 Figure42: ClientQoSDiffServClassMap .......................................................................................................139 Figure43: ClientQoSDiffServPolicyMap......................................................................................................144 Figure44: ClientQoSStatus ...........................................................................................................................146 Figure45: ClusterInformationandMemberConfiguration ..........................................................................150 Figure46: ClusterInformationandMemberConfiguration ..........................................................................150 Figure47: SessionManagement ....................................................................................................................153 Figure48: ChannelManagement ...................................................................................................................155 Figure49: WirelessNeighborhood.................................................................................................................158 Figure50: DetailsforaClusterMemberAP...................................................................................................160 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page9 UnifiedAccessPointAdministratorsGuide ListofTables Table1: TypographicalConventions ................................................................................................................13 Table2: RequirementsfortheAdministratorsComputer ..............................................................................16 Table3: RequirementsforWirelessClients .....................................................................................................17 Table4: BasicSettingsPage .............................................................................................................................22 Table5: CLICommandsforEthernetSetting ...................................................................................................26 Table6: CLICommandsforthe802.1XSupplicant ..........................................................................................27 Table7: LoggingOptions ..................................................................................................................................33 Table8: LogRelayHost ....................................................................................................................................34 Table9: Transmit/Receive................................................................................................................................37 Table10: AssociatedClients.............................................................................................................................38 Table11: TSPECClientAssociations .................................................................................................................39 Table12: RogueAPDetection..........................................................................................................................42 Table13: TSPECStatusandStatistics ...............................................................................................................46 Table14: TSPECAPStatistics............................................................................................................................47 Table15: RadioStatisticsInformation .............................................................................................................48 Table16: EmailAlertStatus .............................................................................................................................50 Table17: EthernetSettingsPage .....................................................................................................................52 Table18: WirelessSettings ..............................................................................................................................55 Table19: RadioSettings ...................................................................................................................................60 Table20: SchedulerConfiguration ...................................................................................................................66 Table21: SchedulerAssociationSettings.........................................................................................................69 Table22: VirtualAccessPointSettings ............................................................................................................71 Table23: StaticWEP.........................................................................................................................................74 Table24: IEEE802.1X .......................................................................................................................................76 Table25: WPAPersonal ...................................................................................................................................78 Table26: WPAEnterprise.................................................................................................................................79 Table27: WDSSettings ....................................................................................................................................83 Table28: WEPonWDSLinks............................................................................................................................84 Table29: WPA/PSKonWDSLinks....................................................................................................................84 Table30: MACAuthentication .........................................................................................................................86 Table31: RADIUSServerAttributesforMACAuthentication ..........................................................................87 Table32: LoadBalancing..................................................................................................................................88 Table33: ManagedAccessPoint......................................................................................................................90 Table34: IEEE802.1XSupplicantAuthentication ............................................................................................92 Table35: ManagementACL .............................................................................................................................94 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page10 UnifiedAccessPointAdministratorsGuide Table36: SNMPSettings ..................................................................................................................................96 Table37: WebServerSettings .........................................................................................................................99 Table38: SSHSettings ....................................................................................................................................101 Table39: TelnetSettings ................................................................................................................................101 Table40: QoSSettings....................................................................................................................................103 Table41: EmailAlertConfiguration ...............................................................................................................106 Table42: NTPSettings....................................................................................................................................110 Table43: SNMPv3Views................................................................................................................................112 Table44: SNMPv3Groups..............................................................................................................................114 Table45: SNMPv3Users................................................................................................................................115 Table46: SNMPv3Targets .............................................................................................................................116 Table47: PacketCaptureStatus.....................................................................................................................124 Table48: PacketCaptureConfiguration ........................................................................................................124 Table49: PacketFileCapture.........................................................................................................................125 Table50: RemotePacketCapture..................................................................................................................127 Table51: PacketCaptureFileDownload........................................................................................................127 Table52: VAPQoSParameters ......................................................................................................................129 Table53: ACLConfiguration...........................................................................................................................132 Table54: DiffServClassMap ..........................................................................................................................139 Table55: DiffServPolicyMap.........................................................................................................................145 Table56: ClientQoSStatus ............................................................................................................................146 Table57: ClientQoSRADIUSAttributes.........................................................................................................147 Table58: AccessPointsintheCluster............................................................................................................151 Table59: ClusteringOptions ..........................................................................................................................151 Table60: SessionManagement ..................................................................................................................... 153 Table61: ChannelAssignments......................................................................................................................156 Table62: LastProposedChanges...................................................................................................................156 Table63: AdvancedChannelManagementSettings......................................................................................157 Table64: WirelessNeighborhoodInformation..............................................................................................159 Table65: ClusterMemberDetails..................................................................................................................160 Table66: UAPDefaultSettings....................................................................................................................... 161 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page11 UnifiedAccessPointAdministratorsGuide AboutThisDocument Section1:AboutThisDocument Thisguidedescribessetup,configuration,administrationandmaintenancefortheDLinkDWLx600APUnified AccessPoint(UAP)onawirelessnetwork.ThethreeUAPmodelsintheDWLx600APfamilyincludethe DWL3600AP,DWL6600AP,andDWL8600AP. DocumentOrganization TheUnifiedAccessPointAdministratorsGuidecontainsthefollowingsections:

Section1:AboutThisDocument,onpage12 Section2:GettingStarted,onpage15 Section3:ViewingAccessPointStatus,onpage30 Section4:ManagingtheAccessPoint,onpage51 Section5:ConfiguringAccessPointServices,onpage95 Section6:ConfiguringSNMPv3,onpage111 Section7:MaintainingtheAccessPoint,onpage117 Section8:ConfiguringClientQualityofService,onpage128 Section9:ClusteringMultipleAPs,onpage149 AppendixA:DefaultAPSettings,onpage161 AppendixB:ConfigurationExamples,onpage164 AdditionalDocumentation ThefollowingdocumentationprovidesadditionalinformationaboutUnifiedAccessPointsoftware:

TheUnifiedAccessPointCLICommandReferencedescribesthecommandsavailablefromthecommand lineinterface(CLI)formanaging,monitoring,andconfiguringtheswitch. TheUserManualfortheDLinkUnifiedWiredandWirelessSystemprovidesinformationaboutsettingup andmanagingtheUnifiedWirelessSwitch(UWS),includinginformationabouthowtousetheswitchto managemultipleUAPs. ReleasenotesfortheDLinkUnifiedWiredandWirelessSystemdetailtheplatformspecificfunctionality ofthesoftwarepackages,includingissuesandworkarounds. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page12 UnifiedAccessPointAdministratorsGuide DocumentConventions DocumentConventions Thissectiondescribestheconventionsthisdocumentuses. Note:Anoteprovidesmoreinformationaboutafeatureortechnologyandcrossreferencestorelated topics. Caution!AcautionprovidesinformationaboutcriticalaspectsofAPconfiguration,combinationsof settings,events,orproceduresthatcanadverselyaffectnetworkconnectivity,security,andsoon. Thefollowingtabledescribesthetypographicalconventionsusedinthisguide. Table1:TypographicalConventions Symbol Bold BlueText courierfont Example ClickApplytosaveyour settings. SeeDocument Conventionsonpage13. WLANAP#shownetwork courierfontitalics value

[]Squarebrackets

{}curlybraces

[value]

{choice1|choice2}

|Verticalbars

[{}]Braceswithinsquare brackets choice1|choice2

[{choice1|choice2}]

Description Menutitles,pagenames,andbuttonnames Hyperlinkedtext. Screentext,filenames,commands,usertyped commandlineentries Commandparameter,whichmightbeavariableor fixedvalue. Indicatesanoptionalfixedparameter. Indicatesthatyoumustselectaparameterfrom thelistofchoices. Separatesthemutuallyexclusivechoices. Indicateachoicewithinanoptionalelement. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page13 UnifiedAccessPointAdministratorsGuide OnlineHelp,SupportedBrowsers,andLimitations OnlineHelp,SupportedBrowsers,andLimitations OnlinehelpfortheUAPAdministrationWebpagesprovidesinformationaboutallfieldsandfeaturesavailable fromtheuserinterface(UI).Theinformationintheonlinehelpisasubsetoftheinformationavailableinthe UnifiedAccessPointAdministratorsGuide. OnlinehelpinformationcorrespondstoeachpageontheUAPAdministrationUI. Forinformationaboutthesettingsonthecurrentpage,clicktheHelplinkontheupperrightsideofapage. Thefollowingfigureshowsanexampleoftheonlinehelpavailablefromthelinksontheuserinterface. Figure1:AdministratorUIOnlineHelp D-Link November2011 UnifiedAccessPointAdministratorsGuide Page14 UnifiedAccessPointAdministratorsGuide GettingStarted Section2:GettingStarted TheDLinkDWLx600APunifiedaccesspoint(UAP)providescontinuous,highspeedaccessbetweenwireless devicesandEthernetdevices.Itisanadvanced,standardsbasedsolutionforwirelessnetworkinginbusinesses ofanysize.TheUAPenableswirelesslocalareanetwork(WLAN)deploymentwhileprovidingstateoftheart wirelessnetworkingfeatures. TheUAPcanoperateintwomodes:StandaloneModeorManagedMode.InStandaloneMode,theUAPacts asanindividualaccesspointinthenetwork,andyoumanageitbyusingtheAdministratorWebUserInterface

(UI),commandlineinterface(CLI),orSNMP.InManagedMode,theUAPispartoftheDLinkUnifiedWiredand WirelessSystem,andyoumanageitbyusingtheDLinkUnifiedWirelessSwitch.IfanAPisinManagedMode, theAdministratorWebUI,Telnet,SSH,andSNMPservicesaredisabled. Thisdocumentdescribeshowtoperformthesetup,management,andmaintenanceoftheUAPinStandalone Mode.ForinformationaboutconfiguringtheAPinManagedModebyusingtheDLinkUnifiedWirelessSwitch, seetheUserManualfortheswitch. BeforeyoupoweronanewUAP,reviewthefollowingsectionstocheckrequiredhardwareandsoftware components,clientconfigurations,andcompatibilityissues.Makesureyouhaveeverythingyouneedfora successfullaunchandtestofyourneworextendedwirelessnetwork. TheDWL6600APandDWL8600AParedualradioaccesspointsandsupporttheIEEE802.11a,802.11b, 802.11g,and802.11nmodes.TheDWL3600APisasingleradioaccesspointandsupportstheIEEE802.11b, IEEE802.11g,and802.11n(2.4GHz)modes. Thissectioncontainsthefollowingtopics:

AdministratorsComputerRequirements WirelessClientRequirements DynamicandStaticIPAddressingontheAP InstallingtheUAP BasicSettings UsingtheCLItoViewtheIPAddress ConfiguringtheEthernetSettings ConfiguringIEEE802.1XAuthentication VerifyingtheInstallation ConfiguringSecurityontheWirelessAccessPoint TomanagetheUAPbyusingtheWebinterfaceorbyusingtheCLIthroughTelnetorSSH,theAPneedsanIP address.IfyouuseVLANsorIEEE802.1XAuthentication(portsecurity)onyournetwork,youmightneedto configureadditionalsettingsontheAPbeforeitcanconnecttothenetwork. Note:TheWLANAPisnotdesignedtofunctionasagatewaytotheInternet.ToconnectyourWLAN tootherLANsortheInternet,youneedagatewaydevice. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page15 UnifiedAccessPointAdministratorsGuide AdministratorsComputerRequirements AdministratorsComputerRequirements Thefollowingtabledescribestheminimumrequirementsfortheadministratorscomputerforconfiguration andadministrationoftheUAPthroughaWebbaseduserinterface(UI). Table2:RequirementsfortheAdministratorsComputer RequiredSoftwareorComponent SerialorEthernetConnectiontothe AccessPoint WirelessConnectiontotheNetwork WebBrowserandOperatingSystem SecuritySettings Description Thecomputerusedtoconfigurethefirstaccesspointmustbe connectedtotheaccesspointbyaserialcableoranEthernetcable. Afterinitialconfigurationandlaunchofthefirstaccesspointonyour newwirelessnetwork,youcanmakesubsequentconfiguration changesthroughtheAdministrationWebpagesusingawireless connectiontotheinternalnetwork.Forwirelessconnectiontothe accesspoint,youradministrationdevicewillneedWiFicapability similartothatofanywirelessclient:

PortableorbuiltinWiFiclientadapterthatsupportsoneormoreof theIEEE802.11modesinwhichyouplantoruntheaccesspoint. WirelessclientsoftwareconfiguredtoassociatewiththeUAP. ConfigurationandadministrationoftheUAPisprovidedthrougha Webbaseduserinterfacehostedontheaccesspoint.We recommendusingoneofthefollowingsupportedWebbrowsersto accesstheaccesspointAdministrationWebpages:

MicrosoftInternetExplorerversion7.xor8.x(withuptodate patchlevelforeithermajorversion) MozillaFirefoxversion3.5orlater Safari5andlaterversions TheadministrationWebbrowsermusthaveJavaScriptenabledto supporttheinteractivefeaturesoftheadministrationinterface. Ensurethatsecurityisdisabledonthewirelessclientusedtoinitially configuretheaccesspoint. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page16 UnifiedAccessPointAdministratorsGuide WirelessClientRequirements WirelessClientRequirements TheUAPprovideswirelessaccesstoanyclientwithaproperlyconfiguredWiFiclientadapterforthe802.11 modeinwhichtheaccesspointisrunning.TheUAPsupportsmultipleclientoperatingsystems.Clientscanbe laptopordesktopcomputers,personaldigitalassistants(PDAs),oranyotherhandheld,portableorstationary deviceequippedwithaWiFiadapterandsupportingdrivers. Toconnecttotheaccesspoint,wirelessclientsneedthesoftwareandhardwaredescribedinthefollowing table. Table3:RequirementsforWirelessClients RequiredComponent WiFiClientAdapter Description PortableorbuiltinWiFiclientadapterthatsupportsoneormoreoftheIEEE 802.11modesinwhichyouplantoruntheaccesspoint. WirelessClientSoftware Clientsoftware,suchasMicrosoftWindowsSupplicant,configuredtoassociate ClientSecuritySettings withtheUAP. Securityshouldbedisabledontheclientusedtodoinitialconfigurationofthe accesspoint. IftheSecuritymodeontheaccesspointissettoanythingotherthanplaintext, wirelessclientswillneedtosetaprofiletotheauthenticationmodeusedbythe accesspointandprovideavalidusernameandpassword,certificate,orsimilaruser identityproof.SecuritymodesareStaticWEP,IEEE802.1X,WPAwithRADIUS server,andWPAPSK. Forinformationaboutconfiguringsecurityontheaccesspoint,seeVirtualAccess PointSettingsonpage70. DynamicandStaticIPAddressingontheAP Whenyoupowerontheaccesspoint,thebuiltinDHCPclientsearchesforaDHCPserveronthenetworkin ordertoobtainanIPAddressandothernetworkinformation.IftheAPdoesnotfindaDHCPserveronthe network,theAPcontinuestouseitsdefaultStaticIPAddress(10.90.90.91)untilyoureassignitanewstatic IPaddress(andspecifyastaticIPaddressingpolicy)oruntiltheAPsuccessfullyreceivesnetworkinformation fromaDHCPserver. TochangetheconnectiontypeandassignastaticIPaddressbyusingtheCLI,seeConfiguringtheEthernet Settingsonpage25or,byusingtheWebUI,seeEthernetSettingsonpage51. Caution!IfyoudonothaveaDHCPserveronyourinternalnetwork,anddonotplantouseone,the firstthingyoumustdoafterpoweringontheaccesspointischangetheconnectiontypefromDHCP tostaticIP.YoucaneitherassignanewstaticIPaddresstotheAPorcontinueusingthedefault address.WerecommendassigninganewstaticIPaddresssothatifyoubringupanotherWLANAP onthesamenetwork,theIPaddressforeachAPwillbeunique. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page17 UnifiedAccessPointAdministratorsGuide DynamicandStaticIPAddressingontheAP RecoveringanIPAddress Ifyouexperiencetroublecommunicatingwiththeaccesspoint,youcanrecoverastaticIPaddressbyresetting theAPconfigurationtothefactorydefaults(seeResettingtheFactoryDefaultConfigurationonpage120), oryoucangetadynamicallyassignedaddressbyconnectingtheAPtoanetworkthathasaDHCPserver. DiscoveringaDynamicallyAssignedIPAddress IfyouhaveaccesstotheDHCPserveronyournetworkandknowtheMACaddressofyourAP,youcanview thenewIPaddressassociatedwiththeMACaddressoftheAP. IfyoudonothaveaccesstotheDHCPserverthatassignedtheIPaddresstotheAPordonotknowtheMAC addressoftheAP,youmightneedtousetheCLItofindoutwhatthenewIPaddressis.Forinformationabout howtodiscoveradynamicallyassignedIPaddress,seeUsingtheCLItoViewtheIPAddressonpage24. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page18 UnifiedAccessPointAdministratorsGuide InstallingtheUAP InstallingtheUAP ToaccesstheAdministrationWebUI,youentertheIPaddressoftheAPintoaWebbrowser.Youcanusethe defaultIPaddressoftheAP(10.90.90.91)tologontotheAPandassignastaticIPaddress,oryoucanusea DHCPserveronyounetworktoassignnetworkinformationtotheAP.TheDHCPclientontheAPisenabledby default. ToinstalltheUAP,usethefollowingsteps:

1. ConnecttheAPtoanadministrativePCbyusingaLANconnectionoradirectcableconnection. TouseaLANconnection,connectoneendofanEthernetcabletothenetworkportontheaccesspoint andtheotherendtothesamehubwhereyourPCisconnected,asshowninthefollowingfigure. Thehuborswitchyouusemustpermitbroadcastsignalsfromtheaccesspointtoreachallotherdevices onthenetwork. Touseadirectcableconnection,connectoneendofanEthernetstraightthroughorcrossovercableto thenetworkportontheaccesspointandtheotherendofthecabletotheEthernetportonthePC,as showninthefollowingfigure.YoucanalsouseaserialcabletoconnecttheserialportontheAPtoa serialportontheadministrativecomputer. ForinitialconfigurationwithadirectEthernetconnectionandnoDHCPserver,besuretosetyourPCtoa staticIPaddressinthesamesubnetasthedefaultIPaddressontheaccesspoint.(ThedefaultIPaddress fortheaccesspointis10.90.90.91.) Ifyouusethismethod,youwillneedtoreconfigurethecablingforsubsequentstartupanddeploymentof theaccesspointsothattheaccesspointisnolongerconnecteddirectlytothePCbutinsteadisconnected totheLAN(eitherbyusingahubordirectly). D-Link November2011 UnifiedAccessPointAdministratorsGuide Page19 UnifiedAccessPointAdministratorsGuide InstallingtheUAP Note:Itispossibletodetectaccesspointsonthenetworkwithawirelessconnection.However, westronglyadviseagainstusingthismethod.Inmostenvironmentsyoumayhavenowayof knowingwhetheryouareactuallyconnectingtotheintendedAP.Also,manyoftheinitial configurationchangesrequiredwillcauseyoutoloseconnectivitywiththeAPoverawireless connection. 2. Connectthepoweradaptertothepowerportonthebackoftheaccesspoint,andthenplugtheotherend ofthepowercordintoapoweroutlet. 3. UseyourWebbrowsertologontotheUAPAdministrationWebpages. IftheAPdidnotacquireanIPaddressfromaDHCPserveronyournetwork,enter10.90.90.91inthe addressfieldofyourbrowser,whichisthedefaultIPaddressoftheAP. IfyouusedaDHCPserveronyournetworktoautomaticallyconfigurenetworkinformationfortheAP, enterthenewIPaddressoftheAPintotheWebbrowser. IfyouusedaDHCPserverandyoudonotknowthenewIPaddressoftheAP,usethefollowing procedurestoobtaintheinformation:

a. ConnectaserialcablefromtheadministrativecomputertotheAPanduseaterminalemulation programtoaccessthecommandlineinterface(CLI). b. Attheloginprompt,enteradminfortheusernameandadminforthepassword.Atthecommand prompt,entergetmanagement. ThecommandoutputdisplaystheIPaddressoftheAP.Enterthisaddressintheaddressfieldofyour browser.ForamoredetailedexplanationabouthowtologontotheCLIbyusingtheconsoleport,see UsingtheCLItoViewtheIPAddressonpage24. 4. Whenprompted,enteradminfortheusernameandadminforthepassword,thenclickOK. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page20 UnifiedAccessPointAdministratorsGuide InstallingtheUAP Whenyoufirstlogin,theBasicSettingspageforUAPadministrationisdisplayed,asthefollowingfigure shows. 5. VerifythesettingsontheBasicSettingspage. Reviewaccesspointdescriptionandprovideanewadministratorpasswordfortheaccesspointifyou donotwanttousethedefaultpassword,whichisadmin. ClicktheApplybuttontoactivatethewirelessnetworkwiththesenewsettings. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page21 UnifiedAccessPointAdministratorsGuide BasicSettings Note:ThechangesyoumakearenotsavedorapplieduntilyouclickApply.Changingsomeaccess pointsettingsmightcausetheAPtostopandrestartsystemprocesses.Ifthishappens,wireless clientswilltemporarilyloseconnectivity.Werecommendthatyouchangeaccesspointsettings whenWLANtrafficislow. 6. 7. 8. ForinformationaboutthefieldsandconfigurationoptionsontheBasicSettingspage,seeBasicSettings onpage22. IfyoudonothaveaDHCPserveronthemanagementnetworkanddonotplantouseone,youmustchange theConnectionTypefromDHCPtoStaticIP. YoucaneitherassignanewStaticIPaddresstotheAPorcontinueusingthedefaultaddress.We recommendassigninganewStaticIPaddresssothatifyoubringupanotherUAPonthesamenetwork, theIPaddressforeachAPwillbeunique.TochangetheconnectiontypeandassignastaticIPaddress,see ConfiguringtheEthernetSettingsonpage25(CLI)orEthernetSettingsonpage51(Web). IfyournetworkusesVLANs,youmightneedtoconfigurethemanagementVLANIDoruntaggedVLANID ontheUAPinorderforittoworkwithyournetwork. ForinformationabouthowtoconfigureVLANinformation,seeConfiguringtheEthernetSettingson page25(CLI)orEthernetSettingsonpage51(Web). IfyournetworkusesIEEE802.1Xportsecurityfornetworkaccesscontrol,youmustconfigurethe802.1X supplicantinformationontheAP. Forinformationabouthowtoconfigurethe802.1Xusernameandpassword,seeConfiguringIEEE802.1X Authenticationonpage27. BasicSettings FromtheBasicSettingspage,youcanviewvariousinformationabouttheUAP,includingIPandMACaddress information,andconfiguretheadministratorpasswordfortheUAP.Table4describesthefieldsand configurationoptionsontheBasicSettingspage. Field IPAddress IPv6Address IPv6LinkLocal Address MACAddress D-Link November2011 Table4:BasicSettingsPage Description ShowstheIPaddressassignedtotheAP.Thisfieldisnoteditableonthispagebecause theIPaddressisalreadyassigned(eitherbyDHCP,orstaticallythroughtheEthernet Settingspage). ShowstheIPv6addressassignedtotheAP.Thisfieldisnoteditableonthispagebecause theIPaddressisalreadyassigned(eitherbyDHCPv6,orstaticallythroughtheEthernet Settingspage). ShowstheIPv6LinkLocaladdress,whichistheIPv6addressusedbythelocalphysical link.ThelinklocaladdressisnotconfigurableandisassignedbyusingtheIPv6Neighbor Discoveryprocess. ShowstheMACaddressoftheAP.TheaddressshownhereistheMACaddress associatedwiththemanagementinterface.ThisistheaddressbywhichtheAPisknown externallytoothernetworks. UnifiedAccessPointAdministratorsGuide Page22 UnifiedAccessPointAdministratorsGuide BasicSettings Table4:BasicSettingsPage(Cont.) Field FirmwareVersion Description ShowsversioninformationaboutthefirmwarecurrentlyinstalledontheAP.Asnew versionsoftheWLANAPfirmwarebecomeavailable,youcanupgradethefirmwareon yourAPs. IdentifiestheAPhardwaremodel. IdentifiestheAPhardwareversion. ShowstheAPserialnumber. Genericnametoidentifythetypeofhardware. ProductIdentifier HardwareVersion SerialNumber DeviceName DeviceDescription Providesinformationabouttheproducthardware. CurrentPassword Enterthecurrentadministratorpassword.Youmustcorrectlyenterthecurrentpassword beforeyouareabletochangeit. Enteranewadministratorpassword.Thecharactersyouenteraredisplayedasbullet characterstopreventothersfromseeingyourpasswordasyoutype. Theadministratorpasswordmustbeanalphanumericstringofupto8characters.Donot usespecialcharactersorspaces. Note:Asanimmediatefirststepinsecuringyourwirelessnetwork,werecommendthat youchangetheadministratorpasswordfromthedefault. Reenterthenewadministratorpasswordtoconfirmthatyoutypeditasintended. Selectabaudratefortheserialportconnection.ThebaudrateontheAPmustmatch thebaudrateontheterminalorterminalemulatortoconnecttotheAPcommandline interface(CLI)byusingaserial(console)connection. Thefollowingbaudratesareavailable:

9600 19200 38400 57600 115200 EnteranamefortheAP.ThisnameappearsonlyontheBasicSettingspageandisaname toidentifytheAPtotheadministrator.Useupto64alphanumericcharacters,for exampleMyAP. Enterthename,emailaddress,orphonenumberofthepersontocontactregarding issuesrelatedtotheAP. EnterthephysicallocationoftheAP,forexampleConferenceRoomA. NewPassword ConfirmNew Password BaudRate SystemName SystemContact SystemLocation D-Link November2011 UnifiedAccessPointAdministratorsGuide Page23 UnifiedAccessPointAdministratorsGuide UsingtheCLItoViewtheIPAddress ConnectingtotheAPWebInterfacebyUsingtheIPv6Address ToconnecttotheAPbyusingtheIPv6globaladdressorIPv6linklocaladdress,youmustentertheAPaddress intoyourbrowserinaspecialformat. Note:ThefollowinginstructionsandexamplesworkwithMicrosoftInternetExplorer7(IE7)and mightnotworkwithotherbrowsers. ToconnecttoanIPv6globaladdress,addsquarebracketsaroundtheIPv6address.Forexample,iftheAP globalIPv6addressis2520::230:abff:fe00:2420,typethefollowingaddressintotheIE7addressfield:http://

[2520::230:abff:fe00:2420]. ToconnecttotheiPv6linklocaladdress,replacethecolons(:)withhyphens(),addtheinterfacenumber precededwithan"s,"thenadd".ipv6literal.net."Forexample,iftheAPlinklocaladdressis fe80::230:abff:fe00:2420,andtheWindowsinterfaceisdefinedas"%6,"typethefollowingaddressintothe IE7addressfield:http://fe80230abfffe002420s6.ipv6literal.net. UsingtheCLItoViewtheIPAddress TheDHCPclientontheUAPisenabledbydefault.IfyouconnecttheUAPtoanetworkwithaDHCPserver,the APautomaticallyacquiresanIPaddress.TomanagetheUAPbyusingtheAdministratorUI,youmustenterthe IPaddressoftheaccesspointintoaWebbrowser. IfaDHCPserveronyournetworkassignsanIPaddresstotheUAP,andyoudonotknowtheIPaddress,use thefollowingstepstoviewtheIPaddressoftheUAP:

1. Usinganullmodemcable,connectaVT100/ANSIterminaloraworkstationtotheconsole(serial)port. IfyouattachedaPC,Apple,orUNIXworkstation,startaterminalemulationprogram,suchas HyperTerminalorTeraTerm. 2. Configuretheterminalemulationprogramtousethefollowingsettings:

Baudrate:115200bps Databits:8 Parity:none Stopbit:1 Flowcontrol:none 3. Pressthereturnkey,andaloginpromptshouldappear. Theloginnameisadmin.Thedefaultpasswordisadmin.Afterasuccessfullogin,thescreenshowsthe

(AccessPointName)#prompt. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page24 UnifiedAccessPointAdministratorsGuide ConfiguringtheEthernetSettings 4. Attheloginprompt,entergetmanagement. Informationsimilartothefollowingprintstothescreen. ConfiguringtheEthernetSettings ThedefaultEthernetsettings,whichincludeDHCPandVLANinformation,mightnotworkforallnetworks. Bydefault,theDHCPclientontheUAPautomaticallybroadcastsrequestsfornetworkinformation.Ifyouwant touseastaticIPaddress,youmustdisabletheDHCPclientandmanuallyconfiguretheIPaddressandother networkinformation. ThemanagementVLANisVLAN1bydefault.ThisVLANisalsothedefaultuntaggedVLAN.Ifyoualreadyhave amanagementVLANconfiguredonyournetworkwithadifferentVLANID,youmustchangetheVLANIDof themanagementVLANontheaccesspoint. ForinformationaboutusingtheWebinterfacetoconfiguretheEthernetsettings,seeEthernetSettingson page51.YoucanalsousetheCLItoconfiguretheEthernetsettings,whichthefollowingsectiondescribes. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page25 UnifiedAccessPointAdministratorsGuide ConfiguringtheEthernetSettings UsingtheCLItoConfigureEthernetSettings UsethecommandsshowninthefollowingtabletoviewandsetvaluesfortheEthernet(wired)interface.For moreinformationabouteachsetting,seethedescriptionforthefieldinTable17onpage52. Table5:CLICommandsforEthernetSetting Action GettheDNSName SettheDNSName GetCurrentSettingsfortheEthernet(Wired)Internal Interface SetthemanagementVLANID ViewuntaggedVLANinformation EnabletheuntaggedVLAN DisabletheuntaggedVLAN SettheuntaggedVLANID Viewtheconnectiontype UseDHCPastheconnectiontype UseaStaticIPastheconnectiontype SettheStaticIPaddress SetaSubnetMask SettheDefaultGateway ViewtheDNSNameservermodeDynamic=up Manual=down SetDNSNameserverstoUseStaticIPAddresses(Dynamic toManualMode) SetDNSNameserverstoUseDHCPIPAddressing(Manual toDynamicMode) Command gethostid sethostid<host_name>

Forexample:

sethostidvickyap getmanagement setmanagementvlanid<14094>

getuntaggedvlan setuntaggedvlanstatusup setuntaggedvlanstatusdown setuntaggedvlanvlanid<14094>

getmanagementdhcpstatus setmanagementdhcpstatusup setmanagementdhcpstatusdown setmanagementstaticip<ip_address>

Forexample:

setmanagementstaticip10.10.12.221 setmanagementstaticmask<netmask>

Forexample:

setmanagementstaticmask255.255.255.0 setstaticiproutegateway<ip_address>

Forexample:

setstaticiproutegateway10.10.12.1 gethostdnsviadhcp sethostdnsviadhcpdown sethoststaticdns1<ip_address>

sethoststaticdns2<ip_address>

Forexample:

sethoststaticdns1192.168.23.45 sethostdnsviadhcpup Inthefollowingexample,theadministratorusestheCLItosetthemanagementVLANIDto123andtodisable theuntaggedVLANsothatalltrafficistaggedwithaVLANID. DLinkWLANAP#setmanagementvlanid123 DLinkWLANAP#setuntaggedvlanstatusdown D-Link November2011 UnifiedAccessPointAdministratorsGuide Page26 UnifiedAccessPointAdministratorsGuide ConfiguringIEEE802.1XAuthentication DLinkWLANAP#getmanagement PropertyValue vlanid123 interfacebrtrunk staticip10.90.90.91 staticmask255.0.0.0 ip10.90.90.91 mask255.0.0.0 mac5C:D9:98:2F:52:40 dhcpstatusup ipv6statusup ipv6autoconfigstatusup staticipv6::

staticipv6prefixlength0 DLinkWLANAP#getuntaggedvlan PropertyValue vlanid1 statusdown DLinkWLANAP#

ConfiguringIEEE802.1XAuthentication OnnetworksthatuseIEEE802.1X,portbasednetworkaccesscontrol,asupplicant(client)cannotgainaccess tothenetworkuntilthe802.1Xauthenticatorgrantsaccess.Ifyournetworkuses802.1X,youmustconfigure 802.1XauthenticationinformationthattheAPcansupplytotheauthenticator. IfyournetworkusesIEEE802.1XseeConfiguring802.1XAuthenticationonpage92forinformationabout howtoconfigure802.1XbyusingtheWebinterface. UsingtheCLItoConfigure802.1XAuthenticationInformation Thefollowingtableshowsthecommandsusedtoconfigurethe802.1XsupplicantinformationusingtheCLI. Table6:CLICommandsforthe802.1XSupplicant Action View802.1Xsupplicantsettings Enable802.1Xsupplicant Disable802.1Xsupplicant Setthe802.1Xusername Setthe802.1spassword Command getdot1xsupplicant setdot1xsupplicantstatusup setdot1xsupplicantstatusdown setdot1xsupplicantuser<name>

setdot1xsupplicantpassword<password>

D-Link November2011 UnifiedAccessPointAdministratorsGuide Page27 UnifiedAccessPointAdministratorsGuide VerifyingtheInstallation Inthefollowingexample,theadministratorenablesthe802.1XsupplicantandsetstheusernametowlanAP andthepasswordtotest1234. DLinkWLANAP#setdot1xsupplicantstatusup DLinkWLANAP#setdot1xsupplicantuserwlanAP DLinkWLANAP#setdot1xsupplicantpasswordtest1234 DLinkWLANAP#getdot1xsupplicant PropertyValue statusup userwlanAP VerifyingtheInstallation MakesuretheaccesspointisconnectedtotheLANandassociatesomewirelessclientswiththenetwork.Once youhavetestedthebasicsofyourwirelessnetwork,youcanenablemoresecurityandfinetunetheAPby modifyingadvancedconfigurationfeatures. 1. ConnecttheaccesspointtotheLAN. IfyouconfiguredtheaccesspointandadministratorPCbyconnectingbothintoanetworkhub,then youraccesspointisalreadyconnectedtotheLAN.Thenextstepistotestsomewirelessclients. Ifyouconfiguredtheaccesspointbyusingadirectcableconnectionfromyourcomputertotheaccess point,dothefollowingprocedures:

a. Disconnectthecablefromthecomputerandtheaccesspoint. b. ConnectanEthernetcablefromtheaccesspointtotheLAN. c. ConnectyourcomputertotheLANbyusinganEthernetcableorawirelesscard. 2. TestLANconnectivitywithwirelessclients. TesttheUAPbytryingtodetectitandassociatewithitfromsomewirelessclientdevices.Forinformation aboutrequirementsfortheseclients,seeWirelessClientRequirementsonpage17. 3. Secureandconfiguretheaccesspointbyusingadvancedfeatures. OncethewirelessnetworkisupandyoucanconnecttotheAPwithsomewirelessclients,youcanaddin layersofsecurity,createmultiplevirtualaccesspoints(VAPs),andconfigureperformancesettings. Note:TheWLANAPisnotdesignedformultiple,simultaneousconfigurationchanges.Ifmorethan oneadministratorisloggedontotheAdministrationWebpagesandmakingchangestothe configuration,thereisnoguaranteethatallconfigurationchangesspecifiedbymultipleuserswill beapplied. Bydefault,nosecurityisinplaceontheaccesspoint,soanywirelessclientcanassociatewithitandaccess yourLAN.Animportantnextstepistoconfiguresecurity,asdescribedinVirtualAccessPointSettingson page70. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page28 UnifiedAccessPointAdministratorsGuide ConfiguringSecurityontheWirelessAccessPoint ConfiguringSecurityontheWirelessAccessPoint Youconfiguresecurewirelessclientaccessbyconfiguringsecurityforeachvirtualaccesspoint(VAP)thatyou enable.Youcanconfigureupto16VAPsperradiothatsimulatemultipleAPsinonephysicalaccesspoint.By default,onlyoneVAPisenabled.ForeachVAP,youcanconfigureauniquesecuritymodetocontrolwireless clientaccess. Eachradiohas16VAPs,withVAPIDsfrom015.Bydefault,onlyVAP0oneachradioisenabled.VAP0hasthe followingdefaultsettings:

VLANID:1 BroadcastSSID:Enabled SSID:dlink1 Security:None MACAuthenticationType:None RedirectMode:None AllotherVAPsaredisabledbydefault.ThedefaultSSIDforVAPs115is"dlinkx"wherexistheVAPID. TopreventunauthorizedaccesstotheUAP,werecommendthatyouselectandconfigureasecurityoption otherthanNoneforthedefaultVAPandforeachVAPthatyouenable. ForinformationabouthowtoconfigurethesecuritysettingsoneachVAP,seeVirtualAccessPointSettings onpage70. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page29 UnifiedAccessPointAdministratorsGuide ViewingAccessPointStatus Section3:ViewingAccessPointStatus ThissectiondescribestheinformationyoucanviewfromthetabsundertheStatusheadingonthe AdministrationWebUI.Thissectioncontainsthefollowingsubsections:

ViewingInterfaceStatus ViewingEvents ViewingTransmitandReceiveStatistics ViewingAssociatedWirelessClientInformation ViewingTSPECClientAssociations ViewingRogueAPDetection ViewingManagedAPDHCPInformation ViewingTSPECStatusandStatisticsInformation ViewingTSPECAPStatisticsInformation ViewingRadioStatisticsInformation ViewingEmailAlertOperationalStatus Note:ThewebbasedUIimagesinthissectionshowtheDWL8600APadministrationpages.Pages fortheDWL3600APwilldisplayinformationforoneradioonly. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page30 UnifiedAccessPointAdministratorsGuide ViewingInterfaceStatus ViewingInterfaceStatus TomonitorEthernetLAN(wired)andwirelessLAN(WLAN)settings,clicktheInterfacestab. Figure2:ViewingInterfaceStatus ThispagedisplaysthecurrentsettingsoftheUAP.ItdisplaystheWiredSettingsandtheWirelessSettings. WiredSettings(InternalInterface) TheInternalinterfaceincludestheEthernetMACAddress,ManagementVLANID,IPAddress(IPv4andIPv6), SubnetMask,andDNSinformation.Tochangeanyofthesesettings,clicktheEditlink.AfteryouclickEdit,you areredirectedtotheEthernetSettingspage. Forinformationaboutconfiguringthesesettings,seeConfiguringtheEthernetSettingsonpage25. WirelessSettings TheRadioInterfaceincludestheAeroScoutEngineCommunicationstatus,RadioModeandChannel.The WirelessSettingssectionalsoshowstheMACaddress(readonly)associatedwitheachradiointerface. TochangetheRadioModeorChannelsettings,clicktheEditlink.AfteryouclickEdit,youareredirectedtothe ModifyWirelessSettingspage. Forinformationaboutconfiguringthesesettings,seeWirelessSettingsonpage54andModifyingRadio Settingsonpage58. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page31 UnifiedAccessPointAdministratorsGuide ViewingEvents ViewingEvents TheEventspageshowsrealtimesystemeventsontheAPsuchaswirelessclientsassociatingwiththeAPand beingauthenticated. Toviewsystemevents,clicktheEventstab. Figure3:ViewingEvents FromtheEventspage,youcanperformthefollowingtasks:

Viewthemostrecent,highleveleventsgeneratedbythisAP. Enableandconfigurepersistentloggingtowritesystemeventlogstononvolatilememorysothatthe eventsarenoterasedwhenthesystemreboots. SetaSeverityLeveltodeterminewhatcategoryoflogmessagesaredisplayed. SetDepthtodeterminehowmanylogmessagesaredisplayedintheEventlog. EnablearemotelogrelayhosttocaptureallsystemeventsanderrorsinaKernelLog. Note:TheAPacquiresitsdateandtimeinformationusingthenetworktimeprotocol(NTP).Thisdata isreportedinUTCformat(alsoknownasGreenwichMeanTime).Youneedtoconvertthereported timetoyourlocaltime.Forinformationonsettingthenetworktimeprotocol,seeonpage106. ConfiguringPersistentLoggingOptions Ifthesystemunexpectedlyreboots,logmessagescanbeusefultodiagnosethecause.However,logmessages areerasedwhenthesystemrebootsunlessyouenablepersistentlogging. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page32 UnifiedAccessPointAdministratorsGuide ViewingEvents Caution!Enablingpersistentloggingcanwearouttheflash(nonvolatile)memoryanddegrade networkperformance.Youshouldonlyenablepersistentloggingtodebugaproblem.Makesureyou disablepersistentloggingafteryoufinishdebuggingtheproblem. ToconfigurepersistentloggingontheEventspage,setthepersistence,severity,anddepthoptionsas describedinTable7,andthenclickApply. Figure4:PersistentLoggingOptions Table7:LoggingOptions Field Persistence Severity Depth Description ChooseEnabledtosavesystemlogstononvolatilememorysothatthelogsarenoterased whentheAPreboots.ChooseDisabledtosavesystemlogstovolatilememory.Logsin volatilememoryaredeletedwhenthesystemreboots. Specifytheseveritylevelofthelogmessagestowritetononvolatilememory.Forexample, ifyouspecify2,critical,alert,andemergencylogsarewrittentononvolatilememory.Error messageswithaseveritylevelof37arewrittentovolatilememory. 0emergency 1alert 2critical 3error 4warning 5notice 6info 7debug Youcanstoreupto128messagesinnonvolatilememory.Oncethenumberyouconfigure inthisfieldisreached,theoldestlogeventisoverwrittenbythenewlogevent. Note:Toapplyyourchanges,clickApply.ChangingsomesettingsmightcausetheAPtostopand restartsystemprocesses.Ifthishappens,wirelessclientswilltemporarilyloseconnectivity.We recommendthatyouchangeAPsettingswhenWLANtrafficislow. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page33 UnifiedAccessPointAdministratorsGuide ViewingEvents ConfiguringtheLogRelayHostforKernelMessages TheKernelLogisacomprehensivelistofsystemevents(shownintheSystemLog)andkernelmessagessuch aserrorconditions,likedroppingframes. YoucannotviewkernellogmessagesdirectlyfromtheAdministrationWebUIforanAP.Youmustfirstsetup aremoteserverrunningasyslogprocessandactingasasysloglogrelayhostonyournetwork.Then,youcan configuretheUAPtosendsyslogmessagestotheremoteserver. RemotelogservercollectionforAPsyslogmessagesprovidesthefollowingfeatures:

AllowsaggregationofsyslogmessagesfrommultipleAPs StoresalongerhistoryofmessagesthankeptonasingleAP Triggersscriptedmanagementoperationsandalerts TouseKernelLogrelaying,youmustconfigurearemoteservertoreceivethesyslogmessages.Theprocedure toconfigurearemoteloghostdependsonthetypeofsystemyouuseastheremotehost. Note:Thesyslogprocesswilldefaulttouseport514.Werecommendkeepingthisdefaultport. However;Ifyouchoosetoreconfigurethelogport,makesurethattheportnumberyouassignto syslogisnotbeingusedbyanotherprocess. EnablingorDisablingtheLogRelayHostontheEventsPage ToenableandconfigureLogRelayingontheEventspage,settheLogRelayoptionsasdescribedinthe followingtable,andthenclickApply. Figure5:LogRelayHost Table8:LogRelayHost Field RelayLog RelayHost RelayPort Description SelectEnabledtoallowtheUAPtosendlogmessagestoaremotehost.Select Disabledtokeepalllogmessagesonthelocalsystem. SpecifytheIPAddressorDNSnameoftheremotelogserver. SpecifythePortnumberforthesyslogprocessontheRelayHost. Thedefaultportis514. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page34 UnifiedAccessPointAdministratorsGuide ViewingEvents Note:Toapplyyourchanges,clickApply.ChangingsomesettingsmightcausetheAPtostopand restartsystemprocesses.Ifthishappens,wirelessclientswilltemporarilyloseconnectivity.We recommendthatyouchangeAPsettingswhenWLANtrafficislow. IfyouenabledtheLogRelayHost,clickingApplywillactivateremotelogging.TheAPwillsenditskernel messagesrealtimefordisplaytotheremotelogservermonitor,aspecifiedkernellogfile,orotherstorage, dependingonhowyouconfiguredtheLogRelayHost. IfyoudisabledtheLogRelayHost,clickingApplywilldisableremotelogging. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page35 UnifiedAccessPointAdministratorsGuide ViewingTransmitandReceiveStatistics ViewingTransmitandReceiveStatistics TheTransmit/ReceivepageprovidessomebasicinformationaboutthecurrentAPandarealtimedisplayof thetransmitandreceivestatisticsfortheEthernetinterfaceontheAPandfortheVAPsonallsupportedradio interfaces.AlltransmitandreceivestatisticsshownaretotalssincetheAPwaslaststarted.Ifyourebootthe AP,thesefiguresindicatetransmitandreceivetotalssincethereboot. ToviewtransmitandreceivestatisticsfortheAP,clicktheTransmit/Receivepage. Figure6:ViewingTrafficStatistics D-Link November2011 UnifiedAccessPointAdministratorsGuide Page36 UnifiedAccessPointAdministratorsGuide ViewingTransmitandReceiveStatistics Field Interface Status MACAddress VLANID Name(SSID) Table9:Transmit/Receive Description ThenameoftheEthernetorVAPinterface. Showswhethertheinterfaceisupordown. MACaddressforthespecifiedinterface. TheUAPhasauniqueMACaddressforeachinterface.EachradiohasadifferentMAC addressforeachinterfaceoneachofitstworadios(DWL6600APandDWL8600AP). VirtualLAN(VLAN)ID. YoucanuseVLANstoestablishmultipleinternalandguestnetworksonthesameAP. TheVLANIDissetontheVAPpage.(SeeConfiguringLoadBalancingonpage88.) Wirelessnetworkname.AlsoknownastheSSID,thisalphanumerickeyuniquely identifiesawirelesslocalareanetwork. TheSSIDissetontheVAPpage.(SeeConfiguringLoadBalancingonpage88.) Transmit and Receive Information TotalPackets TotalBytes TotalDropPackets TotalDropBytes Errors Indicatestotalpacketssent(inTransmittable)orreceived(inReceivedtable)bythis AP. Indicatestotalbytessent(inTransmittable)orreceived(inReceivedtable)bythisAP. Indicatestotalnumberofpacketssent(inTransmittable)orreceived(inReceived table)bythisAPthatweredropped. Indicatestotalnumberofbytessent(inTransmittable)orreceived(inReceivedtable) bythisAPthatweredropped. IndicatestotalerrorsrelatedtosendingandreceivingdataonthisAP. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page37 UnifiedAccessPointAdministratorsGuide ViewingAssociatedWirelessClientInformation ViewingAssociatedWirelessClientInformation Toviewtheclientstationsassociatedwithaparticularaccesspoint,clicktheClientAssociationstab. Figure7:ViewingClientAssociationInformation Theassociatedstationsaredisplayedalongwithinformationaboutpackettraffictransmittedandreceivedfor eachstation. Table10describesthefieldsontheClientAssociationspage. Table10:AssociatedClients Field Network Station Status Description ShowswhichVAPtheclientisassociatedwith.Forexample,anentryofwlan0vap2meansthe clientisassociatedwithRadio1,VAP2. Anentryofwlan0meanstheclientisassociatedwithVAP0onRadio1.Anentryofwlan1 meanstheclientisassociatedwithVAP0onRadio2. ShowstheMACaddressoftheassociatedwirelessclient. TheAuthenticatedandAssociatedStatusshowstheunderlyingIEEE802.11authentication andassociationstatus,whichispresentnomatterwhichtypeofsecuritytheclientusesto connecttotheAP.ThisstatusdoesnotshowIEEE802.1Xauthenticationorassociationstatus. Somepointstokeepinmindwithregardtothisfieldare:

IftheAPsecuritymodeisNoneorStaticWEP,theauthenticationandassociationstatusof clientsshowingontheClientAssociationspagewillbeinlinewithwhatisexpected;that is,ifaclientshowsasauthenticatedtotheAP,itwillbeabletotransmitandreceivedata.

(ThisisbecauseStaticWEPusesonlyIEEE802.11authentication.) IftheAPusesIEEE802.1XorWPAsecurity,however,itispossibleforaclientassociationto showonthispageasauthenticated(viatheIEEE802.11security)butactuallynotbe authenticatedtotheAPviathesecondlayerofsecurity. FromStation Showsthenumberofpacketsandbytesreceivedfromthewirelessclientandthenumberof packetsandbytesthatweredroppedafterbeingreceived. ShowsthenumberofpacketsandbytestransmittedfromtheAPtothewirelessclientandthe numberofpacketsandbytesthatweredroppedupontransmission. ToStation D-Link November2011 UnifiedAccessPointAdministratorsGuide Page38 UnifiedAccessPointAdministratorsGuide ViewingTSPECClientAssociations ViewingTSPECClientAssociations TheTSPECClientAssociationStatusandStatisticspageprovidessomebasicinformationabouttheclient associationsstatusandarealtimedisplayofthetransmitandreceivestatisticsfortheTSPECclients.All transmitandreceivestatisticsshownaretotalssincetheclientassociationstarted. ATSPECisatrafficspecificationthatissentfromaQoScapablewirelessclienttoanAPrequestingacertain amountofnetworkaccessforthetrafficstream(TS)itrepresents.Atrafficstreamisacollectionofdatapackets identifiedbythewirelessclientasbelongingtoaparticularuserpriority.Anexampleofavoicetrafficstream isaWiFiCERTIFIEDtelephonehandsetthatmarksitscodecgenerateddatapacketsasvoiceprioritytraffic. Anexampleofavideotrafficstreamisavideoplayerapplicationonawirelesslaptopthatprioritizesavideo conferencefeedfromacorporateserver. ToviewTSPECclientassociationstatistics,clicktheTSPECClientAssociationstab. Figure8:ViewingTSPECClientAssociations Table11describestheinformationprovidedontheTSPECClientAssociationStatusandStatisticspage. Field Description Table11:TSPECClientAssociations Status Network Station TSIdentifier AccessCategory Direction Radiointerfaceusedbytheclient. ClientstationMACaddress. TSPECTrafficSessionIdentifier(range07). TSAccessCategory(voiceorvideo). ThetrafficdirectionforthisTS.Directioncanbe:

uplink downlink bidirectional D-Link November2011 UnifiedAccessPointAdministratorsGuide Page39 UnifiedAccessPointAdministratorsGuide ViewingTSPECClientAssociations Table11:TSPECClientAssociations(Cont.) Field UserPriority MediumTime Description TheUserPriority(UP)forthisTS.TheUPissentwitheachpacketintheUPportionof theIPheader.Typicalvaluesare:

6or7forvoice 4or5forvideo Thevaluemaydifferdependingonotherprioritytrafficsessions. Thetime(in32microsecondpersecondunits)thattheTStrafficoccupiesthe transmissionmedium. ExcessUsageEvents ThenumberoftimestheclienthasexceededthemediumtimeestablishedforitsTSPEC. Minor,infrequentviolationsareignored. TheVirtualAccessPointassociatedwiththisTSclient. TheVirtualAccessPointMACaddress. TheservicesetidentifierassociatedwiththisTSclient. VAP MACAddress SSID Statistics Network Station TSIdentifier TSType AccessCategory Direction Direction FromStation ToStation Radiointerfaceusedbytheclient. ClientstationMACaddress. TSPECTrafficSessionIdentifier(range07). TherewillonlybeanentryintherowforaclientassociationthathasanactiveTS.If therearenoactivetrafficstreams,thereisnoentryforthestation. TSAccessCategory(voiceorvideo). ThetrafficdirectionforthisTS.Directioncanbe:

uplink downlink bidirectional ThetrafficdirectionforthisTS.Directioncanbe:

uplink downlink bidirectional Showsthenumberofpacketsandbytesreceivedfromthewirelessclientandthe numberofpacketsandbytesthatweredroppedafterbeingreceived.Alsoshowsthe numberofpackets:

inexcessofanadmittedTSPEC. forwhichnoTSPEChasbeenestablishedwhenadmissionisrequiredbytheAP. ShowsthenumberofpacketsandbytestransmittedfromtheAPtothewirelessclient andthenumberofpacketsandbytesthatweredroppedupontransmission.Alsoshows thenumberofpackets:

inexcessofanadmittedTSPEC. forwhichnoTSPEChasbeenestablishedwhenadmissionisrequiredbytheAP. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page40 UnifiedAccessPointAdministratorsGuide ViewingRogueAPDetection LinkIntegrityMonitoring TheUAPprovideslinkintegritymonitoringtocontinuallyverifyitsconnectiontoeachassociatedclient.Todo this,theAPsendsdatapacketstoclientseveryfewsecondswhennoothertrafficispassing.ThisallowstheAP todetectwhenaclientgoesoutofrange,evenduringperiodswhennonormaltrafficisexchanged.Theclient connectiondropsoffthelistwithin300secondsifthesedatapacketsarenotacknowledged,evenifno disassociationmessageisreceived. ViewingRogueAPDetection ThestatuspagetoviewRogueAPDetectioninformationprovidesrealtimestatisticsforallAPswithinrange oftheAPonwhichyouareviewingtheAdministrationWebpages.WhenAPdetectionisenabled,theradio willperiodicallyswitchfromitsoperatingchanneltoscanotherchannelswithinthesameband.ClickRefresh toupdatethescreenanddisplaythemostcurrentinformation. TheRogueAPDetectionpagecontainsthefollowingtwolists:

DetectedRogueAPListListsallAPswithinrangeoftheAPthathavenotbeenacknowledgedasknown APs. KnownAPListListsallAPswithinrangeoftheAPthathavebeenacknowledgedasknownAPseitherby clickingtheGrantbuttonassociatedwithanAPintheDetectedRogueAPListorbyappearinginan importedAPlist. Toviewinformationaboutotheraccesspointsonthewirelessnetwork,clicktheRogueAPDetectiontab. Figure9:ViewingRogueandKnownAccessPoints D-Link November2011 UnifiedAccessPointAdministratorsGuide Page41 UnifiedAccessPointAdministratorsGuide ViewingRogueAPDetection YoumustenabletheAPdetectiononaradioinordertocollectinformationaboutotherAPswithinrange. Table12describestheinformationprovidedonneighboringaccesspoints. Table12:RogueAPDetection Field APDetectionfor Radio Description ToallowtheAPradiostoperformneighborAPdetectionandcollectinformationabout neighborAPs,clickEnabled. TodisableneighborAPdetectionontheradios,clickDisabled. IfyouchangetheAPdetectionmode,clickApplytosavethenewsettings. DetectedRogueAPList Action ClickGranttomovetheAPfromtheDetectedRogueAPListtotheKnownAPList. Note:TheDetectedRougeAPandKnownAPlistsprovideinformation.TheDWLx600AP doesnothaveanycontrolovertheAPsonthelistandcannotapplyanysecuritypolicies toAPsdetectedthroughtheRFscan. ShowstheMACaddressoftheneighboringAP. TheRadiofieldindicateswhichradiodetectedtheneighboringAP:

wlan0(RadioOne) wlan1(RadioTwo) ShowstheBeaconintervalbeingusedbythisAP. BeaconframesaretransmittedbyanAPatregularintervalstoannouncetheexistenceof thewirelessnetwork.Thedefaultbehavioristosendabeaconframeonceevery100 milliseconds(or10persecond). TheBeaconIntervalissetontheRadiopage.(SeeModifyingRadioSettingsonpage58.) Indicatesthetypeofdevice:

APindicatestheneighboringdeviceisanAPthatsupportstheIEEE802.11Wireless NetworkingFrameworkinInfrastructureMode. AdhocindicatesaneighboringstationrunninginAdhocMode.Stationssettoadhoc modecommunicatewitheachotherdirectly,withouttheuseofatraditionalAP.Ad hocmodeisanIEEE802.11WirelessNetworkingFrameworkalsoreferredtoaspeer topeermodeoranIndependentBasicServiceSet(IBSS). TheServiceSetIdentifier(SSID)fortheAP. TheSSIDisanalphanumericstringofupto32charactersthatuniquelyidentifiesawireless localareanetwork.ItisalsoreferredtoastheNetworkName. TheSSIDissetontheVAPpage.(SeeConfiguringLoadBalancingonpage88.) Indicateswhetherthereisanysecurityontheneighboringdevice. OffindicatesthattheSecuritymodeontheneighboringdeviceissettoNone(no security). Onindicatesthattheneighboringdevicehassomesecurityinplace. SecurityisconfiguredontheAPfromtheVAPpage. IndicateswhetherWPAsecurityisonoroffforthisAP. MAC Radio BeaconInt. Type SSID Privacy WPA D-Link November2011 UnifiedAccessPointAdministratorsGuide Page42 UnifiedAccessPointAdministratorsGuide ViewingRogueAPDetection Field Band Channel Rate Signal Beacons LastBeacon Rates KnownAPList Action MAC Radio Type SSID Table12:RogueAPDetection(Cont.) Description ThisindicatestheIEEE802.11modebeingusedonthisAP.(Forexample,IEEE802.11a, IEEE802.11b,IEEE802.11g.) Thenumbershownindicatesthemodeaccordingtothefollowingmap:

2.4indicatesIEEE802.11b,802.11g,or802.11nmode(oracombinationofthemodes) 5indicatesIEEE802.11aor802.11nmode(orbothmodes) ShowstheChannelonwhichtheAPiscurrentlybroadcasting. Thechanneldefinestheportionoftheradiospectrumthattheradiousesfortransmitting andreceiving. ThechannelissetinRadioSettings.(SeeModifyingRadioSettingsonpage58.) Showstherate(inmegabitspersecond)atwhichthisAPiscurrentlytransmitting. ThecurrentratewillalwaysbeoneoftheratesshowninSupportedRates. IndicatesthestrengthoftheradiosignalemittingfromthisAP.Ifyouhoverthemouse pointeroverthebars,anumberappearsandshowsthestrengthindecibels(dB). ShowsthetotalnumberofbeaconsreceivedfromthisAPsinceitwasfirstdiscovered. ShowsthedateandtimeofthelastbeaconreceivedfromthisAP. Showssupportedandbasic(advertised)ratesetsfortheneighboringAP.Ratesareshown inmegabitspersecond(Mbps). AllSupportedRatesarelisted,withBasicRatesshowninbold. RatesetsareconfiguredontheRadioSettingspage.(SeeModifyingRadioSettingson page58.) AnAPcanappearintheKnownAPListifithasbeenmovedfromtheDetectedRogueAP ListbyclickingtheGrantbuttonoriftheMACaddressoftheAPappearsinanAPlistthat hasbeenimported. TomovetheAPfromtheKnownAPListtotheDetectedRogueAPList,clickDelete. Note:TheDetectedRougeAPandKnownAPlistsprovideinformation.TheDWLx600AP doesnothaveanycontrolovertheAPsonthelistandcannotapplyanysecuritypolicies toAPsdetectedthroughtheRFscan. ShowstheMACaddressoftheneighboringAP. TheRadiofieldindicateswhichradiodetectedtheneighboringAP:

wlan0(RadioOne) wlan1(RadioTwo) Indicatesthetypeofdevice:

APindicatestheneighboringdeviceisanAPthatsupportstheIEEE802.11Wireless NetworkingFrameworkinInfrastructureMode. AdhocindicatesaneighboringstationrunninginAdhocMode.Stationssettoadhoc modecommunicatewitheachotherdirectly,withouttheuseofatraditionalAP.Ad hocmodeisanIEEE802.11WirelessNetworkingFrameworkalsoreferredtoaspeer topeermodeoranIndependentBasicServiceSet(IBSS). TheServiceSetIdentifier(SSID)fortheAP. TheSSIDisanalphanumericstringofupto32charactersthatuniquelyidentifiesawireless localareanetwork.ItisalsoreferredtoastheNetworkName. TheSSIDissetontheVAPpage.(SeeConfiguringLoadBalancingonpage88.) D-Link November2011 UnifiedAccessPointAdministratorsGuide Page43 UnifiedAccessPointAdministratorsGuide ViewingRogueAPDetection Field Privacy Band Channel Table12:RogueAPDetection(Cont.) Description Indicateswhetherthereisanysecurityontheneighboringdevice. OffindicatesthattheSecuritymodeontheneighboringdeviceissettoNone(no security). Onindicatesthattheneighboringdevicehassomesecurityinplace. SecurityisconfiguredontheAPfromtheVAPpage. ThisindicatestheIEEE802.11modebeingusedonthisAP.(Forexample,IEEE802.11a, IEEE802.11b,IEEE802.11g.) Thenumbershownindicatesthemodeaccordingtothefollowingmap:

2.4indicatesIEEE802.11b,802.11g,or802.11nmode(oracombinationofthemodes) 5indicatesIEEE802.11aor802.11nmode(orbothmodes) ShowstheChannelonwhichtheAPiscurrentlybroadcasting. Thechanneldefinestheportionoftheradiospectrumthattheradiousesfortransmitting andreceiving. ThechannelissetinRadioSettings.(SeeModifyingRadioSettingsonpage58.) SavingandImportingtheKnownAPList TosavetheKnownAPlisttoafile,clickSave.ThelistcontainstheMACaddressesofallAPthathavebeen addedtotheKnownAPList.Bydefault,thefilenameisRogue1.cfg.YoucanuseatexteditororWebbrowser toopenthefileandviewitscontents. UsetheImportfeaturetoimportalistofKnownAPsfromasavedlist.ThelistmightbefromanotherDWL x600APorcreatedfromatextfile.IftheMACaddressofanAPappearsintheKnownAPList,itwillnotbe detectedasarogue. ToimportanAPListfromafile,usethefollowingsteps:

1. ChoosewhethertoreplacetheexistingKnownAPlistoraddtheentriesintheimportedfiletotheKnown APlist. SelecttheReplaceoptiontoimportthelistandreplacethecontentsoftheKnownAPList. SelecttheMergeoptiontoimportthelistandaddtheAPsintheimportedfiletotheAPscurrently displayedintheKnownAPList. 2. ClickBrowseandchoosethefiletoimport. Thefileyouimportmustbeaplaintextfilewitha.txtor.cfgextension.EntriesinthefileareMAC addressesinhexidecimalformatwitheachoctetseparatedbycolons,forexample00:11:22:33:44:55. Separateentrieswithasinglespace.FortheAPtoacceptthefile,itmustcontainonlyMACaddresses. 3. ClickImport. Oncetheimportiscomplete,thescreenrefreshesandtheMACaddressesoftheAPsintheimportedfile appearintheKnownAPList. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page44 UnifiedAccessPointAdministratorsGuide ViewingManagedAPDHCPInformation ViewingManagedAPDHCPInformation TheUAPcanlearnaboutDLinkUnifiedWirelessSwitchesonthenetworkthroughDHCPresponsestoitsinitial DHCPrequest.TheManagedAPDHCPpagedisplaystheDNSnamesorIPaddressesofuptofourDLinkUnified WirelessSwitchesthattheAPlearnedaboutfromaDHCPserveronyournetwork. ForinformationabouthowtoconfigureaDHCPservertorespondtoAPDHCPrequestswiththeswitchIP addressinformation,seetheUserManualfortheswitch. ViewingTSPECStatusandStatisticsInformation TheTSPECStatusandStatisticspageprovides:

SummaryinformationaboutTSPECsessionsbyradio SummaryinformationaboutTSPECsessionsbyVAP RealtimetransmitandreceivestatisticsfortheTSPECVAPsonallradiointerfaces. AllofthetransmitandreceivestatisticsshownaretotalssincetheAPwaslaststarted.IfyoureboottheAP, thesefiguresindicatetransmitandreceivetotalssincethereboot. ToviewTSPECstatusandstatistics,clicktheTSPECStatusandStatisticstab. Figure10:ViewingTSPECStatusandStatistics D-Link November2011 UnifiedAccessPointAdministratorsGuide Page45 UnifiedAccessPointAdministratorsGuide ViewingTSPECStatusandStatisticsInformation Table13describestheinformationprovidedonTSPECStatusandStatisticspage. Table13:TSPECStatusandStatistics Field Description APandVAPStatus Interface AccessCategory Status ActiveTS TSClients IndicatesthenameoftheRadioorVAPinterface. IndicatesCurrentAccessCategoryassociatedwiththisTrafficStream(voiceorvideo). IndicateswhethertheTSPECsessionisenabled(up)ornot(down)forthecorresponding AccessCategory. Note:Thisisaconfigurationstatus(doesnotnecessarilyrepresentthecurrentsession activity). IndicatesthenumberofcurrentlyactiveTSPECTrafficStreamsforthisradioandAccess Category. IndicatesthenumberofTrafficStreamclientsassociatedwiththisradioandAccess Category. Time(in32microsecondpersecondunits)allocatedforthisAccessCategoryoverthe transmissionmediumtocarrydata.Thisvalueshouldbelessthanorequaltothe maximumbandwidthallowedoverthemediumforthisTS. Time(in32microsecondpersecondunits)ofunusedbandwidthforthisAccess MediumTime Unallocated Category. TransmitandReceiveStatistics TotalPackets MediumTime Admitted IndicatesthetotalnumberofTSpacketssent(inTransmittable)orreceived(inReceived table)bythisRadioforthespecifiedAccessCategory. IndicatesthetotalnumberofTSbytessent(inTransmittable)orreceived(inReceived table)bythisRadioforthespecifiedAccessCategory. TotalBytes TotalVoicePackets IndicatesthetotalnumberofTSvoicepacketssent(inTransmittable)orreceived(in TotalVoiceBytes Receivedtable)bythisAPforthisVAP. IndicatesthetotalTSvoicebytessent(inTransmittable)orreceived(inReceivedtable) bythisAPforthisVAP. TotalVideoPackets IndicatesthetotalnumberofTSvideopacketssent(inTransmittable)orreceived(in TotalVideoBytes Receivedtable)bythisAPforthisVAP. IndicatesthetotalTSvideobytessent(inTransmittable)orreceived(inReceivedtable) bythisAPforthisVAP. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page46 UnifiedAccessPointAdministratorsGuide ViewingTSPECAPStatisticsInformation ViewingTSPECAPStatisticsInformation TheViewTSPECAPStatisticspageprovidesinformationonthevoiceandvideoTrafficStreamsacceptedand rejectedbytheAP. ToviewTSPECAPstatistics,clicktheTSPECAPStatisticstab. Table14describestheinformationprovidedonTSPECAPStatisticspage. Table14:TSPECAPStatistics Field TSPECStatisticsSummaryfor VoiceACM TSPECStatisticsSummaryfor VideoACM Description Indicatesthetotalnumberofacceptedandthetotalnumberofrejected voiceTrafficStreams. Indicatesthetotalnumberofacceptedandthetotalnumberofrejected videoTrafficStreams. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page47 UnifiedAccessPointAdministratorsGuide ViewingRadioStatisticsInformation ViewingRadioStatisticsInformation TheRadioStatisticspageprovidesdetailedinformationaboutthepacketsandbytestransmittedandreceived ontheradiointerfaceofthisaccesspoint. Figure11:RadioStatistics ThefollowingtabledescribesdetailsabouttheRadioStatisticsinformation. Table15:RadioStatisticsInformation Field Radio Description Chooseeitherradio1orradio2toviewstatisticsfortheselectedradio

(DWL8600APandDWL6600APonly). TotalbytesreceivedbytheAPonthisradiointerface. TotalpacketstransmittedbytheAPonthisradiointerface. WLANPacketsReceived TotalpacketsreceivedbytheAPonthisradiointerface. WLANBytesReceived WLANPackets Transmitted WLANBytesTransmitted TotalbytestransmittedbytheAPonthisradiointerface. WLANPacketsReceive Dropped WLANBytesReceive Dropped WLANPacketsTransmit Dropped WLANBytesTransmit Dropped NumberofpacketstransmittedbytheAPonthisradiointerfacethatwere dropped. NumberofbytestransmittedbytheAPonthisradiointerfacethatweredropped. NumberofpacketsreceivedbytheAPonthisradiointerfacethatweredropped. NumberofbytesreceivedbytheAPonthisradiointerfacethatweredropped. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page48 UnifiedAccessPointAdministratorsGuide ViewingRadioStatisticsInformation Table15:RadioStatisticsInformation(Cont.) Field FragmentsReceived FragmentsTransmitted NumberoftransmittedMPDUwithanindividualaddressoranMPDUwitha Description CountofsuccessfullyreceivedMPDUframesoftypedataormanagement. MulticastFrames Received MulticastFrames Transmitted DuplicateFrameCount FailedTransmitCount TransmitRetryCount MultipleRetryCount RTSSuccessCount RTSFailureCount ACKFailureCount FCSErrorCount FramesTransmitted WEPUndecryptable Count multicastaddressoftypeDataorManagement. CountofMSDUframesreceivedwiththemulticastbitsetinthedestinationMAC address. CountofsuccessfullytransmittedMSDUframeswherethemulticastbitissetinthe destinationMACaddress. NumberoftimesaframeisreceivedandtheSequenceControlfieldindicatesisa duplicate. NumberoftimesanMSDUisnottransmittedsuccessfullyduetotransmitattempts exceedingeithertheshortretrylimitorthelongretrylimit. NumberoftimesanMSDUissuccessfullytransmittedafteroneormoreretries. NumberoftimesanMSDUissuccessfullytransmittedaftermorethanoneretry. CountofCTSframesreceivedinresponsetoanRTSframe. CountofCTSframesnotreceivedinresponsetoanRTSframe. CountofACKframesnotreceivedwhenexpected. CountofFCSerrorsdetectedinareceivedMPDUframe. CountofeachsuccessfullytransmittedMSDU. Countofencryptedframesreceivedandthekeyconfigurationofthetransmitter indicatesthattheframeshouldnothavebeenencryptedorthatframewas discardedduetothereceivingstationnotimplementingtheprivacyoption. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page49 UnifiedAccessPointAdministratorsGuide ViewingEmailAlertOperationalStatus ViewingEmailAlertOperationalStatus TheEmailAlertOperationalStatuspageprovidesinformationabouttheemailalertssentbasedonthesyslog messagesgeneratedintheAP. ToviewtheEmailAlertOperationalStatus,clicktheStatus>EmailAlertStatustab. Toconfiguretheemailalerts,seeConfiguringEmailAlertonpage106 Figure12:EmailAlertOperationalStatus ThefollowingtabledescribesdetailsabouttheEmailAlertOperationalStatus. Table16:EmailAlertStatus Field EmailAlertStatus NumberofEmailSent NumberofEmailFailed TimeSinceLastEmail Sent Description TheEmailAlertoperationalstatusThestatusiseitherUporDown.Thedefaultis Down. Thetotalnumberofemailsentsofar.Therangeisanunsignedintegerof32bits. Thedefaultis0. Thetotalnumberofemailfailuressofar.Therangeisanunsignedintegerof32 bits.Thedefaultis0. Thetimesincethelastemailwassent.Timeformatisused.Thedefaultis00days 00hours00mins00secs. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page50 UnifiedAccessPointAdministratorsGuide ManagingtheAccessPoint Section4:ManagingtheAccessPoint ThissectiondescribeshowtomanagetheUAPandcontainsthefollowingsubsections:

EthernetSettings WirelessSettings ModifyingRadioSettings ConfiguringRadioandVAPScheduler SchedulerAssociationSettings VirtualAccessPointSettings ConfiguringtheWirelessDistributionSystem(WDS) ControllingAccessbyMACAuthentication ConfiguringLoadBalancing ManagedAccessPointOverview Configuring802.1XAuthentication CreatingaManagementAccessControlList TheconfigurationpagesforthefeaturesinthissectionarelocatedundertheManageheadingonthe AdministrationWebUI. Note:ThewebbasedUIimagesinthissectionshowtheDWL8600APadministrationpages.Pages fortheDWL3600APdisplayinformationforoneradioonly. EthernetSettings Thedefaultwiredinterfacesettings,whichincludeDHCPandVLANinformation,mightnotworkforall networks. Bydefault,theDHCPclientontheUAPautomaticallybroadcastsrequestsfornetworkinformation.Ifyouwant touseastaticIPaddress,youmustdisabletheDHCPclientandmanuallyconfiguretheIPaddressandother networkinformation. ThemanagementVLANisVLAN1bydefault.ThisVLANisalsothedefaultuntaggedVLAN.Ifyoualreadyhave amanagementVLANconfiguredonyournetworkwithadifferentVLANID,youmustchangetheVLANIDof themanagementVLANontheAP. ToconfiguretheLANsettings,clicktheEthernetSettingstab. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page51 UnifiedAccessPointAdministratorsGuide EthernetSettings ThefollowingtabledescribesthefieldstovieworconfigureontheEthernetSettingspage. Figure13:EthernetSettings Field Hostname Table17:EthernetSettingsPage Description EnterahostnamefortheAP.ThehostnameappearsintheCLIprompt. Thehostnamehasthefollowingrequirements:

Thelengthmustbebetween163characters. Upperandlowercasecharacters,numbers,andhyphensareaccepted. Thefirstcharactermustbealetter(azorAZ),andthelastcharactercannotbea hyphen. MACAddress ManagementVLAN ID UntaggedVLAN ShowstheMACaddressfortheLANinterfacefortheEthernetportonthisAP.Thisisa readonlyfieldthatyoucannotchange. ThemanagementVLANistheVLANassociatedwiththeIPaddressyouusetoaccessthe AP.ThedefaultmanagementVLANIDis1. Provideanumberbetween1and4094forthemanagementVLANID. IfyoudisabletheuntaggedVLAN,alltrafficistaggedwithaVLANID. BydefaultalltrafficontheUAPusesVLAN1,whichisthedefaultuntaggedVLAN.This meansthatalltrafficisuntaggeduntilyoudisabletheuntaggedVLAN,changethe untaggedtrafficVLANID,orchangetheVLANIDforaVAPorclientusingRADIUS. UntaggedVLANID Provideanumberbetween1and4094fortheuntaggedVLANID.TrafficontheVLAN thatyouspecifyinthisfieldwillnotbetaggedwithaVLANID. IfyouselectDHCP,theUAPacquiresitsIPaddress,subnetmask,DNS,andgateway informationfromaDHCPserver. IfyouselectStaticIP,youmustenterinformationintheStaticIPAddress,SubnetMask, andDefaultGatewayfields. ConnectionType D-Link November2011 UnifiedAccessPointAdministratorsGuide Page52 UnifiedAccessPointAdministratorsGuide EthernetSettings Table17:EthernetSettingsPage(Cont.) Field StaticIPAddress SubnetMask DefaultGateway DNSNameservers IPv6AdminMode IPv6AutoConfig AdminMode Description EnterthestaticIPaddressinthetextboxes.ThisfieldisdisabledifyouuseDHCPasthe connectiontype. EntertheSubnetMaskinthetextboxes. EntertheDefaultGatewayinthetextboxes. SelectthemodefortheDNS. InDynamicmode,theIPaddressesfortheDNSserversareassignedautomaticallyvia DHCP.ThisoptionisonlyavailableifyouspecifiedDHCPfortheConnectionType. InManualmode,youmustassignstaticIPaddressestoresolvedomainnames. EnableordisableIPv6managementaccesstotheAP EnableordisableIPv6autoaddressconfigurationontheAP. WhenIPv6AutoConfigModeisenabled,automaticIPv6addressconfigurationand gatewayconfigurationisallowedbyprocessingtheRouterAdvertisementsreceivedon theLANport.TheAPcanhavemultipleautoconfiguredIPv6addresses. StaticIPv6Address EnterastaticIPv6address.TheAPcanhaveastaticIPv6addressevenifaddresseshave alreadybeenconfiguredautomatically. EnterthestaticIPv6prefixlength,whichisanintegerintherangeof0128. StaticIPv6Address PrefixLength IPv6 Autoconfigured GlobalAddresses IPv6LinkLocal Address DefaultIPv6 Gateway IftheAPhasbeenassignedoneormoreIPv6addressesautomatically,theaddressesare listed. ShowstheIPv6LinkLocaladdress,whichistheIPv6addressusedbythelocalphysical link.ThelinklocaladdressisnotconfigurableandisassignedbyusingtheIPv6Neighbor Discoveryprocess. EnterthedefaultIPv6gateway. Note:Afteryouconfigurethewiredsettings,youmustclickApplytoapplythechangesandtosave thesettings.ChangingsomesettingsmightcausetheAPtostopandrestartsystemprocesses.Ifthis happens,wirelessclientswilltemporarilyloseconnectivity.WerecommendthatyouchangeAP settingswhenWLANtrafficislow. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page53 UnifiedAccessPointAdministratorsGuide WirelessSettings WirelessSettings Wirelesssettingsdescribeaspectsofthelocalareanetwork(LAN)relatedspecificallytotheradiodeviceinthe accesspoint(802.11ModeandChannel)andtothenetworkinterfacetotheaccesspoint(MACaddressfor accesspointandWirelessNetworkname,alsoknownasSSID). Toconfigurethewirelessinterface,clicktheManage>WirelessSettingstab. Figure14:WirelessInterfaceConfiguration D-Link November2011 UnifiedAccessPointAdministratorsGuide Page54 UnifiedAccessPointAdministratorsGuide WirelessSettings Table18describesthefieldsandconfigurationoptionsavailableontheWirelessSettingspage. Field TSPECViolation Interval RadioInterface MACAddress Mode Table18:WirelessSettings Description Specifythetimeinterval(inseconds)fortheAPtoreport(throughthesystemlogand SNMPtraps)associatedclientsthatdonotadheretomandatoryadmissioncontrol procedures. Specifywhetheryouwanttheradiointerfaceonoroff. IndicatestheMediaAccessControl(MAC)addressesfortheinterface.DualradioAPshave auniqueMACaddressforeachradio. AMACaddressisapermanent,uniquehardwareaddressforanydevicethatrepresents aninterfacetothenetwork.TheMACaddressisassignedbythemanufacturer.Youcannot changetheMACaddress.Itisprovidedhereforinformationalpurposesasaunique identifierforaninterface. TheModedefinesthePhysicalLayer(PHY)standardtheradiouses. Selectoneofthefollowingmodesforradio1(DWL6600APandDWL8600APonly):

IEEE802.11aisaPHYstandardthatspecifiesoperatinginthe5GHzUNIIbandusing orthogonalfrequencydivisionmultiplexing(OFDM).Itsupportsdataratesranging from6to54Mbps. IEEE802.11a/noperatesinthe5GHzISMbandandincludessupportforboth802.11a and802.11ndevices.IEEE802.11nisanextensionofthe802.11standardthatincludes multipleinputmultipleoutput(MIMO)technology.IEEE802.11nsupportsdataranges ofupto248Mbpsandnearlytwicetheindoorrangeof802.11b,802.11g,and 802.11a. 5GHzIEEE802.11nistherecommendedmodefornetworkswith802.11ndevicesthat operateinthe5GHzfrequencythatdonotneedtosupport802.11adevices.IEEE 802.11ncanachieveahigherthroughputwhenitdoesnotneedtobecompatiblewith legacydevices(802.11a). Selectoneofthefollowingmodesforradio2:

IEEE802.11b/goperatesinthe2.4GHzISMband.IEEE802.11bisanenhancementof theinitial802.11PHYtoinclude5.5Mbpsand11Mbpsdatarates.Itusesdirect sequencespreadspectrum(DSSS)orfrequencyhoppingspreadspectrum(FHSS)as wellascomplementarycodekeying(CCK)toprovidethehigherdatarates.Itsupports dataratesrangingfrom1to11Mbps.IEEE802.11gisahigherspeedextension(upto 54Mbps)tothe802.11bPHY.Itusesorthogonalfrequencydivisionmultiplexing

(OFDM).Itsupportsdataratesrangingfrom1to54Mbps. IEEE802.11b/g/noperatesinthe2.4GHzISMbandandincludessupportfor802.11b, 802.11g,and802.11ndevices. 2.4GHzIEEE802.11nistherecommendedmodefornetworkswith802.11ndevices thatoperateinthe2.4GHzfrequencythatdonotneedtosupport802.11b/gdevices. IEEE802.11ncanachieveahigherthroughputwhenitdoesnotneedtobecompatible withlegacydevices(802.11b/g). D-Link November2011 UnifiedAccessPointAdministratorsGuide Page55 UnifiedAccessPointAdministratorsGuide WirelessSettings Field Channel StationIsolation AeroScout EngineProtocol Support Table18:WirelessSettings(Cont.) Description SelecttheChannel. Therangeofavailablechannelsisdeterminedbythemodeoftheradiointerface

.If youselect Auto forthechannel setting,theAP scansavailablechannels.and.selects a channel wherenotraffic isdetected. TheChanneldefinestheportionoftheradiospectrumtheradiousesfortransmittingand receiving.Eachmodeoffersanumberofchannels,dependingonhowthespectrumis licensedbynationalandtransnationalauthoritiessuchastheFederalCommunications Commission(FCC)ortheInternationalTelecommunicationUnion(ITUR). WhenautomaticchannelassignmentisenabledontheChannelManagementpagefor Clustering,thechannelpolicyfortheradioisautomaticallysettostaticmode,andthe AutooptionisnotavailablefortheChannelfield.Thisallowstheautomaticchannel featuretosetthechannelsfortheradiosinthecluster. ToenableStationIsolation,selectthecheckboxdirectlybesideit. WhenStationIsolationisdisabled,wirelessclientscancommunicatewithoneanother normallybysendingtrafficthroughtheAP. WhenStationIsolationisenabled,theAPblockscommunicationbetweenwirelessclients onthesameradioandVAP.TheAPstillallowsdatatrafficbetweenitswirelessclientsand wireddevicesonthenetwork,acrossaWDSlink,andwithotherwirelessclients associatedwithadifferentVAP,butnotamongwirelessclientsassociatedwiththesame VAP. Note:OndualradioAPs,StationIsolationdoesnotblockcommunicationbetweenRadio1 andRadio2,eveniftheVAPconfigurationoneachradioisthesame. AeroScoutEnginesupportprovideslocationbasedservicesforwirelessnetworks.Specify whethertoenablesupportfortheAeroScoutprotocol. OptionsareEnabledorDisabled.ThedefaultisDisabled.Whenenabled,Aeroscout devicesarerecognizedanddataissenttoanAeroscoutEngine(AE)foranalysis.TheAE determinesthegeographicallocationof802.11capabledevices,suchasSTAs,APs,and AeroScoutslineof802.11enabledRFIDdevices,ortags.TheAEcommunicateswithAPs thatsupporttheAEprotocolinordertocollectinformationabouttheRFdevicesdetected bytheAPs.UsingtheAEprotocol,DLinksupportsdirectcommunicationbetweenAEand theAPs.Whenoperatinginmanagedmode,theAEisconfiguredwiththeIPaddressofthe managedaccesspointsfromwhichitcollectsinformation.TheWirelessSwitchcannot communicatewiththeAE. FormoreinformationabouttheAeroScoutprotocol,seeEnablingAeroScoutEngine Supportonpage57. Note:OnlyAeroScouttaghardwareoftypesT2andT3areexplicitlysupported.Othertag modelsarealsosupportedonlyiftheirimplementationoftheAeroScoutprotocol conformstotheAeroScoutEngineAccessPointInterfaceSpecification,version2.1. Note:AeroScouttagsoperateonlyin802.11b/gmode.Therefore,networkadministrators whousetheAeroScouttagsmustconfigureatleastoneradioonAPsthatareexpectedto detecttagsineither802.11b/gor802.11b/g/nmode.Theradiosconfiguredin2.4GHz IEEE802.11modeoranyofthe5GHZmodescannotdetectAeroScouttags. Note:TheAEprotocolallowsaccesspointstomarkdetectedAPsasroguedevices.TheD LinkAPsdonotsupportthisfeatureandneverreportdetectedAPsasrogues. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page56 UnifiedAccessPointAdministratorsGuide WirelessSettings Note:Afteryouconfigurethewirelesssettings,youmustclickApplytoapplythechangesandtosave thesettings.ChangingsomesettingsmightcausetheAPtostopandrestartsystemprocesses.Ifthis happens,wirelessclientswilltemporarilyloseconnectivity.WerecommendthatyouchangeAP settingswhenWLANtrafficislow. Usingthe802.11hWirelessMode For802.11aradios,iftheregulatorydomainrequiresradardetectiononthechannel,theDynamicFrequency Selection(DFS)andTransmitPowerControl(TPC)featuresof802.11hareautomaticallyactivated. ThereareanumberofkeypointsabouttheIEEE802.11hstandard:

802.11honlyworksforthe802.11aband.Itisnotrequiredfor802.11bor802.11g. Ifyouareoperatinginan802.11henableddomain,theAPattemptstousethechannelyouassign.Ifthe channelhasbeenblockedbyapreviousradardetection,oriftheAPdetectsaradaronthechannel,then theAPautomaticallyselectsadifferentchannel. When802.11hisenabled,theAPwillnotbeoperationalinthe5GHzbandforatleast60secondsdueto radarscanning. SettingupWDSlinksmaybedifficultwhen802.11hisoperational.Thisisbecausetheoperatingchannels ofthetwoAPsontheWDSlinkmaykeepchangingdependingonchannelusageandradarinterference. WDSwillonlyworkifboththeAPsoperateonthesamechannel.FormoreinformationonWDS,see ConfiguringLoadBalancingonpage88. EnablingAeroScoutEngineSupport TheAeroScoutEngine(AE)isasoftwareplatformproducedbyAeroScoutInc.forlocationbasedservices.The AEcandeterminethephysicallocationof802.11capableAeroScoutdevices.TheAEcommunicateswithAPs thathavetheAEprotocolenabledinordertocollectinformationabouttheRFdevicesdetectedbytheAPs. TheDWS4000SeriesswitchsupportsonlydirectcommunicationbetweentheAEandtheAPs.When operatinginmanagedmode,theAEisconfiguredwiththeIPaddressofthemanagedaccesspointsfromwhich itcollectsinformation.TheDWS4000SeriesswitchdoesnotcommunicatewiththeAE. AeroScouttagsoperateonlyin802.11b/gmode.Therefore,networkadministratorswhousetheAeroScout tagsmustconfigureatleastoneradioonAPsthatareexpectedtodetecttagsineither802.11b/gor 802.11b/g/nmode.Theradiosconfiguredin2.4GHzIEEE802.11nmodeoranyofthe5GHzmodescannot detectAeroScouttags. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page57 UnifiedAccessPointAdministratorsGuide ModifyingRadioSettings Note:ThefollowingnotesapplytoAeroScoutproductandprotocolsupport:

DLinkdoesnotsellAeroScoutproducts.ContactAeroScoutforAeroScouthardware,softwareor deploymentinformation. TheAEprotocoldoesnotsupportanyauthenticationorencryptionbetweentheAEserverand theaccesspoint. TheAEprotocolrequiresradiostooperateinpromiscuousmode.ThismeansthattheAPreceives andprocessesallpacketsdetectedbytheradios,asopposedtoprocessingonlypacketsdestined totheAPsBSSID.ThiscanaffectAPthroughput. ModifyingRadioSettings RadiosettingsdirectlycontrolthebehavioroftheradiodevicesintheAPanditsinteractionwiththephysical medium;thatis,howandwhattypeofelectromagneticwavestheAPemits. Tospecifyradiosettings,clicktheRadiotabintheManagesection. Differentsettingsdisplaydependingonthemodeyouselect.AllsettingsaredescribedinTable19onpage60. Figure15:ConfiguringRadioSettings D-Link November2011 UnifiedAccessPointAdministratorsGuide Page58 UnifiedAccessPointAdministratorsGuide ModifyingRadioSettings Figure16:ConfiguringRadioSettings(Continued) D-Link November2011 UnifiedAccessPointAdministratorsGuide Page59 UnifiedAccessPointAdministratorsGuide ModifyingRadioSettings Table19describesthefieldsandconfigurationoptionsfortheRadioSettingspage. Note:TheDWL3600APsupportsonlyoneradio,anditoperatesinthe2.4GHzband(802.11b/g/n). SomefieldsinthefollowingtablearenotavailablefortheDWL3600AP. Field Radio Status(On/Off) Mode Table19:RadioSettings Description SelectRadio1orRadio2tospecifywhichradiotoconfigure.Therestofthesettingson thispageapplytotheradioyouselectinthisfield.Besuretoconfiguresettingsforboth radios. Radio1operatesinthe5GHzband(802.11a/n),andRadio2operatesinthe2.4GHz band(802.11b/g/n). SpecifywhetheryouwanttheradioonoroffbyclickingOnorOff. Ifyouturnoffaradio,theAPsendsdisassociationframestoallthewirelessclientsitis currentlysupportingsothattheradiocanbegracefullyshutdownandtheclientscan starttheassociationprocesswithotheravailableAPs. TheModedefinesthePhysicalLayer(PHY)standardtheradiouses. Note:Themodesavailabledependontheradioselected. Selectoneofthefollowingmodesforradio1(DWL6600APandDWL8600APonly):

IEEE802.11aisaPHYstandardthatspecifiesoperatinginthe5GHzUNIIbandusing orthogonalfrequencydivisionmultiplexing(OFDM).Itsupportsdataratesranging from6to54Mbps. IEEE802.11a/noperatesinthe5GHzISMbandandincludessupportforboth 802.11aand802.11ndevices.IEEE802.11nisanextensionofthe802.11standard thatincludesmultipleinputmultipleoutput(MIMO)technology.IEEE802.11n supportsdatarangesofupto248Mbpsandnearlytwicetheindoorrangeof802.11 b,802.11g,and802.11a. 5GHzIEEE802.11nistherecommendedmodefornetworkswith802.11ndevices thatoperateinthe5GHzfrequencythatdonotneedtosupport802.11adevices. IEEE802.11ncanachieveahigherthroughputwhenitdoesnotneedtobe compatiblewithlegacydevices(802.11a). Selectoneofthefollowingmodesforradio2:

IEEE802.11b/goperatesinthe2.4GHzISMband.IEEE802.11bisanenhancement oftheinitial802.11PHYtoinclude5.5Mbpsand11Mbpsdatarates.Itusesdirect sequencespreadspectrum(DSSS)orfrequencyhoppingspreadspectrum(FHSS)as wellascomplementarycodekeying(CCK)toprovidethehigherdatarates.Itsupports dataratesrangingfrom1to11Mbps.IEEE802.11gisahigherspeedextension(up to54Mbps)tothe802.11bPHY.Itusesorthogonalfrequencydivisionmultiplexing

(OFDM).Itsupportsdataratesrangingfrom1to54Mbps. IEEE802.11b/g/noperatesinthe2.4GHzISMbandandincludessupportfor 802.11b,802.11g,and802.11ndevices. 2.4GHzIEEE802.11nistherecommendedmodefornetworkswith802.11ndevices thatoperateinthe2.4GHzfrequencythatdonotneedtosupport802.11b/gdevices. IEEE802.11ncanachieveahigherthroughputwhenitdoesnotneedtobe compatiblewithlegacydevices(802.11b/g). D-Link November2011 UnifiedAccessPointAdministratorsGuide Page60 UnifiedAccessPointAdministratorsGuide ModifyingRadioSettings Table19:RadioSettings(Cont.) Field Channel ChannelBandwidth

(802.11nmodes only) PrimaryChannel

(802.11nmodes only) ShortGuard IntervalSupported Description SelecttheChannel. Therangeofavailablechannelsisdeterminedbythemodeoftheradiointerface. If youselect Auto forthechannelsetting,theAP scansavailable hannels.and selects a channel wherenotraffic isdetected. Thechanneldefinestheportionoftheradiospectrumtheradiousesfortransmittingand receiving.Eachmodeoffersanumberofchannels,dependingonhowthespectrumis licensedbynationalandtransnationalauthoritiessuchastheFederalCommunications Commission(FCC)ortheInternationalTelecommunicationUnion(ITUR). WhenautomaticchannelassignmentisenabledontheChannelManagementpagefor Clustering,thechannelpolicyfortheradioisautomaticallysettostaticmode,andthe AutooptionisnotavailablefortheChannelfield.Thisallowstheautomaticchannel featuretosetthechannelsfortheradiosinthecluster. The802.11nspecificationallowsa40MHzwidechannelinadditiontothelegacy20 MHzchannelavailablewithothermodes.The40MHzchannelenableshigherdatarates butleavesfewerchannelsavailableforusebyother2.4GHzand5GHzdevices. Setthefieldto20MHztorestricttheuseofthechannelbandwidthtoa20MHz channel. Thissettingcanbechangedonlywhenthechannelbandwidthissetto40MHz.A40 MHzchannelcanbeconsideredtoconsistoftwo20MHzchannelsthatarecontiguous inthefrequencydomain.Thesetwo20MHzchannelsareoftenreferredtoasthe PrimaryandSecondarychannels.ThePrimaryChannelisusedfor802.11nclientsthat supportonlya20MHzchannelbandwidthandforlegacyclients. Selectoneofthefollowingoptions:

UpperSetthePrimaryChannelastheupper20MHzchannelinthe40MHzband. LowerSetthePrimaryChannelasthelower20MHzchannelinthe40MHzband. Thisfieldisavailableonlyiftheselectedradiomodeincludes802.11n. Theguardintervalisthedeadtime,innanoseconds,betweenOFDMsymbols.Theguard intervalpreventsInterSymbolandInterCarrierInterference(ISI,ICI).The802.11nmode allowsforareductioninthisguardintervalfromtheaandgdefinitionof800 nanosecondsto400nanoseconds.Reducingtheguardintervalcanyielda10%

improvementindatathroughput. Selectoneofthefollowingoptions:

YesTheAPtransmitsdatausinga400nsguardIntervalwhencommunicatingwith clientsthatalsosupporttheshortguardinterval. STBCMode NoTheAPtransmitsdatausingan800nsguardinterval. Thisfieldisavailableonlyiftheselectedradiomodeincludes802.11n. SpaceTimeBlockCoding(STBC)isan802.11ntechniqueintendedtoimprovethe reliabilityofdatatransmissions.Thedatastreamistransmittedonmultipleantennasso thereceivingsystemhasabetterchanceofdetectingatleastoneofthedatastreams. Selectoneofthefollowingoptions:

OnTheAPtransmitsthesamedatastreamonmultipleantennasatthesametime. OffTheAPdoesnottransmitsthesamedataonmultipleantennas. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page61 UnifiedAccessPointAdministratorsGuide ModifyingRadioSettings Field Protection BeaconInterval DTIMPeriod Fragmentation Threshold Table19:RadioSettings(Cont.) Description Theprotectionfeaturecontainsrulestoguaranteethat802.11ntransmissionsdonot causeinterferencewithlegacystationsorAPs.Bydefault,theseprotectionmechanisms areenabled(Auto).Withprotectionenabled,protectionmechanismswillbeinvokedif legacydevicesarewithinrangeoftheAP.Thiscausesmoreoverheadonevery transmission,whichwillimpactperformance.However,thereisnoimpacton performanceiftherearenolegacydeviceswithinrangeoftheAP. Youcandisable(Off)theseprotectionmechanisms;however,when802.11nprotection isoff,legacyclientsorAPswithinrangecanbeaffectedby802.11ntransmissions.The 802.11protectionfeatureisalsoavailablewhenthemodeis802.11b/g.When protectionisenabledinthismode,itprotects802.11bclientsandAPsfrom802.11g transmissions. Note:ThissettingdoesnotaffecttheabilityoftheclienttoassociatewiththeAP. BeaconframesaretransmittedbyanAPatregularintervalstoannouncetheexistence ofthewirelessnetwork.Thedefaultbehavioristosendabeaconframeonceevery100 milliseconds(or10persecond). Enteravaluefrom20to2000milliseconds. SpecifyaDTIMperiodfrom1to255beacons. TheDeliveryTrafficInformationMap(DTIM)messageisanelementincludedinsome Beaconframes.Itindicateswhichclientstations,currentlysleepinginlowpowermode, havedatabufferedontheAPawaitingpickup. TheDTIMperiodyouspecifyindicateshowoftentheclientsservedbythisAPshould checkforbuffereddatastillontheAPawaitingpickup. Themeasurementisinbeacons.Forexample,ifyousetthisfieldto1,clientswillcheck forbuffereddataontheAPateverybeacon.Ifyousetthisfieldto10,clientswillcheck onevery10thbeacon. Specifyanumberbetween256and2,346tosettheframesizethresholdinbytes. Thefragmentationthresholdisawayoflimitingthesizeofpackets(frames)transmitted overthenetwork.Ifapacketexceedsthefragmentationthresholdyouset,the fragmentationfunctionisactivatedandthepacketissentasmultiple802.11frames. Ifthepacketbeingtransmittedisequaltoorlessthanthethreshold,fragmentationisnot used. Settingthethresholdtothelargestvalue(2,346bytes)effectivelydisables fragmentation.FragmentationplaysnorolewhenAggregationisenabled. Fragmentationinvolvesmoreoverheadbothbecauseoftheextraworkofdividingup andreassemblingofframesitrequires,andbecauseitincreasesmessagetrafficonthe network.However,fragmentationcanhelpimprovenetworkperformanceandreliability ifproperlyconfigured. Sendingsmallerframes(byusinglowerfragmentationthreshold)mighthelpwithsome interferenceproblems;forexample,withmicrowaveovens. Bydefault,fragmentationisoff.Werecommendnotusingfragmentationunlessyou suspectradiointerference.Theadditionalheadersappliedtoeachfragmentincreasethe overheadonthenetworkandcangreatlyreducethroughput. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page62 UnifiedAccessPointAdministratorsGuide ModifyingRadioSettings Field RTSThreshold Table19:RadioSettings(Cont.) Description SpecifyaRequesttoSend(RTS)Thresholdvaluebetween0and2347. TheRTSthresholdindicatesthenumberofoctetsinanMPDU,belowwhichanRTS/CTS handshakeisnotperformed. ChangingtheRTSthresholdcanhelpcontroltrafficflowthroughtheAP,especiallyone withalotofclients.Ifyouspecifyalowthresholdvalue,RTSpacketswillbesentmore frequently.Thiswillconsumemorebandwidthandreducethethroughputofthepacket. Ontheotherhand,sendingmoreRTSpacketscanhelpthenetworkrecoverfrom interferenceorcollisionswhichmightoccuronabusynetwork,oronanetwork experiencingelectromagneticinterference. MaximumStations SpecifythemaximumnumberofstationsallowedtoaccessthisAPatanyonetime. TransmitPower FixedMulticast Rate LegacyRateSets MCS(DataRate) Settings(802.11n modesonly) Broadcast/

MulticastRate Limiting Broadcast/

MulticastRateLimit Broadcast/

MulticastRateLimit Burst D-Link November2011 Youcanenteravaluebetween0and200. EnterapercentagevalueforthetransmitpowerlevelforthisAP. Thedefaultvalue,whichis100%,canbemorecostefficientthanalowerpercentage sinceitgivestheAPamaximumbroadcastrangeandreducesthenumberofAPsneeded. Toincreasecapacityofthenetwork,placeAPsclosertogetherandreducethevalueof thetransmitpower.ThishelpsreduceoverlapandinterferenceamongAPs.Alower transmitpowersettingcanalsokeepyournetworkmoresecurebecauseweakerwireless signalsarelesslikelytopropagateoutsideofthephysicallocationofyournetwork. SelectthemulticasttraffictransmissionrateyouwanttheAPtosupport. CheckthetransmissionratesetsyouwanttheAPtosupportandthebasicratesetsyou wanttheAPtoadvertise:

Ratesareexpressedinmegabitspersecond. SupportedRateSetsindicateratesthattheAPsupports.Youcancheckmultiplerates

(clickacheckboxtoselectordeselectarate).TheAPwillautomaticallychoosethe mostefficientratebasedonfactorslikeerrorratesanddistanceofclientstations fromtheAP. BasicRateSetsindicateratesthattheAPwilladvertisetothenetworkforthe purposesofsettingupcommunicationwithotherAPsandclientstationsonthe network.ItisgenerallymoreefficienttohaveanAPbroadcastasubsetofits supportedratesets. ThisfieldshowstheModulationandCodingScheme(MCS)indexvaluessupportedby theradio.Eachindexcanbeenabledanddisabledindependently. Enablingmulticastandbroadcastratelimitingcanimproveoverallnetworkperformance bylimitingthenumberofpacketstransmittedacrossthenetwork. BydefaulttheMulticast/BroadcastRateLimitingoptionisdisabled.Untilyouenable Multicast/BroadcastRateLimiting,thefollowingfieldswillbedisabled. Entertheratelimityouwanttosetformulticastandbroadcasttraffic.Thelimitshould begreaterthan1,butlessthan50packetspersecond.Anytrafficthatfallsbelowthis ratelimitwillalwaysconformandbetransmittedtotheappropriatedestination. Thedefaultandmaximumratelimitsettingis50packetspersecond. Settingaratelimitburstdetermineshowmuchtrafficburstscanbebeforealltraffic exceedstheratelimit.Thisburstlimitallowsintermittentburstsoftrafficonanetwork abovethesetratelimit. Thedefaultandmaximumratelimitburstsettingis75packetspersecond. UnifiedAccessPointAdministratorsGuide Page63 UnifiedAccessPointAdministratorsGuide ModifyingRadioSettings Table19:RadioSettings(Cont.) Description RegulatestheoverallTSPECmodeontheAP.Theoptionsare:

OnTheAPhandlesTSPECrequestsaccordingtotheTSPECsettingsyouconfigure ontheRadiopage.UsethissettingiftheAPhandlestrafficfromQoScapable devices,suchasaWiFiCERTIFIEDphone. OffTheAPignoresTSPECrequestsfromclientstations.Usethissettingifyoudo notwanttouseTSPECtogiveQoScapabledevicespriorityfortimesensitivetraffic. Regulatesmandatoryadmissioncontrol(ACM)forthevoiceaccesscategory.Theoptions are:

OnAstationisrequiredtosendaTSPECrequestforbandwidthtotheAPbefore sendingorreceivingavoicetrafficstream.TheAPrespondswiththeresultofthe request,whichincludestheallottedmediumtimeiftheTSPECwasadmitted. OffAstationcansendandreceivevoiceprioritytrafficwithoutrequiringan admittedTSPEC;theAPignoresvoiceTSPECrequestsfromclientstations. SpecifyanupperlimitontheamountoftraffictheAPattemptstotransmitonthe wirelessmediumusingavoiceACtogainaccess. Regulatesmandatoryadmissioncontrolforthevideoaccesscategory.Theoptionsare:

OnAstationisrequiredtosendaTSPECrequestforbandwidthtotheAPbefore sendingorreceivingavideotrafficstream.TheAPrespondswiththeresultofthe request,whichincludestheallottedmediumtimeiftheTSPECwasadmitted. OffAstationcansendandreceivevideoprioritytrafficwithoutrequiringan admittedTSPEC;theAPignoresvideoTSPECrequestsfromclientstations. SpecifyanupperlimitontheamountoftraffictheAPattemptstotransmitonthe wirelessmediumusingavideoACtogainaccess. SpecifytheamountoftimeforanAPtodetectandownlinkTSasidlebeforedeletingit. SpecifytheamountoftimeforanAPtodetectanuplinkTSasidlebeforedeletingit. SelectEnabletoallowintermixingoflegacytrafficonqueuesoperatingasACM. Field TSPECMode TSPECVoiceACM Mode TSPECVoiceACM Limit TSPECVideoACM Mode TSPECVideoACM Limit TSPECAPInactivity Timeout TSPECStation InactivityTimeout TSPECLegacyWMM QueueMapMode UsetheRadiopagetoconfigurebothRadioOneandRadioTwo.Thesettingsonthepageapplyonlytothe radiothatyouchoosefromtheRadiodropdownlist.Afteryouconfiguresettingsforoneoftheradios,click Applyandthenselectandconfiguretheotherradio.BesuretoclickApplytoapplythesecondsetof configurationsettingsfortheotherradio. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page64 UnifiedAccessPointAdministratorsGuide ConfiguringRadioandVAPScheduler ConfiguringRadioandVAPScheduler TheRadioandVAPschedulerisastandaloneDWLx600APfeature.ToconfiguretheRadioandVAPscheduler, selecttheSchedulertabintheManagesection.TheRadioandVAPSchedulerallowsyoutoconfigurearule withaspecifictimeintervalforVAPsorradiostobeoperational,therebyautomatingtheenablingordisabling oftheVAPsandRadios. Oneofthewaysyoucanusethisfeatureistoscheduleradiostooperateonlyduringtheofficeworkinghours inordertoachievesecurityandreducepowerconsumption.YoucanalsousetheSchedulertoallowaccessto VAPsforwirelessclientsonlyduringspecifictimesofday. Eachrulespecifiesthestarttime,endtimeandday(ordays)oftheweektheradioorVAPcanbeoperational. Therulesareperiodicinnatureandarerepeatedeveryweek. Avalidrulemustcontainallofthefollowingparameters:

DaysoftheWeek StartTime(hourandminutes) EndTime(hourandminutes) Onlyvalidrulesareaddedtotheprofile.Upto16rulesaregroupedtogethertoformaschedulingprofile.Any twoperiodicrulestimeentriesbelongingtothesameprofilemustnotoverlap.Thetimegranularityforthe schedulesisoneminute.TheDWLx600APsupportsupto16profiles. Figure17:SchedulerConfiguration D-Link November2011 UnifiedAccessPointAdministratorsGuide Page65 UnifiedAccessPointAdministratorsGuide ConfiguringRadioandVAPScheduler Table20:SchedulerConfiguration Field GlobalSchedulerMode Aglobalswitchtoenableordisabletheschedulerfeature.ThedefaultisDisable. Description SchedulerOperationalStatus Status Reason SchedulerProfile Rule Configuration SelectProfile SetSchedule StartTime EndTime TheoperationalstatusoftheScheduler.TherangeisUporDown.Thedefaultis Down. Providesadditionalinformationaboutthestatus.Thereasoncanbeoneormoreof thefollowing:

IsActiveOperationalstatusisup. ConfigDownOperationalstatusisdownbecauseglobalconfigurationis disabled. TimeNotSetOperationalstatusisdownbecausetheAPtimehasnotbeenset, eithermanuallyorbyspecifyinganNTPservertouse. ManagedModeOperationalstatusisdownbecausetheAPisinmanaged mode. TheSchedulerprofiledefinesthelistofprofilesnamesthatcanbeassociatedtothe VAPorRadioconfiguration.Rulesareassociatedwithanamedschedulerprofile.You candefineupto16schedulerprofilenames.Bydefault,noprofilesarecreated. Theprofilenamecanbeupto32alphanumericcharacters.ClickAddtoaddthe profilename. Eachschedulerprofilemayhaveupto16periodicrules.Thelistofparametersfor eachperiodicrulearedescribedbelow. Selecttheprofilenamefromthemenu. Thedayoftheweek.Rangeis:Daily,Weekday(MondaytoFriday),Weekend

(SaturdayandSunday),Monday,Tuesday,Wednesday,Thursday,Friday,Saturday, Sunday.ThedefaultisDaily. ThetimewhentheradioorVAPwillbeoperationallyenabled.ThetimeisinHH:MM 24hourformat.Therangeis<0024>:<0059>.Thedefaultis00:00. ThetimewhentheradioorVAPwillbeoperationallydisabled.ThetimeisinHH:MM 24hourformat.Therangeis<0024>:<0059>.Thedefaultis00:00. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page66 UnifiedAccessPointAdministratorsGuide ConfiguringRadioandVAPScheduler Tochangeanexistingrule,selecttherule,updatethevaluesintheRuleConfigurationarea,andclickModify Rule. ClickApplytosavethenewconfigurationsettings. Figure18:ModifyRuleConfiguration Note:Aftermakinganymodifications,youmustclickApplytoapplythechangesandtosavethe settings. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page67 UnifiedAccessPointAdministratorsGuide SchedulerAssociationSettings SchedulerAssociationSettings ForaSchedulerprofiletotakeeffect,youmustassociateitwithatleastoneradioorVAPinterface.Toassociate theSchedulerprofiles,selecttheSchedulerAssociationtabintheManagesection.Bydefault,thereareno Schedulerprofilescreated,sonoprofileisassociatedtoanyradioorVAP.TheSchedulerprofileneedstobe explicitlyassociatedtoaradioorVAPconfiguration.OnlyoneSchedulerprofilecanbeassociatedtoanyradio orVAPconfiguration;however,asingleprofilecanbeassociatedtomultipleradiosorVAPs.IftheScheduler profileassociatedwithaVAPorradioisdeleted,thentheassociatedprofiletotheVAPorradioisremoved implicitly.Iftheradioisoperationallydisabled,thenalltheVAPsassociatedtothatradioarealsooperationally disabledirrespectiveoftheVAPconfiguration. Figure19:SchedulerAssociation D-Link November2011 UnifiedAccessPointAdministratorsGuide Page68 UnifiedAccessPointAdministratorsGuide SchedulerAssociationSettings Field Description Table21:SchedulerAssociationSettings RadioSchedulerProfileOperationalStatus 1or2 Status VAPSchedulerProfileOperationalStatus Radio Fromthemenu,selecttheSchedulerprofiletoassociatewithRadio1orRadio2. Note:TheDWL3600APsupportsonlyoneradio. TheoperationalstatusoftheScheduler.TherangeisUporDown. 015 Status Fromthemenu,selectRadio1orRadio2toassociatetheVAPSchedulerProfile. Note:ThisfieldisnotavailableontheDWL3600AP. Fromthemenu,selecttheSchedulerprofiletoassociatewiththerespectiveVAP. TheoperationalstatusoftheScheduler.TherangeisUporDown. Note:AfteryouassociateaSchedulerprofilewithaRadiointerfaceoraVAPinterface,youmustclick Applytoapplythechangesandtosavethesettings. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page69 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings VirtualAccessPointSettings TochangeVAP0ortoenableandconfigureadditionalVAPs,selecttheVAPtabintheManagesection. VAPssegmentthewirelessLANintomultiplebroadcastdomainsthatarethewirelessequivalentofEthernet VLANs.VAPssimulatemultipleAPsinonephysicalAP.Eachradiosupportsupto16VAPs. ForeachVAP,youcancustomizethesecuritymodetocontrolwirelessclientaccess.EachVAPcanalsohavea uniqueSSID.MultipleSSIDsmakeasingleAPlookliketwoormoreAPstoothersystemsonthenetwork.By configuringVAPs,youcanmaintainbettercontroloverbroadcastandmulticasttraffic,whichaffectsnetwork performance. YoucanconfigureeachVAPtouseadifferentVLAN,oryoucanconfiguremultipleVAPstousethesameVLAN, whethertheVLANisonthesameradiooronadifferentradio.VAP0,whichisalwaysenabledonbothradios, isassignedtothedefaultVLAN1. TheAPaddsVLANIDtagstowirelessclienttrafficbasedontheVLANIDyouconfigureontheVAPpageorby usingtheRADIUSserverassignment.IfyouuseanexternalRADIUSserver,youcanconfiguremultipleVLANs oneachVAP.TheexternalRADIUSserverassignswirelessclientstotheVLANwhentheclientsassociateand authenticate. YoucanconfigureuptofourglobalIPv4orIPv6RADIUSservers.Oneoftheserversalwaysactsasaprimary whiletheothersactasbackupservers.Thenetworktype(IPv4orIPv6)andaccountingmodearecommon acrossallconfiguredRADIUSservers.YoucanconfigureeachVAPtousetheglobalRADIUSserversettings, whichisthedefault,oryoucanconfigureaperVAPRADIUSserverset.YoucanalsoconfigureseparateRADIUS serversettingsforeachVAP.Forexample,youcanconfigureoneVAPtouseanIPv6RADIUSserverwhileother VAPsusetheglobalIPv4RADIUSserversettingsyouconfigure. IfwirelessclientsuseasecuritymodethatdoesnotcommunicatewiththeRAIDUSserver,oriftheRADIUS serverdoesnotprovidetheVLANinformation,youcanassignaVLANIDtoeachVAP.TheAPassignstheVLAN toallwirelessclientsthatconnecttotheAPthroughthatVAP. Note:BeforeyouconfigureVLANsontheAP,besuretoverifythattheswitchandDHCPservertheAP usescansupportIEEE802.1QVLANencapsulation. TosetupmultipleVAPs,clickManage>VAP. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page70 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings Figure20:SettingUpVirtualAccessPoints Table22describesthefieldsandconfigurationoptionsontheVAPpage. Table22:VirtualAccessPointSettings Field RADIUSIPAddress Type RADIUSIPAddress RADIUSIPv6 Address RADIUSIPorIPv6 Address13 Description SpecifytheIPversionthattheRADIUSserveruses. YoucantogglebetweentheaddresstypestoconfigureIPv4andIPv6globalRADIUS addresssettings,buttheAPcontactsonlytheRADIUSserverorserversfortheaddress typeyouselectinthisfield. EntertheIPv4orIPv6addressfortheprimaryglobalRADIUSserver.Bydefault,eachVAP usestheglobalRADIUSsettingsthatyoudefinefortheAPatthetopoftheVAPpage. WhenthefirstwirelessclienttriestoauthenticatewiththeAP,theAPsendsan authenticationrequesttotheprimaryserver.Iftheprimaryserverrespondstothe authenticationrequest,theAPcontinuestousethisRADIUSserverastheprimaryserver, andauthenticationrequestsaresenttotheaddressyouspecify. IftheIPv4RADIUSIPAddressTypeoptionisselectedinthepreviousfield,entertheIP addressoftheRADIUSserverthatallVAPsusebydefault,forexample192.168.10.23.If theIPv6RADIUSIPAddressTypeoptionisselected,entertheIPv6addressoftheprimary globalRADIUSserver,forexample2001:0db8:1234::abcd. EnteruptothreeIPv4orIPv6addressestouseasthebackupRADIUSservers.Thefield labelisRADIUSIPAddresswhentheIPv4RADIUSIPAddressTypeoptionisselectedand RADIUSIPv6AddresswhentheIPv6RADIUSIPAddressTypeoptionisselected. Ifauthenticationfailswiththeprimaryserver,eachconfiguredbackupserveristriedin sequence.TheIPv4orIPv6addressmustbevalidinorderfortheAPtoattemptto contacttheserver. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page71 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings Field RADIUSKey RADIUSKey13 EnableRADIUS Accounting EnableRADIUS FailThrough Radio VAP Enabled VLANID SSID Table22:VirtualAccessPointSettings(Cont.) Description EntertheRADIUSkeyinthetextbox. TheRADIUSKeyisthesharedsecretkeyfortheglobalRADIUSserver.Youcanuseupto 63standardalphanumericandspecialcharacters.Thekeyiscasesensitive,andyoumust configurethesamekeyontheAPandonyourRADIUSserver.Thetextyouenterwillbe displayedas*characterstopreventothersfromseeingtheRADIUSkeyasyoutype. EntertheRADIUSkeyassociatedwiththeconfiguredbackupRADIUSservers.Theserver atRADIUSIPAddress1usesRADIUSKey1,RADIUSIPAddress2usesRADIUSKey2,and soon. Selectthisoptiontotrackandmeasuretheresourcesaparticularuserhasconsumed suchassystemtime,amountofdatatransmittedandreceived,andsoon. IfyouenableRADIUSaccounting,itisenabledfortheprimaryRADIUSserverandall backupservers. SelectthisoptiontoallowthesecondaryRADIUSservertoauthenticatewirelessclients iftheauthenticationwiththeprimaryRADIUSserverisunsuccessful,oriftheprimary RADIUSserverisunavailable. Selecttheradiotoconfigure.VAPsareconfiguredindependentlyoneachradio. Note:TheDWL3600APsupportsonlyoneradio. Youcanconfigureupto16VAPsforeachradio.VAP0isthephysicalradiointerface,soto disableVAP0,youmustdisabletheradio. Youcanenableordisableaconfigurednetwork. Toenablethespecifiednetwork,selecttheEnabledoptionbesidetheappropriate VAP. Todisablethespecifiednetwork,cleartheEnabledoptionbesidetheappropriate VAP. Ifyoudisablethespecifiednetwork,youwilllosetheVLANIDyouentered. WhenawirelessclientconnectstotheAPbyusingthisVAP,theAPtagsalltrafficfrom thewirelessclientwiththeVLANIDyouenterinthisfieldunlessyouentertheuntagged VLANIDoruseaRADIUSservertoassignawirelessclienttoaVLAN.Therangeforthe VLANIDis14094. IfyouuseRADIUSbasedauthenticationforclients,youcanoptionallyaddthefollowing attributestotheappropriatefileintheRADIUSorAAAservertoconfigureaVLANforthe client:

TunnelType TunnelMediumType TunnelPrivateGroupID TheRADIUSassignedVLANIDoverridestheVLANIDyouconfigureontheVAPpage. YouconfiguretheuntaggedandmanagementVLANIDsontheEthernetSettingspage. Formoreinformation,seeEthernetSettingsonpage51. Enteranameforthewirelessnetwork.TheSSIDisanalphanumericstringofupto32 characters.YoucanusethesameSSIDformultipleVAPs,oryoucanchooseauniqueSSID foreachVAP. Note:IfyouareconnectedasawirelessclienttothesameAPthatyouareadministering, resettingtheSSIDwillcauseyoutoloseconnectivitytotheAP.Youwillneedtoreconnect tothenewSSIDafteryousavethisnewsetting. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page72 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings Field BroadcastSSID Security MAC Authentication Type RedirectMode RedirectURL Table22:VirtualAccessPointSettings(Cont.) Description SpecifywhethertoallowtheAPtobroadcasttheServiceSetIdentifier(SSID)inits beaconframes.TheBroadcastSSIDparameterisenabledbydefault.WhentheVAPdoes notbroadcastitsSSID,thenetworknameisnotdisplayedinthelistofavailablenetworks onaclientstation.Instead,theclientmusthavetheexactnetworknameconfiguredin thesupplicantbeforeitisabletoconnect. ToenabletheSSIDbroadcast,selecttheBroadcastSSIDcheckbox. ToprohibittheSSIDbroadcast,cleartheBroadcastSSIDcheckbox. Note:DisablingthebroadcastSSIDissufficienttopreventclientsfromaccidentally connectingtoyournetwork,butitwillnotpreventeventhesimplestofattemptsbya hackertoconnectormonitorunencryptedtraffic.SuppressingtheSSIDbroadcastoffers averyminimallevelofprotectiononanotherwiseexposednetwork(suchasaguest network)wherethepriorityismakingiteasyforclientstogetaconnectionandwhere nosensitiveinformationisavailable. SelectoneofthefollowingSecuritymodesforthisVAP:

None StaticWEP WPAPersonal IEEE802.1X WPAEnterprise IfyouselectasecuritymodeotherthanNone,additionalfieldsappear.Thesefieldsare explainedbelow. Note:TheSecuritymodeyousethereisspecificallyforthisVAP. YoucanconfigureagloballistofMACaddressesthatareallowedordeniedaccesstothe network.ThedropdownmenuforthisfeatureallowsyoutoselectthetypeofMAC Authenticationtouse:

Disabled:DonotuseMACAuthentication. Local:UsetheMACAuthenticationlistthatyouconfigureontheMACAuthentication page. RADIUS:UsetheMACAuthenticationlistontheexternalRADIUSserver. FormoreinformationaboutMACAuthentication,seeControllingAccessbyMAC Authenticationonpage85. EnabletheHTTPredirectfeaturetoredirectwirelessclientstoacustomWebpage. Whenredirectmodeisenabled,theuserwillberedirectedtotheURLyouspecifyafter thewirelessclientassociateswithanAPandtheuseropensaWebbrowserontheclient toaccesstheInternet. ThecustomWebpagemustbelocatedonanexternalWebserverandmightcontain informationsuchasthecompanylogoandnetworkusagepolicy. Note:ThewirelessclientisredirectedtotheexternalWebserveronlyoncewhileitis associatedwiththeAP. SpecifytheURLwheretheWebbrowseristoberedirectedafterthewirelessclient associateswiththeAPandsendsHTTPtraffic. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page73 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings Note:AfteryouconfiguretheVAPsettings,youmustclickApplytoapplythechangesandtosavethe settings.ChangingsomesettingsmightcausetheAPtostopandrestartsystemprocesses.Ifthis happens,wirelessclientswilltemporarilyloseconnectivity.WerecommendthatyouchangeAP settingswhenWLANtrafficislow. None(Plaintext) IfyouselectNoneasyoursecuritymode,nofurtheroptionsareconfigurableontheAP.Thismodemeansthat anydatatransferredtoandfromtheUAPisnotencrypted.Thissecuritymodecanbeusefulduringinitial networkconfigurationorforproblemsolving,butitisnotrecommendedforregularuseontheInternal networkbecauseitisnotsecure. StaticWEP WiredEquivalentPrivacy(WEP)isadataencryptionprotocolfor802.11wirelessnetworks.Allwirelessstations andAPsonthenetworkareconfiguredwithastatic64bit(40bitsecretkey+24bitinitializationvector(IV)) or128bit(104bitsecretkey+24bitIV)SharedKeyfordataencryption. StaticWEPisnotthemostsecuremodeavailable,butitoffersmoreprotectionthansettingthesecuritymode toNone(Plaintext)asitdoespreventanoutsiderfromeasilysniffingoutunencryptedwirelesstraffic. WEPencryptsdatamovingacrossthewirelessnetworkbasedonastatickey.(Theencryptionalgorithmisa streamciphercalledRC4.) Table23:StaticWEP Field TransferKeyIndex Selectakeyindexfromthedropdownmenu.Keyindexes1through4areavailable.The Description KeyLength KeyType defaultis1. TheTransferKeyIndexindicateswhichWEPkeytheAPwillusetoencryptthedatait transmits. Specifythelengthofthekeybyclickingoneoftheradiobuttons:

64bits 128bits Selectthekeytypebyclickingoneoftheradiobuttons:

ASCII Hex D-Link November2011 UnifiedAccessPointAdministratorsGuide Page74 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings Field WEPKeys Authentication Table23:StaticWEP(Cont.) Description YoucanspecifyuptofourWEPkeys.Ineachtextbox,enterastringofcharactersforeach key.Thekeysyouenterdependonthekeytypeselected:

ASCIIIncludesupperandlowercasealphabeticletters,thenumericdigits,and specialsymbolssuchas@and#. HexIncludesdigits0to9andthelettersAtoF. UsethesamenumberofcharactersforeachkeyasspecifiedintheCharactersRequired field.ThesearetheRC4WEPkeyssharedwiththestationsusingtheAP. EachclientstationmustbeconfiguredtouseoneofthesesameWEPkeysinthesame slotasspecifiedhereontheAP. CharactersRequired:ThenumberofcharactersyouenterintotheWEPKeyfieldsis determinedbytheKeylengthandKeytypeyouselect.Forexample,ifyouuse128bit ASCIIkeys,youmustenter26charactersintheWEPkey.Thenumberofcharacters requiredupdatesautomaticallybasedonhowyousetKeyLengthandKeyType. Theauthenticationalgorithmdefinesthemethodusedtodeterminewhetheraclient stationisallowedtoassociatewithanAPwhenstaticWEPisthesecuritymode. Specifytheauthenticationalgorithmyouwanttousebychoosingoneofthefollowing options:

OpenSystemauthenticationallowsanyclientstationtoassociatewiththeAP whetherthatclientstationhasthecorrectWEPkeyornot.Thisalgorithmisalsoused inplaintext,IEEE802.1X,andWPAmodes.Whentheauthenticationalgorithmisset toOpenSystem,anyclientcanassociatewiththeAP. Note:Justbecauseaclientstationisallowedtoassociatedoesnotensureitcan exchangetrafficwithanAP.AstationmusthavethecorrectWEPkeytobeableto successfullyaccessanddecryptdatafromanAP,andtotransmitreadabledatatotheAP. SharedKeyauthenticationrequirestheclientstationtohavethecorrectWEPkeyin ordertoassociatewiththeAP.WhentheauthenticationalgorithmissettoShared Key,astationwithanincorrectWEPkeywillnotbeabletoassociatewiththeAP. BothOpenSystemandSharedKey.Whenyouselectbothauthenticationalgorithms:

ClientstationsconfiguredtouseWEPinsharedkeymodemusthaveavalidWEP keyinordertoassociatewiththeAP. ClientstationsconfiguredtouseWEPasanopensystem(sharedkeymodenot enabled)willbeabletoassociatewiththeAPeveniftheydonothavethecorrect WEPkey. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page75 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings StaticWEPRules IfyouuseStaticWEP,thefollowingrulesapply:

AllclientstationsmusthavetheWirelessLAN(WLAN)securitysettoWEP,andallclientsmusthaveoneof theWEPkeysspecifiedontheAPinordertodecodeAPtostationdatatransmissions. TheAPmusthaveallkeysusedbyclientsforstationtoAPtransmitsothatitcandecodethestation transmissions. Thesamekeymustoccupythesameslotonallnodes(APandclients).ForexampleiftheAPdefines abc123keyasWEPkey3,thentheclientstationsmustdefinethatsamestringasWEPkey3. Clientstationscanusedifferentkeystotransmitdatatotheaccesspoint.(Ortheycanallusethesame key,butthisislesssecurebecauseitmeansonestationcandecryptthedatabeingsentbyanother.) Onsomewirelessclientsoftware,youcanconfiguremultipleWEPkeysanddefineaclientstation transferkeyindex,andthensetthestationstoencryptthedatatheytransmitusingdifferentkeys.This ensuresthatneighboringAPscannotdecodeeachotherstransmissions. Youcannotmix64bitand128bitWEPkeysbetweentheaccesspointanditsclientstations. IEEE802.1X IEEE802.1Xisthestandarddefiningportbasedauthenticationandinfrastructurefordoingkeymanagement. ExtensibleAuthenticationProtocol(EAP)messagessentoveranIEEE802.11wirelessnetworkusingaprotocol calledEAPEncapsulationOverLANs(EAPOL).IEEE802.1Xprovidesdynamicallygeneratedkeysthatare periodicallyrefreshed.AnRC4streamcipherisusedtoencrypttheframebodyandcyclicredundancychecking

(CRC)ofeach802.11frame. ThismoderequirestheuseofanexternalRADIUSservertoauthenticateusers.TheAPrequiresaRADIUS servercapableofEAP,suchastheMicrosoftInternetAuthenticationServer.ToworkwithWindowsclients,the authenticationservermustsupportProtectedEAP(PEAP)andMSCHAPV2. YoucanuseanyofavarietyofauthenticationmethodsthattheIEEE802.1Xmodesupports,including certificates,Kerberos,andpublickeyauthentication.Youmustconfiguretheclientstationstousethesame authenticationmethodtheAPuses. Table24:IEEE802.1X Field UseGlobalRADIUS ServerSettings RADIUSIPAddress Type Description BydefaulteachVAPusestheglobalRADIUSsettingsthatyoudefinefortheAPatthetop oftheVAPpage.However,youcanconfigureeachVAPtouseadifferentsetofRADIUS servers. TousetheglobalRADIUSserversettings,makesurethecheckboxisselected. TouseaseparateRADIUSserverfortheVAP,clearthecheckboxandentertheRADIUS serverIPaddressandkeyinthefollowingfields. SpecifytheIPversionthattheRADIUSserveruses. YoucantogglebetweentheaddresstypestoconfigureIPv4andIPv6globalRADIUS addresssettings,buttheAPcontactsonlytheRADIUSserverorserversfortheaddress typeyouselectinthisfield. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page76 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings Table24:IEEE802.1X(Cont.) Field RADIUSIPAddress RADIUSIPv6 Address RADIUSIPorIPv6 Address13 RADIUSKey RADIUSKey13 EnableRADIUS Accounting EnableRADIUS FailThrough ActiveServer BroadcastKey RefreshRate SessionKeyRefresh Rate Description EntertheIPv4orIPv6addressfortheprimaryRADIUSserverforthisVAP. IftheIPv4RADIUSIPAddressTypeoptionisselectedinthepreviousfield,entertheIP addressoftheRADIUSserverthatallVAPsusebydefault,forexample192.168.10.23.If theIPv6RADIUSIPAddressTypeoptionisselected,entertheIPv6addressoftheprimary globalRADIUSserver,forexample2001:0db8:1234::abcd. EnteruptothreeIPv4and/orIPv6addressestouseasthebackupRADIUSserversforthis VAP.ThefieldlabelisRADIUSIPAddresswhentheIPv4RADIUSIPAddressTypeoptionis selectedandRADIUSIPv6AddresswhentheIPv6RADIUSIPAddressTypeoptionis selected. Ifauthenticationfailswiththeprimaryserver,eachconfiguredbackupserveristriedin sequence. EntertheRADIUSkeyinthetextbox. TheRADIUSKeyisthesharedsecretkeyfortheglobalRADIUSserver.Youcanuseupto 63standardalphanumericandspecialcharacters.Thekeyiscasesensitive,andyoumust configurethesamekeyontheAPandonyourRADIUSserver.Thetextyouenterwillbe displayedas*characterstopreventothersfromseeingtheRADIUSkeyasyoutype. EntertheRADIUSkeyassociatedwiththeconfiguredbackupRADIUSservers.Theserver atRADIUSIPAddress1usesRADIUSKey1,RADIUSIPAddress2usesRADIUSKey2,and soon. Selectthisoptiontotrackandmeasuretheresourcesaparticularuserhasconsumed suchassystemtime,amountofdatatransmittedandreceived,andsoon. IfyouenableRADIUSaccounting,itisenabledfortheprimaryRADIUSserverandall backupservers. SelectthisoptiontoallowthesecondaryRADIUSservertoauthenticatewirelessclients iftheauthenticationwiththeprimaryRADIUSserverisunsuccessful,oriftheprimary RADIUSserverisunavailable. SpecifywhichconfiguredRADIUSservertouseastheactiveRADIUSserver. Enteravaluetosettheintervalatwhichthebroadcast(group)keyisrefreshedforclients associatedtothisVAP(thedefaultis300). Thevalidrangeis086400seconds.Avalueof0indicatesthatthebroadcastkeyisnot refreshed. EnteravaluetosettheintervalatwhichtheAPwillrefreshsession(unicast)keysforeach clientassociatedtotheVAP. Thevalidrangeis086400seconds.Avalueof0indicatesthatthebroadcastkeyisnot refreshed. Note:Afteryouconfigurethesecuritysettings,youmustclickApplytoapplythechangesandtosave thesettings. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page77 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings WPAPersonal WPAPersonalisaWiFiAllianceIEEE802.11istandard,whichincludesAESCCMPandTKIPmechanisms.The PersonalversionofWPAemploysapresharedkey(insteadofusingIEEE802.1XandEAPasisusedinthe EnterpriseWPAsecuritymode).ThePSKisusedforaninitialcheckofcredentialsonly. ThissecuritymodeisbackwardscompatibleforwirelessclientsthatsupporttheoriginalWPA. Field WPAVersions CipherSuites Key BroadcastKey RefreshRate Table25:WPAPersonal Description Selectthetypesofclientstationsyouwanttosupport:

WPA.IfallclientstationsonthenetworksupporttheoriginalWPAbutnonesupportthe newerWPA2,thenselectWPA. WPA2.IfallclientstationsonthenetworksupportWPA2,wesuggestusingWPA2which providesthebestsecuritypertheIEEE802.11istandard. WPAandWPA2.Ifyouhaveamixofclients,someofwhichsupportWPA2andothers whichsupportonlytheoriginalWPA,selectbothofthecheckboxes.ThisletsbothWPA andWPA2clientstationsassociateandauthenticate,butusesthemorerobustWPA2for clientswhosupportit.ThisWPAconfigurationallowsmoreinteroperability,atthe expenseofsomesecurity. Selecttheciphersuiteyouwanttouse:

TKIP CCMP(AES) TKIPandCCMP(AES) BothTKIPandAESclientscanassociatewiththeAP.WPAclientsmusthaveoneofthe followingtobeabletoassociatewiththeAP:

AvalidTKIPkey AvalidAESCCMPkey ClientsnotconfiguredtouseaWPAPersonalwillnotbeabletoassociatewiththeAP. ThePresharedKeyisthesharedsecretkeyforWPAPersonal.Enterastringofatleast8 characterstoamaximumof63characters.Acceptablecharactersincludeupperand lowercasealphabeticletters,thenumericdigits,andspecialsymbolssuchas@and#. Enteravaluetosettheintervalatwhichthebroadcast(group)keyisrefreshedforclients associatedtothisVAP(thedefaultis300). Thevalidrangeis086400seconds.Avalueof0indicatesthatthebroadcastkeyisnot refreshed. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page78 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings WPAEnterprise WPAEnterprisewithRADIUSisanimplementationoftheWiFiAllianceIEEE802.11istandard,whichincludes CCMP(AES),andTKIPmechanisms.TheEnterprisemoderequirestheuseofaRADIUSservertoauthenticate users. ThissecuritymodeisbackwardscompatiblewithwirelessclientsthatsupporttheoriginalWPA. Field WPAVersions Enable preauthentication CipherSuites UseGlobalRADIUS ServerSettings RADIUSIPAddress Type Table26:WPAEnterprise Description Selectthetypesofclientstationsyouwanttosupport:

WPA.IfallclientstationsonthenetworksupporttheoriginalWPAbutnonesupport thenewerWPA2,thenselectWPA. WPA2.IfallclientstationsonthenetworksupportWPA2,wesuggestusingWPA2 whichprovidesthebestsecuritypertheIEEE802.11istandard. WPAandWPA2.Ifyouhaveamixofclients,someofwhichsupportWPA2andothers whichsupportonlytheoriginalWPA,selectbothWPAandWPA2.ThisletsbothWPA andWPA2clientstationsassociateandauthenticate,butusesthemorerobustWPA2 forclientswhosupportit.ThisWPAconfigurationallowsmoreinteroperability,atthe expenseofsomesecurity. IfforWPAVersionsyouselectonlyWPA2orbothWPAandWPA2,youcanenablepre authenticationforWPA2clients. ClickEnablepreauthenticationifyouwantWPA2wirelessclientstosendpre authenticationpacket.ThepreauthenticationinformationwillberelayedfromtheAP theclientiscurrentlyusingtothetargetAP.Enablingthisfeaturecanhelpspeedup authenticationforroamingclientswhoconnecttomultipleAPs. ThisoptiondoesnotapplyifyouselectedWPAforWPAVersionsbecausetheoriginal WPAdoesnotsupportthisfeature. Selecttheciphersuiteyouwanttouse:

TKIP CCMP(AES) TKIPandCCMP(AES) BydefaultbothTKIPandCCMPareselected.WhenbothTKIPandCCMPareselected, clientstationsconfiguredtouseWPAwithRADIUSmusthaveoneofthefollowing:

AvalidTKIPRADIUSIPaddressandRADIUSKey AvalidCCMP(AES)IPaddressandRADIUSKey BydefaulteachVAPusestheglobalRADIUSsettingsthatyoudefinefortheAPatthetop oftheVAPpage.However,youcanconfigureeachVAPtouseadifferentsetofRADIUS servers. TousetheglobalRADIUSserversettings,makesurethecheckboxisselected. TouseaseparateRADIUSserverfortheVAP,clearthecheckboxandentertheRADIUS serverIPaddressandkeyinthefollowingfields. SpecifytheIPversionthattheRADIUSserveruses. YoucantogglebetweentheaddresstypestoconfigureIPv4andIPv6globalRADIUS addresssettings,buttheAPcontactsonlytheRADIUSserverorserversfortheaddress typeyouselectinthisfield. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page79 UnifiedAccessPointAdministratorsGuide VirtualAccessPointSettings Table26:WPAEnterprise(Cont.) Field RADIUSIPAddress RADIUSIPv6 Address RADIUSIPorIPv6 Address13 RADIUSKey RADIUSKey13 EnableRADIUS Accounting EnableRADIUS FailThrough ActiveServer BroadcastKey RefreshRate SessionKeyRefresh Rate Description EntertheIPv4orIPv6addressfortheprimaryRADIUSserverforthisVAP. IftheIPv4RADIUSIPAddressTypeoptionisselectedinthepreviousfield,entertheIP addressoftheRADIUSserverthatallVAPsusebydefault,forexample192.168.10.23.If theIPv6RADIUSIPAddressTypeoptionisselected,entertheIPv6addressoftheprimary globalRADIUSserver,forexample2001:0db8:1234::abcd. EnteruptothreeIPv4and/orIPv6addressestouseasthebackupRADIUSserversforthis VAP.ThefieldlabelisRADIUSIPAddresswhentheIPv4RADIUSIPAddressTypeoptionis selectedandRADIUSIPv6AddresswhentheIPv6RADIUSIPAddressTypeoptionis selected. Ifauthenticationfailswiththeprimaryserver,eachconfiguredbackupserveristriedin sequence. EntertheRADIUSkeyinthetextbox. TheRADIUSKeyisthesharedsecretkeyfortheglobalRADIUSserver.Youcanuseupto 63standardalphanumericandspecialcharacters.Thekeyiscasesensitive,andyoumust configurethesamekeyontheAPandonyourRADIUSserver.Thetextyouenterwillbe displayedas"*"characterstopreventothersfromseeingtheRADIUSkeyasyoutype. EntertheRADIUSkeyassociatedwiththeconfiguredbackupRADIUSservers.Theserver atRADIUSIPAddress1usesRADIUSKey1,RADIUSIPAddress2usesRADIUSKey2,and soon. Selectthisoptiontotrackandmeasuretheresourcesaparticularuserhasconsumed suchassystemtime,amountofdatatransmittedandreceived,andsoon. IfyouenableRADIUSaccounting,itisenabledfortheprimaryRADIUSserverandall backupservers. SelectthisoptiontoallowthesecondaryRADIUSservertoauthenticatewirelessclients iftheauthenticationwiththeprimaryRADIUSserverisunsuccessful,oriftheprimary RADIUSserverisunavailable. SpecifywhichconfiguredRADIUSservertouseastheactiveRADIUSserver. Enteravaluetosettheintervalatwhichthebroadcast(group)keyisrefreshedforclients associatedtothisVAP(thedefaultis300). Thevalidrangeis086400seconds.Avalueof0indicatesthatthebroadcastkeyisnot refreshed. EnteravaluetosettheintervalatwhichtheAPwillrefreshsession(unicast)keysforeach clientassociatedtotheVAP. Thevalidrangeis086400seconds.Avalueof0indicatesthatthebroadcastkeyisnot refreshed. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page80 UnifiedAccessPointAdministratorsGuide ConfiguringtheWirelessDistributionSystem(WDS) ConfiguringtheWirelessDistributionSystem(WDS) TheWirelessDistributionSystem(WDS)allowsyoutoconnectmultipleUAPs.WithWDS,APscommunicate withoneanotherwithoutwiresinastandardizedway.Thiscapabilityiscriticalinprovidingaseamless experienceforroamingclientsandformanagingmultiplewirelessnetworks.Itcanalsosimplifythenetwork infrastructurebyreducingtheamountofcablingrequired.YoucanconfiguretheAPinpointtopointorpoint tomultipointbridgemodebasedonthenumberoflinkstoconnect. Inthepointtopointmode,theAPacceptsclientassociationsandcommunicateswithwirelessclientsand otherrepeaters.TheAPforwardsalltrafficmeantfortheothernetworkoverthetunnelthatisestablished betweentheAPs.Thebridgedoesnotaddtothehopcount.ItfunctionsasasimpleOSIlayer2networkdevice. Inthepointtomultipointbridgemode,oneAPactsasthecommonlinkbetweenmultipleAPs.Inthismode, thecentralAPacceptsclientassociationsandcommunicateswiththeclientsandotherrepeaters.AllotherAPs associateonlywiththecentralAPthatforwardsthepacketstotheappropriatewirelessbridgeforrouting purposes. TheUAPcanalsoactasarepeater.Inthismode,theAPservesasaconnectionbetweentwoAPsthatmight betoofaraparttobewithincellrange.Whenactingasarepeater,theAPdoesnothaveawiredconnectionto theLANandrepeatssignalsbyusingthewirelessconnection.NospecialconfigurationisrequiredfortheAP tofunctionasarepeater,andtherearenorepeatermodesettings.WirelessclientscanstillconnecttoanAP thatisoperatingasarepeater. Note:WhenyoumoveanAPfromStandaloneModetoManagedMode,WDSisdisabled.InManaged Mode,youconfiguretheAPbyusingtheDLinkUnifiedWirelessSwitch.TheAdministratorUI,aswell asTelnet,SSH,andSNMPaccessaredisabledwhentheAPisinManagedMode. Tospecifythedetailsoftrafficexchangefromthisaccesspointtoothers,clicktheWDStab. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page81 UnifiedAccessPointAdministratorsGuide ConfiguringtheWirelessDistributionSystem(WDS) Figure21:ConfiguringWDSSettings BeforeyouconfigureWDSontheAP,notethefollowingguidelines:

WhenusingWDS,besuretoconfigureWDSsettingsonbothAPsparticipatingintheWDSlink. YoucanhaveonlyoneWDSlinkbetweenanypairofAPs.Thatis,aremoteMACaddressmayappearonly onceontheWDSpageforaparticularAP. BothAPsparticipatinginaWDSlinkmustbeonthesameRadiochannelandusingthesameIEEE802.11 mode.(SeeModifyingRadioSettingsonpage58forinformationonconfiguringtheRadiomodeand channel.) When802.11hisoperational,settinguptwoWDSlinkscanbedifficult.SeeUsingthe802.11hWireless Modeonpage57. IfyouuseWPAencryptionontheWDSlinkoverradio1,VAP0ofradio1mustuseWPAPersonalorWPA Enterpriseasthesecuritymode.IfyouuseWPAonaWDSlinkoverradio2,VAP0ofradio2mustuseWPA PersonalorWPAEnterpriseasthesecuritymode. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page82 UnifiedAccessPointAdministratorsGuide ConfiguringtheWirelessDistributionSystem(WDS) ToconfigureWDSonthisAP,describeeachAPintendedtoreceivehandoffsandsendinformationtothisAP. ForeachdestinationAP,configurethefieldslistedinTable21. Field SpanningTree Mode Radio LocalAddress RemoteAddress Encryption Table27:WDSSettings Description SpanningTreeProtocol(STP)preventsswitchingloops.STPisrecommendedifyou configureWDSlinks. SelectEnabledtouseSTP SelectDisabledtoturnoffSTPlinks(notrecommended) ForeachWDSlinkonatworadioAP,selectRadioOneorRadioTwo.Therestofthe settingsforthelinkapplytotheradioselectedinthisfield.ThereadonlyLocalAddress willchangedependingonwhichRadioyouselectinthisfield. Note:ThisfieldisnotavailableontheDWL3600AP. IndicatestheMACaddressesforthisAP. ForeachWDSlinkonatworadioAP,theLocalAddressreflectstheMACaddressforthe internalinterfaceontheselectedradio(RadioOneonwlan0orRadioTwoonwlan1). SpecifytheMACaddressofthedestinationAP;thatis,theAPontheotherendofthe WDSlinktowhichdatawillbesentorhandedoffandfromwhichdatawillbereceived. ClickthedropdownarrowtotherightoftheRemoteAddressfieldtoseealistofallthe availableMACAddressesandtheirassociatedSSIDsonthenetwork.Selectthe appropriateMACaddressfromthelist. NOTE:TheSSIDdisplayedinthedropdownlistissimplytohelpyouidentifythecorrect MACAddressforthedestinationAP.ThisSSIDisaseparateSSIDtothatwhichyousetfor theWDSlink.Thetwodonot(andshouldnot)bethesamevalueorname. Youcanusenoencryption,WEP,orWPA(PSK)ontheWDSlink. IfyouareunconcernedaboutsecurityissuesontheWDSlinkyoumaydecidenottoset anytypeofencryption.Alternatively,ifyouhavesecurityconcernsyoucanchoose betweenStaticWEPandWPA(PSK).InWPA(PSK)mode,theAPusesWPA2PSKwith CCMP(AES)encryptionovertheWDSlink. NOTE:InordertoconfigureWPAPSKonanyWDSlink,VAP0oftheselectedradiomust beconfiguredforWPAPSKorWPAEnterprise. IfyouselectNoneasyourpreferredWDSencryptionoption,youwillnotbeaskedtofillinanymorefieldson theWDSpage.AlldatatransferredbetweenthetwoAPsontheWDSlinkwillbeunencrypted. Note:TodisableaWDSlink,youmustremovethevalueconfiguredintheRemoteAddressfield. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page83 UnifiedAccessPointAdministratorsGuide ConfiguringtheWirelessDistributionSystem(WDS) WEPonWDSLinks Table28describestheadditionalfieldsthatappearwhenyouselectWEPastheencryptiontype. Field Encryption WEP KeyLength KeyType Characters Required WEPKey Table28:WEPonWDSLinks Description WEP SelectthisoptionifyouwanttosetWEPencryptionontheWDSlink. IfWEPisenabled,specifythelengthoftheWEPkey:

64bits 128bits IfWEPisenabled,specifytheWEPkeytype:

ASCII Hex IndicatesthenumberofcharactersrequiredintheWEPkey. ThenumberofcharactersrequiredupdatesautomaticallybasedonhowyousetKey LengthandKeyType. Enterastringofcharacters.IfyouselectedASCII,enteranycombinationof09,az,and AZ.IfyouselectedHEX,enterhexadecimaldigits(anycombinationof09andafor AF).ThesearetheRC4encryptionkeyssharedwiththestationsusingtheAP. WPA/PSKonWDSLinks Table29describestheadditionalfieldsthatappearwhenyouselectWPA/PSKastheencryptiontype. Note:ToconfigureWPAPSKonanyWDSlink,VAP0oftheselectedradiomustbeconfiguredforWPA PSKorWPAEnterprise. Field Encryption SSID Key Table29:WPA/PSKonWDSLinks Description WPA(PSK) EnteranappropriatenameforthenewWDSlinkyouhavecreated.ThisSSIDshouldbe differentfromtheotherSSIDsusedbythisAP.However,itisimportantthatthesame SSIDisalsoenteredattheotherendoftheWDSlink.IfthisSSIDisnotthesameforboth APsontheWDSlink,theywillnotbeabletocommunicateandexchangedata. TheSSIDcanbeanyalphanumericcombination. EnterauniquesharedkeyfortheWDSbridge.Thisuniquesharedkeymustalsobe enteredfortheAPattheotherendoftheWDSlink.Ifthiskeyisnotthesameforboth APs,theywillnotbeabletocommunicateandexchangedata. TheWPAPSKkeyisastringofatleast8characterstoamaximumof63characters. Acceptablecharactersincludeupperandlowercasealphabeticletters,thenumeric digits,andspecialsymbolssuchas@and#. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page84 UnifiedAccessPointAdministratorsGuide ControllingAccessbyMACAuthentication Note:AfteryouconfiguretheWDSsettings,youmustclickApplytoapplythechangesandtosavethe settings.ChangingsomesettingsmightcausetheAPtostopandrestartsystemprocesses.Ifthis happens,wirelessclientswilltemporarilyloseconnectivity.WerecommendthatyouchangeAP settingswhenWLANtrafficislow. ControllingAccessbyMACAuthentication AMediaAccessControl(MAC)addressisahardwareaddressthatuniquelyidentifieseachnodeofanetwork. AllIEEE802networkdevicesshareacommon48bitMACaddressformat,usuallydisplayedasastringof12 hexadecimaldigitsseparatedbycolons,forexample00:DC:BA:09:87:65.Eachwirelessnetworkinterface card(NIC)usedbyawirelessclienthasauniqueMACaddress. YoucanusetheAdministratorUIontheAPoruseanexternalRADIUSservertocontrolaccesstothenetwork throughtheAPbasedontheMACaddressofthewirelessclient.ThisfeatureiscalledMACAuthenticationor MACFiltering.Tocontrolaccess,youconfigureagloballistofMACaddresseslocallyontheAPoronanexternal RADIUSserver.Then,yousetafiltertospecifywhethertheclientswiththoseMACaddressesareallowedor deniedaccesstothenetwork.WhenawirelessclientattemptstoassociatewithanAP,theAPlooksupthe MACaddressoftheclientinthelocalStationsListorontheRADIUSserver.Ifitisfound,theglobalallowor denysettingisapplied.Ifitisnotfound,theoppositeisapplied. OntheVAPpage,theMACAuthenticationTypesettingcontrolswhethertheAPusesthestationlistconfigured locallyontheMACAuthenticationpageortheexternalRADIUSserver.TheAllow/Blockfiltersettingonthe MACAuthenticationpagedetermineswhethertheclientsinthestationlist(localorRADIUS)canaccessthe networkthroughtheAP.FormoreinformationaboutsettingtheMACauthenticationtype,seeVirtualAccess PointSettingsonpage70. ConfiguringaMACFilterandStationListontheAP TheMACAuthenticationpageallowsyoutocontrolaccesstoUAPbasedonMACaddresses.Basedonhow yousetthefilter,youcanallowonlyclientstationswithalistedMACaddressordenyaccesstothestations listed. WhenyouenableMACAuthenticationandspecifyalistofapprovedMACaddresses,onlyclientswithalisted MACaddresscanaccessthenetwork.IfyouspecifyMACaddressestodeny,allclientscanaccessthenetwork exceptfortheclientsonthedenylist. ToenablefilteringbyMACaddress,clicktheMACAuthenticationtab. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page85 UnifiedAccessPointAdministratorsGuide ControllingAccessbyMACAuthentication Figure22:ConfiguringMACAuthentication Note:GlobalMACAuthenticationsettingsapplytoallVAPsonallsupportedradios. Table30describesthefieldsandconfigurationoptionsavailableontheMACAuthenticationpage Field Filter StationsList Table30:MACAuthentication Description TosettheMACAddressFilter,selectoneofthefollowingoptions:

Allowonlystationsinthelist.AnystationthatisnotintheStationsListisdenied accesstothenetworkthroughtheAP. Blockallstationsinlist.Onlythestationsthatappearinthelistaredeniedaccessto thenetworkthroughtheAP.Allotherstationsarepermittedaccess. Note:Thefilteryouselectisappliedtotheclientsinthestationlist,regardlessof whetherthatstationlistislocalorontheRADIUSserver. Thisisthelocallistofclientsthatareeitherpermittedordeniedaccesstothenetwork throughtheAP.ToaddaMACAddresstothelocalStationsList,enterits48bitMAC addressintothelowertextboxes,thenclickAdd. ToremoveaMACAddressfromtheStationsList,selectits48bitMACaddress,thenclick Remove. Thestationsinthelistwilleitherbeallowedordeniedaccessbasedonhowyousetthe filterinthepreviousfield. Note:IftheMACauthenticationtypefortheVAPissettoLocal,theAPusestheStations Listtopermitordenytheclientsaccesstothenetwork.IftheMACauthenticationtype issettoRADIUS,theAPignorestheMACaddressesconfiguredinthislistandusesthe listthatisstoredontheRADIUSserver.TheMACauthenticationtypeissetontheVAP configurationpage. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page86 UnifiedAccessPointAdministratorsGuide ControllingAccessbyMACAuthentication Note:AfteryouconfigurelocalMACAuthenticationsettings,youmustclickApplytoapplythe changesandtosavethesettings.ChangingsomesettingsmightcausetheAPtostopandrestart systemprocesses.Ifthishappens,wirelessclientswilltemporarilyloseconnectivity.Werecommend thatyouchangeAPsettingswhenWLANtrafficislow. ConfiguringMACAuthenticationontheRADIUSServer IfyouuseRADIUSMACauthenticationforMACbasedaccesscontrol,youmustconfigureastationlistonthe RADIUSserver.ThestationlistcontainsclientMACaddressentries,andtheformatforthelistisdescribedin thefollowingtable. Table31:RADIUSServerAttributesforMACAuthentication RADIUSServerAttribute Description UserName(1) MACaddressoftheclientstation. UserPassword(2) AfixedglobalpasswordusedtolookupaclientMAC entry. Value ValidEthernetMAC Address. NOPASSWORD D-Link November2011 UnifiedAccessPointAdministratorsGuide Page87 UnifiedAccessPointAdministratorsGuide ConfiguringLoadBalancing ConfiguringLoadBalancing YoucansetnetworkutilizationthresholdsontheUAPtomaintainthespeedandperformanceofthewireless networkasclientsassociateanddisassociatewiththeAP.Theloadbalancingsettingsapplytoallsupported radios. Toconfigureloadbalancingandsetlimitsandbehaviortobetriggeredbyaspecifiedutilizationrateofthe accesspoint,clicktheLoadBalancingtabandupdatethefieldsshowninthefollowingfigure. Figure23:ConfiguringLoadBalancing Table32:LoadBalancing Field LoadBalancing UtilizationforNo NewAssociations Description Enableordisableloadbalancing:

ToenableloadbalancingonthisAP,clickEnable. TodisableloadbalancingonthisAP,clickDisable. Providethepercentageofnetworkbandwidthutilizationallowedontheradiobeforethe APstopsacceptingnewclientassociations. Thedefaultis0,whichmeansthatallnewassociationswillbeallowedregardlessofthe utilizationrate. Note:Afteryouconfiguretheloadbalancingsettings,youmustclickApplytoapplythechangesand tosavethesettings.ChangingsomesettingsmightcausetheAPtostopandrestartsystemprocesses. Ifthishappens,wirelessclientswilltemporarilyloseconnectivity.WerecommendthatyouchangeAP settingswhenWLANtrafficislow. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page88 UnifiedAccessPointAdministratorsGuide ManagedAccessPointOverview ManagedAccessPointOverview TheUAPcanoperateintwomodes:StandaloneModeorManagedMode.InStandaloneMode,theUAPacts asanindividualAPinthenetwork,andyoumanageitbyusingtheAdministratorWebUserInterface(UI),CLI, orSNMP.InManagedMode,theUAPispartoftheDLinkUnifiedWiredandWirelessSystem,andyoumanage itbyusingtheDLinkUnifiedWirelessSwitch.IfanAPisinManagedMode,theAdministratorWebUI,Telnet, SSH,andSNMPservicesaredisabled. OntheUAP,youcanconfiguretheIPaddressesofuptofourDLinkUnifiedWirelessSwitchesthatcanmanage it.InordertomanagetheAP,theswitchandAPmustdiscovereachother.Therearemultiplewaysforaswitch todiscoveranAP.AddingtheIPaddressoftheswitchtotheAPwhileitisinStandaloneModeisonewayto enableswitchtoAPdiscovery. TransitioningBetweenModes Every30seconds,theDLinkUnifiedWirelessSwitchsendsakeepalivemessagetoalloftheaccesspointsit manages.EachAPchecksforthekeepalivemessagesontheSSLTCPconnection.AslongastheAPmaintains communicationwiththeswitchthroughthekeepalivemessages,itremainsinManagedMode. IftheAPdoesnotreceiveamessagewithin45secondsofthelastkeepalivemessage,theAPassumesthe switchhasfailedandterminatesitsTCPconnectiontotheswitch,andtheAPentersStandaloneMode. OncetheAPtransitionstoStandaloneMode,itcontinuestoforwardtrafficwithoutanyloss.TheAPusesthe configurationontheVAPsconfiguredinVLANForwardingmode(thestandard,nontunneledmode). WhiletheAPisinStandaloneMode,youcanmanageitbyusingtheWebinterfaceortheCLI(throughTelnet orSSH). ForanyclientsthatareconnectedtotheAPthroughtunneledVAPs,theAPsendsdisassociatemessagesand disablesthetunneledVAPs. AslongastheManagedAPAdministrativeModeissettoEnabled,asFigure24onpage90shows,theAPstarts discoveryprocedures.IftheAPestablishesaconnectionwithawirelessswitch,whichmayormaynotbethe sameswitchitwasconnectedtobefore,theswitchsendstheAPitsconfigurationandtheAPsendsthewireless switchinformationaboutallcurrentlyassociatedclients. Aftertheconfigurationfromtheswitchisapplied,theAPradio(s)restart.Clienttrafficisbrieflyinterrupted untiltheradio(s)areupandtheclientsarereassociated. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page89 UnifiedAccessPointAdministratorsGuide ManagedAccessPointOverview ConfiguringManagedAccessPointSettings ToaddtheIPaddressofaDLinkUnifiedWirelessSwitchtotheAP,clicktheManagedAccessPointtabunder theManageheadingandupdatethefieldsshowninTable33. Field ManagedAP AdministrativeMode SwitchIPaddress BaseIPPort PassPhrase Figure24:ConfiguringManagedAccessPointSettings Table33:ManagedAccessPoint Description ClickEnabledtoallowtheAPandswitchtodiscovereachother.IftheAPsuccessfully authenticatesitselfwithawirelessswitch,youwillnotbeabletoaccessthe AdministratorUI. ClickDisabledtopreventtheAPfromcontactingwirelessswitches. EntertheIPaddressofuptofourwirelessswitchesthatcanmanagetheAP.Youcan entertheIPaddressindottedformatorasanDNSname. Youcanviewalistofwirelessswitchesonyournetworkthatwereconfiguredbyusing aDHCPserver. TheAPattemptstocontactSwitchIPAddress1first. ThestartingIPportnumberusedbythewirelessfeature(inarangeof10consecutive portnumbers).Onlythefirstnumberintherangeisconfigurable.Thedefaultvalueis 57775(through57784). Note:WhenthewirelessBaseIPPortnumberischangedontheswitch,thewireless featureisautomaticallydisabledandreenabled.Thenewvalueisnotsentaspartof theglobalswitchconfigurationintheclusterconfigurationdistributioncommand;

everyswitchintheclustermustbeconfiguredindependentlywiththenewWirelessIP portnumber. Note:WhentheWirelessBaseIPPortnumberischangedfromitsdefaultvalueonthe switch,itmustalsobechangedontheAccessPoints. SelecttheEditoptionandenterapassphrasetoallowtheAPtoauthenticateitselfwith thewirelessswitch.Thepassphrasemustbebetween8and63characters. Toremovethepassword,selectEdit,deletetheexistingpassword,andthenclick Apply. Youmustconfigurethesamepassphraseontheswitch. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page90 UnifiedAccessPointAdministratorsGuide ManagedAccessPointOverview Table33:ManagedAccessPoint Field WDSManagedMode SpecifywhethertheAPwillactasaRootAPorSatelliteAPwithintheWDSgroup:

Description RootAPActsasabridgeorrepeateronthewirelessmediumandcommunicates withtheswitchviathewiredlink. SatelliteAPCommunicateswiththeswitchviaaWDSlinktotheRootAP.This modeenablestheSatelliteAPtodiscoverandestablishWDSlinkwiththeRootAP. SpecifywhethertheEthernetportistobeenabledordisabledwhentheAPbecomes partofaWDSgroup. WDSManaged EthernetPort WDSGroupPassword PasswordforWPA2PersonalauthenticationusedtoestablishtheWDSlinks.Onlythe SatelliteAPsneedthisconfiguration.TheRootAPsgetthepasswordfromtheswitch whentheybecomemanaged. Note:AfteryouconfigurethesettingsontheManagedAccessPointpage,youmustclickApplyto applythechangesandtosavethesettings.ChangingsomesettingsmightcausetheAPtostopand restartsystemprocesses.Ifthishappens,wirelessclientswilltemporarilyloseconnectivity.We recommendthatyouchangeAPsettingswhenWLANtrafficislow. IftheUAPsuccessfullyauthenticateswithaDLinkUnifiedWirelessSwitch,youwilllooseaccesstotheAP throughtheAdministratorUI. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page91 UnifiedAccessPointAdministratorsGuide Configuring802.1XAuthentication Configuring802.1XAuthentication OnnetworksthatuseIEEE802.1X,portbasednetworkaccesscontrol,asupplicant(client)cannotgainaccess tothenetworkuntilthe802.1Xauthenticatorgrantsaccess.Ifyournetworkuses802.1X,youmustconfigure 802.1XauthenticationinformationthattheAPcansupplytotheauthenticator. ToconfiguretheUAP802.1XsupplicantusernameandpasswordbyusingtheWebinterface,clickthe AuthenticationtabandconfigurethefieldsshowninTable34. Figure25:IEEE802.1XAuthentication Table34:IEEE802.1XSupplicantAuthentication Field 802.1XSupplicant EAPMethod Description ClickEnabledtoenabletheAdministrativestatusofthe802.1XSupplicant. ClickDisabledtodisabletheAdministrativestatusofthe802.1XSupplicant. SelectoneofthefollowingEAPmethodstouseforcommunicationbetweentheAPand theauthenticator:

MD5 PEAP TLS D-Link November2011 UnifiedAccessPointAdministratorsGuide Page92 UnifiedAccessPointAdministratorsGuide Configuring802.1XAuthentication Field Username Password CertificateFile Status CertificateFile Upload Table34:IEEE802.1XSupplicantAuthentication(Cont.) Description EntertheusernamefortheAPtousewhenrespondingtorequestsfroman802.1X authenticator. Theusernamecanbe1to64charactersinlength.ASCIIprintablecharactersareallowed, whichincludesupperandlowercasealphabeticletters,thenumericdigits,andspecial symbolssuchas@and#. EnterthepasswordfortheAPtousewhenrespondingtorequestsfroman802.1X authenticator. Thepasswordcanbe1to64charactersinlength.ASCIIprintablecharactersareallowed, whichincludesupperandlowercaseletters,numbers,andspecialsymbolssuchas@

and#. Indicateswhetheracertificatefileispresentandwhenthatcertificateexpires. UploadacertificatefiletotheAPbyusingHTTPorTFTP:

HTTPBrowsetothelocationwherethecertificatefileisstoredandclickUpload. TFTPSpecifytheIPaddressoftheTFTPserverwherethecertificatefileislocated andprovidethefilename,includingthefilepath,thenclickUpload. Note:AfteryouconfigurethesettingsontheAuthenticationpage,youmustclickApplytoapplythe changesandtosavethesettings.ChangingsomesettingsmightcausetheAPtostopandrestart systemprocesses.Ifthishappens,wirelessclientswilltemporarilyloseconnectivity.Werecommend thatyouchangeAPsettingswhenWLANtrafficislow. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page93 UnifiedAccessPointAdministratorsGuide CreatingaManagementAccessControlList CreatingaManagementAccessControlList Youcancreateanaccesscontrollist(ACL)thatlistsuptofiveIPv4hostsandfiveIPv6hoststhatareauthorized toaccesstheAPmanagementinterface.Ifthisfeatureisdisabled,anyonecanaccessthemanagement interfacefromanynetworkclientbysupplyingthecorrectAPusernameandpassword. Tocreateanaccesslist,clicktheManagementACLtab. Figure26:ManagementACL Table35:ManagementACL Field ManagementACLMode IPAddress(15) IPv6Address(15) Description EnableordisablethemanagementACLfeature.AtleastoneIPv4orIPv6address shouldbeconfiguredbeforeenablingManagementACLMode.Ifenabled,only theIPaddressesyouspecifywillhaveWeb,Telnet,SSH,andSNMPaccesstothe managementinterface. EnteruptofiveIPv4addressesthatareallowedmanagementaccesstotheAP.Use dotteddecimalformat(forexample,192.168.10.10). EnteruptofiveIPv6addressesthatareallowedmanagementaccesstotheAP.Use thestandardIPv6addressformat(forexample2001:0db8:1234::abcd). Note:Afteryouconfigurethesettings,clickApplytoapplythechangesandtosavethesettings. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page94 UnifiedAccessPointAdministratorsGuide ConfiguringAccessPointServices Section5:ConfiguringAccessPointServices ThissectiondescribeshowtoconfigureservicesontheUAPandcontainsthefollowingsubsections:

ConfiguringSNMPontheAccessPoint WebServerSettings SettingtheSSHStatus SettingtheTelnetStatus ConfiguringQualityofService ConfiguringEmailAlert EnablingtheTimeSettings(NTP) ConfiguringSNMPontheAccessPoint SimpleNetworkManagementProtocol(SNMP)definesastandardforrecording,storing,andsharing informationaboutnetworkdevices.SNMPfacilitatesnetworkmanagement,troubleshooting,and maintenance.TheAPsupportsSNMPversions1,2,and3.Unlessspecificallynoted,allconfiguration parametersonthispageapplytoSNMPv1andSNMPv2conly. KeycomponentsofanySNMPmanagednetworkaremanageddevices,SNMPagents,andamanagement system.TheagentsstoredataabouttheirdevicesinManagementInformationBases(MIBs)andreturnthis datatotheSNMPmanagerwhenrequested.ManageddevicescanbenetworknodessuchasAPs,routers, switches,bridges,hubs,servers,orprinters. TheUAPcanfunctionasanSNMPmanageddeviceforseamlessintegrationintonetworkmanagementsystems suchasHPOpenView. FromtheSNMPpageundertheServicesheading,youcanstartorstopcontrolofSNMPagents,configure communitypasswords,accessMIBs,andconfigureSNMPTrapdestinations. FromthepagesundertheSNMPv3heading,youcanmanageSNMPv3usersandtheirsecuritylevelsanddefine accesscontroltotheSNMPMIBs.ForinformationabouthowtoconfigureSNMPv3views,groups,users,and targets,seeConfiguringSNMPv3onpage111. ToconfigureSNMP,clicktheSNMPtabundertheServicesheadingandupdatethefieldsdescribedinTable36 onpage96 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page95 UnifiedAccessPointAdministratorsGuide ConfiguringSNMPontheAccessPoint Figure27:ModifyingSNMPSettings Table36:SNMPSettings Field SNMP Enabled/Disabled Readonly communityname

(forpermittedSNMPget operations) Description YoucanspecifytheSNMPadministrativemodeonyournetwork.BydefaultSNMP isenabled.ToenableSNMP,clickEnabled.TodisableSNMP,clickDisabled. After changingthemode,youmustclickApplytosaveyourconfigurationchanges. Note: IfSNMPisdisabled,allremainingfieldsontheSNMPpagearedisabled.This isaglobalSNMPparameterwhichappliestoSNMPv1,SNMPv2c,andSNMPv3. Enterareadonlycommunityname.Thevalidrangeis1256characters. Thecommunityname,asdefinedinSNMPv2c,actsasasimpleauthentication mechanismtorestrictthemachinesonthenetworkthatcanrequestdatatothe SNMPagent.Thenamefunctionsasapassword,andtherequestisassumedtobe authenticifthesenderknowsthepassword. Thecommunitynamecanbeinanyalphanumericformat. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page96 UnifiedAccessPointAdministratorsGuide ConfiguringSNMPontheAccessPoint Table36:SNMPSettings(Cont.) Field PortnumbertheSNMP agentwill listento Description BydefaultanSNMPagentonlylistenstorequestsfromport161.However,youcan configurethissotheagentlistenstorequestsonanotherport. EntertheportnumberonwhichyouwanttheSNMPagentstolistentorequests. Thevalidrangeis165535. Note:ThisisaglobalSNMPparameterthatappliestoSNMPv1,SNMPv2c,and SNMPv3. AllowSNMPsetrequests YoucanchoosewhetherornottoallowSNMPsetrequestsontheAP.Enabling SNMPsetrequestsmeansthatmachinesonthenetworkcanexecuteconfiguration changesviatheSNMPagentontheAPtotheDLinkSystemMIB.ToenableSNMP setrequests,clickEnabled.TodisableSNMPsetrequests,clickDisabled. IfyouhaveenabledSNMPsetrequestsyoucansetareadwritecommunityname. Thevalidrangeis1256characters. Settingacommunitynameissimilartosettingapassword.Onlyrequestsfromthe machinesthatidentifythemselveswiththiscommunitynamewillbeaccepted. Thecommunitynamecanbeinanyalphanumericformat. YoucanrestrictthesourceofpermittedSNMPrequests. TorestrictthesourceofpermittedSNMPrequests,clickEnabled. TopermitanysourcesubmittinganSNMPrequest,clickDisabled. SpecifytheIPv4DNShostnameorsubnetofthemachinesthatcanexecutegetand setrequeststothemanageddevices.Thevalidrangeis1256characters. Aswithcommunitynames,thisprovidesalevelofsecurityonSNMPsettings.The SNMPagentwillonlyacceptrequestsfromthehostnameorsubnetspecifiedhere. Tospecifyasubnet,enteroneormoresubnetworkaddressrangesintheform address/mask_lengthwhereaddressisanIPaddressandmask_lengthisthe numberofmaskbits.Bothformatsaddress/maskandaddress/

mask_lengtharesupported.Individualhostscanbeprovidedforthis,i.e.I.P AddressorHostname.Forexample,ifyouenterarangeof192.168.1.0/24this specifiesasubnetworkwithaddress192.168.1.0andasubnetmaskof 255.255.255.0. TheaddressrangeisusedtospecifythesubnetofthedesignatedNMS.Only machineswithIPaddressesinthisrangearepermittedtoexecutegetandset requestsonthemanageddevice.Giventheexampleabove,themachineswith addressesfrom192.168.1.1through192.168.1.254canexecuteSNMP commandsonthedevice.(Theaddressidentifiedbysuffix.0inasubnetworkrange isalwaysreservedforthesubnetaddress,andtheaddressidentifiedby.255inthe rangeisalwaysreservedforthebroadcastaddress). Asanotherexample,ifyouenterarangeof10.10.1.128/25machineswithIP addressesfrom10.10.1.129through10.10.1.254 canexecuteSNMP requestsonmanageddevices.Inthisexample,10.10.1.128isthenetwork addressand10.10.1.255isthebroadcastaddress.126addresseswouldbe designated. SpecifytheIPv6DNShostnameorsubnetofthemachinesthatcanexecutegetand setrequeststothemanageddevices. Readwritecommunity name(forpermitted SNMPsetoperations) Restrictthesourceof SNMPrequeststoonly thedesignatedhostsor subnets Hostname,addressor subnetofNetwork ManagementSystem IPv6HostnameorIPv6 subnetofNetwork ManagementSystem D-Link November2011 UnifiedAccessPointAdministratorsGuide Page97 UnifiedAccessPointAdministratorsGuide ConfiguringSNMPontheAccessPoint Field Communitynamefor traps HostnameorIPaddress Table36:SNMPSettings(Cont.) Description EntertheglobalcommunitystringassociatedwithSNMPtraps.Thevalidrangeis 1256characters. Trapssentfromthedevicewillprovidethisstringasacommunityname. Thecommunitynamecanbeinanyalphanumericformat.Specialcharactersare notpermitted. EntertheDNShostnameofthecomputertowhichyouwanttosendSNMPtraps. Thevalidrangeis1256characters. AnexampleofaDNShostnameis:snmptraps.foo.com. SinceSNMPtrapsaresent randomlyfromtheSNMPagent,itmakessensetospecifywhereexactlythetraps shouldbesent.YoucanadduptoamaximumofthreeDNShostnames.Ensureyou selecttheEnabledcheckboxbesidetheappropriatehostname. Note:AfteryouconfiguretheSNMPsettings,youmustclickApplytoapplythechangesandtosave thesettings.ChangingsomesettingsmightcausetheAPtostopandrestartsystemprocesses.Ifthis happens,wirelessclientswilltemporarilyloseconnectivity.WerecommendthatyouchangeAP settingswhenWLANtrafficislow. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page98 UnifiedAccessPointAdministratorsGuide WebServerSettings WebServerSettings TheAPcanbemanagedthroughHTTPorsecureHTTP(HTTPS)sessions.BydefaultbothHTTPandHTTPS accessareenabled.Eitheraccesstypecanbedisabledseparately. ToconfigureWebserversettings,clickWebServertab. Figure28:ConfiguringWebServerSettings Table37:WebServerSettings Description Field HTTPSServerStatus EnableordisableaccessthroughaSecureHTTPServer(HTTPS). HTTPServerStatus EnableordisableaccessthroughHTTP.ThissettingisindependentoftheHTTPSserver statussetting. SpecifytheportnumberforHTTPtraffic(defaultis80). HTTPPort D-Link November2011 UnifiedAccessPointAdministratorsGuide Page99 UnifiedAccessPointAdministratorsGuide WebServerSettings Table37:WebServerSettings(Cont.) Field MaximumSessions WhenauserlogsontotheAPwebinterface,asessioniscreated.Thissessionis Description maintaineduntiltheuserlogsofforthesessioninactivitytimerexpires. Enterthenumberwebsessions,includingbothHTTPandHTTPs,thatcanexistatthe sametime.Therangeis110sessions.Ifthemaximumnumberofsessionsisreached, thenextuserwhoattemptstologontotheAPwebinterfacereceivesanerrormessage aboutthesessionlimit. Enterthemaximumamountoftime,inminutes,aninactiveuserremainsloggedonto theAPwebinterface.Whentheconfiguredtimeoutisreached,theuserisautomatically loggedofftheAP.Therangeis11440minutes(1440minutes=1day). SelectthisoptiontogenerateanewSSLcertificateforthesecureWebserver.Thisshould bedoneoncetheaccesspointhasanIPaddresstoensurethatthecommonnamefor thecertificatematchestheIPaddressoftheUAP.GeneratinganewSSLcertificatewill restartthesecureWebserver.Thesecureconnectionwillnotworkuntilthenew certificateisacceptedonthebrowser. Indicateswhetheracertificatefileispresentandspecifiesitsexpirationdateandissuer commonname. SaveacopyofthecurrentHTTPSSLcertificateonalocalsystemorTFTPserver. HTTPClickDownloadandspecifywheretostorethebackupcopyofthecertificate file. SessionTimeout GenerateSSL Certificate HTTPSSLCertificate FileStatus ToGettheCurrent HTTPSSLCertificate TFTPProvideafilenameforthecertificatefile,includingthefilepath,specifythe IPaddressoftheTFTPserverwherethecertificatefilecopyistobestored,andthen clickDownload. TouploadaHTTP SSLCertificatefrom aPCoraTFTP Server UploadacertificatefiletotheAPbyusingHTTPorTFTP:

HTTPBrowsetothelocationwherethecertificatefileisstoredandclickUpload. TFTPSpecifytheIPaddressoftheTFTPserverwherethecertificatefileislocated andprovidethefilename,includingthefilepath,thenclickUpload. Note:ClickApplytoapplythechangesandtosavethesettings.Ifyoudisabletheprotocolyouare currentlyusingtoaccesstheAPmanagementinterface,thecurrentconnectionwillendandyouwill notbeabletoaccesstheAPbyusingthatprotocoluntilitisenabled. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page100 UnifiedAccessPointAdministratorsGuide SettingtheSSHStatus SettingtheSSHStatus SecureShell(SSH)isaprogramthatprovidesaccesstotheDWLx600APCLIfromaremotehost.SSHismore securethanTelnetforremoteaccessbecauseitprovidesstrongauthenticationandsecurecommunications overinsecurechannels.FromtheSSHpage,youcanenableordisableSSHaccesstothesystem. Figure29:SSHStatus Table38:SSHSettings Field SSHStatus Description ChoosetoeitherenableordisableSSHaccesstotheAPCLI:

TopermitremoteaccesstotheAPbyusingSSH,clickEnabled. TopreventremoteaccesstotheAPbyusingSSH,clickDisabled. SettingtheTelnetStatus TelnetisaprogramthatprovidesaccesstotheDWLx600APCLIfromaremotehost.FromtheTelnetpage,you canenableordisableTelnetaccesstothesystem. Figure30:TelnetStatus Table39:TelnetSettings Field TelnetStatus Description ChoosetoeitherenableordisableTelnetaccesstotheAPCLI:

TopermitremoteaccesstotheAPbyusingTelnet,clickEnabled. TopreventremoteaccesstotheAPbyusingTelnet,clickDisabled. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page101 UnifiedAccessPointAdministratorsGuide ConfiguringQualityofService ConfiguringQualityofService QualityofService(QoS)providesyouwiththeabilitytospecifyparametersonmultiplequeuesforincreased throughputandbetterperformanceofdifferentiatedwirelesstrafficlikeVoiceoverIP(VoIP),othertypesof audio,video,andstreamingmedia,aswellastraditionalIPdataovertheUAP. ConfiguringQoSontheUAPconsistsofsettingparametersonexistingqueuesfordifferenttypesofwireless traffic,andeffectivelyspecifyingminimumandmaximumwaittimes(throughContentionWindows)for transmission.ThesettingsdescribedhereapplytodatatransmissionbehaviorontheAPonly,nottothatof theclientstations. APEnhancedDistributedChannelAccess(EDCA)ParametersaffecttrafficflowingfromtheAPtotheclient station. StationEnhancedDistributedChannelAccess(EDCA)Parametersaffecttrafficflowingfromtheclientstationto theAP. ThedefaultvaluesfortheAPandstationEDCAparametersarethosesuggestedbytheWiFiAllianceinthe WMMspecification.Innormalusethesevaluesshouldnotneedtobechanged.Changingthesevalueswill affecttheQoSprovided. Note:OntheDWL6600APandDWL8600AP,theQoSsettingsapplytobothradios,butthetrafficfor eachradioisqueuedindependently. TosetupqueuesforQoS,clicktheQoStabundertheServicesheadingandconfiguresettingsasdescribedin Table40onpage103. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page102 UnifiedAccessPointAdministratorsGuide ConfiguringQualityofService Field EDCATemplate AP EDCA Parameters Queue Figure31:ConfiguringQoSSettings Table40:QoSSettings Description Possibleoptionsare:Custom,Default,OptimizedforVoice. QueuesaredefinedfordifferenttypesofdatatransmittedfromAPtostation:

Data0(Voice)Highpriorityqueue,minimumdelay.Timesensitivedatasuch asVoIPandstreamingmediaareautomaticallysenttothisqueue. Data1(Video)Highpriorityqueue,minimumdelay.Timesensitivevideodata isautomaticallysenttothisqueue. Data2(besteffort)Mediumpriorityqueue,mediumthroughputanddelay. MosttraditionalIPdataissenttothisqueue. Data3(Background)Lowestpriorityqueue,highthroughput.Bulkdatathat requiresmaximumthroughputandisnottimesensitiveissenttothisqueue

(FTPdata,forexample). AIFS

(InterFrameSpace) TheArbitrationInterFrameSpacing(AIFS)specifiesawaittimefordataframes. Thewaittimeismeasuredinslots.ValidvaluesforAIFSare1through255. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page103 UnifiedAccessPointAdministratorsGuide ConfiguringQualityofService Field cwMin

(MinimumContention Window) cwMax

(MaximumContention Window) Max.BurstLength Wi-Fi Multimedia Settings WiFiMultiMedia Table40:QoSSettings(Cont.) Description Thisparameterisinputtothealgorithmthatdeterminestheinitialrandombackoff waittime(window)forretryofatransmission. ThevaluespecifiedforMinimumContentionWindowistheupperlimit(in milliseconds)ofarangefromwhichtheinitialrandombackoffwaittimeis determined. Thefirstrandomnumbergeneratedwillbeanumberbetween0andthenumber specifiedhere. Ifthefirstrandombackoffwaittimeexpiresbeforethedataframeissent,aretry counterisincrementedandtherandombackoffvalue(window)isdoubled. Doublingwillcontinueuntilthesizeoftherandombackoffvaluereachesthe numberdefinedintheMaximumContentionWindow. ValidvaluesforcwMinare1,3,7,15,31,63,127,255,511,or1024.Thevaluefor cwMinmustbelowerthanthevalueforcwMax. ThevaluespecifiedfortheMaximumContentionWindowistheupperlimit(in milliseconds)forthedoublingoftherandombackoffvalue.Thisdoublingcontinues untileitherthedataframeissentortheMaximumContentionWindowsizeis reached. OncetheMaximumContentionWindowsizeisreached,retrieswillcontinueuntila maximumnumberofretriesallowedisreached. ValidvaluesforcwMaxare1,3,7,15,31,63,127,255,511,or1024.Thevaluefor cwMaxmustbehigherthanthevalueforcwMin. TheMax.BurstLengthisanAPEDCAparameterandonlyappliestotrafficflowing fromtheAPtotheclientstation. Thisvaluespecifies(inmilliseconds)themaximumburstlengthallowedforpacket burstsonthewirelessnetwork.Apacketburstisacollectionofmultipleframes transmittedwithoutheaderinformation.Thedecreasedoverheadresultsinhigher throughputandbetterperformance. Validvaluesformaximumburstlengthare0.0through999. WiFiMultiMedia(WMM)isenabledbydefault.WithWMMenabled,QoS prioritizationandcoordinationofwirelessmediumaccessison.WithWMM enabled,QoSsettingsontheUAPcontroldownstreamtrafficflowingfromtheAPto clientstation(APEDCAparameters)andtheupstreamtrafficflowingfromthe stationtotheAP(stationEDCAparameters). DisablingWMMdeactivatesQoScontrolofstationEDCAparametersonupstream trafficflowingfromthestationtotheAP. WithWMMdisabled,youcanstillsetsomeparametersonthedownstreamtraffic flowingfromtheAPtotheclientstation(APEDCAparameters). TodisableWMMextensions,clickDisabled. ToenableWMMextensions,clickEnabled. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page104 UnifiedAccessPointAdministratorsGuide ConfiguringQualityofService Field Station EDCA Parameters Queue AIFS

(InterFrameSpace) cwMin

(MinimumContention Window) cwMax

(MaximumContention Window) TXOPLimit Other QoS Settings NoAcknowledgement APSD Table40:QoSSettings(Cont.) Description QueuesaredefinedfordifferenttypesofdatatransmittedfromstationtoAP:

Data0(Voice)Highestpriorityqueue,minimumdelay.Timesensitivedata suchasVoIPandstreamingmediaareautomaticallysenttothisqueue. Data1(Video)Highestpriorityqueue,minimumdelay.Timesensitivevideo dataisautomaticallysenttothisqueue. Data2(besteffort)Mediumpriorityqueue,mediumthroughputanddelay. MosttraditionalIPdataissenttothisqueue. Data3(Background)Lowestpriorityqueue,highthroughput.Bulkdatathat requiresmaximumthroughputandisnottimesensitiveissenttothisqueue

(FTPdata,forexample). TheArbitrationInterFrameSpacing(AIFS)specifiesawaittimefordataframes. Thewaittimeismeasuredinslots.ValidvaluesforAIFSare1through255. Thisparameterisusedbythealgorithmthatdeterminestheinitialrandombackoff waittime(window)forretryofadatatransmissionduringaperiodofcontentionfor UnifiedAccessPointresources.ThevaluespecifiedhereintheMinimumContention Windowistheupperlimit(inmilliseconds)ofarangefromwhichtheinitialrandom backoffwaittimewillbedetermined.Thefirstrandomnumbergeneratedwillbea numberbetween0andthenumberspecifiedhere.Ifthefirstrandombackoffwait timeexpiresbeforethedataframeissent,aretrycounterisincrementedandthe randombackoffvalue(window)isdoubled.Doublingwillcontinueuntilthesizeof therandombackoffvaluereachesthenumberdefinedintheMaximumContention Window. ThevaluespecifiedhereintheMaximumContentionWindowistheupperlimit(in milliseconds)forthedoublingoftherandombackoffvalue.Thisdoublingcontinues untileitherthedataframeissentortheMaximumContentionWindowsizeis reached. OncetheMaximumContentionWindowsizeisreached,retrieswillcontinueuntila maximumnumberofretriesallowedisreached. TheTXOPLimitisastationEDCAparameterandonlyappliestotrafficflowingfrom theclientstationtotheAP.TheTransmissionOpportunity(TXOP)isanintervalof time,inmilliseconds,whenaWMEclientstationhastherighttoinitiate transmissionsontothewirelessmedium(WM)towardstheUnifiedAccessPoint. TheTXOPLimitmaximumvalueis65535. SelectOntospecifythattheAPshouldnotacknowledgeframeswithQosNoAckas theserviceclassvalue. SelectOntoenableAutomaticPowerSaveDelivery(APSD),whichisapower managementmethod.APSDisrecommendedifVoIPphonesaccessthenetwork throughtheAP. Note:AfteryouconfiguretheQoSsettings,youmustclickApplytoapplythechangesandtosavethe settings.ChangingsomesettingsmightcausetheAPtostopandrestartsystemprocesses.Ifthis happens,wirelessclientswilltemporarilyloseconnectivity.WerecommendthatyouchangeAP settingswhenWLANtrafficislow. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page105 UnifiedAccessPointAdministratorsGuide ConfiguringEmailAlert ConfiguringEmailAlert TheEmailAlertfeatureallowstheAPtoautomaticallysendemailmessageswhenaneventatorabovethe configuredseverityleveloccurs.UsetheEmailAlertConfigurationpagetoconfiguremailserversettings,toset theseveritylevelthattriggersalerts,andtoadduptothreeemailaddresseswhereurgentandnonurgent emailalertsaresent. Note:EmailalertisoperationallydisabledwhentheAPtransitionstomanagedmode. Figure32:ConfiguringEmailAlert Table41:EmailAlertConfiguration Field Description EmailAlertGlobalConfiguration AdminMode FromAddress LogDuration D-Link November2011 GloballyenableordisabletheEmailAlertfeatureontheAP.Bydefault,emailalerts aredisabled. SpecifytheemailaddressthatappearsintheFromfieldofalertmessagessentfrom theAP,forexampledlinkAP23@foo.com.Theaddresscanbeamaximumof255 charactersandcancontainonlyprintablecharacters.Bydefault,noaddressis configured. Thisduration,inminutes,determineshowfrequentlythenoncriticalmessagesare senttotheSMTPServer.Therangeis301440minutes.Thedefaultis30minutes. UnifiedAccessPointAdministratorsGuide Page106 UnifiedAccessPointAdministratorsGuide ConfiguringEmailAlert Field UrgentMessage Severity NonUrgentSeverity Table41:EmailAlertConfiguration(Cont.) Description Configurestheseveritylevelforlogmessagesthatareconsideredtobeurgent. Messagesinthiscategoryaresentimmediately.Thesecuritylevelyouselectandall higherlevelsareurgent:

Emergencyindicatessystemisunusable.Itisthehighestlevelofseverity. Alertindicatesactionmustbetakenimmediately. Criticalindicatescriticalconditions. Errorindicateserrorconditions. Warningindicateswarningconditions. Noticeindicatesnormalbutsignificantconditions. Informationalindicatesinformationalmessages. Debugindicatesdebuglevelmessages. Configurestheseveritylevelforlogmessagesthatareconsideredtobenonurgent. Messagesinthiscategoryarecollectedandsentinadigestformatthetimeinterval specifiedbytheLogDurationfield.Thesecuritylevelyouselectandalllevelsupto, butnotincludingthelowestUrgentlevelareconsiderednonurgent.Messages belowthesecuritylevelyouspecifyarenotsentviaemail. SeetheUrgentMessagefielddescriptionforinformationaboutthesecuritylevels. EmailAlertMailServerConfiguration MailServerAddress MailServerSecurity MailServerPort Username Password EmailAlertMessageConfiguration ToAddress1 SpecifytheIPaddressorhostnameoftheSMTPserveronthenetwork. SpecifywhethertouseSMTPoverSSL(TLSv1)ornosecurity(Open)for authenticationwiththemailserver.ThedefaultisOpen. ConfigurestheTCPportnumberforSMTP.Therangeisavalidportnumberfrom0 to65535.Thedefaultis25,whichisthestandardportforSMTP. Specifytheusernametousewhenauthenticationwiththemailserverisrequired. Theusernameisa64bytecharacterstringwithallprintablecharacters.Thedefault isadmin. Specifythepasswordassociatedwiththeusernameconfiguredinthepreviousfield. ToAddress2 ToAddress3 EmailSubject Configurethefirstemailaddresstowhichalertmessagesaresent.Theaddressmust beavalidemailaddress.Bydefault,noaddressisconfigured. Optionally,configurethesecondemailaddresstowhichalertmessagesaresent.The addressmustbeavalidemailaddress.Bydefault,noaddressisconfigured. Optionally,configurethethirdemailaddresstowhichalertmessagesaresent.The addressmustbeavalidemailaddress.Bydefault,noaddressisconfigured. Specifythetexttobedisplayedinthesubjectoftheemailalertmessage.Thesubject cancontainupto255alphanumericcharacters.ThedefaultisLogmessagefromAP. Note:AfteryouconfiguretheEmailAlertsettings,clickApplytoapplythechangesandtosavethe settings. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page107 UnifiedAccessPointAdministratorsGuide ConfiguringEmailAlert Tovalidatetheconfiguredemailservercredentials,clickTestMail.Youcansendatestemailoncetheemail serverdetailsareconfigured. ThefollowingtextshowsanexampleofanemailalertsentfromtheAPtothenetworkadministrator:

From:AP192.168.2.10@mailserver.com Sent:Wednesday,July08,201111:16AM To:administrator@mailserver.com Subject:logmessagefromAP TIMEPriorityProcessIdMessage Jul803:48:25infologin[1457]rootloginonttyp0 Jul803:48:26infomini_httpssl[1175]Maxconcurrentconnectionsof20reached D-Link November2011 UnifiedAccessPointAdministratorsGuide Page108 UnifiedAccessPointAdministratorsGuide EnablingtheTimeSettings(NTP) EnablingtheTimeSettings(NTP) UsetheTimeSettingspagetospecifytheNetworkTimeProtocol(NTP)servertousetoprovidetimeanddate informationtotheAPortoconfigurethetimeanddateinformationmanually. NTPisanInternetstandardprotocolthatsynchronizescomputerclocktimesonyournetwork.NTPservers transmitCoordinatedUniversalTime(UTC,alsoknownasGreenwichMeanTime)totheirclientsystems.NTP sendsperiodictimerequeststoservers,usingthereturnedtimestamptoadjustitsclock.Thetimestampis usedtoindicatethedateandtimeofeacheventinlogmessages. Seehttp://www.ntp.orgformoreinformationaboutNTP. TosetthesystemtimeeithermanuallyorbyspecifyingtheaddressoftheNTPserverfortheAPtouse,click theServices>TimeSettings(NTP)tabandupdatethefieldsasdescribedinTable42onpage110. Figure33:SettingtheSystemTime D-Link November2011 UnifiedAccessPointAdministratorsGuide Page109 UnifiedAccessPointAdministratorsGuide EnablingtheTimeSettings(NTP) Field SetSystemTime NTPServer(UseNTP) SystemDate(Manual configuration) SystemTime(Manual configuration) TimeZone AdjustTimeforDaylight Savings DSTStart(24HR) DSTEnd(24HR) DSTOffset(minutes) Table42:NTPSettings Description NTPprovidesawayfortheAPtoobtainandmaintainitstimefromaserveron thenetwork.UsinganNTPservergivesyourAPtheabilitytoprovidethe correcttimeofdayinlogmessagesandsessioninformation. Choosetouseanetworktimeprotocol(NTP)servertodeterminethesystem time,orsetthesystemtimemanually:

TopermittheAPtopollanNTPserver,clickUsingNetworkTimeProtocol

(NTP). TopreventtheAPfrompollinganNTPserver,clickManually. IfNTPisenabled,specifytheNTPservertouse. YoucanspecifytheNTPserverbyhostnameorIPaddress,althoughusingthe IPaddressisnotrecommendedasthesecanchangemorereadily. Ifyouspecifyahostname,notethefollowingrequirements:

Thelengthmustbebetween163characters. Upperandlowercasecharacters,numbers,andhyphensareaccepted. Thefirstcharactermustbealetter(azorAZ),andthelastcharacter cannotbeahyphen. Specifythecurrentmonth,day,andyear. Specifythecurrenttimeinhoursandminutes.Thesystemusesa24hour clock,so6:00PMisconfiguredas18:00. Selectyourlocaltimezonefromthemenu.ThedefaultisUSA(Pacific). SelecttohavethesystemadjustthereportedtimeforDaylightSavingsTime

(DST).Whenthisfieldisselected,fieldstoconfigureDaylightSavingsTime settingsappear. ConfigurethedateandtimetobeginDaylightSavingsTimefortheSystem Time. ConfigurethedateandtimetoendDaylightSavingsTimefortheSystemTime. SelectthenumberofminutestooffsetDST.Thedefaultis60minutes. Note:AfteryouconfiguretheTimesettings,youmustclickApplytoapplythechangesandtosave thesettings.ChangingsomesettingsmightcausetheAPtostopandrestartsystemprocesses.Ifthis happens,wirelessclientswilltemporarilyloseconnectivity.WerecommendthatyouchangeAP settingswhenWLANtrafficislow. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page110 UnifiedAccessPointAdministratorsGuide ConfiguringSNMPv3 Section6:ConfiguringSNMPv3 ThissectiondescribeshowtoconfiguretheSNMPv3settingsontheUAPandcontainsthefollowing subsections:

ConfiguringSNMPv3Views ConfiguringSNMPv3Groups ConfiguringSNMPv3Users ConfiguringSNMPv3Targets ConfiguringSNMPv3Views AMIBviewiscombinationofasetofviewsubtreesorafamilyofviewsubtreeswhereeachviewsubtreeisa subtreewithinthemanagedobjectnamingtree.YoucancreateMIBviewstocontroltheOIDrangethat SNMPv3userscanaccess. AMIBviewcalled"all"iscreatedbydefaultinthesystem.Thisviewcontainsallmanagementobjects supportedbythesystem. Note:Ifyoucreateanexcludedviewsubtree,createacorrespondingincludedentrywiththesame viewnametoallowsubtreesoutsideoftheexcludedsubtreetobeincluded.Forexample,tocreatea viewthatexcludesthesubtree1.3.6.1.4,createanexcludedentrywiththeOID1.3.6.1.4.Then,create anincludedentrywithOID.1withthesameviewname. Figure34:SNMPv3Views D-Link November2011 UnifiedAccessPointAdministratorsGuide Page111 UnifiedAccessPointAdministratorsGuide ConfiguringSNMPv3Views Table43describesthefieldsyoucanconfigureontheSNMPv3Viewspage. Table43:SNMPv3Views Field ViewName Type OID Mask SNMPv3Views Description EnteranametoidentifytheMIBview. Viewnamescancontainupto32alphanumericcharacters. Specifieswhethertoincludeorexcludetheviewsubtreeorfamilyofsubtreesfromthe MIBview. EnteranOIDstringforthesubtreetoincludeorexcludefromtheview. Forexample,thesystemsubtreeisspecifiedbytheOIDstring.1.3.6.1.2.1.1. TheOIDmaskis47charactersinlength.TheformatoftheOIDmaskisxx.xx.xx(.)...or xx:xx:xx....(:)andis16octetsinlength.Eachoctetis2hexadecimalcharactersseparated byeither.(period)or:(colon).Onlyhexcharactersareacceptedinthisfield.For example,OIDmaskFA.80is11111010.10000000. Afamilymaskisusedtodefineafamilyofviewsubtrees.Thefamilymaskindicateswhich subidentifiersoftheassociatedfamilyOIDstringaresignificanttothefamily's definition. Afamilyofviewsubtreesallowscontrolaccesstoonerowinatable,inamoreefficient manner. ThisfieldshowstheMIBviewsontheUAP.Toremoveaview,selectitandclickRemove. Note:AfteryouconfiguretheSNMPv3Viewssettings,youmustclickApplytoapplythechangesand tosavethesettings. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page112 UnifiedAccessPointAdministratorsGuide ConfiguringSNMPv3Groups ConfiguringSNMPv3Groups SNMPv3groupsallowyoutocombineusersintogroupsofdifferentauthorizationandaccessprivileges. Bydefault,theUAPhastwogroups:

ROAreadonlygroupusingauthenticationanddataencryption.UsersinthisgroupuseanMD5key/

passwordforauthenticationandaDESkey/passwordforencryption.BoththeMD5andDESkey/

passwordsmustbedefined.Bydefault,usersofthisgroupwillhavereadonlyaccesstothedefaultallMIB view,whichcanbemodifiedbytheuser. RWAread/writegroupusingauthenticationanddataencryption.UsersinthisgroupuseanMD5key/

passwordforauthenticationandaDESkey/passwordforencryption.BoththeMD5andDESkey/

passwordsmustbedefined.Bydefault,usersofthisgroupwillhavereadandwriteaccesstothedefault allMIBview,whichcanbemodifiedbytheuser. RWandROgroupsaredefinedbydefault. Note:TheUAPsupportsmaximumofeightgroups. Todefineadditionalgroups,navigatetotheSNMPv3GroupspageandconfigurethesettingsthatTable44on page114describes. Figure35:SNMPv3Groups D-Link November2011 UnifiedAccessPointAdministratorsGuide Page113 UnifiedAccessPointAdministratorsGuide ConfiguringSNMPv3Groups Field Name SecurityLevel WriteViews ReadViews SNMPv3Groups Table44:SNMPv3Groups Description Specifyanametousetoidentifythegroup.ThedefaultgroupnamesareRWandRO. Groupnamescancontainupto32alphanumericcharacters. Selectoneofthefollowingsecuritylevelsforthegroup:

noAuthenticationnoPrivacyNoauthenticationandnodataencryption(no security). AuthenticationnoPrivacyAuthentication,butnodataencryption.Withthis securitylevel,userssendSNMPmessagesthatuseanMD5key/passwordfor authentication,butnotaDESkey/passwordforencryption. AuthenticationPrivacyAuthenticationanddataencryption.Withthissecurity level,userssendanMD5key/passwordforauthenticationandaDESkey/password forencryption. Forgroupsthatrequireauthentication,encryption,orboth,youmustdefinetheMD5 andDESkey/passwordsontheSNMPv3Userspage. Selectthewriteaccesstomanagementobjects(MIBs)forthegroup:

writeallThegroupcancreate,alter,anddeleteMIBs. writenoneThegroupisnotallowedtocreate,alter,ordeleteMIBS. Selectthereadaccesstomanagementobjects(MIBs)forthegroup:

viewallThegroupisallowedtoviewandreadallMIBs. viewnoneThegroupcannotvieworreadMIBs. ThisfieldshowsthedefaultgroupsandthegroupsthatyouhavedefinedontheAP.To removeagroup,selectthegroupandclickRemove. Note:AfteryouconfiguretheSNMPv3Groupssettings,youmustclickApplytoapplythechangesand tosavethesettings. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page114 UnifiedAccessPointAdministratorsGuide ConfiguringSNMPv3Users ConfiguringSNMPv3Users FromtheSNMPv3Userspage,youcandefinemultipleusers,associatethedesiredsecurityleveltoeachuser, andconfiguresecuritykeys. Forauthentication,onlyMD5typeissupported,andforencryptiononlyDEStypeissupported.Thereareno defaultSNMPv3usersontheUAP. Table45describesthefieldstoconfigureSNMPv3users. Figure36:SNMPv3Users Table45:SNMPv3Users Field Name Group Description EntertheusernametoidentifytheSNMPv3user. Usernamescancontainupto32alphanumericcharacters. Maptheusertoagroup.ThedefaultgroupsareRWAuth,RWPriv,andRO.Youcan defineadditionalgroupsontheSNMPv3Groupspage. AuthenticationType SelectthetypeofauthenticationtouseonSNMPrequestsfromtheuser:

AuthenticationKey EncryptionType MD5RequireMD5authenticationonSNMPv3requestsfromtheuser. NoneSNMPv3requestsfromthisuserrequirenoauthentication. IfyouspecifyMD5astheauthenticationtype,enterapasswordtoenabletheSNMP agenttoauthenticaterequestssentbytheuser. Thepassphrasemustbebetween8and32charactersinlength. SelectthetypeofprivacytouseonSNMPrequestsfromtheuser:

DESUseDESencryptiononSNMPv3requestsfromtheuser. NoneSNMPv3requestsfromthisuserrequirenoprivacy. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page115 UnifiedAccessPointAdministratorsGuide ConfiguringSNMPv3Targets Table45:SNMPv3Users(Cont.) Field EncryptionKey SNMPv3Users Description IfyouspecifyDESastheprivacytype,enterakeytousetoencrypttheSNMPrequests. Thepassphrasemustbebetween8and32charactersinlength. ThisfieldshowstheusersthatyouhavedefinedontheAP.Toremoveauser,selectthe userandclickRemove. Note:AfteryouconfiguretheSNMPv3Userssettings,youmustclickApplytoapplythechangesand tosavethesettings. ConfiguringSNMPv3Targets SNMPv3Targetssend"inform"messagestotheSNMPmanager.Eachtargetisidentifiedbyatargetnameand associatedwithtargetIPaddress,UDPport,andSNMPusername. Figure37:SNMPv3Target Table46:SNMPv3Targets Field IPAddress Port Users SNMPv3Targets Description EntertheIPaddressoftheremoteSNMPmanagertoreceivethetarget. EntertheUDPporttouseforsendingSNMPtargets. EnterthenameoftheSNMPusertoassociatewiththetarget.ToconfigureSNMPusers, seeConfiguringSNMPv3Usersonpage115. ThisfieldshowstheSNMPv3TargetsontheUAP.Toremoveatarget,selectitandclick Remove. Note:AfteryouconfiguretheSNMPv3Targetsettings,youmustclickApplytoapplythechangesand tosavethesettings. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page116 UnifiedAccessPointAdministratorsGuide MaintainingtheAccessPoint Section7:MaintainingtheAccessPoint ThissectiondescribeshowtomaintaintheUAP. FromtheUAPAdministratorUI,youcanperformthefollowingmaintenancetasks:

SavingtheCurrentConfigurationtoaBackupFile RestoringtheConfigurationfromaPreviouslySavedFile PerformingAPMaintenance ResettingtheFactoryDefaultConfiguration RebootingtheAccessPoint UpgradingtheFirmware PacketCaptureConfigurationandSettings SavingtheCurrentConfigurationtoaBackupFile TheAPconfigurationfileisinXMLformatandcontainsalloftheinformationabouttheAPsettings.Youcan downloadtheconfigurationfiletoamanagementstationtomanuallyeditthecontentortosaveasabackup copy. YoucanuseHTTPorTFTPtotransferfilestoandfromtheUAP.Afteryoudownloadaconfigurationfiletothe managementstation,youcanmanuallyeditthefile,whichisinXMLformat.Then,youcanuploadtheedited configurationfiletoapplythoseconfigurationsettingstotheAP. UsethefollowingstepstosaveacopyofthecurrentsettingsonanAPtoabackupconfigurationfilebyusing TFTP:

1. SelectTFTPforDownloadMethod. 2. Enteraname(1to63characters)forthebackupfileintheFilenamefield,includingthe.xmlfilename extensionandthepathtothedirectorywhereyouwanttosavethefile. 3. EntertheIPaddressoftheTFTPserver. 4. ClickDownloadtosaveacopyofthefiletotheTFTPserver. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page117 UnifiedAccessPointAdministratorsGuide RestoringtheConfigurationfromaPreviouslySavedFile UsethefollowingstepstosaveacopyofthecurrentsettingsonanAPtoabackupconfigurationfilebyusing HTTP:

1. SelectHTTPforDownloadMethod. 2. ClicktheDownloadbutton. Adialogboxdisplaysverifyingthedownload. 3. Toproceedwiththedownload,selectOK. Adialogboxopensallowingyoutovieworsavethefile. 4. SelecttheSaveFileoptionandselectOK. 5. Usethefilebrowsertonavigatetothedirectorywhereyouwanttosavethefile,andclickOKtosavethe file. Youcankeepthedefaultfilename(config.xml)orrenamethebackupfile,butbesuretosavethefilewith an.xmlextension. RestoringtheConfigurationfromaPreviouslySavedFile YoucanuseHTTPorTFTPtotransferfilestoandfromtheUAP.Afteryoudownloadaconfigurationfiletothe managementstation,youcanmanuallyeditthefile,whichisinXMLformat.Then,youcanuploadtheedited configurationfiletoapplythoseconfigurationsettingstotheAP. UsethefollowingprocedurestorestoretheconfigurationonanAPtopreviouslysavedsettingsbyusingTFTP:

1. SelectTFTPforUploadMethod. 2. Enteraname(1to63characters)forthebackupfileintheFilenamefield,includingthe.xmlfilename extensionandthepathtothedirectorythatcontainstheconfigurationfiletoupload. 3. EntertheIPaddressoftheTFTPserverintheServerIPfield. 4. ClicktheRestorebutton. TheAPreboots.Arebootconfirmationdialogandfollowonrebootingstatusmessagedisplays.Pleasewait fortherebootprocesstocomplete,whichmighttakeseveralminutes. TheAdministrationWebUIisnotaccessibleuntiltheAPhasrebooted. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page118 UnifiedAccessPointAdministratorsGuide RestoringtheConfigurationfromaPreviouslySavedFile UsethefollowingstepstosaveacopyofthecurrentsettingsonanAPtoabackupconfigurationfilebyusing HTTP:

1. SelectHTTPforUploadMethod. 2. UsertheBrowsebuttontoselectthefiletorestore. 3. ClicktheRestorebutton. AFileUploadorChooseFiledialogboxdisplays. 4. Navigatetothedirectorythatcontainsthefile,thenselectthefiletouploadandclickOpen.

(OnlythosefilescreatedwiththeBackupfunctionandsavedas.xmlbackupconfigurationfilesarevalidto usewithRestore;forexample,ap_config.xml.) 5. ClicktheRestorebutton. Adialogboxopensverifyingtherestore. 6. ClickOKtoproceed. TheAPreboots.Arebootconfirmationdialogandfollowonrebootingstatusmessagedisplays.Pleasewait fortherebootprocesstocomplete,whichmighttakeseveralminutes. TheAdministrationWebUIisnotaccessibleuntiltheAPhasrebooted. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page119 UnifiedAccessPointAdministratorsGuide PerformingAPMaintenance PerformingAPMaintenance FromtheMaintenancepage,youcanresettheAPtoitsfactorydefaultsettingsorreboottheAP. Figure38:Maintenance ResettingtheFactoryDefaultConfiguration IfyouareexperiencingproblemswiththeUAPandhavetriedallothertroubleshootingmeasures,clickReset. Thisrestoresfactorydefaultsandclearsallsettings,includingsettingssuchasanewpasswordorwireless settings.Youcanalsousetheresetbuttononthebackpaneltoresetthesystemtothedefaultconfiguration. RebootingtheAccessPoint Formaintenancepurposesorasatroubleshootingmeasure,youcanreboottheUAP.ToreboottheAP,click theRebootbuttonontheConfigurationpage. UpgradingtheFirmware AsnewversionsoftheUAPfirmwarebecomeavailable,youcanupgradethefirmwareonyourdevicestotake advantageofnewfeaturesandenhancements.TheAPusesaTFTPclientforfirmwareupgrades.Youcanalso useHTTPtoperformfirmwareupgrades. Afteryouuploadnewfirmwareandthesystemreboots,thenewlyaddedfirmwarebecomestheprimary image.Iftheupgradefails,theoriginalfirmwareremainsastheprimaryimage. Note:Whenyouupgradethefirmware,theaccesspointretainstheexistingconfiguration information. UsethefollowingstepstoupgradethefirmwareonanaccesspointbyusingTFTP:

1. SelectTFTPforUploadMethod. 2. Enteraname(1to63characters)fortheimagefileintheImageFilenamefield,includingthepathtothe directorythatcontainstheimagetoupload. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page120 UnifiedAccessPointAdministratorsGuide UpgradingtheFirmware Forexample,touploadtheap_upgrade.tarimagelocatedinthe/share/builds/apdirectory,enter/share/

builds/ap/ap_upgrade.tarintheImageFilenamefield. Thefirmwareupgradefilesuppliedmustbeatarfile.Donotattempttousebinfilesorfilesofother formatsfortheupgrade;thesetypesoffileswillnotwork. 3. EntertheIPaddressoftheTFTPserver. 4. ClickUpgrade. UponclickingUpgradeforthefirmwareupgrade,apopupconfirmationwindowisdisplayedthatdescribes theupgradeprocess. 5. ClickOKtoconfirmtheupgradeandstarttheprocess. Note:ThefirmwareupgradeprocessbeginsonceyouclickUpgradeandthenOKinthepopup confirmationwindow. Theupgradeprocessmaytakeseveralminutesduringwhichtimetheaccesspointwillbeunavailable.Do notpowerdowntheaccesspointwhiletheupgradeisinprocess.Whentheupgradeiscomplete,the accesspointrestarts.TheAPresumesnormaloperationwiththesameconfigurationsettingsithadbefore theupgrade. 6. Toverifythatthefirmwareupgradecompletedsuccessfully,checkthefirmwareversionshownonthe Upgradepage(ortheBasicSettingspage).Iftheupgradewassuccessful,theupdatedversionnameor numberisindicated. UsethefollowingstepstoupgradethefirmwareonanaccesspointbyusingHTTP:

1. SelectHTTPforUploadMethod. 2. Ifyouknowthepathtothenewfirmwareimagefile,enteritintheImageFilenamefield.Otherwise,click theBrowsebuttonandlocatethefirmwareimagefile. Thefirmwareupgradefilesuppliedmustbeatarfile.Donotattempttousebinfilesorfilesofother formatsfortheupgrade;thesetypesoffileswillnotwork. 3. ClickUpgradetoapplythenewfirmwareimage. UponclickingUpgradeforthefirmwareupgrade,apopupconfirmationwindowisdisplayedthatdescribes theupgradeprocess. 4. ClickOKtoconfirmtheupgradeandstarttheprocess. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page121 UnifiedAccessPointAdministratorsGuide PacketCaptureConfigurationandSettings Note:ThefirmwareupgradeprocessbeginsonceyouclickUpgradeandthenOKinthepopup confirmationwindow. Theupgradeprocessmaytakeseveralminutesduringwhichtimetheaccesspointwillbeunavailable.Do notpowerdowntheaccesspointwhiletheupgradeisinprocess.Whentheupgradeiscomplete,the accesspointrestarts.TheAPresumesnormaloperationwiththesameconfigurationsettingsithadbefore theupgrade. 5. Toverifythatthefirmwareupgradecompletedsuccessfully,checkthefirmwareversionshownonthe Upgradepage(ortheBasicSettingspage).Iftheupgradewassuccessful,theupdatedversionnameor numberisindicated. PacketCaptureConfigurationandSettings Wirelesspacketcaptureoperatesintwomodes:

Capturefilemode Remotecapturemode Forcapturefilemode,capturedpacketsarestoredinafileontheAccessPoint.TheAPcantransferthefileto aTFTPserver.ThefileisformattedinpcapformatandcanbeexaminedusingtoolssuchasWiresharkand OmniPeek. Forremotecapturemode,thecapturedpacketsareredirectedinrealtimetoanexternalPCrunningthe Wiresharktool. TheAPcancapturethefollowingtypesofpackets:

802.11packetsreceivedandtransmittedonradiointerfaces.Packetscapturedonradiointerfacesinclude the802.11header. 802.3packetsreceivedandtransmittedontheEthernetinterface. 802.3packetsreceivedandtransmittedontheinternallogicalinterfacessuchasVAPsandWDSinterfaces. FromthePacketCaptureConfigurationandSettingspage,youcan:

Viewthecurrentpacketcapturestatus. Configurepacketcaptureparameters. Configurepacketfilecapture. Configurearemotecaptureport. Downloadapacketcapturefile. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page122 UnifiedAccessPointAdministratorsGuide PacketCaptureConfigurationandSettings Figure39:PacketCaptureConfiguration D-Link November2011 UnifiedAccessPointAdministratorsGuide Page123 UnifiedAccessPointAdministratorsGuide PacketCaptureConfigurationandSettings PacketCaptureStatus PacketCaptureStatusallowsyoutoviewthestatusofpacketcaptureontheAP. Table47describesinformationthepacketcapturestatusfieldsdisplay. Table47:PacketCaptureStatus Field CurrentCaptureStatus PacketCaptureTime PacketCaptureFileSize Description Showswhetherpacketcaptureisrunningorstopped. Showselapsedcapturetime. Showsthecurrentcapturefilesize. PacketCaptureParameterConfiguration PacketCaptureConfigurationallowsyoutoconfigureparametersthataffecthowpacketcapturefunctionson theradiointerfaces. Table48describesthefieldstoconfigurethepacketcapture. Field CaptureBeacons PromiscuousCapture ClientFilterEnable ClientFilterMACAddress Table48:PacketCaptureConfiguration Description Enabletocapturethe802.11beaconsdetectedortransmittedbytheradio. Enabletoplacetheradioinpromiscuousmodewhenthecaptureisactive. Inpromiscuousmodetheradioreceivesalltrafficonthechannel,including trafficthatisnotdestinedtothisAP.Whiletheradioisoperatingin promiscuousmode,itcontinuesservingassociatedclients.Packetsnot destinedtotheAParenotforwarded. Assoonasthecaptureiscompleted,theradiorevertstononpromiscuous modeoperation. EnabletousetheWLANclientfiltertocaptureonlyframesthatare transmittedto,orreceivedfromaWLANclientwithaspecifiedMACaddress. SpecifyaMACaddressforWLANclientfiltering. Note:TheMACfilterisactiveonlywhencaptureisperformedonan802.11 interface. Note:Changestopacketcaptureconfigurationparameterstakeaffectafterpacketcaptureis restarted.Modifyingtheparameterswhilethepacketcaptureisrunningdoesn'taffectthecurrent packetcapturesession.Inordertobeginusingnewparametervalues,anexistingpacketcapture sessionmustbestoppedandrestarted. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page124 UnifiedAccessPointAdministratorsGuide PacketCaptureConfigurationandSettings PacketFileCapture InPacketFileCapturemodetheAPstorescapturedpacketsintheRAMfilesystem. Uponactivation,thepacketcaptureproceedsuntiloneofthefollowingoccurs:

Thecapturetimereachesconfiguredduration Thecapturefilereachesitsmaximumsize Theadministratorstopsthecapture Duringthecapture,youcanmonitorthecapturestatus,elapsedcapturetime,andthecurrentcapturefilesize. Thisinformationcanbeupdated,whilethecaptureisinprogress,byclickingRefresh. Table49describesthefieldstoconfigurethepacketcapturestatus. Field CaptureInterface CaptureDuration MaxCaptureFileSize Table49:PacketFileCapture Description SelectanAPCaptureInterfacenamefromthedropdownmenu.APcapture interfacenamesareeligibleforpacketcaptureare:

brtrunkLinuxbridgeinterfaceintheAP eth0802.3trafficontheEthernetport. wlan0VAP0trafficonradio1. wlan1VAP0trafficonradio2. radio1802.11trafficonradio1. radio2802.11trafficonradio2. Note:TheDWL3600APhasonlyoneradio.Theavailableoptionsonthe DWL3600APdonotincludewlan0orradio1. Specifythetimedurationinsecondsforthecapture(range10to3600). SpecifythemaximumallowedsizeforthecapturefileinKB(range64to4096). RemotePacketCapture RemotePacketCaptureallowsyoutospecifyaremoteportasthedestinationforpacketcaptures.Thisfeature worksinconjunctionwiththeWiresharknetworkanalyzertoolforWindows.Apacketcaptureserverrunson theAPandsendsthecapturedpacketsviaaTCPconnectiontotheWiresharktool. AWindowsPCrunningtheWiresharktoolallowsyoutodisplay,log,andanalyzecapturedtraffic. Whentheremotecapturemodeisinuse,theAPdoesn'tstoreanycaptureddatalocallyinitsfilesystem. YourcantraceuptofiveinterfacesontheAPatthesametime.However,youmuststartaseparateWireshark sessionforeachinterface.YoucanconfiguretheIPportnumberusedforconnectingWiresharktotheAP.The defaultportnumberis2002.Thesystemuses5consecutiveportnumbersstartingwiththeconfiguredportfor thepacketcapturesessions. IfafirewallisinstalledbetweentheWiresharkPCandtheAP,theseportsmustbeallowedtopassthroughthe firewall.ThefirewallmustalsobeconfiguredtoallowtheWiresharkPCtoinitiateTCPconnectiontotheAP. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page125 UnifiedAccessPointAdministratorsGuide PacketCaptureConfigurationandSettings ToconfigureWiresharktousetheAPasthesourceforcapturedpackets,youmustspecifytheremoteinterface inthe"CaptureOptions"menu.ForexampletocapturepacketsonanAPwithIPaddress192.168.1.10onradio 1usingthedefaultIPport,specifythefollowinginterface:

rpcap://192.168.1.10/radio1 TocapturepacketsontheEthernetinterfaceoftheAPandVAP0onradio1usingIPport58000,starttwo Wiresharksessionsandspecifythefollowinginterfaces:

rpcap://192.168.1.10:58000/eth0 rpcap://192.168.1.10:58000/wlan0 Whenyouarecapturingtrafficontheradiointerface,youcandisablebeaconcapture,butother802.11control framesarestillsenttoWireshark.Youcansetupadisplayfiltertoshowonly:

Dataframesinthetrace TrafficonspecificBSSIDs Trafficbetweentwoclients Someexamplesofusefuldisplayfiltersare:

ExcludebeaconsandACK/RTS/CTSframes:

!(wlan.fc.type_subtype==8||wlan.fc.type==1) Dataframesonly:

wlan.fc.type==2 TrafficonaspecificBSSID:

wlan.bssid==00:02:bc:00:17:d0 Alltraffictoandfromaspecificclient:

wlan.addr==00:00:e8:4e:5f:8e Inremotecapturemode,trafficissenttothePCrunningWiresharkviaoneofthenetworkinterfaces. DependingonwheretheWiresharktoolislocatedthetrafficcanbesentonanEthernetinterfaceoroneofthe radios.Inordertoavoidatrafficfloodcausedbytracingthetracepackets,theAPautomaticallyinstallsa capturefiltertofilteroutallpacketsdestinedtotheWiresharkapplication.ForexampleiftheWiresharkIPport isconfiguredtobe58000thenthefollowingcapturefilterisautomaticallyinstalledontheAP:

notportrange5800058004. EnablingthepacketcapturefeatureimpactsperformanceoftheAPandcancreateasecurityissue

(unauthorizedclientsmaybeabletoconnecttotheAPandtraceuserdata).TheAPperformanceisnegatively impactedevenifthereisnoactiveWiresharksessionwiththeAP.Theperformanceisnegativelyimpactedto agreaterextentwhenpacketcaptureisinprogress. Duetoperformanceandsecurityissues,thepacketcapturemodeisnotsavedinNVRAMontheAP;iftheAP resets,thecapturemodeisdisabledandtheyoumustreenableitinordertoresumecapturingtraffic.Packet captureparameters(otherthanmode)aresavedinNVRAM. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page126 UnifiedAccessPointAdministratorsGuide PacketCaptureConfigurationandSettings InordertominimizeperformanceimpactontheAPwhiletrafficcaptureisinprogress,youshouldinstall capturefilterstolimitwhichtrafficissenttotheWiresharktool.Whencapturing802.11traffic,largeportion ofthecapturedframestendtobebeacons(typicallysentevery100msbyallAccessPoints).Although Wiresharksupportsadisplayfilterforbeaconframes,itdoesnotsupportacapturefiltertopreventtheAP fromforwardingcapturedbeaconpacketstotheWiresharktool.Inordertoreduceperformanceimpactof capturingthe802.11beacons,youcandisablethecapturebeaconsmode. TheremotepacketcapturefacilityisastandardfeatureoftheWiresharktoolforWindows. Note:RemotepacketcaptureisnotstandardontheLinuxversionofWireshark;theLinuxversion doesn'tworkwiththeAP. Wiresharkisanopensourcetoolandisavailableforfree;itcanbedownloadedfromhttp://

www.wireshark.org. Table50describesthefieldstoconfigurethepacketcapturestatus. Table50:RemotePacketCapture Field RemoteCapturePort Description Specifytheremoteporttouseasthedestinationforpacketcaptures.(range1 to65530). PacketCaptureFileDownload PacketCaptureFileDownloadallowsyoutodownloadthecapturefilebyTFTPtoaconfiguredTFTPserveror byHTTP(S)toaPC.Thecapturedpacketsarestoredinfile/tmp/apcapture.pcapontheAP.Acaptureis automaticallystoppedwhenthecapturefiledownloadcommandistriggered. BecausethecapturefileislocatedintheRAMfilesystem,itdisappearsiftheAPisreset. Table51describesthefieldstoconfigurethepacketcapturestatus. Table51:PacketCaptureFileDownload Field UseTFTPtodownloadthe capturefile Description SelectorclearthisoptiontodeterminewhethertouseTFTPorHTTP(S)to downloadthecapturefile:

TodownloadthefilebyusingTFTP,selectthisoptionandcompletethe TFTPServerFilename ServerIP additionalfields. TodownloadthefilebyusingHTTPorHTTPS,clearthisoptionandclick Downloadtobrowsetothelocationwherethefileistobesaved. WhenusingTFTPtodownloadthefile,specifyanameforthepacketcapture file,includingthe.pcapfilenameextensionandthepathtothedirectory whereyouwanttosavethefile. WhenusingTFTPtodownloadthefile,specifytheIPaddressoftheTFTP server. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page127 UnifiedAccessPointAdministratorsGuide ConfiguringClientQualityofService Section8:ConfiguringClientQualityofService ThissectiondescribeshowtoconfigureQoSsettingsthataffecttrafficfromthewirelessclientstotheAP.By usingtheUAPClientQoSfeatures,youcanlimitbandwidthandapplyACLsandDiffServpoliciestothewireless interface.IfaVAPusesWPAEnterprisesecuritytoauthenticateclients,youcanconfiguretheRADIUSserver toprovideperclientQoSinformation. Thissectiondescribesthefollowingfeatures:

ConfiguringVAPQoSParameters ManagingClientQoSACLs CreatingaDiffServClassMap CreatingaDiffServPolicyMap ConfiguringRADIUSAssignedClientQoSParameters Note:ThewebbasedUIimagesinthissectionshowtheDWL8600APadministrationpages.Pages fortheDWL3600APwillnotdisplayinformationforRadio2becauseithasonlyoneradio. ConfiguringVAPQoSParameters TheclientQoSfeaturesontheUAPprovideadditionalcontrolovercertainQoSaspectsofwirelessclientsthat connecttothenetwork,suchastheamountofbandwidthanindividualclientisallowedtosendandreceive. Tocontrolgeneralcategoriesoftraffic,suchasHTTPtrafficortrafficfromaspecificsubnet,youcanconfigure ACLsandassignthemtooneormoreVAPs. Inadditiontocontrollinggeneraltrafficcategories,ClientQoSallowsyoutoconfigureperclientconditioning ofvariousmicroflowsthroughDifferentiatedServices(DiffServ).DiffServpoliciesareausefultoolfor establishinggeneralmicroflowdefinitionandtreatmentcharacteristicsthatcanbeappliedtoeachwireless client,bothinboundandoutbound,whenitisauthenticatedonthenetwork. FromtheVAPQoSParameterspage,youcanenabletheClientQoSfeature,specifyclientbandwidthlimits, andselecttheACLsandDiffServpoliciestouseasdefaultvaluesforclientsassociatedwiththeVAPwhenthe clientdoesnothavetheirownattributesdefinedbyaRADIUSserver. ToconfiguretheClientQoSadministrativemodeandtoconfiguretheQoSsettingsforaVAP,clicktheVAPQoS Parameterstab. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page128 UnifiedAccessPointAdministratorsGuide ConfiguringVAPQoSParameters Field ClientQoSGlobalAdmin Mode Radio VAP ClientQoSMode BandwidthLimitDown Figure40:VAPQoSParameters Table52:VAPQoSParameters Description EnableordisableClientQoSoperationontheAP. ChangingthissettingwillnotaffecttheWMMsettingsyouconfigureonthe QoSpage. FordualradioAPs,selectRadio1orRadio2tospecifywhichradioto configure. SpecifytheVAPthatwillhavetheClientQoSsettingsthatyouconfigure. TheQoSsettingsyouconfigurefortheselectedVAPwillnotaffectclientsthat accessthenetworkthroughotherVAPs. EnableordisableQoSoperationontheVAPselectedintheVAPmenu. QoSmustbeenabledglobally(fromtheClientQoSGlobalAdminModefield) andontheVAP(QoSModefield)fortheClientQoSsettingstobeappliedto wirelessclients. EnterthemaximumallowedtransmissionratefromtheAPtothewireless clientinbitspersecond.Thevalidrangeis0429496000bits/sec. Thevalueyouentermustbeamultipleof8000bits/sec,inotherwords,the valuemustben8000bits/sec,wheren=0,1,2,3...Ifyouattempttosetthe limittoavaluethatisnotamultipleof8000bits/sec,theconfigurationwillbe rejected.Avalueof0meansthatthebandwidthmaximumlimitisnotenforced inthisdirection. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page129 UnifiedAccessPointAdministratorsGuide ConfiguringVAPQoSParameters Field BandwidthLimitUp ACLTypeDown ACLNameDown ACLTypeUp ACLNameUp DiffServPolicyDown DiffServPolicyUp Table52:VAPQoSParameters Description EnterthemaximumallowedclienttransmissionratetotheAPinbitsper second.Thevalidrangeis04294967295bps. Thevalueyouentermustben8000bits/sec,wheren=0,1,2,3...Ifyou attempttosetthelimittoavaluethatisnotamultipleof8000bits/sec,the configurationwillberejected.Avalueof0meansthatthebandwidth maximumlimitisnotenforcedinthisdirection. SelectthetypeofACLtoapplytotrafficintheoutbound(down)direction, whichcanbeoneofthefollowing:

IPv4:TheACLexaminesIPv4packetsformatchestoACLrules IPv6:TheACLexaminesIPv6packetsformatchestoACLrules MAC:TheACLexamineslayer2framesformatchestoACLrules SelectthenameoftheACLappliedtotrafficintheoutbound(down)direction. Afterswitchingthepacketorframetotheoutboundinterface,theACL'srules arecheckedforamatch.Thepacketorframeistransmittedifitispermitted, anddiscardedifitisdenied. SelectthetypeofACLtoapplytotrafficintheinbound(up)direction,which canbeoneofthefollowing:

IPv4:TheACLexaminesIPv4packetsformatchestoACLrules IPv6:TheACLexaminesIPv6packetsformatchestoACLrules MAC:TheACLexamineslayer2framesformatchestoACLrules SelectthenameoftheACLappliedtotrafficenteringtheAPintheinbound

(up)direction. WhenapacketorframeisreceivedbytheAP,theACL'srulesarecheckedfora match.Thepacketorframeisprocessedifitispermitted,anddiscardedifitis denied. SelectthenameoftheDiffServpolicyappliedtotrafficfromtheAPinthe outbound(down)direction. SelectthenameoftheDiffServpolicyappliedtotrafficsenttotheAPinthe inbound(up)direction. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page130 UnifiedAccessPointAdministratorsGuide ManagingClientQoSACLs ManagingClientQoSACLs ACLsareacollectionofpermitanddenyconditions,calledrules,thatprovidesecuritybyblockingunauthorized usersandallowingauthorizeduserstoaccessspecificresources.ACLscanblockanyunwarrantedattemptsto reachnetworkresources. TheUAPsupportsupto50IPv4,IPv6,andMACACLs. IPv4andIPv6ACLs IPACLsclassifytrafficforLayers3and4. EachACLisasetofupto10rulesappliedtotrafficsentfromawirelessclientortobereceivedbyawireless client.Eachrulespecifieswhetherthecontentsofagivenfieldshouldbeusedtopermitordenyaccesstothe network.Rulescanbebasedonvariouscriteriaandmayapplytooneoremorefieldswithinapacket,suchas thesourceordestinationIPaddress,thesourceordestinationL4port,ortheprotocolcarriedinthepacket. MACACLs MACACLsareLayer2ACLs.Youcanconfiguretherulestoinspectfieldsofaframesuchasthesourceor destinationMACaddress,theVLANID,ortheClassofService802.1ppriority.Whenaframeentersorexitsthe APport(dependingonwhethertheACLisappliedintheupordowndirection),theAPinspectstheframeand checkstheACLrulesagainstthecontentoftheframe.Ifanyoftherulesmatchthecontent,apermitordeny actionistakenontheframe. ACLConfigurationProcess ConfigureACLsandrulesontheClientQoSACLpage(steps15),andthenapplytherulestoaspecifiedVAP ontheAPQoSParameterspage(step6). UsethefollowinggeneralstepstoconfigureACLs:

1. SpecifyanamefortheACL. 2. SelectthetypeofACLtoadd. 3. AddtheACL 4. AddnewrulestotheACL. 5. Configurethematchcriteriafortherules. 6. ApplytheACLtooneormoreVAPs. ForanexampleofhowtoconfigureanACL,seeACLConfigurationonpage174 ToconfigureanACL,clicktheClientQoSACLtab. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page131 UnifiedAccessPointAdministratorsGuide ManagingClientQoSACLs ThefieldstoconfigureACLrulesappearonlyafteryouhavecreatedanACL.Thefollowingimageshowsthe configurationofanewrulefortheIPv4ACLnamedacl1.TherulepreventsHTTPtrafficfromallclientsinthe 192.168.20.0networkfrombeingforwarded. Figure41:ClientQoSACL ThefollowingtabledescribesthefieldsavailableontheClientQoSACLpage. Field Description Table53:ACLConfiguration ACLConfiguration ACLName ACLType EnteranametoidentifytheACL.Thenamecancontainfrom131alphanumeric characters.Spacesarenotallowed. SelectthetypeofACLtoconfigure:

IPv4 IPv6 MAC IPv4andIPv6ACLscontrolaccesstonetworkresourcesbasedonLayer3andLayer 4criteria.MACACLscontrolaccessbasedonLayer2criteria. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page132 UnifiedAccessPointAdministratorsGuide ManagingClientQoSACLs Field Description Table53:ACLConfiguration(Cont.) ACLRuleConfiguration ACLNameACLType Rule Action MatchEvery IPv4ACL Protocol SourceIPAddress SelecttheACLtoconfigurewiththenewrule.ThelistcontainsallACLsaddedinthe ACLConfigurationsection. ToconfigureanewruletoaddtotheselectedACL,selectNewRule.Toaddan existingruletoanACLortomodifyarule,selecttherulenumber. WhenanACLhasmultiplerules,therulesareappliedtothepacketorframeinthe orderinwhichyouaddthemtotheACL.Thereisanimplicitdenyallruleasthefinal rule. SpecifieswhethertheACLrulepermitsordeniesanaction. WhenyouselectPermit,theruleallowsalltrafficthatmeetstherulecriteriato enterorexittheAP(dependingontheACLdirectionyouselect).Trafficthat doesnotmeetthecriteriaisdropped. WhenyouselectDeny,theruleblocksalltrafficthatmeetstherulecriteriafrom enteringorexitingtheAP(dependingontheACLdirectionyouselect).Traffic thatdoesnotmeetthecriteriaisforwardedunlessthisruleisthefinalrule. BecausethereisanimplicitdenyallruleattheendofeveryACL,trafficthatis notexplicitlypermittedisdropped. Indicatesthattherule,whicheitherhasapermitordenyaction,willmatchthe frameorpacketregardlessofitscontents. Ifyouselectthisfield,youcannotconfigureanyadditionalmatchcriteria.The MatchEveryoptionisselectedbydefaultforanewrule.Youmustcleartheoption toconfigureothermatchfields. SelecttheProtocolfieldtouseanL3orL4protocolmatchconditionbasedonthe valueoftheIPProtocolfieldinIPv4packetsortheNextHeaderfieldofIPv6packets. Onceyouselectthefield,choosetheprotocoltomatchbykeywordorentera protocolID. SelectFromList Selectoneofthefollowingprotocolsfromthelist:

IP ICMP IGMP TCP UDP MatchtoValue Tomatchaprotocolthatisnotlistedbyname,entertheprotocolID. TheprotocolIDisastandardvalueassignedbytheIANA.Therangeisanumber from0255. Selectthisfieldtorequireapacket'ssourceIPaddresstomatchtheaddresslisted here.EnteranIPaddressintheappropriatefieldtoapplythiscriteria. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page133 UnifiedAccessPointAdministratorsGuide ManagingClientQoSACLs Field WildCardMask SourcePort DestinationIPAddress WildCardMask Table53:ACLConfiguration(Cont.) Description SpecifiesthesourceIPaddresswildcardmask. Thewildcardmasksdetermineswhichbitsareusedandwhichbitsareignored.A wildcardmaskof255.255.255.255indicatesthatnobitisimportant.Awildcardof 0.0.0.0indicatesthatallofthebitsareimportant.ThisfieldisrequiredwhenSource IPAddressischecked. Awildcardmaskis,inessence,theinverseofasubnetmask.Forexample,Tomatch thecriteriatoasinglehostaddress,useawildcardmaskof0.0.0.0.Tomatchthe criteriatoa24bitsubnet(forexample192.168.10.0/24),useawildcardmaskof 0.0.0.255. Selectthisfieldtoincludeasourceportinthematchconditionfortherule.The sourceportisidentifiedinthedatagramheader. Onceyouselectthefield,choosetheportnameorentertheportnumber. SelectFromList Selectthekeywordassociatedwiththesourceporttomatch:

ftp ftpdata http smtp snmp telnet tftp www Eachofthesekeywordstranslatesintoitsequivalentportnumber. MatchtoPort EntertheIANAportnumbertomatchtothesourceportidentifiedinthedatagram header.Theportrangeis065535andincludesthreedifferenttypesofports:

01023:WellKnownPorts 102449151:RegisteredPorts 4915265535:Dynamicand/orPrivatePorts Selectthisfieldtorequireapacket'sdestinationIPaddresstomatchtheaddress listedhere.EnteranIPaddressintheappropriatefieldtoapplythiscriteria. SpecifiesthedestinationIPaddresswildcardmask. Thewildcardmasksdetermineswhichbitsareusedandwhichbitsareignored.A wildcardmaskof255.255.255.255indicatesthatnobitisimportant.Awildcardof 0.0.0.0indicatesthatallofthebitsareimportant.ThisfieldisrequiredwhenSource IPAddressischecked. Awildcardmaskisinessencetheinverseofasubnetmask.Forexample,Tomatch thecriteriatoasinglehostaddress,useawildcardmaskof0.0.0.0.Tomatchthe criteriatoa24bitsubnet(forexample192.168.10.0/24),useawildcardmaskof 0.0.0.255. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page134 UnifiedAccessPointAdministratorsGuide ManagingClientQoSACLs Field DestinationPort IPDSCP IPPrecedence IPTOSBits Table53:ACLConfiguration(Cont.) Description Selectthisfieldtoincludeadestinationportinthematchconditionfortherule.The destinationportisidentifiedinthedatagramheader. Onceyouselectthefield,choosetheportnameorentertheportnumber. SelectFromList Selectthekeywordassociatedwiththedestinationporttomatch:

ftp ftpdata http smtp snmp telnet tftp www Eachofthesekeywordstranslatesintoitsequivalentportnumber. MatchtoPort EntertheIANAportnumbertomatchtothedestinationportidentifiedinthe datagramheader.Theportrangeis065535andincludesthreedifferenttypesof ports:

01023:WellKnownPorts 102449151:RegisteredPorts 4915265535:Dynamicand/orPrivatePorts TouseIPDSCPasamatchcriteria,selectthecheckboxandselectaDSCPvalue keywordorenteraDSCPvaluetomatch.Youcanselectonlyoneservicetype(DSCP, IPPrecedenceorTOSbits)touseformatchcriteria. SelectfromList SelectfromalistofDSCPtypes. MatchtoValue EnteraDSCPValuetomatch(063). Selectthisoptionandenteravaluetousethepacket'sIPPrecedencevalueinthe IPheaderasmatchcriteria.Youcanselectonlyoneservicetype(DSCP,IP PrecedenceorTOSbits)touseformatchcriteria. TheIPPrecedencerangeis07. Selectthisoptionandenteravaluetousethepacket'sTypeofServicebitsintheIP headerasmatchcriteria.Youcanselectonlyoneservicetype(DSCP,IPPrecedence orTOSbits)touseformatchcriteria. TheIPTOSfieldinapacketisdefinedasalleightbitsoftheServiceTypeoctetin theIPheader.TheTOSBitsvalueisatwodigithexadecimalnumberfrom00toff. ThehighorderthreebitsrepresenttheIPprecedencevalue.Thehighordersixbits representtheIPDifferentiatedServicesCodePoint(DSCP)value. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page135 UnifiedAccessPointAdministratorsGuide ManagingClientQoSACLs Field IPTOSMask IPv6ACL Protocol SourceIPv6Address Table53:ACLConfiguration(Cont.) Description EnteranIPTOSmaskvaluetoidentifythebitpositionsintheTOSBitsvaluethatare usedforcomparisonagainsttheIPTOSfieldinapacket. TheTOSMaskvalueisatwodigithexadecimalnumberfrom00toff,representing aninverted(i.e.wildcard)mask.ThezerovaluedbitsintheTOSMaskdenotethe bitpositionsintheTOSBitsvaluethatareusedforcomparisonagainsttheIPTOS fieldofapacket.Forexample,tocheckforanIPTOSvaluehavingbits7and5set andbit1clear,wherebit7ismostsignificant,useaTOSBitsvalueofa0andaTOS Maskof00.Thisisanoptionalconfiguration. SelecttheProtocolfieldtouseanL3orL4protocolmatchconditionbasedonthe valueoftheIPProtocolfieldinIPv4packetsortheNextHeaderfieldofIPv6packets. Onceyouselectthefield,choosetheprotocoltomatchbykeywordorprotocolID. Selectthisfieldtorequireapacket'ssourceIPv6addresstomatchtheaddresslisted here.EnteranIPv6addressintheappropriatefieldtoapplythiscriteria. SourceIPv6PrefixLength EntertheprefixlengthofthesourceIPv6address. SourcePort Selectthisoptiontoincludeasourceportinthematchconditionfortherule.The sourceportisidentifiedinthedatagramheader. Onceyouselecttheoption,choosetheportnameorentertheportnumber. DestinationIPv6Address Selectthisfieldtorequireapacket'sdestinationIPv6addresstomatchtheaddress listedhere.EnteranIPv6addressintheappropriatefieldtoapplythiscriteria. EntertheprefixlengthofthedestinationIPv6address. DestinationIPv6Prefix Length DestinationPort IPv6FlowLabel IPv6DSCP Selectthisoptiontoincludeadestinationportinthematchconditionfortherule. Thedestinationportisidentifiedinthedatagramheader. Onceyouselecttheoption,choosetheportnameorentertheportnumber. Flowlabelis20bitnumberthatisuniquetoanIPv6packet.Itisusedbyend stationstosignifyqualityofservicehandlinginrouters(range0to1048575). TouseIPv6DSCPasamatchcriteria,selectthecheckboxandselectaDSCPvalue keywordorenteraDSCPvaluetomatch.Youcanselectonlyoneservicetype(DSCP, IPPrecedenceorTOSbits)touseformatchcriteria. SelectfromList SelectfromalistofDSCPtypes. MatchtoValue EnteraDSCPValuetomatch(063). D-Link November2011 UnifiedAccessPointAdministratorsGuide Page136 UnifiedAccessPointAdministratorsGuide ManagingClientQoSACLs Field MACACL EtherType ClassofService SourceMACAddress SourceMACMask DestinationMAC Address DestinationMACMask VLANID Table53:ACLConfiguration(Cont.) Description SelecttheEtherTypefieldtocomparethematchcriteriaagainstthevalueinthe headerofanEthernetframe. SelectanEtherTypekeywordorenteranEtherTypevaluetospecifythematch criteria. SelectfromListSelect Selectoneofthefollowingprotocoltypes:

appletalk arp ipv4 ipv6 ipx netbios pppoe MatchtoValue Enteracustomprotocolidentifiertowhichpacketsarematched.Thevalueisafour digithexidecimalnumberintherangeof0600FFFF. Selectthisfieldandenteran802.1puserprioritytocompareagainstanEthernet frame. Thevalidrangeis07.Thisfieldislocatedinthefirst/only802.1QVLANtag. SelectthisfieldandenterthesourceMACaddresstocompareagainstanEthernet frame. SelectthisfieldandenterthesourceMACaddressmaskspecifyingwhichbitsinthe sourceMACtocompareagainstanEthernetframe. A0indicatesthattheaddressbitissignificant,andanfindicatesthattheaddress bitistobeignored.AMACmaskof00:00:00:00:00:00matchesasingleMAC address. SelectthisfieldandenterthedestinationMACaddresstocompareagainstan Ethernetframe. EnterthedestinationMACaddressmaskspecifyingwhichbitsinthedestination MACtocompareagainstanEthernetframe. A0indicatesthattheaddressbitissignificant,andanfindicatesthattheaddress bitistobeignored.AMACmaskof00:00:00:00:00:00matchesasingleMAC address. SelectthisfieldandentertheVLANIDstocompareagainstanEthernetframe. Thisfieldislocatedinthefirst/only802.1QVLANtag. Afteryousetthedesiredrulecriteria,clickApply.TodeleteanACL,selecttheDeleteACLoptionandclick Apply. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page137 UnifiedAccessPointAdministratorsGuide CreatingaDiffServClassMap CreatingaDiffServClassMap TheClientQoSfeaturecontainsDifferentiatedServices(DiffServ)supportthatallowstraffictobeclassifiedinto streamsandgivencertainQoStreatmentinaccordancewithdefinedperhopbehaviors. StandardIPbasednetworksaredesignedtoprovidebesteffortdatadeliveryservice.Besteffortserviceimplies thatthenetworkdeliversthedatainatimelyfashion,althoughthereisnoguaranteethatitwill.Duringtimes ofcongestion,packetsmaybedelayed,sentsporadically,ordropped.FortypicalInternetapplications,suchas emailandfiletransfer,aslightdegradationinserviceisacceptableandinmanycasesunnoticeable.However, onapplicationswithstricttimingrequirements,suchasvoiceormultimedia,anydegradationofservicehas undesirableeffects. Byclassifyingthetrafficandcreatingpoliciesthatdefinehowtohandlethesetrafficclasses,youcanmakesure thattimesensitivetrafficisgivenprecedenceoverothertraffic. TheUAPsupportsupto50ClassMaps. DefiningDiffServ TouseDiffServforClientQoS,usetheClassMapandPolicyMappagestodefinethefollowingcategoriesand theircriteria:

Class:createclassesanddefineclasscriteria Policy:createpolicies,associateclasseswithpolicies,anddefinepolicystatements Onceyoudefinetheclassandassociateitwithapolicy,applythepolicytoaspecifiedVAPontheVAPQoS Parameterspage. Packetsareclassifiedandprocessedbasedondefinedcriteria.Theclassificationcriteriaisdefinedbyaclass. Theprocessingisdefinedbyapolicy'sattributes.Policyattributesmaybedefinedonaperclassinstancebasis, anditistheseattributesthatareappliedwhenamatchoccurs.Apolicycancontainmultipleclasses.Whenthe policyisactive,theactionstakendependonwhichclassmatchesthepacket. Packetprocessingbeginsbytestingtheclassmatchcriteriaforapacket.Apolicyisappliedtoapacketwhena classmatchwithinthatpolicyisfound.DiffServissupportedforIPv4andIPv6packets. UsetheClassMappagetoaddanewDiffservclassname,ortorenameordeleteanexistingclass,anddefine thecriteriatoassociatewiththeDiffServclass. ToconfigureaDiffServClassMap,clicktheClassMaptab. Note:TheClassMappagedisplaystheMatchCriteriaConfigurationfieldsonlyifaClassMaphasbeen created.TocreateaClassMap,enteranameintheClassMapNamefieldandclickAddClassMap. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page138 UnifiedAccessPointAdministratorsGuide CreatingaDiffServClassMap Figure42:ClientQoSDiffServClassMap Table54:DiffServClassMap Field Description ClassMapConfiguration ClassMapName MatchLayer3Protocol MatchCriteriaConfiguration ClassMapName EnteraClassMapNametoadd.Thenamecanrangefrom1to31 alphanumericcharacters. SpecifywhethertoclassifyIPv4orIPv6packets. Selectnameoftheclasstoconfigure. UsethefieldsintheMatchCriteriaConfigurationareatomatchpacketstoa class.Selectthecheckboxforeachfieldtobeusedasacriterionforaclassand enterdataintherelatedfield.Youcanhavemultiplematchcriteriainaclass. Note:Thematchcriteriafieldsthatareavailabledependonwhethertheclass mapisanIPv4orIPv6classmap. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page139 UnifiedAccessPointAdministratorsGuide CreatingaDiffServClassMap Field MatchEvery Protocol IPv4ClassMaps SourceIPAddress SourceIPMask DestinationIPAddress DestinationIPMask Table54:DiffServClassMap(Cont.) Description SelectMatchEverytospecifythatthematchconditionistruetoallthe parametersinanL3packet. AllL3packetswillmatchanMatchEverymatchcondition. SelecttheProtocolfieldtouseanL3orL4protocolmatchconditionbasedon thevalueoftheIPProtocolfieldinIPv4packetsortheNextHeaderfieldofIPv6 packets. Onceyouselectthefield,choosetheprotocoltomatchbykeywordorentera protocolID. SelectFromList Selectoneofthefollowingprotocolsfromthelist:

IP ICMP IPv6 ICMPv6 IGMP TCP UDP MatchtoValue Tomatchaprotocolthatisnotlistedbyname,entertheprotocolID. TheprotocolIDisastandardvalueassignedbytheIANA.Therangeisanumber from0255. Selectthisfieldtorequireapacket'ssourceIPaddresstomatchtheaddress listedhere.EnteranIPaddressintheappropriatefieldtoapplythiscriteria. EnterthesourceIPaddressmask. ThemaskforDiffServisanetworkstylebitmaskinIPdotteddecimalformat indicatingwhichpart(s)ofthedestinationIPAddresstouseformatching againstpacketcontent. ADiffServmaskof255.255.255.255indicatesthatallbitsareimportant,anda maskof0.0.0.0indicatesthatnobitsareimportant.Theoppositeistruewith anACLwildcardmask.Forexample,tomatchthecriteriatoasinglehost address,useaDiffServmaskof255.255.255.255.Tomatchthecriteriatoa24 bitsubnet(forexample192.168.10.0/24),useamaskof255.255.255.0. Selectthisfieldtorequireapacket'sdestinationIPaddresstomatchthe addresslistedhere.EnteranIPaddressintheappropriatefieldtoapplythis criteria. EnterthedestinationIPaddressmask. ThemaskforDiffServisanetworkstylebitmaskinIPdotteddecimalformat indicatingwhichpart(s)ofthedestinationIPAddresstouseformatching againstpacketcontent. ADiffServmaskof255.255.255.255indicatesthatallbitsareimportant,anda maskof0.0.0.0indicatesthatnobitsareimportant.Theoppositeistruewith anACLwildcardmask.Forexample,tomatchthecriteriatoasinglehost address,useaDiffServmaskof255.255.255.255.Tomatchthecriteriatoa24 bitsubnet(forexample192.168.10.0/24),useamaskof255.255.255.0. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page140 UnifiedAccessPointAdministratorsGuide CreatingaDiffServClassMap Field Description Table54:DiffServClassMap(Cont.) IPv6ClassMaps SourceIPv6Address SourceIPv6PrefixLength DestinationIPv6Address DestinationIPv6Prefix Length IPv6FlowLabel IPDSCP IPv4andIPv6ClassMaps SourcePort Selectthisfieldtorequireapacket'ssourceIPv6addresstomatchtheaddress listedhere.EnteranIPv6addressintheappropriatefieldtoapplythiscriteria. EntertheprefixlengthofthesourceIPv6address. Selectthisfieldtorequireapacket'sdestinationIPv6addresstomatchthe addresslistedhere.EnteranIPv6addressintheappropriatefieldtoapplythis criteria. EntertheprefixlengthofthedestinationIPv6address. Flowlabelis20bitnumberthatisuniquetoanIPv6packet.Itisusedbyend stationstosignifyqualityofservicehandlinginrouters(range0to1048575). TouseIPDSCPasamatchcriteria,selectthecheckboxandselectaDSCPvalue keywordorenteraDSCP. SelectfromList SelectfromalistofDSCPtypes. MatchtoValue EnteraDSCPValuetomatch(063). Selectthisfieldtoincludeasourceportinthematchconditionfortherule.The sourceportisidentifiedinthedatagramheader. Onceyouselectthefield,choosetheportnameorentertheportnumber. SelectFromList Selectthekeywordassociatedwiththesourceporttomatch:

ftp ftpdata http smtp snmp telnet tftp www Eachofthesekeywordstranslatesintoitsequivalentportnumber. MatchtoPort EntertheIANAportnumbertomatchtothesourceportidentifiedinthe datagramheader.Theportrangeis065535andincludesthreedifferenttypes ofports:

01023:WellKnownPorts 102449151:RegisteredPorts 4915265535:Dynamicand/orPrivatePorts D-Link November2011 UnifiedAccessPointAdministratorsGuide Page141 UnifiedAccessPointAdministratorsGuide CreatingaDiffServClassMap Field DestinationPort EtherType ClassofService SourceMACAddress Table54:DiffServClassMap(Cont.) Description Selectthisfieldtoincludeadestinationportinthematchconditionforthe rule.Thedestinationportisidentifiedinthedatagramheader. Onceyouselectthefield,choosetheportnameorentertheportnumber. SelectFromList Selectthekeywordassociatedwiththedestinationporttomatch:

ftp ftpdata http smtp snmp telnet tftp www Eachofthesekeywordstranslatesintoitsequivalentportnumber. MatchtoPort EntertheIANAportnumbertomatchtothedestinationportidentifiedinthe datagramheader.Theportrangeis065535andincludesthreedifferenttypes ofports:

01023:WellKnownPorts 102449151:RegisteredPorts 4915265535:Dynamicand/orPrivatePorts SelecttheEtherTypefieldtocomparethematchcriteriaagainstthevaluein theheaderofanEthernetframe. SelectanEtherTypekeywordorenteranEtherTypevaluetospecifythematch criteria. SelectfromListSelect Selectoneofthefollowingprotocoltypes:

appletalk arp ipv4 ipv6 ipx netbios pppoe MatchtoValue Enteracustomprotocolidentifiertowhichpacketsarematched.Thevalueis afourdigithexidecimalnumberintherangeof0600FFFF. Selectthefieldandenteraclassofservice802.1puserpriorityvaluetobe matchedforthepackets.Thevalidrangeis07. SelectthisfieldandenterthesourceMACaddresstocompareagainstan Ethernetframe. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page142 UnifiedAccessPointAdministratorsGuide CreatingaDiffServClassMap Field SourceMACMask DestinationMACAddress DestinationMACMask VLANID IPv4ClassMaps ServiceType IPDSCP IPPrecedence IPTOSBits IPTOSMask DeleteClassMap Table54:DiffServClassMap(Cont.) Description EnterthesourceMACaddressmaskspecifyingwhichbitsinthedestination MACtocompareagainstanEthernetframe. Anfindicatesthattheaddressbitissignificant,anda0indicatesthatthe addressbitistobeignored.AMACmaskofff:ff:ff:ff:ff:ffmatchesasingleMAC address. SelectthisfieldandenterthedestinationMACaddresstocompareagainstan Ethernetframe. EnterthedestinationMACaddressmaskspecifyingwhichbitsinthe destinationMACtocompareagainstanEthernetframe. Anfindicatesthattheaddressbitissignificant,anda0indicatesthatthe addressbitistobeignored.AMACmaskofff:ff:ff:ff:ff:ffmatchesasingleMAC address. SelectthefieldandenteraVLANIDtobematchedforpackets.TheVLANID rangeis04095. Youcanspecifyonetypeofservicetouseinmatchingpacketstoclasscriteria. TouseIPDSCPasamatchcriteria,selectthecheckboxandselectaDSCPvalue keywordorenteraDSCP. SelectfromList SelectfromalistofDSCPtypes. MatchtoValue EnteraDSCPValuetomatch(063). Selectthisfieldtomatchthepacket'sIPPrecedencevaluetotheclasscriteria IPPrecedencevalue. TheIPPrecedencerangeis07. Selectthisfieldandenteravaluetousethepacket'sTypeofServicebitsinthe IPheaderasmatchcriteria. TheTOSbitvaluerangesbetween(00FF).Thehighorderthreebitsrepresent theIPprecedencevalue.ThehighordersixbitsrepresenttheIPDifferentiated ServicesCodePoint(DSCP)value. EnteranIPTOSmaskvaluetoperformabooleanANDwiththeTOSfieldinthe headerofthepacketandcomparedagainsttheTOSenteredforthisrule. TheTOSMaskcanbeusedtocomparespecificbits(Precedence/Typeof Service)fromtheTOSfieldintheIPheaderofapacketagainsttheTOSvalue enteredforthisrule.(00FF). ChecktodeletetheclassmapselectedintheClassMapNamemenu.Theclass mapcannotbedeletedifitisalreadyattachedtoapolicy. TodeleteaClassMap,selecttheDeleteClassMapoptionandclickApply. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page143 UnifiedAccessPointAdministratorsGuide CreatingaDiffServPolicyMap CreatingaDiffServPolicyMap UsethePolicyMappagetocreateDiffServpoliciesandtoassociateacollectionofclasseswithoneormore policystatements. TheUAPsupportsupto50PolicyMaps. Packetsareclassifiedandprocessedbasedondefinedcriteria.Theclassificationcriteriaisdefinedbyaclasson theClassMappage.Theprocessingisdefinedbyapolicy'sattributesonthePolicyMappage.Policyattributes maybedefinedonaperclassinstancebasis,anditistheseattributesthatareappliedwhenamatchoccurs. APolicyMapcancontainupto10ClassMaps.Whenthepolicyisactive,theactionstakendependonwhich classmatchesthepacket. Packetprocessingbeginsbytestingtheclassmatchcriteriaforapacket.Apolicyisappliedtoapacketwhena classmatchwithinthatpolicyisfound. TocreateaDiffServpolicy,clickthePolicyMaptab. Figure43:ClientQoSDiffServPolicyMap D-Link November2011 UnifiedAccessPointAdministratorsGuide Page144 UnifiedAccessPointAdministratorsGuide CreatingaDiffServPolicyMap Field PolicyMapName PolicyMapName(Policy ClassDefinition) ClassMapName(PolicyClass Definition) PoliceSimple Send Drop MarkClassofService MarkIPDSCP MarkIPPrecedence DisassociateClassMap MemberClasses DeletePolicyMap Table55:DiffServPolicyMap Description Enterthennameofthepolicymaptoadd.Thenamecancontainupto31 alphanumericcharacters. Selectthepolicytoassociatewithamemberclass. Selectthememberclasstoassociatewiththispolicyname. Selectthisoptiontoestablishthetrafficpolicingstylefortheclass.Thesimple formofthepolicingstyleusesasingledatarateandburstsize,resultingintwo outcomes:conformandnonconform. CommittedRate Enterthecommittedrate,inKbps,towhichtrafficmustconform. CommittedBurst Enterthecommittedburstsize,inbytes,towhichtrafficmustconform. SelectSendtospecifythatallpacketsfortheassociatedtrafficstreamareto beforwardediftheclassmapcriteriaismet. SelectDroptospecifythatallpacketsfortheassociatedtrafficstreamareto bedroppediftheclassmapcriteriaismet. Selectthisfieldtomarkallpacketsfortheassociatedtrafficstreamwiththe specifiedclassofservicevalueinthepriorityfieldofthe802.1pheader.Ifthe packetdoesnotalreadycontainthisheader,oneisinserted.TheCoSvalueis anintegerfrom07. SelectthisfieldtomarkallpacketsfortheassociatedtrafficstreamwiththeIP DSCPvalueyouselectfromthelistorspecify. SelectfromList SelectfromalistofDSCPtypes. MatchtoValue EnteraDSCPValuetomatch(063). Selectthisfieldtomarkallpacketsfortheassociatedtrafficstreamwiththe specifiedIPPrecedencevalue.TheIPPrecedencevalueisanintegerfrom07. SelectthisoptionandclickApplytoremovetheclassselectedintheClassMap NamemenufromthepolicyselectedinthePolicyMapNamemenu. ListsallDiffServclassescurrentlydefinedasmembersoftheselectedpolicy.If noclassisassociatedwiththepolicy,thefieldisempty. SelectthisfieldtodeletethepolicymapshowinginthePolicyMapName menu. TodeleteaPolicyMap,selecttheDeletePolicyMapoptionandclickApply. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page145 UnifiedAccessPointAdministratorsGuide ClientQoSStatus ClientQoSStatus TheClientQoSStatuspageshowstheclientQoSsettingsthatareappliedtoeachclientcurrentlyassociated withtheAP. ToviewQoSsettingsforanassociatedclient,clicktheClientQoSStatustab. Figure44:ClientQoSStatus Table56:ClientQoSStatus Field Station GlobalQoSMode ClientQoSMode BandwidthLimitUp Description TheStationmenucontainstheMACaddressofeachclientcurrentlyassociatedwith theAP.ToviewtheQoSsettingsappliedtoaclient,selectitsMACaddressfromthe list. ShowsthecurrentClientQoSGlobalAdminModeontheAP. ShowswhethertheQOSmodefortheselectedclientisenabledordisabled. Note:FortheQosModetobeenabledonaclient,itmustbegloballyenabledon theAPandenabledontheVAPtheclientisassociatedwith.UsetheVAPQoS ParameterspagetoenabletheQoSGlobalAdminmodeandtheperVAPQoS Mode. ShowsthemaximumallowedtransmissionratefromtheclienttotheAPinbitsper second(bps).Thevalidrangeis04294967295bps. BandwidthLimitDown ShowsthemaximumallowedtransmissionratefromtheAPtotheclientinbitsper ACLTypeUp second(bps).Thevalidrangeis04294967295bps. ShowsthetypeofACLthatisappliedtotrafficintheinbound(clienttoAP) direction,whichcanbeoneofthefollowing:

IPv4:TheACLexaminesIPv4packetsformatchestoACLrules. IPv6:TheACLexaminesIPv6packetsformatchestoACLrules. MAC:TheACLexamineslayer2framesformatchestoACLrules. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page146 UnifiedAccessPointAdministratorsGuide ConfiguringRADIUSAssignedClientQoSParameters Field ACLNameUp ACLTypeDown ACLNameDown DiffServPolicyUp DiffServPolicyDown Table56:ClientQoSStatus(Cont.) Description ShowsthenameoftheACLappliedtotrafficenteringtheAPintheinbound direction. WhenapacketorframeisreceivedbytheAP,theACL'srulesarecheckedfora match.Thepacketorframeisprocessedifitispermittedanddiscardedifitis denied. ShowsthetypeofACLtoapplytotrafficintheoutbound(APtoclient)direction, whichcanbeoneofthefollowing:

IPv4:TheACLexaminesIPv4packetsformatchestoACLrules. IPv6:TheACLexaminesIPv6packetsformatchestoACLrules MAC:TheACLexamineslayer2framesformatchestoACLrules ShowsthenameoftheACLappliedtotrafficintheoutbounddirection. Afterswitchingthepacketorframetotheoutboundinterface,theACL'srulesare checkedforamatch.Thepacketorframeistransmittedifitispermittedand discardedifitisdenied. ShowsthenameoftheDiffServpolicyappliedtotrafficsenttotheAPintheinbound

(clienttoAP)direction. ShowsthenameoftheDiffServpolicyappliedtotrafficfromtheAPintheoutbound

(APtoclient)direction. ConfiguringRADIUSAssignedClientQoSParameters IfaVAPisconfiguredtouseWPAEnterprisesecurity,youcanincludeclientQoSinformationintheclient databaseontheRADIUSserver.Whenaclientsuccessfullyauthenticates,theRADIUSservercaninclude bandwidthlimitsandidentifytheACLsandDiffServpoliciestoapplytothespecificwirelessclient.ACLsand DiffServpoliciesreferencedintheRADIUSclientdatabasemustmatchthenamesoftheACLsandDiffServ policiesconfiguredontheAPtobesuccessfullyappliedtothewirelessclients. Table57describestheQoSattributesthatcanbeincludedintheclient'sRADIUSserverentry.Ifawireless clientsuccessfullyauthenticatesusingWPAEnterprise,eachQoSRADIUSattributethatexistsfortheclientis senttotheAPforprocessing.Theattributesareoptionalanddonotneedtobepresentinthecliententry.If theattributeisnotpresent,theClientQoSsettingontheAPisused. RADIUSAttribute VendorSpecific(26), WISPrBandwidth MaxDown ID 14122,8 Table57:ClientQoSRADIUSAttributes Description Maximumallowedclientreceptionratefrom theAPinbitspersecond.Ifnonzero,the specifiedvalueisroundeddowntothenearest 64KbpsvaluewhenusedintheAP(64Kbps minimum).Ifzero,bandwidthlimitingisnot enforcedfortheclientinthisdirection. Type/Range Type:integer 32bitunsignedinteger value(04294967295) D-Link November2011 UnifiedAccessPointAdministratorsGuide Page147 UnifiedAccessPointAdministratorsGuide ConfiguringRADIUSAssignedClientQoSParameters Table57:ClientQoSRADIUSAttributes(Cont.) RADIUSAttribute VendorSpecific(26), WISPrBandwidth MaxUp ID 14122,7 VendorSpecific(26), LVL7WirelessClient ACLDn 6132,120 Description Maximumallowedclienttransmissionrateto theAPinbitspersecond.Ifnonzero,the specifiedvalueisroundeddowntothenearest 64KbpsvaluewhenusedintheAP(64Kbps minimum).Ifzero,bandwidthlimitingisnot enforcedfortheclientinthisdirection. Accesslistidentifiertobeappliedto802.1X authenticatedwirelessclienttrafficinthe outbound(down)direction. IfthisattributereferstoanACLthatdoesnot existontheAP,allpacketsforthisclientwillbe droppeduntiltheACLisdefined. VendorSpecific(26), LVL7WirelessClient ACLUp 6132,121 Accesslistidentifiertobeappliedto802.1X authenticatedwirelessclienttrafficinthe inbound(up)direction. IfthisattributereferstoanACLthatdoesnot existontheAP,allpacketsforthisclientwillbe droppeduntiltheACLisdefined. VendorSpecific(26), LVL7WirelessClient PolicyDn VendorSpecific(26), LVL7WirelessClient PolicyUp 6132,122 NameofDiffServpolicytobeappliedto802.1X authenticatedwirelessclienttrafficinthe outbound(down)direction. Ifthisattributereferstoapolicynamethat doesnotexistontheAP,allpacketsforthis clientwillbedroppeduntiltheDiffServpolicyis defined. 6132,123 NameofDiffServpolicytobeappliedto802.1X authenticatedwirelessclienttrafficinthe inbound(up)direction. Ifthisattributereferstoapolicynamethat doesnotexistontheAP,allpacketsforthis clientwillbedroppeduntiltheDiffServpolicyis defined. Type/Range Type:integer 32bitunsignedinteger value(04294967295) Type:string 536characters(notnull terminated) Thestringisoftheform type:namewhere:type=

ACLtypeidentifier:IPV4, IPV6,MAC

:=requiredseparator character name=131alphanumeric characters,specifyingthe ACLnumber(IPV4)or name(IPV6,MAC) Type:string 536characters(notnull terminated)Thestringisof theformtype:name where:type=ACLtype identifier:IPV4,IPV6,MAC

:=requiredseparator character name=131alphanumeric characters,specifyingthe ACLnumber(IPV4)or name(IPV6,MAC) Type:string 131characters(notnull terminated) Type:string 131characters(notnull terminated) D-Link November2011 UnifiedAccessPointAdministratorsGuide Page148 UnifiedAccessPointAdministratorsGuide ClusteringMultipleAPs Section9:ClusteringMultipleAPs TheUAPsupportsAPclusters.Aclusterprovidesasinglepointofadministrationandletsyouview,deploy, configure,andsecurethewirelessnetworkasasingleentityratherthanaseriesofseparatewirelessdevices. ManagingAccessPointsintheCluster TheAPclusterisadynamic,configurationawaregroupofAPsinthesamesubnetofanetwork.Eachcluster canhaveupto16members.Onlyoneclusterperwirelessnetworkissupported;however,anetworksubnet canhavemultipleclusters.Clusterscansharevariousconfigurationinformation,suchasVAPsettingsandQoS queueparameters. AclustercanbeformedbetweentwoAPsifthefollowingconditionsaremet:

TheAPsusethesameradiomode(forexample,radio1uses802.11g) TheAPsareconnectedonthesamebridgedsegment. TheAPsjoiningtheclusterhavethesameClusterName. ClusteringmodeisenabledonbothAPs. Note:FortwoAPstobeinthesamecluster,theydonotneedtohavethesamenumberofradios;

however,thesupportedcapabilitiesoftheradiosshouldbesame. Note:ThewebbasedUIimagesinthissectionshowtheDWL8600APadministrationpages.Pages fortheDWL3600APwillnotdisplayinformationforRadio2becauseithasonlyoneradio. ClusteringSingleandDualRadioAPs Clusteringofsingleanddualradiosisnotsupported.AclustercancontainamixifDWL6600APand DWL8600APaccesspoints,butthisclustershouldnotcontainanyDWL3600APs. ViewingandConfiguringClusterMembers TheAccessPointspageallowsyoutostartorstopclusteringonanAP,viewtheclustermembers,andconfigure thelocationandclusternameforaclustermember.FromtheAccessPointspage,youcanalsoclicktheIP addressofeachclustermembertonavigatetoconfigurationsettingsanddataonanaccesspointinthecluster. Toviewinformationaboutclustermembersandtoconfigurethelocationandclusterofanindividualmember, clicktheAccessPointstab. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page149 UnifiedAccessPointAdministratorsGuide ManagingAccessPointsintheCluster ThefollowingfigureshowstheCluster>AccessPointspagewhenclusteringisnotenabled. Figure45:ClusterInformationandMemberConfiguration ThefollowingfigureshowstheCluster>AccessPointspagewhenclusteringisenabledandtwoaccesspoints areinthecluster. Figure46:ClusterInformationandMemberConfiguration IfclusteringiscurrentlydisabledontheAP,theStartClusteringbuttonisvisible.Ifclusteringisenabled,the StopClusteringbuttonisvisible.Youcanedittheclusteringoptioninformationwhenclusteringisdisabled. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page150 UnifiedAccessPointAdministratorsGuide ManagingAccessPointsintheCluster ThefollowingtabledescribestheconfigurationandstatusinformationavailableontheclusterAccessPoints page. Field Status Location MACAddress IPAddress Table58:AccessPointsintheCluster Description Ifthestatusfieldisvisible,thentheAPisenabledforclustering.Ifclusteringisnotenabled, thentheAPisoperatinginstandalonemodeandnoneoftheinformationinthistableis visible. TodisableclusteringontheAP,clickStopClustering. Descriptionofwheretheaccesspointisphysicallylocated. MediaAccessControl(MAC)addressoftheaccesspoint. TheaddressshownhereistheMACaddressforthebridge(br0).Thisistheaddressby whichtheAPisknownexternallytoothernetworks. SpecifiestheIPaddressfortheaccesspoint. EachIPaddressisalinktotheAdministrationWebpagesforthataccesspoint.Youcanuse thelinkstonavigatetotheAdministrationWebpagesforaspecificaccesspoint.Thisis usefulforviewingdataonaspecificaccesspointtomakesureaclustermemberispicking upclusterconfigurationchanges,toconfigureadvancedsettingsonaparticularaccess point,ortoswitchastandaloneaccesspointtoclustermode. Thefollowingtabledescribestheclusterinformationtoconfigureforanindividualmember.Theclustering optionsarereadonlywhenclusteringisenabled.Toconfiguretheclusteringoptions,youmuststopclustering. Table59:ClusteringOptions Field Location ClusterName ClusteringIPVersion Description Enteradescriptionofwheretheaccesspointisphysicallylocated. EnterthenameoftheclusterfortheAPtojoin. TheclusternameisnotsenttootherAPsinthecluster.Youmustconfigurethesame clusternameoneachAPthatisamemberofthecluster.Theclusternamemustbe uniqueforeachclusteryouconfigureonthenetwork. SpecifytheIPversionthattheAPsintheclusterusetocommunicatewitheach other. RemovinganAccessPointfromtheCluster Toremoveanaccesspointfromthecluster,dothefollowing. 1. GototheAdministrationWebpagesfortheclusteredaccesspoint. TheAdministrationWebpagesforthestandaloneaccesspointaredisplayed. 2. ClicktheCluster>AccessPointslinkintheAdministrationpages. 3. ClickStopClustering. ThechangewillbereflectedunderStatusforthataccesspoint;theaccesspointwillnowshowas standalone(insteadofcluster). D-Link November2011 UnifiedAccessPointAdministratorsGuide Page151 UnifiedAccessPointAdministratorsGuide ManagingAccessPointsintheCluster AddinganAccessPointtoaCluster Toaddanaccesspointthatiscurrentlyinstandalonemodebackintoacluster,dothefollowing. 1. GototheAdministrationWebpagesforthestandaloneaccesspoint. 2. ClicktheCluster>AccessPointslinkintheAdministrationpagesforthestandaloneaccesspoint. TheAccessPoints pageforastandaloneaccesspointindicatesthatthecurrentmodeisstandalone. 3. TypethenameorlocationoftheAPintheLocationfieldtoidentifytheAPwithinthecluster. 4. TypethenameoftheclusterfortheAPtojoinintheClusterNamefield. 5. ClickStartClustering. Theaccesspointisnowaclustermember.ItsStatus(Mode)ontheCluster>AccessPointspagenow indicatesClusterinsteadofNotClustered. NavigatingtoConfigurationInformationforaSpecificAP Ingeneral,theUAPisdesignedforcentralmanagementofclusteredaccesspoints.Foraccesspointsinacluster, allaccesspointsintheclusterreflectthesameconfiguration.Inthiscase,itdoesnotmatterwhichaccesspoint youactuallyconnecttoforadministration. Theremaybesituations,however,whenyouwanttoviewormanageinformationonaparticularaccesspoint. Forexample,youmightwanttocheckstatusinformationsuchasclientassociationsoreventsforanaccess point.Inthiscase,youcannavigatetotheAdministrationWebinterfaceforindividualaccesspointsbyclicking theIPaddresslinksontheAccessPointspage. AllclusteredaccesspointsareshownontheCluster>AccessPointspage.Tonavigatetoclusteredaccess points,youcansimplyclickontheIPaddressforaspecificclustermembershowninthelist. NavigatingtoanAPbyUsingitsIPAddressinaURL YoucanalsolinktotheAdministrationWebpagesofaspecificaccesspoint,byenteringtheIPaddressforthat accesspointasaURLdirectlyintoaWebbrowseraddressbarinthefollowingform:

http://IPAddressOfAccessPoint whereIPAddressOfAccessPointistheaddressoftheparticularaccesspointyouwanttomonitororconfigure. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page152 UnifiedAccessPointAdministratorsGuide ManagingClusterSessions ManagingClusterSessions TheSessionspageshowsinformationaboutclientstationsassociatedwithaccesspointsinthecluster.Each clientisidentifiedbyitsMACaddress,alongwiththeAP(location)towhichitiscurrentlyconnected. Toviewaparticularstatisticforclientsessions,selectanitemfromtheDisplaydropdownlistandclickGo.You canviewinformationaboutidletime,datarate,signalstrengthandsoon;allofwhicharedescribedindetail inthetablebelow. Asessioninthiscontextistheperiodoftimeinwhichauseronaclientdevice(station)withauniqueMAC addressmaintainsaconnectionwiththewirelessnetwork.Thesessionbeginswhentheclientlogsontothe network,andthesessionendswhentheclienteitherlogsoffintentionallyorlosestheconnectionforsome otherreason. Note:Asessionisnotthesameasanassociation,whichdescribesaclientconnectiontoaparticular accesspoint.AclientnetworkconnectioncanshiftfromoneclusteredAPtoanotherwithinthe contextofthesamesession.AclientstationcanroambetweenAPsandmaintainthesession. Tomanagesessionsassociatedwiththecluster,clickCluster>Sessions. Detailsaboutthesessioninformationshownisdescribedinthefollowingtable. Figure47:SessionManagement Table60:SessionManagement Field APLocation UserMAC Idle Description Indicatesthelocationoftheaccesspoint. ThisisderivedfromthelocationdescriptionspecifiedontheBasicSettingspage. IndicatestheMACaddressofthewirelessclientdevice. AMACaddressisahardwareaddressthatuniquelyidentifieseachnodeofanetwork. Indicatestheamountoftimethisstationhasremainedinactive. Astationisconsideredtobeidlewhenitisnotreceivingortransmittingdata. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page153 UnifiedAccessPointAdministratorsGuide ConfiguringandViewingChannelManagementSettings Field Rate Signal RxTotal TxTotal ErrorRate Table60:SessionManagement Description Thespeedatwhichthisaccesspointistransferringdatatothespecifiedclient. Thedatatransmissionrateismeasuredinmegabitspersecond(Mbps). Thisvalueshouldfallwithintherangeoftheadvertisedratesetforthemodeinuseon theaccesspoint.Forexample,6to54Mbpsfor802.11a. Indicatesthestrengthoftheradiofrequency(RF)signaltheclientreceivesfromthe accesspoint. ThemeasureusedforthisisavalueknownasReceivedSignalStrengthIndication(RSSI), andwillbeavaluebetween0and100. RSSIisdeterminedbyamechanismimplementedonthenetworkinterfacecard(NIC)of theclientstation. Indicatesnumberoftotalpacketsreceivedbytheclientduringthecurrentsession. Indicatesnumberoftotalpacketstransmittedtotheclientduringthissession. Indicatesthepercentageoftimeframesaredroppedduringtransmissiononthisaccess point. SortingSessionInformation Tosorttheinformationshowninthetablesbyaparticularindicator,clickthecolumnlabelbywhichyouwant toorderthings.Forexample,ifyouwanttoseethetablerowsorderedbysignalstrength,clicktheSignal columnlabel.Theentrieswillbesortedbysignalstrength. ConfiguringandViewingChannelManagementSettings WhenChannelManagementisenabled,theUAPautomaticallyassignsradiochannelsusedbyclusteredaccess points.Theautomaticchannelassignmentreducesmutualinterference(orinterferencewithotheraccess pointsoutsideofitscluster)andmaximizesWiFibandwidthtohelpmaintaintheefficiencyofcommunication overthewirelessnetwork. Youmuststartchannelmanagementtogetautomaticchannelassignments;itisdisabledbydefaultonanew AP. Ataspecifiedinterval,theChannelManagermapsAPstochanneluseandmeasuresinterferencelevelsinthe cluster.Ifsignificantchannelinterferenceisdetected,theChannelManagerautomaticallyreassignssomeor alloftheAPstonewchannelsperanefficiencyalgorithm(orautomatedchannelplan).IftheChannelManager determinesthatachangeisnecessary,thatinformationissenttoallmembersoftheclusterandasyslog messageisgeneratedindicatingthesenderAP,newandoldchannelassignments. TheChannelManagementpageshowsprevious,current,andplannedchannelassignmentsforclustered accesspoints.Bydefault,automaticchannelassignmentisdisabled.Youcanstartchannelmanagementto optimizechannelusageacrosstheclusteronascheduledinterval. Toconfigureandviewthechannelassignmentsfortheclustermembers,clicktheChannelManagementtab. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page154 UnifiedAccessPointAdministratorsGuide ConfiguringandViewingChannelManagementSettings Figure48:ChannelManagement Fromthispage,youcanviewchannelassignmentsforallAPsintheclusterandstoporstartautomaticchannel management.ByusingtheAdvancedsettingsonthepage,youcanmodifytheinterferencereductionpotential thattriggerschannelreassignment,changethescheduleforautomaticupdates,andreconfigurethechannel setusedforassignments. Stopping/StartingAutomaticChannelAssignment Bydefault,automaticchannelassignmentisdisabled(off). Note:ChannelManagementoverridesthedefaultclusterbehavior,whichistosynchronizeradio channelsofallAPsacrossacluster.WhenChannelManagementisenabled,theradioChannelis notsyncedacrosstheclustertootherAPs. ClickStarttoresumeautomaticchannelassignment. Whenautomaticchannelassignmentisenabled,theChannelManagerperiodicallymapsradiochannels usedbyclusteredaccesspointsand,ifnecessary,reassignschannelsonclusteredAPstoreduce interference(withclustermembersorotherAPsoutsidethecluster). ClickStoptostopautomaticchannelassignment.(Nochannelusagemapsorchannelreassignmentswill bemade.Onlymanualupdateswillaffectthechannelassignment.) D-Link November2011 UnifiedAccessPointAdministratorsGuide Page155 UnifiedAccessPointAdministratorsGuide ConfiguringandViewingChannelManagementSettings ViewingCurrentChannelAssignmentsandSettingLocks TheCurrentChannelAssignmentssectionshowsalistofallaccesspointsintheclusterbyIPAddress.The displayshowsthebandonwhicheachAPisbroadcasting(a/b/g/n),thecurrentchannelusedbyeachAP,and anoptiontolockanAPonitscurrentradiochannelsothatitcannotbereassignedtoanother. ThefollowingtableprovidesdetailsaboutCurrentChannelAssignments. Table61:ChannelAssignments Field IPAddress Radio Band Current Status Locked Description SpecifiestheIPAddressfortheaccesspoint. IdentifiestheMACaddressoftheradio. Indicatesthebandonwhichtheaccesspointisbroadcasting. IndicatestheradioChannelonwhichthisaccesspointiscurrentlybroadcasting. Showswhethertheradioisup(on)ordown(off). ClickLockedtoforcetheaccesspointtoremainonthecurrentchannel. WhenLockedisselected(enabled)foranaccesspoint,automatedchannelmanagement planswillnotreassigntheAPtoadifferentchannelasapartoftheoptimizationstrategy. Instead,APswithlockedchannelswillbefactoredinasrequirementsfortheplan. IfyouclickApply,youwillseethatlockedAPsshowthesamechannelfortheCurrent ChannelandProposedChannelfields.LockedAPswillkeeptheircurrentchannels. ViewingtheLastProposedSetofChanges TheProposedChannelAssignmentsshowsthelastchannelplan.Theplanlistsallaccesspointsinthecluster byIPAddress,andshowsthecurrentandproposedchannelsforeachAP.Lockedchannelswillnotbere assignedandtheoptimizationofchanneldistributionamongAPswilltakeintoaccountthefactthatlockedAPs mustremainontheircurrentchannels.APsthatarenotlockedmaybeassignedtodifferentchannelsthanthey werepreviouslyusing,dependingontheresultsoftheplan. Table62:LastProposedChanges Field IPAddress Radio ProposedChannel Description SpecifiestheIPAddressfortheaccesspoint. Indicatestheradiochannelonwhichthisaccesspointiscurrentlybroadcasting. Indicatestheradiochanneltowhichthisaccesspointwouldbereassignedifthe ChannelPlanisexecuted. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page156 UnifiedAccessPointAdministratorsGuide ConfiguringandViewingChannelManagementSettings ConfiguringAdvancedSettings Theadvancedsettingsallowyoutocustomizeandschedulethechannelplanforthecluster.IfyouuseChannel Managementasprovided(withoutupdatingAdvancedSettings),channelsareautomaticallyfinetunedonce everyhourifinterferencecanbereducedby25percentormore.Channelswillbereassignedevenifthe networkisbusy.Theappropriatechannelsetswillbeused(b/gforAPsusingIEEE802.11b/gandaforAPsusing IEEE802.11a). Thedefaultsettingsaredesignedtosatisfymostscenarioswhereyouwouldneedtoimplementchannel management. UseAdvancedSettingstomodifytheinterferencereductionpotentialthattriggerschannelreassignment, changethescheduleforautomaticupdates,andreconfigurethechannelsetusedforassignments.Ifthereare nofieldsshowingintheAdvancedsection,clickthetogglebuttontodisplaythesettingsthatmodifytiming anddetailsofthechannelplanningalgorithm. Table63:AdvancedChannelManagementSettings Field Changechannelsif interferenceisreducedbyat least Determineifthereisbetterset ofchannelsevery Description Specifytheminimumpercentageofinterferencereductionaproposedplan mustachieveinordertobeapplied.Thedefaultis75percent. Usethedropdownmenutochoosepercentagesrangingfrom5percentto 75percent. Thissettingletsyousetagatingfactorforchannelreassignmentsothatthe networkisnotcontinuallydisruptedforminimalgainsinefficiency. Forexample,ifchannelinterferencemustbereducedby75percentandthe proposedchannelassignmentswillonlyreduceinterferenceby30percent, thenchannelswillnotbereassigned.However;ifyouresettheminimal channelinterferencebenefitto25percentandclickApply,theproposed channelplanwillbeimplementedandchannelsreassignedasneeded. Usethedropdownmenutospecifythescheduleforautomatedupdates. Arangeofintervalsisprovided,from30Minutesto6Months Thedefaultis1Hour(channelusagereassessedandtheresultingchannel planappliedeveryhour). ClickApplyunderAdvancedsettingstoapplythesesettings. Advancedsettingswilltakeeffectwhentheyareappliedandinfluencehowautomaticchannelmanagement isperformed. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page157 UnifiedAccessPointAdministratorsGuide ViewingWirelessNeighborhoodInformation ViewingWirelessNeighborhoodInformation TheWirelessNeighborhoodshowsupto20accesspointsperradiowithinrangeofeverymemberofthe cluster,showswhichaccesspointsarewithinrangeofwhichclustermembers,anddistinguishesbetween clustermembersandnonmembers. Note:TheWirelessNeighborhoodpageshowsupto20accesspointsperradio.Toseealltheaccess pointsdetectedonagivenclusteraccesspoint,navigatetothatclustermember'swebinterfaceand gototheStatus>NeighboringAccessPointspage. Foreachneighboraccesspoint,theWirelessNeighborhoodviewshowsidentifyinginformation(SSIDor NetworkName,IPAddress,MACaddress)alongwithradiostatistics(signalstrength,channel,beaconinterval). YoucanclickonanAPtogetadditionalstatisticsabouttheAPsinradiorangeofthecurrentlyselectedAP. TheWirelessNeighborhoodviewcanhelpyou:

Detectandlocateunexpected(orrogue)accesspointsinawirelessdomainsothatyoucantakeactionto limitassociatedrisks Verifycoverageexpectations.ByassessingwhichAPsarevisibleatwhatsignalstrengthfromotherAPs, youcanverifythatthedeploymentmeetsyourplanninggoals. Detectfaults.Unexpectedchangesinthecoveragepatternareevidentataglanceinthecolorcodedtable. Figure49:WirelessNeighborhood D-Link November2011 UnifiedAccessPointAdministratorsGuide Page158 UnifiedAccessPointAdministratorsGuide ViewingWirelessNeighborhoodInformation ThefollowingtabledescribesdetailsabouttheWirelessNeighborhoodinformation. Table64:WirelessNeighborhoodInformation Field DisplayneighboringAPs Clickoneofthefollowingradiobuttonstochangetheview:

Description Cluster Neighbors InclusterShowsonlyneighborAPsthataremembersofthecluster NotinclusterShowsonlyneighborAPsthatarenotclustermembers BothShowsallneighborAPs(clustermembersandnonmembers) TheClusterlistatthetopofthetableshowsIPaddressesforallaccesspointsinthe cluster.(ThisisthesamelistofclustermembersshownontheCluster>Access Pointstab.) IfthereisonlyoneAPinthecluster,onlyasingleIPaddresscolumnwillbe displayedhere;indicatingthattheAPisclusteredwithitself. YoucanclickonanIPaddresstoviewmoredetailsonaparticularAP. AccesspointswhichareneighborsofoneormoreoftheclusteredAPsarelistedin theleftcolumnbySSID(NetworkName). Anaccesspointwhichisdetectedasaneighborofaclustermembercanalsobea clustermemberitself.Neighborswhoarealsoclustermembersarealwaysshown atthetopofthelistwithaheavybaraboveandincludealocationindicator. ThecoloredbarstotherightofeachAPintheNeighborslistshowsthesignal strengthforeachoftheneighborAPsasdetectedbytheclustermemberwhoseIP addressisshownatthetopofthecolumn. Thecolorofthebarindicatesthesignalstrength:

DarkBlueBarAdarkbluebarandahighsignalstrengthnumber(forexample 50)indicatesgoodsignalstrengthdetectedfromtheNeighborseenbytheAP whoseIPaddressislistedabovethatcolumn. LighterBlueBarAlighterbluebarandalowersignalstrengthnumber(for example20orlower)indicatesmediumorweaksignalstrengthfromthe NeighborseenbytheAPwhoseIPaddressislistedabovethatcolumn WhiteBarAwhitebarandthenumber0indicatesthataneighboringAPthat wasdetectedbyoneoftheclustermemberscannotbedetectedbytheAP whoseIPaddressiflistedabovethatcolumn. LightGrayBarAlightgraybarandnosignalstrengthnumberindicatesa NeighborthatisdetectedbyotherclustermembersbutnotbytheAPwhose IPaddressislistedabovethatcolumn. DarkGrayBarAdarkgraybarandnosignalstrengthnumberindicatesthisis theAPwhoseIPaddressislistedabovethatcolumn(sinceitisnotapplicable toshowhowwelltheAPcandetectitself). D-Link November2011 UnifiedAccessPointAdministratorsGuide Page159 UnifiedAccessPointAdministratorsGuide ViewingWirelessNeighborhoodInformation ViewingDetailsforaClusterMember ToviewdetailsonaclustermemberAP,clickontheIPaddressofaclustermemberatthetopofthepage.The followingfigureshowstheNeighborDetailsforRadio1oftheAPwithanIPaddressof10.27.65.66. Figure50:DetailsforaClusterMemberAP ThefollowingtableexplainsthedetailsshownabouttheselectedAP. Table65:ClusterMemberDetails Field SSID MACAddress Channel Rate Signal BeaconInterval BeaconAge D-Link November2011 Description TheServiceSetIdentifier(SSID)fortheaccesspoint. TheSSIDisanalphanumericstringofupto32charactersthatuniquelyidentifiesa wirelesslocalareanetwork.ItisalsoreferredtoastheNetworkName. AGuestnetworkandanInternalnetworkrunningonthesameaccesspointmustalways havetwodifferentnetworknames. ShowstheMACaddressoftheneighboringaccesspoint. AMACaddressisahardwareaddressthatuniquelyidentifieseachnodeofanetwork. Showsthechannelonwhichtheaccesspointiscurrentlybroadcasting. TheChanneldefinestheportionoftheradiospectrumthattheradiousesfor transmittingandreceiving. Showstherate(inmegabitspersecond)atwhichthisaccesspointiscurrently transmitting. ThecurrentratewillalwaysbeoneoftheratesshowninSupportedRates. Indicatesthestrengthoftheradiosignalemittingfromthisaccesspointasmeasuredin decibels(Db). ShowstheBeaconintervalbeingusedbythisaccesspoint. Beaconframesaretransmittedbyanaccesspointatregularintervalstoannouncethe existenceofthewirelessnetwork.Thedefaultbehavioristosendabeaconframeonce every100milliseconds(or10persecond). Showsthedateandtimeofthelastbeaconreceivedfromthisaccesspoint. UnifiedAccessPointAdministratorsGuide Page160 UnifiedAccessPointAdministratorsGuide DefaultAPSettings AppendixA:DefaultAPSet tings WhenyoufirstpoweronaUAP,ithasthedefaultsettingsshowninthefollowingtable. Note:TheDWL3600APsupportsoneradio,anditiscapableofoperatingintheIEEE802.11b, 802.11g,and802.11n(2.4GHz)modes.Radio1(802.11a/n)settingsdonotapplytothe DWL3600AP. Feature SystemInformation UserName Password EthernetInterfaceSettings ConnectionType DHCP IPAddress SubnetMask DNSName ManagementVLANID UntaggedVLANID IPv6AdminMode IPv6AutoConfigAdminMode RadioSettings Radio(1and2) Radio1IEEE802.11Mode Radio2IEEE802.11Mode 802.11a/nChannel 802.11b/g/nChannel Radio1ChannelBandwidth Radio2ChannelBandwidth PrimaryChannel ShortGuardIntervalSupported STBCMode Protection MaximumWirelessClients TransmitPower Table66:UAPDefaultSettings Default admin admin DHCP Enabled 10.90.90.91(ifnoDHCPserverisavailable) 255.0.0.0 None 1 1 Enabled Enabled On 802.11a/n 802.11b/g/n Auto Auto 40MHz 20MHz Lower Yes On Auto 200 100percent D-Link November2011 UnifiedAccessPointAdministratorsGuide Page161 UnifiedAccessPointAdministratorsGuide DefaultAPSettings Table66:UAPDefaultSettings(Cont.) Feature LegacyRateSetsSupported(Mbps) IEEE802.11a:54,48,36,24,18,12,9,6 Default IEEE802.11b:11,5.5,2,1 IEEE802.11g:54,48,36,24,18,12,11,9,6,5.5,2,1 IEEE802.11a:24,12,6 IEEE802.11b:2,1 IEEE802.11g:11,5.5,2,1 015Enabled LegacyRateSets(Mbps)

(Basic/Advertised) Auto 100 2 2346 2347 Off Off MCS(DataRate)Settings

(802.11nonly) Broadcast/MulticastRateLimiting Disabled FixedMulticastRate BeaconInterval DTIMPeriod FragmentationThreshold RTSThreshold TSPECMode TSPECVoiceACMMode VirtualAccessPointSettings Status VLANID NetworkName(SSID) BroadcastSSID SecurityMode MACAuthenticationType RADIUSIPAddress RADIUSKey RADIUSAccounting RedirectMode OtherDefaultSettings WDSSettings STP MACAuthentication LoadBalancing SNMP ROSNMPCommunityName SNMPAgentPort SNMPSetRequests ManagedAPMode None Disabled Nostationsinlist Disabled Enabled public 161 Enabled Enabled VAP0isenabledonbothradios,allotherVAPsdisabled 1 dlink1throughdlink16 Allow None(plaintext) None 10.90.90.1 secret Disabled None D-Link November2011 UnifiedAccessPointAdministratorsGuide Page162 UnifiedAccessPointAdministratorsGuide DefaultAPSettings Table66:UAPDefaultSettings(Cont.) Feature Default Authentication(802.1XSupplicant) Disabled ManagementACL Disabled Enabled;disabledinManagedMode HTTPAccess Enabled;disabledinManagedMode HTTPSAccess ConsolePortAccess Enabled Enabled;disabledinManagedMode TelnetAccess Enabled;disabledinManagedMode SSHAccess WMM Enabled Down EmailAlertAdminMode Manual(Notset) Time ClientQoSGlobalAdminMode Disabled Disabled PerVAPClientQoSMode Clustering Stopped D-Link November2011 UnifiedAccessPointAdministratorsGuide Page163 UnifiedAccessPointAdministratorsGuide ConfigurationExamples AppendixB:ConfigurationExamples ThisappendixcontainsexamplesofhowtoconfigureselectedfeaturesavailableontheUAP.Eachexample containsproceduresonhowtoconfigurethefeaturebyusingtheWebinterface,CLI,andSNMP. Thisappendixdescribeshowtoperformthefollowingprocedures:

ConfiguringaVAP ConfiguringRadioSettings ConfiguringtheWirelessDistributionSystem ClusteringAccessPoints ConfiguringClientQoS ForallSNMPexamples,theobjectsyouusetoAPareinaprivateMIB.Thepathtothetablesthatcontainthe objectsisiso(1).org(3).dod(6).internet(1).private(4).enterprises(1).dlink(171).dlinkproducts(10).dwl ap(37).dwlWLANAP(26). ConfiguringaVAP ThisexampleshowshowtoconfigureVAP1withthefollowingnondefaultsettings:

VLANID:2 SSID:Marketing Security:WPAPersonalusingWPA2withCCMP(AES) VAPConfigurationfromtheWebInterface 1. LogontotheAPandnavigatetotheManage>VAPpage. 2. 3. Enter2intheVLANIDcolumn. 4. IntheSSIDcolumn,deletetheexistingSSIDandtypeMarketing. IntheEnabledcolumnforVAP1,selectthecheckbox. 5. SelectWPAPersonalfromthemenuintheSecuritycolumn. Additionalfieldsappear. 6. SelecttheWPA2andCCMP(AES)options,andcleartheWPAandTKIPoptions. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page164 UnifiedAccessPointAdministratorsGuide ConfiguringaVAP 7. EnteraWPAencryptionkeyintheKeyfield. Thekeycanbeamixofalphanumericandspecialcharacters.Thekeyiscasesensitiveandcanbebetween 8and63characters. 8. ClickApplytoupdatetheAPwiththenewsettings. VAPConfigurationfromtheCLI 1. ConnecttotheAPbyusingTelnet,SSHoraserialconnection. 2. EnableVAP1. setvapvap1statusup 3. SettheVLANIDto2. setvapvap1vlanid2 Note:ThepreviouscommandsetstheVLANIDto2forVAP1onbothradios.TosettheVLANID forVAP1onradiooneonly,usethefollowingcommand:set vap 1 with radio wlan0 to vlan-id 2. 4. SettheSSIDtoMarketing. setinterfacewlan0vap1ssidMarketing 5. SettheSecurityModetoWPAPersonal. setinterfacewlan0vap1securitywpapersonal 6. AllowWPA2clients,andnotWPAclients,toconnecttotheAP. setbsswlan0bssvap1wpaallowedoff setbsswlan0bssvap1wpa2allowedon 7. SettheCipherSuitetoCCMP(AES)only. setbsswlan0bssvap1wpaciphertkipoff setbsswlan0bssvap1wpacipherccmpon 8. SetthePresharedkey. setinterfacewlan0vap1wpapersonalkeyJuPXkC7GvY$moQiUttp2 Ifthesharedsecretkeysincludesspaces,placethekeyinsidequotationmarks. 9. Usethefollowingcommandstoviewandverifythesettings. getinterfacewlan0vap1detail getvapvap1detail D-Link November2011 UnifiedAccessPointAdministratorsGuide Page165 UnifiedAccessPointAdministratorsGuide ConfiguringRadioSettings VAPConfigurationUsingSNMP 1. LoadtheDLINKWLANACCESSPOINTMIBmodule. 2. FromtheMIBtree,navigatetotheobjectsintheapVaptable. 3. WalktheapVapDescriptionobjecttoviewtheinstanceIDforVAP1(wlan0vap1). VAP1onRadio1isinstance3. 4. UsetheapVapStatusobjecttosetthestatusofVAP1toup(1). 5. UsetheapVapVlanIDobjecttosettheVLANIDofVAP1to2. 6. NavigatetotheobjectsintheapIfConfigtable. 7. WalktheapIfConfigNameobjecttoviewtheinstanceIDforVAP1(wlan0vap1). VAP1onRadio1isinstance3. 8. Setthevalueofinstance3intheapIfConfigSsidobjecttoMarketing. 9. Setthevalueofinstance3intheapIfConfigSecurityobjecttowpapersonal(3). 10. Setthevalueofinstance3intheapIfConfigWpaPersonalKeyobjecttoJuPXkC7GvY$moQiUttp2,whichis theWPApresharedkey. 11. NavigatetotheobjectsintheapRadioBss>apBssTabletable. 12. WalktheapBssDescrobjecttoviewtheinstanceIDforVAP1. VAP1onRadio1isinstance1. 13. Setthevalueofinstance1intheapBssWpaAllowedobjecttofalse(2). 14. Setthevalueofinstance1intheapBssWpaCipherTkipobjecttofalse(2). 15. Setthevalueofinstance1intheapBssWpaCipherCcmpobjecttotrue(1). ConfiguringRadioSettings ThisexampleshowshowtoconfigureRadio2withthefollowingsettings:

Mode:IEEE802.11b/g/n Channel:6 ChannelBandwidth:40MHz MaximumStations:100 TransmitPower:75%

RadioConfigurationfromtheWebInterface 1. LogontotheAPandnavigatetotheManage>Radiopage. 2. Makesurethenumber2appearsintheRadiofieldandthatthestatusisOn. 3. FromtheModemenu,selectIEEE802.11b/g/n. 4. FromtheChannelfield,select6. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page166 UnifiedAccessPointAdministratorsGuide ConfiguringRadioSettings 5. FromtheChannelBandwidthfield,select40MHz. 6. 7. IntheMaximumStationsfield,changethevalueto100. IntheTransmitPowerfield,changethevalueto75. ThefollowingimageshowstheRadiopagewiththesettingsspecifiedinthisexample. 8. ClickApplytoupdatetheAPwiththenewsettings. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page167 UnifiedAccessPointAdministratorsGuide ConfiguringRadioSettings RadioConfigurationfromtheCLI 1. ConnecttotheAPbyusingTelnet,SSH,oraserialconnection. 2. TurnRadio2onifthestatusisnotcurrentlyup. setradiowlan1statuson 3. SetthemodetoIEEE802.11b/g/n. setradiowlan1modebgn 4. Setthechannelto6. setradiowlan1channelpolicystatic setradiowlan1staticchannel6 5. Setthechannelbandwidthto40MHz. setradiowlan1nbandwidth40 6. Allowamaximumof100stationstoconnecttotheAPatatime. setbsswlan1bssvap0maxstations100 7. Setthetransmitpowerto75percent. setradiowlan1txpower75 8. Viewinformationabouttheradiosettings. getradiowlan1detail RadioConfigurationUsingSNMP 1. LoadtheDLINKWLANACCESSPOINTMIBmodule. 2. FromtheMIBtree,navigatetotheobjectsintheapRadiotable(apRadioBss>apRadioTable). 3. UsetheapRadioStatusobjecttosetthestatusofRadio2toup(1). 4. UsetheapRadioModeobjecttosettheRadio2modetoIEEE802.11b/g/n,whichisbgn(4). 5. UsetheapRadioChannelPolicyobjecttosetthechannelpolicytostatic(1),whichdisablestheautomatic channelassignment. 6. UsetheapRadioStaticChannelobjecttosetthechannelto6. 7. UsetheapRadioChannelBandwithobjecttosetthechannelbandwidthforRadio2tofortyMHz(2). 8. UsetheapRadioTxPowerobjecttosetthetransmissionpoweronRadio2to75. 9. NavigatetotheobjectsintheapBssTable. 10. UsetheapBssMaxStationsobjecttosetthevalueofthemaximumallowedstationsto100. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page168 UnifiedAccessPointAdministratorsGuide ConfiguringtheWirelessDistributionSystem ConfiguringtheWirelessDistributionSystem ThisexamplesshowshowtoconfigureaWDSlinkbetweentwoAPs.ThelocalAPisMyAP1andhasaMAC addressof00:1B:E9:16:32:40,andtheremoteAPisMyAP2withaMACaddressof00:30:AB:00:00:B0. TheWDSlinkhasthefollowingsettings,whichmustbeconfiguredonbothAPs:

Encryption:WPA(PSK) SSID:wdslink Key:abcdefghijk WDSConfigurationfromtheWebInterface TocreateaWDSlinkbetweenapairofaccesspointsMyAP1andMyAP2usethefollowingsteps:

1. LogontoMyAP1andnavigatetotheManage>WDSpage. TheMACaddressforMyAP1(theaccesspointyouarecurrentlyviewing)isautomaticallyprovidedinthe LocalAddressfield. 2. EntertheMACaddressforMyAP2intheRemoteAddressfield,orclickthearrownexttothefieldandselect theMACaddressofMyAP2fromthepopuplist. 3. SelectWPA(PSK)fromtheEncryptionmenu. Note:TheWPA(PSK)optionisavailableonlyifVAP0onRadio1usesWPA(PSK)asthesecurity method.IfVAP0isnotsettoWPAPersonalorWPAEnterprise,youmustchooseeitherNone

(Plaintext)orWEPforWDSlinkencryption. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page169 UnifiedAccessPointAdministratorsGuide ConfiguringtheWirelessDistributionSystem 4. EnterwdslinkintheSSIDfieldandabcdefghijkintheKeyfield. 5. ClickApplytoapplytheWDSsettingstotheAP. 6. LogontoMyAP2andrepeatsteps25(butbesuretousetheMACaddressofMyAP1intheRemoteAddress field. Note:MyAP1andMyAP2mustbesettothesameIEEE802.11Modeandbetransmittingonthe samechannel. WDSConfigurationfromtheCLI 1. ConnecttotheMyAP1byusingTelnet,SSH,oraserialconnection. 2. ConfiguretheremoteMACaddressforMyAP2. setinterfacewlan0wds0statusupremotemac00:30:AB:00:00:B0 3. SetWPA(PSK)astheencryptiontypeforthelink. setinterfacewlan0wds0wdssecuritypolicywpapersonal 4. SettheSSIDontheWDSlink. setinterfacewlan0wds0wdsssidwdslink 5. Configuretheencryptionkey. setinterfacewlan0wds0wdswpapskkeyabcdefghijk 6. AdministrativelyenabletheWDSlink. setinterfacewlan0wds0statusup 7. PerformthesameconfigurationstepsonMyAP2. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page170 UnifiedAccessPointAdministratorsGuide ConfiguringtheWirelessDistributionSystem WDSConfigurationUsingSNMP 1. LoadtheFASTPATHWLANACCESSPOINTMIBmodule. 2. FromtheMIBtree,navigatetotheobjectsintheapIfConfigtable. 3. WalktheapIfConfigNameobjecttoviewtheinstanceIDforthefirstWDSlink(wlan0wds0). ThefirstWDSlinkisinstance1. 4. Setthevalueofinstance1intheapIfConfigRemoteMacobjectto00:30:AB:00:00:B0. IntheMGSoftbrowser,theformatfortheMACaddressvaluetosetis#0x000x300xAB0x000x000xB0. 5. Setthevalueofinstance1intheapIfConfigWdsSecPolicyobjecttoWPAPersonal(3). 6. Setthevalueofinstance1intheapIfConfigSsidobjecttowdslink. 7. Setthevalueofinstance1intheapIfConfigWdsWpaPskKeyobjecttoabcdefthijk. SomeMIBbrowsersrequirethatthevaluebeenteredinHEXvaluesratherthanASCIIvalues. 8. PerformthesameconfigurationstepsonMyAP2. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page171 UnifiedAccessPointAdministratorsGuide ClusteringAccessPoints ClusteringAccessPoints ThisexampleshowshowtoconfigureaclusterwithtwoAPsandtoenableautomaticchannelre assigment.ThelocationofthelocalAPisRoom214,andtheclusternameisMyCluster. ClusteringAPsbyUsingtheWebInterface 1. LogontotheAPandnavigatetotheCluster>AccessPointspage. 2. 3. EntertheAPlocationandthenameoftheclusterforittojoin. Ifclusteringhasstarted,clickStopClusteringsoyoucanchangetheClusteringOptions. 4. ClickApply. 5. ClickStartClusteringtoenabletheclusteringfeature. Afteryourefreshthepage,otherAPsthatareonthesamebridgedsegment,haveradiosinthesame operatingmode,areenabledforclustering,andhavethesameclusternameappearintheAccessPoints table. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page172 UnifiedAccessPointAdministratorsGuide ClusteringAccessPoints 6. GototheChannelManagementpagetoviewthechannelassignments. Atableonthepagedisplaysthecurrentchannelassignmentsandtheproposedchannelassignments.The intervalsettingintheAdvancedsectiondeterminehowoftenproposedchangesareapplied. ClusteringAPsbyUsingtheCLI 1. ConnecttotheAPbyusingTelnet,SSH,oraserialconnection. 2. Stopclusteringsoyoucanchangethelocationandclustername. setclusterclustered0 3. SettheAPLocation. setclusterclusternameRoom214"

Note:Iftheclusternameorclusterlocationhasspaces,youmustenclosethetextinquotation markswhenyouenterthetextintheCLI,asthecommandexampleshows.Youdonotneedtouse quotationmarkswhenyouentertextbyusingtheWebUI. 4. Settheclustername. setclusterlocationMyCluster 5. Startclustering. setclusterclustered1 6. ViewinformationabouttheclustersettingsontheAP. getclusterdetail 7. Starttheautomaticchannelplanner. setchannelplannerstatusup 8. Viewthesettingsfortheautomaticchannelplanner. getchannelplannerdetail D-Link November2011 UnifiedAccessPointAdministratorsGuide Page173 UnifiedAccessPointAdministratorsGuide ConfiguringClientQoS ClusteringAPsbyUsingSNMP ClusterconfigurationbyusingSNMPisnotsupported. ConfiguringClientQoS ThisexampleshowshowtoenableclientQoS,configureanACLandaDiffServpolicyontheAP,andtoapply theACLandthePolicytotraffictransmittedfromclientsassociatedwithVAP2andreceivedbytheAP. TheIPv4ACLisnamedacl1andcontainstworules.ThefirstruleallowsHTTPtrafficfromthe192.168.1.0 subnet.ThesecondruleallowsallIPtrafficfromthemanagementstation(192.168.1.23).Allothertrafficis deniedduetotheimplicitdenyallruleattheendoftheACL.TheACLisappliedtotheinboundinterfaceon theAPsothatpacketsarecheckedwhentheAPreceivestrafficfromassociatedclients. TheDiffServpolicyinthisexampleshowshowtoestablishdefaultDiffServbehaviorforclientsassociatingwith theVAPthatdonotobtainaDiffServpolicynamethroughtheRADIUSserver.Voicetraffic(UDPpackets) receivedfromclientsinthe192.168.1.0subnetthathastheVoIPserverasitsdestinationaddress

(192.168.2.200),ismarkedwiththeIPDSCPvalueforexpeditedforwardingsothatittakespriorityoverother traffic. ConfiguringQoSbyUsingtheWebInterface ACLConfiguration 1. LogontotheAPandnavigatetotheClientQoS>ClientQoSACLpage. 2. Enteracl1intheACLNamefield,andclickAddACL. Thescreenrefreshes,andadditionalfieldsappear. 3. FromtheActionmenu,selectPermit. 4. CleartheMatchEveryoption. 5. VerifythattheProtocoloptionisselectedandIPisselectedfromtheSelectFromListmenu. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page174 UnifiedAccessPointAdministratorsGuide ConfiguringClientQoS 6. Configuretheremainingsettings:

SourceIPAddress:192.168.1.0 WildCardMask:0.0.0.255 SourcePort:Selecttheoption SelectFromList(SourcePort):www 7. ClickApplytosavetherule. 8. SelectNewRulefromtheRulemenuandcreateanotherrulewiththefollowingsettings:

Action:Permit MatchEvery:Cleartheoption Protocol:IP Address:192.168.1.23 WildCardMask:0.0.0.0 9. ClickApplytosavetherule. 10. NavigatetotheClientQoS>VAPQoSParameterspage. 11. FortheClientQoSGlobalAdminModeoption,selectEnabled. 12. FromtheVAPmenu,selectVAP2. 13. SelecttheEnabledoptionforClientQoSMode. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page175 UnifiedAccessPointAdministratorsGuide ConfiguringClientQoS 14. FromtheACLTypeUpmenu,selectIPv4. 15. FromtheACLNameUpmenu,selectacl1. 16. ClickApplytoupdatetheAPwiththeQoSsettings. DiffServConfiguration 1. LogontotheAPandnavigatetotheClientQoS>ClassMappage. 2. Enterclass_voipintheClassMapNamefieldandclickAddClassMap. Thepagerefreshesandadditionalfieldsappear. 3. SelecttheMatchEveryoptiontoindicatethatallmatchcriteriadefinedfortheclassmustbesatisfiedin orderforapackettobeconsideredamatch. 4. SelectProtocol,andthenselectUDPfromtheSelectFromListfieldtodefineUDPasamatchcriteria. 5. SelectSourceIPAddressandenterthefollowinginformation:

Address:192.168.1.0 SourceIPMask:255.255.255.0 6. SelecttheDestinationIPAddressoptionandenterthefollowinginformationfortheVoIPserver:

Address:192.168.2.200 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page176 UnifiedAccessPointAdministratorsGuide ConfiguringClientQoS DestinationIPMask:255.255.255.255 7. ClickApplytosavethematchcriteria. 8. NavigatetotheClientQoS>PolicyMappage. 9. Tocreateapolicy,enterpol_voipintothePolicyMapNamefield,andthenclickAddPolicyMap. Thepagerefreshesandadditionalfieldsappear. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page177 UnifiedAccessPointAdministratorsGuide ConfiguringClientQoS 10. Fortheclass_voipclassmap,selecttheIPDSCPoption,andthenselecteffromtheSelectFromListmenu. 11. Trafficthatmeetsthecriteriadefinedintheclass_voipclassismarkedwithaDSCPvalueofEF(expedited forwarding). 12. ClickApplytosavethepolicy. 13. NavigatetotheClientQoS>VAPQoSParameterspage. 14. SelectVAP2fromtheVAPmenu. 15. MakesurethattheClientQoSGlobalAdminModeandtheQoSModearebothenabled. 16. FromtheDiffServPolicyUpmenu,selectpol_voip. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page178 UnifiedAccessPointAdministratorsGuide ConfiguringClientQoS 17. ClickApplytoupdatetheAPwiththeQoSsettings. ConfiguringQoSbyUsingtheCLI ACLConfiguration 1. ConnecttotheAP. 2. CreateanACLnamedacl1. addaclacl1acltypeipv4 3. Addaruletoacl1thatallowsHTTPtrafficfromthe192.168.1.0subnet. addruleaclnameacl2acltypeipv4actionpermitprotocolipsrcip192.168.1.0srcipmask 0.0.0.255srcporthttp 4. Addanotherruletoacl1thatallowsalltrafficfromthehostwithanIPaddressof192.168.1.23. addruleaclnameacl2acltypeipv4actionpermitprotocolipsrcip192.168.1.23srcipmask 0.0.0.0 5. EnableClientQoSontheAP. setclientqosmodeup 6. EnableClientQoSonVAP2 setvapwlan0vap2qosmodeup 7. Applyacl1toVAP2intheinbounddirection(fromtheclienttotheAP). setvapwlan0vap2defaclupacl1 DiffServConfiguration 1. LogontotheAPCLI. 2. Createaclassmapnamedclass_voipandconfigureittomatchallUDPpacketsfromthe192.168.1.0 networkthathaveadestinationIPaddressof192.168.2.200(theVoIPserver). D-Link November2011 UnifiedAccessPointAdministratorsGuide Page179 UnifiedAccessPointAdministratorsGuide ConfiguringClientQoS addclassmapclass_voipeveryyesprotocoludpsrcip192.168.1.0srcipmask255.255.255.0dst ip192.168.2.200dstipmask255.255.255.255 3. Addapolicymapnamedpol_voip. addpolicymappol_voip 4. Definethepol_voippolicymapbyaddingtheclass_voipclassmapandspecifyingthatpacketsthatmatch theclass_voipcriteriawillbemarkedwithaDSCPvalueofEF(expeditedforwarding). addpolicyattrpolicymapnamepol_voipclassmapnameclass_voipmarkipdscpef 5. EnableClientQoSontheAP. setclientqosmodeup 6. EnableClientQoSonVAP2 setvapwlan0vap2qosmodeup 7. Applypol_voiptoVAP2intheinbounddirection(fromtheclienttotheAP). setvapwlan0vap2defpolicyuppol_voip ConfiguringQoSbyUsingSNMP ACLConfiguration 1. LoadtheDLINKWLANACCESSPOINTMIBmodule. 2. FromtheMIBtree,navigatetotheobjectsintheapQos>apAclTable. 3. UsetheapQosAclStatusobjecttocreatearowentrywithapQosAclNameandapQosAclTypeastheindexes forapQosAclEntry. ThenewapQosAclEntryvalueincludestheapQosAclType(1)followedbythenumberofcharactersinthe name(4),andthentheASCIIcodeforthename.Inthisexample,acl1is97.99.108.49.Thevaluetosetis4, whichisCreateandGo. 4. Addaruletoacl1thatallowsHTTPtrafficfromthe192.168.1.0subnet. Use1.3.6.1.4.1.6132.1.1.28.10.3.1.14.1.4.97.99.108.49.1tosettheapQosAclRuleStatusofRule1to active(1) IntheOID,the14(bold)isthesequenceidentifierfortheapQosAclRuleStatussobject,1istheACLtype, 4.97.99.108.49istheACLname(thenumberofcharactersfollowedbytheASCIIcode),andthefinal1 D-Link November2011 UnifiedAccessPointAdministratorsGuide Page180 UnifiedAccessPointAdministratorsGuide ConfiguringClientQoS istheACLrulenumber. Use1.3.6.1.4.1.6132.1.1.28.10.3.1.4.1.4.97.99.108.49.1tosettheapQosAclRuleSrcIpAddresstoa valueof192.168.1.0. Use1.3.6.1.4.1.6132.1.1.28.10.3.1.5.1.4.97.99.108.49.1tosettheapQosAclRuleSrcIpMasktoavalue of0.0.0.255. Use1.3.6.1.4.1.6132.1.1.28.10.3.1.6.1.4.97.99.108.49.1tosetapQosAclRuleSrcProtocoltoavalueof 80(HTTP). Use1.3.6.1.4.1.6132.1.1.28.10.3.1.16.1.4.97.99.108.49.1tosetapQosAclRuleCommittoavalueof1

(true),whichsavestherule. 5. Addanotherruletoacl1thatallowsalltrafficfromthehostwithanIPaddressof192.168.1.23. Use1.3.6.1.4.1.6132.1.1.28.10.3.1.14.1.4.97.99.108.49.2tosettheapQosAclRuleStatusofRule2to active(1) Use1.3.6.1.4.1.6132.1.1.28.10.3.1.4.1.4.97.99.108.49.2tosettheapQosAclRuleSrcIpAddresstoa valueof192.168.1.23. Use1.3.6.1.4.1.6132.1.1.28.10.3.1.5.1.4.97.99.108.49.2tosettheapQosAclRuleSrcIpMasktoavalue of0.0.0.0. Use1.3.6.1.4.1.6132.1.1.28.10.3.1.16.1.4.97.99.108.49.2tosetapQosAclRuleCommittoavalueof1

(true),whichsavestherule. 6. UsetheapQosGlobalModeobjecttosetthestatustoup(1),whichenablesClientQoSontheAP. 7. WalktheapVapDescriptionobjecttoviewtheinstanceIDforVAP2(wlan0vap2). VAP2onRadio1isinstance5. 8. UsetheapVapQosModeobjecttosetthestatusofVAP2toup(1). 9. UsetheapVapAclUpobjecttoapplyacl1toVAP2intheinbounddirection(fromtheclienttotheAP). TheACLnameisthetextstring,andnottheASCIIcode. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page181 UnifiedAccessPointAdministratorsGuide ConfiguringClientQoS DiffServConfiguration 1. LoadtheDLINKWLANACCESSPOINTMIBmodule. 2. FromtheMIBtree,navigatetotheobjectsintheapQos>apAclTable. 3. UsetheapQosDsClassMapStatusobjecttosetthestatusoftheclassmapnamedclass_voiptoCreateand Go(4). TheOIDtosetis1.3.6.1.4.1.6132.1.1.28.10.4.1.2.10.99.108.97.115.115.95.118.111.105.112,where10is thenumberofcharacters,and99.108.97.115.115.95.118.111.105.112isclass_voipinASCIIcode. 4. Configureclass_voiptomatchallUDPpacketsfromthe192.168.1.0networkthathaveadestinationIP addressof192.168.2.200(theVoIPserver). SetapQosDsClassMapMatchEverytotrue(1). SetapQosDsClassMapMatchProtocoltoUDP(17). SetapQosDsClassMapMatchSrcIpAddressto192.168.1.0. SetapQosDsClassMapMatchSrcIpMaskto255.255.255.0. SetapQosDsClassMapMatchDestIpAddressto192.168.2.200. SetapQosDsClassMapMatchDestIpMaskto255.255.255.255 SetapQosDsClassMapMatchCommittotrue(1). 5. Createapolicymapnamedpol_voip(whichis112.111.108.95.118.111.105.112inASCII)bysettingthe valueoftheOID1.3.6.1.4.1.6132.1.1.28.10.5.1.2.8.112.111.108.95.118.111.105.112toCreateandGo(4). 6. Definethepol_voippolicymapbyaddingtheclass_voipclassmapandspecifyingthatpacketsthatmatch theclass_voipcriteriawillbemarkedwithaDSCPvalueofEF(expeditedforwarding). Set apQosDsPolicyMapAttrStatus.8.112.111.108.95.118.111.105.112.10.99.108.97.115.115.95.118.111.1 05.112.1toavalueof4(CreateandGo) Set apQosDsPolicyMapAttrMarkIpDscp.8.112.111.108.95.118.111.105.112.10.99.108.97.115.115.95.118. 111.105.112.1to46(whichistheequivalentofef). D-Link November2011 UnifiedAccessPointAdministratorsGuide Page182 UnifiedAccessPointAdministratorsGuide ConfiguringClientQoS 7. EnableClientQoSontheAP. setclientqosmodeup 8. UsetheapQosGlobalModeobjecttosetthestatustoup(1),whichenablesClientQoSontheAP. 9. WalktheapVapDescriptionobjecttoviewtheinstanceIDforVAP2(wlan0vap2). VAP2onRadio1isinstance5. 10. UsetheapVapQosModeobjecttosetthestatusofVAP2toup(1). 11. UsetheapVapPolUpobjecttoapplypol_voiptoVAP2intheinbounddirection(fromtheclienttotheAP). Thepolicynameisthetextstring,andnottheASCIIcode. D-Link November2011 UnifiedAccessPointAdministratorsGuide Page183 FederalCommunicationCommissionInterferenceStatement ThisdevicecomplieswithPart15oftheFCCRules.Operationissubjectto thefollowingtwoconditions:(1)Thisdevicemaynotcauseharmful interference,and(2)thisdevicemustacceptanyinterferencereceived, includinginterferencethatmaycauseundesiredoperation. Theselimits Thisequipmenthasbeentestedandfoundtocomplywiththelimitsfor a Class Bdigitaldevice,pursuanttoPart15oftheFCCRules. aredesignedtoprovidereasonableprotectionagainstharmfulinterferencein a residentialinstallation.Thisequipmentgenerates,usesandcanradiateradio frequencyenergyand,ifnotinstalledandusedinaccordancewiththe instructions,maycauseharmfulinterferencetoradiocommunications. However,thereisnoguaranteethatinterferencewillnotoccurinaparticular installation. Ifthisequipmentdoescauseharmfulinterferencetoradioor televisionreception,whichcanbedeterminedbyturningtheequipmentoff andon,theuserisencouragedtotrytocorrecttheinterferencebyoneofthe followingmeasures:

-Reorientorrelocatethereceivingantenna.

-Increasetheseparationbetweentheequipmentandreceiver.

-Connecttheequipmentintoanoutletonacircuitdifferentfromthat towhichthereceiverisconnected.

-Consultthedealeroranexperiencedradio/TVtechnicianforhelp. FCCCaution:Anychangesormodificationsnotexpresslyapprovedbythe partyresponsibleforcompliancecouldvoidtheuser'sauthoritytooperatethis equipment. Thistransmittermustnotbeco-locatedoroperatinginconjunctionwithany otherantennaortransmitter. Radiation ExposureStatement:

ThisequipmentcomplieswithFCCradiationexposurelimitssetforthforan uncontrolledenvironment.Thisequipmentshouldbeinstalledandoperated withminimumdistance20cmbetweentheradiator&yourbody. IndustryCanadastatement:

ThisdevicecomplieswithRSS-210oftheIndustryCanadaRules.Operationis subjecttothefollowingtwoconditions:(1)Thisdevicemaynotcauseharmful interference,and(2)thisdevicemustacceptanyinterferencereceived, includinginterferencethatmaycauseundesiredoperation. lanormeCNR-210d'IndustrieCanadaapplicable Cedispositifestconforme auxappareilsradioexemptsdelicence.Sonfonctionnementestsujetauxdeux conditionssuivantes:(1)ledispositifnedoitpasproduiredebrouillage pr judiciable,et(2)cedispositifdoitacceptertoutbrouillagere unbrouillagesusceptibledeprovoquerunfonctionnementind u,ycompris sirable. RadiationExposureStatement:

ThisequipmentcomplieswithICradiationexposurelimitssetforthforan uncontrolledenvironment.Thisequipmentshouldbeinstalledandoperated withminimumdistance20cmbetweentheradiator&yourbody. D clarationd'expositionauxradiations:

Cet quipementestconformeauxlimitesd'expositionauxrayonnementsIC tabliespourunenvironnementnoncontr etutilis rayonnementetvotrecorps. avecunminimumde20cmdedistanceentrelasourcede quipementdoit l .Cet treinstall