Wireless-ac/n dual band desktop access point with poe (14 pages)
Summary of Contents for Cisco WAP131
Page 1
ADMINISTRATION GUIDE Cisco WAP131 Wireless-N Dual Radio Access Point with PoE Cisco WAP351 Wireless-N Dual Radio Access Point with 5 Ports Switch...
Page 2
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company.
Management Buttons Chapter 2: Status and Statistics System Summary Network Interfaces Traffic Statistics WorkGroup Bridge Transmit/Receive Associated Clients Radio Statistics Email Alert Status View Log TSPEC Client Associations TSPEC Status and Statistics TSPEC AP Statistics Cisco WAP131 and WAP351 Administration Guide...
Page 5
Packet Capture File Download Support Information Spanning Tree Settings Chapter 4: LAN Port Settings Configuring Port Settings for Cisco WAP131 Configuring Port Settings for Cisco WAP351 VLAN Configuration Configuring VLAN Settings for Cisco WAP131 Configuring VLAN Settings for Cisco WAP351...
Page 6
WPA/PSK on WDS Links WorkGroup Bridge Quality of Service Chapter 6: System Security RADIUS Server 802.1X/802.1X Supplicant Configure 802.1X Supplicant for Cisco WAP131 Configure 802.1X for Cisco WAP351 Password Complexity WPA-PSK Complexity Chapter 7: Quality of Service Global Settings Configuring QoS Settings for Cisco WAP131...
Page 7
Workflow to Configure ACLs Configure IPv4 ACLs Configure IPv6 ACLs Configure MAC ACLs ACL Association ACL Status Chapter 9: SNMP General Views Groups Users Targets Chapter 10: Captive Portal Global Configuration Local Groups/Users Local Groups Local Users Cisco WAP131 and WAP351 Administration Guide...
Page 8
Configuring and Viewing the Channel Assignments Viewing Channel Assignments and Setting Locks Configuring Advanced Settings Wireless Neighborhood Viewing Neighboring Devices Viewing Details for a Single Point Setup Member Appendix A: Where to Go From Here Cisco WAP131 and WAP351 Administration Guide...
Getting Started This chapter provides an introduction to the web-based Configuration Utility of the Cisco WAP131 and WAP351 Wireless-N Dual Radio Access Points. It includes these topics: • Getting Started with the Configuration • Using the Access Point Setup Wizard •...
Locate the IP address of the WAP device. STEP 2 a. The WAP device can be accessed and managed by Cisconetwork tools and services including the Cisco FindIT Network Discovery Utility that enables you to automatically discover all supported Cisco devices in the same local network segment as your computer.
STEP 3 In the address bar, enter the default DHCP address and press the Enter key. STEP 4 Enter the default user name of cisco and password of cisco in the Username and STEP 5 Password fields. Click Log In. The Access Point Setup Wizard appears.
Configuring Security Settings. Click Next. The Configure Radio 1 - Assign The VLAN ID For Your Wireless STEP 11 Network window appears. Enter a VLAN ID for traffic received on the wireless network. STEP 12 Cisco WAP131 and WAP351 Administration Guide...
STEP 4 and enter a New Cluster Name. When you configure your devices with the same cluster name and enable the Single Point Setup mode on other WAP devices, they automatically join the group. Cisco WAP131 and WAP351 Administration Guide...
Page 14
Click Next. Repeat the step 9 to step 14 to configure the settings for Radio 2 STEP 15 interface. Click Next. The Enable Captive Portal - Create Your Guest Network window STEP 16 appears. Cisco WAP131 and WAP351 Administration Guide...
Page 15
If they are correct, click Submit. Your setup settings are saved and a confirmation STEP 27 window appears. Click Finish. STEP 28 The WAP device was configured successfully. You are required to log in again with the new password. Cisco WAP131 and WAP351 Administration Guide...
To change the default administrative password: Enter the following fields to set a new password: STEP 1 • Old Password—Enter the current password (default is cisco). • New Password—Enter a new password. • Confirm Password—Enter the new password again for confirmation.
Click the Support link to direct you to the product support page. • Click the Forums link to direct you to the Cisco Support Community page. • Click the Wireless Planning Tool link to direct you to the AirMagnet Planner page.
WAP device. If a main menu item is preceded by an arrow, select to expand and display the submenu of each group. You can then select on the desired submenu item to open the associated page. Cisco WAP131 and WAP351 Administration Guide...
Edits or modifies an existing entry. Select an entry first. Refresh Redisplays the current page with the latest data. Save Saves the settings or configuration. Update Updates the new information to the startup configuration. Cisco WAP131 and WAP351 Administration Guide...
System Summary under Device Status on the Getting Started page. The following information is displayed: • PID VID—The hardware model and version of the WAP device. • Serial Number—The serial number of the WAP device. Cisco WAP131 and WAP351 Administration Guide...
Page 21
Local IP Address—The IP address, if any, of a remote device that is connected to this service on the WAP device. All indicates that any IP address on the device can use this service. Cisco WAP131 and WAP351 Administration Guide...
The following information is displayed: • LAN Status—Displays information for LAN interface, including: MAC Address—The MAC address of the WAP device. IP Address—The IP address of the WAP device. Subnet Mask—The subnet mask of the WAP device. Cisco WAP131 and WAP351 Administration Guide...
Page 23
Green Ethernet Mode (For WAP131 Only)—The Green Ethernet mode is enabled or disabled on the WAP device. VLAN ID (For WAP131 Only)—The VLAN ID number of the WAP device. These settings apply to the internal interface. Click the Edit link to change any of these settings.
Page 24
Profile—The name of any associated scheduler profile. State—The current state (active or inactive). The state indicates whether the VAP is exchanging data with a client. You can click Refresh to refresh the screen and show the most current information. Cisco WAP131 and WAP351 Administration Guide...
To show the WorkGroup Bridge Transmit/Receive page, select Status and Statistics > WorkGroup Bridge Transmit/Receive. The Traffic Statistics table shows information for each network interface that is configured as a WorkGroup Bridge interface, including: Cisco WAP131 and WAP351 Administration Guide...
WAP device. This status does not show IEEE 802.1X authentication or association status. These are some points to keep in mind with regard to this field: Cisco WAP131 and WAP351 Administration Guide...
Page 27
STA has not been admitted. • Up Time (DD:HH:MM)—The amount of time that the client has been associated with the WAP device. You can click Refresh to refresh the screen and show the most current information. Cisco WAP131 and WAP351 Administration Guide...
MSDU frames where the multicast bit was set in the destination MAC address. • Duplicate Frame Count—Number of times that a frame was received and the Sequence Control field indicates it was a duplicate. Cisco WAP131 and WAP351 Administration Guide...
Email Alert Status—Shows if the Email Alert is enabled or disabled on the WAP device. The default is Disabled. • Number of Emails Sent—The total number of emails sent. The range is an unsigned integer of 32 bits. The default is 0. Cisco WAP131 and WAP351 Administration Guide...
WAP device requesting a certain amount of network access for the traffic stream (TS) that it represents. A traffic stream is a collection of data packets identified by the wireless client as belonging to a particular user priority. An example of a voice Cisco WAP131 and WAP351 Administration Guide...
Page 31
• VAP MAC Address—MAC address of the Virtual Access Point (VAP). The Statistics table displays the following information • Network Interface—Radio interface used by the client. • Station—Station MAC address of the client. Cisco WAP131 and WAP351 Administration Guide...
If you reboot the WAP device, these figures indicate transmit and receive totals since the reboot. To view the TSPEC status and statistics, select Status and Statistics > TSPEC Status and Statistics. Cisco WAP131 and WAP351 Administration Guide...
Page 33
(VAPs): • Interface—Name of the VAP interface. • Total Voice Packets—Total number of traffic stream voice packets sent (in Transmit table) or received (in Received table) by this WAP device for this VAP. Cisco WAP131 and WAP351 Administration Guide...
• TSPEC Statistics Summary for Video ACM—The total number of accepted and the total number of rejected video traffic streams. You can click Refresh to refresh the screen and show the most current information. Cisco WAP131 and WAP351 Administration Guide...
One management user is configured on the WAP device by default: • User Name: cisco • Password: cisco Use the User Accounts page to configure up to four additional users and to change a user password. Cisco WAP131 and WAP351 Administration Guide...
Select Administration > User Accounts. STEP 1 The User Account Table shows the currently configured users. The user cisco is preconfigured in the system and has Read/Write privileges. All other users can have Read Only access, but not Read/Write access.
In the System Clock Source area, choose Network Time Protocol (NTP). STEP 2 Configure these parameters: STEP 3 • NTP Server(1 through 4)/IPv4/IPv6 Address/Name—Specify the IPv4 address, IPv6 address, or host name of an NTP server. A default NTP server is listed. Cisco WAP131 and WAP351 Administration Guide...
System Time—Select the current hour and minutes in 24-hour clock format. • Time Zone—Select the time zone for your location. • Adjust Time for Daylight Savings—If daylight savings time is applicable to your time zone, check this option and configure the following fields: Cisco WAP131 and WAP351 Administration Guide...
Persistence—Check Enable to save system logs to nonvolatile memory so that the logs are kept when the WAP device reboots. You can save up to 1000 log messages in the nonvolatile memory. When the limit of 1000 is Cisco WAP131 and WAP351 Administration Guide...
Select Administration > Log Settings. STEP 1 In the Remote Log Server Table, configure these parameters : STEP 2 • Remote Log Server—Enter the IPv4 or IPv6 address, or the host name of the remote log server. Cisco WAP131 and WAP351 Administration Guide...
Do not use your personal email address, which would unnecessarily expose your personal email login credentials. Use a separate email account instead. Also be aware that many email accounts keep a copy of all sent messages by default. Cisco WAP131 and WAP351 Administration Guide...
A host name can consist of one or more labels, which are sets of up to 63 alphanumeric characters. If a host name includes multiple labels, each is separated by a period (.). The entire series of labels and periods can be up to 253 characters long. Cisco WAP131 and WAP351 Administration Guide...
Username = Your full email address you can use to login to your email account associated with the above server Password = xxxxxxxx is a valid password of your valid email account To Email Address 1 = myemail@gmail.com Windows Live Hotmail Windows Live Hotmail recommends the following settings: Cisco WAP131 and WAP351 Administration Guide...
STEP 1 In the Global Settings area, configure these parameters: STEP 2 • Maximum Sessions—Enter the number of web sessions, including both HTTP and HTTPS, that can be in use at the same time. Cisco WAP131 and WAP351 Administration Guide...
Page 46
Redirect HTTP to HTTPS—Redirects management HTTP access attempts on the HTTP port to the HTTPS port. This field is available only when HTTP access is disabled. Click Save. The changes are saved to the Startup Configuration. STEP 4 Cisco WAP131 and WAP351 Administration Guide...
Server IPv4 Address, then click Upload. The filename cannot contain the following characters: spaces, <, >, | , \, : , (, ), &, ; , #, ? , *, and two or more successive periods. A confirmation appears when the upload was successful. Cisco WAP131 and WAP351 Administration Guide...
When new versions of the firmware become available, you can upgrade the firmware on your WAP device to take advantage of new features and enhancements. The WAP device uses a TFTP or HTTP/HTTPS client for firmware upgrades. Cisco WAP131 and WAP351 Administration Guide...
Select TFTP as the transfer method. STEP 1 Enter a name (1 to 256 characters) for the image file in the Source File Name field, STEP 2 including the path to the directory that contains the image to upload. Cisco WAP131 and WAP351 Administration Guide...
When the process is complete, the WAP device restarts and resumes normal operation. To verify that the firmware upgrade completed successfully, log into the web- STEP 4 based Configuration Utility, open the Upgrade Firmware page, and view the active firmware version. Cisco WAP131 and WAP351 Administration Guide...
? , *, and two or more successive periods. For a TFTP backup only, enter the TFTP Server IPv4 Address. STEP 5 Select which configuration file that you want to back up: STEP 6 Cisco WAP131 and WAP351 Administration Guide...
? , *, and two or more successive periods. Select which configuration file on the WAP device that you want to replace with STEP 5 the downloaded file: the Startup Configuration or the Backup Configuration. Cisco WAP131 and WAP351 Administration Guide...
Mirror Configuration to the Startup Configuration. In the Destination File Name field, select the file type to be replaced with the file STEP 3 that you are copying. Cisco WAP131 and WAP351 Administration Guide...
STEP 3 To Factory Default. Any customized settings are lost. A window appears prompting you to confirm or cancel the reboot. The current NOTE management session may be terminated. Click OK to reboot. STEP 4 Cisco WAP131 and WAP351 Administration Guide...
The WAP device advertises these service types: • Cisco-specific device description (csco-sb)—This service enables clients to discover the Cisco WAP devices and other products deployed in your networks. • Management user interfaces—This service identifies the management interfaces available on the WAP device (HTTP and SNMP).
In the Packet Capture Configuration area, configure these parameters: STEP 2 • Capture Beacons—Enables or disables the capturing of 802.11 beacons detected or transmitted by the radio. • Promiscuous Capture—Enables or disables the promiscuous mode when the capture is active. Cisco WAP131 and WAP351 Administration Guide...
Select Administration > Packet Capture. STEP 1 Ensure that Local File is selected for the Packet Capture Method. STEP 2 Configure these parameters: STEP 3 • Capture Interface (For WAP131 Only)—Enter a capture interface type for packet capture: Cisco WAP131 and WAP351 Administration Guide...
Page 58
Max Capture File Size—Enter the maximum allowed size for the capture file in kilobytes (KB). The range is from 64 to 4096. The default is 1024. Click Save. The changes are saved to the Startup Configuration. STEP 4 Cisco WAP131 and WAP351 Administration Guide...
In the Remote Capture Port field, use the default port (2002), or if you are using a STEP 4 port other than the default, enter the desired port number used for connecting Wireshark to the WAP device. The port range is from 1025 to 65530. Cisco WAP131 and WAP351 Administration Guide...
Page 60
-- rpcap://[192.168.1.220]:2002/radio1 At WAP351, VAP1 ~ VAP7 traffic -- rpcap://[ 192.168.1.220]:2002/wlan0vap1 ~ wlan0vap7 At WAP131, VAP1 ~ VAP3 traffic -- rpcap://[ 192.168.1.220]:2002/wlan0vap1 ~ wlan0vap3 You can trace up to four interfaces on the WAP device at the same time. However, you must start a separate Wireshark session for each interface.
Page 61
Wireshark session. To minimize the performance impact on the WAP device during traffic capture, install capture filters to limit which traffic is sent to the Wireshark Cisco WAP131 and WAP351 Administration Guide...
Enter the TFTP Server Filename to download if it is different from the default. By STEP 3 default, the captured packets are stored in the folder file /tmp/apcapture.pcap on the WAP device. Specify a TFTP Server IPv4 Address in the field provided. STEP 4 Cisco WAP131 and WAP351 Administration Guide...
Spanning Tree Settings Use the Spanning Tree Settings page to configure the STP settings on the Cisco WAP351. It supports the configuration per port or on the whole device.
Page 64
STEP 1 Configure these parameters: STEP 2 • STP Status—Enables or disables STP globally on the Cisco WAP351. By default, STP is enabled. • Flood BPDU if STP is disabled on port(s)—Check to flood the BPDU packets received from the port(s) whose STP status is disabled, or uncheck to drop the BPDU packets received from the port(s) whose STP status is disabled.
Use the Port Settings page to view and configure the settings for the port that physically connects the WAP device to a local area network. Configuring Port Settings for Cisco WAP131 To configure the port settings: Select LAN > Port Settings.
Duplex. • Auto Negotiation—When enabled, the port negotiates with its link partner to set the fastest link speed and duplex mode available. When disabled, you can manually configure the Port Speed and Duplex Mode. Cisco WAP131 and WAP351 Administration Guide...
Click Save. The changes are saved to the Startup Configuration. STEP 3 VLAN Configuration Use the VLAN Configuration page to view and configure the VLAN settings. Configuring VLAN Settings for Cisco WAP131 Select LAN > VLAN Configuration. STEP 1 Configure these parameters: STEP 2 •...
WAP device through Telnet or the web GUI. There must be one and only one VLAN as the management VLAN. If no interface (wire or wireless) belongs to the management VLAN, there will be no interface that a user can use to access the configuration utility. Cisco WAP131 and WAP351 Administration Guide...
Choose one of these options: DHCP—The WAP device acquires its IP address from a DHCP server on the LAN. Static IP—Manually configure the IPv4 address. The IPv4 address should be in a form similar to xxx.xxx.xxx.xxx (192.0.2.10). Cisco WAP131 and WAP351 Administration Guide...
(2001:DB8::CAD5:7D91). • IPv6 Administrative Mode—Enables or disables IPv6 management access. • IPv6 Auto Configuration Administrative Mode—Enables or disables IPv6 automatic address configuration on the WAP device. Cisco WAP131 and WAP351 Administration Guide...
Page 71
IPv6 Domain Name Servers—Select one of the following options: Dynamic—The DNS name servers are learned dynamically through DHCPv6. Manual—Manually specify up to two IPv6 DNS name servers in the fields provided. Configure an IPv6 tunnel using ISATAP. STEP 3 Cisco WAP131 and WAP351 Administration Guide...
Page 72
NOTE and ISATAP IPv6 Global Address fields show on the page. These are the virtual IPv6 interface addresses to the IPv4 network. Click Save. The changes are saved to the Startup Configuration. STEP 4 Cisco WAP131 and WAP351 Administration Guide...
Page 73
After new settings are saved, the corresponding processes may be stopped and NOTE restarted. When this condition happens, the WAP device may lose connectivity. We recommend that you change the WAP device settings when a loss of connectivity will least affect your wireless clients. Cisco WAP131 and WAP351 Administration Guide...
WAP device to report associated clients that do not adhere to mandatory admission control procedures. The reporting occurs through the system log and SNMP traps. Enter a time from 0 to 900 seconds. The default is 300 seconds. Cisco WAP131 and WAP351 Administration Guide...
Page 75
Primary Channel (802.11n modes with 20/40 MHz bandwidth only)—A 40 MHz channel can be considered to consist of two 20-MHz channels that are contiguous in the frequency domain. These two 20-MHz channels are often Cisco WAP131 and WAP351 Administration Guide...
Page 76
Yes—The WAP device transmits data using a 400-nanosecond guard interval when communicating with clients that also support the short guard interval. This is the default selection. No—The WAP device transmits data using an 800-nanosecond guard interval. Cisco WAP131 and WAP351 Administration Guide...
Page 77
If the packet being transmitted is equal to or less than the threshold, the fragmentation is not used. Setting the threshold to the largest value (2,346 bytes, which is the default) effectively disables the fragmentation. Cisco WAP131 and WAP351 Administration Guide...
Page 78
A lower transmit power setting can also keep your network more secure because the weaker wireless signals are less likely to propagate outside of the physical location of your network. Cisco WAP131 and WAP351 Administration Guide...
Page 79
Rate Limit Burst—An amount of traffic, measured in bytes, which is allowed to pass as a temporary burst even if it is above the defined maximum rate. The default and maximum rate limit burst setting is 75 packets per second. Cisco WAP131 and WAP351 Administration Guide...
Page 80
TSPEC Video ACM Limit—The upper limit on the amount of traffic that the WAP device attempts to transmit on the wireless medium using a video AC to gain access. The default limit is 15 percent of total traffic. Cisco WAP131 and WAP351 Administration Guide...
Rogue AP Detection The Cisco WAP351 supports the Rogue AP detection feature. A Rogue AP is an access point that has been installed on a secure network without explicit authorization from a system administrator. Rogue APs pose a security threat...
It is also referred to as the Network Name. • Privacy—Indicates whether there is any security on the rogue device. The options are: Off—Indicates that the security mode on the rogue device is set to None (no security). Cisco WAP131 and WAP351 Administration Guide...
Page 83
Trusted AP List. If the AP is in the Trusted AP List, click Untrust to move the AP to the Detected Rogue AP List. Click Refresh to refresh the screen and show the most current information. STEP 5 Cisco WAP131 and WAP351 Administration Guide...
Replace—Imports the list and replaces the contents of the Known AP List. • Merge—Imports the list and adds the APs in the imported file to the APs currently shown in the Known AP List. Cisco WAP131 and WAP351 Administration Guide...
WAP device. Up to four VAPs are supported on the Cisco WAP131 and up to eight VAPs are supported on the Cisco WAP351. Each VAP can be independently enabled or disabled, with the exception of VAP0.
Each VAP is associated with a VLAN, which is identified by a VLAN ID (VID). A VID can be any value from 1 to 4094, inclusive. The Cisco WAP131 supports five active VLANs (four for WLAN plus one management VLAN). The Cisco WAP351 supports 17 active VLANs (16 for WLAN plus one management VLAN).
Page 87
None Static WEP Dynamic WEP WPA Personal WPA Enterprise If you choose a security mode other than None, additional fields appear. For more information on configuring the wireless security settings, see Configuring Security Settings. Cisco WAP131 and WAP351 Administration Guide...
Page 88
WAP device settings when a loss of connectivity will least affect your wireless clients. To delete a VAP, check the VAP and click Delete. To save your deletion permanently, NOTE click Save when complete. Cisco WAP131 and WAP351 Administration Guide...
ASCII — Includes uppercase and lowercase alphabetic letters, the numeric digits, and special symbols such as @ and #. Hex — Includes digits 0 to 9 and the letters A to F. Cisco WAP131 and WAP351 Administration Guide...
Page 90
WAP device. Also, the client stations configured to use WEP as an open system (shared key mode not enabled) can associate with the WAP device even if they do not have the correct WEP key. Cisco WAP131 and WAP351 Administration Guide...
The WAP device requires a RADIUS server that supports EAP, such as the Microsoft Internet Authentication Server. To work with Microsoft Windows clients, the authentication server must support Protected EAP (PEAP) and MSCHAP V2. Cisco WAP131 and WAP351 Administration Guide...
Page 92
If you enable RADIUS accounting, it is enabled for the primary RADIUS server and all backup servers. Cisco WAP131 and WAP351 Administration Guide...
WPA2-AES—All client stations on the network support WPA2 and AES- CCMP cipher/security protocol. This WPA version provides the best security per IEEE 802.11i standard. As per the latest WiFi Alliance requirement, the AP has to support this mode all the time. Cisco WAP131 and WAP351 Administration Guide...
This security mode is backwards-compatible with the wireless clients that support the original WPA. The dynamic VLAN mode is enabled by default, which allows the RADIUS authentication server to decide which VLAN is used for the stations. Cisco WAP131 and WAP351 Administration Guide...
Page 95
IPv4 and IPv6 global RADIUS address settings, but the WAP device contacts only the RADIUS server or servers for the address type that you select in this field. Cisco WAP131 and WAP351 Administration Guide...
Page 96
Session Key Refresh Rate—The interval at which the WAP device refreshes session (unicast) keys for each client associated with the VAP. The valid range is from 0 to 86400 seconds. A value of 0 indicates that the session key is not refreshed. Cisco WAP131 and WAP351 Administration Guide...
Reason—The reason for the scheduler operational status. Possible values are: IsActive—The scheduler is administratively enabled. Administrative Mode is disabled—The scheduler administrative mode is disabled. System Time is out dated—The system time is out dated. ManagedMode—The scheduler is in managed mode. Cisco WAP131 and WAP351 Administration Guide...
A scheduler profile must be associated with a radio interface or a VAP interface to NOTE be in effect. See the Scheduler Association page. To delete a rule, select the profile from the Profile Name column and click Delete. NOTE Cisco WAP131 and WAP351 Administration Guide...
Click Enable to enable Bandwidth Utilization, or uncheck Enable to disable this STEP 2 feature. In the Maximum Utilization Threshold field, enter the percentage of network STEP 3 bandwidth utilization allowed on the radio before the WAP device stops accepting new client associations. Cisco WAP131 and WAP351 Administration Guide...
Block all stations in list—Only the stations that appear in the list are denied access to the network through the WAP device. All other stations are permitted access. The filter setting also applies to the MAC filtering list stored on the NOTE RADIUS server, if one exists. Cisco WAP131 and WAP351 Administration Guide...
RADIUS Server Description Value Attribute User-Name (1) MAC address of the client station. Valid Ethernet MAC address User-Password A fixed global password used to look up NOPASSWORD a client MAC entry. Cisco WAP131 and WAP351 Administration Guide...
Before you configure WDS on the WAP device, note these guidelines: • WDS only works with the Cisco WAP131 and Cisco WAP351 devices. • All Cisco WAP devices participating in a WDS link must have the following identical settings: Radio IEEE 802.11 Mode...
Configuring STP for Cisco WAP131 Select Wireless > WDS Bridge. STEP 1 In the Spanning Tree Mode field, check Enable to enable STP mode on the Cisco STEP 2 WAP131. When enabled, STP helps prevent switching loops. STP is recommended if you configure WDS links.
Repeat these steps for up to three additional WDS interfaces. STEP 4 Click Save. The changes are saved to the Startup Configuration. STEP 5 Replicate this procedure on the other device or devices connecting to the bridge. STEP 6 Cisco WAP131 and WAP351 Administration Guide...
The WDS ID can be any alphanumeric combination. • Key—Enter a unique shared key for the WDS bridge. This unique shared key must also be entered for the WAP device at the other end of the WDS Cisco WAP131 and WAP351 Administration Guide...
WAP device. WDS is a better solution and is preferred over the WorkGroup Bridge solution. Use WDS if you are bridging the Cisco WAP131 and Cisco WAP351 devices. If you are not, then consider the WorkGroup Bridge. When the WorkGroup Bridge feature is enabled, the VAP configurations are not applied;...
Page 107
Detection is enabled in Rogue AP Detection (which is also disabled by default). • Security—The type of security to use for authenticating as a client station on the upstream WAP device. The options are: Cisco WAP131 and WAP351 Administration Guide...
Page 108
MAC address list. RADIUS—The set of clients in the APs BSS that can access the upstream network is restricted to the clients specified in a MAC address list on a RADIUS server. Cisco WAP131 and WAP351 Administration Guide...
Choose one of these options from the EDCA Template list: STEP 3 • WFA Defaults—Populates the WAP device and the Station EDCA parameters with WiFi Alliance default values, which are best for general, mixed traffic. Cisco WAP131 and WAP351 Administration Guide...
Page 110
• Maximum Contention Window—The upper limit in milliseconds for the doubling of the random backoff value. This doubling continues until either the data frame is sent or the Maximum Contention Window size is reached. Cisco WAP131 and WAP351 Administration Guide...
Page 111
Unscheduled Automatic Power Save Delivery—Check Enable to enable APSD, which is a power management method. APSD is recommended if VoIP phones access the network through the WAP device. Click Save. The changes are saved to the Startup Configuration. STEP 6 Cisco WAP131 and WAP351 Administration Guide...
Page 112
After new settings are saved, the corresponding processes may be stopped and CAUTION restarted. When this condition happens, the WAP device may lose connectivity. We recommend that you change the WAP device settings when a loss of connectivity will least affect your wireless clients. Cisco WAP131 and WAP351 Administration Guide...
In addition to using the global RADIUS servers, you can also configure each VAP to NOTE use a specific set of RADIUS servers. See the Networks page for more information. Cisco WAP131 and WAP351 Administration Guide...
Page 114
Authentication Port (2 through 4)—Enter the port associated with the configured backup RADIUS servers. The server at Server IP (IPv6) Address 2 uses Authentication Port 2, the server at Server IP (IPv6) Address 3 uses Authentication Port 3, and so on. Cisco WAP131 and WAP351 Administration Guide...
If your network uses 802.1X, you must configure 802.1X authentication information on the WAP device, so that it can supply it to the authenticator. Configure 802.1X Supplicant for Cisco WAP131 To configure the 802.1X supplicant settings: Click System Security > 802.1X Supplicant.
Page 116
After new settings are saved, the corresponding processes may be stopped and NOTE restarted. When this condition happens, the WAP device may lose connectivity. We recommend that you change the WAP device settings when a loss of connectivity will least affect your wireless clients. Cisco WAP131 and WAP351 Administration Guide...
The user name and password that are encrypted using the MD5 NOTE algorithm can be configured to allow the WAP device to authenticate using 802.1X. • Certificate File Status—Shows whether a current certificate exists. Cisco WAP131 and WAP351 Administration Guide...
Page 118
WAP device sends an authentication request to the primary server. If the primary server responds to the authentication request, the WAP device continues to use this RADIUS server as the primary server, and authentication requests are sent to the address you specify. Cisco WAP131 and WAP351 Administration Guide...
Page 119
Periodic Reauthentication—Enables EAP reauthentication. Reauthentication Period—Enter the EAP reauthentication period in seconds. The default is 3600. The valid range is from 300 to 4294967295 seconds. Click Save. The changes are saved to the Startup Configuration. STEP 6 Cisco WAP131 and WAP351 Administration Guide...
Password Aging Time—Enter the number of days before a newly created password expires, from 1 to 365. The default is 180 days. Click Save. The changes are saved to the Startup Configuration. STEP 4 Cisco WAP131 and WAP351 Administration Guide...
32 to 63. The default is 63. • Minimum WPA-PSK Length—The minimum key length in number of characters is from 8 to 16. The default is 8. Click Save. The changes are saved to the Startup Configuration. STEP 4 Cisco WAP131 and WAP351 Administration Guide...
WAP device, and configure the trust mode and other QoS settings if you are using a Cisco WAP351 device. Configuring QoS Settings for Cisco WAP131 To configure the QoS mode on your WAP device: Select Quality of Service > Global Settings.
Global Settings Configuring QoS Settings for Cisco WAP351 If you are using a Cisco WAP351 device and the QoS mode is enabled, you can configure the trust mode and other settings for Ethernet switch: Select Quality of Service > Global Settings.
Choose IPv4 as the type of class map from the Class Map Type list. The IPv4 STEP 3 class map applies only to IPv4 traffic on the WAP device. In the Match Criteria Configuration area, configure these parameters to match STEP 4 the packets to a class: Cisco WAP131 and WAP351 Administration Guide...
Page 125
Match to Port—Matches the source port number in the datagram header to an IANA port number that you specify. The port range is from 0 to 65535 and includes three different types of ports: 0 to 1023—Well-Known Ports 1024 to 49151—Registered Ports Cisco WAP131 and WAP351 Administration Guide...
Page 126
IP DSCP Match to Value—Enter a custom DSCP value from 0 to 63. IP Precedence—Matches the packet's IP precedence value to the IP precedence value defined in this field. The IP precedence range is from 0 to 7. Cisco WAP131 and WAP351 Administration Guide...
Class Map Name—Choose the IPv6 class map from the list. • Match Every Packet—The match condition is true to all parameters in a Layer 3 packet. When enabled, all Layer 3 packets will match the condition. Cisco WAP131 and WAP351 Administration Guide...
Page 128
Destination IPv6—Requires a packet's destination IPv6 address to match the IPv6 address defined in the appropriate fields. Destination IPv6 Address—Enter the IPv6 address to apply this criteria. Destination IPv6 Prefix Length—Enter the prefix length of the destination IPv6 address. Cisco WAP131 and WAP351 Administration Guide...
STEP 1 In the Class Map Name field, enter the name for the new class map. The name can STEP 2 contain from 1 to 31 alphanumeric and special characters. Spaces are not allowed. Cisco WAP131 and WAP351 Administration Guide...
Page 130
00:00:00:00:00:00 checks all address bits and is used to match a single MAC address. • Destination MAC—Includes a destination MAC address in the match condition for the rule. Destination MAC Address—Enter the destination MAC address to compare against an Ethernet frame. Cisco WAP131 and WAP351 Administration Guide...
Police Simple—Establishes the traffic policing style for the class. The simple form of the policing style uses a single data rate and burst size, resulting in two outcomes: conform and nonconform. If you enable this feature, configure one of these fields: Cisco WAP131 and WAP351 Administration Guide...
Page 132
The CoS value is an integer from 0 to 7. The CoS remark only takes effect in the CoS/802.1p trust mode for NOTE the Ethernet ports of the Cisco WAP351. • Mark IP DSCP—Marks all packets for the associated traffic stream with the IP DSCP value that you select from the list.
Class Map page, including: • Member Class—The class map name. • Match All—Shows if this map matches all packets. • Rule Field—Shows the detailed definition of this class map. See Class Map for more information. Cisco WAP131 and WAP351 Administration Guide...
Page 134
Class Map Name—Lists the class maps that this policy map contains. • Policy—Shows the policy details of this class map. See Policy Map more information. You can click Refresh to refresh the screen and show the most current information. Cisco WAP131 and WAP351 Administration Guide...
There is an implicit deny at the end of every rule created. To avoid deny all, we NOTE strongly recommend that you add a permit rule within the ACL to allow traffic. Cisco WAP131 and WAP351 Administration Guide...
Choose IPv4 as the type of ACL from the ACL Type list. IPv4 ACLs control access STEP 3 to network resources based on Layer 3 and Layer 4 criteria. Click Add ACL. STEP 4 In the ACL Rule Configuration area, configure these ACL rule parameters: STEP 5 Cisco WAP131 and WAP351 Administration Guide...
Page 137
A wildcard mask of 255.255.255.255 indicates that no bit is important. A wildcard of 0.0.0.0 indicates that all bits are important. This field is required when Source IP Address is checked. Cisco WAP131 and WAP351 Administration Guide...
Page 138
0.0.0.0. To match the criteria to a 24-bit subnet (for example, 192.168.10.0/ 24), use a wildcard mask of 0.0.0.255. • Destination Port—Includes a destination port in the match condition for the rule. The destination port is identified in the datagram header. Cisco WAP131 and WAP351 Administration Guide...
Page 139
(that is, wildcard) mask. The zero-valued bits in the IP ToS Mask denote the bit positions in the IP ToS Bits value that are used for comparison against the IP ToS field of a packet. For example, to Cisco WAP131 and WAP351 Administration Guide...
WAP device. Traffic that does not meet the criteria is forwarded unless this rule is the final rule. Because there is an implicit deny all rule at the end of every ACL, traffic that is not explicitly permitted is dropped. Cisco WAP131 and WAP351 Administration Guide...
Page 141
IPv6 address. • Destination Port—Includes a destination port in the match condition for the rule. The destination port is identified in the datagram header. Select From List—If selected, choose the port name from the list. Cisco WAP131 and WAP351 Administration Guide...
Choose MAC as the type of ACL from the ACL Type list. MAC ACLs control STEP 3 access based on Layer 2 criteria. Click Add ACL. STEP 4 In the ACL Rule Configuration area, configure these ACL rule parameters: STEP 5 Cisco WAP131 and WAP351 Administration Guide...
Page 143
Source MAC Address—Enter the source MAC address to compare against an Ethernet frame. Source MAC Mask—Enter the source MAC address mask specifying which bits in the source MAC to compare against an Ethernet frame. Cisco WAP131 and WAP351 Administration Guide...
Select ACL > ACL Association. STEP 1 In the Interface field, click the radio or Ethernet interface on which you want to STEP 2 configure the ACL parameters. Configure these parameters for the selected interface: STEP 3 Cisco WAP131 and WAP351 Administration Guide...
STEP 4 An interface can be bound with either a DiffServ policy or an ACL, but not both. NOTE IPv6 type is not supported at the Ethernet ports of the Cisco WAP351. NOTE ACL Status The ACL Status page shows the details for different types of ACL rules.
Page 146
Match All—Shows whether or not the ACL rule matches all packets. • Rule Field—Shows the detailed settings for the ACL. See ACL Rule more information. You can click Refresh to refresh the screen and show the most current information. Cisco WAP131 and WAP351 Administration Guide...
The valid range is from 1025 to 65535. In the SNMPv2c Settings area, configure the SNMPv2c settings: STEP 4 • Read-only Community—Enter a read-only community name for SNMPv2 access. The valid range is 1 to 256 alphanumeric and special characters. Cisco WAP131 and WAP351 Administration Guide...
Page 148
Only machines with IP addresses in this range are permitted to execute get, and set requests on the managed device. Given the example above, the machines with addresses from 192.168.1.1 through 192.168.1.254 can execute SNMP commands on the device. (The address identified by suffix .0 Cisco WAP131 and WAP351 Administration Guide...
Page 149
After new settings are saved, the corresponding processes may be stopped and NOTE restarted. When this happens, the WAP device may lose connectivity. We recommend that you change the WAP device settings when a loss of connectivity will least affect your wireless clients. Cisco WAP131 and WAP351 Administration Guide...
A family mask is used to define a family of view subtrees. The family mask indicates which subidentifiers of the associated family OID string are significant to the family's definition. A family of view subtrees enables efficient control access to one row in a table. Cisco WAP131 and WAP351 Administration Guide...
To add and configure an SNMP group: Select SNMP > Groups. STEP 1 Click Add to create a new row in the SNMPv3 Groups table. STEP 2 Check the box for the new group and click Edit. STEP 3 Cisco WAP131 and WAP351 Administration Guide...
Page 152
Click Save. The group is added to the SNMPv3 Groups list and your changes are STEP 5 saved to the Startup Configuration. To remove a group, check the group in the list and click Delete. NOTE Cisco WAP131 and WAP351 Administration Guide...
Encryption Type—Choose the type of privacy to use on SNMP requests from the user, which can be one of these options: DES—Uses DES encryption on SNMPv3 requests from the user. None—SNMPv3 requests from this user require no privacy. Cisco WAP131 and WAP351 Administration Guide...
Users—Enter the name of the SNMP user to associate with the target. To configure SNMP users, see the Users page. Click Save. The user is added to the SNMPv3 Targets list and your changes are STEP 5 saved to the Startup Configuration. Cisco WAP131 and WAP351 Administration Guide...
Page 155
SNMP Targets To remove an SMMP target, select the user in the list and click Delete. NOTE Cisco WAP131 and WAP351 Administration Guide...
You can configure the CP verification to allow access for both guest and authenticated users. The Captive Portal feature is available only on the Cisco WAP351. The Cisco NOTE WAP131 does not support Captive Portal.
Up to two groups can be configured. The Default Group exists by default and cannot be deleted. • User Count—The number of CP users currently configured on the WAP device. Up to 128 users can be configured. Cisco WAP131 and WAP351 Administration Guide...
In the Local Groups Settings area, choose the group that you want to delete. STEP 2 Check the Delete Group option. STEP 3 Click Delete Group. The changes are saved to the Startup Configuration. STEP 4 Cisco WAP131 and WAP351 Administration Guide...
0. When it is set to 0, the timeout value configured for the CP instance is used. • Group Name—Choose the assigned user group. Each CP instance is configured to support a particular group of users. Cisco WAP131 and WAP351 Administration Guide...
To create a CP instance and configure its settings: Select Captive Portal > Instance Configuration. STEP 1 Choose Create from the Captive Port Instances list. STEP 2 Cisco WAP131 and WAP351 Administration Guide...
Page 161
If the time specified in this field expires before the client attempts to reauthenticate, the client entry is removed from the authenticated client list. The range is from 0 to 1440 minutes. The default value is 60 minutes. Cisco WAP131 and WAP351 Administration Guide...
Page 162
Server IP Address 1 or Server IPv6 Address 1—Enter the IPv4 or IPv6 address for the primary RADIUS server for this VAP. The IPv4 address should be in a form similar to xxx.xxx.xxx.xxx (192.0.2.10). The IPv6 address should be in a form similar to xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx (2001:DB8:CAD5:7D91). Cisco WAP131 and WAP351 Administration Guide...
Select Captive Portal > Instance Association. STEP 1 Choose the radio that you want to configure. STEP 2 Choose the instance name for each VAP to which you want to associate an STEP 3 instance. Cisco WAP131 and WAP351 Administration Guide...
The Captive Portal Web Locale Parameters area reappears the additional STEP 5 options for modifying the locale. The Locale ID and Instance Name fields cannot be edited. The editable fields are populated with default values. Configure these parameters: Cisco WAP131 and WAP351 Administration Guide...
Page 165
1 to 64 characters. • Button Label—The label on the button that users click to submit their user name and password for authentication. The range is from 2 to 32 characters. The default is Connect. Cisco WAP131 and WAP351 Administration Guide...
Page 166
The range is from 1 to 256 characters. • Delete Locale—Deletes the current locale. Click Save. Your changes are saved to the Startup Configuration. STEP 6 Click Preview to view the updated page. STEP 7 Cisco WAP131 and WAP351 Administration Guide...
STEP 4 Choose the Captive Portal Web Locale that you want to configure. STEP 5 For the Background Image Name, Logo Image Name, or Account Image fields, STEP 6 choose the newly uploaded image. Cisco WAP131 and WAP351 Administration Guide...
• VAP ID—The VAP that the user is associated with. • Radio ID—The radio ID. • Captive Portal ID—The ID of the Captive Portal instance to which the user is associated. Cisco WAP131 and WAP351 Administration Guide...
Page 169
• Failure Time—The time that the authentication failure occurred. A timestamp is included that shows the time of the failure. You can click Refresh to show the latest data from the WAP device. Cisco WAP131 and WAP351 Administration Guide...
• Channel Management • Wireless Neighborhood The Single Point Setup feature is available only on the Cisco WAP351. The Cisco NOTE WAP131 does not support the Single Point Setup feature. Single Point Setup Overview Single Point Setup provides a centralized method to administer and control the wireless services across multiple devices.
Plan your Single Point Setup cluster. Be sure that two or more WAP devices that STEP 1 you want to cluster are the same model. For example, the Cisco WAP351 devices can only cluster with other Cisco WAP351 devices. We strongly recommend that you run the latest firmware version on all clustered WAP devices.
That is, if WAP1 has more changes, but WAP2 has the most recent change, WAP1 is selected. If they have an equal number of changes, but WAP2 has the most recent change, then WAP2 is selected. Cisco WAP131 and WAP351 Administration Guide...
Client QoS User Accounts Email Alert HTTP/HTTPS Service (Except Radio Settings Including TSPEC Settings SSL Certificate Configuration) (Some exceptions) Log Settings Rogue AP Detection MAC Filtering Scheduler Management Access Control SNMP General and SNMPv3 Cisco WAP131 and WAP351 Administration Guide...
Page 174
DTIM Period Maximum Stations Transmit Power Other Configuration Settings and Parameters That are Not Propagated in Single Point Setup Bandwidth Utilization Port Settings Bonjour VLAN and IPv4 IPv6 Address WDS Bridge IPv6 Tunnel Packet Capture Cisco WAP131 and WAP351 Administration Guide...
The default is ciscosb-cluster. • Clustering IP Version—Choose the IP version that the WAP devices in the cluster use to communicate with other members of the cluster. The default is IPv4. Cisco WAP131 and WAP351 Administration Guide...
• IP Address—The IP address for the WAP device. The Single Point Setup status and the number of the WAP devices are shown NOTE graphically on the right side of the page. Cisco WAP131 and WAP351 Administration Guide...
All WAP devices in a Single Point Setup cluster reflect the same configuration (if the configurable items can be propagated). It does not matter which WAP device you connect to for administration—configuration changes on any WAP device in the cluster are propagated to the other members. Cisco WAP131 and WAP351 Administration Guide...
WAP device. A WLAN client association can shift from one clustered WAP device to another within the same session. To view the sessions associated with the cluster, select Single Point Setup > Sessions. Cisco WAP131 and WAP351 Administration Guide...
Page 179
To sort the information shown in the tables by a particular indicator, click the column label that you want to sort by. For example, if you want to see the table rows ordered by signal strength, click the Signal column label. Cisco WAP131 and WAP351 Administration Guide...
You can also use the advanced settings to modify the interference reduction potential that triggers the channel reassignment, change the schedule for automatic updates, and reconfigure the channel set used for assignments. To start automatic channel assignment, click Start. STEP 2 Cisco WAP131 and WAP351 Administration Guide...
Wireless Radio—The MAC address of the radio. • Band—The band on which the WAP device is broadcasting. • Channel—The radio channel on which the WAP device is currently broadcasting. • Locked—Forces the WAP device to remain on the current channel. Cisco WAP131 and WAP351 Administration Guide...
The default is 75 percent. Choose the percentages ranging from 5 percent to 75 percent. Using this setting lets you set a Cisco WAP131 and WAP351 Administration Guide...
• Detect faults. Unexpected changes in the coverage pattern are evident at a glance in the color coded table. Viewing Neighboring Devices To view the neighboring devices, select Single Point Setup > Wireless Neighborhood. Cisco WAP131 and WAP351 Administration Guide...
Page 184
Lighter Blue Bar—A lighter blue bar and a lower signal strength number (for example 20 or lower) indicates medium or weak signal strength from the neighbor, as seen by the device whose IP address is listed above that column Cisco WAP131 and WAP351 Administration Guide...
Signal—The strength of the radio signal detected from the access point, measured in decibels (dB). • Beacon Interval—The beacon interval used by the access point. • Beacon Age—The date and time of the last beacon received from the access point. Cisco WAP131 and WAP351 Administration Guide...
Where to Go From Here Cisco provides a wide range of resources to help you and your customer obtain the full benefits of the Cisco WAP131 and WAP351 Wireless-N Dual Radio Access Points. Cisco Support www.cisco.com/go/smallbizsupport Community Cisco Support and www.cisco.com/go/smallbizhelp...