SCALANCE WLC711 SIMATIC NET. Industrial Wireless LAN SCALANCE WLC711. Preface. Safety notes. Description. Getting started 3

Transcription

1 Preface Safety notes 1 SIMATIC NET Industrial Wireless LAN Getting Started Description 2 Getting started 3 Basic configuration with the wizard 4 Managing access points 5 Configuring specific use cases with the wizard 6 Optional configuration 7 11/2014 C79000-G8976-C269-06

2 Legal information Warning notice system This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are graded according to the degree of danger. DANGER indicates that death or severe personal injury will result if proper precautions are not taken. WARNING indicates that death or severe personal injury may result if proper precautions are not taken. CAUTION indicates that minor personal injury can result if proper precautions are not taken. NOTICE indicates that property damage can result if proper precautions are not taken. If more than one degree of danger is present, the warning notice representing the highest degree of danger will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property damage. Qualified Personnel The product/system described in this documentation may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with these products/systems. Proper use of Siemens products Note the following: Trademarks WARNING Siemens products may only be used for the applications described in the catalog and in the relevant technical documentation. If products and components from other manufacturers are used, these must be recommended or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance are required to ensure that the products operate safely and without any problems. The permissible ambient conditions must be complied with. The information in the relevant documentation must be observed. All names identified by are registered trademarks of Siemens AG. The remaining trademarks in this publication may be trademarks whose use by third parties for their own purposes could violate the rights of the owner. Disclaimer of Liability We have reviewed the contents of this publication to ensure consistency with the hardware and software described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this publication is reviewed regularly and any necessary corrections are included in subsequent editions. Siemens AG Division Process Industries and Drives Postfach NÜRNBERG GERMANY Order number: C79000-G8976-C P 11/2014 Subject to change Copyright Siemens AG All rights reserved

3 Preface Introduction By using the Industrial Wireless LAN controller along with controllerbased access points, it is possible to set up a single wireless infrastructure for the entire company. This achieves a high degree of flexibility since mobile subscribers (for example a laptop) move both in the office and in the automation network and can change over seamlessly between these networks (roaming). This means that data can be accessed from anywhere in the company over wireless. Thanks to the use of a centralized security mechanism for each user group, data is protected from unauthorized access and manipulation. The controller-based access points SCALANCE W78xC support the WLAN standards IEEE a/b/g ad n and are connected to the IWLAN controller SCALANCE WLC via gigabit Ethernet. The same applies to the access points SCALANCE W786C, with which a connection via fiber-optic is possible depending on the version. The controller-based access points SCALANCE W786-2HPW support the WLAN standards IEEE a/b/g and are connected to the IWLAN controller SCALANCE WLC via fast Ethernet or fiber-optic cable. One requirement for operation is always the use of the IWLAN controller SCALANCE WLC which makes the group configuration of access points possible. This allows a widespread IWLAN infrastructure to be represented clearly. The central management with the IWLAN controller also allows the recording of disruptions, monitoring and documentation of statistics. Who is this document intended for? The Getting Started is intended for system administrators who want to configure the wireless LAN controller SCALANCE Industrial Wireless LAN controller WLC711 and the access points with the Web Based Management (WBM) of the SCALANCE Industrial Wireless LAN controller and access points. Purpose of this document This document provides you with a general overview of the functions of the WBM SCALANCE Industrial Wireless LAN controller and access points. The Getting Started will quickly help you to learn about configuring the devices. We recommend that you read the Getting Started not selectively but rather from front to back. You will get to know the important components that can help you during configuration. Validity of this document This document is valid for the SCALANCE IWLAN Controller WLC711 and the controllerbased SCALANCE W78xC access points as of firmware version V 8.0. Getting Started, 11/2014, C79000-G8976-C

4 Preface SIMATIC NET glossary Explanations of the specialist terms used in this documentation can be found in the SIMATIC NET glossary. You will find the SIMATIC NET glossary here: SIMATIC NET Manual Collection The DVD ships with certain SIMATIC NET products. On the Internet under the following entry ID: ( Security messages Note Siemens offers IT security mechanisms for its automation and drive product portfolio in order to support the safe operation of the plant/machine. Our products are also continuously developed further with regard to IT security. We therefore recommend that you regularly check for updates of our products and that you only use the latest versions. You will find information in: Auto-Hotspot Here, you can register for a product-specific newsletter. For the safe operation of a plant/machine, however, it is also necessary to integrate the automation components into an overall IT security concept for the entire plant/machine, which corresponds to the state-of-the-art IT technology. You will find information on this in: ( Products from other manufacturers that are being used must also be taken into account. 4 Getting Started, 11/2014, C79000-G8976-C269-06

5 Table of contents Preface Safety notes Description General Requirement for configuration LED display Getting started Sequence Logon Shutting down and turning off Basic configuration with the wizard Managing access points Commissioning access points Registering access points Configuring access points Single configuration Multiple configuration Configuring specific use cases with the wizard Use case: Bridged at WLC Use case: Bridged at AP Optional configuration Expanding the number of manageable access points Access using the Command Line Interface (CLI) Data backup Using reports Using policies Authentication via RADIUS server User configuration Index Getting Started, 11/2014, C79000-G8976-C

6 Table of contents 6 Getting Started, 11/2014, C79000-G8976-C269-06

7 Safety notes 1 Note Note the information in the user guide and the compact operating instructions. Notes on secure network design To protect your network from attacks, note the following points: Use WPA2/ WPA2-PSK with AES To prevent misuse of a password, use only WPA2/AES. WPA2/ WPA2-PSK with AES provides the highest security. Protect your network against man-in-the-middle attacks To protect your network from man-in-the-middle attacks, a network topology is recommended, that makes it more difficult for an attacker to tap into the communications path between two end devices. You can, for example, protect WLAN devices by arranging so that the management port is accessible only via a separate management VLAN. You can also install a separate HTTPS certificate on a WLAN client / access point. The HTTPS certificate checks the identity of the device and controls the encrypted data exchange. You can install the HTTPS certificate via HTTP. Use SNMPv3 SNMPv3 provides you with highest possible security when accessing the WLAN devices via SNMP. Getting Started, 11/2014, C79000-G8976-C

8 Safety notes 8 Getting Started, 11/2014, C79000-G8976-C269-06

9 Description General Information Siemens Customer Support If you have questions or problems, contact Siemens Customer Support at the following address: DE: International: Related information can be found on the accompanying SIMATIC NET IWLAN CD: BAK W78xC BAK W786-2HPW SCALANCE W-700 configuration manual Which access points can be used? To achieve an optimum WLAN, the following SCALANCE wireless LAN access points are ideal: SCALANCE wireless LAN W78xC access points SCALANCE Wireless LAN access points W788C-2 RJ-45 SCALANCE Wireless LAN access points W788C-2 M12 SCALANCE Wireless LAN access points W788C-2 M12 EEC SCALANCE Wireless LAN access points W786-2HPW Note Detection of W788C-2 M12 EEC devices During detection of devices, the devices of the W788C-2 M12 EEC variant are shown as W788C-2 M12 Getting Started, 11/2014, C79000-G8976-C

10 Description 2.1 General How is data transferred? To transfer the data, the has the following RJ-45 Ethernet connectors: Management port: "admin" interface. The configuration data is transferred at this port at 10/100/1000 Mbps. Data port: "esa0" interface. At this port, the data is transferred at 10/100/1000 Mbps. You will find further information in the compact operating instructions. Where is the configuration data stored? Your configuration data is stored directly on the WLC. It is, however, possible to store this data as a backup and to transfer it to other WLCs. How to create backups is explained in the User Guide. What can the WBM do? All access points connected to a WLC are centrally monitored and managed to achieve better administrative control. When necessary, each AP can be configured, enabled or disabled separately. APs can be managed using the WLC. Alarms, traps and reporting statistics are generated and can be evaluated by the network manager. The APs also send data about performance, security and use to the WLC that can then be put together in detailed reports. With the WBM, you have the following options: Central configuration, administration and monitoring of several access points by the SCALANCE Industrial Wireless LAN controller. Configuration of filter functions. Making the settings: Bridge traffic locally at WLC. The data coming from the access points is forwarded centrally via the WLC. Bridge traffic locally at AP: The data coming from the access points us forwarded directly by the access points to the wired network. 10 Getting Started, 11/2014, C79000-G8976-C269-06

11 Description 2.2 Requirement for configuration 2.2 Requirement for configuration To be able to configure the SCALANCE Industrial Wireless LAN controller and the access points with the WBM, the following conditions must be met: Correct connection of the hardware. A correct connection between the management port of the and a PC. You will find information about setting up in the compact operating instructions SCALANCE WLC LED display Introduction This section contains information explaining how the LED displays work. This means you can make sure that the wireless LAN controller has started up completely. LED display Status displays LED Meaning LED Description PWR Power supply OFF GREEN Standby mode Supply voltage is applied. L L2 Battery display flashing RED Battery low (remaining life less than 1 month). Battery empty. RED L3 RUN/STOP Flashing YELLOW flashing GREEN System is starting up. System running. The L2 and L3 LEDs each flash at 1 second intervals. If the L2 and L3 LEDs flash yellow together at an interval of 2 seconds, an upgrade or the import of a configuration following an upgrade is being performed. Getting Started, 11/2014, C79000-G8976-C

12 Description 2.3 LED display 12 Getting Started, 11/2014, C79000-G8976-C269-06

13 Getting started Sequence Below you will find an overview of the best way to configure access points. Step 1 - Prior to configuration Decide which WLAN service you want to use. The following are available: Data This WLAN service is recommended if your WLAN is used mainly for normal data traffic, for example intranet. This WLAN service can be suitable for PROFINET IO if WLAN clients move within the range of one access point (no roaming of WLAN clients between several access points). Possible topologies for the WLAN service are as follows: Bridge at AP (requirement for PNIO) Bridge at WLC Routed Note PNIO For complex plants requiring PROFINET IO communication, stand-alone access points with ipcf support are recommended. Voice This WLAN service is recommended if your WLAN is used mainly for voice and video communication, for example VoIP. Possible topologies for this WLAN type are as follows: Bridged at WLC Routed Captive portal With this WLAN service, you can set up a WLAN specifically for guests. Step 2 - Setting up the network Make sure that the external servers such as DHCP and RADIUS are available and adequately configured. Make sure that the data port between the Industrial Ethernet switch (IE Switch) and WLC and the IE switch and APs have the identical subnet configuration. Getting Started, 11/2014, C79000-G8976-C

14 Getting started 3.1 Sequence Step 3 - Installing hardware Install the SCALANCE Industrial Wireless LAN controller and the access points. You will find further information in the compact operating instructions. 14 Getting Started, 11/2014, C79000-G8976-C269-06

15 Getting started 3.2 Logon 3.2 Logon Prerequisite To log on with the WBM, a connection must exist between the management port ("admin" interface) of the WLC and the configuration PC. Calling up the logon page To call up the logon page, open a Web browser and enter the default IP address in the address line. Note Display of a security message If a security message is displayed in the Web browser, confirm this to continue the download of the Web page. The security message results from the pre-installed, self-signed certificate. It is possible to install your own certificate. You will find more detailed information in the user guide. This default IP address can be changed using the WBM. The logon page of the WBM SCALANCE Industrial Wireless LAN controller and access points opens: Figure 3-1 Logon page Getting Started, 11/2014, C79000-G8976-C

16 Getting started 3.2 Logon Initial logon Default user data is set in the factory. When you log on the first time, follow the steps below: 1. Enter the user name admin in the "User Name" input box. 2. Enter the password abc123 in the "Password" input box. 3. Click the "Login" button. The page for basic configuration with the wizard opens. When you have completed the basic configuration the start page of the WBM SCALANCE Industrial Wireless LAN controller and access points is displayed immediately after a new logon. Access protection of the system - changing passwords We recommend that you protect the system from unauthorized access. To do this, change the factory-set default administrator password. The procedure is described during basic configuration with the wizard. Entering the wrong user name or password If you enter an unconfigured user name or an incorrect password, an error message is displayed. 16 Getting Started, 11/2014, C79000-G8976-C269-06

17 Getting started 3.3 Shutting down and turning off 3.3 Shutting down and turning off Introduction To avoid loss of data, it is advisable to shut down and turn off the using the operator interfaces. Note Data loss Remember that data on the hard disk can be lost if you do not shut down the SCALANCE WLC711 correctly. Make sure that you use the procedure in this section. "System Maintenance" configuration page To open the configuration page, select the "Wireless Controller > Administration > System Maintenance" menu command. The following window opens: Figure 3-2 "System Maintenance" configuration page Getting Started, 11/2014, C79000-G8976-C

18 Getting started 3.3 Shutting down and turning off Procedure To turn off the correctly, follow the steps below: 1. Select from the following options in the "System Shutdown" section: Halt system: reboot The system is shut down and restarted. Halt system: shutdown power The system is shut down safely. All services and applications are stopped. 2. To shut down the system with the APs that belong to it and that are connected to it, click the "Shutdown" button. A warning appears. To confirm the action, click the "Yes to continue" button. As an alternative, you can also shut down the WLC with CLI commands. You will find further information in the manual CLI Reference Guide. 18 Getting Started, 11/2014, C79000-G8976-C269-06

19 Basic configuration with the wizard 4 Introduction After you log on the first time, the WBM provides you with a wizard for the basic configuration of the WLC. You can call up the wizard at any time using the "Wireless Controller > Installation Wizard" menu command. Note Reconfiguration of the network topology with the wizard is not possible. You cannot reconfigure the network topology with the wizard, but only configure following a system reset. You can only modify the network topology later using the "Wireless Controller > Topologies" menu command. Getting Started, 11/2014, C79000-G8976-C

20 Basic configuration with the wizard Example The following graphic shows you a typical WLC-based configuration of a WLAN: Figure 4-1 Example: Typical WLC-based configuration of a WLAN 20 Getting Started, 11/2014, C79000-G8976-C269-06

21 Basic configuration with the wizard "Basic Installation Wizard" configuration page When you log on for the first time, the following window opens: Figure 4-2 "Basic Installation Wizard" configuration page To use the basic installation with the wizard correctly, follow the steps below: Time Settings In this section, you configure the time zone of the WLC. From the drop-down lists, select the continent or ocean, the country and the region of the time zone in which the WLC is located. Getting Started, 11/2014, C79000-G8976-C

22 Basic configuration with the wizard Meaning of the "Time Zone Region" options: Set time With this option, you set the year, the month, the day, the minutes and the seconds manually using drop-down lists. Run local NTP Server If you select this option, the WLC functions as an NTP server and provides other devices with the opportunity of synchronizing their time with the time of the WLC. Use NTP If you select this option, an external NTP server is used for time-of-day synchronization. In this input box, enter the IP address of an NTP time server that has a connection to the network. Topology Configuration In this section, you configure the physical interface of the WLC that is assigned as data port. Enter the required values in the input boxes: Topology Using the assigned logical names, topologies are linked to a VNS (Virtual Network Service). The wizard proposes the predefined name "Physical 1". On completion of the basic configuration, you can change the name using the "Wireless Controller > Topologies" menu command. A VNS is the logical linking of all components required to operate a WLAN. This includes: WLAN service Policy Class of Service Topology VLAN ID Using the VLAN ID, you assign a broadcast domain to the WLC data port. In this area, the VLAN ID is configured for the WLC. Make sure that the data port of the WLC, the access points and the connecting network are assigned to the same broadcast domain. Use the following range for the VLAN ID: 1 to Enter the required VLAN ID you want to use in the "VLAN ID" input box. Note VLAN ID 1 is the default internal VLAN ID of the WLC and can therefore only be used after configuration. You will find further information in the user guide, section "Setting Up Internal VLAN ID and Multicast Support". 22 Getting Started, 11/2014, C79000-G8976-C269-06

23 Basic configuration with the wizard Select the required option from the drop-down list: Tagged If you want to forward tagged packets, select this option. Make sure that your devices are capable of reading tagged packets. Untagged If you want to forward untagged packets, select this option. This is the default selection. "Port" drop-down list From the drop-down list, select the data port "esa0" of the WLC. IP Address Enter the IP address of the data port "esa0" of the WLC. Use the IP address range of your IP subnet. If you require information about obtaining a temporary IP address, click on the link "How to obtain a temporary IP address". Netmask Enter the netmask of the data port "esa0" of the WLC. To move to the next page of the wizard, click the "Next" button. Getting Started, 11/2014, C79000-G8976-C

24 Basic configuration with the wizard "Management" configuration page Figure 4-3 "Management" configuration page Management port In this section, you configure the management port of the WLC via which the configuration data is transferred. If necessary, adapt the factory setting to your network environment: IP Address Shows the IP address of the management port of the WLC. Netmask To separate the range of the network from the range of the hosts, the corresponding subnet mask of the IP address is displayed. Enter the netmask of the data port "esa0" of the WLC. 24 Getting Started, 11/2014, C79000-G8976-C269-06

25 Basic configuration with the wizard Gateway Shows the standard gateway of the network. Note Check that the contents are correct Check that your entries are correct before saving the settings. If there are errors in the configuration, it will not be possible to establish the connection to the SCALANCE Industrial Wireless LAN access point. SNMP In this section, the monitoring, control and error detection of the network components is set using the "Simple Network Management Protocol". SNMP is a network protocol with which network components can be monitored and controlled from a central station. The following settings are available: "Mode" drop-down list Select from the following options: OFF If you select this option, you disable SNMP. V2c If you select this option, you allow SNMP version 2. The following input boxes appear for SNMP communication: V3 Read Community Enter the password to be used for the read mode of SNMP communication. Write Community Here, enter the password to be used for the write mode of SNMP communication. Trap Destination Enter the IP address of the server you are using that will receive the SNMP messages as network manager. If you select this option, you allow SNMP version 3. Following the basic installation, you can create users and configure them manually with the " Wireless Controller > SNMP" menu command. Note In this version, some SNMP objects only have read permissions. Getting Started, 11/2014, C79000-G8976-C

26 Basic configuration with the wizard Syslog server The syslog server is configured in this section. Syslog is a protocol used for the transfer of event notification messages via networks. To use the syslog protocol for the WLC, select the "Enable" check box. The "IP Address" input box appears in which you enter the IP address of the syslog server. OSPF In this section, you enable the "Open Shortest Path First" protocol. OSPF is a dynamic routing protocol for medium sized to large IP networks. This protocol allows data streams to be split up over various routes. If you select OSPF, the WLC uses "Dynamic Route Selection". This means that subnets are set up. Select the "Enable" check box. The following options appear: Port Click on the topology name of the WLC you want to configure. Area ID Define the area of OSPF. If necessary, adapt the factory setting to your network environment. To move to the next page of the wizard, click the "Next" button. 26 Getting Started, 11/2014, C79000-G8976-C269-06

27 Basic configuration with the wizard "Services" configuration page Figure 4-4 "Services" configuration page RADIUS In this section, you enable the "Remote Authentication Dial In User Service" protocol (RADIUS). The authentication and authorization is managed by a RADIUS server that is configured in this section. Select the "Enable" option. The following input boxes appear: Server Alias Name the RADIUS server by entering the name. IP Address Enter the IP address of the RADIUS server. Shared Secret Enter the password required for the connection between the WLC and the RADIUS server. Getting Started, 11/2014, C79000-G8976-C

28 Basic configuration with the wizard Mobility In this section, you enable the "Mobility" feature. This feature allows WLAN devices, for example a laptop, to roam between different WLCs seamlessly within different wireless APs. Select the "Enable" check box. A message will inform you that the Network Time Protocol (NTP) is necessary for mobility. You will be prompted to allow NTP. The dialog for further configuration opens. Note To allow WLCs to communicate with each other, at least one mobility manager is required. The other WLCs act as mobility agents. If the WLC is configured as a mobility agent, it acts as an NTP client and uses the mobility manager as the NTP server. If the WLC is configured as the mobility manager, the "Run local NTP server" option must be enabled so that the mobility agents can use the local NTP server of the mobility manager. "Role" radio button Select the role of mobility manager or mobility agent for the WLC. Select one WLC as mobility manager in the network and all others as mobility agents. "Port" drop-down list Select the interface of the WLC that will be used for communication between the mobility manager and mobility agent. Make sure that the selected interface in the network is capable of routing. "Manager IP" input box If the WLC was configured as a mobility agent, enter the IP address of the mobility manager in the input box. Default VNS A virtual network service is the logical linking of all attributes necessary for a WLAN. In this section, you enable the standard VNS parameters that can then be configured later with the "VNS Configuration" menu command. Meaning of the default values: Type: Bridged at AP Communication is direct via the AP and not via the WLC. WPA-PSK Key: MobilityMadeEasy The password of the WPA-PSK is "MobilityMadeEasy". To increase the security of the VNS, we recommend that you change this default password. Name: Wireless The name of the VNS is "Wireless" SSID: Wireless The name of the Service Set Identifier of the VNS is "Wireless". 28 Getting Started, 11/2014, C79000-G8976-C269-06

29 Basic configuration with the wizard To complete the installation, click the "Finish" button. A warning message is displayed because you want to change settings of the management port. To confirm the changes, click the "OK" button. Figure 4-5 Warning: Management port "Success" configuration page (wizard completed successfully) Figure 4-6 "Success" configuration page (wizard completed successfully) Getting Started, 11/2014, C79000-G8976-C

30 Basic configuration with the wizard You have configured the WLC and it can be used. If you do not want to make any other changes, click the "Close" button. Note Changing the password We recommend that you change the password. For optimum security, a password should have following features: A length of 8 to 24 characters Different characters. You can use special characters except for ` ' " \ :. Numbers and upper and lower case characters. Do not use sequences of characters, for example "12" or "ab". Enter the new password in the "New Password" input box. Confirm the new password by entering it again in the "Confirm Password" input box. To store your new password, click the "Save" button. To close the page, click the "Close" button. You have now completed the wizard successfully. Once you have completed the basic configuration, you will be logged off because the WBM loads the new settings. If the time zone was changed, the WLC is automatically restarted. Log on again with the WBM with the updated settings. 30 Getting Started, 11/2014, C79000-G8976-C269-06

31 Managing access points Commissioning access points Prerequisite To establish a connection between a SCALANCE Industrial Wireless LAN controller and an access point, the access point must be connected to the IE network. Procedure On the "Topology" configuration page, set the network topology of the SCALANCE Industrial Wireless LAN controller. If you configure and save these settings, a connection can be established between the SCALANCE Industrial Wireless LAN controller and the access point. To open the configuration page, select the "VNS Configuration > Topologies" menu command. From the "Topologies" list on the left, select the predefined type "physical 1". The "Topology" window opens: Getting Started, 11/2014, C79000-G8976-C

32 Managing access points 5.1 Commissioning access points Figure 5-1 Configuration of the network topology Example: Configuration of the network topology "physical 1" "Physical 1" is a topology based on the data port of the SCALANCE Industrial Wireless LAN controller. It is responsible for the layer 2 and layer 3 properties. In the "General" tab, you will see the sections "Core", "Layer 2" and "Layer 3" and these are explained below. Core In this section, you configure the basic properties of the topology. "Name" input box Here, enter the logical name of the topology. "Mode" drop-down list Select "Physical" from the "Mode" drop-down list. "3rd Party" check box If you want to connect access points that are not intended for operation with the WLC, enable this check box. You will find information about configuring these access points in the User Guide. 32 Getting Started, 11/2014, C79000-G8976-C269-06

33 Managing access points 5.1 Commissioning access points Layer 2 In this section, the settings you made with the wizard in the basic configuration are displayed. "VLAN ID" input box The VLAN ID is required for the communication between the WLC and the access points throughout the connecting network. In this area, the VLAN ID is configured for the WLC. Make sure that the WLC, the access points and the connecting network are assigned to the same broadcast domain. Use the following range for the VLAN ID: 2 to Enter the required VLAN ID you want to use in the "VLAN ID" input box. Radio buttons Select the required option with the radio buttons: Tagged If you want to forward tagged packets, select this option. Make sure that your devices are capable of reading tagged packets. Untagged If you want to forward untagged packets, select this option. This selection is made as default. "Port" drop-down list From the drop-down list, select the data port "esa0" of the SCALANCE Industrial Wireless LAN controller. Layer 3 - IPv4 In this section, you configure the IP settings of the topology. "Interface IP" input box Here, you define the IP address of the topology. "Mask" input box Enter the IP address in the net mask. Getting Started, 11/2014, C79000-G8976-C

34 Managing access points 5.1 Commissioning access points "DHCP" drop-down list DHCP (Dynamic Host Configuration Protocol) is a method for automatic assignment of IP addresses. It has the following properties: DHCP can be used both when starting up a device and during ongoing operation. The assigned IP address remains valid only for a particular time known as the "lease time". Once this period has elapsed, the client must either request a new IP address or extend the lease time of the existing IP address. There is normally no fixed address assignment; in other words, when a client requests an IP address again, it can receive a different address from the previous address. From the "DHCP" drop-down list, select the following options for the DHCP settings of the access points: Local server If you select this option, the "esa0" topology becomes the DHCP server. To configure the DHCP server, click the "Configure" button. The following dialog box opens: Figure 5-2 Configuring the DHCP server dialog box The default values already entered can be retained. Enter the IP address of the router in the "Gateway" input box. No other boxes need to be configured. If you nevertheless want to configure these boxes, you will find further information in the SCALANCE WLC711 User guide. Save your configuration. None If a DHCP server is already in your network, select this option. "MTU" display box The Maximum Transmission Unit (MTU) defines the maximum transmission unit or maximum packet size of a protocol for this topology. The fixed value is 1500 bytes for physical topologies and is not changed. 34 Getting Started, 11/2014, C79000-G8976-C269-06

35 Managing access points 5.1 Commissioning access points "AP Registration" radio button Enable the check box so that the AP can register with the SCALANCE Industrial Wireless LAN controller. "Management Traffic" radio button Select the check box so that you can configure the WLC via the data port (management). To store your settings, click the "Save" button. The access point can now connect to the SCALANCE Industrial Wireless LAN controller. Buttons To configure new topologies, the following buttons are available: New With this button, you create a new topology. Delete With this button, you delete the selected topology. Select the topology and then click the "Delete" button. Result If you have completed everything correctly, the access points log on automatically and are shown in the wireless list available with the "Wireless APs" menu command. From this point onwards, the APs can be configured singly or in groups. Getting Started, 11/2014, C79000-G8976-C

36 Managing access points 5.2 Registering access points 5.2 Registering access points "AP Registration" configuration page This section explains how to register access points with the WLC. You configure the security properties and the type of registration of the APs. You can register access points in two different ways: Manual Before you connect the AP, first enter the serial number of the AP in the WBM. When the AP is later connected to the network, this is registered immediately. How to register the AP manually is explained in the SCALANCE User Guide in the section "Adding and Registering a Wireless AP Manually". Automatic How to register APs automatically is explained in detail on the following pages. Procedure To open the "AP Registration" configuration page, select the "Wireless APs > Global Settings > AP Registration" menu command. The following window opens: Figure 5-3 Wireless APs - AP Registration 36 Getting Started, 11/2014, C79000-G8976-C269-06

37 Managing access points 5.2 Registering access points Security Mode To configure the security mode for the WLC, enable one of the available radio buttons according to your requirements: Allow all Wireless APs to connect If the serial number of the AP is not known to the WLC, a new registration entry is created automatically. The AP receives a default configuration. If the WLC knows the serial number of the AP, the WLC authenticates the AP based on the existing registration entry and sends the existing configuration to the AP. Note Security Mode It is advisable to enable the option "Allow all Wireless APs to connect" during the initial configuration of the network. This gives you the option of registering several APs at the same time and improving efficiency. When you have completed the initial configuration of the network, it is advisable to enable the option "Allow only approved Wireless APs to connect". This means that third-party devices cannot log on. You will find further information in the "SCALANCE WLC711" User Guide. Allow only approved Wireless APs to connect If the serial number of the AP is not known to the WLC, a new registration entry is created automatically and given the status "Pending". To allow the AP to receive status changes, the WLC sends a minimum configuration to the AP. This minimum configuration allows an existing connection to remain established. APs with the "Pending" status cannot be configured and do not receive a default configuration until they are given the "Approved" status. If the WLC recognizes the serial number of the AP, it authenticates the AP based on the existing registration entry and sends the existing configuration to the AP. Note Access points can then only log on successfully with a WLC if this has enough free licenses available. Remember that APs themselves take up licenses when they are in the "Pending" status. Discovery Timers The parameters are set: Number of retries In the input box, enter the number of possible logon retries of the AP with the WLC. Delay between retries In the input box, enter the delay between the logon retries in seconds. If the AP does not reach the WLC, the AP attempts to register with the next WLC. Getting Started, 11/2014, C79000-G8976-C

38 Managing access points 5.2 Registering access points Telnet Access Telnet is a network protocol with which you can establish unencrypted network connections to the Command Line Interface of the WLC. You require a password for this. Enter the password for access to Telnet in the "Password" input box. Confirm the password by entering it in the "Confirm password" input box. Note Unencrypted password Note that the password via Telnet access is not encrypted. To establish an encrypted network connection to the Command Line Interface of the WLC, use SSH. SSH Access SSH means "Secure Shell" and it is a network protocol with which encrypted network connections can be established. You require a password for this. Enter the password for access to SSH in the "Password" input box. Confirm the password by entering it again in the "Confirm password" input box. Secure Cluster The default values already entered can be retained. You will find further information in the User Guide in the section "Configuring an AP Cluster". Buttons The buttons have the following meanings: View SLP Registration The "Service Location Protocol" (SLP) is a protocol with which APs register with the WLC. To obtain a view of the SLP registration process, click the button. A new window appears in which the events of the registration process, for example of the IP addresses of the WLC are shown. Save To save your settings, click this button. "AP Default Settings" configuration page The section explains how to change the default settings. When they register for the first time, the access points receive default settings that you can change. It is also possible to specify the configuration of existing APs as a default configuration. How to change these default values is explained in the "Common Configuration" and "W78xC" tabs. The other tabs are identical to the "W78xC" tab. 38 Getting Started, 11/2014, C79000-G8976-C269-06

39 Managing access points 5.2 Registering access points To go to the "AP Default Settings" configuration page, select the "Wireless AP > Bulk Configuration > AP Default Settings" menu command. "Save Settings" button To store your current settings, click the "Save Settings" button. Common Configuration In this area, you set the use of the WLAN. From the "Bulk Configuration > AP Default Settings" configuration page, select the "Common Configuration" tab. The following window opens: Figure 5-4 AP Default Settings - Common Configuration Where necessary, adapt the setting to your requirements: Getting Started, 11/2014, C79000-G8976-C

40 Managing access points 5.2 Registering access points Static Configuration The following options can be selected: So that each AP accesses the ranking list "WLC Search List", deselect the "Learn WLC Search List from AP" check box. For further information about how to add WLCs to the ranking list and to sort the list, refer to section"single configuration (Page 42)". If the AP should not access the ranking list "WLC Search List", select the "Learn WLC Search List from AP" check box. This means that the AP uses and maintains its individual ranking list. If the ranking list "WLC Search List " has no entries, the AP uses the "SLP unicast/multicast" functions or "DHCP" to find a WLC. Note If the ranking list contains incorrect values, for example a non-existent IP address, the AP will not find any WLCs. WLAN Assignment In this area, you have the option of assigning Radio 1 and/or Radio 2 (wireless interface) for each VNS in the list under "WLAN Name". Enable or disable the "Radio 1" and/or "Radio 2" check box. W78xC On this configuration page, you set the default values, for example the parameters of the individual WLAN networks. From the "Bulk Configuration > AP Default Settings" configuration page, select the "W78xC" tab. The following window opens: 40 Getting Started, 11/2014, C79000-G8976-C269-06

41 Managing access points 5.2 Registering access points Figure 5-5 Wireless APs > Bulk Configuration - AP Default Settings Where necessary, adapt the setting to your requirements. AP Properties Select your requirements from the drop-down lists: LLDP With the "Link Layer Discovery Protocol", you can exchange device information, for example the IP address between neighboring devices. Enable or disable the transfer of LLDP information. Country Select the country where the AP is being operated. Radio Settings Select the options for Radio 1 or Radio 2. You will find information about setting the Radio in the section "Single configuration (Page 42)": Getting Started, 11/2014, C79000-G8976-C

42 Managing access points 5.3 Configuring access points 5.3 Configuring access points Single configuration "All APs" configuration page To open the "All APs" configuration page, select the "Wireless APs > APs > All" menu command. With this page, you configure the access points individually. Note that a configuration type can be used on more than one AP. For more detailed information, refer to section "Multiple configuration (Page 55)". Buttons Note the following buttons on this configuration page: Copy to Defaults To save the configuration of the AP type as a default value in the WBM, click the "Copy to Default" button. Reset to Defaults To replace the current settings of the AP type with the default values, click the "Reset to Default" button. Add Wireless AP To register an AP manually, click the "Add Wireless AP" button. Save To store your settings, click the "Save" button. 42 Getting Started, 11/2014, C79000-G8976-C269-06

43 Managing access points 5.3 Configuring access points AP Properties On the "APs > All" configuration page, select the "AP Properties" tab. The following window opens: Figure 5-6 Wireless APs > APs > All > AP Properties From the middle list, select the access point you want to configure. In the "AP Properties" tab, you can then view the settings of this AP and configure some of them. Where necessary, adapt the setting to your requirements. "Serial #" display box Displays the unique identification number of the access point. You will also find the identification number printed on the access point. "Host Name" display box This value is based on the AP type and the serial number and is used for assignment for the DHCP server. "Name" input box Enter a unique name for the AP that differs from other APs. The default value is the serial number of the AP. Getting Started, 11/2014, C79000-G8976-C

44 Managing access points 5.3 Configuring access points "Location" input box Enter the location of the AP. "Description" input box If required, enter a comment that describes the AP. "Topology" display box Shows the port of the topology of the AP selected during basic configuration. "AP Environment" drop-down list From the drop-down list, specify whether the AP is in the building (indoor) or outside (outdoor). Note Note that the maximum transmit power (Max Tx Power) depends on the selection (indoor/outdoor) and that this can be restricted by this. Select the correct environment. "Hardware Version" display box Shows the current hardware version of the AP. "Application Version" display box Shows the current software version of the AP. "Status" display Approved Shows that the AP is allowed to establish a connection to the WLC. You will find further information in the user guide. Pending The AP has not yet been recognized manually on the WLC and is not therefore allowed to establish a connection to the WLC. "Active Clients" display Shows how many end devices are currently connected to the AP. "Country" drop-down list From the drop-down list, select the country where the AP is being operated. If you change the country, the AP is automatically restarted. Note Remember that the maximum transmit power (Max Tx Power) depends on the country selected and that it can be restricted by this. Select the correct country. 44 Getting Started, 11/2014, C79000-G8976-C269-06

45 Managing access points 5.3 Configuring access points Drop-down lists of the antenna types Select the type for each antenna from the drop-down list. If you select "No Antenna", the AP does not send any wireless signals. Note that this drop-down list is only available for APs with external antenna connectors. WLAN Assignment On the "APs > All" configuration page, select the "WLAN Assignment" tab. The following window opens: Figure 5-7 Wireless APs > APs > All > WLAN Assignment From the middle list, select the access point you want to configure. In the "WLAN Assignment" tab, you can establish an assignment between WLAN services and the WLAN interfaces of the AP. Normally, Radio 1 corresponds to the IEEE standards a/n and Radio 2 corresponds to the IEEE standards b/g/n. One exception to this is the SCALANCE access point W786-2HPW. Where necessary, adapt the setting to your requirements. "WLAN Name" column This column displays the configured WLAN services. Using the "VNS Configuration > WLAN Services" menu command, you can configure WLAN services. Getting Started, 11/2014, C79000-G8976-C

46 Managing access points 5.3 Configuring access points "Radio 1" column Select Radio 1 if you want to use the 5 GHz frequency band for this WLAN service. "Radio 2" column Select Radio 2 if you want to use the 2.4 GHz frequency band for this WLAN service. Note Selecting the IEEE standard If you are not sure which WLAN standard your end devices (WLAN clients) support, select both wireless frequencies. Note that up to eight WLAN services can be configured per radio. Note that the access point W786-2HPW can handle both wireless frequencies on each WLAN Interface and therefore requires prior configuration. You will find further information in the "" User Guide. Radio 1 On the "APs > All" configuration page, select the "Radio 1" tab. The following window opens: Figure 5-8 Wireless APs > APs > All > Radio 1 settings 46 Getting Started, 11/2014, C79000-G8976-C269-06

47 Managing access points 5.3 Configuring access points From the middle list, select the access point you want to configure. Make the interfacespecific settings in the "Radio 1" tab. Where necessary, adapt the settings to your requirements. Base Settings "BSS Info" display box BSS stands for "Basic Service Set". After configuring the WLAN services, the BSS displays the MAC address of the AP for each WLAN. It also indicates which SSID of the WLAN was assigned to which radio. "Admin Mode" drop-down list Select the following from the drop-down list: On Off To enable the radio, select "On". To disable the radio, select "Off". "Radio Mode" drop-down list From the drop-down list, select the following IEEE standard: a a/n To enable this IEEE standard, select "a". "a/n" is a compatibility mode that automatically detects whether the IEEE standard "a" or "n" is involved. To enable the compatibility mode "a/n", select "a/n" (recommended). n-strict To enable this standard, select "n-strict". If clients do not support this standard, no connection can be established to the WLAN. "Channel Width" drop-down list With IEEE standard n, data can be transferred via two directly neighboring channels. The two 20 MHz channels are put together to form one channel with 40 MHz. This allows the channel bandwidth to be doubled and the data throughput to be increased. If the radio modes "n-strict" or "a/n" were selected, you can set the bandwidth. Getting Started, 11/2014, C79000-G8976-C

48 Managing access points 5.3 Configuring access points Select the following from the drop-down list: 20MHz (downwards compatible with legacy modes IEEE standard a/h) To disable channel bonding, select "20 MHz": 40MHz To enable channel bonding, select "40 MHz": If the main channel allows both types of bonding (up and down), you can select the channel bonding type from the "Channel Bonding" drop-down list. If the main channel only allows one bonding type (up or down), the type is displayed in the "Channel Bonding" drop-down list. Auto To enable or disable channel bonding automatically, select "Auto". The bandwidth then changes automatically between 20 MHz and 40 MHz depending on the load of the expansion channel. If the expansion channel is under too much load and exceeds a defined value of the 40 MHz range, channel bonding is automatically disabled. Basic Radio Settings "RF Domain" input box To identify a group of APs, an RF domain can be configured as an option. Write a character string that uniquely identifies a group of APs. The maximum length of this character string must not exceed 16 characters. "Current Channel" display box Shows which channel the AP is on. "Last Requested Channel" display box Depending on the setting, this display depends on the "Request New Channel" function and shows the last requested channel. "Request New Channel" drop-down list From the drop-down list, select the channel to be used for communication between the AP and end device. "Channel Bonding" drop-down list Channel bonding bonds the primary channel (20 MHz) with an expansion channel. With "Up", the expansion channel is positioned 20 MHz above and with "Down" 20 MHz below the primary channel. Remember that the available selection for channel bonding depends on the "Request New Channel" selection. 48 Getting Started, 11/2014, C79000-G8976-C269-06

49 Managing access points 5.3 Configuring access points "Guard Interval" drop-down list The guard interval specifies how much time should elapse between sending two symbols. If a 40 MHz channel was selected, select the following properties: Long Select this option if 800 ns should elapse between sending two symbols. Short Select this option if 400 ns should elapse between sending two symbols. This option is suitable only for clients that support the IEEE standard n. "Auto Tx Power Ctrl (ATPC)" check box If you enable this check box, the AP automatically regulates its transmit power between Max Tx Power and Min Tx Power. "Current Tx Power Level" display box Shows the current transmit power. "Max Tx Power" drop-down list This setting depends on the selected country. Select the suitable maximum transmit power. "Min Tx Power" drop-down list Select the suitable minimum transmit power. "Auto Tx Power Ctrl Adjust" drop-down list This drop-down list is only visible after enabling the "Auto Tx Power Ctrl (ATPC)" function. Using this drop-down list, you can define a static value that is always added or subtracted automatically to/from the negotiated transmit power. "Channel Plan" drop-down list If automatic channel selection (ACS) is enabled, you can define a channel plan for the AP. This means that you have the option of selecting channels to be available during an ACS query. For example, due to radar interference you can only use certain channels. All Channels If you select "All Channels", all available channels (DFS and non-dfs) are available. Custom If you select "Custom", the "Configure" button is displayed. This gives you the opportunity of selecting channels manually. All Non-DFS Channels If you select "All Non-DFS Channels", you can use channels between 36 and 48. Getting Started, 11/2014, C79000-G8976-C

50 Managing access points 5.3 Configuring access points "View" button Shows all available channels if the "All Channels" or "All Non-DFS Channels" selection is enabled. Note Country-specific Note that the number of channels depends on the selected country. 50 Getting Started, 11/2014, C79000-G8976-C269-06

51 Managing access points 5.3 Configuring access points "Antenna Selection" drop-down list Each W78xC access point has six antennas No. Antenna connector Designation WBM 1 R1 A1 Radio 1 antenna 1 - left 2 R1 A2 Radio 1 antenna 2 - middle 3 R1 A3 Radio 1 antenna 3 - right 4 R2 A3 Radio 2 antenna 3 - right 5 R2 A2 Radio 2 antenna 2 - middle 6 R2 A1 Radio 2 antenna 1 - left Figure 5-9 Antenna connectors With the IEEE standard n, MIMO APs can transfer and evaluate different signals (spatial streams) on the same channel. If several antennas are used, it is possible to distinguish the different signals spatially. Getting Started, 11/2014, C79000-G8976-C

52 Managing access points 5.3 Configuring access points From the drop-down list, select the antenna combination you want to configure for wireless network Radio 1. Radio 2 On the "APs > All" configuration page, select the "Radio 2" tab. The following window opens: Figure 5-10 Wireless APs > APs > All > Radio 2 settings The meaning of the settings is the same as on the "Radio 1" tab. Note that with "Radio 2", you can choose from 13 channels. Note that in the 2.4 GHz frequency band (IEEE standard b/g) 13 or 11 (USA only) channels can be selected. To configure "Radio 2", use the information from the "Radio 1" tab. 52 Getting Started, 11/2014, C79000-G8976-C269-06

53 Managing access points 5.3 Configuring access points Static Configuration On the "APs > All" configuration page, select the "Static Configuration" tab. The following window opens: Figure 5-11 Wireless APs > APs > All > Static Configuration From the middle list, select the access point you want to configure. In the "Static Configuration" tab, you make the settings to decide how the AP with the WLC and a switch will connect. Where necessary, adapt the settings to your requirements. VLAN Settings "Tagged - VLAN ID" radio button To send tagged packets, enable the radio button and enter the VLAN ID in the input box beside it. "Untagged" radio button If you do not want to send tagged packets, enable the radio button. Getting Started, 11/2014, C79000-G8976-C

54 Managing access points 5.3 Configuring access points IP Address Assignment "Use DHCP" drop-down list To use DHCP, select the radio button. As a result, the selected AP obtains a dynamic IP address from the DHCP server. "Static Values" radio button If you enable this radio button, the AP is assigned a static IP address. You can complete the following input boxes: IP Address Enter the IP address of the AP here. Netmask Enter the netmask of the AP here. Gateway Enter the gateway of the AP here. Ethernet Port In this area, select the speed and the mode of the Ethernet port. "Ethernet Speed" drop-down list Select a suitable speed for Ethernet. Make sure that the AP has exactly the same settings as the switch. If you select "Auto", the speed is automatically negotiated with the switch. If you select 100 or 10 Mbps, you can edit the Ethernet mode. "Tunnel MTU" input box By entering an MTU size, you specify the threshold value at which packets are fragmented. We recommend a maximum value of "Ethernet Mode" drop-down list Here, select the Ethernet mode: Full duplex Select this function so that data packets are sent and received simultaneously. Half duplex Select this function Select this function so that data packets are either sent or received. 54 Getting Started, 11/2014, C79000-G8976-C269-06

55 Managing access points 5.3 Configuring access points Wireless Controller Search List If several WLCs are registered, they can be entered in the "Wireless Controller Search List" ranking list. Normally, the AP logs on at the WLC at which it was last logged on. If the AP cannot reach this WLC, it connects to the first WLC listed in the ranking list. If this list is empty, the AP searches for a WLC using the Dynamic Host Configuration Protocol (DHCP) or a Service Location Protocol Directory Agent (SLP DA) that is dependent on the registration. The first time it registers, the AP first uses the information provided by DHCP. If this does not exist, it starts an SLP multicast. If the AP is unsuccessful, the list must be entered manually via an SSH/Telnet connection. If the AP is not supplied with an IP address by DHCP, it can be reached every minute for approximately 20 seconds via the IP address and can then be configured completely and statically via SSH / Telnet. You will find further information in the user guide. Buttons With the following buttons, you can change the arrangement of the WLCs: Up To move the controller up, select a controller from the list and click the "Up" button. Down To move the controller down, select a controller from the list and click the "Down" button. Delete To remove a WLC from the list, click the "Delete" button. Add To include a WLC in the list, enter the IP address of the WLC in the input box and click the "Add" button x The IEEE 802.1x standard is an authentication method that is used when the IE switch to which the AP is connected uses port authentication, for example via a RADIUS server. You will find more detailed information on configuration in the User Guide Multiple configuration "Multi-edit" configuration page This section explains how to apply a setting to multiple access points. This gives you the opportunity of configuring and managing several APs efficiently. To open the "Multi-edit" configuration page, select the "Wireless AP > AP Multi-edit" menu command. Getting Started, 11/2014, C79000-G8976-C

56 Managing access points 5.3 Configuring access points AP Multi-Edit To open the "AP Multi-edit" configuration page, select the "Wireless APs > Bulk Configuration > AP Multi-edit Settings" menu command. The following window opens: Figure 5-12 AP Multi-edit "Hardware Types" list The "Hardware Types" list shows the hardware types of the APs that the SCALANCE WLC711 supports. If you select a hardware type from the list, all the APs that correspond to this hardware type are shown in the "Wireless APs" list. If you select several hardware types with the Ctrl key, the common sub properties of the hardware of the APs are displayed. 56 Getting Started, 11/2014, C79000-G8976-C269-06

57 Managing access points 5.3 Configuring access points Configuring access points at the same time To configure common sub properties of APs at the same time, follow the steps below: 1. To configure similar APs, select one or more hardware types from the middle list "Hardware Types". APs with the same configuration are displayed in the "Wireless APs" list. 2. In the "Wireless APs" list, select the APs you want to configure similarly. In the right-hand area, you will see common configuration properties of the selected APs. 3. Configure the APs. You will find information on the significance of the individual configuration options in the section "Single configuration (Page 42)". Getting Started, 11/2014, C79000-G8976-C

58 Managing access points 5.3 Configuring access points 58 Getting Started, 11/2014, C79000-G8976-C269-06

59 Configuring specific use cases with the wizard Use case: Bridged at WLC Introduction The following graphic shows you the "Bridged at WLC" use case in a simplified form: Figure 6-1 Use case - Bridged at WLC Description The "Bridged at WLC" use case describes the following situation: 1. The WLC is connected to port "LAN 1" of the switch and is involved in the flow of data. 2. The WLC is connected to the "admin" port of the management station. 3. The APs are connected to the switch. Getting Started, 11/2014, C79000-G8976-C

60 Configuring specific use cases with the wizard 6.1 Use case: Bridged at WLC 4. A server is connected to the switch. 5. The APs can be configured using the WLC. Properties This gives you the following options: There are no additional configurations, for example via WLAN settings on the switch. Fast roaming is more reliable since the switches are not involved. Note MAC mode If you operate SCALANCE IWLAN clients SCALANCE W74x-1, note that only the MAC mode "Manual" is supported. In this mode only one Ethernet node may be connected to the client. Procedure To configure the WLC, open the "VNS Creation Wizard" with the "VNS Configuration > New... > Start VNS Wizard" menu command. The following window opens: Figure 6-2 Use case - Bridged at WLC - "VNS Creation Wizard" wizard 60 Getting Started, 11/2014, C79000-G8976-C269-06

61 Configuring specific use cases with the wizard 6.1 Use case: Bridged at WLC Follow these steps during configuration: 1. In the "Name" input box, enter a name for the VNS configuration, for example "WLC Data". 2. Select the value "Data" from the "Category" drop-down list. This influences topologies, policies and service settings. 3. To move to the next page of the wizard, click the "Next" button. The following window opens: Figure 6-3 Use case - Bridged at WLC - "Basic Settings" wizard Follow these steps during configuration: 1. Select the "Enabled" check box. This means that on completion of the wizard, the WLAN settings are activated immediately. 2. To identify the network, enter a name for the SSID, for example "WLC Data" in the "SSID" input box. 3. If you do not require 802.1x authentication, select the value "Disabled" from the "Authentication Mode" drop-down list. 4. From the "Mode" drop-down list, select the value "Bridge Traffic Locally at WLC". 5. Select the value "esa0" from the "Interface" drop-down list. 6. Enter the IP address of the interface of the WLC in the "Interface IP" input box. 7. Enter the netmask of the data port of the WLC in the "Mask" input box. Getting Started, 11/2014, C79000-G8976-C

62 Configuring specific use cases with the wizard 6.1 Use case: Bridged at WLC 8. Enter the VLAN ID in the "VLAN ID" input box. 9. To be able to send packets untagged, enable the "Untagged" radio button. 10.To use the DHCP protocol for the access points, select the "Enable DHCP" check box. 11.To move to the next page of the wizard, click the "Next" button. The following window opens: Figure 6-4 Use case - Bridged at WLC - "DHCP" wizard Follow these steps during configuration: 1. To operate the DHCP server as a local server, select the value "Local DHCP Server" from the "DHCP Option" drop-down list. 2. Enter the default router of the network in the "Gateway" input box. 3. Enter the address range to be provided by the WLC in the input boxes of the "Address Range". 4. Enter a default and maximum value for the lease time in the input boxes of "Lease (seconds)". 5. To move to the next page of the wizard, click the "Next" button. 62 Getting Started, 11/2014, C79000-G8976-C269-06

63 Configuring specific use cases with the wizard 6.1 Use case: Bridged at WLC The following window opens: Figure 6-5 Use case - Bridged at WLC - "Filtering" wizard Follow these steps during configuration: 1. Select the value "Authenticated" from the "Filter ID" drop-down list. 2. To permit all data traffic, enable the "All Other Traffic" radio button at the end of the list. 3. To move to the next page of the wizard, click the "Next" button. Getting Started, 11/2014, C79000-G8976-C

64 Configuring specific use cases with the wizard 6.1 Use case: Bridged at WLC The following window opens: Figure 6-6 Use case - Bridged at WLC - "Privacy" wizard On this configuration page, you configure WPA2-PSK. Follow these steps during configuration: 1. Enable the "WPA - PSK" radio button. 2. Select the "WPA v.2" check box to activate the encryption methods. 3. Select the entry "Auto" from the "Encryption" drop-down list. This makes the two security protocols AES and CCMP available. Note Access points with the IEEE n standard do not support the "Auto" function in WPA v So that clients have to log on again after a certain time, select the "Broadcast re-key interval" check box and enter the value "3600" in the input box. 5. To be able to enter a character string, enable the "Input String" radio button beside "Input Method". 6. Enter the future password of the WLAN as a character string, for example "WLCDATA123". 7. To move to the next page of the wizard, click the "Next" button. 64 Getting Started, 11/2014, C79000-G8976-C269-06

65 Configuring specific use cases with the wizard 6.1 Use case: Bridged at WLC The following window opens: Figure 6-7 Use case - Bridged at WLC - "Radio Assignment" wizard Follow these steps during configuration: 1. To assign the WLAN as default, select the "Radio 1" and "Radio 2" check boxes. 2. From the "Select APs" drop-down list, select the "all radios" entry so that all APs are activated. 3. To allow the IEEE standard n to be used, select the "WMM" check box (WiFi Multimedia). 4. To move to the next page of the wizard, click the "Next" button. Getting Started, 11/2014, C79000-G8976-C

66 Configuring specific use cases with the wizard 6.1 Use case: Bridged at WLC The following window opens: Figure 6-8 Use case - Bridged at WLC - "Summary" wizard On this page, you can see and check all the settings. If incorrect information has been entered, you can change the entry by returning to the required configuration page with the "Back" button. All other settings are retained and do not need to be reconfigured. If the entries are correct, click the "Finish" button to move to the next page. If you want to stop the action, click the "Cancel" button. To move to the next page of the wizard, click the "Finish" button. 66 Getting Started, 11/2014, C79000-G8976-C269-06

67 Configuring specific use cases with the wizard 6.1 Use case: Bridged at WLC The following window opens: Figure 6-9 Application - Bridged at WLC Wizard "Success" (wizard completed successfully) Your settings are confirmed on this page. To exit the wizard, click the "Close" button. You have now completed the wizard successfully. Getting Started, 11/2014, C79000-G8976-C

68 Configuring specific use cases with the wizard 6.2 Use case: Bridged at AP 6.2 Use case: Bridged at AP Appearance The following graphic shows you the "Bridged at AP" use case in a simplified form: Figure 6-10 Use case - Bridged at AP Description The "Bridged at AP" use case describes the following situation: 1. The WLC is connected to port "LAN 1" of the switch and is not involved in the flow of data. 2. The WLC is connected to the "admin" port of the management station. 3. The APs are connected to the switch. 4. A DHCP server is connected to the switch. 5. The APs can be configured using the WLC. 68 Getting Started, 11/2014, C79000-G8976-C269-06

69 Configuring specific use cases with the wizard 6.2 Use case: Bridged at AP Properties This gives you the following options: The APs also remain active even if the WLC fails. This WLAN service can be suitable for PROFINET IO if WLAN clients move within the range of one AP (no roaming of WLAN clients between several APs). Avoidance of a possible bottleneck with the bandwidth. This can result when all WLAN clients need to share the data port "esa0" on the WLC. Note PROFINET IO communication For complex plants requiring PROFINET IO communication, stand-alone access points with ipcf support are recommended. Note MAC mode If you operate SCALANCE IWLAN clients SCALANCE W74x-1, note that only the MAC modes "Manual", "Own" and "Automatic" are supported. If several Ethernet notes need to be operated downstream from the IWLAN client, use the MAC mode "Own". Getting Started, 11/2014, C79000-G8976-C

70 Configuring specific use cases with the wizard 6.2 Use case: Bridged at AP Procedure To configure the WLC, open the "VNS Creation Wizard" with the "VNS Configuration > New... > Start VNS Wizard" menu command. The following window opens: Figure 6-11 Use case - Bridged at WLC - "VNS Creation Wizard" wizard Follow these steps during configuration: 1. In the "Name" input box, enter a name for the VNS configuration, for example "WLC Data". 2. Select the value "Data" from the "Category" drop-down list. This influences topologies, policies and service settings. 3. To move to the next page of the wizard, click the "Next" button. 70 Getting Started, 11/2014, C79000-G8976-C269-06

71 Configuring specific use cases with the wizard 6.2 Use case: Bridged at AP The following window opens: Figure 6-12 Use case - Bridged at AP - "Basic Settings" wizard Follow these steps during configuration: 1. Select the "Enabled" check box. This means that on completion of the wizard, the WLAN settings are activated immediately. 2. To identify the network, enter a name for the SSID, for example "WLC Data" in the "SSID" input box. 3. If you do not require 802.1x authentication, select the value "Disabled" from the "Authentication Mode" drop-down list. 4. To have the data traffic only via the APs and not via the WLC, select the value "Bridge Traffic Locally at AP" from the "Mode" drop-down list. 5. To be able to send packets untagged, enable the "Untagged" radio button. 6. To move to the next page of the wizard, click the "Next" button. Getting Started, 11/2014, C79000-G8976-C

72 Configuring specific use cases with the wizard 6.2 Use case: Bridged at AP The following window opens: Figure 6-13 Use case - Bridged at WLC - "Privacy" wizard On this configuration page, you configure WPA2-PSK. Follow these steps during configuration: 1. Enable the "WPA - PSK" radio button. 2. Select the "WPA v.2" check box to activate the encryption methods. 3. Select the entry "Auto" from the "Encryption" drop-down list. This makes the two security protocols AES and CCMP available. Note Access points with the IEEE n standard do not support the "Auto" function in WPA v So that clients have to log on again after a certain time, select the "Broadcast re-key interval" check box and enter the value "3600" in the input box. 5. To be able to enter a character string, enable the "Input String" radio button beside "Input Method". 6. Enter the future password of the WLAN as a character string, for example "WLCDATA123". 7. To move to the next page of the wizard, click the "Next" button. 72 Getting Started, 11/2014, C79000-G8976-C269-06

73 Configuring specific use cases with the wizard 6.2 Use case: Bridged at AP The following window opens: Figure 6-14 Use case - Bridged at WLC - "Radio Assignment" wizard Follow these steps during configuration: 1. To assign the WLAN as default, select the "Radio 1" and "Radio 2" check boxes. 2. From the "Select APs" drop-down list, select the "all radios" entry so that all APs are activated. 3. To allow the IEEE standard n to be used, select the "WMM" check box (WiFi Multimedia). 4. To move to the next page of the wizard, click the "Next" button. Getting Started, 11/2014, C79000-G8976-C

74 Configuring specific use cases with the wizard 6.2 Use case: Bridged at AP The following window opens: Figure 6-15 Use case - Bridged at AP" - "Summary" wizard On this page, you can see and check all the settings. If incorrect information has been entered, you can change the entry by returning to the required configuration page with the "Back" button. All other settings are retained and do not need to be reconfigured. If the entries are correct, click the "Finish" button to move to the next page. If you want to stop the action, click the "Cancel" button. To move to the next page of the wizard, click the "Next" button. 74 Getting Started, 11/2014, C79000-G8976-C269-06

75 Configuring specific use cases with the wizard 6.2 Use case: Bridged at AP The following window opens: Figure 6-16 Application - Bridged at WLC Wizard "Success" (wizard completed successfully) Your settings are confirmed on this page. To exit the wizard, click the "Close" button. You have now completed the wizard successfully. Getting Started, 11/2014, C79000-G8976-C

76 Configuring specific use cases with the wizard 6.2 Use case: Bridged at AP 76 Getting Started, 11/2014, C79000-G8976-C269-06

77 Optional configuration Expanding the number of manageable access points Introduction When the ships, up to 16 controller-based access points can be operated. With the WLC-700 license, you can use a further 16 additional access points with the. The order number of the license key WLC-700 is 6GK SB00. "WLC Product Keys" configuration page On this page, you can expand the number of access points. To open the "WLC Product Keys" configuration page, select the menu command "Wireless Controller > Administration > Software Maintenance" and select the "WLC Product Keys" tab. The following window opens: Figure 7-1 Software Maintenance - WLC Product Keys Getting Started, 11/2014, C79000-G8976-C

78 Optional configuration 7.1 Expanding the number of manageable access points Procedure Follow these steps during configuration: 1. Enter the activation key in the "Activation Key" input box. This activation key is entered in the certificate. Note Activation key The activation key is also stored in the certificate in a Data Matrix code. With code readers, the activation key can be entered directly in the "Activation Key" input box. 2. To apply the activation key, click the "Apply Activation Key" button. 3. Check whether or not the activation key was adopted successfully by clicking the "View Installed Keys" button. The following window opens: 78 Getting Started, 11/2014, C79000-G8976-C269-06

79 Optional configuration 7.1 Expanding the number of manageable access points Figure 7-2 Installed activation key Result Following the capacity upgrade, you can operate up to 48 controller-based access points with the. Getting Started, 11/2014, C79000-G8976-C

80 Optional configuration 7.2 Access using the Command Line Interface (CLI) 7.2 Access using the Command Line Interface (CLI) Introduction With the Command Line Interface (CLI), you can make all the configuration settings for the device. The CLI provides the same options as Web Based Management (WBM). You should therefore also read the detailed explanations of the parameters in the CLI Reference Guide. Note Hyper Terminal The CLI can be used with Hyper Terminal via the serial interface (RS-232) of the WLC or with Secure Shell (SSH) via an Ethernet connection. How to use the serial interface is explained in the Maintenance Guide. Note You should only use the command line interface if you are an experienced user. Even commands that bring about fundamental changes to the configuration are normally executed without a prompt for confirmation. Reading the IP address With CLI commands, you can read out IP addresses of a topology. This is helpful if, for example, you require an overview of the IP address currently being used. Note that only layer 3 configured topologies are read out (Physical, Admin, Bridged at Controller or Routed). Syntax Call up the CLI command with the following entry: show topology [l3] Parameters The meaning of the parameters is as follows: Parameters L3 Meaning You can identify an IP address by entering its interface name or by entering the L3 command and displaying all layer 3 configured topologies (Physical, Admin, B@AP or Routed). Meaning of the parameters Example WLC.siemens.com# show topology l3 80 Getting Started, 11/2014, C79000-G8976-C269-06

81 Optional configuration 7.2 Access using the Command Line Interface (CLI) Result Name Mode L3:IP 1:Admin admin :physical 1 physical Setting the IP address With CLI commands, you can also set the IP addresses of a topology. This is helpful if, for example, you want to change the IP address of the "Admin" topology or want to assign an IP address to a new topology. Example WLC.siemens.com# topology WLC.siemens.com:topology# Admin WLC.siemens.com:topology:Admin# l3 WLC.siemens.com:topology:Admin:l3# ip /24 WLC.siemens.com:topology:Admin:l3# apply Parameters Meaning IP address /24 Subnet mask Meaning of the parameters Getting Started, 11/2014, C79000-G8976-C

82 Optional configuration 7.3 Data backup 7.3 Data backup Introduction With the WBM you can save the following data as a backup and download it to a backup server: Configurations CDRs (Call Data Records) Logs Audits Rogue APs You can store the backup on a hard disk, FTP or SCP server. "Backup" configuration page To open the "Backup" configuration page, select the menu command "Wireless Controller > Administration > Software Maintenance" and select the "Backup" tab. The following window opens: Figure 7-3 Software Maintenance - Backup 82 Getting Started, 11/2014, C79000-G8976-C269-06

83 Optional configuration 7.3 Data backup Available Backups This display box shows the backups that have already been created as a ZIP file. To delete a backup, select the entry to be deleted and click the "Delete" button. Backup In this section, you create backups. "Select what to backup" drop-down list Select what you want to back up from the drop-down list: Config's, CDRs, Logs, Audit and Rogue Configurations only CDRs only Logs only Audit only Rogue only "Backup Now" button To create the backup, click this button. A window now appears that confirms that the backups have been successfully created. Close the window with the "Close" button. The backup is saved and is listed in the "Available Backups" display box. Note Note that the files ".work" and ".dat" are included in the ZIP file. Upload Backup In this section, you upload backups. "Protocol" drop-down list Select one of the following protocol for data transmission from the drop-down list: FTP (File Transfer Protocol) SCP (Secure Copy Protocol) "Server" input box Enter the IP address of the server on which the uploaded backup will be stored. "User ID" input box Enter the ID of the user with which the WLC711 logs on with the server. Getting Started, 11/2014, C79000-G8976-C

84 Optional configuration 7.3 Data backup "Password" input box Enter the password with which the WLC711 logs on with the server. "Confirm" input box To confirm the password, enter it again. "Directory" input box Enter the name of the directory in which the backup file will be saved. "Filename" drop-down list From the drop-down list, select the zipped backup you want to upload. "Upload" button To upload the zipped backup to the server, click the "Upload" button. The backup is now saved on the server and can be used for a system restore. Schedule Backup This area lists the backups that have already been created in the form of a summary. You also have the option of creating automatic backups. Here, certain backups can be created automatically on a daily, weekly or monthly basis. To create automatic backups, click the "Schedule Backup" button. 84 Getting Started, 11/2014, C79000-G8976-C269-06

85 Optional configuration 7.4 Using reports 7.4 Using reports Introduction With reports and displays, you can check statuses or even past events, for example: Transmission rate Connection of the access points Active clients Various statistics System information The following sections describe the "All Active Clients" and "Wireless AP Availability" reports. You will find further information in the User Guide in the section "Working with Reports and Displays". All Active Clients To go to the "All Active Clients" page, select the "Reports > Clients > All Active Clients" menu command. Figure 7-4 Report - All Active Clients This page shows you all the devices active in the WLAN. In the table, you can view various connection properties for each device. These include, for example the IP and MAC address, the authentication and encryption method or the average data rate (sending/receiving) of the client. Getting Started, 11/2014, C79000-G8976-C

86 Optional configuration 7.4 Using reports Wireless AP Availability To view the availability of the APs, open the "Wireless AP Availability" page with the menu command "Reports > Wireless AP Availability". The following window opens: Figure 7-5 Example: Reports - Wireless AP Availability If "Availability Link is UP" is displayed above the list, there is an active fault-tolerant connection to a second WLC. If "Availability not configured" is displayed above the list, there is no fault-tolerant connection to a second WLC. Check the configuration for errors and eliminate them. Each AP is represented by a colored box. The report uses the following colors to display the status of the connection: Green The AP has established an active connection. Blue The AP has established a backup connection to a second WLC in fault-tolerant mode. Red The AP is not connected. You will find further information in the "" User Guide. 86 Getting Started, 11/2014, C79000-G8976-C269-06

87 Optional configuration 7.5 Using policies 7.5 Using policies Introduction A policy is a collection of rules (permissions and prohibitions) that decide how WLAN clients can act in the WLAN. A VNS always has two policies. By default, the policy for authenticated users corresponds to the policy for non-authenticated users. The following different types of policy are available: Non-authenticated default policy This policy must exist. It is used for the data traffic of all non-authenticated clients. Authenticated default policy This policy must exist. It is used for the data traffic of all clients that have already been authenticated. "Policies" configuration page To open the "Policies" configuration page, select the "VNS Configuration > Policies" menu command. Example Below you will find an explanation of how you create a policy for non-authenticated clients based on an example. Getting Started, 11/2014, C79000-G8976-C

88 Optional configuration 7.5 Using policies Follow these steps during configuration: 1. To create a new policy, click the "New" button. 2. Link the policy to a topology by selecting the topology from the "Assigned Topology" dropdown list. If you are uncertain which topology the policy should be linked to, leave the entry set to "No Change". 3. Go to the "Filter Rules" tab. Depending on the function and the topology with which the policy will be used, "AP Filtering" needs to be enabled. This must be enabled for "Bridge at AP" topologies; for all other types of topology enabling this is optional. Figure 7-6 Policies - Filter Rules In the default setting, all communication is allowed (see screenshot). For non-authenticated policies, it is advisable to prohibit all communication. This is achieved by selecting the relevant filter rules and changing the access control to "Deny" using the "Edit" button. If you nevertheless want to make certain destinations or address areas available in your network, you can define these using "Add". 88 Getting Started, 11/2014, C79000-G8976-C269-06

89 Optional configuration 7.6 Authentication via RADIUS server 7.6 Authentication via RADIUS server Introduction A RADIUS server is a central authentication server that checks client logons using certificates or user name and password. The advantage compared with WPA-/WPA2-PSK is that each WLAN client has its own unique identifier. "Privacy" configuration page To open the "Privacy" configuration page, select the menu command "VNS Configuration > WLAN Services" and select the "Privacy" tab. With this page, you can create an automatic or static key. RADIUS With the following setting, a WPA key is created automatically for each client: Figure 7-7 WLAN Services - Privacy Getting Started, 11/2014, C79000-G8976-C

90 Optional configuration 7.6 Authentication via RADIUS server Procedure Follow these steps during configuration: 1. Select the "WPA" check box. 2. Select the "WPAv.2" check box. 3. Select the entry "Auto" from the "Encryption" drop-down list. 4. Select the "Broadcast re-key interval" check box and enter "3600" in the input box. 5. To save your changes, click the "Save" button. The following window opens: Figure 7-8 WLAN Services - Auth & Acct 6. To enable RADIUS, select the entry "802.1x" from the drop-down list. You will find information about the RADIUS server in the User Guide in the section "VNS Global Settings". 7. To save your changes, click the "Save" button. 90 Getting Started, 11/2014, C79000-G8976-C269-06

91 Optional configuration 7.6 Authentication via RADIUS server WPA2-PSK With the following setting, a static WPA key is created for each client: Figure 7-9 WLAN Services - Privacy Procedure Follow these steps during configuration: 1. Select the "WPA - PSK" check box. 2. Select the "WPAv.2" check box. 3. Select the "Broadcast re-key interval" check box and enter "3600" in the input box. 4. To enter the WPA key as a string, select the "Input String" check box. 5. Enter a secure WPA key as a a string in the "Pre-shared key String" input box. Remember that the WPA key must include a minimum of eight characters. Getting Started, 11/2014, C79000-G8976-C

92 Optional configuration 7.6 Authentication via RADIUS server 6. To save your changes, click the "Save" button. The following window opens: Figure 7-10 WLAN Services - Auth & Acct 7. To enable WPA2-PSK, select the "Disabled" entry from the drop-down list. 8. To save your changes, click the "Save" button. 92 Getting Started, 11/2014, C79000-G8976-C269-06

93 Optional configuration 7.7 User configuration 7.7 User configuration "Local Authentication" configuration page This section contains information about changing user data, creating new users or deleting existing users. To open the "Local Authentication" configuration page, select the "Wireless Controller > Login Management" menu command. The following window opens: Figure 7-11 Login Management - Local Authentication Changing user data To change the data of a user, follow the steps below: 1. Choose the user to be modified in the list. 2. In the section "Modify User", enter the new password in the "Password" input box. 3. Confirm the new password in the "Modify User" section by entering it again in the "Confirm Password" input box. To save the new password, click the "Change Password" button. 4. To save the configuration, click the "Save" button. Getting Started, 11/2014, C79000-G8976-C