Installation Guide. HP ProCurve Secure Access 700wl Series.

Transcription

1 Installation Guide HP ProCurve Secure Access 700wl Series

2

3 HP PROCURVE SECURE ACCESS 700WL SERIES INSTALLATION GUIDE

4 Copyright 2003 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. This document contains proprietary information, which is protected by copyright. No part of this document may be photocopied, reproduced, or translated into another language without the prior written consent of Hewlett-Packard. Publication Number July 2003 Edition 1 Applicable Products HP ProCurve Access Controller 720wl (J8153A) HP ProCurve Access Control Server 740wl (J8154A) HP ProCurve Integrated Access Manager 760wl (J8155A) HP ProCurve 700wl 10/100 Module (J8156A) HP ProCurve 700wl Gigabit-SX Module (J8157A) HP ProCurve 700wl Gigabit-LX Module (J8158A) HP ProCurve 700wl 10/100/1000Base-T (J8159A) HP ProCurve 700wl Acceleration Module (J8160A) Trademark Credits Windows NT, Windows, and MS Windows are US registered trademarks of Microsoft Corporation. Disclaimer HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Hewlett-Packard assumes no responsibility for the use or reliability of its software on equipment that is not furnished by Hewlett-Packard. Warranty See the Customer Support/Warranty booklet included with the product. A copy of the specific warranty terms applicable to your Hewlett-Packard products and replacement parts can be obtained from your HP Sales and Service Office or authorized dealer. ii

5 CONTENTS Preface Audience How To Use This Document Organization Related Publications Document Conventions Support Information vii vii vii vii ix ix ix Chapter 1 Introduction to the HP ProCurve Secure Access 700wl Series Overview Order of Network Installation Integrated Access Manager Only Integrated Access Manager With Additional Access Controllers Access Control Server With One or More Access Controllers Tools and Information Required Tools Required Information Required Chapter 2 Hardware Installation Hardware Description System Memory/Storage Chassis Power Supply Fans I/O Ports Controls and Indicators Rear Chassis iii

6 Site Planning Checklist Site Power Requirements and Heat Dissipation Installing a 700wl Series System Unpacking Rack Mounting the Chassis Connecting Power to the Chassis Adding an Option Card Removing the Top and Option Card Cover Plate Inserting an Option Card into a 700wl Series Unit Chapter 3 Access Control Server 740wl Network Installation 3-1 Getting Started IP Addressing Considerations Installation Using the Command Line Interface Connecting to a Serial Console Issuing Commands from the Serial Console Installation Using the Administrator Interface Chapter 4 Access Controller 720wl Network Installation 4-1 Getting Started IP Addressing Considerations Installation Using the Command Line Interface Connecting to a Serial Console Issuing Commands from the Serial Console Installation Using the Administrator Interface 4-6 Accessing the Administrator Interface Over a Downlink Port 4-7 Accessing the Administrator Interface Over the Network 4-8 Network Configuration Using the Browser-Based Interface 4-9 Completing the Installation 4-13 Chapter 5 Integrated Access Manager 760wl Network Installation 5-1 Getting Started IP Addressing Considerations Installation Using the Command Line Interface Connecting to a Serial Console Issuing Commands from the Serial Console Installation Using the Administrator Interface Accessing the Administrator Interface Over a Downlink Port iv Installation Guide

7 Accessing the Administrator Interface Over the Network 5-8 Network Configuration Using the Browser-Based Interface 5-9 Completing the Installation 5-13 Chapter 6 Troubleshooting 6-1 Appendix A Command Line Interface Accessing the Command Line Interface Command Syntax Getting CLI Command Help Administrator Access Control Commands System Status and Information Commands Network Configuration Commands Port Configuration Commands Access Controller Port Configuration Commands Access Controller Configuration Advanced Network Configuration Access Control Server Configuration Advanced Network Configuration Wireless Data Privacy Configuration Active Client Management Commands System Backup, Upgrade, and Shutdown Commands Backup and Restore Upgrading the System Software Stopping and Restarting the System Resetting to Factory Defaults Diagnostic and Log Commands Time Configuration SNMP Configuration and Reporting Commands A-1 A-1 A-2 A-3 A-3 A-4 A-6 A-8 A-10 A-10 A-11 A-13 A-15 A-15 A-17 A-19 A-19 A-20 A-23 A-23 A-24 A-27 A-28 Appendix B LCD Display Description Display Description Powering On and System Boot Default Display Main Menu Network Configuration System Shutdown B-1 B-1 B-2 B-2 B-3 B-4 B-5 Installation Guide 2-v

8 Appendix C Technical Specifications C-1 Technical Specifications Environmental Ranges Power Requirements Physical Dimensions Physical Interface C-1 C-1 C-1 C-1 C-2 Appendix D Cable and Connector Specifications D-1 Serial Connector D-1 10/100 Downlink Ethernet Connectors D-2 Index of Commands IOC-1 Index IX-1 2-vi Installation Guide

9 PREFACE This preface describes the objective, audience, use, and organization of the HP ProCurve Secure Access 700wl Series Installation Guide. It also outlines the document conventions, related documentation, and support information. Audience The audience for this document is the network administrators who wants to enable network users to communicate using an HP ProCurve Secure Access 700wl Series system. This document is intended for authorized personnel who have previous experience working with network telecommunications systems or similar equipment. It is assumed that the personnel using this document have the appropriate background and knowledge to complete the procedures described in this document. How To Use This Document This document contains procedural information describing the installation and configuration of the HP ProCurve Integrated Access Manager 760wl, Access Control Server 740wl, or Access Controller 720wl. Each procedure is written in a task-oriented format consisting of numbered step-by-step instructions. In most cases, several procedures are required to complete one overall task. All procedures should be performed in the order they appear in this document, unless otherwise instructed. Organization This document is organized as follows: Chapter 1 Introduction to the HP ProCurve Secure Access 700wl Series This chapter gives an overview of the installation procedure. Chapter 2 Hardware Installation This chapter describes the installation of the HP ProCurve Integrated Access Manager 760wl, HP ProCurve Access Control Server 740wl, and HP ProCurve Access Controller 720wl. vii

10 Chapter 3 Access Control Server 740wl Network Installation This chapter describes the network configuration of the Access Control Server after it has been physically installed. Chapter 4 Access Controller 720wl Network Installation This chapter describes the network configuration of an Access Controller after it has been physically installed. Chapter 5 Integrated Access Manager 760wl Network Installation This chapter describes the network installation of an Integrated Access Manager after it has been physically installed. Chapter 6 Troubleshooting This chapter presents troubleshooting procedures for the 700wl Series system. Appendix A Command Line Interface This appendix provides a description of the command line interface. Appendix B LCD Display Description This appendix describes the LCD display on the Access Controller 720wl, Access Control Server 740wl, and Integrated Access Manager 760wl. The display can be used to view the system s network parameters, and to power down the system. Appendix C Technical Specifications This appendix describes the technical specifications of the system. Appendix D Cable and Connector Specifications This appendix describes the Serial Connector and the Standard Ethernet cables for use with 700wl Series devices. Index of CLI Commands The Index of Commands is an alphabetized list of the CLI commands with references to the pages where they are documented. viii HP ProCurve Secure Access 700wl Series Installation Guide

11 Related Publications The following lists related publications: HP ProCurve Secure Access 700wl Series Configuration and Management Guide HP ProCurve Secure Access 700wl Series Release Notes HP ProCurve Secure Access 700wl Series Quick Start Guide HP ProCurve Secure Access 700wl Series Getting Started Guide Document Conventions The following text conventions are used in this document: Table 1. Text Conventions Convention Boldface Arial Boldface Italic Palatino Italic Palatino Courier Definition Screen menus that you click to select, commands that you select, or field names are in boldface Arial. New terms that are introduced are in boldface italic Palatino. Emphasized terms are in italic Palatino. Filenames and text that you type are in Courier. The following icons are used to alert you to important information: Table 2. Notices Icon Notice Type Alerts you to... None Note Helpful suggestions or information that is of special importance in certain situations. None Caution Risk of loss of system functionality or loss of data. Warning Risk of personal injury, system damage, or irrecoverable loss of data. Support Information See the HP ProCurve Networking web site at Click on technical support and select support services for a list of available support resources and options for contacting HP. HP ProCurve Secure Access 700wl Series Installation Guide ix

12 x HP ProCurve Secure Access 700wl Series Installation Guide

13 INTRODUCTION TO THE HP PROCURVE 1 SECURE ACCESS 700WL SERIES This chapter gives a brief description of the installation procedures for HP ProCurve Secure Access 700wl Series products. It consists of the following sections Overview Order of Network Installation Tools and Information Required Overview There are three products that make up the HP ProCurve Secure Access 700wl Series: HP ProCurve Access Control Server 740wl HP ProCurve Access Controller 720wl HP ProCurve Integrated Access Manager 760wl The physical installation of the hardware for any of these products is essentially the same, and is described fully in Chapter 2, Hardware Installation. The hardware installation is always performed first, before the network installation. The network installation is slightly different for each product, and the order of installation depends on the specific equipment to be installed. Order of Network Installation The order of installation depends on the complement of equipment you wish to install. There are three basic configurations, and for each, there is an order of network installation as follows: Integrated Access Manager 760wl only, with no Access Controller 720wls Integrated Access Manager 760wl with one or more additional Access Controller 720wls Access Control Server 740wl with at least one Access Controller 720wl Integrated Access Manager Only If you are installing an Integrated Access Manager 760wl only, perform installation in the following order: Step 1. Install the hardware, following the steps in Chapter 2, Hardware Installation. 1-1

14 Introduction to the HP ProCurve Secure Access 700wl Series Step 2. Perform the Integrated Access Manager network installation, following the steps in Chapter 5, Integrated Access Manager 760wl Network Installation. Note: If at a later time, you wish to add additional Access Controller 720wls, perform the steps in Chapter 4, Access Controller 720wl Network Installation for each Access Controller you wish to add. Integrated Access Manager With Additional Access Controllers If you are installing an Integrated Access Manager 760wl with one or more Access Controllers, perform installation in the following order: Step 1. Install the hardware, following the steps in Chapter 2, Hardware Installation. You can perform hardware installation of the Integrated Access Manager and Access Controllers in any order. Step 2. Perform the Integrated Access Manager network installation, following the steps inchapter 5, Integrated Access Manager 760wl Network Installation. You must perform network installation on the Integrated Access Manager first. Step 3. For each Access Controller 720wl you wish to install, follow the steps in Chapter 4, Access Controller 720wl Network Installation. You must complete the entire procedure for each Access Controller before starting the next one. Access Control Server With One or More Access Controllers If you are installing a Access Control Server 740wl and one or more Access Controllers, perform installation in the following order: Step 1. Install the hardware, following the steps in Chapter 2, Hardware Installation. You can perform hardware installation of the Access Control Server and Access Controllers in any order. Step 2. Perform the Access Control Server network installation, following the steps in Chapter 3, Access Control Server 740wl Network Installation. You must perform network installation on the Access Control Server first. Step 3. For each Access Controller 720wl you wish to install, follow the steps in Chapter 4, Access Controller 720wl Network Installation. You must complete the entire procedure for each Access Controller before starting the next one. Tools and Information Required Certain tools and information are required to perform installation. Tools Required The following tools and equipment are required to install the chassis in a rack: Tape measure and level Number 2 Phillips screwdriver 1-2 HP ProCurve Secure Access 700wl Series Installation Guide

15 Introduction to the HP ProCurve Secure Access 700wl Series Information Required Note: The information you gather here is required during configuration and is presented here as a reminder to find it before beginning the network installation. To perform network installation on a Access Control Server, Access Controller, or Integrated Access Manager, the information defined in Table 1-1 may be required: Table 1-1. Installation Parameters HP ProCurve System(s) Parameter Form All Hostname (Fully Qualified) Not required. Must be fully qualified if provided. Example: am21b.corp.com Access Controllers and Integrated Access Manager Only Domain name IP address Subnet Mask Gateway (router) IP address Primary and Secondary DNS server IP addresses Shared Secret DHCP server IP address Primary and Secondary WINS server IP addresses Note: A hostname is required only for an Access Control Servers or Integrated Access Manager that will have a real Secure Socket Layer (SSL) certificate installed. If you install a signed SSL certificate, the hostname must match that on the SSL certificate. Defines the system s domain if a hostname is not provided. Optional. Example: corp.com Can be configured as a static IP address or can be obtained via DHCP. Defines the system s subnet range. Can be obtained via DHCP. Example: Defines the default router. Can be obtained via DHCP. Defines the location of the primary and backup DNS servers. Can be obtained via DHCP. Secret key used to establish trust relationship between a Access Control Server or Integrated Access Manager and an Access Controller. Alphanumeric string. The same shared secret must be configured on each system. Not required for an Integrated Access Manager if no additional Access Controllers are used. For Access Controllers only, can be obtained via DHCP if 700wl Series-specific extensions are configured. Optional. Needed only if the Integrated Access Manager or Access Controller will have non-nat clients, and there is no DHCP server or DHCP forwarding router on it s subnet. Defines the location of the primary and backup WINS servers. Can be obtained via DHCP. HP ProCurve Secure Access 700wl Series Installation Guide 1-3

16 Introduction to the HP ProCurve Secure Access 700wl Series Table 1-1. Installation Parameters HP ProCurve System(s) Parameter Form Access Controllers Integrated Access IP address of the Access Control Server or Only Manager or Access Integrated Access Manager. Can be obtained via Control Server IP address DHCP if 700wl Series-specific extensions are configured. Many of these parameters can be supplied by the DHCP server if the system is configured to obtain its IP address via DHCP. If the system is configured to use a static IP address, then all the parameters shown in the table must be provided when the system is configured for network installation. 1-4 HP ProCurve Secure Access 700wl Series Installation Guide

17 HARDWARE INSTALLATION 2 This chapter describes the hardware installation of the following HP ProCurve products: Integrated Access Manager 760wl, Access Control Server 740wl, and Access Controller 720wl. You must be sure that the site requirements are met and carefully follow the procedures described to physically install the equipment. This chapter consists of the following sections: Hardware Description Site Planning Checklist Installing a 700wl Series System Adding an Option Card Hardware Description This section describes the hardware features of the HP ProCurve Integrated Access Manager 760wl, HP ProCurve Access Controller 720wl, and HP ProCurve Access Control Server 740wl. These products are designed for high-performance, high-density wiring-closet applications. An Integrated Access Manager 760wl, or Access Controller 720wl with a single four-port 10/100 Ethernet card all look as shown in Figure 2-1. Figure 2-2 shows a Access Control Server 740wl, which looks similar to the Integrated Access Manager 760wl or Access Controller 720wl, but does not include any option cards. 2-1

18 ON HDD integrated access manager 760wl J8155A SCROLL SELECT J8154A ON HDD SCROLL SELECT Hardware Installation hp procurve NETWORK RESERVED UPLINK Figure 2-1. Isometric View Integrated Access Manager 760wl or Access Controller 720wl hp procurve access control server 740wl 1 RESERVED NETWORK UPLINK Figure 2-2. Isometric view Access Control Server 740wl The hardware for all three products is very similar, and consists of a chassis, power supply, fans, I/O ports, indicators, and switches. All systems have at least two RJ45 connectors one for the network uplink, used to connect the system to the network, and one that is reserved for future use. Access Controllers and Integrated Access Managers may have up to twelve downlink access ports, used to connect wireless access points or other client-side devices to the system. Option cards with downlink ports can be pre-installed at the factory, or they can be ordered separately and added at a later time. 2-2 HP ProCurve Secure Access 700wl Series Installation Guide

19 Hardware Installation A front panel view of an Access Controller 720wl with a 4-port Ethernet card installed is shown in Figure 2-3. An Integrated Access Manager 760wl looks similar. 1 ON HDD SCROLL SELECT 2 hp procurve access controller 720wl J8153A RESERVED NETWORK UPLINK Figure 2-3. Front panel view Integrated Access Manager 760wl or Access Controller 720wl Figure 2-4 shows a front panel view of the Access Control Server 740wl. 1 ON HDD SCROLL SELECT 2 hp procurve access control server 740wl J8154A RESERVED NETWORK UPLINK Figure 2-4. Front panel view Access Control Server 740wl A detailed view of the network interface (uplink port) is shown in Figure 2-5. LED1 LED2 Figure 2-5. Network Uplink port The two LEDs, LED1 and LED2, provide information on the port speed and data connection state of the default network uplink port. See Controls and Indicators on page 2-6 for a definition of their meanings. Note: The system can optionally be configured to use an alternate port, such as a Fiber Gigabit Ethernet port on an option card, as the network uplink. System Memory/Storage The Access Control Server 740wl and Integrated Access Manager 760wl are each equipped with a hard disk; the Access Controller 720wl is equipped with 256K of flash memory. Figure 2-6 shows an Integrated Access Manager 760wl with the top cover removed. An Access Control Server 740wl looks similar, but without the riser board, into which option cards are inserted. HP ProCurve Secure Access 700wl Series Installation Guide 2-3

20 J8155A l integrated access manager 760wl SCROLL SELECT ON HDD integrated access manager 760wl J8155A SCROLL SELECT Hardware Installation Hard Disk Riser Board O / ON HDD hp procurve NETWORK RESERVED UPLINK Figure 2-6. Integrated Access Manager 760wl with top cover removed Figure 2-7 shows an Access Controller 720wl with the top cover removed. Flash Memory 256 hp procurve NETWORK RESERVED UPLINK Figure 2-7. Access Controller 720wl internal view Chassis The chassis is a 2 rack-unit (RU) enclosure, having dimensions (43.2 cm) wide, (38.1 cm) deep, and 3.5 (8.9 cm) high. It weighs 14 lb. (6.4 kg). It can be mounted at the front with the brackets provided. 2-4 HP ProCurve Secure Access 700wl Series Installation Guide

21 J8153A ON HDD SCROLL SELECT Hardware Installation Power Supply A single, non-redundant, auto voltage sensing power supply is provided. Input is volts, 2.5A, 50/60 Hz, with a measured 87 watts output. Fans Note: For environmental specifications, see Site Power Requirements and Heat Dissipation. The system fan assemblies provide cooling air for the internal chassis components. The fans exhaust warm air from one end and draw in cool air at the other end. Figure 2-8 shows the direction of air flow through a 700wl Series system. hp procurve access controller 720wl NETWORK RESERVED UPLINK Airflow Direction Figure 2-8. Airflow direction All 700wl Series systems monitor their internal fan speeds, internal chassis temperature, and power supply voltages. The status of these values are reported by system software. I/O Ports Table 2-1 summarizes the functional I/O ports on the Access Control Server 740wl, Integrated Access Manager 760wl, and Access Controller 720wl. HP ProCurve Secure Access 700wl Series Installation Guide 2-5

22 Hardware Installation Table 2-1. I/O Ports Port Function Network Uplink Reserved port (for future use) Description RJ45, 10Base-T/ 100Base-TX/ 1000Base-T RJ45, 10Base-T/ 100Base-TX/ 1000Base-T Number of Ports 740wl 760wl 720wl Serial Console DB9, Serial Port Access Controller Downlink Port RJ45, 10Base-T/ 100Base-TX 0 up to 12 up to 12 Controls and Indicators Controls There is only one control on the front of the chassis, a power button. The power button is a momentary switch and is used to turn on the system. Note: The front panel power button should not be used to power off the system. Turning off the system should be performed through software or from the LCD Display. System Status Indicators There are two system status LED indicators on the front of the chassis Power (ON) and HDD. ON is lit when the power supply is plugged in to a live outlet, the rear panel On/Off switch is in the On position, and the power is turned on by the front panel On/Off button. HDD is lit when the internal hard disk drive is in use. LCD Display The display can be used to view the system s network parameters, and to power down the system. The LCD display is located in the center of the 700wl Series system front panel. It is a 16 character by two line display, with two buttons located to the right of the display (Figure 2-9). SCROLL SELECT Figure 2-9. LCD Display Appendix B, LCD Display Description describes the messages and operation of the LCD display panel. 2-6 HP ProCurve Secure Access 700wl Series Installation Guide

23 Hardware Installation Network Uplink Status Indicators The two LEDs, LED1 and LED2, provide information on the port speed and data connection state of the default network uplink port as shown in Table 2-2. Table 2-2. Network uplink LED status LED State LED1 (Port Speed) LED2 (Connection) On Orange: 1000 Mbps Yellow: Good connection Green: 100 Mbps Off 10 Mbps Poor or no connection Blinking Transferring data Access Controller and Integrated Access Manager Port Indicators The access ports on an Access Controller or Integrated Access Manager are labeled 1 to 4, reading from left to right, as shown in Figure Each Cluster LED corresponds to one port as shown Left LED Right LED Cluster LEDs Figure Access port labeling on an Access Controller or Integrated Access Manager Table 2-3 shows the possible states for each LED and the meaning of each state. Table 2-3. Port LED Status Indicators LED Left LED Right LED Cluster LEDs State and Meaning Off: No activity Blinking: Data transfer Off: No link/no connection On: Link established, good connection Not used HP ProCurve Secure Access 700wl Series Installation Guide 2-7

24 ASSEMBLED IN THE U.S.A. LISTED E I.T.E. B Hardware Installation Rear Chassis Figure 2-11 shows the rear of the chassis. There are no controls on the rear of the chassis. Access Controller 720wl U R C L US SN Wide-Ranging Input V 6A 50/60Hz Figure Rear chassis Site Planning Checklist Before installing an Integrated Access Manager 760wl, Access Control Server 740wl, or Access Controller 720wl, you should evaluate the items in the following site planning checklist: Space Evaluation Space and layout Floor covering Impact and vibration Lighting Maintenance access Environmental Evaluation Ambient temperature Humidity Altitude Atmospheric contamination Airflow Power Evaluation Input power type Proximity of receptacle to equipment UPS for power failures Grounding Evaluation Circuit breaker size 2-8 HP ProCurve Secure Access 700wl Series Installation Guide

25 Hardware Installation Cable and Interface Equipment Evaluation Cable type Connector type Cable distance limitations Interface equipment (transceivers) EMI Evaluation Distance limitations for signaling Site wiring RFI levels Site Power Requirements and Heat Dissipation Table 2-4 shows the site power requirements and heat dissipation for the Integrated Access Manager 760wl, Access Control Server 740wl, and Access Controller 720wl. Table 2-4. Site Power Requirements, Temperature and Heat Dissipation Parameters Parameter Value Power Supply Output (Watts) 56 AC Input Power (Watts) 80 Heat Dissipation (BTU/Hr.) 170 AC Input Current at 120 VAC (Amps).88 AC Input Current at 240 VAC (Amps).44 Operating Temperature Range, C 0 to 40 Storage Temperature Range, C -25 to +70 Humidity Range, non-condensing, percent 5 to 90 Installing a 700wl Series System Note: In this section, the hardware installation instructions for the Integrated Access Manager 760wl, Access Control Server 740wl, and Access Controller 720wl are the same. Any of these is referred to as the chassis. Unpacking Unpack the contents carefully. Save the shipping containers and all packing materials. To save storage space, you may want to flatten the containers. Check that the following is included: Chassis HP ProCurve Secure Access 700wl Series Installation Guide 2-9

26 Hardware Installation Hardware and Accessories Kit x 5/8 inch Phillips pan-head bolts, zinc (quantity: 4) x 5/8 Phillips washer-head bolts, black (quantity: 4) Power Cord AT Null Modem (serial crossover) Cable (DB9 Female/DB9 Female) Documentation Kit Documentation CD-ROM Software License Agreement Software Release Notes HP ProCurve Networking Products Support/Warranty Booklet HP ProCurve Secure Access 700wl Series Quick Start Guide HP ProCurve Secure Access 700wl Series Getting Started Guide If any of the above is missing, contact HP immediately and do not attempt installation. Rack Mounting the Chassis Each HP ProCurve Secure Access 700wl Series chassis comes with attached L-brackets suitable for mounting the chassis in a standard 19-inch (48.3 cm) equipment rack with two unobstructed outer posts. This unit is not suitable for mounting in racks with obstructions (such as a power strip) that could impair access to the device. The air space in front and rear of system should be 6.00 inches minimum. Caution: Ground the chassis properly with the supplied power cord. Caution: Be sure to position the power cord so that you can easily disconnect the chassis. Caution: Do not install the chassis in an environment where the operating temperature might exceed 55 C (123 F). Caution: Do not restrict air flow around the side and rear of the chassis. The air space in front and rear of system should be 6.00 inches minimum. Required Installation Tools The following tools and equipment are required to install the chassis in a rack: Tape measure and level Number 2 Phillips screwdriver 2-10 HP ProCurve Secure Access 700wl Series Installation Guide

27 Hardware Installation Mounting Procedure To install a chassis in a rack, follow these steps: Step 1. Prepare for installation as follows: a. Place the chassis on the floor or on a sturdy table, as close as possible to the rack. Leave enough clearance to allow yourself to move around the chassis. b. Use the tape measure to measure the depth of the rack. Measure from the outside of the front mounting posts to the outside of the rear mounting strip. The depth must be at least inches (38.1 cm). c. Measure the space between the inner edges of the left front and right front mounting posts to ensure that it is inches (45.09 cm) wide. The chassis is inches (43.2 cm) wide and must fit between the mounting posts. d. Open the accessories box and refer to the component checklist to verify that all parts are included, as described in Unpacking. Note: Some equipment racks have a power strip along the length of one of the rear posts. If the rack has this feature, consider the position of the strip when planning fastener points. Step 2. Install the chassis in the rack as follows: a. Align the mounting holes in the L-bracket with the mounting holes in the equipment rack. b. Secure the chassis using either four x 5/8 screws or four x 5/8 screws (two per side) through the elongated holes in the L-bracket and into the threaded holes in the mounting post (Figure 2-12). c. Use the tape measure and level to ensure that the chassis is installed straight and level. HP ProCurve Secure Access 700wl Series Installation Guide 2-11

28 ON HDD hp procurve integrated access manager 760wl J8155A SCROLL SELECT Hardware Installation. NETWORK RESERVED UPLINK Figure Mounting the Integrated Access Manager 760wl in a rack or cabinet Connecting Power to the Chassis Follow these steps to connect power to the chassis: Step 1. Before you connect the power supply to a power source, ensure that all site power and grounding requirements described above have been met. Step 2. Plug the power cord into the rear of the chassis, as shown in Figure Step 3. Connect the other end of the power cord to an AC-power input source. Adding an Option Card Caution: Be sure to wear a properly grounded wrist grounding strap when installing an option card or otherwise working on the equipment with the cover removed. There is a danger of Electrostatic Discharge (ESD) damaging the equipment if this precaution is not taken. Warning: Blank option card cover plates and cover panels serve three important functions: they prevent exposure to hazardous voltages and currents inside the chassis; they 2-12 HP ProCurve Secure Access 700wl Series Installation Guide

29 Hardware Installation contain electromagnetic interference (EMI) that might disrupt other equipment; and they direct the flow of cooling air through the chassis. Do not operate the system unless all cards, option card cover plates, front covers, and rear covers are in place. Warning: High Voltages are present! Do not remove the cover until all power cables have been disconnected and the chassis is properly grounded. Failure to observe this may result in severe injury or death by electrocution. Removing the Top and Option Card Cover Plate Step 1. Be sure that all cables have been removed, and attach a properly grounded ESD wrist strap to your wrist. Step 2. Remove eight screws that secure the top cover to the chassis. Step 3. Remove the cover. Step 4. Using a #2 Phillips-head screwdriver inserted through the appropriate hole on the option card retaining screw cover, remove the screw holding the option card cover plate. Remove the option card cover plate from the front of the Access Controller 720wl Access Controller (Figure 2-13). Note: A magnetic screwdriver may be useful, to help avoid screws falling into the unit, where they may be difficult to retrieve. SCROLL SELECT NETWORK RESERVED UPLINK Option Card Retaining Screw Cover Figure Removing the option card cover plate HP ProCurve Secure Access 700wl Series Installation Guide 2-13

30 J8153A ON HDD Hardware Installation Inserting an Option Card into a 700wl Series Unit Step 1. Remove the option card from its protective packaging, taking care not to damage it. Step 2. Insert the card into the chassis as shown (Figure 2-14). Riser Board hp procurve access controller 720wl SCROLL SELECT NETWORK UPLINK RESERVED Option Card Retaining Screw Cover Figure Inserting an option card into the 700wl Series chassis Step 3. Be sure that the option card seats firmly. Step 4. Using the screw removed with the option card cover plate, secure the option card to the chassis by inserting the screw and screwdriver through the option card retaining screw cover. Step 5. Make sure the riser board is still perpendicular to the motherboard, and the option card is seated properly in and perpendicular to the riser board. Step 6. Replace the cover, making sure the cover clips secure the riser board, and reinstall the eight screws holding the cover to the chassis. Step 7. Reconnect the power cable. HP ProCurve 1 Port Gigabit-SX Option Card To connect an SC cable to the HP ProCurve 1 Port Gigabit-SX option card, use the LC-to-SC media converter shipped with the card. Make sure you remove the protective covers on the cable connectors before attempting to insert the connector into the card port, and before attempting to connect a cable to the female side of the media converter HP ProCurve Secure Access 700wl Series Installation Guide

31 ACCESS CONTROL SERVER 740WL 3 NETWORK INSTALLATION This chapter describes the installation of your HP ProCurve Access Control Server 740wl on an existing network to allow interoperability and proper network security between all equipment. It consists of the following sections: Getting Started Installation Using the Command Line Interface Installation Using the Administrator Interface Getting Started The network installation procedures in this chapter are performed after the hardware has been installed, as described in Chapter 2, Hardware Installation. The network installation procedures described in this chapter make an HP ProCurve Access Control Server usable on a network. The Access Control Server must always be installed before any Access Controllers are installed. You can perform the initial network configuration of an Access Control Server in one of two ways: Connect a serial console to the Access Control Server s serial console port and use the Command Line Interface (CLI). See Installation Using the Command Line Interface for detailed instructions. Connect the Access Control Server to your network, allowing it to get an IP address using the Dynamic Host Configuration Protocol (DHCP). Then connect to its Administrator Interface with a web browser. See Installation Using the Administrator Interface for detailed instructions. Configuration beyond basic network installation, i.e., the process of customizing the function of an HP ProCurve system to a particular end-user environment, is not described in this manual. Configuration performed after network installation is completed is described in the HP ProCurve Secure Access 700wl Series Management and Configuration Guide. Caution: If you plan to use an option card port (i.e., a fiber gigabit port) as the network uplink port, you must use the CLI to configure the uplink port, and you must not connect the unit to your network until after you have configured the uplink port. When a downlink port is reconfigured to be an uplink port, the default uplink port immediately becomes a downlink port. If either of these ports functions as a 3-1

32 Access Control Server 740wl Network Installation downlink port while it is connected to your network, major problems can occur. Not only will the 700wl Series system detect your network traffic as client traffic and attempt to authenticate and filter it, but it will also respond to all ARP requests, and could eventually hijack all your network traffic. It is not possible to reconfigure the uplink using the browser-based Administrator interface. IP Addressing Considerations An Access Control Server requires a stable IP address so that the Access Controllers under its control can readily identify and communicate with the server. You can either arrange for DHCP to always assign the same IP address to the Access Control Server, or you can manually enter a static IP address. Most commonly, a static IP address is used. The HP ProCurve Access Control Server ships configured by default to obtain its IP address and other information from a Dynamic Host Configuration Protocol (DHCP) server. This means the system will attempt to obtain an IP address as soon as it is connected to the network and is powered up. Note: If you do not want the Access Control Server to attempt to use DHCP, you must configure its IP address before you connect it to the network for the first time. You can configure the Access Control Server without connecting it to the network using a serial console connected to the serial port. See Connecting to a Serial Console on page 3-3. If you do allow the Access Control Server to get its initial address using DHCP, this enables an administrator to connect to the Access Control Server s browser-based Administrator Interface over the network to configure the system s other network parameters. If you elect to obtain the Access Control Server IP address using DHCP, the Access Control Server can also obtain the hostname, domain name, subnet mask, default router address, and primary and secondary DNS server addresses from the DHCP server. Which information it receives depends on how you have configured your DHCP server. If you configure your DHCP server to assign the same IP address to the Access Control Server every time, then even after a factory reset (which clears all configuration changes and returns the system to its default settings) the Access Control Server will obtain the correct IP address upon a reboot. If you elect to use a static IP address, you will need to reconfigure the address after a factory reset. To install an Access Control Server onto a network, you need the information shown in Table 3-1: Table 3-1. Installation parameters Parameter Access Control Server hostname (optional) Description Not required. Must be fully qualified if provided. Example: am21b.corp.com 3-2 HP ProCurve Secure Access 700wl Series Installation Guide

33 ON HDD hp procurve access control server 740wl J8154A SCROLL SELECT Access Control Server 740wl Network Installation Table 3-1. Installation parameters Parameter Domain name (optional) Access Control Server IP address Subnet mask (Netmask) Gateway (default router) IP address Primary and secondary DNS server IP addresses Access Control Server shared secret Description Defines the Access Control Server s domain if a hostname is not provided. Optional. Example: corp.com This can be assigned as a static IP address or can be obtained via DHCP. Defines the Access Control Server s subnet range. Can be obtained via DHCP. Example: Defines the default router. Can be obtained via DHCP. Defines the location of the primary and backup DNS servers. Can be obtained via DHCP. Secret key used to establish trust relationship with an Access Controller. Alphanumeric string. The same shared secret must be configured on the Access Controller. Installation Using the Command Line Interface You can connect a serial console to the Access Control Server s serial console port, and then configure the Access Control Server s network settings using the CLI. Connecting to a Serial Console To use the CLI, you must first connect a cable from the serial port male DB9 connector on the Access Control Server to a serial console. (Figure 3-1). NETWORK UPLINK Access Control Server 740wl Serial Cable External Management System Figure 3-1. Connecting an Access Control Server 740wl to a Serial Console Typically, the serial console is a terminal emulator running on another management computer that is usually equipped with a male DB9 port. If your management computer is so HP ProCurve Secure Access 700wl Series Installation Guide 3-3

34 Access Control Server 740wl Network Installation equipped, you would use a female DB9 to female DB9 crossover serial cable (also known as a null modem cable) to connect the two devices. See Appendix D, Cable and Connector Specifications for the pinout specifications for this connector. Configure the terminal session on your management computer as follows: Baud rate: 9600 Stop bits: 1 Data Bits: 8 Parity: None Flow Control: None Note: Do not connect the Access Control Server to the network at this time. Issuing Commands from the Serial Console Note: See Appendix A for a complete list of commands available for the Command Line Interface (CLI). After you have connected the serial console, follow these steps to configure the Access Control Server network parameters: Step 1. Power up the Access Control Server. You will see a series of messages as the system boots and initializes itself. At the end of the boot and initialization sequence you will see a prompt: HP ProCurve Serial Console Press return for console: Step 2. Press Return and enter admin as the login id and admin as the initial password. login:admin Password: xxxxx The system then displays the command prompt: HP ProCurve Access Control Server #<MAC address> HP 700wl Series@[ ]: If you are using DHCP to supply the IP address, netmask, default router and DNS server IP addresses, go to Step 4. Otherwise, perform Step 3. Step 3. Enter the following commands: set ip <ip address> <netmask> <ip address> is the IP address you want to assign to the Access Control Server. <netmask> is the subnet mask that defines the subnet address range for the Access Control Server. It must be entered in the format xxx.xxx.xxx.xxx for example, set hostname <fully qualified hostname> The hostname must be fully qualified, and it must resolve to the IP address you assign to this Access Control Server. This parameter is optional. set gateway <ip address> 3-4 HP ProCurve Secure Access 700wl Series Installation Guide

35 Access Control Server 740wl Network Installation <ip address> is the address of the default router. set dns <primary dns ip address> <secondary dns ip address> The two DNS IP addresses are the addresses of your primary and secondary DNS servers. The secondary IP address is optional. Step 4. Change the administrator login and password by entering the following command: set admin <login-name> <password> <password> You must enter the password twice. Step 5. Set the shared secret the Access Controllers will use to validate themselves to the Access Control Server as follows: set sharedsecret <secret> <secret> You must enter the shared secret twice. Step 6. If you intend to use a port on an option card as the network uplink port, you must reconfigure the uplink port from the default on-board port (slot 0 port 2) to the port on the option card. Caution: Make sure the Access Control Server is NOT connected to the network when you reconfigure the uplink port. When a downlink port is reconfigured to be an uplink port, the default uplink port immediately becomes a downlink port. If either of these ports functions as a downlink port while it is connected to your network, major problems can occur. Not only will the 700wl Series system detect your network traffic as client traffic, and attempt to authenticate and filter it, but it will also respond to all ARP requests, and could eventually hijack all your network traffic. Enter the following command: set uplink <slot>/<port> <slot> is the slot in which the option card is installed, <port> is the port number. This is always port 1 for a single-port card. Step 7. Connect the Access Control Server Network Uplink port to your network (Figure 3-2 in the next section illustrates the connection of the default (on-board) Network Uplink port). Step 8. Verify that you can access the Administrator Interface from a browser running on a computer system connected to your network through either the fully qualified hostname: hostname> or if you choose not to assign a hostname, through the IP address: address> Step 9. You can now use the browser-based Administrator Interface to complete the configuration of other settings such as the time and date, session logging, SNMP, advanced network settings, the HTTP proxy feature, and wireless data privacy settings. See the HP ProCurve Secure Access 700wl Series Management and Configuration Guide for detailed instructions. Alternatively, you may use the CLI to complete the configuration. HP ProCurve Secure Access 700wl Series Installation Guide 3-5

36 Access Control Server 740wl Network Installation Installation Using the Administrator Interface If you want to perform network installation of your Access Control Server using the browserbased administrator interface, you must connect to the Access Control Server over the network. This requires that you know the IP address of your Access Control Server. You will use this IP address to connect your web browser to the Administrator Interface. Since the Access Control Server by default requests an IP address from a DHCP server, you can use the IP address assigned by the DHCP server to connect to the Administrator Interface. Before you connect your Access Control Server to the network, you can configure the DHCP server to provide a fixed IP address to the Access Control Server. If you do this, then the DHCP server can also provide the netmask, default gateway (router) IP address, and primary and secondary DNS IP addresses. You will only need to change the administrator user ID and password (strongly recommended) and configure the shared secret that enables Access Controllers to communicate with the Access Control Server. If you cannot or do not wish to configure your DHCP server to provide a known address, then in order to connect to the Access Control Server you must determine the IP address supplied by DHCP. The easiest way to do this is by looking at the LCD display on the Control Server. The LCD alternates display of the IP address with display of the date/time and software version number. If you do not have access to the Access Control Server itself, you can find the IP address by examining the logs on your DHCP server to determine which address was given to the Access Control Server. An alternate method is to connect a serial console as described in Installation Using the Command Line Interface, and note the IP address that is contained as part of the CLI prompt. Note: If you plan to use a port on an option card as the network uplink port, you will need to use the serial console interface to change the network uplink port. The uplink port cannot be reconfigured through the browser-based Administrator Interface. See Installation Using the Command Line Interface and specifically Step 6 in the procedure, for instructions. Proceed as follows: Step 1. Connect the Access Control Server Network Uplink port to your network, as shown (Figure 3-2). 3-6 HP ProCurve Secure Access 700wl Series Installation Guide

37 J8154A ON HD1 SCROLL SELECT Access Control Server 740wl Network Installation To Network hp procurve access control server 740wl 1 NETWORK RESERVED UPLINK 2 3 Default Network Uplink Port Access Control Server 740wl Standard Ethernet Cable Figure 3-2. Connecting the Access Control Server to the network through the default Network Uplink port Step 2. Connect a web browser to the Access Control Server by entering a URL of the form: address> where <ip address> is the address assigned to the Access Control Server, or hostname> (if your DNS server is set to resolve this hostname to the IP address provided by your DHCP server). The Administrator Login page appears (Figure 3-3). HP ProCurve Secure Access 700wl Series Installation Guide 3-7

38 Access Control Server 740wl Network Installation Figure 3-3. Administrator Login Step 3. For both the username and password, enter admin, and click Login. The Main Menu (Figure 3-4) appears. Figure 3-4. Main Menu Step 4. Click Network. The Network Configuration page appears, as shown in Figure HP ProCurve Secure Access 700wl Series Installation Guide

39 Access Control Server 740wl Network Installation Figure 3-5. Network Configuration Step 5. If appropriate, enter a fully qualified hostname for this Access Control Server. Step 6. Enter the name of the domain in which this Access Control Server resides. Step 7. If you do not choose to use DHCP, check No for Obtain IP Address via DHCP, and enter the IP Address, netmask, default router address, and primary and secondary DNS IP addresses. Step 8. If you do choose to use DHCP, enter any values not supplied by the DHCP server in the appropriate fields of the network configuration window. If your DHCP server is configured appropriately, the IP address, subnet mask (netmask), default router, and primary and secondary DNS addresses should already be filled in. Step 9. Click Submit Changes. Step 10. Return to the Main Menu (Figure 3-4) and click Admin Authorization. The Admin Authorization Configuration page appears (Figure 3-6). HP ProCurve Secure Access 700wl Series Installation Guide 3-9

40 Access Control Server 740wl Network Installation Figure 3-6. Changing the Administrator Username and Password Step 11. Enter the new username, new password, and confirm the new password. Enable technical support access only if requested to do so by an authorized HP ProCurve support engineer. Step 12. Click Submit Changes. Step 13. Return to the Main Menu (Figure 3-4), and click Shared Secret Authorization. The Shared Secret Authorization page appears (Figure 3-7). Figure 3-7. Configure the shared secret for the Access Controllers Step 14. Enter the shared secret that Access Controllers will use to validate themselves to this Access Control Server. Step 15. Click Submit Changes HP ProCurve Secure Access 700wl Series Installation Guide

41 Access Control Server 740wl Network Installation Step 16. Verify that you can access the Administrator Interface from a browser running on a computer system connected to your network through either the fully qualified hostname: hostname> or, if you choose not to assign a hostname, through the IP address: address> Step 17. Return to the Main Menu (Figure 3-4) to complete the configuration of other settings such as the time and date, session logging, SNMP, advanced network settings, the HTTP proxy feature, and wireless data privacy settings. See the HP ProCurve Secure Access 700wl Series Management and Configuration Guide for detailed instructions. HP ProCurve Secure Access 700wl Series Installation Guide 3-11

42 Access Control Server 740wl Network Installation 3-12 HP ProCurve Secure Access 700wl Series Installation Guide

43 ACCESS CONTROLLER 720WL NETWORK 4 INSTALLATION This chapter describes the network installation of your HP ProCurve Access Controller 720wl on an existing network to allow interoperability and proper network security between all equipment. It consists of the following sections: Getting Started Installation Using the Command Line Interface Installation Using the Administrator Interface Completing the Installation Getting Started The network installation procedures in this chapter are performed after the hardware has been installed, as described in Chapter 2, Hardware Installation. The network installation procedures described in this chapter make an HP ProCurve Access Controller usable on a network. The Access Control Server or Integrated Access Manager must always be installed and operational before any Access Controllers. See Chapter 3, Access Control Server 740wl Network Installation or Chapter 5, Integrated Access Manager 760wl Network Installation for instructions on installing an Access Control Server or Integrated Access Manager. You can perform network configuration of an Access Controller in one of three ways: Connect a serial console to the Access Controller s serial console port and use the Command Line Interface (CLI). See Installation Using the Command Line Interface for detailed instructions. Connect a computer, such as a PC or laptop, to one of the Access Controller s Ethernet access ports (also known as downlink ports) using a standard Ethernet cable. Then use a web browser to connect to its Administrator Interface. See Installation Using the Administrator Interface for detailed instructions. Connect the Access Controller to your network, allowing it to get an IP address using the Dynamic Host Configuration Protocol (DHCP). Then connect to its Administrator Interface with a web browser. See Installation Using the Administrator Interface for detailed instructions. Caution: If you plan to use an option card port (i.e., a fiber gigabit port) as the network uplink port, you must use the CLI to configure the uplink port, and you must not connect 4-1

44 Access Controller 720wl Network Installation the unit to your network until after you have configured the uplink port. When a downlink port is reconfigured to be an uplink port, the default uplink port immediately becomes a downlink port. If either of these ports functions as a downlink port while it is connected to your network, major problems can occur. Not only will the 700wl Series system detect your network traffic as client traffic and attempt to authenticate and filter it, but it will also respond to all ARP requests, and could eventually hijack all your network traffic. It is not possible to reconfigure the uplink using the browser-based Administrator interface. Configuration beyond basic network installation, i.e., the process of customizing the function of a 700wl Series system to a particular end-user environment, is not described in this manual. Configuration performed after network installation is completed is described in the HP ProCurve Secure Access 700wl Series Management and Configuration Guide. IP Addressing Considerations The HP ProCurve Access Controller ships configured by default to obtain its IP address and other information from a Dynamic Host Configuration Protocol (DHCP) server. You can configure the Access Controller either to use DHCP to assign the IP address, or you can manually assign a static IP address. Because the Access Controller is configured to use DHCP by default, the system will attempt to obtain an IP address via DHCP as soon as it is connected to the network and powered up for the first time. Note: If you do not want the Access Controller to attempt to use DHCP, you must change its configuration to not use DHCP before you connect it to the network for the first time. You can configure the Access Controller without connecting it to the network either through a serial console connected to the serial port, or using a management system connected through an Access Controller downlink port. If you do allow the Access Controller to get its initial address using DHCP, this enables an administrator to connect to the Access Controller s browser-based Administrator Interface over the network to configure the system s other network parameters. If you elect to obtain the Access Controller IP address using DHCP, the Access Controller can also obtain the hostname, domain name, subnet mask, default router address, primary and secondary DNS server addresses, and the primary and secondary WINS server addresses from the DHCP server. Which information it receives depends on how you have configured your DHCP server. You can also configure a 700wl Series-specific extension to DHCP that provides the Access Controller with the IP address of its Access Control Server and the shared secret used to validate the Access Controller to the Access Control Server. This allows you to place an Access Manager into service without any network installation procedures. Caution: You should not broadcast the shared secret over your network if there is any chance of an unauthorized person sniffing the shared secret. Only use this method 4-2 HP ProCurve Secure Access 700wl Series Installation Guide

45 Access Controller 720wl Network Installation if you are absolutely sure you have a secure network and a trustworthy user community. To install a Access Controller onto a network, you need the information shown in Table 4-1: Table 4-1. Installation parameters Parameter Access Controller Hostname (optional) Domain name (optional) DHCP server IP address Access Controller IP address Subnet mask (Netmask) Gateway (default router) IP address Primary and secondary DNS server IP addresses Primary and secondary WINS server IP addresses (optional). Access Control Server IP address Access Control Server shared secret Description Not required for an Access Controller. Must be fully qualified if provided. Example: am21b.corp.com Defines the Access Controller s domain if a hostname is not provided. Optional. Example: corp.com Optional. Needed only if this Access Controller will have non-nat clients, and there is no DHCP server or DHCPforwarding router on this Access Controller s subnet. This can be assigned as a static IP address or can be obtained via DHCP. Defines the Access Controller s subnet range. Can be obtained via DHCP. Example: Defines the default router. Can be obtained via DHCP. Defines the location of the primary and backup DNS servers. Can be obtained via DHCP. Defines the location of the primary and backup WINS servers. Can be obtained via DHCP. IP address of the Access Control Server or Integrated Access Manager. Can be obtained via DHCP if HP ProCurve-specific extensions are configured. Secret key used to establish trust relationship with the Access Control Server or Integrated Access Manager. Can be obtained via DHCP if HP ProCurve-specific extensions are configured. Alphanumeric string that must match the shared secret configured on the Access Control Server or Integrated Access Manager. Installation Using the Command Line Interface You can connect a serial console to the Access Controller s serial console port, and then configure the Access Controller s network settings using the CLI. The Access Controller does not need to be connected to the network. You can use this method to assign a static IP address to the system, or you can configure it to allow DHCP to assign the address once you have connected the Access Controller to your network. HP ProCurve Secure Access 700wl Series Installation Guide 4-3

46 ON HDD hp procurve access controller 720wl J8153A SCROLL SELECT RESERVED Access Controller 720wl Network Installation Connecting to a Serial Console To use the CLI, you must first connect a cable from the serial port male DB9 connector on the Access Controller to a serial console. (Figure 4-1). NETWORK UPLINK Access Controller 720wl Serial Cable External Management System Figure 4-1. Connecting an Access Controller to a Serial Console Typically, the serial console is a terminal emulator running on another management computer that is usually equipped with a male DB9 port. If your management computer is so equipped, you would use a female DB9 to female DB9 crossover serial cable (also known as a null modem cable) to connect the two devices. See Appendix D, Cable and Connector Specifications for the pinout specifications for this connector. Configure the terminal session on your management computer as follows: Baud rate: 9600 Stop bits: 1 Data Bits: 8 Flow Control: None Parity: None Note: Do not connect the Access Controller to the network at this time. Issuing Commands from the Serial Console Note: See Appendix A for a complete list of commands available for the Command Line Interface (CLI). After you have connected the serial console, follow these steps to configure the Access Controller network parameters: Step 1. Power up the Access Controller. You will see a series of messages as the system boots and initializes itself. At the end of the boot and initialization sequence you will see a prompt: HP ProCurve Serial Console Press return for console: 4-4 HP ProCurve Secure Access 700wl Series Installation Guide

47 Access Controller 720wl Network Installation Step 2. Press Return and enter admin as the login id and admin as the initial password. login:admin Password: xxxxx The system then displays the command prompt: HP ProCurve Access Controller #<MAC address of Access Controller> HP 700wl If you are using DHCP to supply the IP address, netmask, default router, DNS and WINS server IP addresses, go to Step 5. Otherwise, perform Step 3. Step 3. Enter the following commands: set ip <ip address> <netmask> <ip address> is the IP address you want to assign to the Access Controller. <netmask> is the subnet mask that defines the subnet address range for the Access Controller. It must be entered in the format xxx.xxx.xxx.xxx for example, set hostname <fully qualified hostname> The hostname must be fully qualified, and it must resolve to the IP address you assign to this Access Controller. This parameter is optional. set domainname <domainname> <domainname> is the domain name for the Access Controller. This parameter is optional set gateway <ip address> <ip address> is the address of the default router. set dns <primary dns ip address> <secondary dns ip address> The two DNS IP addresses are the addresses of your primary and secondary DNS servers. The secondary IP address is optional. Step 4. If your network is a Windows environment, and WINS servers are needed for client address resolution, enter the IP address of the primary and secondary WINS servers: set wins <primary wins ip address> <secondary wins ip address> The two WINS IP addresses are the addresses of your primary and secondary WINS servers. The secondary IP address is optional. Step 5. If this Access Controller will have non-nat mode clients, and no DHCP server or DHCP-forwarding router exists on the Access Controller s subnet, enter the IP address of a suitable DHCP server: set dhcpserver <ip address> The Access Controller will relay client DHCP requests to this server. Step 6. (Optional but strongly recommended.) Change the administrator login and password by entering the following command: set admin <login-name> <password> <password> You must enter the password twice. Step 7. Set the IP address and shared secret of the Access Control Server as follows: set controlserver <ip address> HP ProCurve Secure Access 700wl Series Installation Guide 4-5

48 Access Controller 720wl Network Installation <ip address> is the IP address of the Access Control Server that manages this Access Controller. set sharedsecret [<secret> <secret>] <secret> must match exactly the secret configured on the Access Control Server. If you enter this command without its arguments, you are prompted for the shared secret and its confirmation. Step 8. If you intend to use a port on an option card as the network uplink port, you must reconfigure the uplink port from the default on-board port (slot 0 port 2) to the port on the option card. Caution: Make sure the Access Controller is NOT connected to the network when you reconfigure the uplink port. Until you reconfigure the option card port as the uplink port, it functions as a downlink port; and as soon as it is configured as the uplink port, the on-board (default) uplink port becomes a downlink port. If either of these ports is connected to the network while it is functioning as a downlink port, serious problems can occur. Enter the following command: set uplink <slot>/<port> <slot> is the slot in which the option card is installed, <port> is the port number. This is always port 1 for a single-port card. Step 9. Connect the Access Controller s Network Uplink port to your network with a standard Ethernet cable (Figure 4-3 in the next section illustrates this connection for the default Network Uplink port). Step 10. From a browser running on a computer system connected to your network, verify that you can access the browser-based Administrator Interface through either the fully qualified hostname of the Access Controller: hostname> or if you chose not to assign a hostname, through the IP address: address> Step 11. You can now use the browser-based Administrator Interface to complete the configuration of other settings such as the time and date, session logging, SNMP, and advanced network settings. See the HP ProCurve Secure Access 700wl Series Management and Configuration Guide for detailed instructions. Alternatively, you may use the CLI to complete the configuration. Step 12. Complete the installation as described in Completing the Installation at the end of this chapter. Installation Using the Administrator Interface There are two ways you can connect to an Access Controller s Administrator Interface using a browser: Connect a computer, such as a PC or laptop, to one of the Access Controller s Ethernet access ports (also known as downlink ports) using a standard Ethernet cable. You should 4-6 HP ProCurve Secure Access 700wl Series Installation Guide

49 J8153A ON HDD Access Controller 720wl Network Installation then be able to connect a browser to the Administrator Interface at IP address With this method, the Access Controller should not be connected to the network. If you do not want to use DHCP to obtain an IP address for the Access Controller, you can use this method to configure a static IP address. Connect the Access Controller to your network, allowing it to get an IP address using the Dynamic Host Configuration Protocol (DHCP). You can then determine the IP address by looking at the LCD display on the front of the Access Controller, and use that IP address to connect a browser to the Administrator Interface over the network. Once you have connected you can configure a static IP address if desired, or continue to allow DHPC to assign the address to this Access Controller. Accessing the Administrator Interface Over a Downlink Port You can connect an external computer to the Access Controller using one of the downlink ports on the front of the chassis. Follow these steps. Step 1. Connect one of the four Ethernet access ports to an external computer system such as a laptop using a 10Base-T/100Base-TX Ethernet standard cable, as shown in Figure 4-2. hp procurve access controller 720wl Access Controller 720wl SCROLL SELECT NETWORK UPLINK RESERVED Downlink Access Port Standard Ethernet Cable External Management System Figure 4-2. Connecting a laptop to an Access Controller downlink port Note: Do not connect the Access Controller to the network at this time. HP ProCurve Secure Access 700wl Series Installation Guide 4-7

50 Access Controller 720wl Network Installation Step 2. Configure the external management system to obtain an IP address using DHCP, then shut down the system. Step 3. Power on the Access Controller. Wait at least 90 seconds. Step 4. Power on the external management system and start its networking function. Step 5. Verify that the external management system has obtained an IP address in the range 42.x.x.x. In general, any device attached through one of the Access Controller ports can always use the IP address as a shorthand way of accessing the Administrator Interface of that Access Controller. Step 6. Set the browser of the external management system to: The Administrator Login page should appear. See Network Configuration Using the Browser-Based Interface to continue the network installation process. Accessing the Administrator Interface Over the Network If you want to access the Access Controller Administrator Interface over the network, you should be familiar with the configuration of your DHCP server. The DHCP server must be configured to assign to the Access Controller not only an IP address, but also to provide the parameters defined in Table 4-1. To connect your browser to the Access Controller over the network, follow these steps: Step 1. Connect the Access Controller s Network Uplink port to your network (Figure 4-3). 4-8 HP ProCurve Secure Access 700wl Series Installation Guide

51 J8153A ON HD1 Access Controller 720wl Network Installation To Network hp procurve access controller 720wl SCROLL SELECT 1 RESERVED NETWORK UPLINK 2 3 Default Network Uplink Port Access Controller 720wl Standard Ethernet Cable Figure 4-3. Connecting the Access Controller to the network using the default Network Uplink port Step 2. Power up the Access Controller. Wait at least 90 seconds. Step 3. Verify that the Access Controller has received an IP address by looking at the LCD display on the front of the chassis. Step 4. Verify that you can access the Administrator Interface from a browser running on a computer system connected to your network by setting the browser to: address> where <ip address> is the IP address that your DHCP server assigned to the Access Controller. The Administrator Login page should appear. See the next section, Network Configuration Using the Browser-Based Interface to continue the network installation process. Network Configuration Using the Browser-Based Interface Note: If you plan to use a port on an option card as the network uplink port, you will need to use the serial console interface to change the network uplink port. The uplink port cannot be reconfigured through the browser-based Administrator Interface. See Installation Using the Command Line Interface and specifically Step 8 in the procedure, for instructions. HP ProCurve Secure Access 700wl Series Installation Guide 4-9

52 Access Controller 720wl Network Installation When you have successfully connected your browser to the Administrator Interface, the Administrator Login page appears (Figure 4-4). Figure 4-4. Administrator Login Step 1. For both the username and password, enter admin, and click Login. The Main Menu page (Figure 4-5) appears. Figure 4-5. Main Menu Step 2. On the Main Menu, click Network. The Network Configuration page appears, as shown in Figure HP ProCurve Secure Access 700wl Series Installation Guide

53 Access Controller 720wl Network Installation Figure 4-6. Network Configuration Note: If you plan to continue to have DHCP supply the Access Controller s IP address, you only need to enter information in the following steps if your DHCP server has not already provided it. Step 3. Type a hostname as a fully qualified name. Assigning a hostname is optional for an Access Controller. If you enter a hostname, the DNS at your site must be able to resolve the hostname to the IP address you select. Step 4. Type the name of the domain in which this system resides. This will be used as the default domain, and appended to any host names that are not fully qualified. This is also optional. Step 5. If this Access Controller is going to send client DHCP requests to a DHCP server that is not on the same subnet, and not accessible via a DHCP-forwarding router, type the address of the DHCP server in the DCHP Server IP field. This enables the Access Controller to relay the client s DHCP request to the DHCP server at the specified address. Leave this field blank if DHCP server requests are handled on this Access Controller s subnet. Note: This applies only to clients that are not using Network Address Translation (NAT), since a network-address translated client will have its DHCP request satisfied by the Access Manager itself. HP ProCurve Secure Access 700wl Series Installation Guide 4-11

54 Access Controller 720wl Network Installation Step 6. If you do not choose to use DHCP to obtain the Access Controller s IP address, click No to Obtain IP Address via DHCP? and enter the information in the following fields: Type the IP address of your system. Choose the Netmask address from the drop-down box. Type the Default Router IP address. Type the Primary DNS server IP address, and if applicable, the Secondary DNS server IP address. If applicable, type the Primary WINS and Secondary WINS addresses. Step 7. Click Submit Changes to save your settings. Step 8. Return to the Main Menu, and click Admin Authorization to change the administrator login name and password. The Admin Authorization Configuration page appears (Figure 4-7). Figure 4-7. Admin Authorization Configuration Step 9. Type the new username, new password, and confirm the password. Note: Enable technical support access only if requested by an authorized technical support engineer. Click Submit Changes to save your settings. Step 10. On the Main Menu, click Control Server. The Specify Control Server page appears (Figure 4-8) HP ProCurve Secure Access 700wl Series Installation Guide

55 Access Controller 720wl Network Installation. Figure 4-8. Specify Control Server and Enter Shared Secret Step 11. Enter the IP address and Secret Key (shared secret) of the Access Control Server or Integrated Access Manager that manages this Access Controller. The Secret Key must match the shared secret you configured on your Access Control Server or Integrated Access Manager. You must enter the secret twice to confirm that you have entered it correctly. If you use DHCP to set the IP address and shared secret, you can confirm that the IP address is what you expect. The secret key is not displayed, however. Step 12. Click Submit Changes to save your settings. Step 13. Return to the Main Menu (Figure 4-5) to complete the configuration of other settings such as the time and date, session logging, SNMP, advanced network settings, the HTTP proxy feature, and wireless data privacy settings. See the HP ProCurve Secure Access 700wl Series Management and Configuration Guide for detailed instructions. Step 14. Complete the Installation as described in the next section. Completing the Installation If you have configured the Access Controller offline (while disconnected from the network) you must complete the installation by connecting the unit to your network using the Network Uplink port and a standard 10Base-T/100Base-TX/1000Base-T Ethernet cable. If the system was configured to use a static IP address, the system should now be accessible via its web server by specifying either the system hostname or its IP address from an external web browser. If the system was configured to obtain an IP address from a DHCP server, then it should obtain one within seconds after connecting to the IP network. Step 1. Verify the system name and IP address. If you configured the system over the network, you can skip this step. HP ProCurve Secure Access 700wl Series Installation Guide 4-13

56 Access Controller 720wl Network Installation If you used a management system connected to an access port to configure the system: With management system still connected to the access port, reconnect to the Administrator Interface at and verify that the system reports its correct name and IP address on the Network Configuration page. You may now disconnect the management system and the standard Ethernet cable. If you configured the system using a serial console connected to the serial port: With the serial console still connected, enter the command: show ip and verify that the information displayed is correct. You can now disconnect the serial console. Step 2. Complete the installation by connecting one or more wireless access points to the Access Manager downlink ports, using standard (straight-through) 10Base-T/ 100Base-TX Ethernet cables. The ports on the Access Controller are labeled 1 to 4, reading from left to right, as shown in Figure 4-9. Each Cluster LED corresponds to one port as shown Left LED Right LED Cluster LEDs Figure 4-9. Access Port Labeling on Access Controller 720wl Table 4-2 shows the possible states for each LED and the meaning of each state. Table 4-2. Port LED Status Indicators LED Left LED Right LED Cluster LEDs State and Meaning Off: No activity Blinking: Data transfer Off: No link/no connection On: Link established, good connection Not used 4-14 HP ProCurve Secure Access 700wl Series Installation Guide

57 INTEGRATED ACCESS MANAGER 760WL 5 NETWORK INSTALLATION This chapter describes the network installation of your Integrated Access Manager 760wl on an existing network to allow interoperability and proper network security between all equipment. It consists of the following sections: Getting Started Installation Using the Command Line Interface Installation Using the Administrator Interface Completing the Installation Getting Started The network installation procedures in this chapter are performed after the hardware has been installed, as described in Chapter 2, Hardware Installation. The network installation procedures described in this chapter make an HP ProCurve Integrated Access Manager 760wl usable on a network. The Integrated Access Manager must always be installed and operational before any additional Access Controllers are installed. You can perform network configuration of an Integrated Access Manager in one of three ways: Connect a serial console to the Integrated Access Manager s serial console port and use the Command Line Interface (CLI). See Installation Using the Command Line Interface for detailed instructions. Connect a computer, such as a PC or laptop, to one of the Integrated Access Manager s Ethernet access ports (also known as downlink ports) using a standard Ethernet cable. Then use a web browser to connect to its Administrator Interface. See Installation Using the Administrator Interface for detailed instructions. Connect the Integrated Access Manager to your network, allowing it to get an IP address using the Dynamic Host Configuration Protocol (DHCP). Then connect to its Administrator Interface with a web browser. See Installation Using the Administrator Interface for detailed instructions. Caution: If you plan to use an option card port (i.e., a fiber gigabit port) as the network uplink port, you must use the CLI to configure the uplink port, and you must not connect the unit to your network until after you have configured the uplink port. Before you reconfigure the option card port as the uplink port, it will function as a downlink 5-1

58 Integrated Access Manager 760wl Network Installation port; and as soon as it becomes the uplink port, the on-board (default) uplink port becomes a downlink port. If either of these ports is connected to the network while it is functioning as a downlink port, serious problems can occur. It is not possible to reconfigure the uplink using the browser-based Administrator Interface. Configuration beyond basic network installation the process of customizing the function of a 700wl Series system to a particular end-user environment is not described in this manual. Configuration performed after network installation is completed is described in the HP ProCurve Secure Access 700wl Series Management and Configuration Guide. IP Addressing Considerations An Integrated Access Manager requires a stable IP address so that the Access Controllers under its control can readily identify and communicate with the server. You can either arrange for DHCP to always assign the same IP address to the Integrated Access Manager, or you can manually enter a static IP address. Most commonly, a static IP address is used. The HP ProCurve Integrated Access Manager ships configured by default to obtain its IP address and other information from a Dynamic Host Configuration Protocol (DHCP) server. This means that the system will attempt to obtain an IP address via DHCP as soon as it is connected to the network and powered up for the first time. Note: If you do not want the Integrated Access Manager to attempt to use DHCP, you must configure its IP address before you connect it to the network for the first time. You can configure the Integrated Access Manager without connecting it to the network either through a serial console connected to the serial port, or using a management system connected through an Access (downlink) port. If you do allow the Integrated Access Manager to get its initial address using DHCP, this enables an administrator to connect to the Integrated Access Manager s browser-based Administrator Interface over the network to configure the system s other network parameters. If you elect to obtain the Integrated Access Manager IP address using DHCP, the Integrated Access Manager can also obtain the hostname, domain name, subnet mask, default router address, primary and secondary DNS server addresses, and the primary and secondary WINS server addresses from the DHCP server. Which information it receives depends on how you have configured your DHCP server. If you configure your DHCP server to assign the same IP address to the Integrated Access Manager every time, then even after a factory reset (which clears all configuration changes and returns the system to its default settings) the Integrated Access Manager will obtain the correct IP address upon a reboot. If you elect to use a static IP address, you will need to reconfigure the address after a factory reset. To install an Integrated Access Manager onto a network, you need the information shown in Table 5-1: 5-2 HP ProCurve Secure Access 700wl Series Installation Guide

59 Integrated Access Manager 760wl Network Installation Table 5-1. Installation parameters Parameter Integrated Access Manager hostname (optional) Domain name (optional) DHCP server IP address Integrated Access Manager IP address Subnet mask (Netmask) Gateway (default router) IP address Primary and secondary DNS server IP addresses Primary and secondary WINS server IP addresses (optional). Access Controller shared secret Description Not required. Must be fully qualified if provided. Example: am21b.corp.com Defines the Integrated Access Manager s domain if a hostname is not provided. Optional. Example: corp.com Optional. Needed only if this Integrated Access Manager will have non-nat clients, and there is no DHCP server or DHCP forwarding router on this Integrated Access Manager s subnet. Can be configured as a static IP address or can be obtained via DHCP. Defines the Integrated Access Manager s subnet range. Can be obtained via DHCP. Example: Defines the default router. Can be obtained via DHCP. Defines the location of the primary and backup DNS servers. Can be obtained via DHCP. Defines the location of the primary and backup WINS servers. Can be obtained via DHCP. Secret key used to establish trust relationship with an Access Controller. Alphanumeric string. The same shared secret must be configured on the Access Controller. Installation Using the Command Line Interface You can connect a serial console to the Integrated Access Manager s serial console port, and then configure the Integrated Access Manager s network settings using the CLI. The Integrated Access Manager does not need to be connected to the network. You can use this method to assign a static IP address to the system, or you can configure it to allow DHCP to assign the address once you have connected the Integrated Access Manager to your network. Connecting to a Serial Console To use the CLI, you must first connect a cable from the serial port male DB9 connector on the Integrated Access Manager to a serial console. (Figure 5-1). HP ProCurve Secure Access 700wl Series Installation Guide 5-3

60 ON HDD hp procurve integrated access manager 760wl J8155A SCROLL SELECT RESERVED Integrated Access Manager 760wl Network Installation NETWORK UPLINK Integrated Access Manager 760wl External Management System Serial Cable Figure 5-1. Connecting an Integrated Access Manager 760wl to a Serial Console Typically, the serial console is a terminal emulator running on another management computer that is usually equipped with a male DB9 port. If your management computer is so equipped, you would use a female DB9 to female DB9 crossover serial cable (also known as a null modem cable) to connect the two devices. See Appendix D, Cable and Connector Specifications for the pinout specifications for this connector. Configure the terminal session on your management computer as follows: Baud rate: 9600 Stop bits: 1 Data Bits: 8 Parity: None Flow Control: None Note: Do not connect the Integrated Access Manager to the network at this time. Issuing Commands from the Serial Console Note: See Appendix A for a complete list of commands available for the Command Line Interface (CLI). After you have connected the serial console., follow these steps to configure the Integrated Access Manager network parameters: Step 1. Power up the Integrated Access Manager. You will see a series of messages as the system boots and initializes itself. At the end of the boot and initialization sequence you will see a prompt: HP ProCurve Serial Console Press return for console: Step 2. Press Return and enter admin as the login id and admin as the initial password. login:admin Password: xxxxx 5-4 HP ProCurve Secure Access 700wl Series Installation Guide

61 Integrated Access Manager 760wl Network Installation The system then displays the command prompt: HP ProCurve Integrated Access Manager#<MAC address> HP 700wl If you are using DHCP to supply the IP address, netmask, default router, DNS and WINS server IP addresses, go to Step 5. Otherwise, perform Step 3. Step 3. Enter the following commands: set ip <ip address> <netmask> <ip address> is the IP address you want to assign to the Integrated Access Manager. <netmask> is the subnet mask that defines the subnet address range for the Integrated Access Manager. It must be entered in the format xxx.xxx.xxx.xxx for example, set hostname <fully qualified hostname> The hostname must be fully qualified, and it must resolve to the IP address you assign to this Integrated Access Manager. This parameter is optional. set domainname <domainname> <domainname> is the domain name for the Integrated Access Manager. This parameter is optional. set gateway <ip address> <ip address> is the address of the default router. set dns <primary dns ip address> [<secondary dns ip address>] The two DNS IP addresses are the addresses of your primary and secondary DNS servers. The secondary IP address is optional. Step 4. If your network is a Windows environment, and WINS servers are needed for client address resolution, enter the IP address of the primary and secondary WINS servers: set wins <primary wins ip address> [<secondary wins ip address>] The two WINS IP addresses are the addresses of your primary and secondary WINS servers. The secondary IP address is optional. Step 5. If this Integrated Access Manager will have non-nat mode clients, and no DHCP server or DHCP-forwarding router exists on the Integrated Access Manager s subnet, enter the IP address of a suitable DHCP server: set dhcpserver <ip address> The Integrated Access Manager will relay client DHCP requests to this server. Step 6. Set the IP address and shared secret of the Integrated Access Manager as follows: set sharedsecret [<secret> <secret>] If you enter the command without its arguments, you are prompted for the shared secret. You must enter the shared secret twice. Step 7. (Optional but strongly recommended.) Change the administrator login and password by entering the following command: set admin <login-name> <password> <password> You must enter the password twice. HP ProCurve Secure Access 700wl Series Installation Guide 5-5

62 Integrated Access Manager 760wl Network Installation Step 8. If you intend to use a port on an option card as the network uplink port, you must reconfigure the uplink port from the default on-board port (slot 0 port 2) to the port on the option card. Caution: Make sure the Integrated Access Manager is NOT connected to the network when you reconfigure the uplink port. Until you reconfigure the option card port as the uplink port, it functions as a downlink port; and as soon as it becomes the uplink port, the on-board (default) uplink port becomes a downlink port. If either of these ports is connected to the network while it is functioning as a downlink port, major problems can occur. Enter the following command: set uplink <slot>/<port> <slot> is the slot in which the option card is installed, <port> is the port number. This is always port 1 for a single-port card. Step 9. Connect the Integrated Access Manager Network Uplink port to your network with a standard Ethernet cable (Figure 5-3 in the next section illustrates this connection for the default Network Uplink port). Step 10. From a browser running on a computer system connected to your network, verify that you can access the browser-based Administrator Interface through either the fully qualified hostname of the Integrated Access Manager: hostname> or if you chose not to assign a hostname, through the IP address: address> Step 11. You can now use the browser-based Administrator Interface to complete the configuration of other settings such as the time and date, session logging, SNMP, and advanced network settings. See the HP ProCurve Secure Access 700wl Series Management and Configuration Guide for detailed instructions. Alternatively, you may use the CLI to complete the configuration. Step 12. Complete the installation as described in Completing the Installation at the end of this chapter. Installation Using the Administrator Interface There are two ways you can connect to an Integrated Access Manager s Administrator Interface using a browser: Connect a computer, such as a PC or laptop, to one of the Integrated Access Manager s Ethernet access ports (also known as downlink ports) using a standard Ethernet cable. You should then be able to connect a browser to the Administrator Interface at IP address With this method, the Integrated Access Manager should not be connected to the network. If you do not want to use DHCP to obtain an IP address for the Integrated Access Manager, you can use this method to configure a static IP address. 5-6 HP ProCurve Secure Access 700wl Series Installation Guide

63 ON HDD hp procurve integrated access manager 760wl J8155A SCROLL SELECT Integrated Access Manager 760wl Network Installation Connect the Integrated Access Manager to your network, allowing it to get an IP address using the Dynamic Host Configuration Protocol (DHCP). You can then determine the IP address by looking at the LCD display on the front of the Integrated Access Manager, and use that IP address to connect a browser to the Administrator Interface over the network. Once you have connected you can configure a static IP address if desired, or continue to allow DHPC to assign the address to this Integrated Access Manager. Accessing the Administrator Interface Over a Downlink Port You can connect an external computer to the Integrated Access Manager using one of the downlink ports on the front of the chassis. Follow these steps. Step 1. Connect one of the four Ethernet access ports to an external computer system such as a laptop using a 10Base-T/100Base-TX ethernet standard cable, as shown in Figure Integrated Access Manager 760wl NETWORK RESERVED UPLINK Downlink Access Port Standard Ethernet Cable External Management System Figure 5-2. Connecting a laptop to an Integrated Access Manager downlink port Note: Do not connect the Integrated Access Manager to the network at this time. Step 2. Configure the external management system to obtain an IP address using DHCP, then shut down the system. Step 3. Power on the Integrated Access Manager. Wait at least 90 seconds. Step 4. Power on the external management system and start its networking function. HP ProCurve Secure Access 700wl Series Installation Guide 5-7

64 Integrated Access Manager 760wl Network Installation Step 5. Verify that the external management system has obtained an IP address in the range 42.x.x.x. In general, any device attached through one of the Integrated Access Manager access ports can always use the IP address as a shorthand way of accessing the Administrator Interface of that Integrated Access Manager. Step 6. Set the browser of the external management system to: The Administrator Login page should appear. See Network Configuration Using the Browser-Based Interface to continue the network installation process. Accessing the Administrator Interface Over the Network If you want to access the Integrated Access Manager Administrator Interface over the network, you should be familiar with the configuration of your DHCP server. The DHCP server should be configured to assign to the Integrated Access Manager not only an IP address, but also to provide the parameters defined in Table 4-1. To connect your browser to the Integrated Access Manager over the network, follow these steps: Step 1. Connect the Integrated Access Manager s Network Uplink port to your network (Figure 5-3). 5-8 HP ProCurve Secure Access 700wl Series Installation Guide

65 J8155A ON Integrated Access Manager 760wl Network Installation To Network HD1 hp procurve integrated access manager 760w l SCROLL SELECT 1 NETWORK RESERVED UPLINK 2 3 Default Network Uplink Port Integrated Access Manager 760wl Standard Ethernet Cable Figure 5-3. Connecting the Integrated Access Manager to the network using the Uplink port Step 2. Power up the Integrated Access Manager. Wait at least 90 seconds. Step 3. Verify that the Integrated Access Manager has received an IP address by looking at the LCD display on the front of the chassis. Step 4. Verify that you can access the Administrator Interface from a browser running on a computer system connected to your network by setting the browser to: address> where <ip address> is the IP address that your DHCP server assigned to the Integrated Access Manager (as shown on the LCD display on the system chassis). The Administrator Login page should appear. See the next section, Network Configuration Using the Browser-Based Interface to continue the network installation process. Network Configuration Using the Browser-Based Interface Note: If you plan to use a port on an option card as the network uplink port, you will need to use the serial console interface to change the network uplink port. The uplink port cannot be reconfigured through the browser-based Administrator Interface. See Installation Using the Command Line Interface and specifically Step 8 in the procedure, for instructions. HP ProCurve Secure Access 700wl Series Installation Guide 5-9

66 Integrated Access Manager 760wl Network Installation When you have successfully connected your browser to the Administrator Interface, the Administrator Login page appears (Figure 5-4). Figure 5-4. Administrator Login Step 1. For both the username and password, enter admin, and click Login. The Main Menu page (Figure 5-5) appears. Figure 5-5. Main Menu Step 2. Click Network. The Network Configuration page appears, as shown in Figure HP ProCurve Secure Access 700wl Series Installation Guide

67 Integrated Access Manager 760wl Network Installation Figure 5-6. Network Configuration Note: If you plan to continue to have DHCP supply the Integrated Access Manager s IP address, you only need to enter information in the following steps if your DHCP server has not already provided it. Step 3. Type a hostname as a fully qualified name. Assigning a hostname is optional for an Integrated Access Manager. If you enter a hostname, the DNS at your site must be able to resolve the hostname to the IP address you select. Step 4. Type the name of the domain in which this system resides. This will be used as the default domain, and appended to any host names that are not fully qualified. This is also optional. Step 5. If this Integrated Access Manager is going to send client DHCP requests to a DHCP server that is not on the same subnet, and not accessible via a DHCP-forwarding router, type the address of the DHCP server in the DCHP Server IP field. This enables the Integrated Access Manager to relay the client s DHCP request to the DHCP server at the specified address. Leave this field blank if DHCP server requests are handled on this Integrated Access Manager s subnet. Note: This applies only to clients that are not using Network Address Translation (NAT), since a network-address translated client will have its DHCP request satisfied by the Integrated Access Manager itself. HP ProCurve Secure Access 700wl Series Installation Guide 5-11

68 Integrated Access Manager 760wl Network Installation Step 6. If you do not choose to use DHCP to obtain the Integrated Access Manager s IP address, click No to Obtain IP Address via DHCP? and enter the information in the following fields: Type the IP address of your system. Choose the Netmask address from the drop-down box. Type the Default Router IP address. Type the Primary DNS server IP address, and if applicable, the Secondary DNS server IP address. If applicable, type the Primary WINS and Secondary WINS addresses. Step 7. Click Submit Changes to save your settings. Step 8. Return to the Main Menu, and click Admin Authorization to change the administrator login name and password. The Admin Authorization Configuration page appears (Figure 5-7). Figure 5-7. Admin Authorization Configuration Step 9. Type the new username, new password, and confirm the password. Note: Enable technical support access only if requested by an authorized technical support engineer. Click Submit Changes to save your settings. Step 10. Return to the Main Menu and click Shared Secret Authorization. The Shared Secret Authorization page appears (Figure 5-8) HP ProCurve Secure Access 700wl Series Installation Guide

69 Integrated Access Manager 760wl Network Installation. Figure 5-8. Configure Access Controllers shared secret Step 11. Type and confirm the shared secret that Access Controllers will use to validate themselves to this Integrated Access Manager. Step 12. Click Submit Changes to save your settings. Step 13. Return to the Main Menu (Figure 5-5) to complete the configuration of other settings such as the time and date, session logging, SNMP, advanced network settings, the HTTP proxy feature, and wireless data privacy settings. See the HP ProCurve Secure Access 700wl Series Management and Configuration Guide for detailed instructions. Step 14. Complete the Installation as described in the next section. Completing the Installation If you have configured the Integrated Access Manager offline (while disconnected from the network) you must complete the installation by connecting the unit to your network using the Network Uplink port and a standard 10Base-T/100Base-TX Ethernet cable. If the system was configured to use a static IP address, the system should now be accessible via its web server by specifying either the system hostname or its IP address from an external web browser. If the system was configured to obtain an IP address from a DHCP server, then it should obtain one within seconds after connecting to the IP network. If you configured the system over the network, you can skip step 1. Step 1. Verify that the system is reporting the correct name and IP address: If you used a management system connected to an access port to configure the system: With management system still connected to the access port, reconnect to the Administrator Interface at and verify that the system reports HP ProCurve Secure Access 700wl Series Installation Guide 5-13

70 Integrated Access Manager 760wl Network Installation its correct name and IP address on the Network Configuration page. You may now disconnect the management system and the crossover Ethernet cable. If you configured the system using a serial console connected to the serial port: With the serial console still connected, enter the command: show ip and verify that the information displayed is correct. You can now disconnect the serial console. Step 2. Complete installation by connecting one or more wireless access points to the Access Manager downlink ports, using standard (straight-through) 10Base-T/100Base- TX/1000Base-T Ethernet cables. The ports on the Integrated Access Manager are labeled 1 to 4, reading from left to right, as shown in Figure 5-9. Each Cluster LED corresponds to one port as shown Left LED Right LED Cluster LEDs Figure 5-9. Access Port Labeling on Access Controller 720wl Table 5-2 shows the possible states for each LED and the meaning of each state. Table 5-2. Port LED Status Indicators LED Left LED Right LED Cluster LEDs State and Meaning Off: No activity Blinking: Data transfer Off: No link/no connection On: Link established, good connection Not used 5-14 HP ProCurve Secure Access 700wl Series Installation Guide

71 TROUBLESHOOTING 6 This chapter presents troubleshooting procedures for the 700wl Series system. Table 6-1 shows the symptoms, probable cause and recommended action for a non-responsive unit. Table 6-1 Troubleshooting Guide Symptom(s) Probable Cause Recommended Action Power LED Off No Power Check power cord and AC outlet Power LED on but fans not running No response on interface Unit inaccessible from customer network after configuration Defective Fan Improper Ethernet Cable Network uplink connected before configuration Management system not configured correctly Link Activity LED not lit Incorrect Cabling Replace Fan Use standard (straight-through) Ethernet cable Complete configuration before connecting network uplink Ensure management system received an IP address from unit in /24 Check connections and cables Connect serial management console to check if unit responds. If no response, check null modem cable, DB9 connectors, terminal emulation software. Command line interface should prompt with IP address of unit ( or actual IP address). The address which shows up will be the real ip address once it has been configured. If not power cycle unit and watch for boot sequence. 1. Use straight-through Ethernet Cable. 2. Ensure connectivity to network 6-1

72 Troubleshooting Table 6-1 Troubleshooting Guide (Continued) Symptom(s) Probable Cause Recommended Action Unit inaccessible from management system after configuration Incorrect configuration Incorrect network configuration If all else fails Access system through network uplink, check configuration. Check in particular that IP address and hostname are correct, and that hostname agrees with IP address. 1. Check default router. 2. Check DNS server configuration 3. Check subnet mask 4. Check configuration of unit to use DHCP or static IP address. 1. Reboot using command line interface. 2. Restart management system 3. Restore to factory defaults and start over Can t get to Access Incorrect password 1. Check configuration, particularly Control Server or Rights passwords Manager 2. Use CLI to reset passwords No traffic through access No connection 1. Check cabling to access point. point 2. Use cross-over cable if required Access Point requires server for WEP Key Access Point requires configuration 3. Check power to Access Point Create LOGON group for MAC address of Access Point that allows this traffic for each Access Point. If Access Point uses static IP or wants a dynamic IP address from the network DHCP server, make sure the 700wl Series system is not doing NAT for Access Point (create LOGON group for MAC address of Access Point that allows Real IP Mode). No initial web page Access Controller sees no Use a browser to request web request Broken Browser Internet Explorer 5.01 with DLL schannel.dll version is known to have broken SSL Certain downrev versions of MAC OS/X browsers have broken SSL 6-2 HP ProCurve Secure Access 700wl Series Installation Guide

73 COMMAND LINE INTERFACE A This appendix documents the commands that are available on the serial console as part of the Command Line Interface (CLI). The CLI enables initial configuration and subsequent troubleshooting of the HP ProCurve Secure Access 700wl Series. The Command Line Interface commands are listed in the following categories: Accessing the Command Line Interface A-1 Getting CLI Command Help A-3 Administrator Access Control Commands A-3 System Status and Information Commands A-4 Network Configuration Commands A-6 Port Configuration Commands A-8 Access Controller Configuration A-10 Access Control Server Configuration A-13 Wireless Data Privacy Configuration A-15 Active Client Management Commands A-17 System Backup, Upgrade, and Shutdown Commands A-19 Diagnostic and Log Commands A-24 Time Configuration A-27 SNMP Configuration and Reporting Commands A-28 Note: You can also configure these functions through the web-based interface. For an alphabetical listing of commands see the Index of Commands at the back of this manual. Accessing the Command Line Interface To use the Command Line Interface, you must connect a serial console to the serial port on an Access Controller, Access Control Server or Integrated Access Manager. The serial console is a terminal emulator running on another management computer. For details on connecting a serial console, see the section Installation Using the Command Line Interface in the Installation Guide for your 700wl Series system. A-1

74 When the serial console establishes a connection, it displays a message Press return for console: When you press return, you are prompted for your administrator login ID and password. To exit the serial console, type the command: exit Command Syntax You may see a variety of symbols shown as part of the command syntax. These symbols explain how to enter the command, and you do not type them as part of the command itself. Table A-1 summarizes command syntax symbols. Table A-1. Command Syntax Symbols Symbol angle brackets < > braces { } vertical bar square brackets [ ] Description Enclose a variable or value. You must specify the variable or value. For example, in the syntax set datetime <date> <time> you must supply a date string for <date> and a time string for <time> when entering the command. Do not type the angle brackets. Enclose a required value or list of required arguments. One or more values or arguments can be specified. For example, in the syntax logoff client {all mac <mac-address>} you must specify either all or mac followed by a MAC address when entering the command. Do not type the braces. Separates mutually exclusive items in a list, one of which must be entered. For example, in the syntax set dhcp on off you can enter set dhcp on or set dhcp off. You cannot combine the options in a single help command. Do not type the vertical bar. Enclose an optional value or a list of optional arguments. For example, in the syntax set dns <ip-address> [<ip-address>] the second IP address (specifying a secondary DNS server) is optional. You can leave it out and specify only a primary DNS server. Do not type the square brackets. Note: Some commands, such as factoryreset, produce a prompt: Are you sure? [n] The value in braces indicates the default value if you just Enter without typing a value. A-2 HP ProCurve Secure Access 700wl Series Installation Guide

75 Getting CLI Command Help The following command provides help for the CLI commands. help [diag help ipsec snmp] Displays a list of commands. When used without an argument, the top-level commands are listed. When a valid argument is specified, a list of commands for a command group are displayed. Many commands, such as add, clear, set, or show, can be used with a large number of arguments. For these commands you can follow the command with a question mark to see a list of the options you can use with the command. For example, to see a list of the possible add commands, type: add? This produces the following output: "add" commands: ad d bridging... Ad d bridging options ad d snmpmanager... Ad d an SNMP authorized manager ad d snmptrapreceiver... Ad d an SNMP trap receiver To see details about one of these commands, you can again use a question mark. For example to see details of the add snmpmanager command, you can type: add snmpmanager? This produces the following output: Usage: add snmpmanager <hostname> <ip-address>[/<mask>] Administrator Access Control Commands The following commands configure web, console, and technical support access to the HP ProCurve system: set admin <login-name> [<password> <password>] Changes the console and web administrator login and password. Prompts for password if not entered on the command line. clear admin Removes the console and web administrator login and password. No login or password is required to access either Administration interface if the login and password have been cleared. show admin Shows the current administrator login. The password is not displayed. HP ProCurve Secure Access 700wl Series Installation Guide A-3

76 set remote on off Enables or disables remote technical support access. The default is disabled. This should be enabled only at the direction of HP customer support personnel. show remote Displays the current remote technical support access setting. System Status and Information Commands show status Displays an overview of the system status. For a Access Control Server, this command includes up time and the IP address, MAC address and connect time for each connected Access Controller. For an Access Controller, this command includes up time and the IP address and the connect time for itsaccess Control Server or Integrated Access Manager. For an Integrated Access Manager, this command includes a combination of the Access Control Server and Access Controller status. The output for an Integrated Access Manager 760wl appears similar to the following: Uptime: 4 hrs, 50 mins Access Controller Function A ccess Control Server: Use Integrated Server A ctive Clients: None Access Control Server Function E nabled: Yes A ccess Controllers: 1 connected MAC Addr ess IP A ddress Co nnected 00:e0:18 :7d:b5:3d hrs, 50 mins show id Displays this system s ID, which is the MAC address of the Slot 0 port 0. show ether [status] Displays the configuration and status of the interface(s) in the system. The port currently configured as the uplink port has Uplink appended to the end of the status entry for that interface. The default form of the command (show ether) displays the MAC Address, interface name, and supported media types (in parentheses) of each interface, as shown in the following example: System Board: 1 Ethernet port 0/1: 00: e0:18:7d:b5:3d, sis0, (100baseTX, 10baseT/UTP), Uplink S lot 3: 4 Ethernet ports 3/1: 00: 80:c8:b9:21:60, dc3, (100baseTX, 10baseT/UTP) 3/2: 00: 80:c8:b9:21:5f, dc2, (100baseTX, 10baseT/UTP) A-4 HP ProCurve Secure Access 700wl Series Installation Guide

77 3/3: 00:80:c8:b9:21:5e, dc1, (100baseTX, 10baseT/UTP) 3/4: 00:80:c8:b9:21:5d, dc0, (100baseTX, 10baseT/UTP) The show ether status command displays the MAC Address, the currently configured media type/option, the active media type/option (in parentheses) and the link status, as shown in the following example: Sy stem Board: 1 Ethernet port 0/1: 00:e0:18:7d:b5:3d, autoselect (100baseTX <full-duplex>), active Sl ot 3: 4 Ethernet ports 3/1: 00:80:c8:b9:21:60, autoselect (none), no carrier 3/2: 00:80:c8:b9:21:5f, autoselect (none), no carrier 3/3: 00:80:c8:b9:21:5e, autoselect (none), no carrier 3/4: 00:80:c8:b9:21:5d, autoselect (none), no carrier show slots Shows the card in each slot. The output for an Integrated Access Manager 760wl or Access Controller 720wl with two of the three slots filled appears as follows: Slots: 3 Sy stem Board: 2 Ethernet ports Sl ot 1: Empty Sl ot 2: 4 Ethernet ports Sl ot 3: 4 Ethernet ports show deviceport <device> Shows the port or slot and port for a device. <device> The device name associated with a port, for example, dc0, dc1, sis0. For example, on an Integrated Access Manager 760wl the command: show deviceport sis0 displays the following output: Slot/Port: 0/1 show product Displays the product name. For example, on an Integrated Access Manager 760wl, this command displays: Integrated Access Manager show serial Displays the product serial number. The output is similar to the following: 10-00E0187DB53D HP ProCurve Secure Access 700wl Series Installation Guide A-5

78 show version Displays the current software version. Also shows the alternate (upgrade, downgrade or same) version of the software, if one exists on the system. The output is similar to the following: Versi on Build Date Install Date Active: Feb :21: Feb 25 12:37: Alt: Feb 7 01:22: Feb 11 19:45: downgrade Network Configuration Commands set hostname <hostname> Sets the system s hostname. The system hostname is also used as the SNMP system name. If you set a hostname, it must be resolvable through DNS. <hostname> The fully qualified host name of the system. clear hostname Clears the system s hostname. set domainname <domainname> Sets the domain name for a system that has not been configured with a hostname. The domain name is used to identify the domain of the system. In commands that take a hostname as an argument, such as ping or nslookup, if the hostnames are not qualified, this domain name is appended to the hostname. clear domainname Clears the domain name. set ip { <ip-address> [<netmask>] <ip-address>/<maskbits> } Sets a static IP address for the device. <ip-address> The IP address to be assigned to the interface. <netmask> The subnet mask, in the form xxx.xxx.xxx.xxx (e.g., ). <maskbits> The subnet mask, specified as the number of bits in the mask. For example, /30 is the equivalent of ; /24 is the equivalent of A-6 HP ProCurve Secure Access 700wl Series Installation Guide

79 show ip Shows the current IP configuration. Output from this command looks similar to the following: Hostname: Domain Name: xyzcorp.com IP address: /24 DHCP enabled: No Default gateway: DHCP server: None configured DNS servers: WINS servers: None configured set gateway <ip-address> Sets the IP address of the default router. clear gateway Clears the gateway IP address (resets to ). This is the equivalent of the command set gateway set dhcp on off Enables dynamically assigned IP address configuration for this system. If disabled the system s IP address, subnet (netmask), gateway, and DNS servers must be set manually. The default (at factory reset) is ON. set dhcpserver <ip-address> Sets the IP address to be used as a DHCP server for clients connected to an Access Controller that does not use NAT. <ip-address> The DHCP server IP address. clear dhcpserver Resets the currently configured DHCP server value. show dhcpserver Shows the currently configured DHCP server value, or Not Set if no DHCP server is configured. set dns <primary-ip-address> [<secondary-ip-address>] Sets the IP addresses of the DNS servers. <primary-ip-address> The IP address of the primary DNS server for the system. <secondary-ip-address> The IP address of the secondary DNS server for the system (optional). HP ProCurve Secure Access 700wl Series Installation Guide A-7

80 clear dns Clears the IP addresses of the DNS servers. set sharedsecret [<secret> <secret> ] Sets the Access Controller and Access Control Server shared secret. Prompts for the secret if not entered on the command line. clear sharedsecret Clears the Access Controller and Access Control Server shared secret. show sharedsecret Shows whether the Access Controller and Access Control Server shared secret is set. The shared secret itself is not displayed. Output from this command is as follows: Shared secret: Set or Shared secret: Not Set Port Configuration Commands The first set of commands in this section can be used on both an Access Controller or Access Control Server. The Access Controller-specific port commands apply only to downlink ports on an Access Controller or Integrated Access Manager. set uplink [<slot>/<port>] Sets the uplink port. <slot>/<port> specifies the port on a Gigabit Ethernet option card. For a single-port card, the port number will be 1. There may be a slight delay before the port switch takes effect. To reset the uplink port to the default network uplink port, enter the set uplink command without a port specification, or use the following port specifications: 0/1 (slot 0 port 1) for a 700wl Series or 5000 Series unit 0/2 (slot 0 port 2) for a 700wl Series unit Caution: Disconnect the system from the network before you issue this command. As soon as you reconfigure the uplink port, the port that was functioning as the uplink port prior to the reconfiguration becomes a downlink port. If it remains connected to your network, serious problems can occur. show uplink Shows the current uplink port. Output from this command is similar to the following: The uplink is configured at: Slot 0 Port 1 A-8 HP ProCurve Secure Access 700wl Series Installation Guide

81 show portmedia <port> <slot>/<port> Shows the port media settings for the specified port or slot and port. For example, the command: show portmedia 3/1 displays output similar to the following: Port 3/1 media settings Po rt status: active C onfigured setting: autoselect Ac tive port setting: 100baseTX full-duplex S upported settings: autoselect 100b asetx full-duplex 100b asetx 10ba set/utp full-duplex 10ba set/utp none Port status can be active or no carrier. Configured setting is the current setting as configured through the set portmedia command (or through the Advanced Network Settings page of the Administrative Notifies). Active port setting is the setting actually in effect. For example, if the configured setting is autoselect, the Active port setting will be the actual setting as autonegotiated with the client device (computer, access point, hub, switch, etc.). Supported settings lists the valid (supported) settings for the port. Any of these may be used with the set portmedia command for this port. set portmedia {<port> <slot>/<port>} "<media> [<media-option>]" Sets the port media setting for the specified port or slot and port. <port> <slot>/<port> <media> <media-option> The port, or slot and port on which to set the media type and option. The media type, for example 100baseTX or 10baseT/UTP. Must match one of the valid media types for the port, as displayed in the show portmedia command for the port. A media option, for example full-duplex. This is not required. If used, the media plus media-option specification (within the quotes) must match one of the valid settings for the port as displayed by the show portmedia command for the port. You can use the show portmedia command to get a list of supported media and media option settings. clear portmedia <port> <slot>/<port> Clears the port media setting for the specified port or slot and port. The setting reverts to autoselect. HP ProCurve Secure Access 700wl Series Installation Guide A-9

82 Access Controller Port Configuration Commands The following commands are available only from an Access Controller or Integrated Access Manager. set portip { <port> <slot>/<port> } <ip-address> <netmask> Sets the IP address and subnet mask for the specified port. <port> <slot>/<port> <ip-address> <netmask> The port, or slot and port to which the IP address is to be assigned. The IP address to be assigned to the interface. The subnet mask, in the form xxx.xxx.xxx.xxx (e.g., ). The /<maskbits> form (e.g., /24) cannot be used in this command. clear portip <port> <slot>/<port> Clears the IP address and subnet mask for the specified port or slot and port. show portip Displays the current IP address and netmask settings, if set, for all ports in the system. Output from this command is similar to the following: Port settings S lot 1 Port 1 S lot 1 Port 2 S lot 1 Port 3 S lot 1 Port 4 S lot 2 Port 1 S lot 2 Port 2 S lot 2 Port 3 S lot 2 Port 4 S lot 3 Port 1 S lot 3 Port 2 S lot 3 Port 3 S lot 3 Port 4 IP: Not set IP: IP: IP: Not set IP: Not set IP: Not set IP: Not set IP: Not set IP: Not set IP: Not set IP: Not set IP: Not set Net mask: Net mask: Access Controller Configuration The commands in this section are available only on an Access Controller or an Integrated Access Manager. The exceptions are the set controlserver, clear controlserver, and show controlserver commands, which are not available on an Integrated Access Manager. set controlserver <ip-address> For an Access Controller, sets the IP address of its Integrated Access Manager. Note: This command is not available on an Integrated Access Manager. A-10 HP ProCurve Secure Access 700wl Series Installation Guide

83 clear controlserver For an Access Controller, clears the Integrated Access Manager IP address. Note: This command is not available on an Integrated Access Manager. show controlserver For an Access Controller, shows the Integrated Access Manager IP address. Output from this command appears similar to the following: Access Control Server: Note: This command is not available on an Integrated Access Manager. Advanced Network Configuration Caution: Any modifications to the bridging settings will log off all clients. set bridging on off Enables and disables bridging. This command will log off all connected clients. add bridging <pre-defined-type> <quoted-custom-bridging-string> Adds a bridging option. This command will log off all connected clients. <pre-defined-type> <quoted-custombridging-string> One of the following pre-defined bridge types: cdp: Cisco Discovery Protocol wnmp: Wireless Network Access Protocol atalk: AppleTalk A string, enclosed in quotes, that specifies a custom bridging type. See Section 2.4.1, Advanced Network Settings in Chapter 2, and Appendix A, Filter Expression Syntax of the HP ProCurve Secure Access 700wl Series Management and Configuration Guide for a detailed discussion. delete bridging <pre-defined-type> <quoted-custom-bridging-string> Removes a bridging option. See the table under the add bridging command for a specification of the argument values. This command will log off all connected clients. show bridging Shows the current bridging settings. The current bridging types that may appear are: cdp wnmp Cisco Discovery Protocol Wireless Network Access Protocol HP ProCurve Secure Access 700wl Series Installation Guide A-11

84 atalk custom AppleTalk protocol Type was set using a custom bridging string. See Section 2.4.1, Advanced Network Settings in Chapter 2, and Appendix A, Filter Expression Syntax of thehp ProCurve Secure Access 700wl Series Management and Configuration Guide for a detailed discussion. For example, output from this command, if bridging is enabled, is similar to the following: Bridging is enabled Configured bridges: c dp: ether [12:2] <= 1514 and ether dst 01:00:0c:cc:cc:cc w nmp: ether [12:2] = 0x8781 and ether[0:4] = 0x01a0f8f0 c ustom: ether[12:2] = 0x8037 or ether[12:2] = 0x8137 set clientprobes <interval> <timeout> Configures the interval and timeout for the Access Controller client probe, sent to clients that have been idle to determine if they should be disassociated. The interval specifies the length of the idle period before the Access Controller sends a client probe. If a client remains idle, the probe is sent once per interval, until the timeout is reached. The timeout specifies the total length of time to wait, given no response to the client probes, before sending a disassociate message to the Rights Manager. <interval> <timeout> The number of idle seconds to wait before sending a client probe. The default is 30 seconds. The total number of idle seconds to wait before disassociating a client that has been idle and has not responded to repeated probes. This must be at least twice the interval setting. The default is 300 seconds. When a client is disassociated, its MAC address and set of rights are removed from the Access Controller, and the Rights Manager begins the linger timer countdown. If the linger timer expires without any activity from the client, the client will be required to re-authenticate when it resumes activity. show clientprobes Displays the current configuration of the client probe timers. Output from this command is similar to the following: Client probes I nterval: 30 seco nds of idle time T imeout: 300 sec onds of idle time set forwardipbroadcasts { none <port-list>} Specifies the ports that should have IP broadcast forwarding enabled. A-12 HP ProCurve Secure Access 700wl Series Installation Guide

85 none <port-list> Disables IP broadcast forwarding on all ports. A space-separated list of one or more port numbers, in the form <port> or <slot>/<port>. For example: For a Integrated Access Manager 760wl or Access Controller 720wl system, the command to set IP broadcast forwarding on all four ports is: set forwardipbroadcasts For a Integrated Access Manager 760wl, Integrated Access Manager 760wl, Access Controller 720wl, or Access Controller 720wl system the command to set IP broadcast forwarding on all four ports of slot 1 is: set forwardipbroadcasts 1/1 1/2 1/3 1/4 show forwardipbroadcasts Shows the list of ports or slots and ports that have IP broadcast forwarding enabled. For example, output from this command for an Access Controller or Integrated Access Manager with 12 ports appears as follows: Enabled on: 1/1 1/2 1/3 1/4 2/1 2/2 2/3 2/4 3/1 3/2 3/3 3/4 Access Control Server Configuration The following commands are available only on a Access Control Server or Integrated Access Manager, except for the show syslogserver and show natdhcp commands, which are also available on an Access Controller. delete am mac <mac-address> Removes an Access Controller s configuration information (tunneling and HTTP proxy settings) from the Access Control Server s or Integrated Access Manager s database. This command lets you remove the configuration information for an Access Controller that has been disconnected from the system. show am [httpproxy tunnel ] [mac <mac-address>] Shows Access Controller settings for one or all Access Controllers known to the Access Control Server or Integrated Access Manager. The default is to show all settings for all Access Controllers. httpproxy tunnel mac <mac-address> Specifies that HTTP Proxy settings should be displayed Specifies that PPTP/L2TP/IPSec settings should be displayed Specifies the MAC address of an Access Controller The show am command with no parameters shows basic information about the connected Access Controllers, including the length of time they have been running and the software version currently running and the length of time the unit has been up. HP ProCurve Secure Access 700wl Series Installation Guide A-13

86 set am httpproxy mac <mac-address <proxy-ip> <proxy-port> Configures an HTTP Proxy server for one of the Access Controllers configured on this Access Control Server or Integrated Access Manager. <mac-address> <proxy-ip> <proxy-port> Specifies the MAC address of the Access Controller Specifies the IP address of the Proxy Server Specifies the TCP port number used by the Proxy Server clear am httpproxy all mac <mac-address Clears the HTTP proxy setting for a specified Access Controller or for all Access Controllers configured on this Access Control Server or Integrated Access Manager. all mac <mac-address> Specifies that settings for all Access Controllers should be cleared Specifies the MAC address of an Access Controller set syslogserver <ip-address< [<facility>] Sets the IP address of a syslog server, and the logging facility. Setting the syslog server address enables session logging. <ip-address> <facility> The syslog server IP address. The syslog server logging facility. Valid facilities are daemon, user, and local0 - local7. The default is daemon. clear syslogserver Clears the IP address of a Syslog server. This disables session logging. show syslogserver Note: Even though you can only configure the Syslog server address from a Access Control Server or Integrated Access Manager, you can also use the show syslogserver command from an Access Controller to view the syslog settings. Shows the current setting of the syslog server options. A-14 HP ProCurve Secure Access 700wl Series Installation Guide

87 Advanced Network Configuration set natdhcp <ip-address> <subnetmask> [<lease-time> [<time-units>] ] Sets the NAT DHCP subnet and lease time. <ip-address> The DHCP subnet address for NAT. The default is <subnetmask> <lease-time> <time-units> The subnet mask, in the form xxx.xxx.xxx.xxx (e.g., ). The /<maskbits> form (e.g., /24) cannot be used in this command. The length of time a lease remains valid, in units as specified by the time-units parameter. Defaults to 86,400 seconds (one day). The time units in which the lease time is specified. Can be one of seconds, minutes, hours, days, weeks, or months. Default is seconds. clear natdhcp Resets the currently configured internal DHCP server value used for NATed clients. show natdhcp Note: Even though you can only configure the DHCP server NAT address range from the Access Control Server or Integrated Access Manager, you can use the show natdhcp command from an Access Controller to view these settings. Shows the currently configured DHCP server values for NATed clients. Output from this command appears as follows for the default NAT DHCP configuration: NAT IP Base: NAT Subnet Mask: Lease Time: 1 day Wireless Data Privacy Configuration Wireless data privacy is configured and maintained centrally on a Access Control Server or Integrated Access Manager, but the settings are propagated to and are implemented/enforced by the Access Controller. The following commands, except for the show airwave command, are not available on an Access Controller. set pptp on off Enables or disables PPTP. set l2tp on off Enables or disables L2TP. set ipsecsecret [ <secret> <secret>] Sets the IPSec shared secret. Prompts for the secret if not entered on the command line. HP ProCurve Secure Access 700wl Series Installation Guide A-15

88 clear ipsecsecret Clears the IPSec shared secret. set espencryption [des] [3des] [blowfish] [cast] [aes] [none] Sets the IPSec ESP encryption methods. You must specify at least one method. set espintegrity [md5] [sha1] [none] Set the IPSec ESP integrity methods. You must specify at least one method. set ikedh [group1] [group2] [group5] Set the IPSec IKE Diffie-Hellman groups. You must specify at least one group. set ikeencryption [des] [3des] [blowfish] [cast] Set the IPSec IKE encryption methods. You must specify at least one method. set ikeintegrity [md5] [sha1] Set the IPSec IKE integrity methods. You must specify at least one method. set ipsec on of} Enables or disables IPSec. set ssh on off Enables or disables ssh for wireless data privacy. show airwave Note: Even though you can only configure wireless data privacy settings from the Access Control Server or Integrated Access Manager, you can use the show airwave command from an Access Controller to view these settings. Shows the current wireless data privacy settings. Output from this command is similar to the following: IPSec: Disabled IPSec shared secret: Not set IKE Encryption: DES 3-DES IKE Integrity: SHA-1 IKE Diffie-Hellman: Group 1 Group 2 ESP Encryption: DES 3-DES Blowfish ESP Integrity: MD5 SHA-1 PPTP: Enabled L2TP: Enabled Tunnel IP: DHCP Range: Not set SSH: Disabled A-16 HP ProCurve Secure Access 700wl Series Installation Guide

89 set am tunnel mac <mac-address> {dhcp range <ip-address1> <ip-address2>} Sets the range of IP addresses for PPTP, L2TP, and IPSec tunnelling for an Access Controller. These addresses can be obtained through DHCP or within a specified range of addresses. mac <mac-address> dhcp range Specifies the MAC address of the Access Controller. Specifies that the addresses should be obtained via DHCP. Specifies that a range of IP addresses should be used. <ip-address1> defines the first address in the range. <ip-address2> defines the last address in the range. clear am tunnel all mac <mac-address Clears the PPTP, L2TP, and IPSec tunnelling settings for a specified Access Controller or for all Access Controllers connected to this Access Control Server or Integrated Access Manager. all mac <mac-address> Specifies that settings for all Access Controllers should be cleared. Specifies the MAC address of an Access Controller Active Client Management Commands Use these commands to manage Active Clients from an Access Controller or Integrated Access Manager. These commands cannot be used from a Access Control Server. show clients [mac <mac-address>] [sort {mac ip user machine port sessions idle} ] [reverse] Lists all active clients. You can optionally sort the list by a number of criteria. <mac-address> sort reverse MAC (Ethernet) address to display. Specified in the format: xx:xx:xx:xx:xx:xx or xxxxxxxxxxxx (colons are optional). Sort the clients according to one of the following criteria (one must be specified): mac: by MAC address ip: by IP address user: by user name machine: by machine name. (Note that some clients, such as Apple systems, may allow special characters in their names, and these may be displayed differently in this list.) port: by Access Manage port sessions: by number of running sessions idle: by idle time duration Keyword that reverses the order of the display, which normally displays the most recent events first (in ascending order). HP ProCurve Secure Access 700wl Series Installation Guide A-17

90 show client mac <mac-address> [ rights ] Lists active sessions for a client. Shows client rights if requested. <mac-address> MAC (Ethernet) address to display. Specified in the format: rights xx:xx:xx:xx:xx:xx or xxxxxxxxxxxx (colons are optional). Keyword that specifies that the XML that defines the client rights should be included in the display. The following command: show client mac 00:00:86:5a:78:18 rights Produced the following output: User: ann Machine name: ANNMCC-MOBILE MAC address: 00:00:86:5a:78:18 IP address: Address status: NAT mode: rights do not allow use of non-nat IP address Access Controller: Slot/Port: 3/1 Client Rights These rights expire in 48 mins, 43 secs: <?xml version="1.0" standalone="yes"?> <client_rights> <expiry>2923</expiry> <id>ann</id> <allow_real_ip>false</allow_real_ip> <allow_static_ip>false</allow_static_ip> <ip_addr_policy>do_nat</ip_addr_policy> <encryption_required>false</encryption_required> <ipsec> <stance>deny</stance> </ipsec> <pptp> <stance>deny</stance> <mppe_stance>accept</mppe_stance> <mppe_bits>0</mppe_bits> <mppe_stateful>false</mppe_stateful> <min_mschap>0</min_mschap> <allow_pap>false</allow_pap> <allow_chap_md5>false</allow_chap_md5> </pptp>... (client rights abbreviated to save space) </client_rights> Active Sessions Protocol Source Destination Xmit Recv Idle UDP Client: : : s TCP Client: : : m17s TCP Client: : : m28s Actual: : :443 A-18 HP ProCurve Secure Access 700wl Series Installation Guide

91 logoff client {all mac < mac-address> } Logs off a client or all clients. You are asked to confirm this action. all <mac-address> Keyword the specifies that all clients should be logged off. MAC (Ethernet) address of the client to log off. Specified in the format: xx:xx:xx:xx:xx:xx or xxxxxxxxxxxx (colons are optional). System Backup, Upgrade, and Shutdown Commands The following commands support the backup of the current system configuration, and restore of a saved configuration; downloading new software versions; and rebooting, shutting down the system, or resetting it to its factory default configuration. Backup and Restore create backup Creates a backup image. Because this will temporarily disconnect all clients, you are prompted to confirm that you want to do this. The following is an example of the messages that appear on an Integrated Access Manager: Creating a system backup will momentarily shut down this Integrated Access Manager. All client machines will be temporarily disconnected. Are you sure you want to briefly shut down the system and create a backup [n]? If you respond Y to continue with the backup, the following reminder appears: NOTE: After creating the backup image, you must transfer it from this Integrated Access Manager onto your local computer. store backup <url> [<filename>] Stores the backup on another system using FTP. This command can be used only after a backup has been created. <url> <filename> The URL encoded location to store the backup. The format of the URL is ftp://<host> or ftp://<username>[:<password>]@<host> <username>[:<password>] specifies a username and optional password with access to the remote site, if required. The host must be an FTP server. The destination filename for the backup image. The default is hp-yyyy-mmdd. For anonymous FTP, the path is relative to the FTP root. If a username and password is required for FTP, then the full path to the update file must be specified. HP ProCurve Secure Access 700wl Series Installation Guide A-19

92 If you do not have access to an FTP site, you can use the browser-based Administrative Interface to store the file onto the local system. get backup <url> Retrieves a stored backup from another system using FTP. <url> The URL encoded location (including the file name) where the backup is stored. The format of the URL is ftp://<host>/<backupfile> or ftp://<username>[:<password>]@<host>/<backupfile> <username>[:<password>] specifies a username and optional password with access to the remote site, if required. <backupfile> is the filename (including the path) of the backup image. The host must be an FTP server. If the backup file was stored to your local system using the browser-based Administrative Interface, you can use that same interface to retrieve and restore the backup file from your local system. restore backup Restores a retrieved backup. Restoring a system backup reboots the system and replaces all current information (configuration, logs, etc.) with information stored in the backup image. All clients are disconnected by this operation. The only configured setting not replaced by the restore operation is the uplink setting. The uplink will remain as configured on the target system. cancel backup Cancels a running store backup or get backup task. show backup Displays information about the list of local backups and the status of a running store backup or get backup task. Output from this command is similar to the following: Backup image created Nov 25 17:25: No backup image store or get in progress. Upgrading the System Software get upgrade <url> <key> [ reboot version mindowngrade ] Downloads a software release from a specified URL via FTP, HTTP, or TFTP. This starts a background task that can be checked with the show upgrade command. If you do not include the reboot option, the downloaded version is stored as the alternate version, and is not activated until you reboot the system with the alternate version option A-20 HP ProCurve Secure Access 700wl Series Installation Guide

93 included. When you reboot to an alternate version, the new version becomes the installed version, and the previously installed version becomes the alternate. The default URL to get the latest software from HP is: ftp://ftp.hp.com/pub/networking/700software/ambit-hp For a flash-based Access Controller, the default URL is: ftp://ftp.hp.com/pub/networking/700software/ambit-am-hp Command options can be used to do the following: Reboot the unit as soon as the download is complete. This makes the downloaded version the new installed version. Your configuration settings are preserved. Display the release version available for download without actually doing the download. This allows you to verify that the version is appropriate or what you expect before you download it. For the release version available at the URL you specify, display the lowest (oldest) version of the software to which you may downgrade without requiring a factory reset (which will reset the unit to its default settings). This option allows you to determine whether, if you install the version available at the URL, you will be able to revert to your old version without having to do a factory reset. <url> <key> reboot version mindowngrade The URL encoded location of the software release to install. The format of the URL is <protocol>://<host>/<update file> or <protocol>://<username>[:<password>]@<host>/<update file> <protocol> can be ftp, http, or tftp. <username>[:<password>] specifies a username and optional password with access to the remote site, if required. <update file> is the filename (including the path) of the software image. For TFTP or anonymous FTP, the path is relative to the FTP or TFTP root. If a username and password is required for FTP, then the full path to the update file must be specified. For HTTP, the path is always relative to the web server s site root directory. The host must be an FTP, HTTP, or TFTP server. The software release install key obtained from HP ProCurve. Automatically reboot after installing the upgrade. The upgraded software is activated when the system is rebooted. Displays the version of the software available for download at the specified URL. The software is not downloaded and the system is not restarted. For the software version at the specified URL, displays the lowest version to which you may downgrade without requiring a factory reset. The software is not downloaded and the system is not restarted. When you initiate the get upgrade command, messages similar to the following appear: Upgrade download initiated. Status of upgrade started Nov 26 16:35:08... Downloading new image file MB/50.4MB received. Note: Use the show upgrade command to see the current status. HP ProCurve Secure Access 700wl Series Installation Guide A-21

94 When you initiate the get upgrade command using the mindowngrade argument, the version at the URL you specify is compared to the currently running image version. If a factory reset would be required in order to switch between these two versions, then a message similar to the following appears: Minimum downgrade for the version at that URL: <future version here> Installed version: A factory reset would be required to return to the current version after installing the version at that URL. If the current version and the version at the URL are compatible (no factory reset required) then the minimum version to which you could downgrade without a factory reset is reported: Minimum downgrade version: When you initiate the get upgrade command with the version argument, a variety of messages may appear, depending on the relationship between the current (running) version and the version at the URL you specify: The version at that URL is a downgrade(version: ) show upgrade Shows the status of the get upgrade task. The output can be similar to the following: or Status of upgrade started Nov 26 16:35:08... Unpacking image file. Status of upgrade started Nov 26 16:35:08... New image successfully installed Nov 26 16:37:45 cancel upgrade Cancels the current get upgrade task. set upgradeproxy [on off] [host <ip-address> [<port> ] ] [user <user> [<password> ] ] Configure a proxy server for retrieving software releases via FTP. on off Enables and disables the proxy server. <ip-address> Specifies the proxy server IP address. <port> (Optional) TCP port for the proxy server. Default is <user > (Optional) User name needed for access to proxy server. <password> (Optional) User password. clear upgradeproxy Resets the proxy server settings used for retrieving software releases via FTP. A-22 HP ProCurve Secure Access 700wl Series Installation Guide

95 show upgradeproxy Shows the current upgrade proxy server configuration. The following is an example of the output when no proxy is set: Upgrade Proxy settings Proxy enabled: No Host IP: Not set Port: 3128 User: Not set Password: Not set Stopping and Restarting the System reboot [upgrade downgrade same] Restarts the system. Optionally, you can specify that the reboot should use the alternate version of the system software. The alternate version installed on the system must match the type you specify. For example, if the alternate version is a newer version than the current version, it is type upgrade. If the alternate version is an older version, it is type downgrade. Use the show version command to determine the type of the alternate version. You are prompted to confirm that you want to reboot. upgrade downgrade same Reboot using the alternate version, which is a newer version than the currently active system software. Reboot using the alternate version, which is an older version than the currently active system software. Reboot using the alternate version, which is the same version as the currently active system software. shutdown Shuts down the system. You are prompted to confirm that you want to shut down the system: This operation will shutdown this system and users may lose their connections. Are you sure you want to shutdown this system [n]? Resetting to Factory Defaults factoryreset Resets all user configurable data to the factory defaults. This includes all network configuration parameters. For example, if you have set a static IP address using the set ip command, after a factory reset DHCP is enabled and the static IP address is gone. HP ProCurve Secure Access 700wl Series Installation Guide A-23

96 Warning: A factory reset will change a reconfigured uplink port back to the default uplink. If you have reconfigured the uplink port (for example, to make use of a gigabit fiber port on an option card) that port will become a downlink port when the system comes back up after the reset. This can have adverse effects on your network. You are prompted to confirm that you want to do this: This operation will erase all configuration information and return this system to factory default settings. Are you sure you want to perform a factory reset [n]? Caution: ALL configuration changes you have made to your system will be lost when you do a factory reset. It is strongly recommended that you back up your system before doing a factory reset. Diagnostic and Log Commands The following commands may be used to display the 700wl Series system log files, and to diagnose network connectivity problems. show logs [<severity> ] [max <lines> ] [for <count> <time-units>] [search <quoted-text>] [reverse] Displays entries in the error log. You can filter the display with the following arguments: <severity> Show only log entries that match or exceed this severity level: The default is notice. crit: show only critical log entries. err: show both error and critical log entries. warn: show all warning, error and critical log entries. notice: show all notice, warning, error, and critical log entries. info: show all information, notice, warning, error, and critical log entries. <lines> The maximum number of lines to be displayed. The default is 23. <count> <time-unit> <quoted-text> reverse The number of time units to be displayed, in combination with the <time-unit> variable. If no for argument is given, the default is one day. The time unit associated with the <count>. May be one of seconds, minutes, hours, days, weeks, or months (31 days); If no for argument is given, the default is one day. Displays entries containing the specified text string, which must be enclosed in quotes. Keyword that reverses the order of the display, which normally displays the most recent events first. A-24 HP ProCurve Secure Access 700wl Series Installation Guide

97 For example, the command: show logs info max 40 generates output similar to the following: Jul 17 10:34:46: Info: Kernel: IP address moved from 00:02:e3:14:40:3f to 00:bd:2e:dc:75:66 on the network side Jul 17 10:34:46: Info: Kernel: IP address moved from 00:bd:2e:dc:75:66 to 00:02:e3:14:40:3f on the network side Jul 17 10:28:28: Info: Kernel: IP address moved from 00:02:e3:14:40:3f to 00:80:c8:b9:aa:ed on the network side Jul 17 10:28:27: Info: Kernel: IP address moved from 00:80:c8:b9:aa:ed to 00:02:e3:14:40:3f on the network side Jul 17 09:59:20: Info: Kernel: IP address moved from 00:02:e3:14:40:3f to 00:80:c8:b9:aa:ed on the network side Jul 16 17:15:52: Info: Uplink port configured at slot 0, port 1 Jul 16 14:19:59: Error: Kernel: stray irq 7 Jul 16 14:17:10: Info: Uplink port configured at slot 0, port 1 Jul 16 14:16:07: Info: Uplink port configured at slot 0, port 1 Jul 16 14:16:01: Info: DHCP client: lease for to be renewed in 282 seconds Jul 16 14:16:00: Info: Uplink port configured at slot 0, port 1 Jul 16 14:16:00: Notice: DHCP client: new default router is Jul 16 14:16:00: Notice: DHCP client: new DNS server is Jul 16 14:16:00: Info: DHCP client: using IP address /24 Jul 16 14:16:00: Info: DHCP client: received DHCPACK from Jul 16 14:15:59: Info: DHCP client: sending DHCPREQUEST to Jul 16 14:15:59: Info: DHCP client: received DHCPOFFER from Jul 16 14:15:59: Info: DHCP client: sending DHCPDISCOVER to Jul 16 14:15:56: Info: Uplink port configured at slot 0, port 1 Jul 16 14:15:50: Error: Kernel: stray irq 7 Jul 16 14:15:50: Notice: HP process started, version Jul 16 14:15:50: Notice: system was factory reset: requested from console clear logs Clears the error log. nslookup <hostname> Returns the IP address for a hostname. If the hostname is not qualified, the domain name (as specified by the set domainname command) is appended. Translates to: nslookup timeout=10 <hostname> HP ProCurve Secure Access 700wl Series Installation Guide A-25

98 ping {<ip-address> <hostname>} Pings an IP address or a hostname. If the hostname is not qualified, the domain name (as specified by the set domainname command) is appended. Translates to: or ping c 3 <ip-address> ping c 3 <hostname> debug ip [ <slot>/<port>] Shows IP traffic on an interface. The default (no slot/port specified) is the configured uplink. <slot>/<port> The slot and port for which IP traffic should be displayed. This command translates to: tcpdump en i <interface> ip This command displays tcpdump output until you terminate the command with a CTRL-C. Upon termination, the console session is restarted, and you must log in again. debug interface [ <slot>/<port> ] Shows traffic on an interface. The default (no slot/port specified) is the configured uplink. <slot>/<port> The slot and port for which traffic should be displayed. This command translates to: tcpdump en -i <interface> This command displays tcpdump output until you terminate the command with a CTRL-C. Upon termination, the console session is restarted, and you must log in again. debug tcpport <tcp port> [ <slot>/<port> ] Shows specified TCP port traffic on an interface. The default (no slot/port specified) is the configured uplink. <tcp port> <slot>/<port> The TCP port number that identifies the traffic to be watched. The slot and port for which IP traffic should be displayed. This command translates to: tcpdump en i <interface> tcp port <port> This command displays tcpdump output until you terminate the command with a CTRL-C. Upon termination, the console session is restarted, and you must log in again. A-26 HP ProCurve Secure Access 700wl Series Installation Guide

99 traceroute {<ip-address > <hostname>} [<hops> [<probes> [<probewait> ] ] ] Displays the traceroute for an IP address or hostname. If the hostname is not qualified, the domain name (as specified by the set domainname command) is appended. <hops> The maximum number of hops to trace. The default is 5. <probes> The maximum number of probes per hop. The default is 3. <probewait> The maximum number of seconds to wait for each probe. The default is 2. This command translates to: traceroute n -m <hops> -q <probes> -w <probewait> <ip-address> or traceroute n -m <hops> -q <probes> -w <probewait> <hostname> Time Configuration set timezone <general-tz> <specific-tz> Sets the local timezone. The set timezone command with no arguments returns a list of the general timezone areas. The command with only a general timezone specification returns a list of the specific timezone areas within the specified general timezone. <general-tz> <specific-tz> The less specific portion of the timezone string. If the timezone is America/Los_Angeles, the general portion is America. Case-sensitive. The more specific portion of the timezone string. If the timezone is America/Los_Angeles the specific portion is Los_Angeles. Case-sensitive. set ntpserver{< ip-address> <hostname>} [<ip-address> <hostname> ] Specifies the IP address or hostname of a primary and secondary Network Time Protocol (NTP) server. Hostnames must be fully qualified if specified. <ip-address> <hostname> An NTP server IP address. An NTP server hostname. This must be a fully qualified domain name. clear ntpserver Clears the NTP servers IP address or hostnames. This command also disables the NTP service if it was enabled. HP ProCurve Secure Access 700wl Series Installation Guide A-27

100 set ntp on off Enables and disables the NTP service. set datetime <date> <time> Manually sets the current local date and time. <date> <time> The current date in yyyy/mm/dd format The current time in h24:mm format. This command also disables the NTP service if it was enabled show time Shows the current date and time, configured time zone and NTP servers. Output from this command is similar to the following: Timezone: America/Los_Angeles NTP Service: Disabled NTP Servers: None Time: 2002/11/26 17:22 SNMP Configuration and Reporting Commands Note: The 700wl Series system supports MIB 2-compliant MIB objects. Note: The 700wl Series system SNMP agent only provides read-only access to the MIB. Therefore, you cannot set or clear MIB objects such as syslocation or syscontact from an external manager via SNMP. You must modify these objects through the web-based administrative interface or the CLI. set snmp on off Turns SNMP support on or off. Turning SNMP on enables read-only access to the MIB. Turning it on when already on, or off when already off has no effect. By default, SNMP support is off. set snmpport <port> Sets the SNMP port. By default, the SNMP port is 161. clear snmpport Resets the SNMP port to the default, port 161. add snmpmanager <hostname> <ip-address> [/<maskbits>] Specifies an authorized SNMP manager by hostname, IP address, or subnetted IP address that can query for SNMP responses. A-28 HP ProCurve Secure Access 700wl Series Installation Guide

101 You can specify up to four authorized SNMP managers by repeating the add snmpmanager command. If you try to add a fifth manager, you will receive an error message. <hostname> <ip-address> <maskbits> The hostname of an SNMP management system. The IP address of an SNMP management system. A subnet mask that defines a range of addresses for the SNMP management system, specified as the number of bits in the mask. For example, /30 is the equivalent of ; /24 is the equivalent of delete snmpmanager all <hostname> <ip-address> [/<maskbits>] Deletes an authorized manager, or all of them. set snmplocation <location> Sets the SNMP syslocation object defined in RFC 1213 as the physical location of this node (for example, telephone closet, 3rd floor). Note: You cannot set this object from an external manager via SNMP. clear snmplocation Clears the SNMP syslocation object. Note: You cannot clear this object from an external manager via SNMP. set snmpcontact <contact> Sets the SNMP syscontact object, defined in RFC 1213 as the textual identification of the contact person for this managed node, together with information on how to contact this person. Note: You cannot set this object from an external manager via SNMP. clear snmpcontact Clears the SNMP syscontact object. Note: You cannot clear this object from an external manager via SNMP. set snmpcommunity <community> Sets the SNMP read community string. The default is public. HP strongly recommends that you change the community string. This is also used for traps. clear snmpcommunity Clears the SNMP community string. HP ProCurve Secure Access 700wl Series Installation Guide A-29

102 add snmptrapreceiver <ip-address> Specifies an IP address to receive traps. You can specify two trap receivers, by executing this command twice. If you try to specify a third trap receiver, you will receive an error message. delete snmptrapreceiver all <ip-address> Deletes a specified trap receiver, or both trap receivers. set snmpauthtraps on off Enables or disables the generation of authentication traps. show snmp Shows the current SNMPv1 configuration. Output is similar to the following example: SNMP: Disabled SNMP Access Mode: Read Only Community Name: public SNMP Port: 161 Location: ServerCloset Bldg2 Contact Info: Device Name: Authentication Traps: Enabled Trap IP Address: None Authorized Managers: None A-30 HP ProCurve Secure Access 700wl Series Installation Guide

103 LCD DISPLAY DESCRIPTION B This appendix describes the LCD display on the Access Controller 720wl, Access Control Server 740wl, and Integrated Access Manager 760wl. The display can be used to view the system s network parameters, and to power down the system. This appendix contains the following sections: Display Description B-1 Powering On and System Boot B-2 Default Display B-2 Main Menu B-3 Network Configuration B-4 System Shutdown B-5 Display Description The LCD display is located in the middle of the front panel of all HP ProCurve Secure Access 700wl Series units. It is a 16 character by two line display, with two buttons located to the right of the display (Figure B-1). SCROLL SELECT Figure B-1. LCD Display The top button is labeled SCROLL. Pressing the SCROLL button cycles through the various displays. The bottom button is labeled SELECT. Pressing the SELECT button causes whatever action is currently on the display to be taken. Note: An unusual voltage surge including static discharge can cause the LCD on the front of the unit to become incorrect and unresponsive. To correct this situation, the unit must be restarted (power cycled). B-1

104 Powering On and System Boot At power-on, the display remains blank until the system has initialized itself and displays System Booting (Figure B-2). SCROLL SELECT Figure B-2. System Booting When the booting is finished, the System Booted display appears (Figure B-3). SCROLL SELECT Figure B-3. System Booted The system then goes to the default display within a few seconds. Default Display Once the system has finished booting, the LCD will alternate between the Hostname/IP Address Display (Figure B-4), and the Date Time/Version Display (Figure B-5). SCROLL SELECT Figure B-4. Hostname/IP Address Display The Hostname/IP Address display shows the hostname (if set, and not fully qualified) and IP Address of the unit. B-2 HP ProCurve Secure Access 700wl Series Installation Guide

105 SCROLL SELECT Figure B-5. Date Time/Version Display The Date Time/Version Display shows the date and time, and the version number of the software installed on the system. The indicator shows whether the unit is an Access Controller (AM), Integrated Access Manager (IS) or Access Control Server (CS). Each display shows for approximately 10 seconds. The system returns to this default display automatically, regardless of the current display, if no buttons are pressed for approximately 30 seconds. Main Menu When the default display (either the Hostname/IP Address or the Date Time/Version) is showing, repeatedly pressing the SCROLL button will cycle through the Main Menu items. These are: Main Menu (Figure B-6) Network Config (Figure B-7) System Shutdown (Figure B-8) If you press both the SCROLL and SELECT buttons at the same time, from any other display, you will also see the Main Menu. SCROLL SELECT Figure B-6. Main Menu Display SCROLL SELECT Figure B-7. Network Configuration Display HP ProCurve Secure Access 700wl Series Installation Guide B-3

106 SCROLL SELECT Figure B-8. System Shutdown Display Network Configuration If you press the SELECT button while Network Config is displayed, you enter the Network Configuration sub-menu. Repeatedly pressing the SCROLL button will cycle through the Network Configuration sub-menu items. These are: IP Address (Figure B-9) Subnet Mask (Figure B-10) Default Router (Figure B-11) Primary DNS (Figure B-12) Secondary DNS (Figure B-13) <Previous Menu (Figure B-14) SCROLL SELECT Figure B-9. IP Address Display SCROLL SELECT Figure B-10. Subnet Mask Display SCROLL SELECT Figure B-11. Default Router Display B-4 HP ProCurve Secure Access 700wl Series Installation Guide