Test Results Summary for Cisco Unified Wireless LAN Test 7.5 for Japan (Release )

Transcription

1 Test Results Summary for Cisco Unified Wireless LAN Test 7.5 for Japan (Release ) First Published: May 14, 2013 Last Modified: July 10, 2013 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax: Text Part Number: OL

2 2013 Cisco Systems, Inc. All rights reserved.

3 CONTENTS CHAPTER 1 Overview 1 Cisco Wireless LAN Solution Test 1 CHAPTER 2 Test Topology and Environment Matrix 5 Test Topology 6 Environment Matrix 6 What's New? 9 Regression Features 9 Upgrade Path 10 Open Caveats 10 Resolved Caveats 11 CHAPTER 3 New Features - Test Summary 13 FlexConnect Enhancements 13 Bonjour Phase 2 :mdns-ap 20 Data DTLS 23 NBAR Enhancements 24 DNS lookup for Radius and TACACS server 25 Client Stateful Switchover (HA Deployment ) 26 Guest Access - Sleeping Client 31 Guest Anchor 32 Policy and Native Profiling in the Controller 32 L2 Filtering - Multi-Field ACL w on Flex locally switched 37 CHAPTER 4 Regression Features - Test Summary 41 L2 Security 42 PI Maps 44 OL iii

4 Contents Autonomous to LWAPP Migration 44 Link Aggregation Mode 44 High Availability 45 Roaming 47 AAA 48 Flexconnect Enhancements 50 H-REAP Fault tolerance 54 Anyconnect VPN 54 Dot1x and WEB-Auth Support 55 Secure FTP 59 Backup and restore of PI 60 NBAR 61 MEDIAS 62 RADIUS FALLBACK 65 PPPoE 66 Copy And Replace 70 Licensing 70 IP Source Gaurd 70 Upgrade 71 Multiple RADIUS Server Per SSID 71 L3 Security 72 AP SSO 75 IO Data Adapter 81 Adhoc Test Cases 86 PI Upgrade 88 Japan SR Cases 99 Cisco Aironet 1600 series Test Cases 106 Cisco 5760 Wireless LAN Controller 108 Cisco Aironet 3600 Wireless Security & Spectrum Intelligence Module Test Cases 109 Related Documentation 111 iv OL

5 CHAPTER 1 Overview Cisco Wireless LAN Solution Test, page 1 Cisco Wireless LAN Solution Test Cisco Wireless LAN Solution Test, an integral part of the enterprise wireless solution, is a program that validates various Cisco Wireless Products and Features. This is achieved by testing the latest versions of Cisco wireless products. Cisco Wireless LAN Solution Test for Japan, in turn is an add-on testing at the solution level, where the requirements gathered are specific to Japanese usage and market. The requirements are derived based on the following: New features in 7.5 Customer found defects in selected wireless products High priority scenarios and basic regression features Inputs from Cisco SEs/ TAC The test execution is carried out on selected Cisco Wireless LAN products, which affect the Japanese segment that are prioritized by Cisco Japan team. The following products are covered in the test execution: Cisco Wireless LAN Controller 5508 Cisco Wireless LAN Controller 2500 Cisco Wireless LAN Controller 5760 Cisco Wireless LAN Flex Controller 7500 Cisco Wireless LAN Flex Controller 8500 WiSM2 Controller Virtual Controller Access Point 3500 OL

6 Cisco Wireless LAN Solution Test Overview Access Point 1042 Access Point 1142 Access Point 1262 Access Point 3600 Access Point 2600 Access Point 1600 Cisco OEAP 602 Cisco Prime Network Control System Cisco Prime Infrastructure ISE Virtual Appliance Cisco Secure ACS Cisco Mobility Service Engine (MSE Physical) Cisco AnyConnect VPN Client Acronyms Acronym AAA ACL ACS AKM AP AVC CA CAPWAP CCKM CCX CDP CKIP CVBF DCA DNS DTIM DSCP Authentication Authorization and Accounting Access Control List Access Control Server Authentication Key Management Access Point Application Visibility and Control. Central Authentication Control and Provisioning of Wireless Access Point Cisco Centralized Key Management Cisco Compatible Extensions Cisco Discovery Protocol Cisco Key Integrity Protocol Cisco Vector Beam Forming Dynamic Channel Assignment Domain Name System Delivery Traffic Indication Map Differentiated Services Code Point 2 OL

7 Overview Cisco Wireless LAN Solution Test Acronym DTLS EAP EULA FLA FLS FT FTP FW HA H-REAP IOS ISE LAG LEAP LSS LWAPP MFP mdns MIC MSE NAT NBAR NCS NMSP OEAP PEAP PEM PI PMF PPPoE PSK Datagram Transport Layer Security Extensible Authentication Protocol End User Licence Agreement Flex Local Authentication Flex Local Switching Fast Transition File Transfer Protocol Firm Ware High Availability Hybrid Remote Edge Access Point Internetwork Operating System Identity Service Engine Link Aggregation Lightweight Extensible Authentication Protocol Location Specific Services Lightweight Access Point Protocol Management Frame Protection multicast Domain Name System Message Integrity Check Mobility Service Engine Network Address Translation Network Based Application Recognition Network Control System Network Mobility Services Protocol Office Extended Access Point Protected Extensible Authentication Protocol Policy Enforcement Module Prime Infrastructure Protected Management Frame Point-to-Point Protocol over Ethernet Pre-shared Key OL

8 Cisco Wireless LAN Solution Test Overview Acronym RADIUS RP RRM SFTP SNMP SS SSID SSO SSO TACACS TCP TFTP TLS UDP vwlc VPN WEP WGB WiSM WLAN WLC WPA Remote Authentication Dial-In User Service Redundancy Port Radio Resource Management Secure File Transfer Protocol. Simple Network Management Protocol Spatial Stream Service Set Identifier Single Sign On Stateful Switch Over Terminal Access Controller Access Control System Transmission Control Protocol Trivial File Transfer Protocol. Transport Layer Security User Datagram Protocol Virtual Wireless LAN Controller Virtual Private Network Wired Equivalent Privacy Workgroup Bridge Wireless Service Module Wireless LAN Wireless LAN Controller Wi-Fi Protected Access 4 OL

9 CHAPTER 2 Test Topology and Environment Matrix Test Topology, page 6 Environment Matrix, page 6 What's New?, page 9 Regression Features, page 9 Upgrade Path, page 10 Open Caveats, page 10 Resolved Caveats, page 11 OL

10 Test Topology Test Topology and Environment Matrix Test Topology Figure 1: Topology in Use Environment Matrix Category Controller Component Cisco Wireless LAN controller 5508 Cisco Flex 7500 Series Wireless Controllers Cisco Flex 8500 Series Wireless Controllers Cisco 2500 Series Wireless Controller Cisco Wireless Services Module 2 (WiSM2) Cisco Wireless LAN Controller 5760 Virtual controller Version SE OL

11 Test Topology and Environment Matrix Environment Matrix Category Application Call control Access Point Switch Component Cisco Prime Infrastructure Cisco Identity Services Engine (ISE) Cisco Secure Access Control System (ACS) Cisco Mobility Services Engine ( MSE - Physical) Cisco Unified Communications Manager Cisco Aironet 3500 Series Cisco Aironet 3600 Series Cisco Aironet 1042 Cisco Aironet 1142 Cisco Aironet 1262 Cisco Aironet 2600 Series Cisco Aironet 600 Series OfficeExtend Access Point Cisco Aironet 3600 Wireless Security and Spectrum Intelligence Module Cisco Aironet 1600 Series Cisco Catalyst 3750V2 Series switch Cisco Catalyst 6509-E Version / (JP) ( 2 )SE SXJ2 OL

12 Environment Matrix Test Topology and Environment Matrix Category Client Chipset Active Directory Browsers Component Operating System (Japanese) Apple Mac Book Pro (Japanese Locale) iphone 4 (Japanese Locale) iphone 5 (Japanese Locale) Samsung Galaxy- S II (Japanese Locale) Wireless IP Phone 7921G (Japanese Locale) Wireless IP Phone 7925G (Japanese Locale) Wireless IP phone 7926G (Japanese Locale) MEDIAS (N-02E) (Japanese Locale) MEDIAS (N-04E) (Japanese Locale) Cisco AnyConnect VPN Client 5300, 6300 AGN Airport Extreme AD Internet Explorer Opera Mozilla Firefox Safari Chrome Version Windows 7 Enterprise Windows XP Professional Windows 8 Enterprise Mac OS ios 6.1 (10B144) ios6.0.2 (10A551) (2) 1.4(2) 1.4(2) Android Android ( For Windows 7 Enterprise ) ( For Samsung Galaxy S-II ) ( For Apple Mac OS ) Windows 2008 R2 Enterprise 8, 9, OL

13 Test Topology and Environment Matrix What's New? What's New? HA Phase 2 Client Stateful Switchover L2 Bonjour Services Detecting Services on VLANs that are accessible on Access Point instead of Controllers Ability to Prioritize or Enter Manually the services to be maintained in the controller Policy and Native Profiling in the controller L2 Filtering - Multi-Field ACL ( Ethertype ) PPPoE passthrough support for central switching FlexConnect Enhancements w on Flex locally switched PEAP / EAP-TLS Support on AP ACL and QoS override Other Features Guest Anchor Support in 8500 DTLS and OEAP-600 Support in vwlc Guest Access - Sleeping Client NBAR downloadable Protocol pack updates DNS Lookup for RADIUS and TACACS server Regression Features Layer 3 Security Layer 2 Security PI Maps Autonomous to LWAPP Migration Link Aggregation Mode High Availability Roaming AAA FlexConnect Enhancements OL

14 Upgrade Path Test Topology and Environment Matrix H-REAP fault tolerance Anyconnect VPN Dot1x and WEB-Auth Support Multiple RADIUS Server Per SSID Secure FTP Backup and restore of PI NBAR Upgrade TAC SR Case Upgrade Path The Following upgrade path are validated along with database Backup & Restore Original Release Target Release Intermediate release Direct Upgrade supported? NCS PI NCS , PI , PI YES NCS PI PI , PI YES PI PI PI YES PI PI NA YES UPGRADES FROM TO--> NCS PI PI PI 1.4 NCS Y Y Y Y NCS Y Y Y PI Y Y PI Y Open Caveats Defect ID CSCug84020 Defect CLI sessions IP address in reverse format in 8500/vWLC Product WLC 10 OL

15 Test Topology and Environment Matrix Resolved Caveats Defect ID CSCug87156 CSCuh54971 CSCuh46664 CSCuh51349 Defect Client is not excluded only if both username and Password is wrong in each entry Client goes to Idle state after AP failover to Secondary WLC Controller's AP Retransmit Count changes when disabling and enabling the AP Fast Heartbeat Search Device "Switches" redirects to Configuration page instead of Monitor page Product WLC WLC PI PI Limitation Defect ID CSCug34552 Defect PI- Device search in classic theme redirects to life cycle theme Product PI Resolved Caveats Defect ID CSCug39671 CSCuh48423 Defect UTF - Character display in WLC Difference between WLC & NCS in enabling/disabling EAP-FAST Parameters in Flexgroup Product WLC NCS OL

16 Resolved Caveats Test Topology and Environment Matrix 12 OL

17 CHAPTER 3 New Features - Test Summary FlexConnect Enhancements, page 13 Bonjour Phase 2 :mdns-ap, page 20 Data DTLS, page 23 NBAR Enhancements, page 24 DNS lookup for Radius and TACACS server, page 25 Client Stateful Switchover (HA Deployment ), page 26 Guest Access - Sleeping Client, page 31 Guest Anchor, page 32 Policy and Native Profiling in the Controller, page 32 L2 Filtering - Multi-Field ACL, page w on Flex locally switched, page 37 FlexConnect Enhancements WirelessJ75S_FCE.001 Client authentication via PEAP through Primary RADIUS server(ise) at site level To verify whether the Client authentication (PEAP) is done via Primary RADIUS server(ise) configured in flexconnect group OL

18 FlexConnect Enhancements New Features - Test Summary WirelessJ75S_FCE.002 Client authentication via PEAP through Secondary RADIUS server(ise) at site level To verify whether the Client authentication (PEAP) is done via Secondary RADIUS server(ise) configured in flexconnect group WirelessJ75S_FCE.003 Client authentication via EAP-TLS through Primary RADIUS server(ise) at site level To verify whether the Client authentication (EAP-TLS) is done via Primary RADIUS server(ise) configured in flexconnect group WirelessJ75S_FCE.004 Client authentication via EAP-TLS through Secondary RADIUS server(ise) at site level To verify whether the Client authentication (EAP-TLS) is done via Secondary RADIUS server(ise) configured in flexconnect group WirelessJ75S_FCE.005 Enabling PEAP and EAP-TLS in FlexConnect group through WLC CLI To enable PEAP and EAP-TLS in WLC CLI for a Flexconnect group and verifying it in WLC GUI. WirelessJ75S_FCE.006 Trying to enable PEAP without enabling AP Local Authentication in a FlexConnect group through WLC CLI To enable PEAP in WLC CLI without enabling AP Local Auth in a Flexconnect group and verifying whether error message is displayed or not. WirelessJ75S_FCE.007 Performing Dot1x with PEAP in case of primary RADIUS server(ise) failover To verify whether dot1x with PEAP authentication for the client is done via Secondary Radius server(ise) configured at site level after primary failover WirelessJ75S_FCE.008 Performing Dot1x with EAP-TLS in case of primary RADIUS server(ise) failover To verify whether dot1x with EAP-TLS authentication for the client is done via Secondary Radius server(ise) configured at site level after primary failover 14 OL

19 New Features - Test Summary FlexConnect Enhancements WirelessJ75S_FCE.009 Client authentication via PEAP through Primary RADIUS server(acs) at site level To verify whether the Client authentication (PEAP) is done via Primary RADIUS server(acs) configured in flexconnect group WirelessJ75S_FCE.010 Client authentication via PEAP through Secondary RADIUS server(acs) at site level To verify whether the Client authentication (PEAP) is done via Secondary RADIUS server(acs) configured in flexconnect group WirelessJ75S_FCE.011 Client authentication via EAP-TLS through Primary RADIUS server(acs) at site level To verify whether the Client authentication (EAP-TLS) is done via Primary RADIUS server(acs) configured in flexconnect group WirelessJ75S_FCE.012 Client authentication via EAP-TLS through Secondary RADIUS server(acs) at site level To verify whether the Client authentication (EAP-TLS) is done via Secondary RADIUS server(acs) configured in flexconnect group WirelessJ75S_FCE.013 Performing Dot1x with PEAP in case of primary RADIUS server(acs) failover To verify whether dot1x with PEAP authentication for the client is done via Secondary Radius server(acs) configured at site level after primary failover WirelessJ75S_FCE.014 Performing Dot1x with EAP-TLS in case of primary RADIUS server(acs) failover To verify whether dot1x with EAP-TLS authentication for the client is done via Secondary Radius server(acs) configured at site level after primary failover WirelessJ75S_FCE.015 Enabling AP Local Authentication alone in FlexConnect group for a WLC in PI and checking it in WLC GUI. To verify whether configuration changes of a Flex group in PI is reflecting or not in WLC. OL

20 FlexConnect Enhancements New Features - Test Summary WirelessJ75S_FCE.016 Enabling PEAP and EAP-TLS in FlexConnect group for a WLC in PI and checking it in WLC GUI. To verify whether configuration changes of a Flex group in PI is reflecting or not in WLC. WirelessJ75S_FCE.017 Authenticating and associating two clients(mac and Win7) via PEAP through Primary RADIUS server(ise) at site level To verify whether the Clients authenticated(peap) and associated via Primary RADIUS server(ise) configured in flexconnect group WirelessJ75S_FCE.018 Authenticating and associating two clients(mac and Win7) via PEAP through Secondary RADIUS server(ise) at site level To verify whether the Clients authenticated(peap) and associated via Secondary RADIUS server(ise) configured in flexconnect group WirelessJ75S_FCE.019 Authenticating and associating two clients(mac and Win7) via EAP-TLS through Primary RADIUS server(ise) at site level To verify whether the Clients authenticated(eap-tls) and associated via Primary RADIUS server(ise) configured in flexconnect group WirelessJ75S_FCE.020 Authenticaing and assocoating two clients(mac and Win7) via EAP-TLS through Secondary RADIUS server(ise) at site level To verify whether the Clients authenticated(eap-tls) and associated via Secondary RADIUS server(ise) configured in flexconnect group WirelessJ75S_FCE.021 AP config with RADIUS Server after AP_SSO to standby WLC To verify whether the AP retains the RADIUS server config applied after AP SSO 16 OL

21 New Features - Test Summary FlexConnect Enhancements WirelessJ75S_FCE.022 Performing AP from Connected mode to Standalone mode with Primary RADIUS Server(ISE) via PEAP Authentication To verify whether the Client is disconnected or not when AP moves from Connected mode to standalone mode. WirelessJ75S_FCE.023 Performing AP from Connected mode to Standalone mode with Secondary RADIUS Server(ISE) via PEAP Authentication To verify whether the Client is disconnected or not when AP moves from Connected mode to standalone mode. WirelessJ75S_FCE.024 Performing AP from Connected mode to Standalone mode with Primary RADIUS Server(ISE) via EAP-TLS Authentication To verify whether the Client is disconnected or not when AP moves from Connected mode to standalone mode. WirelessJ75S_FCE.025 Performing AP from Connected mode to Standalone mode with Secondary RADIUS Server(ISE) via EAP-TLS Authentication To verify whether the Client is disconnected or not when AP moves from Connected mode to standalone mode. WirelessJ75S_FCE.026 Performing VLAN mapping for a WLAN in a FlexConnect Group - L2 Security "None" To verify whether VLAN mapping is done for a WLAN in a FlexConnect Group by associating a client to that WLAN and checking the IP of the client WirelessJ75S_FCE.027 Performing VLAN mapping for a WLAN in a FlexConnect Group - L2 Security "Dot1x" To verify whether VLAN mapping is done from AP level WLAN-VLAN mapping over WLAN-VLAN mapping in a FlexConnect Group. OL

22 FlexConnect Enhancements New Features - Test Summary WirelessJ75S_FCE.028 Performing VLAN mapping for a WLAN in a FlexConnect Group and also with AP level WLAN-VLAN mapping To verify whether VLAN mapping is done for a WLAN in a FlexConnect Group by associating a client to that WLAN and checking the IP of the client WirelessJ75S_FCE.029 Configuring WLAN-VLAN Mapping for a Flex group through WLC CLI To verify whether WLAN-VLAN mapping is reflected in WLC GUI after configuring it in WLC CLI WirelessJ75S_FCE.030 Performing mapped WLAN as centrally switched in WLC GUI. To verify whether the WLAN-VLAN mapping is removed if WLAN is changed to centrally switched. WirelessJ75S_FCE.031 Adding a WLAN-VLAN mapping in FlexConnect group for a WLC in PI and checking it in WLC GUI. To verify whether configuration changes of a Flex group in PI is reflecting or not in WLC. WirelessJ75S_FCE.032 Deleting a WLAN-VLAN mapping in FlexConnect group for a WLC in PI and checking it in WLC GUI. To verify whether configuration changes of a Flex group in PI is reflecting or not in WLC. WirelessJ75S_FCE.033 Creating a Flexconnect ACL and mapping it in Flex group To verify whether created Flexconnect ACL is able to map or not in Flexconnect groups. WirelessJ75S_FCE.034 Creating a Flexconnect ACL and mapping it in Flex group for WLAN-ACL(Locally Switched WLAN) To verify whether created Flexconnect ACL is able to map or not in Flexconnect groups for WLAN-ACL( Locally switched WLAN) 18 OL

23 New Features - Test Summary FlexConnect Enhancements WirelessJ75S_FCE.035 Creating a Flexconnect ACL and mapping it in Flex group for WLAN-ACL(Centrally Switched WLAN) To verify whether created Flexconnect ACL is able to map or not in Flexconnect groups for WLAN-ACL( Centrally switched WLAN) WirelessJ75S_FCE.036 Adding WLAN in WLAN_ACL mapping in FlexConnect group for a WLC in PI and checking it in WLC GUI. To verify whether configuration changes of a Flex group in PI is reflecting or not in WLC. WirelessJ75S_FCE.037 Deleting WLAN in WLAN_ACL mapping in FlexConnect group for a WLC in PI and checking it in WLC GUI. To verify whether configuration changes of a Flex group in PI is reflecting or not in WLC. WirelessJ75S_FCE.038 Allowing a client by creating Flex ACL To verify whether client is permitted or not by Flex ACL WirelessJ75S_FCE.039 Denying a client by creating Flex ACL To verify whether client is denied or not by Flex ACL WirelessJ75S_FCE.040 Associating two clients(mac and Win7) to a WLAN (Central - Switching) with the WebAuth-ACL mapping. To verify whether two clients can be associated or not to a WLAN with Webauth-ACL mapping. WirelessJ75S_FCE.041 Associating two clients(mac and WIn7) with Platinum QoS set in a WLAN(Centrally Switched)-L2 security Dot1x To verify whether two clients is associated and has same data rates for Platinum QoS profile. OL

24 Bonjour Phase 2 :mdns-ap New Features - Test Summary WirelessJ75S_FCE.042 Associating two clients(mac and Win7) to a WLAN(Local Switching) with the WebAuth-ACL mapping. To verify whether two clients can be associated or not to a WLAN with Webauth-ACL mapping. WirelessJ75S_FCE.043 Associating two clients(mac and WIn7) with Platinum QoS set in a WLAN(Local Switching)-L2 security Dot1x To verify whether two clients is associated and has same data rates for Platinum QoS profile. WirelessJ75S_FCE.044 Associating two clients(mac and WIn7) with Platinum QoS set in a WLAN-L3 security Web-auth To verify whether two clients is associated and has same data rates for Platinum QoS profile. WirelessJ75S_FCE.045 Associating two clients(mac and WIn7) with Platinum QoS set in a WLAN and AAA override enabled. To verify whether clients is associated with same SSID but different security types and checking the data rates during different authentication process. WirelessJ75S_FCE.046 Associating two clients(mac and WIn7) with Gold QoS set in a WLAN and AAA override enabled. To verify whether clients is associated with same SSID but different security types and checking the data rates during different authentication process. Bonjour Phase 2 :mdns-ap WirelessJ75S_Bonjour.01 Check controller includes Service provider Associated AP-MAC in Service database (LSS disable/enable) To check for the Controller to include Wireless Service Provider associated AP MAC address during snooping 20 OL

25 New Features - Test Summary Bonjour Phase 2 :mdns-ap WirelessJ75S_Bonjour.02 Controller mdns Browser functionality verification To check for the Controller to display the un-snooped services list with reason WirelessJ75S_Bonjour.03 mdns LSS functionality verification when controller have only wireless side service providers for the client request service To check for the Controller to check the RRM neighbour list while responding to client bonjour query when LSS is enabled on that WLAN. Based on neighbour list, service provider list will be served WirelessJ75S_Bonjour.04 mdns LSS functionality verification when controller have only wired side service providers for the client request service To check for the LSS to work only for wireless SPs. This test to make sure controller sends all wired SP to client WirelessJ75S_Bonjour.05 mdns LSS functionality verification when controller have both wireless & wired side service providers for the client request service To Verify that LSS will work only for wireless SPs. This test is to make sure controller sends all wired SPs & filtered wireless SPs to client WirelessJ75S_Bonjour.06 Check controller includes all SPs in response for the client requested Service when LSS is disabled To check if LSS disabled controller doesn't do any filtering when query comes WirelessJ75S_Bonjour.07 Service Provider L2 Intra controller roaming : Verification of AP-MAC updation To check for the controller to update correct AP-MAC in to database when SP does L2 roam Intra controller WirelessJ75S_Bonjour.08 controller behavior when Service Provider L3 roaming To verify controller behavior when Service Provider L3 roaming WirelessJ75S_Bonjour.09 Auto Anchor : Service Provider snooping functionality verification To check for the foreign controller to snoop the service provider not anchor. OL

26 Bonjour Phase 2 :mdns-ap New Features - Test Summary WirelessJ75S_Bonjour.10 Wireless Client does L2 intra controller roam: Query response verification To verify Controller behavior when it receives mdns query from wireless client WirelessJ75S_Bonjour.11 Wireless Client does L3 roam: Query response verification To check for the Controller behavior when it receives mdns query from wireless client WirelessJ75S_Bonjour.12 Wireless Client configured for auto anchor: Query response verification To check the Controller behavior when it receives mdns query from wireless client WirelessJ75S_Bonjour.13 mdns-ap Snooping To check mdns-ap Snooping: AP connected in ACCESS PORT WirelessJ75S_Bonjour.14 Enable mdns-ap snooping to check for the Controller to send aggregated query when enable mdns-ap snooping WirelessJ75S_Bonjour.15 New service, controller should send service specific query to all mdns-aps To check for Service specific query to be send to mdns-ap if wired snooping is enabled for that service when it is added WirelessJ75S_Bonjour.16 mdns-ap on TTL expiry To Check if controller deletes the services learned from mdns-ap on TTL expiry WirelessJ75S_Bonjour.17 mdns-ap functionality verification : AP reset / shutdown to check for the Controller to delete the service provider info from database when AP disjoin with controller WirelessJ75S_Bonjour.18 mdns-ap functionality verification : Data DTLS To verify mdns AP snooping functionality with DATA DTLS connection. WirelessJ75S_Bonjour.19 mdns-ap to snoop from maximum of 10 VLANs To check if AP can snoop from 10 different VLANs 22 OL

27 New Features - Test Summary Data DTLS WirelessJ75S_Bonjour.20 mdns-ap behavior verification when it joins with other controller To check for AP configuration when AP join with other controller, based on global snooping configuration WirelessJ75S_Bonjour.21 New mobility : mdns SP does L2 roam To verify Service provider roaming functionality in New mobility WirelessJ75S_Bonjour.22 Test to verify LSS mdns configuration To verify LSS mdns configuration Data DTLS WirelessJ75S_DTLS.01 Enabling Data DTLS in vwlc GUI/CLI To Enable Data DTLS encryption in Virtual WLC GUI/CLI WirelessJ75S_DTLS.02 Forwarding packets with different MTU sizes with Data DTLS enabled To forward Packets with different MTU Sizes with Data DTLS enabled. WirelessJ75S_DTLS.03 Forwarding data Packets to vwlc To forward data Packets to vwlc and check for the encryption WirelessJ75S_DTLS.04 Forwarding data Packets to vwlc - OEAP To forward data Packets to vwlc and check for the encryption having OEAP associated with vwlc WirelessJ75S_DTLS.05 Forwarding data Packets to vwlc - AP 3600 To forward data Packets to vwlc and check for the encryption having AP 3600 associated with vwlc OL

28 NBAR Enhancements New Features - Test Summary NBAR Enhancements WirelessJ75S_NBARPP.001 Transfer download protocol pack on 5500 controller To verify if transfer download of protocol pack works fine on 5500 controller WirelessJ75S_NBARPP.002 Transfer download protocol pack on 7500 controller To verify if transfer download of protocol pack works fine on 7500 controller WirelessJ75S_NBARPP.003 AVC show engine version command To verify if AVC show engine version command works fine WirelessJ75S_NBARPP.004 AVC transfer download protocol pack on unsupported controller scenario To Verify if AVC transfer download protocol pack on unsupported controller throws proper error message WirelessJ75S_NBARPP.005 AVC will retain its old protocol pack when AVC fails to load unsupported protocol pack To verify if AVC will retain its old protocol pack when AVC fails to load unsupported protocol pack WirelessJ75S_NBARPP.006 HA support for protocol pack To test HA support for protocol pack WirelessJ75S_NBARPP.007 AVC works fine with the new protocol pack downloaded To Verify if AVC works fine with the new protocol pack downloaded WirelessJ75S_NBARPP.008 AVC will retain its old protocol pack when AVC fails to load protocol pack To verify if AVC will retain its old protocol pack when AVC fails to load 24 OL

29 New Features - Test Summary DNS lookup for Radius and TACACS server DNS lookup for Radius and TACACS server WirelessJ75S_DNS.001 DNS lookup for Radius and TACACS configuration via CLI and GUI. To check whether the DNS lookup configuration for AAA server can be done on WLC via CLI and GUI WirelessJ75S_DNS.002 Upgrade WLC with DNS lookup configuration. To check whether the DNS Configuration is retained and there is no error after upgrade of WLC. WirelessJ75S_DNS.003 Downgrade WLC with DNS lookup configuration To check whether the DNS Configuration is retained and there is no error after downgrade of WLC. WirelessJ75S_DNS.004 Upload / download DNS lookup configuration of WLC. To check whether xml error is not appearing after uploading configuration on WLC. WirelessJ75S_DNS.005 TACACS Accounting for DNS lookup To check whether proper TACACS accounting is happening for DNS lookup configuration WirelessJ75S_DNS.006 Max radius and TACACS server returned from DNS. To check whether WLC queries for AAA servers and DNS returns maximum number of servers WirelessJ75S_DNS.007 Client gets authenticated by radius server returned by DNS server. To verify whether the Client gets authenticated by active radius servers. WirelessJ75S_DNS.008 Changes in active radius server while client is connected. To verify whether DNS returns different active radius server list while client is connected to manually added radius server. WirelessJ75S_DNS.009 Editing Radius and TACACS configuration To verify the WLC behavior while editing AAA server configuration on WLC OL

30 Client Stateful Switchover (HA Deployment ) New Features - Test Summary WirelessJ75S_DNS.010 Error msg when trying to configure DNS more than one To verify whether WLC throws proper error message while trying to configure more than one DNS. WirelessJ75S_DNS.011 WLAN configuration and Active server list To verify the WLC behavior when Active server list gets changed because of DNS lookup. WirelessJ75S_DNS.012 WLAN configuration and Active server list for same radius servers To verify the WLC behavior when similar server list is updated because of DNS lookup. WirelessJ75S_DNS.013 HA functionality with DNS look-up for AAA server To verify the HA functionality when DNS look-up for AAA server is configured WirelessJ75S_DNS.014 No DNS query if DNS look up configuration gets changed To verify whether the WLC waits for timeout before sending DNS query after DNS configuration change. WirelessJ75S_DNS.015 No response from DNS server second time To verify the WLC functionality when there is no response from DNS server. WirelessJ75S_DNS.016 Fallback feature with active radius server To verify whether Fallback works with currently active radius server. WirelessJ75S_DNS.017 Failover first active radius server To verify whether Failover works with active radius servers Client Stateful Switchover (HA Deployment ) Scenario 1 - RP Back-to-Back connectivity WLJ75S_ClientSSO_01 Client SSO with Open/Static WEP security(wlc 5508) To verify whether the Client SSO is successful with Open/Static WEP security type in WLC OL

31 New Features - Test Summary Client Stateful Switchover (HA Deployment ) WLJ75S_ClientSSO_02 Client SSO with Open/Static WEP security(wlc 7500) To verify whether the Client SSO is successful with Open/Static WEP security type in WLC 7500 WLJ75S_ClientSSO_03 Client SSO with web authentication L3 Security(WLC 5508) To verify whether the Client SSO is successful with L3 security type web-authentication in WLC 5508 WLJ75S_ClientSSO_004 Client SSO with web authentication L3 Security(WLC 7500) To verify whether the Client SSO is successful with L3 security type web-authentication in WLC 7500 WLJ75S_ClientSSO_05 Client SSO with web authentication L3 Security after session timeout(wlc 5508) To validate Client SSO with L3 security type web-auth after session timeout WLJ75S_ClientSSO_06 Client SSO with web authentication L3 Security after session timeout(wlc 7500) To validate Client SSO with L3 security type web-auth after session timeout WLJ75S_ClientSSO_07 Client SSO with web authentication L3 Security after user logs out and logs in again(wlc 5508) To validate Client SSO with L3 security type web-auth after user logs out and logs in again OL

32 Client Stateful Switchover (HA Deployment ) New Features - Test Summary WLJ75S_ClientSSO_08 Client SSO with web authentication L3 Security after user logs out and logs in again(wlc 7500) To validate the Client SSO with L3 security type web-auth after user logs out and logs in again WLJ75S_ClientSSO_09 Client SSO with web authentication client session timeout configured(wlc 5508 and WLC 7500) To validate the Client SSO with L3 security type web-auth with client session timeout configured WLJ75S_ClientSSO_010 Client SSO with L2 Security Open/WEP authentication(local switching) To validate the Client SSO with L2 security Open/WEP (local switching) WLJ75S_ClientSSO_011 Client SSO with L2 Security WPA/WPA2(local switching) To validate the Client SSO with L2 security WPA/WPA2 (local switching) WLJ75S_ClientSSO_012 Client SSO with Open/Static WEP securitysession timer expired To validate the Client SSO with Open/WEP security after session timeout for a client WLJ75S_ClientSSO_013 Client SSO with Open/Static WEP when intra controller roaming To validate the Client SSO with Open/Static WEP security during intra-controller roaming WLJ75S_ClientSSO_014 Client SSO with Web authentication when intra controller roaming To validate the Client SSO with web-auth during intra-controller roaming WLJ75S_ClientSSO_015 Client deletion from the Active controller To verify whether the Client deletion in Active WLC has been synced to the standby WLC 28 OL

33 New Features - Test Summary Client Stateful Switchover (HA Deployment ) WLJ75S_ClientSSO_016 Client SSO during dot1x To verify the client table on standby during dot1x WLJ75S_ClientSSO_017 Client SSO with dot1x- session timer expiry To verify the client table on the standby when session timer expires during dot1x Scenario 2- RP connectivity via L2 Switch WLJ75S_ClientSSO_01 Client SSO with Open/Static WEP security(wlc 5508) To verify whether the Client SSO is successful with Open/Static WEP security type in WLC 5508 WLJ75S_ClientSSO_02 Client SSO with web authentication L3 Security(WLC 5508) To verify whether the Client SSO is successful with L3 security type web-authentication in WLC 5508 WLJ75S_ClientSSO_03 Client SSO with web authentication L3 Security after session timeout(wlc 5508) To validate Client SSO with L3 security type web-auth after session timeout WLJ75S_ClientSSO_04 Client SSO with web authentication L3 Security after user logs out and logs in again(wlc 5508) To validate Client SSO with L3 security type web-auth after user logs out and logs in again WLJ75S_ClientSSO_05 Client SSO with web authentication client session timeout configured(wlc 5508 and WLC 7500) To validate the Client SSO with L3 security type web-auth with client session timeout configured WLJ75S_ClientSSO_06 Client SSO with L2 Security Open/WEP authentication(local switching) To validate the Client SSO with L2 security Open/WEP (local switching) OL

34 Client Stateful Switchover (HA Deployment ) New Features - Test Summary Scenario 3- RP connectivity via L2 Switches WLJ75S_ClientSSO_01 Client SSO with Open/Static WEP security(wlc 5508) To verify whether the Client SSO is successful with Open/Static WEP security type in WLC 5508 WLJ75S_ClientSSO_02 Client SSO with web authentication L3 Security(WLC 5508) To verify whether the Client SSO is successful with L3 security type web-authentication in WLC 5508 WLJ75S_ClientSSO_03 Client SSO with web authentication L3 Security after session timeout(wlc 5508) To validate Client SSO with L3 security type web-auth after session timeout WLJ75S_ClientSSO_04 Client SSO with web authentication L3 Security after user logs out and logs in again(wlc 5508) To validate Client SSO with L3 security type web-auth after user logs out and logs in again WLJ75S_ClientSSO_05 Client SSO with web authentication client session timeout configured(wlc 5508 and WLC 7500) To validate the Client SSO with L3 security type web-auth with client session timeout configured WLJ75S_ClientSSO_06 Client SSO with L2 Security Open/WEP authentication(local switching) To validate the Client SSO with L2 security Open/WEP (local switching) 30 OL

35 New Features - Test Summary Guest Access - Sleeping Client Note Specifications of WLC(RP) : RTT Latency 80ms or less Bandwidth 60Mbps or more MTU 1500 Guest Access - Sleeping Client WirelessJ75S_Guest.001 Sleeping client functionality with internal web-auth To verify the sleeping client functionality with internal web-auth works successfully WirelessJ75S_Guest.003 Sleeping client functionality verification with dot1x+webauth To verify the sleeping client feature with dot1x+ webauth works successfully WirelessJ75S_Guest.004 Sleeping client functionality verification respect to AP group To verify the sleeping client feature works irrespective to AP group WirelessJ75S_Guest.005 FlexConnect: Sleeping client functionality verification To verify the sleeping client feature flexconnect local switching WirelessJ75S_Guest.006 L2 roam: Sleeping client functionality verification To verify the sleeping client functionality with L2 Roam works successfully WirelessJ75S_Guest.008 Sleeping Client summary and detail verification To verify sleeping client detailed client summary is appearing properly. WirelessJ75S_Guest.009 Configure Backup /Restore To verify the Backup /Restore of sleeping feature configuration. OL

36 Guest Anchor New Features - Test Summary Guest Anchor WirelessJ75S_GA..001 Guest anchor -Internal web-auth To verify the internal web-auth with anchor controller WirelessJ75S_GA..002 Guest anchor -customized web-auth To verify the customized web-auth with anchor controller Policy and Native Profiling in the Controller WirelessJ75S_Profiling.001 Policy enforcement & Local profiling configuration from Telnet To verify the Policy enforcement & local profiling by CLI WirelessJ75S_Profiling.002 Policy enforcement &Local profiling configuration by GUI To verify the Policy enforcement & local profiling by GUI WirelessJ75S_Profiling.003 Policy enforcement -Upload To verify policy enforcement configuration after upload WirelessJ75S_Profiling.004 Policy enforcement -Download To verify the policy enforcement configuration after download WirelessJ75S_Profiling.005 Native profiling-wlc To verify the traffic flow after profiling WirelessJ75S_Profiling.006 Native profiling from PI -configuration To verify the native profiling configuration from PI WirelessJ75S_Profiling.007 Native profiling from PI template To verify the native profiling configuration from PI template 32 OL

37 New Features - Test Summary L2 Filtering - Multi-Field ACL L2 Filtering - Multi-Field ACL WirelessJ75S_NB.156 max configuration of L2 ACL Configure max number of ACLs and rules per ACL WirelessJ75S_NB.157 L2 ACL configuration - upgrade /downgrade. Configuration of L2 ACLs should be retained after upgrading and downgrading WLC WirelessJ75S_NB.158 L2 ACL name should be unique on WLC WLC should not allow user to configure L2 ACL name if there is already an ACL ( apart from L2 ACLs ) configured on the wlc WirelessJ75S_NB.159 L2 ACLs with single Guest Anchor scenario Configure L2 ACL on guest anchor WLC and associate client on foreign WLC WirelessJ75S_NB.160 L2 ACL with Two guest Anchor on foreign WLC Configure L2 ACL on guest anchors WLC and associate client on foreign WLC. Down first guest anchor and client gets associated to next available guest anchor. L2 ACL will be applied as configured on next guest anchor WirelessJ75S_NB.161 L2 Roaming - new WLC's L2 ACL will be applied New wlc's L2 ACL should be applied after L2 roam WirelessJ75S_NB.162 L3 Roaming - Anchor's L2 ACL should be applied L3 roam works fine and L2 ACL should applied of anchor after roam. WirelessJ75S_NB.163 L3 Roaming - roam foreign to foreign with L2 ACL. L2 ACL should be applied of anchor when client roams [ Anchor - Foreign - Foreign ] OL

38 L2 Filtering - Multi-Field ACL New Features - Test Summary WirelessJ75S_NB.164 Local-switching - L2 ACL on WLAN Verify that L2 ACL mapped to wlan is NOT affecting client's traffic that is locally switched WirelessJ75S_NB.165 Local-switching - L2 ACL on Flex AP Configure L2 ACL and map it Flex AP. Verify that L2 ACL taking affect as per configuration of ACL WirelessJ75S_NB.166 Local-switching - L2 ACL priority among wlan / AP Verify that when client is connected to local-switching wlan, only flex AP L2 ACL will be applied on clients traffic if it's mapped to AP otherwise wlan ACL. WirelessJ75S_NB.167 Local-switching - L2 ACL on AP - reboot AP Verity that L2 ACL on Flex AP remains after reboot also WirelessJ75S_NB.168 PPPoE AP - central-switching and L2 ACL Verify that L2 ACL works fine when client associated with PPPoE AP and central-switching wlan WirelessJ75S_NB.169 PPPoE AP - local-switching and L2 ACL Verify that L2 ACL works fine when client associated with PPPoE AP and local-switching wlan WirelessJ75S_NB.170 only PPPoE client - central-switching and L2 ACL Verify that L2 ACL working fine for PPPoE client when it's connected to central - switched wlan WirelessJ75S_NB.171 only PPPoE client - local-switching and L2 ACL Verify that L2 ACL works fine with PPPoE client when it's associated with local - switching wlan WirelessJ75S_NB.172 Enable Source Guard / DIA on AP but permit ARP in L2 ACL Verify that ARP getting blocked by Source Guard /DIA at Flex AP itself 34 OL

39 New Features - Test Summary L2 Filtering - Multi-Field ACL WirelessJ75S_NB.173 Enable Source Guard / DIA on AP but Deny ARP in L2 ACL Verify that genuine ARP blocked by L2 ACL and ARP attack blocked by SG / DIA WirelessJ75S_NB.174 Enable Source Guard / DIA on PPPoE AP and permit ARP in L2 ACL Verify that ARP getting blocked by Source Guard /DIA at Flex AP. WirelessJ75S_NB.175 PPPoE AP and Enable Source Guard/DIA on AP but Deny ARP in L2 ACL. Verify that genuine ARP blocked by L2 ACL and ARP attack blocked by SG / DIA. WirelessJ75S_NB.176 HA - L2 ACL configure should be pushed to standby Verify that L2 ACL configuration gets synced with HA pair's standby WLC WirelessJ75S_NB.177 HA - failover and fallback with L2 ACLs Verify that when client is associated and L2 ACL is configured then L2 ACL works fine with HA failover and fallback WirelessJ75S_NB.178 L2 ACLs - editing / deleting /adding Verify that editing, deleting and adding works fine WirelessJ75S_NB.179 L2 ACL with Central-switching - session timeout Verify that L2 ACL works fine after session timeout when client is associated to central-switched wlan WirelessJ75S_NB.180 L2 ACL with Local-switching - session timeout Verify L2 ACL works with local-switching and after session timeout WirelessJ75S_NB.181 L2 ACL and L3 roaming - session timeout Verify that L2 ACL works fine after session timeout when client roams WirelessJ75S_NB.182 L2 ACL and Flex Stand-alone AP - session timeout Verify that L2 ACL works fine after session timeout when AP is on standalone mode OL

40 L2 Filtering - Multi-Field ACL New Features - Test Summary WirelessJ75S_NB.183 L2 ACL Central-switching - deleting / adding rules and ACLs on the fly Verify that deleting / adding rules in L2 ACL works fine on the fly WirelessJ75S_NB.184 L2 ACL Local-switching - deleting / adding rules and ACLs on the fly Verify that deleting / adding rules in L2 ACL works fine on the fly WirelessJ75S_NB.185 L2 ACL Stand-alone - deleting /adding rules and ACLs on the fly. Verify that deleting / adding rules in L2 ACL works fine on the fly WirelessJ75S_NB.186 Test all the ether-type in L2 ACL Verify that all the ether-types works fine by simulating packets WirelessJ75S_NB.187 L2 ACL check implicit deny /permit all rule works Verify that implicit deny and permit all rule works fine WirelessJ75S_NB.188 L2 ACL application after DHCP process Verify that L2 ACL gets applicable on client's traffic only after client gets authenticated and gets IP address WirelessJ75S_NB.189 L2 ACL with WGB client Verify that L2 ACL works fine with WGB clients WirelessJ75S_NB.190 L2 ACL for traffic coming from wired side. Verify that L2 ACL work on traffic coming from wired side as well WirelessJ75S_NB.191 L2 ACL with flex, IPv4 and IPv6 ACLs Verify that all the ACL works fine as per configuration when configured all together WirelessJ75S_NB.192 L2 ACL with Split-tunneling Verify that L2 ACL works appropriately with split-tunneling feature WirelessJ75S_NB.200 Backup and Restore To verify the L2ACL present after Backup and restore of WLC 36 OL

41 New Features - Test Summary w on Flex locally switched w on Flex locally switched WirelessJ75_11w.001 Enabling MFP in WLC CLI To verify whether MFP is enabled in GUI when it is configured through CLI of WLAN WirelessJ75_11w.002 Enabling MFP in NCS and checking it in WLC. To verify whether configuration changes of a WLAN in NCS is reflecting in WLC WirelessJ75_11w.003 Enabling MFP in a WLAN with L2 Security "WEP"and associating a Client(Win8) and checking the Management frames through Wireshark To verify whether MIC is present in Management Frames during client association with L2 Security-WEP. WirelessJ75_11w.004 Enabling MFP in a WLAN with L2 Security "None"and associating a Client(Win8) and checking the Management frames through Wireshark To verify whether MIC is present in Management Frames during client association with L2 Security-None. WirelessJ75_11w.005 Enabling MFP in a WLAN with L2 Security "WPA2+PSK"- PMF enabled and associating a Client(Win8) and checking the Management frames through Wireshark To verify whether MIC is present in Management Frames during client association with L2 Security - WPA2+PSK with PMF enabled. OL

42 802.11w on Flex locally switched New Features - Test Summary WirelessJ75_11w.006 Enabling MFP in a WLAN with L2 Security "Dot1x"and associating a Client(Win8) and checking the Management frames through Wireshark To verify whether MIC is present in Management Frames during client association with L2 Security-Dot1x. WirelessJ75_11w.007 Enabling MFP in a WLAN and associating a Client(WGB) and checking the Management frames through Wireshark To verify whether MIC is present in Management Frames during association of WGB client. WirelessJ75_11w.008 Enabling MFP in a WLAN ( FLS and CA) and associating two Clients (WGB and Win8) and checking the Management frames through Wireshark. To verify whether MIC is present in Management Frames during association of two clients with WLAN ( FLS and CA ). WirelessJ75_11w.009 Enabling MFP in a WLAN ( FLS and FLA) and associating two Clients ( WGB and Win8 ) and checking the Management frames through Wireshark To verify whether MIC is present in Management Frames during association of two clients with WLAN ( FLS and FLA ) WirelessJ75_11w.010 Roaming a client ( Win8 ) from 7500 to 5508 and checking the Management frames through Wireshark To verify whether MIC is present in Management Frames during client roam between 7500 to WirelessJ75_11w.011 Roaming a client ( Win8 ) from 7500 to 2504 and checking the Management frames through Wireshark To verify whether MIC is present in Management Frames during client roam between 7500 to OL

43 New Features - Test Summary w on Flex locally switched WirelessJ75_11w.012 Fast roaming a client ( Win8 ) from 5500 to vwlc and checking the Management frames through Wireshark To verify whether MIC is present in Management Frames during fast roam of client between 5500 to vwlc. WirelessJ75_11w.013 Fast roaming a client ( Win8 ) from WiSM2 to 2504 and checking the Management frames through Wireshark To verify whether MIC is present in Management Frames during Fast roam of client between WiSM2 to WirelessJ75_11w.014 Setting MFP as disabled and associating a client and checking the Management Frames. To verify whether MIC is not present in Management Frames during client association with MFP disabled in a WLAN. OL

44 802.11w on Flex locally switched New Features - Test Summary 40 OL

45 CHAPTER 4 Regression Features - Test Summary L2 Security, page 42 PI Maps, page 44 Autonomous to LWAPP Migration, page 44 Link Aggregation Mode, page 44 High Availability, page 45 Roaming, page 47 AAA, page 48 Flexconnect Enhancements, page 50 H-REAP Fault tolerance, page 54 Anyconnect VPN, page 54 Dot1x and WEB-Auth Support, page 55 Secure FTP, page 59 Backup and restore of PI, page 60 NBAR, page 61 MEDIAS, page 62 RADIUS FALLBACK, page 65 PPPoE, page 66 Copy And Replace, page 70 Licensing, page 70 IP Source Gaurd, page 70 Upgrade, page 71 Multiple RADIUS Server Per SSID, page 71 L3 Security, page 72 AP SSO, page 75 OL

46 L2 Security Regression Features - Test Summary IO Data Adapter, page 81 Adhoc Test Cases, page 86 PI Upgrade, page 88 Japan SR Cases, page 99 Cisco Aironet 1600 series Test Cases, page 106 Cisco 5760 Wireless LAN Controller, page 108 Cisco Aironet 3600 Wireless Security & Spectrum Intelligence Module Test Cases, page 109 Related Documentation, page 111 L2 Security WirelessJ74SR_L2.009 Associating 7921G IP phone - WEP To check whether the 7921G ip phone is associated successfully into the network through WEP authentication method WirelessJ74SR_L2.010 Associating 7921G IP phone - WPA To check whether the 7921G ip phone is associated successfully into the network through WPA authentication method WirelessJ74SR_L G IP Phone Association through WEP(RADIUS Server Authentication) To verify the 7921G IP Phone is successfully authenticated and associated through WEP WirelessJ74SR_L2.012 Authentication for the association of clients-wpa Checking for the Authentication of the clients when connected to an AP. WirelessJ74SR_L2.013 Authentication for the association of clients-802.1x Checking for the Authentication of the clients when connected to an AP. 42 OL