Wireless LAN 2300 Engineering WLAN 233X Access Points and Microsoft DHCP Technical Brief Avaya Data Solutions Document Date: Document Number: NN48500-551 Document Version: 2.1
2010 Avaya Inc. All Rights Reserved. Notices While reasonable efforts have been made to ensure that the information in this document is complete and accurate at the time of printing, Avaya assumes no liability for any errors. Avaya reserves the right to make changes and corrections to the information in this document without the obligation to notify any person or organization of such changes. Documentation disclaimer Avaya shall not be responsible for any modifications, additions, or deletions to the original published version of this documentation unless such modifications, additions, or deletions were performed by Avaya. End User agree to indemnify and hold harmless Avaya, Avaya s agents, servants and employees against all claims, lawsuits, demands and judgments arising out of, or in connection with, subsequent modifications, additions or deletions to this documentation, to the extent made by End User. Link disclaimer Avaya is not responsible for the contents or reliability of any linked Web sites referenced within this site or documentation(s) provided by Avaya. Avaya is not responsible for the accuracy of any information, statement or content provided on these sites and does not necessarily endorse the products, services, or information described or offered within them. Avaya does not guarantee that these links will work all the time and has no control over the availability of the linked pages. Warranty Avaya provides a limited warranty on this product. Refer to your sales agreement to establish the terms of the limited warranty. In addition, Avaya s standard warranty language, as well as information regarding support for this product, while under warranty, is available to Avaya customers and other parties through the Avaya Support Web site: http://www.avaya.com/support Please note that if you acquired the product from an authorized reseller, the warranty is provided to you by said reseller and not by Avaya. Licenses THE SOFTWARE LICENSE TERMS AVAILABLE ON THE AVAYA WEBSITE, HTTP://SUPPORT.AVAYA.COM/LICENSEINFO/ ARE APPLICABLE TO ANYONE WHO DOWNLOADS, USES AND/OR INSTALLS AVAYA SOFTWARE, PURCHASED FROM AVAYA INC., ANY AVAYA AFFILIATE, OR AN AUTHORIZED AVAYA RESELLER (AS APPLICABLE) UNDER A COMMERCIAL AGREEMENT WITH AVAYA OR AN AUTHORIZED AVAYA RESELLER. UNLESS OTHERWISE AGREED TO BY AVAYA IN WRITING, AVAYA DOES NOT EXTEND THIS LICENSE IF THE SOFTWARE WAS OBTAINED FROM ANYONE OTHER THAN AVAYA, AN AVAYA AFFILIATE OR AN AVAYA AUTHORIZED RESELLER, AND AVAYA RESERVES THE RIGHT TO TAKE LEGAL ACTION AGAINST YOU AND ANYONE ELSE USING OR SELLING THE SOFTWARE WITHOUT A LICENSE. BY INSTALLING, DOWNLOADING OR USING THE SOFTWARE, OR AUTHORIZING OTHERS TO DO SO, YOU, ON BEHALF OF YOURSELF AND THE ENTITY FOR WHOM YOU ARE INSTALLING, DOWNLOADING OR USING THE SOFTWARE (HEREINAFTER REFERRED TO INTERCHANGEABLY AS "YOU" AND "END USER"), AGREE TO THESE TERMS AND CONDITIONS AND CREATE A BINDING CONTRACT BETWEEN YOU AND AVAYA INC. OR THE APPLICABLE AVAYA AFFILIATE ("AVAYA"). Copyright Except where expressly stated otherwise, no use should be made of the Documentation(s) and Product(s) provided by Avaya. All content in this documentation(s) and the product(s) provided by Avaya including the selection, arrangement and design of the content is owned either by Avaya or its licensors and is protected by copyright and other intellectual property laws including the sui generis rights relating to the protection of databases. You may not modify, copy, reproduce, republish, upload, post, transmit or distribute in any way any content, in whole or in part, including any code and software. Unauthorized reproduction, transmission, dissemination, storage, and or use without the express written consent of Avaya can be a criminal, as well as a civil offense under the applicable law. Third Party Components Certain software programs or portions thereof included in the Product may contain software distributed under third party agreements ("Third Party Components"), which may contain terms that expand or limit rights to use certain portions of the Product ("Third Party Terms"). Information regarding distributed Linux OS source code (for those Products that have distributed the Linux OS source code), and identifying the copyright holders of the Third Party Components and the Third Party Terms that apply to them is available on the Avaya Support Web site: http://support.avaya.com/copyright. Trademarks The trademarks, logos and service marks ("Marks") displayed in this site, the documentation(s) and product(s) provided by Avaya are the registered or unregistered Marks of Avaya, its affiliates, or other third parties. Users are not permitted to use such Marks without prior written consent from Avaya or such third party which may own the Mark. Nothing contained in this site, the documentation(s) and product(s) should be construed as granting, by implication, estoppel, or otherwise, any license or right in and to the Marks without the express written permission of Avaya or the applicable third party. Avaya is a registered trademark of Avaya Inc. All non-avaya trademarks are the property of their respective owners. Downloading documents For the most current versions of documentation, see the Avaya Support. Web site: http://www.avaya.com/support Contact Avaya Support Avaya provides a telephone number for you to use to report problems or to ask questions about your product. The support telephone number is 1-800-242-2121 in the United States. For additional support telephone numbers, see the Avaya Web site: http://www.avaya.com/support 2
Table of Contents Document Updates... 4 Conventions... 4 1. Introduction... 5 1.1 Prerequisites... 5 1.2 Configuration Example... 8 1.3 Verify... 16 2. Reference Documentation... 19 3. Customer service... 20 3.1 Getting technical documentation... 20 3.2 Getting product training... 20 3.3 Getting help from a distributor or reseller... 20 3.4 Getting technical support from the Avaya Web site... 20 3
Document Updates Conventions This section describes the text, image, and command conventions used in this document. Symbols: Tip Highlights a configuration or technical tip. Note Highlights important information to the reader. Caution Highlights important information about an action that may result in equipment damage, configuration or data loss. Text: Bold text indicates emphasis. Italic text in a Courier New font indicates text the user must enter or select in a menu item, button or command: ERS5520-48T# show running-config Output examples from Avaya devices are displayed in a Lucida Console font: ERS5520-48T# show running-config! Embedded ASCII Configuration Generator Script! Model = Ethernet Routing Switch 5520-24T-PWR! Software version = v5.0.0.011 enable configure terminal 4
1. Introduction This document provides an example configuration for a typical network environment where a Microsoft DHCP Server is used with the Avaya WLAN Security Switch 2300 and Avaya WLAN 233X Access Points to supply IP addresses or hostnames. 1.1 Prerequisites Before attempting to configure the Microsoft DHCP server or Avaya WLAN Security Switch 2300, please ensure that you meet the following prerequisites: Working knowledge of Microsoft Windows 2003 Server and DHCP Server. Working knowledge of the Wireless LAN Security Switch 2300 CLI or Wireless LAN 2300 Management Software. 1.1.1 Components Used The information in this technical brief is based on the following software and hardware versions: A Windows 2003 Server with the Microsoft DHCP Server installed. Two Avaya WLAN Security Switch 2300s (any model) with software release 4.1.14 (or higher). One or more Avaya WLAN 233X Access Points. One Avaya Ethernet Routing Switch 5520 with software release 5.0.4 (or higher). Avaya WLAN Management Software 2300 software release 4.1.15 (or higher). Note: The configuration of the Avaya Ethernet Routing Switch 5520 is not the focus of this technical brief and will not be discussed in this document. The information presented in this technical brief was created from devices in a specific lab environment. If you are working in a live network environment ensure that you understand the impact of each command or configuration change before performing it. 5
1.1.2 Background Theory When the Avaya WLAN 233X Access Points are not directly connected to an Avaya WLAN Security Switch 2300, they require information from the network in order to function. At a minimum an Avaya WLAN 233X Access Point requires the following components in order to provide Wireless LAN services to clients: Configuration Profile A configuration profile needs to exist for the 233X Access Point on one or more Avaya WLAN Security Switch 2300s. Power 802.3af PoE must be provided on one of the Ethernet connections to the AP. DHCP A 233X Access Point uses TCP/IP for communication with the Avaya WLAN Security Switch and relies on DHCP to obtain IP addressing. DHCP services must be available on the VLAN in order for the 233X Access Point to boot and DHCP must provide the following parameters to the 233X Access Point: o o o o IP address Domain name DNS server address Default router address When an Avaya WLAN 233X Access Point is deployed in a typical enterprise environment the Access Point will often be connected to a VLAN which is not directly connected to an Avaya WLAN Security Switch 2300. In addition as Wireless LANs gain momentum in the enterprise customers demand high availability so that Wireless LAN services are always available to users if a WLAN Security Switch is unavailable. To address both of these requirements the Avaya Wireless LAN 2300 solution supports the ability to provide Avaya WLAN 233X Access Points with the IP addresses or hostnames of one or more WLAN Security Switch 2300s using standard based DHCP services. Leveraging the DHCP option 43 field, an Avaya 233X Access Point can be provided with one or more Avaya WLAN Security Switch IP addresses or hostnames that it will be used to locate its boot device. The Avaya 233X Access Points configuration profile can be defined on one or more Avaya WLAN Security Switches so that the Access Point can always boot if its primary Security Switch was to become unavailable. A 233X Access Point may also use DNS to locate an Avaya WLAN Security Switch 2300; however this is out of the scope of this document and is addressed in a separate Avaya Technical Brief. With release 5.0 Avaya WLAN 233X Access Points can be configured with static network addressing. For additional information and please reference the Avaya WLAN Security Switch 2300 Series Configuration Guide available on the Avaya public support web site. 6
1.1.3 Distributed APs and DHCP Option 43 The option 43 field in a DHCP Offer message can provide a simple and effective way for Avaya 233X Access Points to locate Avaya Wireless LAN Security Switches across an intermediate Layer 3 network as well as provide Avaya 233X Access Points with alternative Avaya Security Switches if the Primary Security Switch was to become unavailable. The DHCP option 43 field can be easily added to an existing scope on a Microsoft DHCP server to provide the 233X Access Points with the required boot information. The DHCP option 43 field supports the following formats: ip:wss-ipaddress1,wss-ipaddress2,... or host:wss-host1.domain.com,wss-host2.domain.com,... The DHCP option 43 field may supply IP addresses or hostnames, but not both. If the list contains both types of values, the DAP will not attempt to use the list. The IP and host keywords can be in lowercase, uppercase (IP or HOST), or mixed case (example: Ip, Host, and so on.) You may use spaces after the colon or commas, but spaces are not supported within IP addresses or hostnames. Leading zeroes are supported in IP addresses. For example, 192.168.001.010 is valid. Valid characters in hostnames are uppercase and lowercase letters, numbers, periods (. ), and hyphens ( - ). Other characters are not supported. If you use the host option, you must configure the network s DNS server with address records that map the hostnames in the list to the WSS IP addresses. After receiving a DHCP Offer containing a valid string for option 43, a DAP sends a unicast Find message to each WSS switch in the list. 7
1.2 Configuration Example 1.2.1 Network Diagram This technical brief uses the network configuration shown in the diagram below: Figure 1.2.1 Network Diagram The above diagram shows an example network comprising of multiple VLANs and the following components: An Ethernet Routing Switch 5520 is configured with two VLANs (VLAN 1 & VLAN 2) with IP routing enabled. VLAN 1 is assigned the IP address 192.168.1.1 and VLAN 2 is assigned the IP address 192.168.2.1. DHCP forwarding is also enabled on VLAN 2 and is configured to forward DHCP requests to the Windows 2003 servers IP address 192.168.1.5. The Windows 2003 Server is connected to the Ethernet Routing Switch on VLAN 1 and is assigned the IP address 192.168.1.5. Two Wireless LAN Security Switch 2300s are connected to the Ethernet Routing Switch 5520 on VLAN 1. WSS2300-1 is assigned the system IP addresses 192.168.1.10 and WSS2300-2 is assigned the IP address 192.168.110.11. Both Security Switches are a member of a Mobility Domain and WSS2300-1 is the seed switch. A 233X Access Point is connected to the Ethernet Routing Switch 5520 on VLAN 2. The Ethernet port is configured to provide 802.3af PoE and Spanning Tree Protocol is diabled. The default gateway for each device is the corresponding VLAN interface IP address on the Ethernet Routing Switch 5520. A DHCP scope is configured for VLAN 2 with options to provide hosts with a default gateway, DNS name server and DNS domain name. 8
1.2.2 Configurations 1.2.2.1 Microsoft DHCP Server Configuring Microsoft DHCP Option 43 to supply WSS IP Addresses Start the DHCP administration tool by clicking Start, Programs, Administrative Tools and then DHCP. Expand the Scope that you wish to add the DHCP Option 43 to and then right click on Scope Options and select Configure Options. In the Available Options list select 043 Vendor Specific Info. In the ASCII field enter in the IP address of each WSS using the format ip:192.168.1.10,192.168.1.11. Note: By default there is a 00 byte entry in option 43 field which shows as a period in the ASCII section. This must be deleted before typing in the string. Click OK. 9
Configuring Microsoft DHCP Option 43 to supply WSS Hostnames Start the DHCP administration tool by clicking Start, Programs, Administrative Tools and then DHCP. Expand the Scope that you wish to add the DHCP Option 43 to and then right click on Scope Options and select Configure Options. In the Available Options list select 043 Vendor Specific Info. In the ASCII field enter in the host and domain names of each WSS using the format host:wss2300-1.domain.com,wss2300-2.domain.com. Note: By default there is a 00 byte entry in option 43 field which shows as a period in the ASCII section. This must be deleted before typing in the string. Click OK. 10
1.2.2.2 WSS2300-1 Configuration (WMS) Adding a DAP to WSS2300-1 using WMS Start the Distributed AP Wizard by clicking Distributed AP in the Access Point Tasks list. Specify a Name, DAP Number and Serial Number. Optionally type in the Fingerprint if the AP Security Mode on the WSS is set to Required. Click Next. 11
Select the AP Model Number and AP Radio Type. Click Next. Select the 802.11b/g Radio Profile, Channel Number and Transmit Power. Click Next. Select the 802.11a Radio Profile, Channel Number and Transmit Power. Click Finish. Deploy Changes. 12
1.2.2.3 WSS2300-2 Configuration (WMS) Configuring AP Redundancy on WSS2300-2 using WMS Start the AP Redundancy Wizard by clicking AP Redundancy in the Access Point Tasks list. In the Select AP(s) list highlight the DAP that you wish to add a redundant WSS connection. Click Add Connection. 13
In the Select WSS(s) list specify a WSS name that you wish to define as the backup WSS to the AP. Specify the Low Bias setting which will define WSS2300-2 as the least preferred switch. WSS2300-1 will have a high bias setting and will be the primary switch. Click OK. Once the configuration is deployed the DAP will have a configuration profile on both the WSS2300-1 and WSS2300-2 switches. Any changes made in WMS will automatically be applied to both switches. Click OK. Deploy Changes. 14
1.2.2.4 WSS2300-1 Configuration (CLI) Adding a DAP to WSS2300-1 using CLI # Specifies the DAP number, serial-id and AP model number set dap 1 serial-id stp1w20kc3 model 2330 # Specifies the name of the DAP set dap 1 name 2330-1 # Specifies the bias of the DAP where WSS2300-1 is the primary switch and wss2360-2 is # the backup switch set dap 1 bias high # Specifies the 802.11b/g radio channel, power and radio profile set dap 1 radio 1 channel 1 tx-power 10 radio-profile default mode enable # Specifies the 802.11a radio channel, power and radio profile set dap 1 radio 2 channel 44 tx-power 10 radio-profile default mode enable # Save the changes save config 1.2.2.5 WSS2300-2 Configuration (CLI) Adding a DAP to WSS2300-2 using CLI # Specifies the DAP number, serial-id and AP model number set dap 1 serial-id stp1w20kc3 model 2330 # Specifies the name of the DAP set dap 1 name 2330-1 # Specifies the bias of the DAP where WSS2300-1 is the primary switch and wss2360-2 is # the backup switch set dap 1 bias low # Specifies the 802.11b/g radio channel, power and radio profile set dap 1 radio 1 channel 1 tx-power 10 radio-profile default mode enable # Specifies the 802.11a radio channel, power and radio profile set dap 1 radio 2 channel 44 tx-power 10 radio-profile default mode enable 15
# Save the changes save config 1.3 Verify This section provides information you can use to confirm the configuration is working properly. Microsoft DHCP Server When an Avaya 233X Access Point obtains IP addressing from the Microsoft DHCP server, an entry will be created in Address Leases in the scope for the VLAN where the Access Point is connected. The entry will contain the Access Points assigned IP address as well as the Access Points MAC address. 16
Avaya WLAN Security Switch 2300 The following CLI commands can be used to verify the status and configuration of an Avaya 233X Access Point. The show dap status command is useful to verify the status of an Access Point on a Security Switch. WSS2300-1# show dap status 1 DAP: 1, IP-addr: 192.168.2.100 (DHCP, vlan 'VLAN1'), AP model: 2330, manufacturer: Nortel, name: 2330_1 fingerprint: 6a:25:fc:6a:82:7d:e9:3a:3d:ea:03:64:43:54:fd:27 ==================================================== State: operational (encrypted and fingerprint not verified) CPU info: Atheros:MIPS32 speed=220000000 Hz version=ar5312, ram=16777216 s/n=stp1w20kc3 hw_rev=03 Uptime: 0 hours, 2 minutes, 4 seconds Radio 1 type: 802.11g, state: configure succeed [Enabled] operational channel: 1 operational power: 10 bssid1: 00:15:e8:dc:65:40, ssid: Nortel RFID Reports: Inactive Radio 2 type: 802.11a, state: configure succeed [Enabled] operational channel: 44 operational power: 10 bssid1: 00:15:e8:dc:65:41, ssid: Nortel RFID Reports: Inactive The show dap global command is useful to verify which WLAN Security Switches an Avaya Access Points configuration profile is configured on. WSS2300-1# show dap global DAP Serial Id Switch IP Address --- ----------- ------------------- 1 stp1w20kc3 192.168.1.10 HIGH - stp1w20kc3 192.168.1.11 LOW 17
1.3.1 Troubleshoot Avaya 233X Access Point The Health LED can be used to troubleshoot boot issue as it will provide you with the Access Points current state: A solid amber LED indicates that the Access Point is unable to boot or is waiting to receive boot information from a Security Switch. A continuous amber state could mean that the Access Points configuration is not defined on a Security Switch or the AP is unable to establish a connection to a Security Switch. The show dap unconfigured command can be used to identify any unconfigured Access Points that are connected to a Security Switch. An alternating green and amber LED indicates that the Access Point has established a connection to a Security Switch and is waiting for boot instructions and a configuration file. A solid green LED indicates that the Access Point is operational and has established a management connection as well as obtained a valid configuration file from a Security Switch. 18
2. Reference Documentation Document Title Avaya WLAN Security Switch 2300 Series Configuration Guide Avaya WLAN security Switch 2300 Series Command Line Reference Avaya WLAN Access Point 2330/2330A Installation Guide Publication Number 320657-B 320658-B 320661-B Description Avaya Wireless LAN Security Switch 2300 Configuration Guide. Avaya Wireless LAN Security Switch 2300 Command Line Reference Guide. Avaya WLAN 2330/2330A Access Points Installation Guide. 19
3. Customer service Visit the Avaya Web site to access the complete range of services and support that Avaya provides. Go to www.avaya.com or go to one of the pages listed in the following sections. 3.1 Getting technical documentation To download and print selected technical publications and release notes directly from the Internet, go to www.avaya.com/support. 3.2 Getting product training Ongoing product training is available. For more information or to register, you can access the Web site at www.avaya.com/support. From this Web site, you can locate the Training contacts link on the left-hand navigation pane. 3.3 Getting help from a distributor or reseller If you purchased a service contract for your Avaya product from a distributor or authorized reseller, contact the technical support staff for that distributor or reseller for assistance. 3.4 Getting technical support from the Avaya Web site The easiest and most effective way to get technical support for Avaya products is from the Avaya Technical Support Web site at www.avaya.com/support. 20