User's Manual

4/1/05 Local MAC Filter
OL-7426-02
Disable TimeoutDisable Timeout
Each WLAN can have a variable timeout for excluded, or disabled clients. Clients who fail to authenti-
cate three times when attempting to associate are automatically excluded, or disabled, from further
association attempts. After the exclusion timeout period expires, the client is allowed to retry authenti-
cation until it associates or fails authentication and is excluded again.
• Use the show wlan command to check the current WLAN Disable (Excluded) Timeout.
• If necessary, use the following command to change the Disable (Excluded) Timeout:
>config wlan blacklist <WLAN id> <timeout>
where <WLAN id> = 1 through 16, and <timeout> = 1 to 65535 seconds, 0 to add to the
Exclusion List (formerly blacklist) permanently until the operator manually removes the
exclusion.
• Use the show wlan command to verify the current WLAN Disable (Excluded) Timeout.
VLANsVLANs
• Use the show wlan command to verify VLAN assignment status.
• To assign a VLAN to a WLAN, use the following command:
>config wlan vlan <wlan id> [<default>/<untagged>/<VLAN ID> <IP Address>
<VLAN Netmask> <VLAN Gateway>]
where <WLAN id> = 1 through 16, <default> = use the VLAN configured on the network port,
<untagged> = use VLAN 0, <VLAN id> = 1 through 4095, <IP Address> = the VLAN IP
Address on the Cisco Wireless LAN Controller, <VLAN Netmask> = VLAN local IP netmask, and
<VLAN Gateway> = VLAN local IP gateway.
• To remove a VLAN assignment from a WLAN, use the following command:
>config wlan vlan <WLAN id> untagged
where <WLAN id> = 1 through 16.
• Use the show wlan <wlan id> command to verify that you have correctly assigned a VLAN to
the WLAN.
Layer 2 SecurityLayer 2 Security
Dynamic 802.1X Keys and AuthorizationDynamic 802.1X Keys and Authorization
Cisco Wireless LAN Controllers can control 802.1X dynamic keys using EAP (extensible authentication
protocol) across Cisco 1000 Series lightweight access points, and supports 802.1X dynamic key
settings for the Cisco 1000 Series lightweight access point WLAN(s).
• Use the show wlan <wlan id> command to check the security settings of each WLAN. The
default for new WLANs is 802.1X with dynamic keys enabled. If you want to keep a robust
Layer 2 policy, leave 802.1X on.
• If you want to change the 802.1X configuration, use the following commands:
>config wlan security 802.1X [enable/disable] <wlan id>
where <WLAN id> = 1 through 16.
Note: WLANs are created in disabled mode; leave them disabled until you have
finished configuring them.
Note: WLANs are created in disabled mode; leave them disabled until you have
finished configuring them.