Users Guide

120 | Access Points Dell PowerConnect ArubaOS 5.0 | [User Guide
Allowed band The band(s) on which to use the virtual AP:
z a—802.11a band only (5 GHz).
z g—802.11b/g band only (2.4 GHz).
z all—both 802.11a and 802.11b/g bands (5 GHz and 2.4 GHz). This is the default setting.
VLAN The VLAN(s) into which users are placed in order to obtain an IP address. Click the drop-down list
to select a configured VLAN, the click the arrow button to associate that VLAN with the virtual AP
profile.
Forward mode This parameter controls whether data is tunneled to the controller using generic routing
encapsulation (GRE), bridged into the local Ethernet LAN (for remote APs), or a combination
thereof depending on the destination (corporate traffic goes to the controller, and Internet access
remains local). All forwarding modes support band steering, TSPEC/TCLAS enforcement, 802.11k
and station blacklisting.
Click the drop-down list to select one of the following forward modes:
z Tunnel: The AP handles all 802.11 association requests and responses, but sends all 802.11
data packets, action frames and EAPOL frames over a GRE tunnel to the controller for
processing. The controller removes or adds the GRE headers, decrypts or encrypts 802.11
frames and applies firewall rules to the user traffic as usual. Both remote and campus APs can
be configured in tunnel mode.
z Bridge: 802.11 frames are bridged into the local Ethernet LAN. When a remote AP or campus
AP is in bridge mode, the AP (and not the controller) handles all 802.11 association requests
and responses, encryption/decryption processes, and firewall enforcement. The 802.11e and
802.11k action frames are also processed by the AP, which then sends out responses as
needed.
An AP in bridge mode does not support captive portal authentication. Both remote and campus
APs can be configured in bridge mode. Note that you must enable the control plane security
feature on the controller before you configure campus APs in bridge mode.
z Split-Tunnel: 802.11 frames are either tunneled or bridged, depending on the destination
(corporate traffic goes to the controller, and Internet access remains local).
A remote AP in split-tunnel forwarding mode handles all 802.11 association requests and
responses, encryption/decryption, and firewall enforcement. the 802.11e and 802.11k action
frames are also processed by the remote AP, which then sends out responses as needed.
z Decrypt-Tunnel: Both remote and campus APs can be configured in decrypt-tunnel mode.
When an AP uses decrypt-tunnel forwarding mode, that AP decrypts and de-capsulates all
802.11 frames from a client and sends the 802.3 frames through the GRE tunnel to the controller,
which then applies firewall policies to the user traffic.
When the controller sends traffic to a client, the controller sends 802.3 traffic through the GRE
tunnel to the AP, which then converts it to encrypted 802.11 and forwards to the client. This
forwarding mode allows a network to utilize the encryption/decryption capacity of the AP while
reducing the demand for processing resources on the controller.
APs in decrypt-tunnel forwarding mode also manage all 802.11 association requests and
responses, and process all 802.11e and 802.11k action frames. APs using decrypt-tunnel mode
do have some limitations that not present for APs in regular tunnel forwarding mode.
You must enable the control plane security feature on the controller before you configure
campus APs in decrypt-tunnel forward mode. High-throughput APs in decrypt-tunnel mode do
not support de-aggregation of MAC Service Data Units (A-MSDUs).
NOTE: Virtual APs in bridge or split-tunnel mode using static WEP should use key slots 2-4 on the
controller. Key slot 1 should only be used with Virtual APs in tunnel mode.
Deny time range Click the drop-down list and select a configured time range for which the AP will deny access. If
you have not yet configured a time range, navigate to Configuration > Security > Access Control >
Time Ranges to define a time range before configuring this setting in the virtual AP profile.
Mobile IP Enables or disables IP mobility for this virtual AP.
Default: Enabled
HA Discovery
on-association
If enabled, all clients of a virtual AP will receive mobility service on association.
Default: Disabled
DoS Prevention If enabled, APs ignore deauthentication frames from clients. This prevents a successful deauth
attack from being carried out against the AP. This does not affect third-party APs. Default: Disabled
Table 27 Virtual AP Profile Parameters
Parameter Description