Administrator Guide

ManualsBrandsDell ManualsAccess PlatformsW-7010

431

432

433

434

435

436

437

438

439

440

Table Of Contents

Contents
About this Guide
- What's New In ArubaOS 6.4.x
- Fundamentals
  - WebUI
  - CLI
- Related Documents
- Conventions
- Contacting Dell
The Basic User-Centric Networks
- Understanding Basic Deployment and Configuration Tasks
- Configuring the Controller
  - Running Initial Setup
  - Connecting to the Controller after Initial Setup
- W-7000 Series and W-7200 Series Controller
  - New Port Numbering Scheme
  - W-7200 Series Controllers Individual Port Behavior
- Using the LCD Screen
- Configuring a VLAN to Connect to the Network
- Enabling Wireless Connectivity
- Enabling Wireless Connectivity
- Configuring Your User-Centric Network
- Replacing a Controller
Control Plane Security
- Control Plane Security Overview
- Configuring Control Plane Security
  - In the WebUI
  - In the CLI
- Managing AP Whitelists
- Managing Whitelists on Master and Local Controllers
- Working in Environments with Multiple Master Controllers
  - Configuring Networks with a Backup Master Controller
  - Configuring Networks with Clusters of Master Controllers
- Replacing a Controller on a Multi-Controller Network
  - Replacing Controllers in a Single Master Network
  - Replacing Controllers in a Multi-Master Network
- Configuring Control Plane Security after Upgrading
- Troubleshooting Control Plane Security
Software Licenses
- Understanding License Terminology
- Working with Licenses
- Centralized Licensing in a Multi-Controller Network
- Using Licenses
- Understanding License Interaction
- License Installation Best Practices and Exceptions
- Installing a License
- Deleting a License
- Moving Licenses
- Resetting the Controller
Network Configuration Parameters
- Configuring VLANs
- Configuring Ports
- Understanding VLAN Assignments
- Configuring Static Routes
  - In the WebUI
  - In the CLI
- Configuring the Loopback IP Address
  - In the WebUI
  - In the CLI
- Configuring the Controller IP Address
  - In the WebUI
  - In the CLI
- Configuring GRE Tunnels
- Configuring GRE Tunnel Groups
- Jumbo Frame Support
IPv6 Support
- Understanding IPv6 Notation
- Understanding IPv6 Topology
- Enabling IPv6
- Enabling IPv6 Support for Controller and APs
- Filtering an IPv6 Extension Header (EH)
- Configuring a Captive Portal over IPv6
- Working with IPv6 Router Advertisements (RAs)
  - Configuring an IPv6 RA on a VLAN
    - Using WebUI
    - Using CLI
  - Configuring Optional Parameters for RAs
    - In the WebUI
    - In the CLI
- RADIUS Over IPv6
  - In the CLI
  - In the WebUI
- TACACS Over IPv6
  - In the CLI
  - In the WebUI
- DHCPv6 Server
- Understanding ArubaOS Supported Network Configuration for IPv6 Clients
  - Supported Network Configuration
  - Understanding the Network Connection Sequence for Windows IPv6 Clients
- Understanding ArubaOS Authentication and Firewall Features that Support IPv6
- Managing IPv6 User Addresses
- Understanding IPv6 Exceptions and Best Practices
Link Aggregation Control Protocol
- Understanding LACP Best Practices and Exceptions
- Configuring LACP
  - In the CLI
  - In the WebUI
- LACP Sample Configuration
OSPFv2
- Understanding OSPF Deployment Best Practices and Exceptions
- Understanding OSPFv2 by Example using a WLAN Scenario
  - WLAN Topology
  - WLAN Routing Table
- Understanding OSPFv2 by Example using a Branch Scenario
  - Branch Topology
  - Branch Routing Table
- Configuring OSPF
  - Exporting VPN Client Addresses to OSPF
    - In the WebUI
    - In the CLI
- Sample Topology and Configuration
Tunneled Nodes
- Understanding Tunneled Node Configuration
- Configuring a Wired Tunneled Node Client
  - Configuring an Access Port as a Tunneled Node Port
  - Configuring a Trunk Port as a Tunneled Node Port
Authentication Servers
- Understanding Authentication Server Best Practices and Exceptions
- Understanding Servers and Server Groups
- Configuring Authentication Servers
- Managing the Internal Database
- Configuring Server Groups
- Assigning Server Groups
- Configuring Authentication Timers
  - Setting an Authentication Timer
    - Using the WebUI
    - Using the CLI
- Authentication Server Load Balancing
  - Enabling Authentication Server Load Balancing Functionality
MAC-based Authentication
- Configuring MAC-Based Authentication
  - Configuring the MAC Authentication Profile
    - In the WebUI
    - In the CLI
- Configuring Clients
  - In the WebUI
  - In the CLI
Branch Controller Config for Controllers
- Branch Deployment Features
- WAN Failure (Authentication) Survivability
- WAN Health Check
- WAN Optimization through IP Payload Compression
- Interface Bandwidth Contracts
- Integration with a Palo Alto Networks (PAN) Portal
  - Integration Workflow
  - Configuration Prerequisites
- Branch Controller Routing Features
  - Uplink Routing Using Nexthop Lists
  - Policy-Based Routing
- Zero-Touch Provisioning
- Using Smart Config to create a Branch Config Group
- PortFast and BPDU Guard
- Preventing WAN Link Failure on Virtual APs
  - In the WebUI
  - In the CLI
- Branch WAN Dashboard Changes
802.1X Authentication
- Understanding 802.1X Authentication
- Configuring 802.1X Authentication
- Enabling 802.1x Supplicant Support on an AP
  - Prerequisites
  - Provisioning an AP as an 802.1X Supplicant
    - In the WebUI
    - In the CLI
- Sample Configurations
- Performing Advanced Configuration Options for 802.1X
  - Configuring Reauthentication with Unicast Key Rotation
    - In the WebUI
    - In the CLI
- Application Single Sign-On Using L2 Authentication
Stateful and WISPr Authentication
- Working With Stateful Authentication
- Working With WISPr Authentication
- Understanding Stateful Authentication Best Practices
- Configuring Stateful 802.1X Authentication
  - In the WebUI
  - In the CLI
- Configuring Stateful NTLM Authentication
  - In the WebUI
  - In the CLI
- Configuring Stateful Kerberos Authentication
  - In the WebUI
  - In the CLI
- Configuring WISPr Authentication
  - In the WebUI
  - In the CLI
Certificate Revocation
- Understanding OCSP and CRL
  - Configuring a Controller as OCSP and CRL Clients
  - Configuring an OCSP Controller as a Responder
- Configuring the Controller as an OCSP Client
  - In the WebUI
  - In the CLI
- Configuring the Controller as a CRL Client
  - In the WebUI
  - In the CLI
- Configuring the Controller as an OCSP Responder
  - In the WebUI
  - In the CLI
- Certificate Revocation Checking for SSH Pubkey Authentication
Captive Portal Authentication
- Understanding Captive Portal
  - Policy Enforcement Firewall Next Generation (PEFNG) License
  - Controller Server Certificate
- Configuring Captive Portal in the Base Operating System
  - In the WebUI
  - In the CLI
- Using Captive Portal with a PEFNG License
  - Configuring Captive Portal in the WebUI
  - Configuring Captive Portal in the CLI
- Sample Authentication with Captive Portal
- Configuring Guest VLANs
  - In the WebUI
  - In the CLI
- Configuring Captive Portal Authentication Profiles
- Enabling Optional Captive Portal Configurations
- Personalizing the Captive Portal Page
- Creating and Installing an Internal Captive Portal
- Creating Walled Garden Access
  - In the WebUI
  - In the CLI
- Enabling Captive Portal Enhancements
Virtual Private Networks
- Planning a VPN Configuration
- Working with VPN Authentication Profiles
- Configuring a Basic VPN for L2TP/IPsec in the WebUI
- Configuring a VPN for L2TP/IPsec with IKEv2 in the WebUI
- Configuring a VPN for Smart Card Clients
  - Working with Smart Card clients using IKEv2
  - Working with Smart Card Clients using IKEv1
- Configuring a VPN for Clients with User Passwords
  - In the WebUI
  - In the CLI
- Configuring Remote Access VPNs for XAuth
  - Configuring VPNs for XAuth Clients using Smart Cards
  - Configuring a VPN for XAuth Clients Using a Username and Password
- Working with Remote Access VPNs for PPTP
  - In the WebUI
  - In the CLI
- Working with Site-to-Site VPNs
- Working with VPN Dialer
  - Configuring VPN Dialer
    - In the WebUI
    - In the CLI
  - Assigning a Dialer to a User Role
    - In the WebUI
    - In the CLI
Roles and Policies
- Configuring Firewall Policies
- User Roles
  - In the WebUI
  - In the CLI
- Assigning User Roles
- Understanding Global Firewall Parameters
- Using AppRF 2.0
ClearPass Policy Manager Integration
- Introduction
- Important Points to Remember
- Enabling Downloadable Role on a Controller
  - Using the WebUI
  - Using the CLI
- Sample Configuration
  - CPPM Server Configuration
  - Controller Configuration
Virtual APs
- Virtual AP Configuration Workflow
  - Using the WebUI
  - Using the CLI
- Virtual AP Profiles
- Changing a Virtual AP Forwarding Mode
- Radio Resource Management (802.11k)
- BSS Transition Management (802.11v)
- Fast BSS Transition ( 802.11r)
- SSID Profiles
  - SSID Profile Overview
  - Configuring the SSID Profile
    - In the WebUI
    - In the CLI
- WLAN Authentication
  - Configuring an AAA Profile in the WebUI
  - Configuring an AAA Profile in the CLI
- High-Throughput Virtual APs
- Guest WLANs
- Changing a Virtual AP Forwarding Mode
Adaptive Radio Management
- ARM Feature Overviews
- Configuring ARM Settings
- ARM Troubleshooting
- Understanding ARM
  - ARM Support for 802.11n
  - Monitoring Your Network with ARM
- Client Match
- ARM Coverage and Interference Metrics
- Configuring ARM Profiles
- Assigning an ARM Profile to an AP Group
  - In the WebUI
  - In the CLI
- Using Multi-Band ARM for 802.11a/802.11g Traffic
- Band Steering
  - Steering Modes
  - Enabling Band Steering
    - In the WebUI
    - In the CLI
- Enabling Traffic Shaping
  - Enabling Traffic Shaping
    - In the WebUI
    - In the CLI
  - Enabling or Disabling the Hard Limit Parameter in Traffic Management Profile
    - Using the WebUI
    - Using the CLI
- Spectrum Load Balancing
- Reusing Channels to Control RX Sensitivity Tuning
- Configuring Non-802.11 Noise Interference Immunity
- Troubleshooting ARM
Wireless Intrusion Prevention
- Working with the Reusable Wizard
  - Understanding Wizard Intrusion Detection
  - Understanding Wizard Intrusion Protection
    - Protecting Your Infrastructure
    - Protecting Your Clients
- Monitoring the Dashboard
- Detecting Rogue APs
- Working with Intrusion Detection
  - Understanding Infrastructure Intrusion Detection
  - Understanding Client Intrusion Detection
- Configuring Intrusion Protection
- Configuring the WLAN Management System (WMS)
  - In the WebUI
  - In the CLI
    - Configuring Local WMS Settings
    - Managing the WMS Database
- Understanding Client Blacklisting
- Working with WIP Advanced Features
- Configuring TotalWatch
- Administering TotalWatch
- Tarpit Shielding Overview
- Configuring Tarpit Shielding
  - Enabling Tarpit Shielding
  - Understanding Tarpit Shielding Licensing CLI Commands
Access Points
- Basic Functions and Features
- Naming and Grouping APs
  - Creating an AP group
    - In the WebUI
    - In the CLI
  - Assigning APs to an AP Group
    - In the WebUI
    - In the CLI
- Understanding AP Configuration Profiles
- Before you Deploy an AP
  - Mesh AP Preconfiguration
  - Remote AP Preconfiguration
- Enable Controller Discovery
- Enable DHCP to Provide APs with IP Addresses
  - In the WebUI
  - In the CLI
- AP Provisioning Profiles
  - Defining an AP Provisioning Profile
  - Assigning Provisioning Profiles
- Configuring Installed APs
- Optional AP Configuration Settings
- RF Management
- Optimizing APs Over Low-Speed Links
  - Configuring the Bootstrap Threshold
  - Prioritizing AP heartbeats
- AP Scanning Optimization
  - Channel Types and Priority
    - In the CLI
  - Scanning Optimizations
- Channel Group Scanning
- Configuring AP Channel Assignments
- Managing AP Console Settings
  - Username and Password Protection
    - Setting a Console/Telnet Username and Password
    - Disabling Access to the AP Console
- Link Aggregation Support on W-AP220 Series and W-AP270 Series
- Service Tag
  - In the WebUI
  - In the CLI
Secure Enterprise Mesh
- Mesh Overview Information
- Mesh Configuration Procedures
- Understanding Mesh Access Points
- Understanding Mesh Links
  - Link Metrics
  - Optimizing Links
- Understanding Mesh Profiles
- Understanding Remote Mesh Portals (RMPs)
- Understanding the AP Boot Sequence
- Mesh Deployment Solutions
- Mesh Deployment Planning
- Configuring Mesh Cluster Profiles
  - Managing Mesh Cluster Profiles in the WebUI
  - Managing Mesh Cluster Profiles in the CLI
- Creating and Editing Mesh Radio Profiles
- Creating and Editing Mesh High-Throughput SSID Profiles
  - Managing Mesh High-Throughput SSID Profiles in the WebUI
  - Managing Mesh High-Throughput SSID Profiles in the CLI
- Configuring Ethernet Ports for Mesh
- Provisioning Mesh Nodes
  - Provisioning Caveats
  - Provisioning Mesh Nodes
    - In the WebUI
    - In the CLI
- Verifying Your Mesh Network
  - Verification Checklist
  - CLI Examples
- Configuring Remote Mesh Portals (RMPs)
  - Creating a Remote Mesh Portal In the WebUI
  - Provisioning a Remote Mesh Portal In the CLI
Increasing Network Uptime Through Redundancy and VRRP
- High Availability
  - Pre-Deployment Information
  - Configuration Procedures
- VRRP-Based Redundancy
- High Availability Deployment Models
- Client State Synchronization
  - Feature Guidelines and Limitations
- High Availability Inter-Controller Heartbeats
- High Availability Extended Controller Capacity
- Configuring High Availability
  - Pre-Deployment Information
  - Configuring High Availability
    - In the WebUI
    - In the CLI
- Migrating from VRRP or Backup-LMS Redundancy
  - Configuring a Master Controller for Redundancy and High Availability
    - Migrating from VRRP Redundancy
    - Migrating from Backup-LMS Redundancy
- Configuring VRRP Redundancy
RSTP
- Understanding RSTP Migration and Interoperability
- Working with Rapid Convergence
  - Edge Port and Point-to-Point
- Configuring RSTP
- Troubleshooting RSTP
PVST+
- Understanding PVST+ Interoperability and Best Practices
- Enabling PVST+ in the CLI
- Enabling PVST+ in the WebUI
Link Layer Discovery Protocol
- Important Points to Remember
- LLDP Overview
  - Default LLDP Configuration
- Configuring LLDP
- Monitoring LLDP Configuration
IP Mobility
- Understanding Dell Mobility Architecture
- Configuring Mobility Domains
- Tracking Mobile Users
- Configuring Advanced Mobility Functions
- Understanding Bridge Mode Mobility Deployments
- Enabling Mobility Multicast
External Firewall Configuration
- Understanding Firewall Port Configuration Among Dell Devices
- Enabling Network Access
- Ports Used for Virtual Internet Access (VIA)
- Configuring Ports to Allow Other Traffic Types
Palo Alto Networks Firewall Integration
- Limitations
- Preconfiguration on the PAN Firewall
  - User-ID Support
  - Device-Type Based Policy Support
- Configuring PAN Firewall Integration
Remote Access Points
- About Remote Access Points
- Configuring the Secure Remote Access Point Service
- Deploying a Branch/Home Office Solution
- Enabling Remote AP Advanced Configuration Options
- Understanding Split Tunneling
- Understanding Bridge
- Provisioning Wi-Fi Multimedia
- Reserving Uplink Bandwidth
  - Understanding Bandwidth Reservation for Uplink Voice Traffic
  - Configuring Bandwidth Reservation
    - In the WebUI
    - In the CLI
- Provisioning 4G USB Modems on Remote Access Points
- Provisioning RAPs at Home
  - Prerequisites
  - Provisioning RAP Using Zero Touch Provisioning
- Configuring W-IAP3WN and W-IAP3WNP Access Points
  - In the WebUI
  - In the CLI
- Converting an IAP to RAP or CAP
  - Converting IAP to RAP
  - Converting an IAP to CAP
- Enabling Bandwidth Contract Support for RAPs
  - Configuring Bandwidth Contracts for RAP
Virtual Intranet Access
Spectrum Analysis
- Understanding Spectrum Analysis
- Creating Spectrum Monitors and Hybrid APs
- Connecting Spectrum Devices to the Spectrum Analysis Client
  - View Connected Spectrum Analysis Devices
  - Disconnecting a Spectrum Device
- Configuring the Spectrum Analysis Dashboards
- Customizing Spectrum Analysis Graphs
  - Spectrum Analysis Graph Configuration Options
- Working with Non-Wi-Fi Interferers
- Understanding the Spectrum Analysis Session Log
- Viewing Spectrum Analysis Data
- Recording Spectrum Analysis Data
- Troubleshooting Spectrum Analysis
Dashboard Monitoring
- WAN
- Performance
- Usage
- Potential Issues
- AppRF
  - All Traffic
  - Web Content Classification
- AirGroup
- Security
- UCC
  - Chart View
  - Details View
- Controller
  - Details View
  - Controller Events
- WLANs
- Access Points
- Clients
- Firewall
Management Access
- Configuring Certificate Authentication for WebUI Access
  - In the WebUI
  - In the CLI
- Secure Shell (SSH)
- Enabling Public Key Authentication
  - In the WebUI
  - In the CLI
- Enabling RADIUS Server Authentication
- Connecting to an W-AirWave Server
  - AMON Message Size Changes on the Controller
- Custom Certificate Support for RAP
  - Suite-B Support for ECDSA Certificate
  - Storing CSR and Private Key Files in a USB
- Implementing a Specific Management Password Policy
  - Defining a Management Password Policy
    - In the WebUI
    - In the CLI
  - Management Authentication Profile Parameters
- Configuring AP Image Preload
  - Enable and Configure AP Image Preload
    - In the WebUI
    - In the CLI
  - View AP Preload Status
- Configuring Centralized Image Upgrades
  - Configuring Centralized Image Upgrades
    - Using the WebUI
    - In the CLI
  - Viewing Controller Upgrade Statistics
- Managing Certificates
- Configuring SNMP
  - SNMP Parameters for the Controller
    - In the WebUI
    - In the CLI
- Enabling Capacity Alerts
  - In the WebUI
  - In the CLI
- Configuring Logging
  - In the WebUI
  - In the CLI
- Enabling Guest Provisioning
- Managing Files on the Controller
- Setting the System Clock
- ClearPass Profiling with IF-MAP
  - In the WebUI
  - In the CLI
- Whitelist Synchronization
  - In the WebUI
  - In the CLI
- Downloadable Regulatory Table
802.11u Hotspots
- Hotspot 2.0 Pre-Deployment Information
- Hotspot Profile Configuration Tasks
- Hotspot 2.0 Overview
- Configuring Hotspot 2.0 Profiles
  - In the WebUI
  - In the CLI
- Configuring Hotspot Advertisement Profiles
  - Configuring an Advertisement Profile
    - In the WebUI
    - In the CLI
  - Associating the Advertisement Profile to a Hotspot 2.0 Profile
    - In the WebUI
    - In the CLI
- Configuring ANQP Venue Name Profiles
- Configuring ANQP Network Authentication Profiles
  - In the WebUI
  - In the CLI
- Configuring ANQP Domain Name Profiles
  - In the WebUI
  - In the CLI
- Configuring ANQP IP Address Availability Profiles
  - In the WebUI
  - In the CLI
- Configuring ANQP NAI Realm Profiles
  - In the WebUI
  - In the CLI
- Configuring ANQP Roaming Consortium Profiles
  - In the WebUI
  - In the CLI
- Configuring ANQP 3GPP Cellular Network Profiles
  - In the WebUI
  - In the CLI
- Configuring H2QP Connection Capability Profiles
  - In the WebUI
  - In the CLI
- Configuring H2QP Operator Friendly Name Profiles
  - In the WebUI
  - In the CLI
- Configuring H2QP Operating Class Indication Profiles
  - In the WebUI
  - In the CLI
- Configuring H2QP WAN Metrics Profiles
  - In the WebUI
  - In the CLI
Adding Local Controllers
- Moving to a Multi-Controller Environment
  - Configuring a PSK
    - Configuring a Master Controller PSK
    - Configuring a Local Controller PSK
  - Configuring a Controller Certificate
    - Configuring a Local Controller Certificate
    - Configuring a Master Controller Certificate
- Configuring Local Controllers
Advanced Security
- Securing Client Traffic
- Securing Controller-to-Controller Communication
  - Configuring Controllers for xSec
    - In the WebUI
    - In the CLI
- Configuring the Odyssey Client on Client Machines
  - Installing the Odyssey Client
Voice and Video
- Voice and Video License Requirements
- Configuring Voice and Video
- Working with QoS for Voice and Video
- Unified Communication and Collaboration
- Understanding Extended Voice and Video Features
- Advanced Voice Troubleshooting
AirGroup
- Zero Configuration Networking
- AirGroup Solution
- AirGroup Deployment Models
  - Integrated Deployment Model
  - AirGroup with ClearPass Policy Manager
- Features Supported in AirGroup
- ClearPass Policy Manager and ClearPass Guest Features
- Auto-association and Controller-based Policy
  - Configuring Auto-association and Controller-based Policy
- Best Practices and Limitations
- Integrated Deployment Model
  - Master-Local Controller Synchronization
  - Configuring an AirGroup Integrated Deployment Model
- Controller Dashboard Monitoring
- Configuring the AirGroup-CPPM Interface
- Bluetooth-Based Discovery and AirGroup
- AirGroup mDNS Static Records
  - Important Points to Remember
  - Creating mDNS Static Records on a Controller
    - Group mDNS Static Records
    - Individual Static mDNS Records
- mDNS AP VLAN Aggregation
  - Configuring mDNS AP VLAN Aggregation
- mDNS Multicast Response Propagation
  - Maximum Number of iChat Users
  - Configuring mDNS Multicast Response Propagation
    - In the WebUI
    - In the CLI
- Troubleshooting and Log Messages
Instant AP VPN Support
- Overview
- VPN Configuration
- Viewing Branch Status
W-600 Series Controllers
- Connecting with a USB Cellular Modems
- Configuring a Supported USB Modem
- Configuring a New USB Modem
External Services Interface
- Sample ESI Topology
- Understanding the ESI Syslog Parser
- Configuring ESI
- Sample Route-Mode ESI Topology
- Sample NAT-mode ESI Topology
- Understanding Basic Regular Expression (BRE) Syntax
External User Management
- Overview
  - Before you Begin
- Working with the ArubaOS XML API Works
- Creating an XML Request
- XML Response
  - Default Response Format
    - Response Codes
  - Query Command Response Format
- Using the XML API Server
- Sample Code
  - Using XML API in C Language
Behavior and Defaults
- Understanding Mode Support
- Understanding Basic System Defaults
- Understanding Default Management User Roles
- Understanding Default Open Ports
DHCP with Vendor-Specific Options
- Configuring a Windows-Based DHCP Server
  - Configuring Option 60
    - Configuring Option 60 using the Windows DHCP Server
  - Configuring Option 43
    - Configuring Option 43 using the Windows DHCP Server:
- Enabling DHCP Relay Agent Information Option (Option 82)
  - Configuring Option 82
    - In the WebUI
    - In the CLI
- Enabling Linux DHCP Servers
802.1X Configuration for IAS and Windows Clients
- Configuring Microsoft IAS
- Configuring Management Authentication using IAS
- Window XP Wireless Client Sample Configuration
Acronyms and Terms
- Acronyms
- Terms

In the CLI

To configure the Captive Portal dialer for a user-role via the CLI, access the CLI in config mode and issue the

following commands:

(host) (config) #user-role <role>

dialer <name>

Dell Networking W-Series ArubaOS 6.4.x | User Guide Virtual Private Networks | 437