Cisco Cisco Aironet 350 Mini-PCI Wireless LAN Client Adapter User Manuals

Table of Contents

• Enterprise Mobility 4.1 Design Guide

  1
• Cisco Validated Design

  2
• Contents

  3
• Preface

  15
  • Document Purpose

    15
  • Intended Audience

    15
  • Document Organization

    15
• Cisco Unified Wireless Network Solution Overview

  17
  • WLAN Introduction

    17
  • WLAN Solution Benefits

    17
  • Requirements of WLAN Systems

    18
  • Cisco Unified Wireless Network

    21
• Cisco Unified Wireless Technology and Architecture

  23
  • LWAPP Overview

    23
    • Split MAC

      24
    • Layer 2 and Layer 3 Tunnels

      26
      • Layer 2 Tunnel

        26
      • Layer 3 Tunnel

        27
    • WLC Discovery and Selection

      30
  • Components

    31
    • WLCs

      31
    • APs

      32
      • Cisco Standalone APs

        32
      • Cisco LWAPP APs

        33
  • Mobility Groups, AP Groups, and RF Groups

    35
    • Mobility Groups

      35
    • Mobility Group Definition

      36
      • Mobility Group Application

        37
      • Mobility Group-Exceptions

        37
    • AP Groups

      37
    • RF Groups

      38
  • Roaming

    39
    • WLC to WLC Roaming Across Client Subnets

      40
      • Layer 3 Roam-Asymmetrical Mobility Tunnel

        41
      • Layer 3 Roam-Symmetrical Mobility Tunnel

        42
    • Important Notes About Layer 3 Roaming

      44
  • Broadcast and Multicast on the WLC

    44
    • WLC Broadcast and Multicast Details

      46
      • DHCP

        46
      • ARP

        46
    • Other Broadcast and Multicast Traffic

      47
  • Design Considerations

    47
    • WLC Location

      48
    • Centralizing WLCs

      49
    • Distributed WLC Network Connectivity

      50
    • Traffic Load and Wired Network Performance

      52
    • AP Connectivity

      53
  • Operation and Maintenance

    53
    • WLC Discovery

      53
    • AP Distribution

      54
    • Firmware Changes

      54
• WLAN Radio Frequency Design Considerations

  57
  • RF Basics

    57
    • Regulatory Domains

      57
    • Operating Frequencies

      58
      • 802.11b/g Operating Frequencies and Data Rates

        59
      • 802.11a Operating Frequencies and Data Rates

        59
    • Understanding the IEEE 802.11 Standards

      62
      • Direct Sequence Spread Spectrum

        63
      • IEEE 802.11b Direct Sequence Channels

        63
      • IEEE 802.11g

        64
      • IEEE 802.11a OFDM Physical Layer

        65
      • IEEE 802.11a Channels

        65
    • RF Power Terminology

      66
      • dB

        66
      • dBi

        66
      • dBm

        66
      • Effective Isotropic Radiated Power

        67
  • Planning for RF Deployment

    67
    • Different Deployment Types of Overlapping WLAN Coverage

      68
      • Data-Only Deployment

        68
      • Voice/Deployment

        69
      • Location-Based Services Deployments

        70
    • WLAN Data Rate Requirements

      72
      • Data Rate Compared to Coverage Area

        72
      • AP Density for Different Data Rates

        73
    • Client Density and Throughput Requirements

      75
    • WLAN Coverage Requirements

      76
    • Power Level and Antenna Choice

      77
      • Omni-Directional Antennas

        77
      • Patch Antennas

        78
    • Security Policy Requirements

      79
    • RF Environment

      79
    • RF Deployment Best Practices

      80
  • Manually Fine-Tuning WLAN Coverage

    81
    • Channel and Data Rate Selection

      81
      • Recommendations for Channel Selection

        81
      • Manual Channel Selection

        82
      • Data Rate Selection

        84
        • Mandatory, Supported, and Disabled Rate Modes

          85
        • Lowest and Highest Mandatory Rate Settings

          85
  • Radio Resource Management (Auto-RF)

    86
    • Overview of Auto-RF Operation

      86
    • Auto-RF Variables and Settings

      87
      • Sample show ap auto-rf Command Output

        90
      • Dynamic Channel Assignment

        91
      • Interference Detection and Avoidance

        91
      • Dynamic Transmit Power Control

        92
      • Coverage Hole Detection and Correction

        92
      • Client and Network Load Balancing

        92
• Cisco Unified Wireless Network Architecture-Base Security Features

  93
  • Base 802.11 Security Features

    93
    • WLAN Security Implementation Criteria

      93
    • Terminology

      95
  • 802.1X

    96
    • Extensible Authentication Protocol

      97
    • Authentication

      98
    • Supplicants

      98
    • Authenticator

      99
    • Authentication Server

      101
  • Encryption

    102
    • WEP

      103
    • TKIP Encryption

      103
    • AES Encryption

      104
    • Four-Way Handshake

      105
  • Cisco Compatible Extensions

    106
    • Proactive Key Caching and CCKM

      108
  • Cisco Unified Wireless Network Architecture

    110
    • LWAPP Features

      111
  • Cisco Unified Wireless Security Features

    112
    • Enhanced WLAN Security Options

      112
      • Local EAP Authentication

        114
    • ACL and Firewall Features

      116
    • DHCP and ARP Protection

      116
    • Peer-to-Peer Blocking

      117
    • Wireless IDS

      117
    • Client Exclusion

      118
    • Rogue AP

      119
      • Air/RF Detection

        120
      • Location

        121
      • Wire Detection

        121
      • Rogue AP Containment

        122
    • Management Frame Protection

      122
      • Client Management Frame Protection

        125
    • WCS Security Features

      125
      • Configuration Verification

        125
      • Alarms and Reports

        126
  • Architecture Integration

    127
  • Cisco Integrated Security Features

    128
    • Types of Attacks

      128
      • MAC Flooding Attack

        128
      • DHCP Rogue Server Attack

        129
      • DHCP Starvation Attack

        129
      • ARP Spoofing-based Man-In-the-Middle Attack

        129
      • IP Spoofing Attack

        129
    • CISF for Wireless Deployment Scenarios

      129
    • Using CISF for Wireless Features

      131
      • Using Port Security to Mitigate a MAC Flooding Attack

        131
        • Port Security in a Wireless Network

          131
        • Effectiveness of Port Security

          132
      • Using Port Security to Mitigate a DHCP Starvation Attack

        132
        • Wireless DHCP Starvation Attack

          132
      • Using DHCP Snooping to Mitigate a Rogue DHCP Server Attack

        133
        • DHCP Snooping for Wireless Access

          133
        • Effectiveness of DHCP Snooping

          134
      • Using Dynamic ARP Inspection to Mitigate a Man-in-the-Middle Attack

        134
        • DAI for Wireless Access

          134
        • Effectiveness of DAI

          135
      • Using IP Source Guard to Mitigate IP and MAC Spoofing

        136
        • IP Source Guard for Wireless Access

          136
        • Effectiveness of IP Source Guard

          137
      • Summary of Findings

        138
  • References

    139
• Cisco Unified Wireless QoS

  141
  • QoS Overview

    141
  • Wireless QoS Deployment Schemes

    142
    • QoS Parameters

      142
    • Upstream and Downstream QoS

      143
    • QoS and Network Performance

      144
  • 802.11 DCF

    144
    • Interframe Spaces

      145
    • Random Backoff

      145
    • CWmin, CWmax, and Retries

      146
  • Wi-Fi Multimedia

    147
    • WMM Access

      147
    • WMM Classification

      147
    • WMM Queues

      149
      • EDCA

        150
      • U-APSD

        152
      • TSpec Admission Control

        154
        • Add Traffic Stream

          154
  • QoS Advanced Features for WLAN Infrastructure

    156
    • IP Phones

      159
    • Setting the Admission Control Parameters

      159
      • Impact of TSpec Admission Control

        161
  • 802.11e, 802.1P, and DSCP Mapping

    162
    • QoS Baseline Priority Mapping

      163
      • Deploying QoS Features on LWAPP-based APs

        163
      • WAN QoS and the H-REAP

        164
  • Guidelines for Deploying Wireless QoS

    164
    • Throughput

      164
    • QoS Example LAN Switch Configuration

      165
      • AP Switch Configuration

        165
      • WLC Switch Configuration

        165
    • Traffic Shaping, Over the Air QoS, and WMM Clients

      166
    • WLAN Voice and the Cisco 7921G and 7920

      166
  • LWAPP over WAN Connections

    166
    • LWAPP Traffic Classification

      167
      • LWAPP Control Traffic

        167
      • LWAPP 802.11 Traffic

        170
    • Classification Considerations

      170
      • LWAPP Traffic Volumes

        170
      • Example Router Configurations

        170
        • Remarking Client Generated CS6 Packets

          170
        • Changing the DSCP of LWAPP Control Traffic above a predefined rate

          171
• Cisco Unified Wireless Multicast Design

  173
  • Introduction

    173
  • Overview of Multicast Forwarding in Cisco Unified Wireless Networks

    173
    • Wireless Multicast Roaming

      175
      • Asymmetric Multicast Tunneling

        175
  • Multicast Enabled Networks

    176
    • LWAPP Multicast Reserved Ports and Addresses

      176
    • Enabling Multicast Forwarding on the Controller

      177
      • CLI Commands to Enable Ethernet Multicast Mode

        177
  • Multicast Deployment Considerations

    178
    • Recommendations for Choosing an LWAPP Multicast Address

      178
    • Fragmentation and LWAPP Multicast Packets

      178
      • All Controllers have the Same LWAPP Multicast Group

        179
      • Controlling Multicast on the WLAN Using Standard Multicast Techniques

        179
  • How Controller Placement Impacts Multicast Traffic and Roaming

    181
  • Additional Considerations

    182
• Cisco Unified Wireless Hybrid REAP

  183
  • Remote Edge AP

    183
  • Hybrid REAP

    184
    • Supported Platforms

      184
      • WLAN WLCs

        184
      • Access Points

        185
    • H-REAP Terminology

      185
      • Switching Modes

        185
      • Operation Modes

        185
      • H-REAP States

        186
    • Applications

      188
      • Branch Wireless Connectivity

        188
      • Branch Guest Access

        189
      • Public WLAN Hotspot

        190
      • Unified Wireless Feature Support

        191
      • Deployment Considerations

        192
        • WAN Link

          192
      • Roaming

        193
        • Radio Resource Management

          193
        • Location Services

          194
        • QoS Considerations

          194
        • General WLC Deployment Considerations with H-REAP

          194
      • WAN Link Disruptions

        195
        • EAP 802.1x and Web Auth WLANs

          195
        • Other Features

          195
        • Radio Configuration

          195
      • H-REAP Limitations and Caveats

        196
        • Local Switching Restrictions

          196
        • Max Supported WLANs

          196
        • Network Address Translation (NAT/PAT)

          196
      • Restricting Inter-Client Communication

        198
      • H-REAP Scaling

        198
      • Inline Power

        199
      • Management

        199
  • H-REAP Configuration

    199
    • Initial Configuration

      199
      • Serial Console Port

        199
      • DHCP with Statically Configured WLC IPs

        201
    • Configuring LAP for H-REAP Operation

      201
      • Enabling VLAN Support

        203
    • Advanced Configuration

      203
      • Choosing WLANs for Local Switching

        204
        • Configuring H-REAP Support on a WLAN

          204
      • H-REAP Local Switching (VLAN) Configuration

        205
        • Establishing a WLAN to Local VLAN Mapping

          206
      • WLC Dynamic Interface Configuration for Remote Only WLANs

        207
    • H-REAP Verification

      207
      • Verifying the H-REAP AP Addressing

        207
      • Verifying the WLC Resolution Configuration

        207
    • Troubleshooting

      208
      • H-REAP Does Not Join the WLC

        208
      • Client Associated to Local Switched WLAN Cannot Obtain an IP Address

        208
      • Client Cannot Authenticate or Associate to Locally Switched WLAN

        208
      • Client Cannot Authenticate or Associate to the Central Switched WLAN

        209
      • H-REAP Debug Commands

        209
        • WLC Debug Commands

          209
      • H-REAP AP Debug Commands

        209
• Cisco Wireless Mesh Networking

  211
  • Introduction

    211
    • Cisco 1500 Series Mesh AP

      212
    • Cisco Wireless LAN Controllers

      214
    • Wireless Control System (WCS)

      215
  • Wireless Mesh Operation

    215
    • Bridge Authentication

      216
    • Wireless Mesh Encryption

      216
    • AWPP Wireless Mesh Routing

      217
    • Example Simple Mesh Deployment

      217
    • Mesh Neighbors, Parents, and Children

      220
    • Background Scanning in Mesh Networks

      222
    • Ease Calculation

      224
    • SNR Smoothing

      224
    • Loop Prevention

      224
    • Choosing the Best Mesh Parent

      225
    • Routing Around an Interface

      225
  • Design Details

    225
    • Wireless Mesh Design Constraints

      226
    • Client WLAN

      226
    • Bridging Backhaul Packets

      226
    • Client Access on Backhaul Connections

      227
  • Increasing Mesh Availability

    227
    • Multiple RAPs

      229
    • Multiple Controllers

      230
    • Multiple Wireless Mesh Mobility Groups

      231
  • Design Example

    231
    • MAP Density and Distance

      231
  • Connecting the Cisco 1500 Mesh AP to your Network

    234
    • Physical Placement of Mesh APs

      235
  • AP 1500 Alternate Deployment Options

    236
    • Wireless Backhaul

      236
    • Point-to-Multipoint Wireless Bridging

      236
    • 10.6.3 Point-to-Point Wireless Bridging

      237
• VoWLAN Design Recommendations

  239
  • Antenna Considerations

    239
    • AP Antenna Selection

      239
    • Antenna Positioning

      241
    • Handset Antennas

      241
  • Channel Utilization

    241
    • Dynamic Frequency Selection (DFS) and 802.11h Requirements of the APs

      242
      • Channels in the 5 GHz Band

        243
  • Call Capacity

    245
    • AP Call Capacity

      248
  • Cell Edge Design

    250
  • Dual Band Coverage Cells

    252
  • Dynamic Transmit Power Control

    252
  • Interference Sources Local to the User

    253
• Cisco Unified Wireless Guest Access Services

  255
  • Introduction

    255
  • Scope

    256
  • Wireless Guest Access Overview

    256
    • Guest Access using the Cisco Unified Wireless Solution

      256
  • WLAN Controller Guest Access

    257
    • Supported Platforms

      258
    • Auto Anchor Mobility to Support Wireless Guest Access

      258
    • Anchor Controller Deployment Guidelines

      260
      • Anchor Controller Positioning

        260
      • DHCP Services

        261
      • Routing

        261
      • Anchor Controller Sizing and Scaling

        261
      • Anchor Controller Redundancy

        261
    • Web Portal Authentication

      262
      • User Redirection

        263
    • Guest Credentials Management

      264
      • Local Controller Lobby Admin Access

        265
    • Guest User Authentication

      265
      • External Authentication

        266
        • External Authentication using Cisco Secure ACS and Microsoft User Databases

          266
      • Guest Pass-through

        266
  • Guest Access Configuration

    268
    • Anchor WLC Installation and Interface Configuration

      269
      • Guest VLAN Interface Configuration

        270
        • Defining a New Interface

          270
        • Defining an Interface Name and VLAN ID

          270
        • Defining Interface Properties

          271
    • Mobility Group Configuration

      272
      • Defining the Default Mobility Domain Name for the Anchor WLC

        272
      • Defining Mobility Group Members of the Anchor WLC

        273
        • Adding Foreign Controllers as Mobility Group Members

          273
      • Adding the Anchor WLC as a Mobility Group Member of a Foreign WLC

        274
    • Guest WLAN Configuration

      274
      • Foreign WLC-Guest WLAN Configuration

        275
        • Defining a Guest WLAN SSID

          276
        • Defining Guest WLAN Parameters and Policies

          277
        • Establishing the Guest WLAN Mobility Anchor(s)

          280
        • Verifying the Guest WLAN Mobility Anchor

          281
    • Guest WLAN Configuration on the Anchor WLC

      281
      • Anchor WLC-Guest WLAN Interface

        282
        • Anchor WLC-Defining the Guest WLAN Mobility Anchor

          282
  • Guest Account Management

    283
    • Guest Management Using WCS

      284
      • Using the Add Guest User Template

        285
      • Using the Schedule Guest User Template

        288
      • Managing Guest Credentials Directly on the Anchor Controller

        293
      • Configuring the Maximum Number of User Accounts

        294
      • Maximum Concurrent User Logins

        294
      • Guest User Management Caveats

        295
  • Other Features and Solution Options

    295
    • Web Portal Page Configuration and Management

      295
      • Internal Web Page Management

        296
        • Importing A Web Page

          296
        • Selecting an Imported Web Auth Page

          297
      • Internal Web Certificate Management

        298
        • Importing an External Web Certificate

          299
    • Support for External Web Redirection

      299
    • Anchor WLC-Pre-Authentication ACL

      300
    • Anchor Controller DHCP Configuration

      302
      • Adding a New DHCP Scope to the Anchor Controller

        302
        • Defining a Scope Name

          302
        • Defining Scope Properties

          303
    • External Radius Authentication

      303
      • Adding a RADIUS Server

        304
    • External Access Control

      306
    • Verifying Guest Access Functionality

      308
      • Troubleshooting Guest Access

        308
        • User Cannot Associate to the Guest WLAN

          309
        • User Does Not Obtain an IP Address via DHCP

          309
        • User is Not Redirected to Web Auth Page

          309
        • User Cannot Authenticate

          309
        • User Cannot Connect to Internet or Upstream Service

          310
      • System Monitoring

        310
        • Anchor Controller

          310
        • Campus (Foreign) Controller

          312
      • Debug Commands

        313
• Mobile Access Router, Universal Bridge Client, and Cisco Unified Wireless

  315
  • 3200 Series Mobile Access Router Overview

    315
  • Cisco 3200 Series and Wireless Network Access

    316
    • Vehicle Network Example

      316
    • Simple Bridge Client Data Path Example

      317
    • Cisco 3200 Series in Mobile IP Environments

      318
    • WMIC Roaming Algorithm

      319
  • Basic Configuration Examples

    320
    • Connecting to the Cisco 32XX

      320
    • Configure IP Address, DHCP, VLAN on 3200 Series

      320
    • WMIC Configurations

      321
      • WMIC Work Group Bridge Configuration

        321
      • WMIC Universal Bridge Client Configuration

        322
      • WMIC as an Access Point Configuration

        322
  • Security

    322
    • Authentication Types

      322
    • Encryption and Key Management

      323
    • Security Configuration

      323
      • Assigning Authentication Types to an SSID

        323
      • Configuring dot1x Credentials

        325
      • EAP-TLS Authentication with AES Encryption Example

        326
      • Configuring the Root Device Interaction with WDS

        327
      • Configuring Additional WPA Settings

        328
        • Setting a Pre-Shared Key

          328
        • Configuring Group Key Updates

          328
      • WPA and Pre-shared Key Configuration Example

        328
  • Cisco 3200 Series Product Details

    329
    • Cisco 3200 Series Interfaces

      329
    • Cisco 3230 Enclosure Connections

      330
    • Cisco 3270 Rugged Enclosure Configuration

      330
    • Cisco 3200 Series WMIC Features

      332
    • Cisco 3200 Series Bridge Considerations

      333
    • Cisco 3200 Series Management Options

      335
• Cisco Unified Wireless and Mobile IP

  337
  • Introduction

    337
  • Different Levels of Network Mobility

    337
  • Requirements for a Mobility Solution

    339
    • Location Database

      340
    • Move Discovery, Location Discovery, and Update Signaling

      340
    • Path Re-establishment

      341
  • Roaming on a Cisco Unified Wireless Network

    341
  • Roaming on a Mobile IP-enabled Network

    342
    • Configuration 1: Sample Mobile IP Client Interface and Host Table Manipulation

      345
    • Mobile IP Client Characteristics When Roaming on a Cisco Unified Wireless Network

      346
• Cisco Unified Wireless Location-Based Services

  349
  • Introduction

    349
  • Reference Publications

    350
  • Cisco Location-Based Services Architecture

    350
    • Positioning Technologies

      350
    • What is RF Fingerprinting?

      351
    • Overall Architecture

      352
    • Role of the Cisco Wireless Location Appliance

      354
    • Accuracy and Precision

      356
    • Tracking Assets and Rogue Devices

      357
  • Cisco Location Control Protocol

    358
  • Installation and Configuration

    359
    • Installing and Configuring the Location Appliance and WCS

      359
  • Deployment Best Practices

    361
    • Location-Aware WLAN Design Considerations

      361
  • RFID Tag Considerations

    362
  • SOAP/XML Application Programming Interface

    363
• Glossary

  365