3Com 3CRWX120695A Installation And Basic Configuration Manual

Published October 2004 Wireless LAN Mobility System Wireless LAN Switch and Controller Installation and Basic Configuration Guide 3CRWX120695A, 3CRWX440095A

Marlborough, MA USA 01752-3064 Copyright © 2004, 3Com Corporation. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from 3Com Corporation. 3Com Corporation reserves the right to revise this documentation and to make changes in content from time to time without obligation on the part of 3Com Corporation to provide notification of such revision or change. 3Com Corporation provides this documentation without warranty, term, or condition of any kind, either implied or expressed, including, but not limited to, the implied warranties, terms or conditions of merchantability, satisfactory quality, and fitness for a particular purpose. 3Com may make improvements or changes in the product(s) and/or the program(s) described in this documentation at any time. If there is any software on removable media described in this documentation, it is furnished under a license agreement included with the product as a separate document, in the hard copy documentation, or on the removable media in a directory file named LICENSE.TXT or !LICENSE.TXT. If you are unable to locate a copy, please contact 3Com and a copy will be provided to you. UNITED STATES GOVERNMENT LEGEND If you are a United States government agency, then this documentation and the software described herein are provided to you subject to the following: All technical data and computer software are commercial in nature and developed solely at private expense. Software is delivered as “Commercial Computer Software” as defined in DFARS 252.227-7014 (June 1995) or as a “commercial item” as defined in FAR 2.101(a) and as such is provided with only such rights as are provided in 3Com’s standard commercial license for the Software. Technical data is provided with limited rights only as provided in DFAR 252.227-7015 (Nov 1995) or FAR 52.227-14 (June 1987), whichever is applicable. You agree not to remove or deface any portion of any legend provided on any licensed program or documentation contained in, or delivered to you in conjunction with, this User Guide. Unless otherwise indicated, 3Com registered trademarks are registered in the United States and may or may not be registered in other countries. 3Com is a registered trademark of 3Com Corporation. The 3Com logo is a trademark of 3Com Corporation. Mobility Domain, Mobility Point, Mobility Profile, Mobility System, Mobility System Software, MP, MSS, and SentrySweep are trademarks of Trapeze Networks, Inc. Intel and Pentium are registered trademarks of Intel Corporation. Microsoft, MS-DOS, Windows, Windows XP, and Windows NT are registered trademarks of Microsoft Corporation. All other company and product names may be trademarks of the respective companies with which they are associated. ENVIRONMENTAL STATEMENT It is the policy of 3Com Corporation to be environmentally-friendly in all operations. To uphold our policy, we are committed to: Establishing environmental performance standards that comply with national legislation and regulations. Conserving energy, materials and natural resources in all operations. Reducing the waste generated by all operations. Ensuring that all waste conforms to recognized environmental standards. Maximizing the recyclable and reusable content of all products. Ensuring that all products can be recycled, reused and disposed of safely. Ensuring that all products are labelled according to recognized environmental standards. Improving our environmental record on a continual basis. End of Life Statement 3Com processes allow for the recovery, reclamation and safe disposal of all end-of-life electronic components. Regulated Materials Statement 3Com products do not contain any hazardous or ozone-depleting material. Environmental Statement about the Documentation The documentation for this product is printed on paper that comes from sustainable, managed forests; it is fully biodegradable and recyclable, and is completely chlorine-free. The varnish is environmentally-friendly, and the inks are vegetable-based with a low heavy-metal content.

Conventions 7 Documentation 8 Documentation Comments 9 1 WX SWITCH OVERVIEW MAP Model Numbers 11 Hardware Features 12 WX1200 Switch 12 WX4400 Switch 12 Management Features 13 Power Features 13 Network Interfaces 13 Status LEDs 14 Software Features 15 Management Features 15 Layer 2 Switching Features 16 IP Services 16 Authentication, Authorization, and Accounting 17 Roaming 17 RF Management 17 2 INSTALLING AND CONNECTING A WX SWITCH Unpacking a WX Switch 19 Installation Requirements and Recommendations 20 3Com Wireless Switch Manager Network Plan 20 Installation Location 21 Cable Requirements 21 Installation Hardware and Tools 24

24 Equipment Rack Installation 25 Tabletop Installation 28 Powering On a WX Switch 28 Connecting to a Serial Management Console 29 Troubleshooting a Serial Management Connection 30 Connecting to the Network 31 Connecting to a MAP or Other 10/100 Ethernet Device 31 Connecting to Gigabit Ethernet Devices 33 3 CONFIGURING A WX SWITCH FOR BASIC SERVICE Before You Begin 35 Accessing the CLI 35 Configuration Overview 36 Configuring an Enable Password 38 Installing an Upgrade License 39 Configuring the Time and Date 40 Configuring IP Connectivity 42 Configuring VLANs and IP Addresses 42 Configuring a Default Route 44 Verifying IP Connectivity 45 Enabling Secure Communication for 3WXM or Web Manager 46 Installing a Certificate 47 Installing a Server Certificate for Network Users 52 Generating a Self-Signed Certificate for Network Users 53 Installing a Certificate Assigned by a Certificate Authority for Network Users 53 Displaying Certificate Information for Network Users 55 Enabling TLS on a Web Browser and Logging In to Web View 55 Specifying the Country of Operation 56 Specifying a System IP Address 59 Configuring for Authenticating Users 60 Configuring a Port for a Wired Authentication User 61 Configuring MAPs for Wireless Users 61 Configuring Mobility Domain Parameters 75 Configuring the Seed 75 Configuring a Nonseed Member 76

76 VLANs and Users 78 Configuring Pass-Through Authentication 78 Configuring EAP Offload with Server Authentication 82 Displaying and Saving the Configuration 84 A WX TECHNICAL SPECIFICATIONS B WX TROUBLESHOOTING C SAFETY INFORMATION D OBTAINING SUPPORT FOR YOUR PRODUCT Register Your Product 101 Purchase Value-Added Services 101 Troubleshoot Online 101 Access Software Downloads 102 Telephone Technical Support and Repair 102 Contact Us 103 INDEX

This guide shows you how to install a 3Com Wireless LAN Switch WX1200 or 3Com Wireless LAN Controller WX4400 in a Mobility System wireless LAN (WLAN) and deploy basic IEEE 802.11 wireless service. Read this guide if you are a network administrator or other person installing WX1200 or WX4400 switches and deploying 802.11 wireless service in a network. If release notes are shipped with your product and the information there differs from the information in this guide, follow the instructions in the release notes. Most user guides and release notes are available in Adobe Acrobat Reader Portable Document Format (PDF) or HTML on the 3Com World Wide Web site: http://www.3com.com/ Conventions Table 1 and Table 2 list conventions that are used throughout this guide. Table 1 Notice Icons Icon Notice Type Description Information note Information that describes important features or instructions Caution Information that alerts you to potential loss of data or potential damage to an application, system, or device Warning Information that alerts you to potential equipment damage or personal injury.

Documentation The MSS documentation set includes the following documents. ■ Wireless LAN Switch Manager (3WXM) Release Notes These notes provide information about the system software release, including new features and bug fixes. ■ Wireless LAN Switch and Controller Release Notes These notes provide information about the system software release, including new features and bug fixes. ■ Wireless LAN Switch and Controller Quick Start Guide This guide provides instructions for performing basic setup of secure (802.1X) and guest (Web AAA) access, for configuring a Mobility Domain for roaming, and for accessing a sample network plan in 3WXM for advanced configuration and management. Table 2 Text Conventions Convention Description Monospace text Sets off command syntax or sample commands and system responses. Bold text Highlights commands that you enter or items you select. Italic text Designates command variables that you replace with appropriate values, or highlights publication titles or words requiring special emphasis. [ ] (square brackets) Enclose optional parameters in command syntax. { } (curly brackets) Enclose mandatory parameters in command syntax. | (vertical bar) Separates mutually exclusive options in command syntax. Keyboard key names If you must press two or more keys simultaneously, the key names are linked with a plus sign (+). Example: Press Ctrl+Alt+Del Words in italics Italics are used to: ■ Emphasize a point. ■ Denote a new term at the place where it is defined in the text. ■ Highlight an example string, such as a username or SSID.

This manual shows you how to plan, configure, deploy, and manage a Mobility System wireless LAN (WLAN) using the 3Com Wireless LAN Switch Manager (3WXM). ■ Wireless LAN Switch and Controller Installation and Basic Configuration Guide This guide provides instructions and specifications for installing a WX wireless switch in a Mobility System WLAN, and basic instructions for deploying a secure IEEE 802.11 wireless service. ■ Wireless LAN Switch and Controller Configuration Guide This guide provides instructions for configuring and managing the system through the Mobility System Software (MSS) CLI. ■ Wireless LAN Switch and Controller Command Reference This reference provides syntax information for all MSS commands supported on WX switches. Documentation Comments Your suggestions are very important to us. They will help make our documentation more useful to you. Please e-mail comments about this document to 3Com at: [email protected] Please include the following information when contacting us: ■ Document title ■ Document part number and revision (on the title page) ■ Page number (if appropriate) Example: ■ Wireless LAN Switch and Controller Configuration Guide ■ Part number 730-9502-0071, Revision B ■ Page 25 Please note that we can only respond to comments and questions about 3Com product documentation at this e-mail address. Questions related to Technical Support or sales should be directed in the first instance to your network supplier.

A 3Com Wireless Switch (WX) provides mobility and authentication, authorization, and accounting (AAA) services for wireless or wired users. A WX switch also controls the operation of 3Com Managed Access Point (MAP) access points, which control and manage IEEE 802.11 operation over the air. WARNING: Installation must be performed by qualified service personnel only. Read and follow all warning notices and instructions marked on the product or included in the documentation. MAP Model Numbers Table 3 lists the MAP switch model numbers. Table 3 MAP Switch Model Numbers Model Port Configuration Power Supply Configuration WX1200 Eight 10/100 Ethernet ports, six of which support PoE One 100-120 VAC / 200-240 VAC autosensing AC power supply WX4400 Four dual-interface gigabit Ethernet ports. Each port has a 1000BASE-TX copper interface and a Gigabit interface converter (GBIC) slot for insertion of a 1000BASE-SX or 1000BASE-LX fiber-optic interface. Two 100-120 VAC / 200-240 VAC autosensing AC power supplies

Hardware Features The following sections describe the WX hardware features. WX1200 Switch A WX1200 switch is one RU high and can be installed in a standard 48.26-cm (19-inch) equipment rack or on a tabletop. Figure 1 shows the external hardware features of a WX1200 switch. Figure 1 WX1200 Switch—Front Panel Control Features The rear of the switch contains a label with the serial ID, MAC address, and other identifying information. WX4400 Switch A WX4400 switch is two rack units (RUs) high and can be installed in a standard 48.26-cm (19-inch) equipment rack or on a tabletop. Figure 2 shows a front view of a WX4400 switch and identifies the external hardware features. Power supply Power supply LED 10/100 Ethernet uplink ports 10/100 and MAP/PoE LEDs 10/100 and MAP Ethernet ports Serial console port

Like the WX1200, the rear of the WX4400 contains a label with the serial ID, MAC address, and other identifying information. Management Features ■ Serial console port—The serial console port provides a direct management connection to a WX switch’s command-line interface (CLI). The port has a DB-9 female connector and supports the EIA-232D signaling standard. ■ Status LEDs—The Ethernet ports and power supplies have LEDs that indicate their status. The management CPU on a WX4400 switch also has an LED. (For details, see “Status LEDs” on page 14.) ■ Flash card slot (WX4400 only)—The flash card slot is not used for normal WX operation. Power Features ■ Power supplies—A WX4400 switch comes with one 100-240 VAC autosensing AC power supply. You can add a second supply for load sharing and redundancy. The power supplies are hot-swappable. A WX1200 switch contains one 100-120 VAC / 200-240 VAC autosensing AC power supply. The WX1200 power supply is a fixed-configuration supply and cannot be inserted or removed. Network Interfaces ■ 10/100 Ethernet ports—A WX1200 switch has eight 10/100BASE-TX Ethernet ports. Each port has a standard RJ-45 connector and uses Category 5 (Cat 5) cable based on the EIA/TIA-586 standard. 100-240V 50/60 Hz 8A MAX DISCONNECT ALL POWER BEFORE SERVICING Gigabit link LEDs GBIC slot AC power inlet Power supply Power supply serial number Power supply LED Serial console port Flash card slot Eject button Mgmt LED 1000BASE-TX port Mgmt Console

Ports 1 through 6 can be configured for MAP access points and can support PoE. Ports 7 and 8 on the WX1200 switch are uplink ports only and do not support PoE. The 10/100 Ethernet ports on the WX1200 switch provide automatic MDI/MDX, which automatically crosses over the send and receive signals if required. A WX4400 switch provides high-bandwidth centralized control of many indirectly connected MAP access points. The switch does not have 10/100 Ethernet ports and does not provide PoE. ■ Gigabit interface converter (GBIC) slots (WX4400 only)—A WX4400 switch has four ports. Each port has a slot for a 1000BASE-SX or 1000BASE-LX fiber-optic GBIC, and a built-in 1000BASE-TX copper interface with an RJ-45 connector. Only one interface, copper or fiber, can be active on a port. The GBIC interface is active by default. Status LEDs The WX switches have LEDs that indicate port, power, and CPU status. Table 4 lists the LEDs. (For the location of each LED, see Figure 1 and Figure 2.) Table 4 WX Status LEDs LED Appearance Meaning Mgmt (WX4400 only) Bright green, then fade (repeated) This LED appearance is sometimes called breathing. WX switch is operating normally. Blinking green WX switch is booting. Quickly blinking amber WX switch was unable to boot completely. Power supply status Solid green DC power output is on. Solid amber Power fault has occurred. Unlit AC power is off. Gigabit fiber link activity (WX4400 only) Solid green 1000-Mbps fiber link is operational. Blinking green Traffic is active on the 1000-Mbps fiber link. Gigabit copper link activity (WX4400 only) Solid green 1000-Mbps copper link is operational. Blinking green Traffic is active on the 1000-Mbps copper link.

wired LAN features and wireless LAN features that enable you to integrate the switch into your wired network and provide network access for wired or wireless users. Management Features ■ Serial and network command-line interface (CLI) access—You can access the CLI through a direct serial connection or through the network using Secure Shell (SSH) or Telnet. ■ 3Com Wireless Switch Manager management application—3Com Wireless Switch Manager is an extensive GUI application for planning, configuring, deploying, and managing a 3Com network and its users. 3Com Wireless Switch Manager uses Secure Sockets Layer protocol (SSL) to interact with MSS. Link (WX1200 only) Solid green 100-Mbps link is operational. Solid amber 10-Mbps link is operational. Blinking green Traffic is active on the 100-Mbps link. Blinking amber Traffic is active on the 10-Mbps link. MAP (WX1200 only) Solid green For a MAP access point’s active link, with PoE enabled, all the following are true: ■ MAP access point has booted. ■ MAP access point has received a valid configuration from the WX switch. ■ Management link with a MAP access point is operational. Alternating green and amber MAP access point is booting with an image received from the WX switch. If the LED remains in this state indefinitely, the boot or configuration attempt has failed. Solid amber PoE is on but no MAP access point is connected to the link. Blinking amber MAP is not connected or is unresponsive, or there is a PoE problem. Unlit Port is not configured as a MAP access port, or PoE is off. Table 4 WX Status LEDs (continued) LED Appearance Meaning

■ Software and configuration management—You can store multiple software images and configuration files in the WX switch’s nonvolatile storage. ■ Web Manager—Web Manager is a Web-based application for configuring and managing a single WX switch through a Web browser. Web Manager creates a secure connection by using Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS). Layer 2 Switching Features ■ Spanning Tree Protocol (STP)—MSS is 802.1D-compatible and supports Per-VLAN Spanning Tree (PVST+). PVST+ allows a separate spanning tree in each virtual LAN (VLAN). Optional fast convergence features allow you to quickly resume traffic forwarding after a topology change. ■ Load-sharing port groups—You can configure multiple physical ports into a single logical link for traffic load sharing and physical link redundancy. ■ Virtual LANs (VLANs)—MSS supports logical segmentation of a switch’s ports into separate Layer 2 collision domains. A port can be a member of one or more VLANs. Each VLAN can have its own IP interface. MSS supports the 802.1Q tag format. ■ Internet Group Management Protocol (IGMP) snooping for multicast containment—The WX switch can learn about the multicast sources and receivers in the network and restrict forwarding for a multicast group to the users for that group. IGMPv1 and IGMPv2 are supported. IP Services ■ IP interfaces—You can configure an IP interface for each VLAN. ■ IP ping and traceroute—You can test IP connectivity between the WX switch and other devices. ■ Domain Name Service (DNS)—You can configure the switch to use DNS servers for name resolution. You also can configure a default domain name to append to hostnames. ■ Network Time Protocol (NTP)—A WX switch can sets its time and date by polling an NTP server. ■ System log—A WX generates log messages to log system events. The log messages are stored locally and also can be exported to syslog servers. ■ Simple Network Management Protocol (SNMP)—A WX switch can be configured to generate SNMP traps for major system events.

protocols. Based on authentication, users are assigned VLAN membership, access control, and roaming boundaries. ■ MAC authentication—If a device does not support 802.1X, you can configure authentication based on the source MAC address to assign VLAN membership, access control, and roaming boundaries. ■ Guest authentication—Guests can be authenticated by a shared set of authorization attributes that assign VLAN membership, access control, and roaming boundaries. ■ Local and remote authentication—You can authenticate users locally using information configured on the WX switch, or use a Remote Authentication Dial-In User Service (RADIUS) server. When you use a remote server, the WX switch can enhance performance by performing some of the AAA tasks locally or distributing the load across multiple servers. Roaming ■ MAP access point roaming—You can configure the WX switch to allow users to roam from one MAP access point to another on the same WX switch. ■ Mobility Domain™ roaming—You also can configure a group of WX switches to allow users to roam from one switch to another. Regardless of the wired subnet connections, each user maintains the same IP address and session across the network. ■ Session management—You can display session information and statistics for users. RF Management ■ RF Auto-Tuning—MSS can automatically assign channels and power settings to MAP access points based on RF information collected from the network. ■ Radio frequency (RF) topology—With 3Com Wireless Switch Manager, you can verify site coverage and capacity. ■ Rogue detection and countermeasures—MAPs can be used to gather RF information for validating an RF deployment plan, and for detecting and combatting rogue access points. ■ User-based RF—You can gather statistics on a per-user basis as users roam across the network.

WX SWITCH Before installing a WX switch, you might need to generate a network plan with 3Com Wireless Switch Manager. (See “3Com Wireless Switch Manager Network Plan” on page 20.) Unpacking a WX Switch The shipping carton for a WX switch contains the following items: ■ One WX switch, containing one power supply ■ For some countries, one country-specific power cord ■ One serial cable for connection to the management console ■ Two rack-mount brackets ■ Four adhesive rubber feet ■ One documentation pack that includes this guide ■ One set of release notes Figure 3 shows the contents of the shipping carton for a WX4400 switch. The contents of a WX1200 shipping carton are similar.

Figure 3 WX4400 Switch Shipping Carton Contents Before you begin installation: 1 Open the carton and carefully remove the contents, if you have not already done so. 2 Place the packing materials back in the carton and save the carton. 3 Verify that you received each item in the previous list. If any item is missing or damaged, contact 3Com. Installation Requirements and Recommendations For best results, follow these requirements and recommendations before installing a WX switch. 3Com Wireless Switch Manager Network Plan If you are using 3Com Wireless Switch Manager to plan your 3Com Mobility System installation, 3Com recommends that you create and verify a network plan for the entire 3Com network installation before Rack-mount brackets WX switch with installed power supply Power cord Serial cable Rubber feet Documentation pack

21 installing WX switches or MAP access points. A network plan provides the following information: ■ Number of WX switches required at your site, and where to install them ■ Number of MAP access points required for adequate WLAN capacity in each coverage area, and where to install them ■ Configuration settings for all the WX switches and MAP access points in the WLAN, which can be automatically deployed to the devices by 3Com Wireless Switch Manager. (For information about installing 3Com Wireless Switch Manager and creating and verifying a network plan, see the Wireless LAN Switch Manager Reference Manual.) Installation Location WX1200 switch fans are located in the rear of the switch and air inlets are located on the sides of the switch. Make sure these areas have adequate ventilation after installation. Do not block air vents. WARNING: The WX switch has been designed and tested to be installed in an operating ambient temperature of 0° C to +50° C (32° F to 122° F). To reduce the risk of equipment damage, install equipment with consideration to these ambient conditions. Cable Requirements To avoid installation problems, use the proper cables. WARNING: The gigabit Ethernet fiber-optic interfaces use Class 1 lasers. To reduce the risk of eye injury, do not stare into the interface or otherwise direct the laser beam into your eye. Serial Console Cable The serial console port has a female DB-9 connector and supports the EIA-232D signaling standard. You need a standard DB-9-male-to-DB-9-female PC modem cable. Table 5 lists the pin signals.

Network Cables Table 6 lists the interface types supported by WX switches and the cable type required for each type of interface. The WX1200 supports 10/100 Ethernet connections. Table 7 lists the link type and properties of the supported connections. Table 5 Serial Console Pin Signals WX Pin Usage PC Pin Usage 2 Receive 3 Transmit 3 Transmit 2 Receive 5 Ground 5 Ground Table 6 Ethernet Interfaces Link Type Cable Type Connector Type Maximum Distance 10/100BASE-T Cat 5 copper Straight-through or crossover signaling RJ-45 100 m (328 feet) 1000BASE-SX Multimode 50-µm fiber SC 550 m (1804.5 feet) Multimode 62.5-µm fiber SC 275 m (902.2 feet) 1000BASE-LX Single mode 9/10-µm fiber SC 10,000 m (32,808.4 fe et) Multimode 50-µm fiber SC 550 m (1804.5 feet) Multimode 62.5-µm fiber SC 550 m (1804.5 feet) 1000BASE-TX Cat 5 copper Can use straight-through or crossover signaling, provided all four wire pairs are connected RJ-45 100 m (328 feet)

23 10/100 Ethernet Cable Wiring Connections on the 10/100 ports require Category 5 (Cat 5) cable based on the EIA/TIA-586 standard. For direct connection to a MAP access point, a router, or an end station such as a PC, printer, or server, use a straight-through cable. For direct connection to another switch, use a crossover cable. (The 10/100 Ethernet ports on the WX1200 switch provide automatic MDI/MDX, which automatically crosses over the send and receive signals if required.) Table 8 on page 23 lists the pin signals for 10/100 Ethernet straight-through wiring. Pins 4, 5, 7, and 8 are used only when Power over Ethernet (PoE) is enabled on the port. RD means Receive Data and TD means Transmit Data. MAP Cable Requirement Use a straight-through Ethernet cable to connect a MAP access point directly to a WX switch or indirectly through another device. Table 7 Ethernet Interfaces Link Type Cable Type Connector Type Maximum Distance 10/100BASE-T Cat 5 copper Straight-through or crossover signaling RJ-45 100 m (328 feet) Table 8 10/100 Ethernet Straight-Through Pin Signals WX Switch Other Device Pin Function Pin Function 1 RD+ 1 TD+ 2 RD- 2 TD- 3 TD+ 3 RD+ 4 PoE+ 4 PoE+ 5 PoE+ 5 PoE+ 6 TD- 6 RD- 7 PoE- 7 PoE- 8 PoE- 8 PoE-

Installation Hardware and Tools Table 9 lists the mounting hardware and tools required for each type of installation. WARNING: To reduce the risk of equipment damage, make sure the WX switch is installed so that the mechanical load on the device is evenly distributed. For example, make sure the switch is level in the equipment rack, is evenly fastened by screws on either side, and does not have a heavy object resting on one side of the switch. Installing a WX Switch You can mount a WX switch in a standard 48.26-cm (19-inch) equipment rack or on a tabletop. Each WX switch is shipped with two brackets for rack mounting and four adhesive rubber feet for tabletop mounting. The WX4400 mounting brackets support either front or center mounting. The WX1200 mounting brackets support front mounting only. To install a WX switch, use one of the following procedures. WARNING: Earth grounding is required for a WX switch installed in a rack. If you are relying on the rack to provide ground, the rack itself must be grounded with a ground strap to the earth ground. Metal screws attaching the switch to the rack provide ground attachment to the rack. WARNING: In the U.S., overcurrent protection must be provided by the installation. Branch circuit protection in accordance with National Fire Table 9 Required Mounting Hardware and Tools Mounting Option Required Hardware and Tools Included with the Product Equipment rack ■ Front-mount or center-mount option for the WX4400 switch ■ Front-mount option for the WX1200 switch Mounting brackets Yes Four rack-mount screws and screwdriver Note: Equipment racks vary, and the screw and screwdriver type depend on the equipment rack. No Power cords Yes (one) Serial console cable Yes Tabletop Four adhesive rubber feet Yes Power cord(s) Yes Serial console cable Yes

25 Protection Association (NFPA) 70, National Electrical Code (NEC) is required. Consideration must be given to the electrical ratings on the WX switch and branch circuit protection. Do not install equipment such that the branch circuit current and voltage protection is exceeded. Pay particular attention to the earthing connection for the supply connections. When using an extension cord or power strip, pay attention to the grounding type. Equipment Rack Installation You can install a WX4400 switch into a front-mount or center-mount equipment rack. You can install a WX1200 switch into a front-mount equipment rack. ■ Figure 4 shows how to install a WX4400 switch into a front-mount equipment rack. (Installation of a WX1200 switch is similar.) ■ Figure 5 shows how to install a WX4400 switch into a center-mount equipment rack. Refer to these figures as you perform the procedure.

Figure 4 WX4400 Installation—Front-Mount Equipment Rack First, attach brackets to chassis. Then, install chassis into rack.

27 Figure 5 WX4400 Installation—Center-Mount Equipment Rack 1 Remove the four bracket screws from each side of the WX switch. 2 Align a bracket over the screw holes: ■ For a front-mount equipment rack, align the bracket so that the bracket flange is flush with the WX switch’s front panel and extends away from the switch. ■ For a center-mount equipment rack, align the bracket so that the bracket flange is located near the center screw holes. 3 Reinsert the screws to secure the brackets to the WX switch. 4 Repeat for the other bracket. WARNING: 3Com recommends that you ask someone to assist you with the remaining steps. If you accidentally drop the WX switch, you can be injured and the switch can be damaged. First, attach brackets to chassis. Then, install chassis into rack.

5 Lift the WX switch into position in the equipment rack. WARNING: To prevent the WX switch from slipping, do not release the switch until all the rack-mount screws are tight. 6 Insert the bottom rack-mount screws into the bracket flanges to secure the WX switch to the equipment rack, then insert the top screws. 7 Go to “Powering On a WX Switch” on page 28. Tabletop Installation 1 On a clean work surface with no debris, carefully turn the WX switch upside down. 2 Wipe the four placement locations for the rubber feet to clear away any oil or dust. The location areas are marked by X’s. 3 Attach the four rubber adhesive feet over the X’s. 4 Turn the WX switch right-side up, and place the switch in position on the table. 5 Go to “Powering On a WX Switch” on page 28. Powering On a WX Switch The WX1200 and WX4400 require an AC power source. WARNING: The WX switch relies on the building’s installation for overcurrent protection. Ensure that a fuse or circuit breaker no larger than 120 VAC, 15 A U.S. (240 VAC, 10 A international) is used on the phase conductors. To power on a WX switch: 1 Make sure any power supply is fully seated in the WX switch. 2 For each power supply that you are using on the WX switch, attach a power cord to an AC power source.

29 3 Plug the power cord into the WX power supply. The WX switch begins booting as soon as you plug in the power cord(s). 4 Observe the power supply LED for each connected power supply to verify that the LED is steadily glowing green. This indicates normal power supply operation. Connecting to a Serial Management Console Initial configuration of the WX switch requires a connection to the switch’s CLI through the serial console port. Figure 6 shows how to install a serial cable on the WX switch. Refer to this figure as you perform the procedure. (For cable requirements, see “Serial Console Cable” on page 21.) Figure 6 Serial Cable Installation To connect a PC to the serial console port: 1 Insert the serial cable into the PC port as shown in Figure 6. 2 Insert the other end of the cable into the serial console port on the WX switch as shown in Figure 6. 3 Start a standard VT100 terminal emulation application on the PC, and configure the following modem settings: ■ 9600 bps ■ 8 bits ■ 1 stop Serial port Serial cable Serial port on computer

■ No parity ■ Hardware flow control disabled 4 Open a connection on a serial port. ■ If the WX switch is already powered on, press Enter three times to display one of the following command prompts: WX1200> WX4400> Go to step 4 in “Accessing the CLI” on page 35. ■ If a command prompt does not appear, go to “Troubleshooting a Serial Management Connection”. Troubleshooting a Serial Management Connection If a command prompt does not appear when attempting to initiate a serial management connection, do the following: 1 Verify that the WX switch is powered on. 2 Verify that the serial cable is fully inserted in the PC and WX switch ports. 3 Verify that the correct modem settings are configured in the terminal emulation application: ■ 9600 bps ■ 8 bits ■ 1 stop ■ No parity ■ Hardware flow control disabled 4 Verify that you opened the connection on the PC port connected to the WX switch. For example, if you inserted the cable in PC port COM1, make sure you open the connection on COM1 instead of COM2 or another port. If none of the previous steps results in a management connection, use another serial cable.

31 Connecting to the Network Use the following procedures to connect a WX switch to MAP access points or other 10/100 Ethernet devices and to gigabit Ethernet devices. Connecting to a MAP or Other 10/100 Ethernet Device The WX1200 and WX400 require straight-through cabling for connection to a router or to an end station such as a PC, printer, or server. The WX1200 requires straight-through cabling for connection to a directly connected MAP. Both switches require crossover cabling for connection to another switch. The 10/100 Ethernet ports are configured as wired network ports by default. You must change the port type for locally connected MAP access points, and for wired end stations that use AAA through the WX switch to access the network. For installations in Japan: Provide an earthing connection before you connect the mains plug to the mains. When disconnecting the earthing connection, make sure to disconnect only after you pull out the mains plug for the mains. To connect to a MAP or other 10/100 Ethernet device: 1 Insert a Cat 5 cable with a standard RJ-45 connector: ■ For direct connection to a MAP access point, use a straight-through cable. ■ For connection to a router or to an end station such as a PC, printer, or server, use a straight-through cable. ■ For connection to another switch, use a crossover cable. (For cable requirements, see “Network Cables” on page 22.) The 10/100 Ethernet ports on the WX1200 switch provide automatic MDI/MDX. 2 If the cable is directly attached to a MAP access point: ■ For a first-time installation, set the port type to activate the link. (For information, see “Configuring MAPs for Wireless Users” on page 61.) ■ If the port type is already set for a MAP access point, observe the appearance of the MAP LED for the port:

3 If the cable is attached to a wired end station that uses AAA through the WX switch to access the network: ■ For a first-time installation, set the port type to activate the link. (For information, see “Configuring a Port for a Wired Authentication User” on page 61.) ■ If the port type is already set for a wired authentication port, go on to step 4. 4 If the cable is directly attached to a device other than a MAP access point: a Observe the appearance of the Link LED for the port: MAP LED Appearance Meaning Solid green For a MAP access point’s active link, with PoE enabled, all the following are true: ■ MAP access point has booted. ■ MAP access point has received a valid configuration from the WX switch. ■ Management link with a MAP access point is operational. For a MAP access point’s secondary link, the link is present. Alternating green and amber MAP access point is booting with an image received from the WX switch. Solid amber PoE is on, but no MAP access point is connected to the link. Blinking amber MAP access point is unresponsive or there is a PoE problem. Unlit PoE is off. Link LED Appearance Meaning Solid green 100-Mbps link is operational. Solid amber 10-Mbps link is operational. Blinking green Traffic is active on the 100-Mbps link. Blinking amber Traffic is active on the 10-Mbps link. Unlit Link is not operational.

33 b If the Link LED is unlit, check the cable and verify that the device at the other end of the link is operating. Connecting to Gigabit Ethernet Devices The following procedures explain how to connect a WX400 switch’s copper or fiber Gigabit port to the network. WARNING: The gigabit Ethernet fiber-optic interfaces use Class 1 lasers. To reduce the risk of eye injury, do not stare into the interface or otherwise direct the laser beam into your eye. Connecting to a Copper Gigabit Device Insert a Cat 5 cable with a standard RJ-45 connector. The cable can use straight-through or crossover signalling. 1 Insert the Cat 5 cable into the port’s RJ-45 (copper) interface. 2 Access the command-line interface (CLI) on the switch, use the enable command to enter configuration mode, and use the following command to set the active interface on the port to RJ-45 (copper): set port preference port-list rj45 3 Observe the lower LED to the left of the port: ■ If the LED is solid green, the 1000-Mbps link is operational. ■ If the LED is blinking green, traffic is active on the 1000-Mbps link. ■ If the LED is unlit, the link is not operational. Check the cable and verify that the device at the other end of the link is operational. Connecting to a Fiber Gigabit Device You must install a gigabit interface converter (GBIC) to connect a WX4400 switch to 1000BASE-SX or 1000BASE-LX cable. (For cable requirements, see “Network Cables” on page 22.) To install a GBIC: 1 Insert the GBIC into a GBIC slot on the front panel until it clicks into place. 2 Remove the protective covering(s) from the port connector(s) and set them aside in a safe place for later use. 3 Insert the network cable.

For 1000BASE-SX or 1000BASE-LX fiber, make sure you insert the two cable ends in the proper sides (transmit or receive). Otherwise, the link does not work. 4 Observe the upper LED to the right of the GBIC port: ■ If the LED is green, the 1000-Mbps link is operational. ■ If the LED is blinking amber, traffic is active on the 1000-Mbps link. ■ If the LED is unlit, the link is not operational. Check the cable and verify that the device at the other end of the link is operational. To remove a GBIC: 1 Remove the network cable(s). 2 Insert the protective covering(s) into the port connector(s). 3 Squeeze the clips on the sides of the GBIC and pull the GBIC out of the slot.

BASIC SERVICE You can configure a WX switch with 3Com Wireless Switch Manager (3WXM), Web Manager, or the CLI. Mobility System Software (MSS) commands are required for basic setup in each case. (Even if you plan to configure the switch with 3WXM or Web Manager, you need to type a few commands in the CLI first.) Before You Begin If your WX switch does not yet have an IP address and you are accessing the CLI through the serial console port, go first to “Accessing the CLI” on page 35. This chapter shows CLI command syntax and examples and includes complex terminology. For syntax descriptions, additional configuration, and a glossary of terms, see the Wireless LAN Switch and Controller Command Reference and the Wireless LAN Switch and Controller Configuration Guide. As an alternative to using this chapter, you can use the quickstart command to perform basic setup. (See the Wireless LAN Switch and Controller Quick Start Guide.) Accessing the CLI To enter the configuration commands in this chapter, you must log in to the enabled access level of the CLI. The default username and password are null strings. To log in from the serial console to the enabled access level for configuration: 1 Press Enter to display a username prompt. Username:

2 Press Enter again to display a password prompt. Username: Password: 3 Press Enter a third time to display a command prompt. Username: Password: WX1200> 4 Type the enable command and press Enter once more to display the prompt for the enabled access level. Username: Password: WX1200> enable WX1200# Configuration Overview To configure a WX switch for basic service, perform the following tasks, in this order: 1 Configure an enable password. (See “Configuring an Enable Password” on page 38.) 2 Install an upgrade license, if applicable. (See “Installing an Upgrade License” on page 39.) 3 Configure time and date parameters. (See “Configuring the Time and Date” on page 40.) 4 Configure IP connectivity. (See “Configuring IP Connectivity” on page 42.) 5 Enable secure communication for 3WXM or Web Manager management. Perform this task only if you intend to use these interfaces. (See “Enabling Secure Communication for 3WXM or Web Manager” on page 46.) 6 Specify the country of operation. (See “Specifying the Country of Operation” on page 56.) CAUTION: Setting the country code to the incorrect value can result in the MAPs using the wrong radio channels and power levels for the country. This can cause interference with other vital equipment.

can stop using the CLI after specifying the country of operation and saving the configuration. (To save the configuration, see “Displaying and Saving the Configuration” on page 84.) 7 Specify a system IP address. (See “Specifying a System IP Address” on page 59.) 8 Set the port types for ports connected to wired or wireless authentication users. (See “Configuring for Authenticating Users” on page 60.) 9 Configure Mobility Domain parameters. (See “Configuring Mobility Domain Parameters” on page 75.) 10 Configure authentication for network users. (See “Configuring User Authentication” on page 76.) 11 Verify the changes and save them to the configuration file. (See “Displaying and Saving the Configuration” on page 84.) Figure 7 shows the Mobility System configured by the command examples in this chapter. All CLI configuration examples in this chapter apply to the WX switch named WX1. In most cases, the examples are valid for both the WX1200 and the WX4400. The exception is that the WX4400 switch supports Distributed MAP access points only. (Distributed MAPs are connected to the WX switch through an intermediate Layer 2 or Layer 3 network.) Thus, WX1 in Figure 7 can be a WX1200 but not a WX4400 switch. WX2 and WX3 can be either model. The WX switch models differ based on the number of MAPs they can support. The WX1200 supports configuration of 30 MAPs and can boot up to 12 of them. The WX4400 supports configuration of 256 MAPs. The WX4400 can boot up to 24, 48, 72, or 96 MAPs, depending on the license installed on the switch.

Figure 7 Example 3Com Network Configuring an Enable Password MSS does not require you to change the enable password from the default (null string). However, 3Com recommends that you configure an enable password to provide at least minimal security to the WX switch before you proceed to more advanced configuration options. To configure an enable password, use the following command: set enablepass Router Router Wired authentication client System IP address 10.10.10.4 Port 1 Port 2 Port 4 WX1 10.10.40.19/24 10.10.20.19/24 10.10.30.19/24 RADIUS servers 10.10.70.20 10.10.70.40 10.10.60.18/24 10.10.60.19/24 3WXM Port 3 Layer 2 Layer 2 10.10.10.19/24 Port 5 VLANs on WX 1 VLAN 2 mgmt, port 5, 10.10.10.4/24 VLAN 4 blue, port 5, tag 20, 10.10.20.2/24 VLAN 3 red, port 5, tag 30 Layer 2 serial-id M9DE48BDEA200 serial-id M9DE48B6EAD00 serial-id M9DE48B012F00 serial-id M9DE48B123400 serial-id M9DE48B234500 10.10.50.19/24 external antenna System IP address 10.10.40.4 WX2 System IP address 10.10.40.4 WX3 MAP MAP MAP MAP MAP

39 To configure an enable password: 1 If you are not already at the enabled access level, enter the enable command. WX1200> enable 2 At the enabled prompt, enter set enablepass. WX1200# set enablepass 3 When you are prompted for your old password, press Enter. Enter old password: 4 When you are prompted for a new password, enter an enable password of up to 32 alphanumeric characters, with no spaces. Enter new password: The password you enter is not displayed. 5 When you are prompted to retype your password, reenter the enable password. Retype new password: MSS does not display your password, but lets you know that the enable password is set: success: password changed (For information about additional ways to secure CLI access, see the Wireless LAN Switch and Controller Configuration Guide.) Installing an Upgrade License Table 10 lists how many MAPs you can configure on a WX switch, and how many MAPs a switch can boot. The numbers are for directly connected and Distributed MAPs combined. You can install one or more upgrade licences to increase the number of MAPs a WX4400 can boot. Each upgrade license adds support for an Table 10 Maximum MAPs Supported Per Switch WX Switch Model Maximum Configured Maximum Booted WX4400 256 24, 48, 72, or 96, depending on the license. WX1200 30 12

additional 24 MAPs, up to 96 MAPs total. You can upgrade the WX4400 only. The WX1200 cannot be upgraded. To display the current license level and install an upgrade license, use the following commands: display license set license license-key activation-key The license key is shipped with the switch. To obtain the activation key, access the 3Com web site. Each license and activation key pair allows the switch to actively manage an additional 24 MAPs. You can install up to three upgrade license and activation key pairs, to actively manage up to 96 MAPs. The following command installs an upgrade license: WX4400# set license WXL-076E-93E9-62DA-54D8 WXA-3E04-4CC2-430D-B508 Serial Number : M8XE4IBB8DB10 License Number : 245 License Key : WXL-076E-93E9-62DA-54D8 Activation key : WXA-3E04-4CC2-430D-B508 Feature : 24 additional ports Expires : Never 48 ports are enabled success: license was installed The additional ports refers to the number of additional MAPs the WX4400 can boot and actively manage. Configuring the Time and Date To set the system time and date: 1 Set the time zone to specify the offset from Coordinated Universal Time (UTC). 2 Configure MSS to offset the time by an additional hour for daylight savings time or similar summertime period, if applicable. 3 Specify the IP address of a Network Time Protocol (NTP) server or statically set the time and date.

41 3Com recommends that you set the time and date parameters before you install certificates on the WX switch. Generally, certificates are valid for one year beginning with the system time and date that are in effect when you generate the certificate request. If the switch’s time and date are incorrect, the certificate might not be valid. To configure time and date parameters, use the following commands: set timezone zone-name {-hours [minutes]} set summertime summer-name [start week weekday month hour min end week weekday month hour min] set timedate {date mmm dd yyyy [time hh:mm:ss]} set ntp {enable | disable} set ntp server ip-addr To verify the changes, use the following commands: display timezone display summertime display timedate display ntp The following commands configure the timezone as PST (Pacific Standard Time) with an offset of -8 hours from UTC and enable the standard summertime offset and name it PDT (Pacific Daylight Time). Additional commands configure an NTP server and enable the WX switch’s NTP client. WX1200# set timezone PST -8 success: change accepted. WX1200# set summertime PDT success: change accepted. WX1200# set ntp server 192.168.1.10 WX1200# set ntp enable success: NTP Client enabled The following commands display time and date parameters and the current time and date:

WX1200# display timezone Timezone is set to 'PST', offset from UTC is -8:0 hours. WX1200# display summertime Summertime is enabled, and set to 'PDT'. Start : Sun Apr 04 2004, 02:00:00 End : Sun Oct 31 2004, 02:00:00 Offset : 60 minutes Recurring : yes, starting at 2:00 am of first Sunday of April and ending at 2:00 am on last Sunday of October. WX1200# display ntp NTP client: enabled Current update-interval: 20(secs) Current time: Fri Feb 06 2004, 12:02:57 Timezone is set to 'PST', offset from UTC is -8:0 hours. Summertime is enabled. Last NTP update: Fri Feb 06 2004, 12:02:46 NTP Server Peer state Local State --------------------------------------------------- 192.168.1.5 SYSPEER SYNCED WX1200# display timedate Fri Feb 06 2004, 12:03:04 PST Configuring IP Connectivity To configure IP connectivity: 1 Configure a VLAN, assign a port to the VLAN that can provide IP connectivity through the network for administrative purposes, and configure an IP address on the VLAN. (See “Configuring VLANs and IP Addresses” on page 42.) 2 Configure a default route. (See “Configuring a Default Route” on page 44.) 3 Test the IP configuration. (See “Verifying IP Connectivity” on page 45.) Configuring VLANs and IP Addresses Any or all VLANs on the switch can have an IP address. 3WXM and Web Manager require IP connectivity to a WX switch to manage the switch. User traffic also requires VLANs, although you do not need to configure every user’s VLAN on every WX switch. To configure a VLAN and an IP address, use the following commands: set vlan vlan-num name name set vlan vlan-id port port-list [tag tag-value] set interface vlan-id ip {ip-addr mask | ip-addr/mask-length}

43 The vlan-id parameter can be the VLAN number or the VLAN name. To verify the changes, use the following commands: display vlan config display interface The following commands configure a VLAN named mgmt and two additional VLANs over an 802.1Q trunk link for network traffic: WX1200# set vlan 2 name mgmt success: change accepted. WX1200# set vlan mgmt port 5 success: change accepted. WX1200# set vlan 3 name red success: change accepted. WX1200# set vlan red port 5 tag 30 success: change accepted. WX1200# set vlan 4 name blue success: change accepted. WX1200# set vlan blue port 5 tag 20 success: change accepted. To avoid confusion, do not assign numbers as VLAN names. Every VLAN on a WX switch has both a VLAN name used for authorization purposes and a VLAN number. VLAN numbers can vary uniquely for each WX switch and are not related to 802.1Q tag values even when used. VLAN names must be unique among all WX switches in a Mobility Domain. The following command displays VLAN information: WX1200# display vlan config Admin VLAN Tunl Port VLAN Name Status State Affin Port Tag State ---- ---------------- ------ ----- ----- ---------------- ----- ----- 1 default Up Down 5 2 mgmt Up Down 5 5 none Up 3 red Up Down 5 5 30 Up 4 blue Up Down 5 5 20 Up

The default VLAN listed in the sample display vlan output is present in a WX switch’s configuration by default but does not contain any ports unless you add them. 3Com recommends that you do not use the default VLAN (VLAN 1) for user traffic or rename the default VLAN. Instead, configure other VLANs and use those VLANs for user traffic. This is because the default VLAN might not be in the same subnet on each switch. The following commands configure IP addresses on some of the VLANs. (MSS does not require an IP address on every VLAN.) WX1200# set interface mgmt ip 10.10.10.4/24 success: change accepted. WX1200# set interface blue ip 10.10.20.2/24 success: change accepted. WX1200# display interface VLAN Name Address Mask Enabled State ---- --------------- --------------- --------------- ------- ----- 2 mgmt 10.10.10.4 255.255.255.0 YES Up 4 blue 10.10.20.2 255.255.255.0 YES Up Configuring a Default Route If 3WXM or Web Manager and a WX switch are in different subnets, you need to configure a default route on the WX switch. To configure a default route, use the following command: set ip route default gateway metric To verify the change, use the following command: display ip route The following commands add a default route that uses gateway 10.10.20.19 with a path cost of 1, and verify the change:

45 WX1200# set ip route default 10.10.20.19 1 success: change accepted. WX1200# display ip route Router table for IPv4 Destination/Mask Proto Metric NH-Type Gateway VLAN:Interface _________________ _______ ______ _______ _______________ _______________ 0.0.0.0/ 0 Static 1 Router 10.10.20.19 vlan:4:ip 10.10.10.4/24 IP 0 Direct vlan:2:ip 10.10.10.4/32 IP 0 Local vlan:2:ip:10.10.10.4/2 10.10.10.255/32 IP 0 Local vlan:2:ip:10.10.10.4/2 10.10.20.2/24 IP 0 Direct vlan:4:ip 10.10.20.2/32 IP 0 Local vlan:4:ip:10.10.20.2/24 10.10.20.255/32 IP 0 Local vlan:4:ip:10.10.20.2/24 224.0.0.0/ 4 IP 0 Local MULTICAST The 0.0.0.0 route is the default route. The 10.10.10.x and 10.10.20.x routes in this example are automatically added by MSS when you configure the corresponding IP interfaces. The 224.0.0.0 route is for IGMP snooping. MSS automatically places this route in the configuration. Verifying IP Connectivity To verify that the WX switch can send and receive IP traffic, use the following command: ping host The ping command sends an Internet Control Message Protocol (ICMP) echo packet to the specified device and listens for a reply packet. For host, specify the IP address of a host device on the network. If you configure the Domain Name Service (DNS) or set a local alias for the host device, you can specify the DNS hostname or the alias instead of the IP address of the device. (For information, see the Wireless LAN Switch and Controller Configuration Guide.) The following command verifies IP connectivity to IP address 10.10.20.19:

WX1200# ping 10.10.20.19 PING 10.10.20.19 (10.10.20.19) from 10.10.20.2 : 56(84) bytes of data. 64 bytes from 10.10.20.19: icmp_seq=1 ttl=255 time=0.769 ms 64 bytes from 10.10.20.19: icmp_seq=2 ttl=255 time=0.628 ms 64 bytes from 10.10.20.19: icmp_seq=3 ttl=255 time=0.676 ms 64 bytes from 10.10.20.19: icmp_seq=4 ttl=255 time=0.619 ms 64 bytes from 10.10.20.19: icmp_seq=5 ttl=255 time=0.608 ms --- 20.20.20.1 ping statistics --- 5 packets transmitted, 5 packets received, 0 errors, 0% packet loss Enabling Secure Communication for 3WXM or Web Manager To enable secure communication between 3WXM or Web Manager and a WX switch, install a server certificate on the WX switch. (See “Installing a Certificate” on page 47.) For Web Manager, you also need to enable Transport Layer Security (TLS) on the Web browser. (See “Enabling TLS on a Web Browser and Logging In to Web View” on page 55.) Figure 8 shows an example of a WX switch prepared for 3WXM with certificate authority (CA) certificates.

47 Figure 8 Secure 3WXM Communication Using CA Certificates Installing a Certificate To manage a WX switch, 3WXM or a Web browser using Web Manager must be able to authenticate the switch and establish an encrypted session to it. This requires the switch to have a server certificate. Use one of the following methods to enable secure communication between 3WXM or Web Manager and a WX switch: ■ Generate a self-signed certificate on the switch. (See “Generating a Self-Signed Certificate” on page 48.) ■ Alternatively, request a certificate for the WX switch from a CA and install the certificate into the switch along with the CA’s own certificate. 3WXM Router Certificate authority 10.10.10.19/24 Server certificate Certificate authority certificate MAP MAP WX switch VLAN 2 mgmt Port 5 10.10.10.4/24

(See “Installing a Certificate Assigned by a Certificate Authority” on page 49 and “Installing a Certificate Authority’s Certificate” on page 51.) Generating a Self-Signed Certificate As an alternative to using a certificate assigned by a CA, you can generate a self-signed certificate on the WX switch. To use a self-signed certificate generated by the WX switch, use the following commands: crypto generate key admin {512 | 1024 | 2048} crypto generate self-signed admin The following commands generate a public-private key pair and a self-signed certificate: WX1200# crypto generate key admin 1024 key pair generated WX1200# crypto generate self-signed admin Country Name: State Name: Locality Name: Organizational Name: Organizational Unit: Common Name: [email protected] Email Address: Unstructured Name: Self-signed cert for admin is -----BEGIN CERTIFICATE----- MIICUzCCAbygAwIBAgICA+cwDQYJKoZIhvc NAQEEBQAwNjELMAkGA1UEBhMCVVMx CzAJBgNVBAgTAkNBMRowGAYDVQQDFBF0ZWNoc HVic0B0cnB6LmNvbTAeFw0wMzA0 ... Lm8wmVYLxP56MpCUAm9O8C2foYgOY40= -----END CERTIFICATE----- The common name is required. The other fields are optional. Use a common name that uniquely identifies the WX switch. Use a fully qualified name if such names are supported on your network. MSS automatically installs the keys and self-signed certificate into its certificate and key store.

49 When you select an option to import information from the WX switch into 3WXM, it displays a dialog that shows the switch’s certificate information and provides options for handling the certificate. You can configure 3WXM to always accept self-signed certificates from WX switches. (For more information, see the Wireless LAN Switch Manager Reference Manual.) Installing a Certificate Assigned by a Certificate Authority You can install a WX switch certificate assigned by a CA in one of the following ways: ■ Install a PKCS #12 object file—To use this method: a Use TFTP to download onto the switch a PKCS #12 object file containing a public-private key pair and a certificate assigned by the CA. b Assign a one-time password to authenticate the PKCS #12 object file. c Install the public-private key pair and certificate from the PKCS #12 object file into the switch’s certificate and key store. (For more information, see “Installing a Certificate from a PKCS #12 Object File” on page 50.) ■ Install a PKCS #7 object file—To use this method: a Generate a public-private key pair on the switch. b Generate a certificate request on the switch. c Use the request (a PKCS #10 object) to obtain a certificate from the CA. d Install the certificate assigned by the CA (a PKCS #7 object file) into the switch’s certificate and key store. (For more information, see “Installing a Certificate from a PKCS #7 Object File” on page 50.) In either case, you also need to install the CA’s own certificate on the switch and on the 3WXM or Web Manager host. The CA’s certificate allows 3WXM or Web Manager to verify that the switch certificate assigned by the CA is valid. Some certificate authorities refer to PKCS object files as base64 encoded files.

Installing a Certificate from a PKCS #12 Object File To install a public-private key pair and a certificate assigned by a CA in a PKCS #12 object file, use the following commands: copy tftp://ip-addr/source-url [destination-url] crypto otp admin string crypto pkcs12 admin filename These commands copy the PKCS #12 object file from a TFTP server to the WX switch, configure a one-time password, and install the PKCS #12 object file. The password allows the public-private key pair and the certificate to be installed together from the same object file. MSS removes the password after completing the crypto pkcs12 command. Here is an example: WX1200# copy tftp://10.10.10.10/p12file WX1200# crypto otp admin temppwd WX1200# crypto pkcs12 admin p12file Installing a Certificate from a PKCS #7 Object File To generate a public-private key pair, and request and install a certificate assigned by a CA in a PKCS #7 object file, use the following commands: crypto generate key admin {512 | 1024 | 2048} crypto generate request admin crypto certificate admin PEM-formatted-certificate The following commands generate a key pair and a certificate request: WX1200# crypto generate key admin 1024 key pair generated WX1200# crypto generate request admin Country Name: State Name: Locality Name: Organizational Name: Organizational Unit: Common Name: [email protected] Email Address: Unstructured Name: CSR for admin is -----BEGIN CERTIFICATE REQUEST----- MIIBdTCB3wIBADA2MQswCQYDVQQGEwJV UzELMAkGA1UECBMCQ0ExGjAYBgNVBAMU

51 EXRlY2hwdWJzQHRycHouY29tMIGfMA0GCSq GSIb3DQEBAQUAA4GNADCBiQKBgQC4 ... 2L8Q9tk+G2As84QYMwe9RJAjfbYM5bdWRUFiLzvK7BJgqBsCZz4DP00= -----END CERTIFICATE REQUEST----- The common name is required. The other fields are optional. Use a common name that uniquely identifies the WX switch. Use a fully qualified name if such names are supported on your network. After you submit the certificate request to a CA and receive a signed certificate from the CA as a PKCS #7 object file, install the certificate into the WX switch’s certificate and key store: 1 Open the PKCS #7 object file with an ASCII text editor (such as Notepad) or a browser. 2 Type the crypto certificate admin command at the WX switch’s prompt. 3 After the prompt, copy and paste the PKCS #7 object file into the CLI. For example: WX1200# crypto certificate admin Enter PEM-encoded certificate -----BEGIN CERTIFICATE----- MIIGDDCCBbagAwIBAgIKFrJ2aAAAAAAAn DANBgkqhkiG9w0BAQUFADCBmzErMCkG CSqGSIb3DQEJARYcYWRtaW5pc3RyYXRvck B0cmFwZXplc3FhLmNvbTELMAkGA1UE ... bDQNTaS4W0ytUGuJm1RjyA== -----END CERTIFICATE----- You must paste the entire block, from the beginning: -----BEGIN CERTIFICATE REQUEST----- to the end: -----END CERTIFICATE REQUEST-----. The certificate server and MSS recognize the block only through the beginning and ending delimiters. Installing a Certificate Authority’s Certificate In addition to installing the WX switch certificate issued by the CA, you also need to install the CA’s own certificate into the WX switch’s certificate and key store. The CA certificate allows 3WXM or Web Manager to verify that the WX switch’s certificate is valid. You need to install the CA’s certificate whether you installed the switch certificate from a PKCS #7 object file or a PKCS #12 object file.

To install a CA’s certificate: 1 Request a copy of the CA certificate as a PKCS #7 object file from the CA, then open the file with an ASCII text editor (such as Notepad) or a browser. 2 Type the crypto ca-certificate admin command. 3 After the prompt, copy and paste the PKCS #7 object file into the CLI. For example: WX1200# crypto ca-certificate admin Enter PEM-encoded certificate -----BEGIN CERTIFICATE----- MIIDwDCCA2qgAwIBAgIQL2jvuu4P05FAQI CyewU3ojANBgkqhkiG9w0BAQUFADCB mzErMCkGCSqGSIb3DQEJARYcYWRtaW5 pc3RyYXRvckB0cmFwZXplc3FhLmNvbTEL ... RGpOeQ== -----END CERTIFICATE----- Displaying Certificate Information Use the following command to display administrative certificate information: display crypto certificate admin This command displays the following information about the certificate: ■ X.509 version number ■ Serial number ■ Subject (the certificate holder’s identifying information) ■ Signature algorithm used by the signer of the certificate ■ Issuer information (CA information, unless the certificate is self-signed) ■ Period during which the certificate is valid Installing a Server Certificate for Network Users To use an 802.1X authentication protocol that includes local EAP processing on a WX switch, the switch must have a server certificate. You can generate a certificate on the switch itself or install a certificate

53 assigned by a certificate authority (CA). If you use a certificate assigned by a CA, you also need to install the CA’s own certificate for validation. If you use an authentication protocol that uses EAP-TLS on the WX switch, users also need certificates. (For more information, see the Wireless LAN Switch and Controller Configuration Guide.) The command syntax for installing certificates for management by 3WXM or Web Manager and installing certificates for network users is very similar. The CLI commands for configuring network user authentication use the eap option instead of the admin option, but are otherwise the same. Likewise, the procedures are the same. Generating a Self-Signed Certificate for Network Users As an alternative to using a certificate assigned by a CA, you can generate a self-signed certificate on the WX switch. To use a self-signed certificate, use the following commands: crypto generate key eap {1024 | 2048} crypto generate self-signed eap The common name is required. The other fields are optional. MSS automatically installs the key and self-signed certificate into its certificate and key store. Installing a Certificate Assigned by a Certificate Authority for Network Users You can install a certificate assigned by a CA in one of the following ways: ■ Install a PKCS #12 object file—To use this method: ■ Install a PKCS #7 object file—To use this method: In either case, you also need to install the CA’s own certificate. The CA certificate allows users to verify that the switch certificate assigned by the CA is valid. Installing a Certificate for Network Users from a PKCS #12 Object File To install a public-private key pair and a certificate assigned by a CA in a PKCS #12 object file, use the following commands: copy tftp://ip-addr/source-url [destination-url] crypto otp eap string crypto pkcs12 eap filename

These commands copy the PKCS #12 object file from a TFTP server to the WX switch, configure a one-time password, and install the PKCS #12 object file. The password allows the public-private key pair and the certificate to be installed together from the same object file. MSS removes the password after completing the crypto pkcs12 command. Installing a Certificate for Network Users from a PKCS #7 Object File To generate a public-private key pair, and request and install a certificate assigned by a CA in a PKCS #7 object file, use the following commands: crypto generate key eap {1024 | 2048} crypto generate request eap crypto certificate eap PEM-formatted-certificate After you submit the certificate request to a CA and receive a signed certificate from the CA as a PKCS #7 object file, install the certificate into the WX switch’s certificate and key store: 1 Open the PKCS #7 object file with an ASCII text editor (such as Notepad). 2 Type the crypto certificate eap command at the WX switch’s command prompt. 3 After the prompt, paste the PKCS #7 object file into the CLI. For example: WX1200# crypto certificate eap Enter PEM-encoded certificate -----BEGIN CERTIFICATE----- MIIGDDCCBbagAwIBAgIKFrJ2aAAAAA AAnDANBgkqhkiG9w0BAQUFADCBmzErMCkG CSqGSIb3DQEJARYcYWRtaW5pc3RyYX RvckB0cmFwZXplc3FhLmNvbTELMAkGA1UE ... bDQNTaS4W0ytUGuJm1RjyA== -----END CERTIFICATE----- You must paste the entire block, from the beginning: -----BEGIN CERTIFICATE REQUEST----- to the end: -----END CERTIFICATE REQUEST-----. The certificate server and MSS recognize the block only through the beginning and ending delimiters.

55 Installing a Certificate Authority’s Certificate for Network Users In addition to installing the WX switch certificate issued by the CA, you also need to install the CA’s own certificate into the WX switch’s certificate and key store. The CA certificate allows users to verify that the WX switch’s certificate is valid. You need to install the CA’s certificate whether you installed the switch certificate from a PKCS #7 object file or a PKCS #12 object file. To install a CA’s certificate: 1 Request a copy of the CA certificate as a PKCS #7 object file from the CA, then open the file with an ASCII text editor (such as Notepad). 2 Type the crypto ca-certificate eap command. 3 After the prompt, paste the PKCS #7 object file into the CLI. For example: WX1200# crypto ca-certificate eap Enter PEM-encoded certificate -----BEGIN CERTIFICATE----- MIIDwDCCA2qgAwIBAgIQL2jvuu4P05F AQICyewU3ojANBgkqhkiG9w0BAQUFADCB mzErMCkGCSqGSIb3DQEJARYcYWRtaW5pc 3RyYXRvckB0cmFwZXplc3FhLmNvbTEL ... RGpOeQ== -----END CERTIFICATE----- Displaying Certificate Information for Network Users Use the following command to display certificate information for network users: display crypto certificate eap Enabling TLS on a Web Browser and Logging In to Web View Use the procedure in this section if you plan to use Web Manager to continue configuring the switch. Otherwise, skip this section and go to “Specifying the Country of Operation”.

Web Manager uses Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS), which requires TLS. Make sure TLS 1.0 is enabled on the Web browser. For example, if you are using the Microsoft Internet Explorer: 1 Select Tools > Internet Options to display the Internet Options dialog box. 2 Select the Advanced tab. 3 Scroll to the bottom of the list of options and select the TLS 1.0 option to enable it. 4 Click OK. To log in to a WX switch with Web Manager: 1 Type https://ip-addr in the Web browser’s Address or Location field and press Enter. For ip-addr, type an IP address you configured on the switch. (See “Configuring VLANs and IP Addresses” on page 42.) 2 In the Password field, type the enable password you configured on the switch. (See “Configuring an Enable Password” on page 38.) Leave the User name field blank. 3 Click OK. If your web browser has the Google toolbar installed, one of the toolbar’s options can cause some of the fields in Web Manager to be highlighted in yellow. If you want to turn off the yellow highlighting, disable the Automatically highlight fields that Autofill can fill option, which is one of the toolbar’s options. Specifying the Country of Operation You must specify the country in which you plan to operate the WX switch and its MAP access points. MSS does not allow you to configure or enable the MAP access point radios until you specify the country of operation. CAUTION: Setting the country code to the incorrect value can result in the MAPs using the wrong radio channels and power levels for the country. This can cause interference with other vital equipment.

57 If you plan to upload the WX switch’s configuration into 3WXM (with the Changes > Upload Wireless Switch option), you must specify the country of operation with the CLI before uploading the configuration. If the country of operation is not specified, 3WXM rejects the configuration. To specify the country, use the following command: set system countrycode code For the country code, specify one of the codes listed in Table 11. Table 11 Country Codes Country Code Australia AU Austria AT Belgium BE Brazil BR Canada CA China CN Czech Republic CZ Denmark DK Finland FI France FR Germany DE Greece GR Hong Kong HK Hungary HU Iceland IS India IN Ireland IE Israel IL Italy IT Japan JP Liechtenstein LI Luxembourg LU Malaysia MY

The current software version might not support all the countries listed here. To verify the configuration change, use the following command: display system The following example sets the country code to US (United States) and verifies the setting: Mexico MX Netherlands NL New Zealand NZ Norway NO Poland PL Portugal PT Saudi Arabia SA Singapore SG Slovakia SK Slovenia SI South Africa ZA South Korea KR Spain ES Sweden SE Switzerland CH Taiwan TW Thailand TH United Arab Emirates AE United Kingdom GB United States US Table 11 Country Codes (continued) Country Code

59 WX1200# set system countrycode US success: change accepted. WX1200# display system =============================================================================== Product Name: WX1200 System Name: WX1200 System Countrycode: US System Location: System Contact: System Description: WX1200 System IP: 0.0.0.0 System MAC: 00:0B:0E:02:76:F6 =============================================================================== Boot Time: 2003-05-07 08:28:39 Uptime: 0 days 04:00:07 =============================================================================== Fan status: fan1 OK fan2 OK fan3 OK Temperature: temp1 ok temp2 ok temp3 ok PSU Status: Lower Power Supply DC ok AC ok Upper Power Supply missing Memory: 115.09/496.04 (23%) Total Power Over Ethernet : 32.000 =============================================================================== Specifying a System IP Address You can designate one of the IP addresses configured on a WX switch’s VLAN to be the system IP address of the switch. The system IP address provides a common IP interface and source IP address for some 3Com management and Mobility Domain operations. The system IP address is required by some features, including roaming. The system IP address is also used by default for other features, including RADIUS and the system log. To assign one of the configured IP addresses to be the system IP address, use the following command: set system ip-address ip-addr Enter an IP address in dotted decimal notation. This command sets the IP address you specify to be the system IP address. To verify the configuration change, use the following command: display system

The following commands configure the system IP address to be 10.10.10.4, the IP address on VLAN mgmt, and verify the change: WX1200# set system ip-address 10.10.10.4 success: change accepted. WX1200# display system =============================================================================== Product Name: WX1200 System Name: WX1200 System Countrycode: System Location: System Contact: System Description: WX1200 System IP: 10.10.10.4 System MAC: 00:0B:0E:02:76:F6 =============================================================================== Boot Time: 2003-05-07 08:28:39 Uptime: 0 days 04:00:07 =============================================================================== Fan status: fan1 OK fan2 OK fan3 OK Temperature: temp1 ok temp2 ok temp3 ok PSU Status: Lower Power Supply DC ok AC ok Upper Power Supply missing Memory: 115.09/496.04 (23%) Total Power Over Ethernet : 32.000 =============================================================================== Configuring for Authenticating Users A WX switch can provide authentication, authorization, and accounting (AAA) services for wireless and wired users. Wireless users are attached to a WX switch through a MAP access point. Wired users are attached to a WX switch through wired authentication ports. By default, all a WX switch’s ports are set as wired network ports. Wired network ports connect the switch to other networking devices such as switches and routers. ■ To provide authentication to a wired user, you must set that user’s port to be a wired authentication port. ■ To provide authentication to wireless users, you must configure the WX to support a MAP. How you configure the WX will depend on how the MAP is connected to the WX. There are two categories of MAP to WX connection: directly connected and distributed.

61 ■ A directly connected MAP connects to one or two 10/100 ports on a WX. The WX 10/100 port provides PoE to the MAP. The WX forwards data only to and from the configured MAP on that port. The port numbers on the WX configured for direct attached MAPs reference a particular MAP. ■ A MAP that is not directly connected to a WX is considered a Distributed MAP. The WX contains a configuration for a Distributed MAP based on the MAP’s serial number. Similar to ports configured for directly connected MAPs, Distributed MAP configurations are numbered and can reference a particular MAP. These numbered configurations do not, however, reference any physical port. A Distributed MAP is a leaf device. You do not need to enable STP on the port that is directly connected to the MAP. If Spanning Tree Protocol (STP) is enabled on the port that is directly connected to a Distributed MAP, 3Com recommends that you enable port fast convergence (called PortFast on some vendors’ devices) on the port or disable STP on the port. (For more information, see the “Configuring MAP Access Points” chapter in the Wireless LAN Switch and Controller Configuration Guide.) Configuring a Port for a Wired Authentication User A wired authentication user connects to the WX by a network cable. The user must authenticate before connecting to the network. To set a port type for a wired authentication user, use the following command: set port type wired-auth port-list [tag tag-list] [max-sessions num] The following example sets port 3 for a wired authentication user: WX1200# set port type wired-auth 3 success: change accepted Configuring MAPs for Wireless Users A wireless user makes a wireless connection through a MAP to the WX. The user must authenticate before connecting to the network. To allow wireless users, you must configure the WX to support a MAP. To prepare a MAP access point for use, perform the following tasks, in this order: 1 Configure the WX switch for the MAP access it will be supporting and enable Power over Ethernet (PoE) if required. (See “Configuring for a

Directly-Connected MAP” on page 65 and “Configuring for a Distributed MAP” on page 66.) 2 Configure a service profile for each SSID and its encryption settings. (See “Configuring a Service Profile” on page 69.) 3 Configure a radio profile. (See “Configuring a Radio Profile” on page 71.) 4 Apply the radio profile to radios and enable the radios. (See “Applying a Radio Profile to Radios and Enabling the Radios” on page 74.) MAP Connection Requirements You can connect a MAP access point to a WX switch directly to a 10/100 port supplying PoE or through an intermediate network. ■ A directly connected MAP connects to one or two 10/100 ports on a WX. The WX port is then configured specifically for a direct attachment to a MAP. There is no intermediate networking equipment between the WX and MAP, and only one MAP is connected to the WX port. The WX 10/100 port typically provides PoE to the MAP. The WX forwards data only to and from the configured MAP on that port. The port numbers on the WX configured for direct attached MAPs reference a particular MAP. ■ A MAP that is not directly connected to a WX is considered a Distributed MAP. There may be intermediate layer 2 switches or layer 3 IP routers between the WX and MAP. The WX can communicate to the Distributed MAP through any network port. A network port is any port connecting the switch to other networking devices, such as switches and routers, and it can also be configured for 802.1Q VLAN tagging. The WX contains a configuration for a Distributed MAP based on the MAP’s serial number. Similar to ports configured for directly connected MAPs, distributed MAP configurations are numbered and can reference a particular MAP. These numbered configurations do not, however, reference any physical port. Figure 9 shows examples of direct and network MAP access point connections.

63 Figure 9 Local and Network MAP Access Point Connections This example has the following configuration requirements for the MAPs: ■ MAP1 is directly connected to the WX switch. WX1 needs port 2 configured as a directly connected MAP. ■ MAP2 is connected through a Layer 2 network to WX1. WX1 needs a Distributed MAP configuration in order to boot and configure MAP2. The Layer 2 network must provide DHCP services to MAP2. ■ MAP3 is connected through a Layer 3 network (Layer 2 networks separated by IP routers) to WX1. WX1 needs a Distributed MAP configuration in order to boot and configure MAP3. The Layer 2 network that MAP3 is attached to must provide DHCP services. The network’s DNS server must have a “3COMWX” entry pointing to any WX in the Mobility Domain. The following sections list the configuration requirements for direct attached MAPs and Distributed MAPs. Local Connection Requirements When a MAP connects directly to a WX switch’s 10/100 port, the WX port must be configured as a MAP access port, which supports MAP traffic only. There is no intermediate networking equipment between the WX and MAP and only one MAP is Router System IP address 10.10.10.4 Port 2 WX1 Layer 2 Layer 2 Port 5 Router MAP1 MAP2 MAP3

connected to the WX port. The WX 10/100 port provides PoE to the MAP. The WX forwards data only to and from the configured MAP on that port. Distributed MAP Network Requirements When a MAP connects indirectly to a WX, the WX must be configured with a Distributed MAP configuration. The WX can communicate with the Distributed MAP through any network port. (In the CLI, a Distributed MAP configuration is referred to as a DAP.) Because distributed MAPs are not directly attached to a WX, they require additional support from the network in order to function. Information on the booting and operation sequence for Distributed MAPs is covered in the “Configuring MAP Access Points” chapter of the Wireless LAN Switch and Controller Configuration Guide. ■ Power—PoE must be provided on one of the Ethernet connections to the MAP. Be sure to utilize a PoE injection device that has been tested by 3Com. Providing PoE on both of the Ethernet connections (if the MAP has two) allows for redundant PoE. ■ DHCP—A Distributed MAP uses TCP/IP for communication, and relies on DHCP to obtain IP parameters. Therefore, DHCP services must be available on the subnet that the MAP is connected to. DHCP must provide the following parameters to the MAP: ■ IP address ■ Domain name ■ DNS server address ■ Gateway address ■ DNS—If the intermediate network between the WX switch and Distributed MAP includes one or more IP routers, create a 3COMWX.mynetwork.com entry on the DNS server. The DNS entry allows the MAP to communicate with a WX. If the MAP is unable to locate a WX on the subnet it is connected to, it performs a DNS query for 3COMWX.mynetwork.com, where the DNS suffix for mynetwork.com is learned through DHCP. The WX relays information about WX switches in the network that contain a Distributed MAP configuration specific to that Distributed MAP.

65 Do not enable PoE on network ports unless you intend to power a third-party device. If you enable PoE under other conditions, power can damage the device. Configuring for a Directly-Connected MAP When you set the port type for use by locally connected MAPs, you must specify the PoE state (enabled or disabled) of the port. If you enable PoE on a port connected to another device, physical damage to the device can result. To set a port for a locally-connected MAP, use the following command: set port type ap port-list model {ap2750 | mp-52 | mp-101 | mp-122 | mp-241 | mp-252 | mp-262 | mp-341 | mp-352} poe {enable | disable} [radiotype {11a | 11b| 11g}] You must specify a port list of one or more port numbers, the MAP model number, and the PoE state. MAP access point models AP2750, MP-241 and MP-341 have a single radio that can be configured for 802.11a or 802.11b/g. MAP models MP-52, MP-252, MP-262, and MP-352 have two radios. One radio is always 802.11a. The other radio is 802.11b/g, but can be configured for 802.11b or 802.11g exclusively. If the country of operation specified by the set system countrycode command does not allow 802.11g, the default is 802.11b. MAP radios configured for 802.11g also allow associations from 802.11b clients by default. To disable support for 802.11b associations, use the set radio-profile 11g-only command on the radio profile that contains the radio. You cannot configure port 7 or 8 as a MAP port on the WX1200. To manage a MAP access point on a WX4400 switch, configure a Distributed MAP connection on the switch. (See “Configuring for a Distributed MAP” on page 66.) MAP model MP-262 requires an external antenna for the 802.11b/g radio. You must specify the antenna model. MAP models MP-341 and MP-352 have an internal 802.1b/g antenna as well as a connector for an external antenna, so use of an external antenna is optional on these

models. To specify the antenna model, use the set {ap | dap} radio antennatype command. (See “Configuring Radio-Specific Parameters” on page 73.) To verify the configuration changes, use the following commands. Use display ap config for directly connected MAPs and use display dap config for Distributed MAPs. (See “Displaying Radio Configuration Information” on page 74 for an example.) display ap config [port-list [radio {1 | 2}]] display dap config [dap-num [radio {1 | 2}]] The following example sets ports 1, 2, and 4 for MAP access point model AP2750: WX1200# set port type ap 1,2,4 model ap2750 poe enable This may affect the power applied on the configured ports. Would you like to continue? (y/n) [n]y success: change accepted. To verify the configuration change, use the following command: display ap config [port-list [radio {1 | 2}]] Here is an example: WX1200# display ap config 1 Port 1: MAP model: AP2750, POE: enable, bias: high, name: MAP01 boot-download-enable: YES load balancing group: none Radio: type: 802.11g, mode: disabled, channel: 6 tx pwr: 15, profile: default auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10 Configuring for a Distributed MAP To create a configuration for a Distributed MAP (referred to as a DAP in the CLI), use the following command: set dap dap-num serial-id serial-ID model {ap2750 | mp-52 | mp-101 | mp-122 | mp-241 | mp-252 | mp-262 | mp-341 | mp-352} [radiotype {11a | 11b| 11g}] The dap-num parameter identifies the Distributed MAP connection for the MAP.

67 For the serial-id parameter, specify the serial ID of the MAP. The serial ID is listed on the MAP case. To display the serial ID using the CLI, use the display version details command. The serial ID of the AP2750 might be preceded by 4 digits and a slash (example: 0100/). Do not enter these digits or the slash. The model and radiotype parameters have the same options as they do with the set port type ap command. Because the WX switch does not supply power to an indirectly connected MAP, the set dap command does not use the poe parameter. The following example configures connections for two Distributed MAPs that are indirectly connected to the WX. Note that when you create a connection, you assign it a number that can be used later for displaying and configuration, much like the physical ports for directly connected MAPs: WX1200# set dap 1 serial-id M9DE48B012F00 model mp-262 success: change accepted. WX1200# set dap 2 serial-id M9DE48B123400 model mp-341 success: change accepted. To verify the configuration change, use the following command: display dap config [dap-num [radio {1 | 2}]] Here is an example: WX1200# display dap config Dap 1: Serial-Id: M9DE48B012F00, AP model: AP2750, bias: high, name: DMP01 boot-download-enable: YES load balancing group: none Radio 1: type: 802.11g, mode: disabled, channel: dynamic tx pwr: 14, profile: default auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10 Dap 2: Serial-Id: M9DE48B123400, AP model: AP2750, bias: high, name: DMP02 boot-download-enable: YES load balancing group: none Radio 1: type: 802.11g, mode: disabled, channel: dynamic tx pwr: 14, profile: default auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10

Configure the same Distributed MAP on each of the WX switches you want to use to manage the MAP access point associated with the Distributed MAP. Make sure to use the same Distributed MAP number and serial ID on each WX switch. To display configuration information for all Distributed MAPs configured in the Mobility Domain, use the following command: display dap global [dap-num | serial-id serial-ID] The following command lists configuration information for the Distributed MAPs in Figure 7 on page 38: WX1200# display dap global Total number of entries: 12 DAP Serial Id WX IP Address Bias --- ----------- --------------- ---- 1 M9DE48B012F00 10.10.10.4 HIGH - M9DE48B012F00 10.10.40.4 HIGH - M9DE48B012F00 10.10.50.4 HIGH 2 M9DE48B123400 10.10.10.4 HIGH - M9DE48B123400 10.10.40.4 HIGH - M9DE48B123400 10.10.50.4 HIGH - M9DE48B6EAD00 10.10.40.4 HIGH - M9DE48B6EAD00 10.10.50.4 HIGH - M9DE48B234500 10.10.40.4 HIGH - M9DE48B234500 10.10.50.4 HIGH - M9DE48BDEA200 10.10.40.4 HIGH - M9DE48BDEA200 10.10.50.4 HIGH This example assumes that each WX switch in Figure 7 is configured with a Distributed MAP connection (DAP) for each MAP that is not directly connected to the WX switch. The MAPs that are directly connected to 10.10.10.4 (WX1) are not configured as Distributed MAPs on WX1, but they are configured as Distributed MAPs on the other WX switches. On WX1, the directly connected MAPs are configured using MAP access ports, with the set port type ap command. A DAP number is listed only for Distributed MAPs that are configured on the WX switch on which you type the command. For Distributed MAPs configured on other WX switches, a hyphen ( - ) is displayed in the DAP field. The bias determines the WX switch a Distributed MAP prefers for booting, configuration, and data transfer. (For information about bias

69 and how to configure it, see the Wireless LAN Switch and Controller Configuration Guide.) Configuring a Service Profile A service profile controls advertisement and encryption for an SSID. You can specify the following: ■ Whether SSIDs that use the service profile are beaconed ■ Whether the SSIDs are encrypted or clear (unencrypted) ■ For encrypted SSIDs, the encryption settings to use ■ The fallthru authentication method for users that are not authenticated with 802.1X or MAC authentication. The fallthru method can be Web, last-resort, or none. (See “Configuring for Authenticating Users” on page 60.) Table 12 lists the parameters controlled by a service profile and their default values. Table 12 Defaults for Service Profile Parameters Parameter Default Value Radio Behavior When Parameter Set To Default Value auth-dot1x enable When the Wi-Fi Protected Access (WPA) information element (IE) is enabled, uses 802.1X to authenticate WPA clients. auth-fallthru web-auth Uses Web AAA for users who do not match an 802.1X or MAC authentication rule for the SSID requested by the user. auth-psk disable Does not support using a preshared key (PSK) to authenticate WPA clients. beacon enable Sends beacons to advertise the SSID managed by the service profile. cipher-ccmp disable Does not use Counter with Cipher Block Chaining Message Authentication Code Protocol (CCMP) to encrypt traffic sent to WPA clients. cipher-tkip enable When the WPA IE is enabled, uses Temporal Key Integrity Protocol (TKIP) to encrypt traffic sent to WPA clients. cipher-wep104 disable Does not use Wired Equivalent Privacy (WEP) with 104-bit keys to encrypt traffic sent to WPA clients.

To create a service profile and assign an SSID to it, use the following command: set service-profile name ssid-name ssid-name To display a service profile, use the following command: cipher-wep40 disable Does not use WEP with 40-bit keys to encrypt traffic sent to WPA clients. psk-phrase No passphrase defined Uses dynamically generated keys rather than statically configured keys to authenticate WPA clients. psk-raw No preshared key defined Uses dynamically generated keys rather than statically configured keys to authenticate WPA clients. rsn-ie disable Does not use the RSN IE in transmitted frames. shared-key-auth disable Does not use shared-key authentication. This parameter does not enable PSK authentication for WPA. To enable PSK encryption for WPA, use the set radio-profile auth-psk command. ssid-name private Uses the SSID name private. ssid-type crypto Encrypts wireless traffic for the SSID. tkip-mc-time 60000 Uses Michael countermeasures for 60,000 ms (60 seconds) following detection of a second MIC failure within 60 seconds. web-aaa-form Not configured For Web AAA users, serves the default login web page or, if configured, the SSID-specific login web page. wep key-index No keys defined Uses dynamic WEP rather than static WEP. If you configure a WEP key for static WEP, MSS continues to also support dynamic WEP. wep active-multicast- index 1 Uses WEP key 1 for static WEP encryption of multicast traffic if WEP encryption is enabled and keys are defined. wep active-unicast-in dex 1 Uses WEP key 1 for static WEP encryption of unicast traffic if WEP encryption is enabled and keys are defined. wpa-ie disable Does not use the WPA IE in transmitted frames. Table 12 Defaults for Service Profile Parameters (continued) Parameter Default Value Radio Behavior When Parameter Set To Default Value

71 display service-profile name The following commands configure a service profile named corp1, and assign encrypted SSID private_wlan to it: WX1200# set service-profile corp1 ssid-name private_wlan success: change accepted. WX1200# set service-profile corp1 ssid-type crypto success: change accepted. Configuring a Radio Profile A radio profile is a named set of radio parameters that you can apply to multiple radios. A radio profile can contain information for two types of SSIDs: ■ Encrypted SSID—Clients using this SSID must use encryption. Use the encrypted SSID for secured access to your enterprise network. ■ Clear SSID—Clients using this SSID do not use encryption. Use the clear SSID for public access to nonsecure portions of your network. A radio can send and receive traffic for both types of SSID at the same time. By default, a radio sends beacons to advertise the encrypted SSID but does not advertise the clear SSID. To configure and display a radio profile, use the following commands: set radio-profile name display radio-profile name 3Com recommends that you do not use the name default. MSS already contains a radio profile named default. (For information about the default radio profile, see the Wireless LAN Switch and Controller Configuration Guide.) The following command configures radio profile rp1: WX1200# set radio-profile rp1 success: change accepted. Table 13 lists the radio profile parameters and their default values. For information about these parameters and how to change them, see the Wireless LAN Switch and Controller Configuration Guide.

Table 13 Defaults for Radio Profile Parameters Parameter Default Value Radio Behavior When Parameter Set To Default Value 11g-only disable Allows associations with 802.11g and 802.11b clients. This parameter applies only to 802.11b/g radios. beacon-interval 100 Waits 100 ms between beacons. dtim-interval 1 Sends the delivery traffic indication map (DTIM) after every beacon. frag-threshold 2346 Transmits frames up to 2346 bytes long without fragmentation. long-retry 5 Sends a long unicast frame up to five times without acknowledgment. max-rx-lifetime 2000 Allows a received frame to stay in the buffer for up to 2000 ms (2 seconds). max-tx-lifetime 2000 Allows a frame that is scheduled for transmission to stay in the buffer for up to 2000 ms (2 seconds). preamble-length short Advertises support for short 802.11b preambles, accepts either short or long 802.11b preambles, and generates unicast frames with the preamble length specified by the client. This parameter applies only to 802.11b/g radios. rts-threshold 2346 Transmits frames longer than 2346 bytes by means of the Request-to-Send/Clear-to-Send (RTS/CTS) method. service-profile No service profiles defined Default settings for all service profile parameters, including encryption parameters, are used. short-retry 5 Sends a short unicast frame up to five times without acknowledgment.

73 Configuring Radio-Specific Parameters The following parameters are specific to individual radios and are not controlled by a radio profile: ■ Channel number ■ Transmit power (in decibels referred to 1 milliwatt) ■ External antenna model (MP-262, MP-341, and MP-352 802.11b/g radios only) These parameters have the following defaults: ■ Channel number: ■ The default channel number for 802.11b/g is 6. ■ The default channel number for 802.11a is the lowest valid channel number for the country of operation. ■ Transmit power—Highest setting allowed for the country of operation or highest setting supported on the hardware, whichever is lower ■ External antenna model—ANT1180 The channel and power defaults listed above apply only when RF Auto-Tuning is disabled. RF Auto-Tuning can automatically set and adjust the channel and power settings on radios. By default, RF Auto-Tuning for channel assignment is enabled, and RF Auto-Tuning for power setting is disabled. You are not required to set any of these radio-specific parameters (except the external antenna type, if different from the default). RF Auto-Tuning sets the channels automatically to avoid channel interference, and the default power levels are high enough for most installations. If you do need to set the channels or power manually, use the following commands: set {ap port-list | dap dap-num} radio {1 | 2} channel channel-number set {ap port-list | dap dap-num} radio {1 | 2} tx-power power-level To change the external antenna type, use the following command:

set {ap port-list | dap dap-num} radio {1 | 2} antennatype {ANT1060 | ANT1120 | ANT1180} To enable or disable RF Auto-Tuning for channel or power assignment, use the following commands: set radio-profile name auto-tune channel-config {enable | disable} set radio-profile name auto-tune power-config {enable | disable} Applying a Radio Profile to Radios and Enabling the Radios To apply a radio profile to radios, use the following command: set {ap port-list | dap dap-num} radio {1 | 2} radio-profile name mode {enable | disable} The following commands applies radio profile rp1 to radio 1 on MAP access ports 1, 2, and 4 and on Distributed MAP 1 and Distributed MAP 2 and enables the radios: WX1200# set ap 1,2,4 radio 1 radio-profile rp1 mode enable success: change accepted. WX1200# set dap 1,2 radio 1 radio-profile rp1 mode enable success: change accepted. The following command applies radio profile rp1 to radio 2 on MAP access ports 1, 2, and 4 and on Distributed MAP 1 and enables the radios: WX1200# set ap 1,2,4 radio 2 radio-profile rp1 mode enable success: change accepted. WX1200# set dap 1 radio 2 radio-profile rp1 mode enable success: change accepted. Displaying Radio Configuration Information To verify radio configuration changes, use the following commands: display ap config [port-list [radio {1 | 2}]] display dap config [dap-num [radio {1 | 2}]]

75 Here is an example: WX1200# display ap config 1 Port 1: AP model: AP2750, POE: enable, bias: high, name: MAP01 boot-download-enable: YES load balancing group: none Radio 1: type: 802.11g, mode: disabled, channel: 6 tx pwr: 15, profile: default auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10 Configuring Mobility Domain Parameters A Mobility Domain is a collection of WX switches that work together to support a roaming user. A user can roam across the network from one WX switch to another while maintaining the same IP address and session. Each Mobility Domain has one seed member that maintains a list of the system IP addresses of all the members. Nonseed members communicate with the seed initially to retrieve and store the IP connectivity information of other WX switches, and subsequently if configurations of member switches change or switches are added or deleted. For normal operation, the seed switch need not be available for the rest of the Mobility Domain to function. All WX switches in a Mobility Domain use their system IP addresses as a basis to communicate. To support the services of the Mobility Domain, the system IP address of every WX switch in a Mobility Domain requires basic IP connectivity with the system IP addresses of all other WX switches in the Mobility Domain. (For configuration information, see “Specifying a System IP Address” on page 59.) Configuring the Seed To configure the current WX switch to be the seed of a Mobility Domain, use the following commands: set mobility-domain mode seed domain-name mob-dom-name To specify the WX switches that are members of the Mobility Domain, use the following command: set mobility-domain member ip-addr Enter the system IP address of the member switch. You do not need to enter the subnet mask. Repeat the command for each member.

To verify the change, use the following command: display mobility-domain The following commands configure a WX switch to be the Mobility Domain seed, add two nonseed members to the member list, and verify the change: WX1200# set mobility-domain mode seed domain-name corp success: change accepted. WX1200# set mobility-domain member 10.10.40.4 success: change accepted. WX1200# set mobility-domain member 10.10.50.4 success: change accepted. WX1200# display mobility-domain Mobility Domain name: corp Member State Status --------------- ------------- -------------- 10.10.10.4 STATE_UP SEED 10.10.40.4 STATE_UP MEMBER 10.10.50.4 STATE_UP MEMBER Configuring a Nonseed Member To configure the current WX switch to be a member of a Mobility Domain but not the seed for the domain, use the following command: set mobility-domain mode member seed-ip ip-addr Enter the system IP address of the seed switch. Configuring User Authentication MSS provides the following types of authentication: ■ IEEE 802.1X—If the network user’s network interface card (NIC) supports 802.1X, MSS checks for an 802.1X authentication rule that matches the username (and SSID, if wireless access is requested), and that uses the Extensible Authentication Protocol (EAP) requested by the NIC. If a matching rule is found, MSS uses the requested EAP to check the RADIUS server group or local database for the username and password entered by the user. If matching information is found, MSS grants access to the user. ■ MAC—If the username does not match an 802.1X authentication rule, but the MAC address of the user’s NIC or Voice-over-IP (VoIP) phone and the SSID (if wireless) do match a MAC authentication rule,

77 MSS checks the RADIUS server group or local database for matching user information. If the MAC address (and password, if on a RADIUS server) matches, MSS grants access. Otherwise, MSS attempts the fallthru authentication type, which can be Web, last-resort, or none. ■ Web—A network user attempts to access a web page over the network. The WX switch intercepts the HTTP or HTTPS request and serves a login Web page to the user. The user enters the username and password, and MSS checks the RADIUS server group or local database for matching user information. If the username and password match, MSS redirects the user to the web page she requested. Otherwise, MSS denies access to the user. ■ Last-resort—A network user requests access to the network, without entering a username or password. MSS checks for a last-resort authentication rule for the requested SSID (or for wired, if the user is on a wired authentication port). If a matching rule is found, MSS checks the RADIUS server group or local database for username last-resort-wired (for wired authentication access) or last-resort-ssid, where ssid is the SSID requested by the user. If the user information is on a RADIUS server, MSS also checks for a password. Users cannot access the network unless they are authorized. You can configure a WX switch to authenticate users with user information on a group of RADIUS servers or in a local user database on the switch. You also can configure a switch to offload some authentication tasks from the server group. ■ Pass-through—The switch establishes an Extensible Authentication Protocol (EAP) session directly between the client and RADIUS server. All authentication information and certificate exchanges pass through the switch. In this case, the switch does not need a certificate. ■ Local—The switch performs all authentication with information in a local user database configured on the switch. No RADIUS servers are required. In this case, the switch needs a certificate. If you plan to use EAP with Transport Layer Security (EAP-TLS), the clients also need certificates. ■ Offload—The switch offloads all EAP processing from a RADIUS server by establishing a TLS session between the switch and the client. In this case, the switch needs a certificate. If you plan to use the EAP-TLS authentication protocol, the clients also need certificates.

This section provides examples for configuring Protected EAP with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MS-CHAP-V2) authentication for 802.1X users, in pass-through and offload configurations. (For information about configuring other authentication types, see the Wireless LAN Switch and Controller Configuration Guide.) VLANs and Users For each user, an attribute must be set in the local database or on a RADIUS server to assign the user to a VLAN. This is true regardless of the authentication type you use. You can use either of the following attributes to assign a user to a VLAN: ■ Tunnel-Private-Group-ID—This attribute is described in RFC 2868, RADIUS Attributes for Tunnel Protocol Support. ■ VLAN-Name—This attribute is a 3Com vendor-specific attribute (VSA). You cannot configure the Tunnel-Private-Group-ID attribute in the local user database. Specify the VLAN name, not the VLAN number. The examples in this chapter assume the VLAN is assigned on a RADIUS server with either of the valid attributes. Other RADIUS attributes and VSAs are optional. (For information about 3Com VSAs, see the Wireless LAN Switch and Controller Configuration Guide.) Configuring Pass-Through Authentication To configure a WX switch to use a group of RADIUS servers to perform all user authentication: 1 Configure the RADIUS servers and add them to a server group. You must configure a server group even if you have only one server. (See “Configuring RADIUS Servers for Pass-Through Authentication” on page 79.) 2 Set the authentication protocol to pass-through. Pass-through authentication does not require local user information or user certificates on the WX switch. (See “Configuring the Authentication Protocol for Pass-Through Authentication” on page 80.) Figure 10 shows an example of pass-through user authentication.

79 Figure 10 Pass-Through User Authentication Configuring RADIUS Servers for Pass-Through Authentication To configure MSS to use a RADIUS server, use the following command: set radius server {server-name} [address ip-addr] [auth-port port-number] [acct-port port-number] [timeout seconds] [retransmit number] [deadtime minutes] [key string] [author-password password] To add the server(s) to a server group, use the following command: set server group group-name members server-name1 [server-name2] [server-name3] [server-name4] To configure MSS to load-balance authentication requests among the servers, use the following command: set server group group-name load-balance enable | disable To verify the change, use the following command: WX switch Router User A RADIUS server User A TLS MAP MAP

display aaa The following commands configure two RADIUS servers, add them to server group grp1, enable load balancing of authentication sessions among the servers, and verify the change: WX1200# set radius server svr1 address 10.10.70.20 key rad1pword success: change accepted. WX1200# set radius server svr2 address 10.10.70.40 key rad2pword success: change accepted. WX1200# set server group grp1 members svr1 svr2 success: change accepted. WX1200# set server group grp1 load-balance enable success: change accepted. WX1200# display aaa Default Values authport=1812 acctport=1813 timeout=5 acct-timeout=5 retrans=3 deadtime=0 key=(null) author-pass=(null) Radius Servers Server Addr Ports T/o Tries Dead State ------------------------------------------------------------------- svr1 10.10.70.20 1812 1813 5 3 0 UP svr2 10.10.70.40 1812 1813 5 3 0 UP Server groups grp1 (load-balanced): svr1 svr2 Configuring the Authentication Protocol for Pass-Through Authentication To configure the authentication protocol for 802.1X users, use the following command: set authentication dot1x {ssid ssid-name | wired} user-glob [bonded] protocol method1 [method2] [method3] [method4] To verify the change, use the following command: display aaa The asterisk in the example below is a wildcard. You cannot use a wildcard to represent the delimiter characters in user globs, which are the at sign (@) and the dot (.). To match a username that contains a delimiter, you must specify the delimiter in the user glob as shown in these

81 examples. Alternatively, use a double asterisk (**) with no delimiters to match all usernames. If you have more than one authentication rule, add the rules in the order you want MSS to use them. For example, add the most specific rules first and the most general rules (rules that match most widely) last. Authentication Example for Users in a Windows Domain The following command configures an authentication rule for a set of users, known as a user glob, in a Microsoft Windows domain. The command configures all users in the EXAMPLE Windows domain to use any supported EAP type to communicate with EAP-capable RADIUS server group grp1, when attempting to access SSID private_wlan. The server group authenticates the users. WX1200# set authentication dot1x ssid private_wlan EXAMPLE\* pass-through grp1 success: change accepted. Authentication Example for Users in a UNIX Domain The following commands add authentication rules for user globs in a UNIX domain. Users are authenticated by using any supported EAP type to communicate with EAP-capable RADIUS server group grp1. WX1200# set authentication dot1x ssid private_wlan *@mktg.example.com pass-through grp1 success: change accepted. WX1200# set authentication dot1x ssid private_wlan *@eng.example.com pass-through grp1 success: change accepted. WX1200# set authentication dot1x ssid private_wlan *@*.*.com pass-through grp1 success: change accepted. WX1200# set authentication dot1x ssid private_wlan *@*.com pass-through grp1 success: change accepted. Displaying the Server Group and Authentication Configuration The display aaa command displays the server group and authentication configuration on a WX switch. In the following example, the configuration contains a server group with two RADIUS servers and an authentication rule for users in a Windows domain.

WX1200# display aaa Default Values authport=1812 acctport=1813 timeout=5 acct-timeout=5 retrans=3 deadtime=0 key=(null) author-pass=(null) Radius Servers Server Addr Ports T/o Tries Dead State ------------------------------------------------------------------- svr1 10.10.70.20 1812 1813 5 3 0 UP svr2 10.10.70.40 1812 1813 5 3 0 UP Server groups grp1 (load-balanced): svr1 svr2 set authentication dot1x ssid private_wlan EXAMPLE\* pass-through grp1 Configuring EAP Offload with Server Authentication You can configure a WX switch to perform all EAP processing locally and use RADIUS servers for authentication and authorization. To configure an WX switch to perform EAP processing locally and use RADIUS servers for MS-CHAP-V2: 1 Install server certificates on the WX switch. You can install certificates assigned by a CA or generate self-signed certificate on the switch. (See “Installing a Server Certificate for Network Users” on page 52, “Generating a Self-Signed Certificate for Network Users” on page 53, and “Installing a Certificate Assigned by a Certificate Authority for Network Users” on page 53.) 2 Configure the RADIUS servers and add them to server group. You must configure a server group even if you have only one server. (See “Configuring RADIUS Servers for Pass-Through Authentication” on page 79.) 3 Set the 802.1X authentication protocol to PEAP-MS-CHAP-V2. With this protocol setting, a WX switch performs EAP locally and uses a RADIUS server to complete the process by performing authentication and authorization with MS-CHAP-V2. (See “Configuring the Authentication Protocol for Offload Authentication” on page 83.) Figure 11 shows an example of offload user authentication.

83 Figure 11 Offload User Authentication Configuring RADIUS Servers for Offload Authentication (See “Configuring RADIUS Servers for Pass-Through Authentication” on page 79.) The commands for configuring a RADIUS server group are exactly the same for offload and pass-through user authentication. Configuring the Authentication Protocol for Offload Authentication To configure the authentication protocol for 802.1X users, use the following command. A user glob represents a set of users. set authentication dot1x {ssid ssid-name | wired} user-glob [bonded] protocol method1 [method2] [method3] [method4] WX switch Router User A Certificate authority RADIUS server MS-CHAP-V2 User A TLS Server certificate Certificate authority certificate MAP MAP

To verify the change, use the following command: display aaa The following command configures a WX switch to authenticate users in the EXAMPLE Windows domain who request access to SSID private_wlan, by processing EAP locally on the WX switch, and by using a RADIUS server in server group grp1 for MS-CHAP-V2 authentication and authorization: WX1200# set authentication dot1x ssid private_wlan EXAMPLE\* peap-mschapv2 grp1 success: change accepted. The asterisk in this example is a wildcard. You cannot use a wildcard to represent the delimiter characters in user globs, which are the at sign (@) and the dot (.). To match a username that contains a delimiter, you must specify the delimiter in the user glob as shown in these examples. Alternatively, use a double asterisk (**) with no delimiters to match all usernames. If you have more than one authentication rule, add the rules in the order you want MSS to use them. For example, add the most specific rules first and the most general rules (rules that match most widely) last. WX1200# display aaa Default Values authport=1812 acctport=1813 timeout=5 acct-timeout=5 retrans=3 deadtime=0 key=(null) author-pass=(null) Radius Servers Server Addr Ports T/o Tries Dead State ------------------------------------------------------------------- svr1 10.10.70.20 1812 1813 5 3 0 UP svr2 10.10.70.40 1812 1813 5 3 0 UP Server groups grp1 (load-balanced): svr1 svr2 set authentication dot1x ssid private_wlan EXAMPLE\* peap-mschapv2 grp1 Displaying and Saving the Configuration MSS immediately implements configuration changes by updating the device’s running configuration. The software does not automatically retain configuration changes after a software reboot or a power cycle. To review and save configuration changes, use the following commands:

85 display config [area area] [all] save config The display config command without the all option displays only those configuration changes that are different from the default settings of the WX switch and its MAP access points. The all option displays the entire configuration including the default values of all parameters. The following command displays the beginning of the configuration file on a WX switch configured with the commands in this chapter: WX1200# display config # Configuration nvgen'd at 2004-9-16 14:12:37 # Image 3.0.0 # Model WX1200 # Last change occurred at 2004-9-16 14:03:52 set ip route default 10.10.20.19 1 set system name WX1200 set system ip-address 10.10.10.4 set system countrycode US set timezone pdt -8 0 set summertime PDT start first sun apr 4 0 end last sun oct 31 0 set service-profile corp1 ssid-name private_wlan set service-profile corp1 ssid-type crypto set radius server svr1 address 10.10.70.20 key rad1pword set radius server svr2 address 10.10.70.40 key rad2pword set server group grp1 members svr1 svr2 set server group grp1 load-balance enabled set enablepass password b6b706525e1814394621eeb2a1c4d5803fcf set authentication dot1x ssid private_wlan EXAMPLE\* pass-through grp1 set radio-profile rp1 set dap 1 serial-id M9DE48B012F00 model mp-262 set dap 2 serial-id M9DE48B123400 model mp-341 set port type ap 1,2,4 model ap2750 poe enable set dap 1,2 radio 1 radio-profile rp1 mode enable press any key to continue, q to quit. WX1200# save config Configuration saved to configuration.

Table 15 lists the technical specifications for wireless switch model WX4400. Table 15 lists the technical specifications for wireless switch model WX1200. Table 14 WX4400 Mechanical and Compliance Specifications Specification Description Size Width: 44.2 cm (17.4 inches) Depth: 46.23 cm (18.2 inches) Height: 8.81 cm (3.47 inches) Weight With one power supply: 9.75 kg (21.50 pounds) With two power supplies: 11.35 kg (25.00 pounds) Operating Temperature 0° C to +50° C (32° F to +122° F) Storage Temperature -20° C to +70° C (-4° F to +158° F) Humidity 10% to 95% noncondensing Power supply 100-240 VAC 50 Hz to 60 Hz Up to 350 W 8 Arms at 120 Vrms and 3.5 Arms at 230 Vrms, with 50-A peak inrush current Hot-swappable Load sharing with two supplies installed Status indicators Management CPU status LED Power supply status LEDs Port activity and link speed LEDs (For descriptions of the LEDs, see “Status LEDs” on page 14.)

Wired network ports Four dual-interface gigabit Ethernet ports. Each port has a 1000BASE-TX copper interface and a GBIC slot for insertion of a 1000BASE-SX or 1000BASE-LX fiber-optic interface. Safety and electromagnetic compliance FCC PART 15, UL 60950 ICES PART 15, CSA 22.2 NO. 60950 EN 55022, EN 55024 CISPR 22 TUV/GS (EN 60 950) VCCI Table 15 WX1200 Mechanical and Compliance Specifications Specification Description Size Width: 44.2 cm (17.4 inches) Depth: 25.6 cm (10.08 inches) Height: 4.4 cm (1.72 inches) Weight Without a power supply: 3.40 kg (7.50 pounds) With power supply: 3.8 kg (8.50 pounds) Operating Temperature 0° C to +50° C (32° F to +122° F) Storage Temperature -20° C to +70° C (-4° F to +158° F) Humidity 10% to 95% noncondensing Power supply 100-120 VAC / 200-240 VAC 47 Hz to 63 Hz 2.5 Arms at 115 Vrms and 1.25 Arms at 230 Vrms, with 70-A peak inrush current Power over Ethernet (PoE) 48 VDC 91.8 W total budget for all ports (15.3 W * 6 ports) 15.3 W per port maximum Status indicators Power supply status LEDs Port activity and link speed LEDs (For descriptions of the LEDs, see “Status LEDs” on page 14.) Table 14 WX4400 Mechanical and Compliance Specifications (continued) Specification Description

Six RJ-45 ports for 10/100BASE-T Ethernet and optional Power over Ethernet (PoE) Two RJ-45 ports for 10/100BASE-T Ethernet uplinks (without PoE) Safety and electromagnetic compliance FCC PART 15, UL 60950 ICES PART 15, CSA 22.2 NO. 60950 EN 55022, EN 55024 CISPR 22 TUV/GS (EN 60 950) VCCI Table 15 WX1200 Mechanical and Compliance Specifications (continued) Specification Description

during basic installation and setup of a WX switch. Table 16 WX Setup Problems and Remedies Symptom Diagnosis Remedy 3Com Wireless Switch Manager or a web browser (if you are using Web View) warns that the WX switch’s certificate date is invalid. The switch’s time and date are currently incorrect, or were incorrect when you generated the self-signed certificate or certificate request. 1 Use set timezone to set the time zone in which you are operating the switch. (See “Configuring the Time and Date” on page 40.) 2 Use set timedate to configure the current time and date in that time zone. (See “Configuring the Time and Date” on page 40.) 3 Reconfigure the administrative certificate(s). (See “Enabling Secure Communication for 3WXM or Web Manager” on page 46.) 4 If you have already configured a certificate on the switch for authentication by network users, you must recreate this certificate, too.

WX switch does not accept configuration information for an MAP access point or a radio. The country code might not be set or might be set for another country. 1 Type the display system command to display the country code configured on the switch. 2 If the value in the System Countrycode field is NONE or is for a country other than the one in which you are operating the switch, use the set system countrycode command to configure the correct country code. (See “Specifying the Country of Operation” on page 56.) Client cannot access the network. This symptom has more than one possible cause: ■ The client might be failing authentication or might not be authorized for a VLAN. 1 Type the display aaa command to check the authentication rules on the WX switch, to ensure that the client can be authenticated. 2 Check the authorization rules in the switch’s local database (display aaa) or on the RADIUS servers to ensure the client is authorized to join a VLAN that is configured on at least one of the WX switches in the Mobility Domain. ■ If the client and switch configurations are correct, a VLAN might be disconnected. A client connected to a VLAN that is disconnected is unable to access the network. 1 Type the display vlan config command to check the status of each VLAN. 2 If a VLAN is disconnected (VLAN state is Down), check the network cables for the VLAN’s ports. At least one of the ports in a VLAN must have a physical link to the network for the VLAN to be connected. Table 16 WX Setup Problems and Remedies (continued) Symptom Diagnosis Remedy

software reload. The configuration changes were not saved. 1 Retype the commands for the missing configuration information. 2 Type the save config command to save the changes. Mgmt LED is quickly blinking amber. CLI stops at boot prompt (boot>). The WX switch was unable to load the system image file. Type the boot command at the boot prompt. Table 16 WX Setup Problems and Remedies (continued) Symptom Diagnosis Remedy

Warning Conventions This situation or condition can cause injury. Deze situatie of omstandigheid kan letsel veroorzaken. Diese Situation oder dieser Zustand kann zu Verletzungen führen. Cette situation ou cette condition peuvent provoquer des blessures. Esta situación o condición puede causar lesiones. High voltage. This situation or condition can cause injury due to electric shock. Hoog voltage. Deze situatie of omstandigheid kan letsel veroorzaken door elektrische schokken. Hochspannung. Diese Situation oder dieser Zustand kann einen Elektroschock verursachen. Haute tension. Cette situation ou cette condition peuvent provoquer des blessures dues à des décharges électriques. Alta tensión. Esta situación o condición puede causar lesiones por descarga eléctrica.

Qualified Service Personnel Warning Radiation. This situation or condition can cause injury due to improper handling of fiber-optic equipment. Straling. Deze situatie of omstandigheid kan letsel veroorzaken door onjuist gebruik van glasvezelapparatuur. Strahlung. Diese Situation oder dieser Zustand kann durch falschen Umgang mit glasfaserbasierten Geräten zu Verletzungen führen. Radiation. Cette situation ou cette condition peuvent provoquer des blessures dues à une manipulation inappropriée d’appareils équipés de fibres optiques. Radiación. Esta situación o condición puede causar lesiones debido a un manejo inadecuado del equipamiento de fibra óptica. Installation must be performed by qualified service personnel only. Read and follow all warning notices and instructions marked on the product or included in the documentation. De installatie mag alleen worden uitgevoerd door bevoegd onderhoudspersoneel. Het is essentieel dat u kennis neemt van alle waarschuwingen en instructies aangebracht op het product zelf en/of opgenomen in de documentatie. Die Installation darf nur von einem qualifizierten Kundendienstmitarbeiter vorgenommen werden. Lesen Sie alle Warnhinweise und Anweisungen auf dem Produkt oder in der Dokumentation und befolgen Sie sie. L’installation doit être effectuée uniquement par des techniciens qualifiés. Lisez et suivez toutes les notices d’avertissement et les instructions figurant sur le produit ou comprises dans la documentation. Sólo puede realizar la instalación personal cualificado de asistencia técnica. Lea y siga todas las notas de advertencia e instrucciones indicadas en el producto o incluidas en la documentación.

To reduce the risk of eye injury, do not stare into the interface or otherwise direct the laser beam into your eye. De gigabit Ethernet glasvezel interfaces gebruiken Klasse 1 lasers. Teneinde oogletsel te voorkomen, mag u nooit rechtstreeks in de interface kijken of een laserstraal op andere wijze op uw oog richten. Für die Glasfaserschnittstellen werden bei Gigabit-Ethernet Class 1-Laser verwendet. Vermeiden Sie Augenverletzungen, indem Sie nicht in die Schnittstelle schauen oder den Laserstrahl auf Ihr Auge richten. Les interfaces Gigabit Ethernet à fibre optique utilisent des lasers de classe 1. Pour réduire le risque de blessure oculaire, ne regardez pas directement l’interface et ne dirigez pas le faisceau laser vers vos yeux. Las interfaces de fibra óptica Gigabit Ethernet utilizan láseres de Clase 1. Para reducir el riesgo de sufrir lesiones oculares, no mire fijamente la interfaz ni dirija el rayo láser hacia los ojos.

Earth Ground Warning Earth grounding is required for a WX switch installed in a rack. If you are relying on the rack to provide ground, the rack itself must be grounded with a ground strap to the earth ground. Metal screws attaching the switch to the rack provide ground attachment to the rack. Aarding aan de grond is vereist voor een WX switch geïnstalleerd in een rek. Als u het rek gebruikt als massa, dan dient het rek zelf via een aardingsstrip verbonden te zijn met grondaarding. De metalen bouten waarmee de switch is bevestigd aan het rek zorgen voor aarding van het rek. Für einen WX-Switch, der in einem Rack installiert ist, ist eine Erdung erforderlich. Wenn Sie die Erdung über das Rack vornehmen möchten, müssen Sie es über ein Masseband mit der Erde verbinden. Die Erdung zum Rack erfolgt dann über die Metallschrauben, die den Schalter mit dem Rack verbinden. La mise à la terre est requise pour un commutateur WX installé dans un châssis. Si vous utilisez le châssis comme masse, celui-ci doit être mis à la terre au moyen d’un câble de mise à la terre relié à la prise de terre. Les vis métalliques qui attachent le commutateur au châssis assurent une mise à la masse au châssis. Un interruptor WX instalado en un bastidor necesita una conexión a masa. Para utilizar el bastidor como conexión a masa debe conectar a masa dicho bastidor con una tira de conexión a masa. Los tornillos metálicos que fijan el interruptor al bastidor proporcionan conexión a masa al bastidor.

3Com recommends that you ask someone to assist you with the remaining steps. If you accidentally drop the WX switch, you can be injured and the switch can be damaged. 3Com adviseert dat u bij het uitvoeren van de resterende stappen iemand ter assistentie vraagt. Als u de WX switch per ongeluk laat vallen, kunt u letsel oplopen en kan de switch beschadigd raken. 3Com empfiehlt, dass Sie jemanden bitten, Ihnen beim Ausführen der weiteren Schritte zu helfen. Wenn Sie den WX-Switch versehentlich fallen lassen, könnten Sie dadurch verletzt werden und der Switch wird eventuell beschädigt. 3Com vous conseille de demander l’assistance d’une autre personne pour les étapes restantes. Si vous laissez tomber le commutateur WX par accident, vous pouvez vous blesser et le commutateur risque d’être endommagé. 3Com le recomienda que pida la ayuda de alguien para realizar los pasos restantes. Si el interruptor WX se cae accidentalmente, usted puede sufrir lesiones y el interruptor puede sufrir daños. To prevent the WX switch from slipping, do not release the switch until all the rack-mount screws are tight. Laat de WX switch niet los totdat alle bevestigingsbouten goed zijn vastgedraaid om te voorkomen dat de switch uit uw handen glijdt. Sie vermeiden, dass der WX-Switch abrutscht, indem Sie ihn festhalten, bis alle Rack-Befestigungsschrauben angezogen sind. Pour éviter que le commutateur WX ne tombe, ne le lâchez pas tant que les vis de montage du châssis ne sont pas fixées. Para evitar que el interruptor WX se caiga, no lo suelte hasta que todos los tornillos del bastidor estén bien apretados.

Overcurrent Warning The WX switch relies on the building’s installation for overcurrent protection. Ensure that a fuse or circuit breaker no larger than 120 VAC, 15A U.S. (240 VAC, 10 A international) is used on the phase conductors. De WX switch is afhankelijk van de in het gebouw geïnstalleerde beveiliging tegen overstroom. Op de fase-aders dient een zekering of circuitonderbreker te worden gebruikt van maximaal 240 V~, 10 A. Der Lastschutz des WX-Switch hängt vom Gesamtlastschutz des Gebäudes ab. Sie sollten sicherstellen, dass die Phasen mit maximal 240 V~ / 10 A abgesichert sind. La protection du commutateur WX contre les surintensités dépend de l’installation électrique du bâtiment. Assurez-vous qu’un fusible ou un disjoncteur inférieur ou égal à 120 VCA, 15 A É.-U. (240 VCA, 10 A pour les autres pays) est utilisé sur les conducteurs de phase. El interruptor WX está protegido contra las sobrecargas de corriente mediante la instalación del edificio. Asegúrese de utilizar un fusible o un disyuntor que no supere los 120 VAC, 15A en EE.UU. (240 VAC, 10 A en el resto del mundo) en los conductores de fase.