3Com 3CRWXR10095A Bedienungsanleitung

http://www.3com.com/ Part No. 10015082 Published June 2 006 Wir eless LAN Mobility System W ir eless LAN Switch Manager Refer ence Manual WX4400 3CRWX440095A WX1200 3CRWX120695A WXR100 3CRWXR10095A[...]

3Com Corporati on 350 Campus Drive Marlborough, MA USA 01752-3064 Copyright © 2 006, 3Com Corporatio n. All rights reserved . No part of this documen tatio n may be repro duced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without writt en permission fr om 3Com Cor poration. 3C[...]

C ONTENTS A BOUT T HIS G UIDE Conventions 17 Documentation 18 Documentation Comments 19 1 I NSTALLING 3WXM Ha rdwa re Re qui reme nts 21 Hardwar e Requir ements for 3WXM Cli ent 21 Hardwar e Requir ements for 3WXM Monit oring Service 22 Software Requirements 23 Preparing for Installation 23 User Privileges 23 Serial Number and License Key 24 Instal[...]

Copy and Paste in the Content Panel 43 Enabling Keyboard Shortcut Mn emonics (Windows XP Only) 44 3 G ETTING S TARTED Starting 3WXM 47 Restricting A ccess to 3WXM 50 Creati ng an Administrato r Account 51 Creating Provision or Monitor Accounts 52 Deleting 3WXM User Acco unts 52 Disabling Access Contr ol 5 2 4 W ORKING WITH N ETWORK P LANS Creating [...]

Creati ng or Modifying Buildings in a Site 74 Creati ng or Modifying Floors 77 Importing or Drawing Floor Details 78 Importing a Drawing of a Floo r 78 File Recommendations 79 Preparing a Dr awing Before Importing It 79 Cropping the Paper Space 84 Adjusting the Scale of a Drawing 85 Adjusting the Origin Point 86 Working with Laye rs 87 Cleaning Up [...]

6 C ONFIGURING WX S YSTEM P ARAMETERS WX Switch Configuration Objects 157 Adding a WX Switch to the Network Pla n 161 Creati ng a WX Switch as Part of RF Planning 161 Creating a WX Switch Using the Create Wireless Switch W izar d 161 Creating a New WX Switch Based o n a Configured Switch in the Network Plan 162 Adding a Switch by Uploading its Conf[...]

Viewing and Setting Log and T race Settings 198 Viewing Log Settings 198 Changing Log Set tings 198 Viewing and Configuring IP Services Settings 201 Viewing IP Services Setting 201 Creati ng a Static Route 202 Create an IP Alias 203 Configuring DNS 203 Configuring NTP 204 Configuring ARP 205 Viewing and Configuring VLANs 206 Viewing VLANs 207 Creat[...]

7 C ONFIGURING W IR ELESS P ARAMETERS Viewing and Configuring Wireless Services 235 Wireless Service Parameters 236 Viewing W ir eless Services 241 Configuring an 802.1X Wireless Service 242 Configuring a V oice over W ireless Service 244 Configuring a We b-Portal (WebAAA) Service 247 Configuring an Open Access Serv ice 250 Configuring a Custom Ser[...]

Adding an Entry to the Client Black List 284 Enabling Countermeasur es 284 Enabling MAP Signatures 285 8 C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETERS Creati ng and Managing Users in the Local User Database 287 Viewing Users and Groups in the Local Database 288 Creati ng a Named User 289 Creati ng a User Gr oup and Ass[...]

Viewing and Configuring AAA Support for Thir d-Party AP Users 322 Viewing Settings for Thir d-Party AP AAA Support 322 Creati ng a Proxy Acces s Rule 322 Configuring a RADIUS Proxy for a Client 324 Specifying the WX Port Connec ted to the Third-Party AP 324 Viewing and Changing Location Policy Rules 325 Viewing Location Policy Rules 325 Creati ng a[...]

Synchronizing Local and Netwo rk Changes 35 0 Reviewing Switch Conf igurat ion Changes 350 Accepting Network Changes 351 Undoing Local or Network Changes 351 Deploying Switch Configurati on Changes 352 Synchro nizing When the Network and 3WXM Have Nonmatchin g Changes 353 Distributing System Images 354 Using the Image Repository 354 Distributing Sy[...]

13 C ONFIGURING AND A PPLYING P OLICIES How Changes Are Managed 373 Policies Created When Y ou Migrate a 3. x Ne twork Plan to 4.1 373 Viewing Policies 374 Creat ing a Policy 374 Configuring Featur e Settings in a Policy 375 Applying Policy Changes to Switches 375 14 U SING THE E VENT L OG Displaying the Event Log 377 T oolbar Options 377 Refreshin[...]

Generating a Site Survey Order 398 Generating a W ork Or der 399 16 M ONITORING THE N ETWORK Overview 401 Requirements for Mo nitoring 402 Accessing Monitor ed Data 402 Using the Explor e Window 403 T oolbar Options 405 Thres hold Flags 407 Displaying Object Details 410 Displaying 802.11 Coverage 410 T aking RF Measurements 412 Using the Sta tus Su[...]

Using the Rogue Detectio n Screen 462 T oolbar Options 463 Filtering the Rogue List 464 Displaying Rogue Details 465 Displaying a Rogue’ s Geographical Location 468 Ignoring Friendly Third-Party Devices 470 Adding a Device to the Attack List 471 Converting a Rogue into a Third Party AP 471 T o convert a rogue in to a third- party AP 471 Adding a [...]

B C HANGING 3WXM S ERVICES P REF EREN C ES Overview 491 Starting or Stopping the 3WXM Services 493 Connecting to 3 WXM Services 494 Certificate Check 495 V erifying that the 3WXM Client is Receiving Service Data 496 Changing Service Settings 497 Changing WX Connection Settings 498 Changing Monitoring Settings 500 T o change monitoring settings 501 [...]

[...]

A BOUT T HIS G UIDE This manual shows you ho w to plan , configure, deploy , an d manage a Mobility System wireless LAN (WL AN) using the 3Com Wireless LAN Switch Manage r (3WXM). Read this manual if you are a network administrator or a person responsible for managing a WLAN. If release notes are shipped with your product and the information there [...]

18 A BOUT T HIS G UIDE This manual uses the follo wi ng text and syntax conventions: Documentation The 3WXM documentation set includes the following documents.  Wireless LAN Switch Manage r (3WXM) Release Notes These notes provide information about the system software release, including new features and bug fixes.  Wireless LAN Switch and Con[...]

Documentation Comments 19  Wireless LAN Switch Ma nager Refere nce Manual This manual shows you how to plan , configure, deploy , and manage a Mobility System wireless LAN (WL AN) using the 3Com Wireless LAN Switch Manage r (3WXM).  Wireless LAN Switch Manager User’ s Guide This guide shows y ou how to pl an, configure, deploy , and manage [...]

20 A BOUT T HIS G UIDE Example:  Wireless LAN Switch and Cont roller Configuration Guide  Part number 730-9502- 0071, Revision B  Page 25 Please note that we can only r esp ond to comments and questions about 3Com product documentation at this e-mail address. Qu estions related to T echnical Support or sales should be di rected in the firs[...]

1 I NSTALLING 3WXM This chapter d escribes how to install 3Com Wireless LAN Switch Manager (3WXM). Ha rdw are Requirements Ha rdw are Requirements for 3WXM Client T able 3 shows the min imum and r ecommended requir ements to run the 3WXM client. Ta b l e 3 Hardwar e Requirements for Running 3WXM Client Minimum Recommended Processor Intel Pentium 4 [...]

22 C HAPTER 1: I NSTALLING 3WXM Ha rdw are Requirements for 3WXM Monitoring Service T able 4 shows the min imum and r ecommended requir ements to run the 3WXM monitoring service. T able 5 contains general recommended guidelines for hardware requir ements and memory allocation based on the nu mber of radios and WX switches your server will support. [...]

Software Requirements 23 Software Requirements 3WXM client and 3WXM monitoring services are each supported on the following operating systems:  Microsoft Windows Server 2003  Microsoft Windows XP with Service Pack 1 (SP1) or later  Microsoft Windows 2000 with Service Pack 4 Y ou must use the English version of the operating system you sele[...]

24 C HAPTER 1: I NSTALLING 3WXM Serial Number and License Key 3WXM comes with a base lic ense key , which is provided on the CD cover . T o use 3WXM Services, you need to enter the base key and an activation key , which you obtain from 3Com. The base key and activation key enable you to manage up to 10 wir ele ss LAN switches. T o manage mor e than[...]

Installing 3WXM 25 2 Open the 3Com Wir eless Switch Management folder . 3 Select 3Com Wireless Switch Manager . 4 Click the View button. The 3Com W ireless LAN Switch Mana ger (3WXM) information screen appears. 5 Click the Install b utton. The installation begins. During the inst allation, the 3Com W ireless Switch Manager installation wizard minim[...]

26 C HAPTER 1: I NSTALLING 3WXM Installation Log File During installation, an installati on log file, 3WXM_InstallLog.log, is created and placed in the 3WXM inst allation folder . Double-click the log file’ s icon to read the log file. Have this log file available if you need to contact 3Com T ech nical Support about an installation problem. Upgr[...]

Uninstalling 3WXM 27 3 Click Uninstall . The 3WXM Uninstall Options dialog appears. By default, the following are removed when you uninstall the client application:  Network plans  Access contr ol If the monitoring service was also installed, the monitoring service’ s database directory is also uninstalled by default. The databas e dir ecto[...]

28 C HAPTER 1: I NSTALLING 3WXM T o prevent an item from being uninstalled, click on the checkbox next to the item to r emove the checkmark. 4 Click Continue . The uninstall program reports its pr ogr ess. When the uninstall process is complete, the uninstall program r eports that the items were successfully deleted. 5 Click Done .[...]

2 W ORKING WITH THE 3WXM U SER I NTERFACE This chapter describes how to use the 3Com W ir eless LAN Switch Manager (3WXM) interface. Overview When you start 3WXM client and l og into 3WXM Services, the network plan is displayed by the 3WXM client. T oolbar Organiz er panel Content panel Aler ts panel Lock icon[...]

30 C HAPTER 2: W ORKING WI TH THE 3WXM U SER I NTERFACE The network plan is the work spac e in 3WXM you use to design and manage a 3Com network. The network plan defines t he following:  Network equipment (WX switches, MAPs, and third-party access points)  Network site, including floor plans, RF characteristics of the floors, and radio covera[...]

Display Panels 31 The Organ izer panel can contain the following object trees, depending on the option selected on th e tool bar:  Policies (displayed by the Policies tool b ar option) — The set of device configuration policies included in your network plan.  Equipment (displayed by the Configuration tool bar option) — The set of devices [...]

32 C HAPTER 2: W ORKING WI TH THE 3WXM U SER I NTERFACE T o expand the view of an object in the tree, click on the plus sign next to the object. For example, to display the buildings in a site, click on the plus sign next to the site name. T o display the floors in the build ing, click next to the bu ilding name, a nd so on. Alerts Panel Th e Alert[...]

Display Panels 33 Content Panel The Co ntent panel displays informat ion or configuration settings, based on the selected tool bar option. The Co ntent panel is located to the right of the Organizer panel. (See the figure on page 29.) The Policies, RF Planning, and Conf ig uration tool bar options display configuration fields. After selecting one o[...]

34 C HAPTER 2: W ORKING WI TH THE 3WXM U SER I NTERFACE Saving or Discardin g Configuration Changes When you select the Policies, RF Planning, or Configurat ion tool bar option, the Content panel contains a Save bu tton and a Discard button.  Save —Click Save to send un saved configuration changes to 3WXM Services to save in the network pla n.[...]

Display Panels 35 T o resolve errors and deploy the cha nges, use the V erification option. The V erification o ption provides detailed information for errors and war nings and enables you to resolve them. Gene rally , you can resolve an error or warning by ignoring it or by clicking a link to open a configuration wizard. (For mor e information, se[...]

36 C HAPTER 2: W ORKING WI TH THE 3WXM U SER I NTERFACE Some wizards contain multiple pages. Click the Next and Previous buttons at the b ottom of a wizard to navigate among the wizard’ s pages. The Finish button saves the changes. If applicable, saving the chang es also results in the newly configured object appe aring in a table in the Content [...]

Display Panels 37 Properties Dialogs T o open a version of the configuration wizard that contains all the configurable settings for the object, even ones that rarely need to be changed, select the object in the table, then click Properties . Resizing a Display Panel Y ou can resize a panel by clicking and dragging the panel’ s border , or by clic[...]

38 C HAPTER 2: W ORKING WI TH THE 3WXM U SER I NTERFACE Menu Bar Options T able 8 lists the options available from the menu at the top of the main 3WXM window . Click on a menu category to display t he options for that category . Ta b l e 8 3WXM Menu Options Menu Option Description File Connect Log on to 3WXM Services. Close Close the curr ently op[...]

Tool Bar Options 39 T ool Bar Options T able 9 lists the options available fr om the tool bar of the main 3WXM window . Click on an option to open the data or tabs fo r that option. Some tool bar options fill the Cont ent panel. Others fill the entir e window area under the tool bar . The larger icons provide access to 3WXM featur es. The smaller i[...]

40 C HAPTER 2: W ORKING WI TH THE 3WXM U SER I NTERFACE RF Planning Display the tree of configur ed sites in the Organizer panel.  To display information about a site or an object in that site, click on it. The information appears in the Content panel.  To perform site-related tasks, click task links in the Task List panel. (See “Planning t[...]

Tool Bar Options 41 V erification Display the Config V erification and Network V erification tabs. The V eri fication tabs enable you to troubleshoot configuration issues on WX swi tches in the network plan or in the live ne twork.  To display more information about an error or warning message, click on the row containing the message.  To res[...]

42 C HAPTER 2: W ORKING WI TH THE 3WXM U SER I NTERFACE Copying, Pasting, and Deleting Objects Y ou can copy , paste, and delete object s in the Organizer panel or in the Content panel. In the Or ganizer panel, right-click on an object to display a menu with the following options:  Copy —Copy the selected object and it s child objects to t he [...]

Copying, Pasting, and Deleting Objects 43 Copy and Paste Replace in the Organizer Panel T o replace an object with the Copy and Paste Repla ce options: 1 Select the object you want to copy in the Organizer panel. 2 Right-click on the object and select Copy . 3 Select the object you wa nt to r eplace. 4 Right-click on the pare nt object and select P[...]

44 C HAPTER 2: W ORKING WI TH THE 3WXM U SER I NTERFACE Enabling Keyboard Shortcut Mnemonics (Windows XP Only) Keyboar d short cut mnemonic s (also ca lled action mnemonics ) in 3WXM underline shortcut characters in action names in toolbars and menus. When a character is underlined, you can press the corresponding letter key on the keyboard to disp[...]

Enabling Keyboard Shortcut Mnemonics (Windows XP Onl y) 45 4 Clear the box labe led Hide underlined letters for keyboar d navigation until I press the Alt key . Clearing this option allows programs to show the underlined character for mnemonics in 3WXM. 5 Click OK . 6 In the Display Pr operties dialog box, click OK .[...]

46 C HAPTER 2: W ORKING WI TH THE 3WXM U SER I NTERFACE[...]

3 G ETTING S TARTED This chapter contain s information about starting 3Com Wireless LAN Switch Manager (3WXM), restrict ing access to 3WXM, creating and managing network plans, and defining a Mobility Domain. Starting 3WXM The following steps describe how to start 3WXM. Y ou must install a license key and acti vation key fo r the server before you [...]

48 C HAPTER 3: G ETTING S TARTED If this is the first time you ar e starting 3WXM, or you have not yet activated your license, the client w ill not establish a c onnection to the server when you click Next . Instead, the client w ill briefly contact the server , then display the following message: Error: Missing license .  If you need to install[...]

Starting 3WXM 49 8 If you plan to manage 10 or fewer wireless LAN switches, click Fin ish and go to step 13. If you plan to manage more than 10 wir eless LAN switches, click Next and go to step 9. If you are activating an eva luati on copy , you can manage up to 10 wireless LAN s witches. 9 T ype the upgrad e license key in the License Key box and [...]

50 C HAPTER 3: G ETTING S TARTED Restricting Access to 3WXM By default, all users who have been su ccessfully auth enticated to a system with 3WXM installed on it can run 3WXM. Y ou can restrict the users allowed to access 3WXM on a system and define their access privileges by cr eating three types of 3WXM user accounts:  Administrator —This a[...]

Restricting Ac cess to 3WXM 51 Creating an Administrator Account Before you can r estrict user acce ss to 3WXM, you must cr eate an administrator account. After creati ng an administrator account, you can cre ate pr ovision or monit or accoun ts. T o create an administrator account: 1 Select T ools > 3WXM Services Setup . The 3WXM Services Setup[...]

52 C HAPTER 3: G ETTING S TARTED Creating Pr ovision or Monitor Accounts After cr eating an administrator acco unt, you can create provision or monitor accounts. T o create a provision or monitor account: 1 Access the 3WXM Services Setup dialog box. 2 T o add a provision user account, click Add Pr ovision Account . T o add a monitor account, click [...]

4 W ORKING WITH N ETWORK P LANS A network plan is the workspace in 3WXM you use to design a 3Com network. In a network plan, you defi ne components of the network (WX switches, MAP access points, and optional third-party access points). Regardless of whether you intend to use physical planning features, you must create a network plan before you can[...]

54 C HAPTER 4: W ORKING WI TH N ETWORK P LANS Creating a Network Plan T o create a network plan: 1 From the main 3WXM window , select File > New . The Create Network Plan wizard appears. 2 In the Network Plan Name box, type a n ame for the network plan. Y ou can use 1 to 60 alphanumeric characters, with no spaces, tabs, or any of the following: [...]

Managing Network Plans 55  Wireless Switch—Use a wizard to configure basic switch parameters. (See “Using the Create Wireless Switch Wizard” on page 165.)  Third-Party AP—Add a thir d-party AP for use in network planning. (See “Creating a Thir d-Party AP” on page 63.)  Country Code—Change the regulat ory domain for the MAPs i[...]

56 C HAPTER 4: W ORKING WI TH N ETWORK P LANS 3Com recommends that you r egularly back up the config-db directory so that you have additional copies of your network plans. (In addition to this sect ion, see “M anaging Network Plans” on page 503.) If the plan has unsaved c hanges and 3WXM Services becomes unavailable before the changes are saved[...]

Managing Network Plans 57 T o open a network plan: 1 Establish a connection to the 3WXM Services host on which the network plan is saved. Y ou can do this by restarting 3WXM or selecting File > Open , and then entering the IP address of the 3WXM Services host in the 3WXM Services Connection dialog box. 2 After the connection is established wi th[...]

58 C HAPTER 4: W ORKING WI TH N ETWORK P LANS 3WXM compares the object names in the plan to b e imported with the object names in the open plan. If both plans have objects of the same name and type, the objects are listed and Conflict appear s in the Status column. 3 Do one of the following, depending on whether you want to import all objects from [...]

Managing Network Plans 59 T o delete a network plan 1 In the main 3WXM window , select Fi le > Delete Network Plan . The Delete Network Plan wizard appears. 2 Select the network plan you want to delete from the list. 3 Click Next . The network plan is deleted. 4 Click Finish . Sharing a Network Plan Since the 3WXM plan repository r eside s on a [...]

60 C HAPTER 4: W ORKING WI TH N ETWORK P LANS T o disable notification 1 In the main 3WXM window , select T ools > Pr efere nces . 2 Click the Persisten ce tab. 3 T o disable change no tification, clear Plan Change Notification . 4 Click Close . Defining a Mobility Domain A Mobility Domain is a co llection of WX switches that work together to su[...]

Defining a Mobility Do main 61  Mobility Domain communication s are stable. Generally , the communications requir ed for roaming ar e the same as those r equired for VLAN t unneling. Roaming betwee n ports on a WX is possible even if the Mobility Domain is down.  Authentication, authorization, and accounting (AAA) on the MAP to which the clie[...]

62 C HAPTER 4: W ORKING WI TH N ETWORK P LANS T raffic Ports Used by a Mobility Domain When deploy ing a Mobili ty Domain, you mig ht attach the W X switches to subnets that have firewalls or access controls between them. W ithin a Mobility Domain, the WX switches e xchange information and other types of traffic, depending on your configuration of [...]

Creating a WX Switch 63 6 In the Available Devices lis t, select the WX switches you want to add to the Mobility Domain. 7 Click Next . 8 Select the switch to act as the seed switch for the Mobility Domain. 9 Click Finish . Creating a WX Switch 1 Select the Configuration tool bar option. 2 In the Organizer panel, select the network plan name. 3 In [...]

64 C HAPTER 4: W ORKING WI TH N ETWORK P LANS 9 In the HTTP Port Number box, specify the port number for HTTP service. 10 Click Next . 11 In the AP Model dr op-down list, select one of the following:  AP (Dual Radio) —802.11a and 802.11b or 802.11b/g  AP (Single Radio) —802.11a, 802.11b, or 802.11g 12 In the Radio T y pe dr op-down list, [...]

Changing the Country Code 65 Changing the Country Code The country code determines the va lid radio types as well as channel numbers and power settings for MAP ra dios. The country code is one of the parameters you set w hen you cr eate a network plan. If you need to change a plan’ s country code, use the following procedure. 1 Select the Configu[...]

66 C HAPTER 4: W ORKING WI TH N ETWORK P LANS 5 Select the scope:  Mobility Domain  WX switch  Radio profile  Individual MAP radio T o select a radio pr ofile, display it first by clicking on the p lus sign next to the WX switch. T o select an individual radio, display it first by displaying its radio profile, then clicking on the plus [...]

Converting Auto DAPs into Statically Configured APs 67 Converting Auto DAPs into Statically Configured APs Distributed MAPs that ar e not c onfig ur ed on any WX switches in the Mobility Domain can nonetheless be bo oted and managed by a switch if the switch has a profile for Distributed MAPs, and has capacity to manage the MAP . A MAP that is boot[...]

68 C HAPTER 4: W ORKING WI TH N ETWORK P LANS T o simplify configuration, 3WXM assumes that the extent of the Network Domain is the same as extent of the entire network plan. 3WXM also automatically sets the seed affinities on each switch as described in T able 11. 3Com recommends that you allow 3WXM to automatically assign affinity values instead [...]

5 P LANNING THE 3C OM M OBILITY S YSTEM The 3Com W ir eless LAN Switch Manager (3WXM) planning tools help you plan your mobility system. This chapter discusses the Building wizar d and describes how to create a site, create or modify buildings, import or draw floor details, specify the RF characteristics of a floor , define a wire less coverage ar [...]

70 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM Accessing the RF Planning T ools T o access the RF pla nning tool s, select the RF Planning tool bar option and do one of the following:  If you are cr eating a new buildi ng, click on the site name in the Organizer panel and select Create Building in the T ask List panel.  If you ar e mod[...]

RF Planning Overview 71 Adjust the paper space (crop the drawing). Define the drawing scale. Change the grid size. Zoom in. Zoom out. Fit view in window . Print the view displayed in the floor display ar ea. T oggle AP label. Copy selected objects. Paste selected objects. Undo last change. Redo last change. Group selected objects. Ungroup selected [...]

72 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM Creating or Modifying a Site A site is a folder that contains the buildings in the ne twork plan. A site usually repr esents a campus of geographically colocated building s. If your network plan encompasses multiple campuses, create a site for each campus. T o create or modify a site 1 Select th[...]

Creating or Modifying a Site 73 1 In the Site Name box, type a name for the site (1 to 80 alphanumeric characters, with no spaces o r tabs). 2 T o change the Count ry Code, select Se tup Country Code in the T ask List panel, then in the Change Country C ode dialog, select the country where the network is to be deployed. 3 In the Channel Set (802.11[...]

74 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM Creating or Modifying Buildings in a Site T o create or modify a building in a site: 1 Select the RF Planning tool bar option. 2 In the Organizer panel, click the site name. 3 Do one of the fo llowing:  If you ar e cr eating a new buildi ng, click on the site name in the Organizer panel and s[...]

Creating or Modifying Buildings in a Site 75 1 In the Building Name box, type the name of the building (1 to 30 alphanumeric characters, with no spaces or tabs). 2 In the T ask List Panel, under Other , click Edit Building. The Edit Building dialog box is displayed. 3 In the Number Of Floors box, specif y how many floors the building has.[...]

76 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM 4 In the Starting Floor Level bo x, spec ify the floor number of the first floor in the building. T o start with a subterran ean floor , you can specify 0 or a negative floor numb er . 5 In the Skip Floor Levels box, specify floor numbers you want to skip. Skipping floors is usef ul when you wa [...]

Creating or Modifying Floors 77 Creating or Modifying Floors T o create or modify a floor in a building: 1 Select the RF Planning tool bar option. 2 In the Organizer panel, click the building name. 3 Do one of the fo llowing:  If you are cr eating a new floor , click on the building name in the Organizer panel and select Cr eate Fl oor in th e T[...]

78 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM 6 In the Height of the Ceiling box, type the number of feet or meters from the floor to the ceiling (1 to 1000 feet or meters). The ceiling height is based on the surface of the ceiling where the access points will be mounted, not on the ce nter of the plenum space between floors. 7 Click OK. Af[...]

Importing or Drawing Floor Details 79 File Recommendations For optimal results, use a DWG or DXF drawing. These types of drawings are made of vector graphics line objects (lines), whic h you can easily convert into RF obstacles after importing the drawing in to 3WXM. In addition, the drawing objects are usually grouped together and organized by lay[...]

80 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM In AutoCAD, when you load the draw ing file, you might see messages about the files not being foun d. T o check for exter nal refer ences, you can select Insert > Xr ef Manager . If you look at the lay ers, externally refer enced layers have a common pr efix label with the $ delimiter between[...]

Importing or Drawing Floor Details 81 T o check the contents of the invisible layer s to make sur e the informatio n can be discar de d, re verse the fr ozen /unfr ozen statu s of all layers, to that only the layers that normally are frozen ar e visible. In T urboCAD, delete the unneeded la yers. In AutoCAD, click-drag around all the visible object[...]

82 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM T o move objects t o the new RF laye rs, click-drag to select objects, select Modify >Pr operties , and change the objects’ layer .  Save the drawing on DWG and DXF fo rmats, in case one fo rmat does not import well. T o save the file into a specific form at, select File >Save As and [...]

Importing or Drawing Floor Details 83 Importing the Drawing T o import a floor dr awing: 1 Select the RF Planning tool bar option. 2 In the Organizer panel, click on the plus sign next to t he building to expand it, then click on the name of the floor for which you are importing the drawing. An empty fl oo r layout appears in the Content panel. 3 I[...]

84 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM Figure 1 Floor Plan After Importing At this point, you can edit the floor contents. Go to “Cropping the Paper Space”, next, to begin. Cropping the Pap er Space Y ou can crop the paper space of a drawing to remove unneeded space and objects around the floor . For example, if the drawing inclu[...]

Importing or Drawing Floor Details 85 If you click Ye s , all object s and paper space outside the area you selected are r emoved and the image is resized to fill the r emoved space. Figure 1 on page 84 shows the same floor plan as Figure 2 (below) after cropping the paper space. Figure 2 Floor Plan After Cr opping Adjusting the Scale of a Drawing [...]

86 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM Adjusting the Origin Point 3WXM uses a building’ s origin point to understand what is above or be low a given floor . When calculating RF co verage, 3WXM needs to understand where MAP access points on adjacent floors ar e located so that 3WXM can take RF from those MA Ps into a ccount when ass[...]

Importing or Drawing Floor Details 87 In this example, the origin point ha s been moved to an interior shaft. Working with Layers Most drawings contain multiple layers of information. 3WXM allows you to hide, add and delete individual layers. Y o u also can add and r emove objects and move objects from one layer to another . For RF planning, you ca[...]

88 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM For best performance and simpler pl anning, 3Com r ecommends that you hide or remove unnecessary layers and r emove unnecessa ry objects. The Clean Layout option auto matically deletes all obj ects that meet the cleanup criteria, which you can modify . (See “Cleaning Up a Drawing” on page 89[...]

Importing or Drawing Floor Details 89 Adding or re moving a layer T o add a new laye r to a drawing, do the following: 1 Right-click the list of layers in the Organize r panel. 2 Select Add Layer from the menu that is displayed. 3WXM adds the new layer to the list and highlights its name so you can edit it. 3 Edit the name. Moving an object from on[...]

90 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM T o clean up a drawing 1 Display the floor plan in the Content panel. 2 In the T ask List panel, under RF Planni ng, click Clean Layout . The Floor Plan Clean Up wizar d appears. 3 In the Remove Lines and Remove Objects gr oup boxes, click next to any items you do not want 3WXM to remove from th[...]

Importing or Drawing Floor Details 91 6 T o change the maximum size of object s to be r emoved, type the new horizontal and vertical dimensions in the X-axis and Y - axis boxes. 3WXM removes all objects that fit within both the specified axes. 7 In the Layer List gr oup box, select the layers you want to clean up. Y ou can select individual layers [...]

92 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM 10 Do one of the fo llowing:  Click Finish to ac cept the changes.  Click Previous to change the cleanup constraints. Go back to step 2 on page 75.  Click Cancel to cancel the changes.[...]

Importing or Drawing Floor Details 93 Drawing Floor Objects Manually Y ou can use the Free Draw palette to add objects to your floor drawing that are not r elated to RF obstacle s (for example, a conference r oom table). The tools for drawing non-RF objects work the same as the tools for drawing RF objects, but the tools are different. T o d raw a [...]

94 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM Specifying the RF Characteristics of a Floor 3WXM uses RF attenuation information in the floor plan when calculating how many MAPs you ne ed and where to place them to provide the wireless coverage r equir ed for the floor . The RF attenuation information comes from the attenuati on values assoc[...]

Specifying the RF Char acteristics of a Floor 95 Converting Objects into RF Obstacles Y ou have several options w hen cr eating RF obstacles:  Convert all objects in a layer of a CAD drawing into RF obstacles.  Convert all objects in an ar ea of the drawing into RF obstacles.  Convert multiple objects in the drawing into RF obstacles.  [...]

96 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM T o create RF obstacles by grouping objects Y ou can group several objects in a drawing to specify them as one RF obstacle. For example, if a wall consis ts of several lines, the lines can be grouped. If you subsequently ungr oup the objects, the RF obstacle information is removed. 1 Select an o[...]

Specifying the RF Char acteristics of a Floor 97 3 In the Attenuation Factor boxes, specify the attenuation factor for 802.11a and 802.11b/g techn ology (0 to 100 dB). The default is the typical attenuation factor for the material chosen . 4 Click Finish to save the changes and close the dialog box.  If you created RF obstacles for all ob jects [...]

98 C HAPTER 5: P LANNING THE 3C OM M OB ILITY S YSTEM Using an object other than a line to represent an RF obstacle’ s dimensions does not mate rially affect th e calcul ation of RF attenuation. When 3WXM calculates attenuation along any vector passing through the obstacle, it counts the obstacle’ s RF attenuation only once, regardless of the f[...]

Specifying the RF Char acteristics of a Floor 99 T o use this method, perform the following tasks: 1 In 3WXM, identify the major RF obstacles an d assign an attenuation value to them. Y ou can select any attenuat ion value. 3WXM will use the RF measurement data fr om the site surv ey to correct the attenuation values. (See “Converting Objects int[...]

100 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM Site Survey Recommendations This manual does not descri be how to use the site survey application. For this information, consult the Ekahau site survey documentation. When conducting the survey , use the following best practices for optimal res ul ts :  V erify t hat the scale of the floo r p[...]

Specifying the RF Char acteristics of a Floor 101 5 Click Ye s next to File. 6 In the File Format listbox, select Ekahau . 7 Click Choose to navigate to the csv file that contains the LOS point s. 8 Click Next . The MAC addresses of the LOS points app ear .[...]

102 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 9 Click next to the MAC a ddr ess of each LO S point you want to im port. The MAC addresses are associated with specific radio types. Select the MAC addresses for the radio types you want to use in the network. 10 Click Finish . 11 Place the LOS points on the floor pl an. Click Objects to Place [...]

Specifying the RF Char acteristics of a Floor 103 When you place an LOS point onto the floor plan, the icon disappears from the Organizer Panel. T o create LOS points in 3WXM 1 Display the floor plan in the Content panel. 2 In the T ask List panel, click T ools. 3 Under Site Survey , click the icon. 4 On the floor plan, click on the location for th[...]

104 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 5 In the Name box, type a name fo r the LOS point and click Next . 6 In the AP Model listbox, se lect the type or model of AP you plan to use for the portable AP . If the model is n ot listed, select AP (Dual Radio) for a dual-radio AP or AP (Single Radio) for a single-radio AP . 7 In the Radio [...]

Specifying the RF Char acteristics of a Floor 105 9 In the Channel Number listbox, spec ify the channel number on which the AP radio will b e operating. 10 In the T ransmit Power listbox, specify the transmit power of the AP’ s radio. 11 In the MAC Addr ess box, type the MAC address you want to use for th is position of the AP . T o ensure valid [...]

106 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM T o move an LOS point T o move an LOS icon, click-and-drag to select the icon an d move it to its new location. T o temporarily remove an LOS point onto the Objects to Place tab T o temporarily remove an LOS point from the floor without deleting it, click and drag the LOS icon to the Ob jects T [...]

Specifying the RF Char acteristics of a Floor 107 4 Select the scope for which you want ge nerate a site survey order . Y ou can specify the Network Pla n, an individual site, an indi vidual building, or an individual floor . 5 Select the language for the site survey order:  English  German 6 T o specify the output directory for the site surv[...]

108 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 9 Select a floor to display LOS point information fo r that floor . Scroll down to view the MAC address assignments for the LOS points. Use the instructions in the Ekahau Site Survey Initial Setup section of the work order to set up the survey . When you import the floor map into the site sur ve[...]

Specifying the RF Char acteristics of a Floor 109 4 Click Ye s next to File. 5 In the format listbox, select Ekahau . 6 Click Choose to navigate to the csv file that contains the RF measurem ent data. 7 In the Map Name field, specify the map name. The map name must match the name specified in the site sur vey work order , and must be the same map n[...]

110 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM Applying the RF Measurements to the Floor Plan 1 Under Site Survey in the T a sk List panel, click Optimi ze . A wizard appears, listing the progress of the request.  The T otal number of RF measurements that did not intersect any object line lists the number of measu reme nts that did no t e[...]

Defining Wireless Coverage Areas 111 Y ou must also identify the wireless technology r equired (802.11a or 802.11b/g) for coverage areas. For areas r equiring multiple wireless technologies, two comp letely over lapping coverag e ar eas are created—one for 802.11a and one for 802.1 1b/g. Y ou define coverage by cr eating the following items:  [...]

112 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 5 In the Name box, type the name of the wiring closet (1 to 60 characters, with no tabs). 6 If you have not defined a WX switch in 3WXM, click Finish to save the changes. Otherwise, go to step 7. 3WXM determines how many WX switches are needed when it computes how many MAP access points ar e req[...]

Defining Wireless Coverage Areas 113 Defining a Coverage Area Using the coverage ar ea drawing tool , you can specify the coverage area graphically on your floor plan. Y ou perform the following tasks to define a coverage area: 1 “Drawing a Coverage Area” on page 114 2 “Specifying the W ir eless T echnology for a Coverage Area” on page 116 [...]

114 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM The coverage areas shown in Figure 6 cannot share coverage and are not supported by 3WXM. (However , separa te, nonshared coverage ar eas can overlap.) Figure 6 Unsupported Shar ed Coverage Area Example Keep the following in mind when planning shar ed coverage ar eas:  T wo cover age areas us[...]

Defining Wireless Coverage Areas 115 If you are using a complex concav e polygon as a coverage area, computation of MAP access points might take longer than the computation for an area with a less complicated shape. When drawing a coverage ar ea, make sure it extends just short of external walls. If the coverage ar ea includes external walls, 3WXM [...]

116 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM The Create Coverage Area wizar d appears. Go to “Specifying the W ir eless T echnology for a Coverage Area”. Specifying the Wireless T echnology for a Coverage Area (T o draw a coverage area, see “Dra wing a Co verage Ar ea” on page 11 4.) T o specify wireless technol ogy for a cove rage[...]

Defining Wireless Coverage Areas 117 2 T o refine the dimensions of the co verage area , specify the appr opriate dimension in the X-Length and Y -Lengt h boxes. 3 Click Next . The wizard presents pr operties and associatio n pages for the technology you chose in step 1. The following example shows the wizard for 802.11a and 802.11g technologies. S[...]

118 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 4 Click Next . The Floor Properties page ap pears. Specifying Floor Properties for the Coverage Ar ea Y ou can optionally specify floor properties for the coverage ar ea (if they ar e dif fer ent fr om the default s for th e floor ): 1 T o change the ceiling height, specify the new height in the[...]

Defining Wireless Coverage Areas 119 Specifying Default Device Se ttings for the Coverage Ar ea Y ou can optionally specify the WX switch or MAP models that 3WXM uses when calculating the devices to include in the coverage ar ea. 1 T o change the WX switch model, select the model fr om the WX Model list. 2 T o change the default MAP model, se lect [...]

120 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM If the MAPs are directly conne cted to the WX, ensure that UTP Cat 5 cabling distances betw een the MAP and the WX in the wiring closet do not exceed 100 meters (330 feet). An indirectly attached MAP require s Power over Ethernet (PoE) from a source other than a WX switch, such as a power inject[...]

Defining Wireless Coverage Areas 121 2 T o change the MAP connection type fo r the r edundant co nnection, select Direct or Distributed from the MAP Connection T ype list. WX4400 switches support indirect MAP connect ions only . 3 T o change the number of redundant connections for the distributed connection type, type the number in the Redundancy L[...]

122 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM Configuring Capacity Calculation for Data 3WXM can perform multiple calculations for MAP placement. One is based on coverage only . Another is based on capacity for data traffic, using the data capacity parameters. 3WXM compares the results of the calculations and selects the calcul ation that r[...]

Defining Wireless Coverage Areas 123 Configuring Capacity Calculation for V oice 3WXM can perform multiple calculations for MAP placement. One is based on coverage only . Another is based on capacity for voice over IP service, using the capacity for vo ice parameters. 3WXM comp ar es the results of the calcul ations and selects the calculation that[...]

124 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 3 In the Active Handsets per AP list, sp ecify the number of voice ov er IP phones that you want each MAP to handle. 4 In the Expected Handset Count list, sp ecify the number of voice over IP phones you expect to be in the coverage area. 5 In the Handset Oversubscription Rati o list, select the [...]

Defining Wireless Coverage Areas 125 Specifying Mobility Domain, Radio Pr ofile, and Wiring Closet Associations T o specify association info rmation for the coverage area: 1 In the Mobility Domain list, select th e Mobility Domain that contains the MAPs used for this coverage area. 2 In the Radio Profile list, select the radio pr ofile used for thi[...]

126 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 4 Select the coverage ar ea y ou want to edit and click Pr operties . The Coverage Area Pr operties dialog for the select ed coverage ar ea appears. (Y ou can also display this dialog by displaying the floor plan, selecting Coverage Areas in the Organizer pa nel, then right -clicking on th e cov[...]

Defining Wireless Coverage Areas 127 5 Under the General tab, you can d o the following:  In the Name box, edit the name of the coverage area (1 to 60 characters long, with no tabs).  In the T echnology list, select one of the following:  802.11a  802.11b  802.11g  802.11a and 802.11b  802.11a and 802.11g Select 802.11a and 802[...]

128 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM  In the Active Handsets per AP list, sp ecify the number of voice ov er IP phones that you want each MAP to handle.  In the Expected Handset Count list, specify the number of voice over IP phones you expect to be in the coverage area.  In the Handset Oversubscription Ratio list, select [...]

Defining Wireless Coverage Areas 129 8 Under the Constraints tab, you can do the following:  T o change the ceiling height, specif y the new height in the Height of the Ceiling box.  T o change the height where MAPs are mounted, specify the new mounting height in the AP Placement Height bo x.  T o change the WX switch model, select the mod[...]

130 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM  T o use the same WX switch fo r r edundant connections, select Use the Same WX for Redundancy . This option places both of a MAP’ s wired connections on the same WX switch. For optimal r esiliency , 3Com re commends the use of differ ent WX switches for redundancy .  T o change the MAP [...]

Placing Third-Party Access Points 131 Moving a Third-Party AP Icon to its Floor Location If you added a third-party access point while using the Configuration or Rogue Detection tool bar options, the access point is on the Objects to Place tab. 1 In RF Plan ning, na vigate to the floor plan. 2 In the Organizer panel, click Objects to Place . 3 Sele[...]

132 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 5 In the Name box, type a name for the access point. Y ou can use 1 to 32 characters, with no punctuation exce pt the following: period (.), hyphen (-), or underscor e (_). 6 Optionally , in the Manufacturer ID box, type the manufacturer identification for the access point (1 to 30 characters, w[...]

Placing Third-Party Access Points 133 12 In the AP Model dr op-down list, select one of the following:  AP (Dual Radio) —802.11a and 802.11b or 802.11b/g  AP (Single Radio) —802.11a, 802.11b, or 802.11g 13 In the Radio T ype drop-down list, select one of the following: 11a , 11b , 11g . The choices available depend on the selection you ma[...]

134 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 15 V erify the radio slot numb er and radio type. For a dual-radio access point, 802.11b/g radios have a slot number of 1. 802.11a radios have a slot number of 2. 16 In the Channel Number list, select the channel number for the radio . 17 In the T ransmit Power box, specif y the transmit power f[...]

Placing Installed and Auto-Configured MAPs 135 Placing Installed and Auto-Configured MAPs Y ou can place MAPs that are alr eady installed on the floor into the network plan. T o do this, yo u upload the MAP configuration into 3WXM, associate the MAP with a coverage a rea , then place them on the floor plan. In addition, MAPs that receive their conf[...]

136 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM Computing MAP Placement After you provide information about floor plans, RF obstacles, and wire less coverage r equir ements , 3WXM can design your 3Com wirel ess network for this floor using the follow ing pr ocess:  Compute and place MAPs (See “Computing and Placing MAP Access Points fo r[...]

Computing MAP Placement 137 If you are modifying an existing coverage ar ea with deployed MAPs or if you need to preserve manual changes made to the current configuration, you can lock the MAPs. Locked MAPs cannot be moved or deleted d uring the Compute and Place pr ocess. Y ou perform the following tasks to compute and place MAPs: 1 Specify design[...]

138 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 5 T o change the heig ht wher e MAPs ar e mounted, specify the new mounting height in the AP Placement Height box. 6 T o change the WX switch model, select the model from the WX Model list. 7 T o change the MAP conn ection type , select the ty pe from the AP Connection T ype list:  Direct—M[...]

Computing MAP Placement 139 12 T o change the number of redundant connections for the distributed connection type, type the number in the Redundant Level box. For direct connections, the r edundancy level is always 1. 13 Click Next . The Coverage Ar ea Sele ction dialog is displayed. 14 T o update all the constrain ts for the selected coverage area[...]

140 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM T o compute and place MAPs 1 Display the floor plan in the Content panel. 2 In the T ask List panel, click RF Planning . 3 Under RF Planning, click Compute and Place . The Compute and Place wizard appears. 4 T o remove a coverage ar ea from MAP placement and computation, clear the area’ s Comp[...]

Computing MAP Placement 141 10 Go to “T o review coverage ar ea computation”. T o revi ew coverage ar ea computa tion 1 Review the number of MAPs r equired for each coverage area, and the overriding criterion used (coverage or capacity). 2 Click Fi nish to apply the changes. Icons for the suggested MAP locations appear on the floor plan.[...]

142 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM T o see the RF coverage ar ea for an are a, right-click on the ar ea (either in the organizer panel or on the floor) and select Display RF Coverage . If the area supports mor e than one radio technology , you also need to select the technology . The choices availab le depend on the wir eless tec[...]

Computing MAP Placement 143 Y ou must now compute the optimal power . See “Comput ing Optimal Power” on page 147. Locking and Unlocking MAPs After you compute and place the nece ssary MAPs for a coverage area, you can move them to fine-tune th e wireless coverage. If you need a MAP to be located at a fixed location on the floor , you can lock i[...]

144 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM Assigning MAP Channels If you do not plan to use the RF Auto-T uning feature to automatically set the channels on the MAPs after deployment and installation, use the Assign Channels to MAPs option to assign channels to the MAPs. Appropriate assignment of channels acr oss the floor minimizes co-c[...]

Computing MAP Placement 145 3 T o change the star ting floor for channel assignment, select the floor from the Begin On Floor List. By default, 3WXM st arts at the top floor and works down. 4 T o change the ending floor for channel assignment, select the floor fr om the End On Floor List. The ending floor number must be lower than or equal to the s[...]

146 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 9 Click Finish to accept the channel assignments. The new channel assignments ar e r eflected in the Coverage Ar eas panel. 10 Do one of the fo llowing:  T o verify the RF network, see “V er ifying the Wireless Network” on page 150.  Click Finish to save the changes and close the wizar[...]

Computing MAP Placement 147  Y ellow—Up (but with minor service d egradation)  Orange—Up (but with major service degradation)  Red—Down  Blue—Unknown A MAP with a blue background is not in the live network even though it is on the floor plan. The channel num ber for this MAP will match the channel number assigned by RF Planning.[...]

148 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 3 T o optimize the AP count, select Optimize AP Count . This option checks for coverage overlaps and removes a MAP if neighboring MAPs pr ovide enough coverage to make the MAP unnecessary . This option applies only to coverage areas that are configured for coverage, not capacity . Unless you di [...]

Computing MAP Placement 149 T o resolve optimal power computation problems If power levels for one or more coverage ar eas could not be optimized, show the RF coverage at baseline a ssociation and minimum transmit rates for the coverage areas by doing the following: 1 In the Show RF coverage using listb ox , select how you want to display the cover[...]

150 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM V erifying the Wireless Network Y ou can use the following tools to help verify the wireless network:  Show RF coverage.  Place RF measur ement points.  Use RF interactive measurement mode. Showing RF Coverage Looking at the RF coverage allows you to see if the entire area is adequately[...]

Verifying the Wireless Network 151 3 In the Show RF coverage using listb ox , select how you want to display the coverage:  Baseline Association Rate—Coverag e is shown based on the MAP radio baseline association rate. The baseline association rate is the typical data rate the radio is expected to support for client associations. (The baseline[...]

152 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 4 On the floor plan, click where you want the measurement point to be placed. The Create RF Measurement Point dialog box appears. 5 In the Description box, type a de scription for the measurement point (1 to 60 characters). 6 In the RSSI Options box, select display options for the dialog box: ?[...]

Verifying the Wireless Network 153 7 Click OK to save the changes and close the box. 8 Do one of the fo llowing:  T o use the RF interactive me asurement mode, see “Using RF Interactive Measurement Mode”.  T o generate net work design information, see “Generating RF Network De sign Informatio n” on page 15 5.  Click Finish to save [...]

154 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM T able 15 shows the info rmation available in the RF measurement table. T able 15 RF Mea sur ement Information Item Value X Distance in the X direction from the 0,0 coor dinate (the upper left corner of the panel). Y Distance in the Y direction from the 0,0 coor dinate (the upper left corner of [...]

Generating RF Network Desi gn Information 155 Generating RF Network Design Information After 3WXM has calculated the number of MAPs r equired to pr ovide wireless coverage, you can generate a work order report. The work order report pr ovides all of the necessary information for the physical installation of the 3Com Mobility Sy stem. A work or der [...]

156 C HAPTER 5: P LANNING THE 3C OM M OBILITY S YSTEM 4 Specify whether to include the following info rmation in the work order:  RF Coverage  RSSI Projections  Show Disabled MAPs (only available if RSSI Pr ojections is selected)  Show RF Coverage On Entire Floor (only available if RSSI Projections is selected)  Show Unreachable MAPs[...]

6 C ONFIGURING WX S YSTEM P ARAMETERS This chapter and the follo wing two ch apters describe how to view and configure WX switches using 3WXM. If you want to use 3WXM planning to config ure switches for you as part of coverage plan ning, see “Plann i ng the 3Com Mobility System” on page 69. If you are planning to use 3WXM to configure swit ches[...]

158 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS T able 16 WX Switch Object T ypes Category Obj ect Type Description System Ports Settings for individual ports. (See “Viewing and Changing Port Settings” on page 176.) Port Groups Settings for port groups. (See “Viewing and Changing Port Groups” on page 184.) Management Services Settings f[...]

WX Switch Configuration Objects 159 System, cont. VLANs Groups of physical ports configured as a distinct Layer 2 broadcast domain. Each VLAN has its own Spanning T ree Pr otocol (STP) and Internet Group Management Protocol (IGMP) settings. Optionally , a VLAN can be associated with an IP interface. (See “Viewing and Configuring VL ANs” on page[...]

160 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Wireless, cont. RF Detection Configuration parameters for rogue detection and countermeasures (See “Viewing and Changing RF Detection Settings” on page 282.) AAA Local User Database Users configured on the WX switch instead of on the RADIUS server (See “Creating and Managing Users in the Loc[...]

Adding a WX Switch to the Network Plan 161 Adding a WX Switch to the Network Plan Y ou can use any of the following methods to add a WX switch to a network plan:  Allow 3WXM to create the switch as part of RF planning.  Use the Create Wireless Switch wizar d.  Copy and paste a switch that is alr eady in the network plan.  Upload the swi[...]

162 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Creating a New WX Switch Based on a Configured Switch in the Network Plan Y ou can copy and modify a switch that is already in the network plan, by copying and pasting the switch in the Org anizer panel. 1 Select the Configuration tool bar option. 2 In the Organizer panel, select the switch you wa[...]

Adding a WX Switch to the Network Plan 163 9 T o modify the management interface, select the IP interface and VLAN fr om the VLAN/ IP dr op-down list. 10 T o modify the enable passwor d, edit the string in the Enable Password box. Use this option when you are creating a new switch in 3WXM. This option modifies the password in the network plan. Howe[...]

164 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Configuring Basic and Advanced Settings Clicking on an option in the T ask List panel opens a configuration wizard. Configuration wizards enable you to configure basic settings for an object. For most types of WX switch objects, after you configure the settings and close the wizard, the new object[...]

Using the Create Wireless Switch Wizar d 165 Deploying Changes T o d eploy all the changes, click Deploy . 3WXM compares the cha nges to the verification rules, and lists any warnings or error messages. If there are any err ors, 3WXM will not deploy the changes. T o deploy the changes, you must first resolve the errors. T o resolve configuration er[...]

166 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS  The Move button removes the ports fr om all other VLANs, and places them in the new VLAN. The ports appear in the Curr ent Members list. 10 T o tag ports in the VLAN, select T ag and edit the tag value. Use this option if you used the Add but ton instead of the Move button to place the ports i[...]

Setting Up a Switch 167 Setting Up a Switch After you create a switch, you can use the System Setup Wizard to configure the following essent ial operation and management parameters:  SNMP settings for mon itoring of the switch by 3WXM  VLANs  RADIUS servers and server groups  Wi r eless services  Auto-DAP profile settings The SNMP se[...]

168 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS  AuthRequest-UnsecuredNotify —SNMP message exchanges are authenticated but are not encrypted, and notifications are neither authenticated nor encrypted. The only security level supported for SNMPv1 and SNMPv2c is Unsecured. T o use a higher secu rity level, you must use USM (SNMPv3). b Select[...]

Setting Up a Switch 169  notify-only —The switch can use the string to send notifications.  read-write-notify —An SNMP management application using the string can get and set object values on the switch. The switch can use the string to send notifications. i Click Next . 6 Configure VLANs. VLANs that already exist, such as the default VLA[...]

170 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS  Custom Service Pr ofile—Pr ovides wir eless access based on the combination of options you choose. (Use this option only if none of the other options applies to the type of service you want to offer .) b See “Viewing and Configuring W i reless Services” on page 235 for information about [...]

Modifying Basic Switch Parameters 171  Default source IP address used in unsolicited communications such as AAA accounting reports and SNMP notifications 6 T o enable the switch to be manage d by 3WXM, select M anaged. U ntil this option is selected, you can not deploy the switch configuration you create in 3WXM to the actu al switch in the netw[...]

172 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Changing the WX Softwar e V ersion T o change the WX software version: 1 Select the Configuration tool bar option. 2 In the Organizer panel, select the WX switch. 3 In the T ask List panel, se lect Change Software V ersion. The Change Softwa r e V ersion wizard appears. 4 Select the software versi[...]

Modifying Basic Switch Parameters 173 6 Optionally , in the Offset Minutes box, select the number of minutes (between -59 to 59) to subtract from or add to UTC. 7 In the DST Name box, type the name for the summertime of fset (1 to 16 alphanumeric characters , with no spaces or tabs). 8 In the Start Month list, select the month of the year when the [...]

174 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS 6 In the Prompt box, type the CLI prompt for the WX. If you do not specify a promp t, the CLI uses the following d efault pr ompts:  WX1200> for restricted access  WX1200# for enabled access 7 In the Message of the Day box, type the message that appears before the beginning of each login [...]

Modifying Basic Switch Parameters 175 Deleting Auto DAPs 3WXM automatically updates an Au to DAP’ s infor mation in the network plan when the DAP either is co nverted into a configured MAP , or reboots and then connects to a differ ent WX. However , if an Auto DAP leaves the network without being converted into a statically configured MAP or conn[...]

176 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Launching a Web Management Session with the Switch This option is available only if the switch is runnin g and can be r eached through the network by 3WXM Services. This option also r equires the Managed option for the switch to be enabled. (See step 6 in “Modifying Basic Switch Parameters” on[...]

Viewing and Changin g Port Settings 177 3 T o specify the speed of a 10/1 00 Ethernet port, select one of the following:  Auto —Sets the port to automa tically dete ct the tr af fic speed an d set the speed accordingly . This is the default value.  10 —Sets the speed to 10 Mbps.  100 —Sets the speed to 100 Mbps. The port speed for gi[...]

178 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS b In the Organizer panel, click the pl us sign next to the WX switch. c Click the plus sign next to System. d Select Ports . 2 Select the port. 3 Click Properties . 4 Select SNMP Link T raps . 5 Click OK . Configuring a Port for a Directly Connected AP A MAP access port directly connects the WX sw[...]

Viewing and Changin g Port Settings 179 6 Click Next . The non-editable number (1 or 2) indicates the radio number on the MAP . 7 T o enable the radio, select Enabled . 8 In the Channel Number list, select the channel number for the radio . If RF Auto-T uning for channel co nfiguration is enabled, setting this value has no effect. The channel numbe[...]

180 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS 1 Access the Configure Wired Auth wizard: a Select the Configuration tool bar option. b In the Organizer panel, click the pl us sign next to the WX switch. c Click the plus sign next to System. d Select Ports . e Select the row for the port. f In the T ask List panel, select Wired Auth . 2 Select [...]

Viewing and Changin g Port Settings 181 b Specify the user glob in the Matching User Glob box. T o match on all userna mes, leave the wildcards ( **) in the box. (For synt ax information, see “Access Rules” on pa ge 238.) T o use an existing rule, le ave the rule in the list. c Click Next . d Select the EAP type:  EAP-MD5 Offload  PEAP Of[...]

182 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS T o use an existing rule, le ave the rule in the list. c Click Next . d Select the authentication and accounting method (RADUS server group or local database). (For information, see “AAA Methods (RADIUS Server Gr oups and the Local User Database)” on page 240.) e Click Next . f T o configure a[...]

Viewing and Changin g Port Settings 183 10 Create a W eb Portal authentication rule to control access to the port, or use one that has already been created. T o create a new rule: a Click Create . b Specify the user glob in the Matching User Glob box. T o match on all userna mes, leave the wildcards ( **) in the box. (For synt ax information, see ?[...]

184 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS If you select Web Portal in step 2, 3WXM automatically creates a user named web-portal-wired. Similarly , if you select Op en Access, 3WXM creates a user called last-resor t-wired. Do not delete or modify these users. (Y ou can add, modif y , or delete users at any time, even after this wizard is [...]

Viewing and Changing Port Groups 185 Creating a Port Gr oup T o create a port group: 1 In the T ask List panel, select Port Group. The Create Port Group wizard appears. 2 In the Port Group Name box, type the name of the port group (1 to 16 alphanumeric characters, with no spaces or tabs). 3 Click Next . The Port Group Selection page appears. 4 T o [...]

186 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Viewing and Changing Management Settings By default , HTTPS is enabled on th e WX, allowing you to use W eb Management on port 443 for a secure session. If you di sable HTTPS, yo u cannot use Web Management. 3WXM communications also use HTTPS, but 3WXM is not af fected by the HTTPS conf iguration [...]

Viewing and Ch anging Managem ent Settings 18 7 Y ou can specify fr om 0 to 86400 seconds (one day). The default is 3600 (one hour). If you specify 0, the idle timeout is disabled. The timeout interval is in 30-second incr ements. For example, the int erval can be 0, or 30 seconds, or 60 seconds, or 90 seconds, and so on. If you enter an interval t[...]

188 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS 3 Select the version(s) of SNMP you want th e switch to run:  V1  V2c  USM (SNMPv3) 4 See the following sections for more configuration options. Configuring an SNMP V1 or V2c Community String 1 Access the Cr eate Community wizar d: a Select the Configuration tool bar option. b In the Orga[...]

Viewing and Ch anging Managem ent Settings 18 9 Configuring a USM (SNMP V3) User 1 Access the Cr eate USM User wizar d: a Select the Configuration tool bar option. b In the Organizer panel, click the plus sign next to the WX switch. c Click the plus sign next to System. d Select Management Services . e In the T ask List panel, select USM User . 2 I[...]

190 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS b If you select Hex or IP , type the hexa decimal string or IP address in the V alu e box and click Next and go to step 5. Otherwise, click Finish . 5 Select the authentication type used to authenticat e communications with the remote SNMP engine:  None —No authentication is used. This is the[...]

Viewing and Ch anging Managem ent Settings 19 1 Configuring a Notification Pr ofile A notification profile is a named list of all the notification types that can be generat ed by a switch, and for ea ch notification type, the action to take (drop or send) when an event occurs. 1 Access the Create Notification Profile wizar d: a Select the Configura[...]

192 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS 2 Specify the target ID. 3 T ype the IP address of the target. 4 Specify the protocol port on which the target listens for SNMP notifications. The default is 162. 5 Click Next . 6 Select the notification profile that will use this target. T o view the profile’ s notification types, or to enable [...]

Viewing and Ch anging Managem ent Settings 19 3 9 Click Next .  If you selected V1 or V2C in step 7, go to step 10.  If you selected USM in step 7, go to step 12. 10 For SNMPv1 or SNMPv2c, select or cr eate the SNMP community string. If a community string with access type read-write-notify , read-notify , or notify-only is already configured,[...]

194 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS b In the Username box, type the name of the SNMPv3 user . The name can be 1 to 32 alphanumeric characters, with no spaces or tabs. c Select the access type.  read-notify —An SNMP management application using the string can get object values on the swit ch but cannot set them. The switch can u[...]

Viewing and Ch anging Managem ent Settings 19 5 b In the Retry Count box, specify the number of times the MSS SNMP engine will r esend a noti fication that has not been acknowledged by the target. Y ou can specify from 0 to 3 retries. The default is 0. 16 Click Finish . Modifying a USM User , Notification Profile, or Notification T arget 1 Select t[...]

196 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS  Authenticated —SNMP message exchange s are authenticated but are not encrypted. (This security level is the same as the authNoPriv level described in SNMPv3 RFCs.)  Encrypted —SNMP message exch anges ar e authenticate d and encrypted . (This security level is the same as the authPriv le[...]

Viewing and Ch anging Managem ent Settings 19 7 If a USM user with access type re ad-write-notify , read-notify , or notify-only is already configured, you can select it. Otherwise, you must create a new one. Y ou also can create a new USM user even if one is already configured. T o create a new USM user: a If a list of USM users is displaye d, se [...]

198 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Viewing and Setting Log and T race Settings System logs provide information about system events that you can use to monitor and troubleshoot MSS. Event messages for the WX switch and its attached MAPs can be stored or sent to the following destinations:  Stored in a local buffer on the WX  D[...]

Viewing and Setting Log and Trace Settings 199  Critical —Y ou must r esolve the critical condition. If you do not resolve the condition, the WX can reboot or shut down.  Error —The WX is missing data or unable to form a connection.  Wa r n i n g —A possible problem exists.  Notice —Events that can cause system problems have occ[...]

200 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Creating an External Log Server Y ou can specify a syslog server . Syslog facilities are identifiers that allow a syslog server to handle differ ent sysl og messages from dif ferent sour ces. Y ou can use a facility in the ra nge of Local 0 through Local 7. 1 Access the Cr eate Sy slog Server wiz [...]

Viewing and Configuring IP Services Settings 201 3 Optionally , in the Level box, specify the amount of information includ ed in the trace output (0 to 10). 0 provides the minimum amount of information and 10 proves the maximum amount of information. The default is 5. 4 Optionally , in the User Name box, type the user name to trace. Specify a user [...]

202 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Creating a Static Route The IP routing table contains routes that MSS uses for determining the interfaces for a WX switch’ s exter nal comm unications. When you a dd an IP interface to a VLAN that is up, MSS automatically adds corresponding entries to the IP routing table. For destination routes[...]

Viewing and Configuring IP Services Settings 203 Create an IP Alias Y ou can map an IP address to a name by creating an IP alias. For ex ample, if you create an IP alias carmel for IP address 10.20.30.40, yo u could type telnet carmel rather than telnet 10.20.30.40 . Y ou can use IP aliases in conjunction with DNS. If you use IP a liases and DNS is[...]

204 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS b In the Organizer panel, click the pl us sign next to the WX switch. c Click the plus sign next to System. d Select IP Servi ces . e In the T ask List panel, select DNS Server . 4 T ype the ser ver addr ess in the IP Addr ess box. 5 Select whether the server is primary or secondary . Y ou can des[...]

Viewing and Configuring IP Services Settings 205 Configuring ARP The Ad dr ess Resolution Protocol (ARP ) table maps IP addr esses to MAC addresses. ARP is enabled by defaul t on the WX and cannot be disabled. An ARP entry is added to the table in one of the following ways:  Automatically by the WX. The WX adds a local entr y for its own MAC add[...]

206 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Viewing and Configuring VLANs A virtual LAN (VLAN) is a Layer 2 broadcast domain that can span multiple wire d or wir eless LA N segments. E ach VL AN is a separate logical network, and, if you configure IP interfaces on the VLANs, MSS treats each VLAN as a separate IP subnet. Y ou configure VLANs[...]

Viewing and Configuring VLANs 207 Roaming and VLANs WX switches in a Mobility Domain contain a user’ s traffic within the VLAN the user is assigned to. For example , if you assign a user to VLAN red , the WX switches in the Mobility Domain contain the user’ s traffic within VLAN red configured on the switches. The WX switch through which a user[...]

208 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS VLAN names must be globally unique across a Mobility Domain to ensure the intended user connect ivity as de termined through authentication and authorization. Every VLAN on a WX has a VLAN name, used for aut horization purposes, and a VLAN number . VLAN numbers can vary uniquely fo r each WX and a[...]

Viewing and Configuring VLANs 209 Changing VLAN Membership A port or port group can be in one or mor e VLANs. T o be in multiple VLANs, the port or group must have an 802.1Q VLAN tag. A tag is a numeric value that identifies a virt ual port within the VLAN. The same VLAN can have differ ent tag values on dif ferent ports. However , a port can have [...]

210 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS 6 T o tag a port or port group, select the T ag checkbox. If you specify a tag va lue, 3Com recommends that you use the same value as the VLAN number . 3Com switches do not require the VLAN numbe r and tag value to be the same, but some other vend ors’ devices do. 7 T o change a tag value, chang[...]

Viewing and Configuring VLANs 211 2 In the Content panel, select the VLAN. 3 In the T ask List panel, select Configur e Spanning T ree . This wizard configures ST P features for an individual VLAN but does not configure fast convergence features, which ar e global. (Se e “Enabling STP Fast Convergence Features” on page 213.) 4 T o enable STP , [...]

212 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS  If STP is enabled on the VLAN, sp anning tree packets ar e dr opped at the port.  If STP is disabled on the VLAN, sp anning tree packets ar e forwar ded transparently thr ough the VLAN to and fr om that port. 6 In the Port Priority box, specify a priority value (0 to 255). The default is 12[...]

Viewing and Configuring VLANs 213 Enabling STP Fast Convergence Features The standard STP timers delay traffic forwar ding briefly after a topology change. The time a port takes to change from the listening state to the learning s tate or from the learning state t o the forwar ding state is called the forwarding delay . In some confi gurations, thi[...]

214 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS 2 T o switch to an alter nate port if the r oot port fails, select Enable Uplink Fast . 3 T o enable the backbo ne fast convergence featur e, select Enable Backbone Fast . 4 Click Save . Changing VLAN IGMP Settings Internet Group Management Protocol (IGMP) snooping contr ols multicast traffic on a[...]

Viewing and Configuring VLANs 215 8 In the Other Querier Present Interval box, specify how long (1 to 65,535 seconds) the WX switch waits for a general query to arrive before making itself the querier . T he defa ult interval is 255 seconds. 9 In the Query Response Interval box, specify how long (1 t o 65,535 tenths of a second) a device can take t[...]

216 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Y ou cannot add MAP po rts or wired authentication ports as static multicast ports. However , MSS can dy namically add th ese port types to the list of multicast ports based on multicast traffic. T o add or remove static multicast router and receiver ports: 1 Access the VLAN table: a Select the Co[...]

Viewing and Configuring VLANs 217 Restricting Layer 2 T raf fic Among Clients in a VLAN By default, clients within a VLAN are able to communicate with one another directly at Layer 2. Y ou can enhance network security by restricting Layer 2 forwar ding among clients in the sa me VLAN. When you restrict Layer 2 forwar ding in a VLAN, MSS allows Laye[...]

218 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Restricting Layer 3 T raffic Among Clients in a VLAN T o restrict Layer 3 traf fic among clie nts in the same VLAN, use an ACL. Y ou can configure the ACL yourself or use the Restrict L3 T raffic option in 3WXM. 1 Access the VLAN table: a Select the Configuration tool bar option. b In the Organize[...]

Viewing and Configuring VLANs 219 c Click the plus sign next to System. d Select VLANs . 2 In the T unnel Affinity box, specify the numeric value (1 to 10) that the WX will advertise to other WX swit ches in the Mobility Domain for the VLAN. The default is 5. A higher tunnel af finity indicates a greater pr efer ence. 3 Click Save . Configuring the[...]

220 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS By default, all addresses except the host address of the VLAN, the network broadcast addr ess, and the subnet broadcast address ar e included in the range. If you specify th e range, the start address must be lower than the stop address, and a ll addresses must be in the same subnet. The IP inter [...]

Viewing and Configuring ACLs 221 Y ou can choose to count the number of times an ACE is matched. This hit count is useful for troubleshooting complex ACL configurations and for monitoring traffic load for specific network appl ications or pr otocols. The hit count can o nly be seen fr om the CLI. T o start updating hit counter statistics in the CLI[...]

222 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS T o configure an ACL 1 Access the Cr eate ACL wizar d: a Select the Configuration tool bar option. b In the Organizer panel, click the pl us sign next to the WX switch. c Click the plus sign next to System. d Select ACLs . e In the T ask List panel, select ACL. 2 In the ACL Name box, type the name[...]

Viewing and Configuring ACLs 223 b Select the well-known name of the pr otocol from the Pr otocol Name dr op-down li st. If the pr otoc ol’ s name is no t liste d, select Other to activate the Protocol Number box, then type or select the number . c Click OK . d If you selected tcp or udp , go to step 7. Othe rwise, go to step 9. T o match on all [...]

224 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS  Not Equal  Range  None (no comparison is required) c Select the well-known port n ame fr om the Port Name drop-down list. If the name is not in th e list, select Other and type or select the port number in the Port Number box. d If you selected Range as the comparison operator , type or [...]

Viewing and Configuring ACLs 225  0 (normal) —Packets with normal TOS defined ar e filter ed.  1 (minimum monetary cost) —Packets with mi nimu m monetary cost TOS defined are filtered.  2 (maximum reliability) —Packets with maximum r eliability TOS defined are filter ed.  4 (maximum throughput )—Packets with maximum throughput T[...]

226 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Configuring Advanced ACL Settings After you configure an ACL, you ca n configure the following advanced settings:  Hit counter (enable or disable)  Hit sample rate (applies if the hit counter is enabled)  Established option, to apply a ne w TCP ACE only to established (existing) TCP sessi[...]

Viewing and Configuring ACLs 227 T o enable the established option for TCP ACEs By default, a new TCP ACE applies to new sessions a s well as esta blished (existing) sessions. T o apply the ACE only to established sessions, enable the established option. 1 Select the TCP ACE in the ACL table. 2 In the T ask List panel, select Enable Established Con[...]

228 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS Adding a New ACE to a Configur ed ACL T o add a new ACE to a config ur ed ACL: 1 Access the ACL table: a Select the Configuration tool bar option. b In the Organizer panel, click the pl us sign next to the WX switch. c Click the plus sign next to System. d Select ACLs. 2 Select any ACE in the ACL [...]

Viewing and Configuring ACLs 229 4 Select the mapping type:  T o map to a physical port, select port and go to step 5.  T o map to a virtual port, select vport and go to step 6.  T o map to a VLAN, select vlan and go to step 7.  T o map to a Distributed MAP , select dap and go to step 8. 5 T o map an ACL to a port: a In the Port list, s[...]

230 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS b In the Dire ction list, select In to filter incoming packets or Out to filter outgoing packets. 9 Click Finish . The mapping app ears in the ACL Mappings table. Deleting an ACL To d e l e t e a n A C L : 1 Access the ACL table: a Select the Configuration tool bar option. b In the Organizer panel[...]

Viewing and Changing CoS Mappings 231 Viewing and Changing CoS Mappings MSS supports Layer 2 and Layer 3 classifi cation and marking of traffic, to help provide end-to-end QoS throughout the network. QoS support includes support of Wi-Fi Multimedia (WMM), which provides wir eless QoS for time-sensitive applications such as voice and video. QoS supp[...]

232 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS The QoS mappings app ear in the Content panel. The DSCP to CoS table lists the internal CoS values to wh ich MSS maps DSCP values during classification of ingress traf fic. Th e CoS to DSCP table lists the DSCP values to which MSS maps internal CoS values during marking of egress traffic. Changi n[...]

Viewing and Changing CoS Mappings 233 Setting a Range of DSCP V alues to a Single CoS V alue T o set a range of DSCP values to a single CoS value: 1 Access the QoS tabl es: a Select the Configuration tool bar option. b In the Organizer panel, click the plus sign next to the WX switch. c Click the plus sign next to System. d Select QoS . 2 In the T [...]

234 C HAPTER 6: C ONFIGURING WX S YSTEM P ARAMETERS[...]

7 C ONFIGURING W IR ELESS P ARAMETERS This chapter describes how to view and configure the following wireless parameters for WX switches:  Service Set Identifiers (SSIDs), which ar e managed by servi ce pr ofiles  Radio profiles, which assign IEEE 802 .11 set tings and a ser vice pr ofile to radios  Auto-DAP pr ofile  MAPs  MAP radio[...]

236 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Wire less Service Parameters A wir eless service consists of the following parameters:  Service profile  Access rules Service Profiles A service profile configur es an SSID . T able 18 lists the parameters. For parameters that are assigned default va lues by the wizar ds, the table also lists[...]

Viewing and Co nfiguring Wireless Services 237 Custom Web Portal login page Subdire ctory path and filename of an HTML page customized for login to the SSID Blank (default page with 3Com logo is used) Security modes For encrypted SSIDs only , the types of encryption supported:  Robust Security Network (RSN); also called WPA2  Wi-Fi Protected [...]

238 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Y ou don’t need to select the values for all these parameters when you configure a service. The Service Profile wizar ds help you configure the essential parameters and assign approp riate values to the rest. Some of the parameters that 3WXM automat ically sets ar e not configurable using the Ser[...]

Viewing and Co nfiguring Wireless Services 239  For Windo ws domain clients using Pr otected E AP (PEAP), the user glob is in the format Wi ndows_domain_nameusername . The W indows domain name is the NetBIOS domain name and must be specified in capital letters. For example, EXAMPL Esydney , or EXAM PLE*.*, which specifies all user names whos [...]

240 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS  Uses challenge-response to compare hashes.  Provides no encryption or integrit y checking for the connection. The EAP-MD5 option does not wo rk with Microsoft wired authentication clients.  PEAP Offload— Pr otected EAP with Micros oft Challenge Handshake Authentication Protocol V ersion[...]

Viewing and Co nfiguring Wireless Services 241  If you specify a RADIUS server gro up as the first method and a user is denied access by the RADIUS se rver , n o authentication and authorization are attempted with the other methods specified in the list.  If you specify LOCAL as the first meth od and a user is not in t he local user database [...]

242 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Configuring an 802.1X Wireless Service The 802.1X Service Profile wizard re quires you to select one or more RADIUS server groups and does not allow you to complete the configuration without selecting one. T o be available for selection in the wizard, a RADIUS server group must alr eady be configur[...]

Viewing and Co nfiguring Wireless Services 243 10 Select the EAP type:  EAP-MD5 Offload  PEAP Offload  Local EAP-TLS  External RA DIUS Server If you select PEAP , the EAP Sub-Protocol is MS-CHAPV2. For other protocols, the EAP S ub-Protocol is None. (For information, see “EAP T ype (802.1X Only)” on page 239.) 11 Specify the authent[...]

244 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS If you have not planned RF coverage or configured any MAPs in the network plan yet, no radios are lis ted. Y ou can add the radi os later . (Select the radio profile, click Properties , then select Radi o Selection. See “Configuring Advanced Radio Profile Settings” on page 265.) d Go to step 15[...]

Viewing and Co nfiguring Wireless Services 245 The next step depends on the encryption type you selected in step 5:  If you selected Encrypted , go to step 8.  If you selected Clear , go to step 18. 8 Select the access type:  802.1X Access—Device is allowed onto the SSID only after successful authentication using 802.1X.  MAC Access?[...]

246 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS  By default, data in unicast and mu lticast packets are encrypted using WEP key 1. T o use another key for either type o f packet, select the key number in the WEP Unicast Key Index or WEP Multicast Key Index box. 17 Click Next . 18 Select or type the name of the VLAN into which you want the swi[...]

Viewing and Co nfiguring Wireless Services 247  T o create a new radio pr ofile: a Select Create new Radio Pr ofile and click Next . b T ype the radio profile name in the Name box and click Next . c Select the radios yo u want to ma nage with t he radio pro file and cl ick Move to move them to the Current Members list. If you have not planned RF[...]

248 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS  If you selected Clear in step 5, go to step 15. 7 Select the security modes you want th e SSID to support. Y ou can select one or more of the following:  RSN (WP A2)  WP A  Static WEP 8 Click Next . 9 If you selected RSN or WP A in step 7, you can select whether to use dynamically gene[...]

Viewing and Co nfiguring Wireless Services 249 16 Click Next . The ACEs (ACL rules) that 3WXM will configure for the W eb-Portal service are listed. The ACEs are requir ed to allow DHCP traffic while blocking all other traffic while a user is being authenticated. These ACEs are used only during authentication. After the user is authenticated, the A[...]

250 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS (Y ou can add, modif y , or delete users at any time, even after this wizard is closed. See “Cr eating and Managing Users in the Local User Database” on page 287.) 20 Select or create the radio pr ofil e to map to this service profile. By default, the default radio pr ofile is selected.  T o[...]

Viewing and Co nfiguring Wireless Services 251 5 Select the SSID type fr om the SSID T ype drop-down list:  Encrypted —T raffic on the SSID is encrypted.  Clear—T raffic on the SSID is unencrypted. 6 Click Next .  If you selected Encrypted in step 5, configure the encryption settings. Go to step 7.  If you selected Clear in step 5, [...]

252 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS 14 Click Next . 15 Select the VLAN into which you want the switch to place users of the SSID. If you want to specify the VLAN late r when configuring the access rules, you can leave the VLAN Name box blank. 16 Select or create the radio pr ofil e to map to this service profile. By default, the defa[...]

Viewing and Co nfiguring Wireless Services 253 Modifying Service Profile Settings Y ou can modify the following service profile settings in the Wireless Service Pr ofiles tabl e itself:  SSID name  SSID type (encrypted or clear)  Beacon state (advertisement of the SSID)  Radio profile (maps MAP radios to the service pr ofile) T o view o[...]

254 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Static WEP T ab All of the settings on the Static WEP tab are explained in the sections on the service profile wizar ds. Authorization Attributes T ab The Authorization Attributes tab lists the default authorization attributes for the SSID. When a user is authorized for the SSID, the switch applies[...]

Viewing and Co nfiguring Wireless Services 255 Radio Profile Selection T ab The Radio Profile Select ion tab list the radio profiles mapped to the service profiles. Service pr ofile wiza r ds map the service profiles to the default radio profile by default. T o map another radio pr ofile to the service profile, select the radio profile in the A vai[...]

256 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS  Long Retry Count—Number of times (1 to 15) the MAP transmits an unacknowledged unicast frame that is equal to or longer than the fragment threshold befor e discarding the frame. The default is 5. Client Timeout T ab The Client T imeout tab lists sett ings for client session timer s:  User [...]

Viewing and Co nfiguring Wireless Services 257  Multicast rate—Data rate at which the radio sends multicast frames. The valid rates depen d on the radio type and are the same as the mandatory rates. The default is Au tomatic, which sets the multicast rate to the highest rate that can reach all clients connected to the radio.  Mandatory rate[...]

258 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS SODA T ab The SODA tab has settings fo r the Sy gate On-Demand (SODA) fea ture. SODA is an endpoint security solution that allows enterprises to enforce security policies on client devices without having to install any special software on the client machines. WX switches can be configured to run SO[...]

Viewing and Co nfiguring Wireless Services 259 b Click on the plus sign next to W ir eless. c Select W ir eless Services. 2 Select the service profile in the table. A set of tasks appears under Se tup in the T ask List panel. 3 T o display encryp tion settings and access rules, select one of the following the T a sk List panel:  802.1X Access ?[...]

260 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Modifying SSID Encryption Settings and Access Rules Y ou can create access rules for a service profile from within a service profile wizar d. Y o u also can create or modify a service profile’ s access rules after cr eating the service profile. 1 Display the Wireless Service Profil es table: a In[...]

Viewing and Co nfiguring Wireless Services 261 5 Select the encryption algorithms to use:  AES (CCMP)—Usually used with R SN (WP A2)  TKIP—Usually used with WP A  WEP-104—Use d with dynamic WEP  WEP-40—Used with dynamic WEP 6 Click Next . 7 If you selected Static WEP , spe cify WEP keys.  For each key (up to four), type the k[...]

262 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Do not change the deny rule at the bottom of the ACL. This rule must be present and the capture option must be used with the rule. If the rule does not have the capture option, the Web Portal user never receives a login page. 11 T o modify access rules, click Next and go to “Modifying Access Rule[...]

Viewing and Configuring R adio Profiles 263 Viewing and Configuring Radio Profiles A radio profile is a set of attributes that you can apply to multiple radios . A default radio profile named de fault is provided and cannot be deleted. Rather than configuring each radio individually , yo u can cr eate a new radio profile and apply it to multiple ra[...]

264 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Creating a Radio Profile T o create a radio pr ofile: 1 Access the Create Radio Pr ofile wizard: a Select the Configuration tool bar option. b In the Organizer panel, click the pl us sign next to the WX switch. c Click the plus sign next to W ir eless. d Select Radio Profiles . e In the T ask List [...]

Viewing and Configuring R adio Profiles 265 5 Click Reset T o Default . 6 Click OK . Configuring Advanced Radio Profile Settings After you configure a radio pr ofile, y ou can select the radio profile, and click Properties to display a configuration wizard that contains all th e configurable parameters for the radio profile. A dialog with the follo[...]

266 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS CAUTION: Countermeasures affect wirele ss ser vice on a radio. When a MAP radio is sending countermeasures, the radio is disabled for use by network traffic, until the radio fini shes sending the countermeasures.  Configured—Causes radios to atta ck only devices specified in the attack list on[...]

Viewing and Configuring R adio Profiles 267 Auto T une T ab The Auto T une tab lists s ettings for RF Auto-T uning:  T une Channel—Automatically configures and tunes the channel. This featur e is enabled by default. RF Auto-T uning of channels on 802.11a radios uses only the bot tom eight channels in the band (36, 40, 44, 48, 52, 56, 60, and 6[...]

268 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS At the end of each power -backoff int erval, radi os that tempora rily increased their power r educe it by 1 dBm. The power backoff continues in 1 dBm increments afte r each interval until the power returns to expected setting. Y ou can specify from 0 to 65535 seconds. The default is 10 seconds. Se[...]

Viewing and Changing th e Auto-DAP Profile 269 V oice Configuration T ab The V oice Conf iguration tab lists settings for V oIP services:  QoS Mode—Classification and marking of high priority traffic on the WX and MAP:  WMM—Classifies, marks, and forwards traffic for Wi-Fi Multimedia (WMM) devices base d on 802.1p and DSCP values.  SVP[...]

270 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Changing Auto-DAP Profile Settings T o change settings for a switch’ s Auto-DAP profile: 1 T o enable the Auto -D AP pr ofile, select Enabled . 2 T o select the radio type , click th e MAP Radio T ype box and select the radio type from the list:  11a —802.11a  11b —802.11b only  11g [...]

Viewing and Changing th e Auto-DAP Profile 271 6 In the Enable Firmwa re Update list, select Ye s to automatically upgrade MAP boot firmwar e. The upgrade versio n of the firmware is loaded fr om a WX when the MAP is booting. Select No to disable automatic firmware upgrading. Automatic firmware upgrading is enabled by default. 7 T o enable an indiv[...]

272 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Converting Auto DAPs into Statically Configured DAPs See “Converting Auto DAPs into Stat ically Configured APs” on page 67. Deleting Auto DAPs See “Deleting Auto DAPs” on page 175. Viewing and Configuring MAPs MAPs contain radios that provid e networking between your wir ed network and IEEE[...]

Viewing and Configuring MAPs 273 Viewing the Configured MAPs T o view the configur ed MAPs: 1 Select the Configuration tool bar option. 2 In the Organizer panel, click the plus sign next to the WX switch. 3 Click the plus sign next to W ir eless. 4 Select Access Poi nts . The MAPs that are configured on the WX switch appear in the Content panel. Th[...]

274 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS d Select Access Poi nts . e In the T ask List panel, select Distributed AP . 2 In the Name box, type a name (1 to 16 alphanumeric characters, with no spaces or tabs). 3 In the DAP Number box, specify the connection number for the WX switch’ s connection to this Dist ributed MAP . The rang e of va[...]

Viewing and Configuring MAPs 275 b In the Radio Profile list, select the profile to which the radio belongs. (For more information, see “Viewing and Configuring Radio Profiles” on page 263.) c In the Channel Number list, select the channel number for the radio . If RF Auto-T uning for channel co nfiguration is enabled, setting this value has no[...]

276 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS T o configure a directly connected MAP 1 Access the Cr eate Dire ct-Connect AP wizard: a Select the Configuration tool bar option. b In the Organizer panel, click the pl us sign next to the WX switch. c Click the plus sign next to W ir eless. d Select Access Poi nts . 2 In the T ask List panel, sel[...]

Viewing and Configuring MAPs 277 c In the Channel Number list, select the channel number for the radio . If RF Auto-T uning for channel co nfiguration is enabled, setting this value has no effect. The channel number is controlled by RF Auto-T uning. d In the T ransmit Power box, specif y the transmit power for the radio. If RF Auto-T uning for powe[...]

278 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS c Click the plus sign next to W ir eless. d Select Access Poi nts . 2 Select the MAP you want to modify and click Pr operti es . 3 T o select the radio type for a singl e-radio model, c lick the MAP Radio T ype box and select th e radio type fr om the list:  11a —802.11a  11b —802.11b onl[...]

Viewing and Configuring MAPs 279 8 T o configure settings for a radio, click 802.11g Radio or 802.11a Radio . a T o enable the radio, select Enabled . b If the MAP model supports exte rnal antennas, select the external antenna model from the Antenna T ype box. c T o indicate the direction of the antenna’ s coverage, change the value in the Dir ec[...]

280 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS a T o change the maximu m power level RF Auto -T uning can assig n to the radio, select the power lev el fro m the Max. T ransmit Power pull-down list. The default power level is defaul t, which means RF Auto-T uning can assign up to the maximum power level allowed for the radio. Y ou can specify f[...]

Viewing and Ch anging Radio Settings 281 Viewing and Changing Radio Settings Y ou can configure MAP radio settings when you configur e the MAPs. Y ou also can view or change radio settings after the MAPs ar e configured. Viewing Radio Settings T o view radio settin gs: 1 Select the Configuration tool bar option. 2 In the Organizer panel, click the [...]

282 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Viewing and Changing RF Detection Settings This section contains procedures fo r configuring RF detection on an individual switch. For an overview of RF detection and for specific information about the con figuration options, see “Configuring W ireless Parameters” on page 235. The tasks availab[...]

Viewing and Changing RF Detection Settings 283 4 Select the vendor from the V endor dr op-down list. 5 Select the specific OUIs you want to allow for the selected vendor . Go to step 9. If the vendor or OUI is not listed, click Cancel , then select Permitted OUI Entry in the T ask List panel. Go to step 6. 6 Edit the OUI in the V endor OUI box. 7 S[...]

284 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS Adding an Entry to the Rogue List T o add an entry to the Rogue list: 1 Access the RF detection settings: a Select the Configuration tool bar option. b In the Organizer panel, click the pl us sign next to the WX switch. c Click the plus sign next to W ir eless. d Select RF Detection . 2 Edit the MA[...]

Viewing and Changing RF Detection Settings 285 A rogue is a device that is in the 3Com network but does not belong there. An interfering device is not part of the 3Com network but also is not a rogue. MSS classifies a device as an interfer ing device if no client connected to the device has been detected communicating with any network entity listed[...]

286 C HAPTER 7: C ONFIGURING W IRELESS P ARAMETERS[...]

8 C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETERS This chapter describes how to view and configure the following Authentication, Authorization, and Accou nting (AAA) parameters for WX switches:  Local database entries for AAA processing of administrator and network client access  RADIUS servers, for backend AAA pro[...]

288 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S Y ou can create two types of users in the local database:  Named users — These users are authenticated by user name and password and ar e assigned to sp ecific VLANs. Users include administrators and net work users. Y ou can group these users by creati[...]

Creating and Manag ing Users in the Loc al User Database 28 9 Creating a Named User T o create a named user: 1 Access the Cr eate Named User wizar d: a Select the Configuration tool bar option. b In the Organizer panel, click the plus sign next to the WX switch. c Click the plus sign next to AAA. d Select Local User Database . e In the T ask List p[...]

290 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S 9 Repeat step 5 through step 7 for each attribute value you want to change. 10 Click Finish . Creating a User Group and Assig ning Users T o It T o create a user gr oup and assign users to it: 1 Access the Cr eate Named User Gr oup wizard : a Select the Con[...]

Creating and Manag ing Users in the Loc al User Database 29 1 Creating a MAC User T o create a MAC user: 1 When creating MAC addr ess users, you configure authe ntication Access the Cr eate MAC User wiz ard: a Select the Configuration tool bar option. b In the Organizer panel, click the plus sign next to the WX switch. c Click the plus sign next to[...]

292 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S Creating a MAC User Group and Assig ning Users T o It T o create a MAC user gr oup and assign users to it: 1 Access the Cr eate MAC User Gr oup wizar d: a Select the Configuration tool bar option. b In the Organizer panel, click the pl us sign next to the W[...]

Creating and Manag ing Users in the Loc al User Database 29 3 Authorization Attributes Authorization attributes can be assigne d to users in the local database or on remote servers. The attributes, which include access control list (ACL) filters, VLAN membership , encryption type, session time-out p eriod, and other session characteristics, let you[...]

294 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S filter -id (network access mode only) Inbound or ou tbound ACL to apply to the user . If configured in the WX switch’ s local database, this attribute can be an access control list (ACL) to filter outbound or inbou nd traf fic. Use the following format: i[...]

Creating and Manag ing Users in the Loc al User Database 29 5 service-type T ype of access the user is requesting. Access type, which can be one of the following:  2—Framed; for network user access  6—Administrative; for administrative access, with authorization to access the enabled (configuration) mode. The user must enter the enable co[...]

296 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S start-date Date and time at which the user becomes eligible to access the network. MSS does not authenticate the user unless the attempt to access the network occurs at or after the specified date and time, but before the end-date (if specified). Date and t[...]

Creating and Manag ing Users in the Loc al User Database 29 7 time-of-day (network access mode only) Day(s) and time(s) during which the user is permitted to log into the network. After authorization, the user’ s session can last until either the Time-Of-Day range or the Session-Timeout duration (if set) expires, whichever is shorter . Time-Of-Da[...]

298 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S Viewing and Configuring RADIUS Settings Remote Authentication Dial-In User Se rvice (RADIUS) is a client-serve r security protocol that pr ovides authentication, authorization, and accounting for network users and device s. A RADIUS server stor es user prof[...]

Viewing and Configuring RADIUS Settings 299 Viewing RADIUS Settings, Servers, and Server Gr oups T o view RADIUS settings, servers, and server groups: 1 Select the Configuration tool bar option. 2 In the Organizer panel, click the plus sign next to the WX switch. 3 Click the plus sign next to AAA. 4 Select RADIUS . The RADIUS servers, server grou p[...]

300 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S 8 In the Timeou t box, specify how long (1 to 65,535 seconds) the WX switch must wait for a RADIUS serv er to respond before r etransmitting. The default is 5 seconds. 9 In the Retry Count box, specify how many retransmissions (1 to 100) ar e sent for a RAD[...]

Viewing and Configuring RADIUS Settings 301 d Select RADIUS . e In the T ask List panel, select RADIUS Server Group . 2 In the Name box, type the name of the RADIUS server gr oup (1 to 32 alphanumeric characters, with no spaces or tabs). Do not use the same name for a RADIUS serv er and a server group. 3 Click Next . 4 T o enable load balancing in [...]

302 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S  Authorizat ion passwor d  Use of the WX switch’ s system IP address as the source address for RADIUS packets fr om the switch When you create a new RADIUS server , the default settings ap ply to the new server . T o change default value s for RADIU[...]

Viewing and Configuring Global 802.1X Settings 30 3 Providing an authorization password is r equired only for users whose devices are authenticated by their MAC addresses or for last-resort users, neither of which have a regular us ername or password. The default authorization password is 3Com . Changing the password applies both to MAC users and t[...]

304 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S 2 T o enable 802.1X authentication for all wired authentication ports on the WX switch, select System Authentication Control . T o disable 802.1X authentication for al l wir ed authentication ports, clear System Authentication Control . By default, 802.1X a[...]

Viewing and Configuring Global 802.1X Settings 30 5 9 T o enable reauthentication of 802.1 X clients, select Reauthentication . T o disable reauthentication, clear Reauthentication . By default , reauthentication is enabled. 10 T o specify the number of reauthentication requests the WX switch attempts before a client becomes unauthorized, specify t[...]

306 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S Viewing and Configuring 802.1X Network Access Rules This section describes how to view and configur e 802.1X rules for user network access. T o configure other types of network access rules, see the following:  “Viewing and Configurin g MAC Network Acc[...]

Viewing and Con figuring 802.1X Network Access Rules 307 2 Specify whether the rule is for wire less access to an SSID or access through a wired authentication port:  If the rule is for access to an SSID, do one of the following:  T o match on any SSID name, leave the value any in the SSID box.  T o match only on a specific SSID na me, sel[...]

308 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S The EAP-MD5 option does not wo rk with Microsoft wired authentication clients.  PEAP— Protected EAP with Micr osoft Challenge Handshake Authentication Protocol V ersion 2 (MS-CHAP-V2). Select this protocol for wireless clients.  Uses TLS for encrypt[...]

Viewing and Con figuring 802.1X Network Access Rules 309  If you specify a RADIUS server gro up as the first method and a user is denied access by the RADIUS se rver , n o authentication and authorization are attempted with the other methods specified in the list.  If you specify LOCAL as the first meth od and a user is not in t he local user[...]

310 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S Viewing and Configuring MAC Network Access Rules MAC network access rules allow user s onto the network by authenticating their MAC addresse s instead of t heir user names. During log on, if the user name does not match an 802.1X authentication rule, but th[...]

Viewing and Configuring MAC Network Access Rules 311 2 Specify whether the rule is for wire less access to an SSID or access through a wired authentication port:  If the rule is for access to an SSID, do one of the following:  T o match on any SSID name, leave the value any in the SSID box.  T o match only on a specific SSID na me, select [...]

312 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S MSS tries the methods in the order th ey appear in the Curr ent RADIUS Server Groups list. T o reorder the methods, select a method and click Up or Down .  If you specify a RADIUS server group as the first method and a user is denied access by the RADIUS[...]

Viewing and Configuring WebAAA Network Access Rules 313 Viewing and Configuring WebAAA Network Access Rules Web AAA allows network users to access t he network by logging on a web page. When a user attempts to access a we b page over the network, the WX switch intercepts the HTTP or HTTPS request and serves a login W eb page to the user . The user [...]

314 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S Creating a W eb AAA Network Access Rule T o create a W eb AAA network access rule: 1 Access the Cr eate MAC Network Access wizar d: a Select the Configuration tool bar option. b In the Organizer panel, click the pl us sign next to the WX switch. c Click the[...]

Viewing and Configuring WebAAA Network Access Rules 315 For EAP with T ransport Layer Security (EAP -TLS) clients, the format is username @ domain_name . For example, sydney@example.com specifies the user sydney in the domain name example.com. Th e *@marketing.exampl e.com glob specifies all users in the marketing department at example.com. The use[...]

316 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S 10 Select the accounting method(s) in the A vailable RADIUS Server Groups list and click Add . The options and processing are the same as those for authentication methods. (See step 6.) 11 Click Finish . Viewing and Configuring Last-Resort Network Access Ru[...]

Viewing and Configuring Last-Resort Network Access Rul es 317 2 Specify whether the rule is for wire less access to an SSID or access through a wired authentication port:  If the rule is for access to an SSID, do one of the following:  T o match on any SSID name, leave the value any in the SSID box.  T o match only on a specific SSID na me[...]

318 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S 7 T o enable this accounting rule for the SSID, select Enab led . By default, accounting rules you configur e in 3WXM are disabled, which means 3WXM does not add the rules to the switch’ s configuration. 8 Select one of the following recor d options:  [...]

Viewing and Configuri ng WX Administrator Access Rules 319 Creating an Access Rule for Console Access T o create an access rule for console access: 1 Access the Create Console Admin User wizard: a Select the Configuration tool bar option. b In the Organizer panel, click the plus sign next to the WX switch. c Click the plus sign next to AAA. d Selec[...]

320 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S 7 T o enable this accounting rule for the SSID, select Enab led . By default, accounting rules you configur e in 3WXM are disabled, which means 3WXM does not add the rules to the switch’ s configuration. 8 Select one of the following recor d options:  [...]

Viewing and Configuri ng WX Administrator Access Rules 321 MSS tries the methods in the order th ey appear in the Curr ent RADIUS Server Groups list. T o reorder the methods, select a method and click Up or Down .  If you specify a RADIUS server gro up as the first method and a user is denied access by the RADIUS se rver , n o authentication and[...]

322 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S Viewing and Configuring AAA Support for Thir d-Party AP Users A WX switch can pr ovide network ac cess for users associated with a third-party AP that has authentica ted the users with RADIUS. Y ou can connect a third-party AP to a WX switch and configure t[...]

Viewing and Configuring AAA Support for Third-Party AP Users 323 For the userglob, type a full or pa rtial user name to be matched during authentication (1 to 80 a lphanumeric characters, with no spaces or tabs). The format of a user glob depends on the client type and EAP method.  For Windo ws domain clients using Pr otected E AP (PEAP), the us[...]

324 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S Configuring a RADIUS Proxy for a Client T o configure a RADIUS pr oxy for a client: 1 Access the Create RADIUS Pr oxy Client wizar d: a Select the Configuration tool bar option. b In the Organizer panel, click the pl us sign next to the WX switch. c Click t[...]

Viewing and Changing Location Policy Rul es 325 Viewing and Changing Location Policy Rules During the login process, the AAA authorization pr ocess is started immediately after clients are authenticated to use the WX switch. During authorization, MSS assigns the user to a VLAN and app lies optional user attributes, such as a session timeout value a[...]

326 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S Creating a Location Policy Rule T o create a location policy rule: 1 Access the Cr eate Location Rule wizard: a Select the Configuration tool bar option. b In the Organizer panel, click the pl us sign next to the WX switch. c Click the plus sign next to AAA[...]

Viewing and Changing Location Policy Rul es 327 9 Select the Distributed MAPs for whic h the location policy is applied and click Add . 10 Click Next . 11 In the Action list, select one of the following:  Permit —Allows access if the conditions in the location policy rule are matched. If you select Permit , you must specify at least one of fol[...]

328 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S Viewing and Changing Mobility Profiles Mobility Profile™ attributes allow or deny access to the network for a specific user or gr oup of users. Wh en you create a Mobility Pr ofile, you specify which MAP ports, Distributed MAPs, or wired authentication po[...]

Viewing and Changing Mobility Profil es 329 4 In the Ports drop-down list, select th e ports to include in the Mobility Profile:  All —Include all MAP or wir ed authent ication po rts.  Selected —Include a selected list of ports.  None —Include no ports. If you select Selected , select the individual ports in the A vailable Physical [...]

330 C HAPTER 8: C ONFIGURING A UTHENTICATION , A UTHORIZATION , AND A CCOUNTING P ARAMETER S[...]

9 C ONFIGURING WX S WITCHES R EMOTELY Y ou can use 3WXM Services running in your corporate networ k to configure WX switches in r emote offices. The following remote configuration scenarios are supported:  Drop ship—3WXM Services running in the corporate network can configure a WXR100 switch shipped directly to a remote office. This option doe[...]

332 C HAPTER 9: C ONFIGURING WX S WITCHES R EMOTELY How Remote WX Configuration Wor ks Drop Ship (WXR100 Only) 1 The WXR100 is shipped directly to the remote office where it will be deployed. 2 The network administrato r at the corporate office pr econfigures the switch in a 3WXM network plan. The switch configuration must have a name for the switc[...]

How Remote WX Configuration Works 33 3 Figure 9 shows the location of the Fn switch and the LED. Figure 9 Fn Switch on WXR100 5 Because the Fn switch was pr essed while the switch was starting, the WXR100 configures the following item s, to enable itself to contact 3WXM Services:  Ports 1 and 2 in the default VLAN (VLAN 1)  DHCP client on VLA[...]

334 C HAPTER 9: C ONFIGURING WX S WITCHES R EMOTELY  If the serial number does not matc h and the Auto-Config IP Subnet Matching option is disabled, 3WXM cannot give the switch a configuration. 3WXM generates a verification warning (on the Network V erification tab). The war ning lists the switch’ s serial number and IP address. The networ k a[...]

3WXM Requirements 33 5 8 3WXM receives the configuration request, and looks in the currently open network plan for a switch conf iguration with the same model and serial number as the one in the configuratio n r equest.  If the network plan contains a configuration with a matching mo del and serial number , 3WXM sends the configuration to the sw[...]

336 C HAPTER 9: C ONFIGURING WX S WITCHES R EMOTELY Staging a WX Switch for Configuration by 3WXM The auto-config op tion must be enabled on a WX switch in order for the switch to try to contact 3WXM Services for configuration. The auto-config option is automatically enabled on an unconfigured WXR100 when the Fn switch is pr essed during power on. [...]

Staging a WX Switch for Configuration by 3WXM 337 3 Enable the auto-config option: WX1200# set auto-config enable success: change accepted. 4 Save the configuration changes: WX1200# save config success: configuration saved. 5 Power of f or r estart the switch. Example 2: Deployment Site Has No DHCP and No DNS The deployment site in this example doe[...]

338 C HAPTER 9: C ONFIGURING WX S WITCHES R EMOTELY Example 3: Deployment Site Has DNS But No DHCP The deployment site in th is exampl e does not have a DHCP server but does have a local DNS server . The conf iguration is similar to Example 1, but includes DNS configuration info rmation instead of an IP alias. 1 Configure a VLAN: WX1200# set vlan 1[...]

Staging a WX Switch for Configuration by 3WXM 339 Example 4: Deployment Site Has DHCP But Local DNS Domain Differs From Corporate DNS Domain The deployment site in this example has a DHCP server , so the switch’ s DHCP client is enabled. Static IP address and de fault gateway information are not r equir ed. The site also has a local DNS server . [...]

340 C HAPTER 9: C ONFIGURING WX S WITCHES R EMOTELY 8 Save the configuration changes: WX4400# save config success: configuration saved. 9 Power of f or r estart the switch. Preconfiguring a Switch in 3WXM If you know the switch’ s serial number , use the following procedure to set up the switch’ s co nfiguratio n in 3WXM. 1 Start 3WXM Se rvices[...]

Preconfiguring a Switch in 3WXM 341 14 Click Finish to save the switch configuration and close the wizar d. Leave 3WXM Services running, with the network plan open. When the switch is powered on at the r emote site (and the Fn switch is pressed, if a WXR100), the switch contacts 3WXM Se rvices to r equest a configuration. Uploading a Partially Conf[...]

342 C HAPTER 9: C ONFIGURING WX S WITCHES R EMOTELY 13 Click on a resolution to correct the error or warning conditio n. 14 Select the Devices option on the 3WXM tool bar . 15 Select the switch . 16 In the T ask List panel, select Deploy . Replacing a Switch and Reusing its Configuration If a remote switch that is configur ed by 3WXM fails, you can[...]

Replacing a Switch and Reusing its Configuration 343 How Switch Replacement Works 1 A network administrator enables the Auto-Config IP Subnet Matching option in 3WXM. (This option is on t he 3WXM Services Setup dialog.) 2 Someone at the remote of fice physically unplugs the failed switch and plugs in a new , unconfigured switch or a pr e-staged swi[...]

344 C HAPTER 9: C ONFIGURING WX S WITCHES R EMOTELY Replacing a Switch This task is performed by someone at the remote of fice and does not re quir e a netw ork administ rator . 3Com recommends that you read through the entir e procedur e before beginning. T o replace a switch 1 Remove the power cord from the old switch. 2 Unplug the network cables[...]

10 M ANAGING WX S YSTEM I MAGES AND C ONFIGURATIONS This chapter describes the management of WX system files. It includes information about uploading a WX switch configuration into 3WXM, verifying configuration informat ion, synchronizing lo cal and network changes, deploying WX switches from a network plan to the network, distributing image and co[...]

346 C HAPTER 10: M ANAGING WX S YSTEM I MAGES AND C ONFIGURATIONS Devices T a b The Devices tab allows you to manage configuration changes for WX switches in the network plan. T o access the Devices tab, do one of the following:  Select the Devices tool bar option.  In the Alerts panel, click on Lo cal Changes or Network Changes. The managed [...]

Devices Tab 347 T ask List Options The T ask List panel in the De vi ces tab has the following pages:  Change Management  Device Operations T able 24 lists the tasks you ca n select on the Devices tab. T able 24 Devices T asks Task Option Task Group Task Descrip tion Change Management Local Changes Review Display the configuration changes tha[...]

348 C HAPTER 10: M ANAGING WX S YSTEM I MAGES AND C ONFIGURATIONS Other Upload WX Add a WX switch to the network plan by copying its configu ration from a live switch in the network. (See “Adding a Switch by Uploading its Configuration from the Network” on page 163.) View Operation Log Lists the tasks performed using the Devices tab. (See “Vi[...]

Devices Tab 349 Device Operations, cont. Actions Reboot WX and APs Reboot a WX switch and the MAPs it is managing. (See “Rebooting WX Switches or MAP Access Points” on page 356.) Reboot APs Reboot MAPs. (See “Rebooting WX Switches or MAP Access Points” on page 356.) Manage Device Enable 3WXM management of WX switches. (See “Enabling or Di[...]

350 C HAPTER 10: M ANAGING WX S YSTEM I MAGES AND C ONFIGURATIONS T oolbar Options T able 25 lists the options on the Devices tab’ s too lbar . Synchronizing Local and Network Changes Whenever configuration changes occu r to a switch, 3WXM alerts you that change s have occurr ed. If a co nfiguration ch ange occur s on a switch in the network or i[...]

Synchronizing Local and Network Changes 351  Selecting Review in Local Changes displays cha nges made in 3WXM.  Selecting Review in Network Changes displays changes that have occurred in the network. 5 T o print the changes, click Print . 6 Click Close to return to the Managed Devices tab. Accepting Network Changes T o accept network changes:[...]

352 C HAPTER 10: M ANAGING WX S YSTEM I MAGES AND C ONFIGURATIONS Deploying Switch Configuration Changes Y ou can deploy changes immediately or schedule them to be deployed later . When you deploy changes to a WX, all of the changes ar e sent as a single transaction. If any parameter is unsuccessfully changed, the entire transaction is rolled back.[...]

Synchronizing Local and Network Changes 353 Y ou can click Close at any time after clicking Deploy . The operation continues in the background. T o review the status of the operation, use the operation log. (See “Viewing the Operation Log” on page 358.) T o schedule deployment of local changes 1 Select the Devices tool bar option. 2 At the bott[...]

354 C HAPTER 10: M ANAGING WX S YSTEM I MAGES AND C ONFIGURATIONS Distributing System Images Y ou can use 3WXM to upgrade or downgrade the system ima ge (MSS software) on WX switches. System im ages include switch softwar e and MAP softwar e. Using the Image Repository Use the image repository to add or dele te WX system images. The image file is c[...]

Distributing System Images 355 Distributing System Images Y ou can distribute a system image to one or more WX switches in a network plan. T o use a new system image, you must reboot the WX. For mor e information, see “Rebooting WX Switches or MAP Access Points” on page 356. 3Com recommends that you use the V erification tab to resolve an y con[...]

356 C HAPTER 10: M ANAGING WX S YSTEM I MAGES AND C ONFIGURATIONS 7 Edit the start date and time. (The date and time are based on the date and time on the machine where 3WXM Services is installed.) 8 Click Finish . Rebooting WX Switches or MAP Access Points Y ou can use 3WXM to reboot WX switches and MAPs. T o reboot WX switches and the MAPs they a[...]

Enabling or Disabling Management of a Switch by 3WXM 35 7 Enabling or Disabling Management of a Switch by 3WXM The Devices tab lists managed switches and unmanaged switches separately . Managed switches can be deployed to the network and can be monitored by 3WXM Services. Unmanaged switches can be configured in 3WXM but cannot be deployed to the ne[...]

358 C HAPTER 10: M ANAGING WX S YSTEM I MAGES AND C ONFIGURATIONS Viewing the Operation Log The operatio n log displays informat ion abou t the operations you perform using the Devices options. T o display the operation log 1 Select the Devices tool bar option. 2 At the bottom of the T ask List panel, select Device O perations . 3 In the T ask List[...]

Importing and Exporting Switch Configuration Fil es 359 Importing and Exporting Switch Configuration Files Y ou can import or export switch confi gur ation files in Extensible Mark up Language (XML) format.  The import option enab les you to create a WX switch in the network plan by importing configuration files in Extensible Markup Language (XM[...]

360 C HAPTER 10: M ANAGING WX S YSTEM I MAGES AND C ONFIGURATIONS 7 Click Import . The status o f the import process appears in the St atus column. 8 Click Close to save the changes. 9 Enable 3WXM to manage the swit ch. (See “Modifying Basic Swit ch Parameters” on page 170.) T o export a configuration 1 Select File > Export . The Export Conf[...]

Modifyin g Configurati on Change Polli ng Options 361 Modifying Configuration Change Polling Options By default, 3WXM client polls WX switches in the network every 15 minutes for network changes, and displays a pop up message if changes are detected. The popup message is in addition to notification in the Alerts panel. T o modify configuration poll[...]

362 C HAPTER 10: M ANAGING WX S YSTEM I MAGES AND C ONFIGURATIONS[...]

11 V ERIFYING C ONFIGURATION C HANGES 3WXM uses a set of rules to verify WX switch configurations. Changes to a switch’ s configuration in 3WXM or in the live network are automatically evaluated by comparing the changes to the ru les. If the evaluation detects any error or warning conditions, the information in th e Alerts panel is updated:  E[...]

364 C HAPTER 11: V ERIFYING C ONFIGURATIO N C HANGES Details about the selected err or or war ning appear in the lower left section of the ta b. The Resolution section of the tab lists options for r esolving the warning or error . T oolbar Options T able 27 lists the options on the Event tab’ s to olbar . Filtering the Message List By default, al[...]

Resolving an Error or Warning 365 T o resolve an err or or warning 1 Select the err or or war ning message in the Message column. 2 Read the information in the Error/ W arning Details se ction. For some errors and warnings, this sectio n contains information about how to re solve the err or or warning. 3 If an Edit option is listed in the Resolutio[...]

366 C HAPTER 11: V ERIFYING C ONFIGURATIO N C HANGES T o globally disable a war ning or error 1 Select an instance of the warning o r error message. 2 In the Resolutions section, click disable this rule for all instances . As soon as you click on this option, all instances of th e message disappear from the list. 3WXM will not display the message a[...]

Resolving an Error or Warning 367 3Com recommends that yo u do not deploy a network plan that contains configuration errors. Allowing configurat ion errors to be deployed to the network can affect network stability . 3 Click Close to place the changes into ef fect and close the dialog box. Disabling and Reenabling Rules If you disable a rule, you c[...]

368 C HAPTER 11: V ERIFYING C ONFIGURATIO N C HANGES 6 Reenable the rule or instances:  T o reenable a rule all of whose i n stances ar e disabled, click on the checkbox in the Enabled column. Th e Disable All Instances option is deselected.  T o reenable an individual instance of a rule, click on the c heckbox next to the instance. R epeat f[...]

12 M ANAGING C ERTIFICATES A digital certificate is a form of elec tr onic identification for computers. This chapter describes processi ng and managing certificates, and distributing PKS #12 f iles. Overview A digital certificate is a form of elec tronic identification for computers. The 3Com Mobility System supports th e following types of X.509 [...]

370 C HAPTER 12: M ANAGING C ERTIFICATES Processing Certificates When 3WXM client connects to 3WXM Services or to a WX switch that presents a certificate that is unknown to 3WXM client, the Certificate Check dialog box appears. The dialog sho ws information about the certificate and allows you to accep t or r eject the certifica te and therefor e a[...]

Managing Certificates 371 Managing Certificates After you have installed ce rtificat es, you can r eview a certificate or delete a certificate that is stored in the 3WXM certific ate stor e. Reviewing Certificate Details After installing a certificate in 3WXM , you can see information such as the time frame for which the certificate is valid and wh[...]

372 C HAPTER 12: M ANAGING C ERTIFICATES Distributing Certificates to WX Switches Y ou can use 3WXM to distribute certificates from PKCS #12 files to one or more WX switches. Although you can distribute one PKCS #12 file to many WX switches, as a best practice, you should install a uni que certificate and key pair per WX. 1 Select the Devices tool [...]

C ONFIGURING AND A PPLYING P OLICIES A policy is a set of WX configuration pa rameters that you can define once in 3WXM and then apply to multiple WX switches. When you apply a policy to a set of WX switches, all parameter settings in the policy are applied to the switches and update the settings already on the switches. How Changes Ar e Managed Wh[...]

374 C HAPTER 13: C ONFI GURING AND A PPLYING P OLICIES Viewing Policie s T o view policies: 1 Select the Policies tool bar option. 2 T o view the feature ar eas in the policy , click on the plus sign next to the policy name. Only the ar eas that ar e confi gur ed in the policy ar e listed. Click on the plus sign next to individual feature ar eas. 3[...]

Configuring Featu re Settings in a Policy 375 Configuring Feature Settings in a Policy T o configure feature settings in a policy: 1 If you have not already done so, use the procedur e in “Cr eating a Policy” on page 374 to configure a policy and select the switches to which you want to apply the policy . 2 In the Organizer panel, select a feat[...]

376 C HAPTER 13: C ONFI GURING AND A PPLYING P OLICIES T able 28 Feature Categories For This Feature Ar ea See... System Features IP Services “Viewing and Configurin g IP Services Settings” on page 201 VLANs, Spanning T rees and Port Groups “Viewing and Configurin g VLANs” on page 206 “Changing STP Port Settings in a VLAN” on page 211 ?[...]

1 4 U SING THE E VENT L OG 3WXM maintains a log of system events. The log con tains messages generated by the following:  WX switches in the network plan—me ssages generated by the WX switches in the network plan that ar e bein g monitored by the 3WXM service  3WXM Services—messages generated by the 3W XM server the client is in communica[...]

378 C HAPTER 14: U SING THE E VENT L OG Refreshing Event Data By default, the event data is refreshed whenever the 3WXM client generates a new message fo r itself, or r eceives a new message from the 3WXM Services. T o disable automatic refreshing of events, clear the Auto-update checkbox and click Apply . (The checkbox is loca ted on t he Filters [...]

Filtering Event Messages 379 Filtering Events by Content When using the predefined filters, you can limit the event s you see in Event tab by specifying criteria such as IP address, date, or text in the log message. Y ou can us e advanced filters to fur ther limit the events you see. T o filter messages by content 1 In the Event Sour ce box, type a[...]

380 C HAPTER 14: U SING THE E VENT L OG  In the Start box, click the arrow to use the calendar to specify the day , month, and year .  Specify the end time.  After —Only events that o ccurr ed after a specified time  In the Start box, click the arrow to use the calendar to specify the day , month, and year .  Specify the starting t[...]

Filtering Event Messages 381 Filtering Events by Severity Y ou can limit the events you see in Event tab based on event severity . 1 Click on the Severity tab. 2 Select or clear the severity levels to display (t he following descriptions ar e WX-based):  Emergency —The WX is unusable.  Alert —Action must be taken immediately .  Critica[...]

382 C HAPTER 14: U SING THE E VENT L OG Creating and Saving Filters If you have specified addition al criteria to filter the events, you can save the criteria as a stor ed custom filter . 1 In the Stor ed Filters group box, type a new filter name in the Name box. 2 T ype a name for the filter (1 to 80 alphanumeric characters, with no tabs). 3 Click[...]

15 G ENERATING R EPORTS This chapter describes the reports you can generate with 3WXM:  Inventory  Mobility Domain Configuration  WX Configuratio n  Client Summary  Client Details  Client Err ors  W atch List Client  Network Usage  RF Summary  Radio Details  Rogue Summary  Site Survey  Wor k O rder[...]

384 C HAPTER 15: G ENERATIN G R EPORTS Overview The Reports option of the 3WXM toolbar enables you to generate reports for network clients, RF usage, r ogue devices, and 3Com equipment.  Configuration reports:  Inventory  Mobility Domain Configuration  WX Configuratio n  Client monitoring reports:  Client Summary  Client Detail[...]

Generating an Inventory Report 385 Generating an Inventory Report The inventory report lists the WX switches and MAP access points in a specific Mobility Domain or that do not bel ong to a Mobility Domain. T o generate an inventory report 1 Select the Reports tool bar option. 2 In the Report Category list, select Configuration Reports . 3 In the Re[...]

386 C HAPTER 15: G ENERATIN G R EPORTS Generating a Mobility Domain Configuration Report The Mobility Domain configuration report lists information for all the WX switches in a Mobility Domain, incl uding the VLANs, radio and service profiles, and RADIUS server groups and servers configured on the WX switch(es). 1 Select the Reports tool bar option[...]

Generating a WX Configuration R eport 387 Generating a WX Configuration Report The WX configuration report lists configuratio n details for a WX switch. 1 Select the Reports toolb ar opti on. 2 In the Report Category list, select Configuration Reports. 3 In the Reports list, select WX Configuration. 4 In the Report Scope Instance drop-down list, se[...]

388 C HAPTER 15: G ENERATIN G R EPORTS Generating a Client Summary Report The client summary report lists curr ent client sessions. The data for this report comes from th e 3WXM Services. The Enable client session collection option, located in the Client Monitor group box of the Monitoring Settings tab, must b e enabled. (See “Changing Monitoring[...]

Generating a Clie nt Details Report 389 5 Select the instance for which you wa nt the report. For example, if the scope is Building, select the building. 6 T o select or change the output directory for the report, click Choose , navigate to the new directory , and click Select . 7 T o prevent 3WXM from re placing an existing report of the same type[...]

390 C HAPTER 15: G ENERATIN G R EPORTS 4 Click Add to add a r eport filter . The fi lter configuration fields ar e activated. 5 Click on the Select field, and select one of th e following fr om the dr op-down list:  User Name  IP Address  MAC Address 6 Click on the V alue field. Erase the text in the field and t ype the username, IP addres[...]

Generating a Client Errors Report 391 Generating a Client Errors Report The client errors r eport lists error statistics for curr ent client sessions. The data for this report comes from 3WXM Ser vices. The Enab le RF trending option, located in the RF Monitor group box, mu st be enabled. (See “Changing Monitorin g Settings” on page 500.) 1 Sel[...]

392 C HAPTER 15: G ENERATIN G R EPORTS Generating a W atch List Client Report The watch list client report lists session information and roaming history for clients on the watch list. The client must be on the client wa tch list. (See “Managi ng the Client Wa tch List” on page 4 34.) 1 Select the Reports tool bar option. 2 In the Report Categor[...]

Generating a Network Usage Report 393  Session Statisti cs  AP Statistics (See “Using the Client Monitor Vi ew” on page 415 for information abou t the data columns in each section of the report.) Generating a Network Usage Report The network usage report lists network usage statistics. The data for this report comes from 3WXM Ser vices. T[...]

394 C HAPTER 15: G ENERATIN G R EPORTS 8 T o prevent 3WXM from re placing an existing report of the same type with this new report, click next to Over write Existing File s to deselect this option. 9 Click Generate . 10 When the report is generated, click the report link to vi ew it. The network usage report contains the following sections:  Cum[...]

Generating a Radio Details Report 395 7 T o select or change the output directory for the report, click Choose , navigate to the new directory , and click Select . 8 T o prevent 3WXM from r eplacing an existing r eport of the same type with this new report, click next to Overwrite Existing Files to deselect this option. 9 Click Generate . 10 When t[...]

396 C HAPTER 15: G ENERATIN G R EPORTS 8 Click Generate . 9 When the report is generated, click the report link to vi ew it. (See “Using the RF Monitor View” on page 442 and “Using the RF T rends View” on page 447 for information abou t t he data in each section of the rep or t. ) Generating a Rogue Details Report The rogue details r eport [...]

Generating a Rogue Summary Report 397 Generating a Rogue Summary Report The rogue summary r eport lists information about rogues. The data for this report comes from 3 WXM Services. The Enable Rogue Detection option, located in the Rogue Detection group bo x of the Monitoring Settings tab, must be en abled. (S ee “Cha nging Monitoring Settings”[...]

398 C HAPTER 15: G ENERATIN G R EPORTS 9 T o prevent 3WXM from r eplacing an existing r eport of the same type with this new report, click next to Overwrite Existing Files to deselect this option. 10 Click Generate . 11 When the report is generated, click the report link to vi ew it. The report lists the BSSIDs of the rogues detected by each WX swi[...]

Generating a Work Order 399 Scroll down to view the MAC address assignments for the LOS points. Use the instructions in the Ekah au Site Survey Initial Setup section of the work order to set up the survey . When you import the floor map into the site sur vey tool, make sure you use the map name specified in the work order . The site survey data wil[...]

400 C HAPTER 15: G ENERATIN G R EPORTS 7 T o change the ou tput dir ectory for the report, click on the button next to output directory , navigate to th e new directory , and click Se lect . 8 Click Generate . 9 When the report is generated, click View . A browser window containing the report opens. 10 Optionall y , select the floor . 11 Click Vie [...]

16 M ONITORING THE N ETWORK This chapter describes how to use the 3WXM monito ring service. It includes information about monitoring service requirements, accessing monitored data, using the Explore, St atus Summary , Client Monitor , RF Monitor , and RF T rends windows, and accessing realtime performance statistics and the event log. Overview The [...]

402 C HAPTER 16: M ONIT ORING THE N ETWORK The 3WXM Services is configured to provide data for the Explor e and Status Summary windows by defau lt. T o pr ovide data to the client and RF windows, you must enable the service to poll WX switches for client and RF data. Y ou also can enable the serv ice to r eceive SNMP traps generated by the WX switc[...]

Using the Explore Window 403 3 Select an object in t he Organizer pa nel. Monitored data for the selected object is displayed. Using the Explor e Window The Explore view shows the status of 3Com equipment within the scope of the object selected in the Equipmen t or Sites section of the Organizer panel.  If you select a Mobility Domain or WX swit[...]

404 C HAPTER 16: M ONIT ORING THE N ETWORK  If you select a MAP access point, radio, wiring closet, or cover age ar ea in the Sites section of the Organizer panel, the floor plan is displayed. The floor plan is displayed only if you add the floor to the site information in the network plan.[...]

Using the Explore Window 405 In either the link display or the fl oor display , the operational status of 3Com equipment is indicated by the following colors:  Green — Up  Ye l l o w — Up (but with minor service degradation)  Orange — Up (but with major service degradation)  Red — Down  Blue — Unknown T oolbar Options The E[...]

406 C HAPTER 16: M ONIT ORING THE N ETWORK T able 34 lists the options on the toolbar in t he floor display . T able 34 T oolbar Options in Floor Display of Explore View Icon Descr iption Edit 3WXM prefer ences. Configure 3WXM Services. Launch Help. Zoom in. Zoom out. Refresh the information. Fit the view in the window . Print the view displa yed i[...]

Using the Explore Window 407 Threshold Flags A r ed flag next to an object in the link view of the Explore view indicates that a threshold for the object has been exceeded. The thresholds are defined by the 3WXM Services. (See “Changing 3WXM Services Prefer ences” on page 491.) For example, a red flag next to a MAP might indicate that the thres[...]

408 C HAPTER 16: M ONIT ORING THE N ETWORK Y ou can click on the object that has the red flag for more information. An asterisk indicates the statistic w hose threshold was crossed. In the example below , the WX switch has a higher signal-to-noise ratio (SNR) than specified for the threshold. Double-click on the object with the r e d flag to drill [...]

Using the Explore Window 409 When a red flag appears in the Explore view , the column for th e statistic whose threshold was exceeded also tur ns r ed in the RF T rends view .[...]

410 C HAPTER 16: M ONIT ORING THE N ETWORK Displaying Object Details T o drill down for more detailed i nformat ion for an object in the Explore view , double-click on the object . All Monitor views, including the Explore view itself, are updated to display information specifically about the selected object. For example, if the Explor e window is s[...]

Using the Explore Window 411 The jagged appearance of the coverage area is normal and is caused by the RF obstacles around the radio. The RF obstacle information in the floor plan en ables 3WXM to more a ccurately portray RF information fo r the network, including a radio’ s covera ge. If the coverage area for a radio is displayed as a sphere, th[...]

412 C HAPTER 16: M ONIT ORING THE N ETWORK T aking RF Measurements In the floor plan display , you can take an RF measurement at any point on the floor plan. An RF measurement poin t indicates the RSSI value for each 3Com ra dio on t he floo r . T o take an RF measurement 1 In the floor plan display of the Explor e view , click on the window’ s t[...]

Using the Explore Window 413 T able 36 lists the RF measurement information that is displayed for the measurem ent point. RF measurement point RSSI measur ements T able 36 RF Measurement Information Item Value X (Feet) Distance in the X di rection from the 0,0 coordinate (the upper left corner of the panel). Y (Feet) Distance in the Y di rection fr[...]

414 C HAPTER 16: M ONIT ORING THE N ETWORK Y ou can change the RSSI options even a fter measurement data is displayed. The data is immediately upd ated. T o take a new measu r ement, click on the new measurement point. The measurement data is immediately updated for the new measur ement point. Using the Status Summary Vie w The Status Summary view [...]

Using the Client Monitor View 415 Using the Client Monitor View The Client Monitor view shows det ailed information about client activity on the network. Client information is displayed in the following tabs:  Client Activity — displays association and 802.1X information for the clients  Client Sessions — lists bandwidth, signal-to-noise-[...]

416 C HAPTER 16: M ONIT ORING THE N ETWORK Refreshing Client Data The data displayed in the Client Monitor view is refr eshed at re gular intervals (every 5 minutes by default). The data is refr eshed based on the client monitor polling interval spec ified. (See “Changing Monitoring Settings” on page 500.) Y ou can al so refr esh the data on de[...]

Using the Client Monitor View 417 The same counte rs appear when you select a Site, build ing, or floor . T able 38 lists the data displayed on the Client Activity tab when a Mobility Domain is selected. The coun ters are increm ented each time the 3WXM Services r eceives a client acti vity trap generated by a WX switch. The counters represent acti[...]

418 C HAPTER 16: M ONIT ORING THE N ETWORK Authentication Failures Number of times authentication for a client failed. Common causes of authentica tion failures include the following:  User glob or MAC addres s glob mismatch or Un known user  Invalid p assword  RADIUS server timeout Authorization Failures Number of times authorization for [...]

Using the Client Monitor View 419 Data Displayed When a Switch, MAP , or Radio is Selected When a WX switch, MAP , or individ ual radio is selected in the Organizer panel, the Client Monitor view’ s Clie nt Activity tab displays a row of information for each client activit y trap generated by th e selected device. Associations Number of times a c[...]

420 C HAPTER 16: M ONIT ORING THE N ETWORK T able 39 lists the data displayed on the Client Activity tab when a WX switch, MAP , or individual radio is selected. The Activity Details section at the bo ttom of the view displays details for the selected row of information. The details differ depending on the trap type. The following tables list the d[...]

Using the Client Monitor View 421 T able 40 Activity Details for Association Failur e Column Descripti on MAC Address MAC address of the client. Failure Cause Cause of the association failure:  already-exist  cipher-mismatch  cipher-rejected  load-balance  other  switching-ssid  wep-not-configured Client Location M obility Doma[...]

422 C HAPTER 16: M ONIT ORING THE N ETWORK Client Location Mobil ity Domain, WX switch, MAP access point, and radio that were dealing with the client. Session ID ID used by 3Com equipment to track the session within the Mobility Domain. Auth Server IP System IP address of the WX switch that was attempting to authenticate the client. Note — The sy[...]

Using the Client Monitor View 423 Authorization Failure Cause Reason the authorization failure t rap was generated:  acl-mismatch  crypto-type-mismatch  end_date_mismatch  location-policy  mobility-profile-mismatch  other  ssid-mismatch  start_date_mismatch  timeofday-mismatch  user-param  vlan-tunnel-failure Client[...]

424 C HAPTER 16: M ONIT ORING THE N ETWORK Auth Protocol T ype 80 2.1X pr otocol used to authenticate the client:  EAP-TLS  MD5  NONE  PASS-THROUGH  PEAP Client Location Mo bility Domain, WX switch, MAP , and radio that were dealing with the c lient. Session ID ID used by 3Com equipment to track the session within the Mobility Domain[...]

Using the Client Monitor View 425 User Access T ype Authentication type that granted access:  DOT1X  MAC  LAST-RESORT  WEB T able 44 Activity Details for Client Cleared Column Descrip tion User Name Username of the client. MAC Address MAC address of the client. SSID SSID the client was associated with. Session ID ID used by 3Com equipme[...]

426 C HAPTER 16: M ONIT ORING THE N ETWORK Client IP Address IP address of the client. Auth Server IP System IP address of the WX switch that was attempting to authenticate the client. Note — The system IP addr ess is listed even if the switch was using a RADI US server to authenticate the client. SSID SSID the client was associated with. T able [...]

Using the Client Monitor View 427 Displaying Client Session Information The Client Session tab displays ses sion statistics. The data fields in the display depend on the scope:  If a Mobility Domain is selected, a r ow of data is displayed for each WX switch in the Mobility Domain.  If a WX swit ch, MAP , or radio is selected, client sessions[...]

428 C HAPTER 16: M ONIT ORING THE N ETWORK T able 48 lists the data displaye d on the Client Sessions ta b when the scope is a Mobility Domain. Data Displayed When a WX Switch, MAP , or Radio is Selected When a WX switch, MAP , or individ ual radio is selected in the Organizer panel, the Client Monitor view’ s Cl ient Sessions tab displays a row [...]

Using the Client Monitor View 429 Displaying Session Details T o display details for a user session, select the sessio n in the Cl ient Sessions list. Details for the session appear in the fo llowing tabs at the bottom of the window:  Session Properties  Session Statisti cs  Location History Displaying Session Properties On the Client Sess[...]

430 C HAPTER 16: M ONIT ORING THE N ETWORK T able 50 Session Properties Columns Column Descripti on Username User name the client used to log on to the network. MAC Address MAC addr ess of the client. Start Time Date and time when the session began. The date and time are base d on the system date and time of the WX switch with which the client is a[...]

Using the Client Monitor View 431 Session State State of the user session:  Associated — User is authenticated using an 802.11 protocol and associated with a MAP.  Authori zing — User is authenticated and is starting the AAA authorization process.  Authori zed — User is authorized.  Active — User’s session is fully active. [...]

432 C HAPTER 16: M ONIT ORING THE N ETWORK Displaying Session Statistics On the Client Sessions tab, select the Session Statistics ta b at the bottom of the view . On the Session Statistics tab, you ca n select statistics for the MAP the client is associated with, or total statistics for the client’ s en tir e r oaming history . For the current s[...]

Using the Client Monitor View 433 Displaying Session Location History On the Client Sessions tab, select the Location History tab at the bottom of th e window . Each row r epresents a session with a 3Com radio. When a client roams from one radio to another , the session on the r adio the client is leaving is closed and a new session is opened on th[...]

434 C HAPTER 16: M ONIT ORING THE N ETWORK Sessions in the location history are sort ed from newest to oldest, with the oldest session at the bottom of the list and the newest session at the top. T able 52 lists the information displayed on the tab. Managing the Client Wa t c h L i s t Y ou can add clients to a watch list. The wat ch list allows yo[...]

Using the Client Monitor View 435 1 In the Client Monitor window , click on the window’ s toolbar . The Find Clients dialog box appears. 2 Select one of the following:  Find a specific user — to find a user u sing specific search attributes. Go to step 3.  Find all users — to find all users. Go to step 4. 3 Use any or all of the followi[...]

436 C HAPTER 16: M ONIT ORING THE N ETWORK When specifying search criteria, you must pr ovide an exact match. For a username, you can also specify the prefix of the username. For example, to find na tasha@example.c om, you could specify the following:  natasha@example.com  nat Wildcards are not supported in sear ch criteria. For example, the [...]

Using the Client Monitor View 437 7 T o add a user to the watch list in th e User Management tab, select the Add W atch checkbox in the user row . Repeat for all users that you want to add to the watch list. 8 Click Finish . Displaying the Client W atch List T o display the watch list, select the Client W atch List tab in the Client Monitor window [...]

438 C HAPTER 16: M ONIT ORING THE N ETWORK Details are displayed on the following tabs:  Session — displays the Session Properties, Session Statistics, and Location History tabs. These are the same tabs displayed at the bottom of the Client Sessions tab. (F or descriptions of the data they display , see “Display ing Client Session Informatio[...]

Using the Client Monitor View 439 When looking at graphed data, you can see the data in absolute or delta values. Delta (rate of change) values are calculated with the follo wing equation: value at end of polling interval - v alue at beginning of polling int erval time difference (in seconds) T o change how you view data values, select Absolute to [...]

440 C HAPTER 16: M ONIT ORING THE N ETWORK T o improve the accuracy of the client location display , you can select up to six MAPs from the list. 3WXM uses the selected MAPs to calculat e the location of th e client. For best results, you should select th e MAPs that have detected the clie nt most recently . When selecting multiple MAPs, you should[...]

Using the Client Monitor View 441 5 The client is most likely in the vicinity of the area indicated by the red squares in the floor plan. The number in r ed on the legend (0.44 in this example) is the pr obability (44%) that the client is wher e the display indicates. 6 The list of MAPs that det ected the client is shown to the right of the floor d[...]

442 C HAPTER 16: M ONIT ORING THE N ETWORK Using the RF Monitor View The RF Monitor view shows detailed RF information for each radio. Radio information is displayed in the following tabs:  RF Neighborhood — lists the other t ransmitting devices that the radio can hear .  SSID-BSSID Mapping — lists the MAC address associated with each SSI[...]

Using the RF Monitor View 443 Displaying RF Neighborhood Information In the RF Monitor view , select the RF Neighborhood tab at the bo ttom of the window . The RF Neighborhood tab lists t he transmitters that can hear or are heard by the radio selected in the top sect ion of the window . Y ou can select the viewpoint of the list:  T o list the o[...]

444 C HAPTER 16: M ONIT ORING THE N ETWORK Displaying the SSID-to-BSSID Mapping T o display the SSIDs config ur ed on a radio and their BSSIDs, in the RF Monitor window , select the SSID-BSS ID Mapping tab at the bot tom of the window . BSSID BSSID detected by the radio. Note — This column displays a single entry for each 3Com radio, even if the [...]

Using the RF Monitor View 445 Displaying the Activity Log The activity log displays R F Auto-T uni ng and countermeasures activity for the radio. T o display the activity log, in the RF Monitor view , select the Activity tab at the bottom of the window . T able 55 lists the information displayed on the tab . T able 55 RF Monitor Activity Log Column[...]

446 C HAPTER 16: M ONIT ORING THE N ETWORK Displaying RF Environment Statistics T o display RF en vir onment statistics, in the RF Monitor wind ow , s elect the RF Environment tab at the bottom of the window . T able 56 lists the information displayed on the tab. T able 56 RF Monitor Environment Columns Column Descripti on Channel Radio channel to [...]

Using the RF Trends View 447 Using the RF T rends View The RF T rends view shows curr ent and past 802.11 statistics for radios. Y ou can view statistics up to 30 days old, and display graphs of data trends. T able 57 lists the information displayed in the top section of the RF T rends view . Pkt Re-transmissions Number of retransmitted packets sen[...]

448 C HAPTER 16: M ONIT ORING THE N ETWORK If the SNR, Associated Cli ents, or Re ceiver Threshold column is red, this indicates that the threshold config ured for th is parameter has been exceeded. (See “Changing Monitorin g Settings” on page 500.) When looking at graphed data, you can see the data in absolute or delta values. Delta (rate of c[...]

Accessing Realtime Performance Sta tistics 449 T o change how you view data values, select Absolute to se e absolute values or Deltas to see rate-of-change values. Refreshing RF T rend Data The data displayed in the RF T rends vi ew is r efr eshed at regular intervals (every 5 minutes by default). The data is r efr eshed ba sed on th e specified po[...]

450 C HAPTER 16: M ONIT ORING THE N ETWORK 2 Select the scope to monitor from the list on the left side of the dialog box. 3 Select the specific object(s) to monitor from the list on the right side of the dialog box.  T o select multiple co ntiguous objects, click Shift while selecting.  T o select multiple noncontiguous object s, click Ctrl [...]

Accessing Realtime Performance Sta tistics 451 Generally , the scope is an aggregate obj ect, which means that it is made up of sub-objects. (The exception is when a scope is a set of ports.) When you see performance data for the aggregate object, you are seeing the sum of the data of the sub-objects. For example, a WX consists of ports. Performanc[...]

452 C HAPTER 16: M ONIT ORING THE N ETWORK For example, if the number of octets in is 11,101 ,288 at the beginning of the polling period, the number of octets in is 11,146,904 at the end of the polling period, and the time differ ence is 60 seconds, the delta value is 760.267. T o change how you view data values, select Absolute to see absolute val[...]

Accessing Realtime Performance Sta tistics 453 T o reset counters in the current view For absolute values, you can reset the counters in the curr ent view by clicking Reset Counters In View . Resetting counters applies to the current view only . The performance data continues to be collected. The view shows when you reset the counters. T o show the[...]

454 C HAPTER 16: M ONIT ORING THE N ETWORK Viewing Data in Percentages T o see a set of objects in a particular category of data as per centages in a pie chart, click the Per cent tab. Data for the pie chart is captured when you click the tab and is based on the polling interval you selected. T o see details for percentage-based performance data Y [...]

Accessing Realtime Performance Sta tistics 455 Exporting Performance Data Y ou can export performance data (absolute values only) to a file in comma-delimited text (.csv) format. T o export data to a file 1 In the Statistics tab, click Export Absolute . The Export Data dialog box appears.[...]

456 C HAPTER 16: M ONIT ORING THE N ETWORK 2 T o specify a directory and name for the file, click Choose . 3 T o overwrite existi ng files, select Overwrite Existing Files . By default, this option is selected. 4 T o make a copy of files before overwriting them, select Copy Files Before Overwr iting . By default, this option is selected. The ex ist[...]

17 D ETECTING AND C OMBATTING R OGUE D EVICES This chapter discusses how to manage rogue devices that try to use your wireless network. Information includes an overview of detectio n featur es, enabling countermeasures, using the Rogue Det ection tab, displaying a rogue’ s geographical location, ignor i ng friendly thir d-party devices, and conve[...]

458 C HAPTER 17: D ETECTING AND C OMBATTING R OGUE D EVICES Rogue Detection Requirements Rogue detection in 3WXM has the following requirements.  The Enable Rogue Detection optio n mus t be selected on the Monitoring Settings tab of the 3WXM Services Setup dialog . (See “Changing Monitoring Se ttin gs” on page 500.)  T o use countermeasur[...]

Rogue Detection Requiremen ts 459 T o use countermeasures, they must be enabled. Y o u can enable them on an individual rad io pr ofile basis. (See “Viewing and Configuring Radio Profiles” on page 263.) Mobility Domain Requirement RF Detection requires the Mobility Do main to be completely up. If a Mobility Domain is not fully operatio nal (not[...]

460 C HAPTER 17: D ETECTING AND C OMBATTING R OGUE D EVICES Rogue Detection Lists Rogue detection lists specify the th ir d-party devices an d SSIDs that MSS allows on the network, and the device s MSS classifies as rogues. Y ou can configure the following rogue detection lists:  Permitted SSID list—A list of SSIDs allowed in the Mobili ty Dom[...]

Rogue Detection Lists 461 MAP radio detects wireless packet. No Ye s Ye s Source MAC in SSID in Permitted Ignore List? Device is not a threat. SSID List? Ye s OUI in Permitted V endor List? No Source MAC in Attack List? No Generate an alarm. Classify device as a rogue. No Ye s Issue countermeasures (if enabled). No Rogue classification Ye s algorit[...]

462 C HAPTER 17: D ETECTING AND C OMBATTING R OGUE D EVICES Using the Rogue Detection Screen T o display rogue information, select the Rogue Detection option in the main 3WXM tool bar . The Rogue Detection screen lists in formation about the rogue devices detected in the network. The rogue li st section lists all r ogues detected within the time pe[...]

Using the Rogue Detection Screen 46 3  Activity Log — Lists activity (appearanc e or disappearance) of the rogue selected in the rogue list. The entries in the Activity Log tab come from either of the following sources:  Notification data received fr om a switch  3WXM Services, if they detect th e appearance or disappearance o f the rogu[...]

464 C HAPTER 17: D ETECTING AND C OMBATTING R OGUE D EVICES Filtering the Rogue List By default, the rogue list contains all rogues detected during the most-recent polling interval, in all Mo bility Domains in the network plan. Y ou can change the filter criteria for which rogues ar e listed. T o filter the rogue list 1 Click the icon on the Rogue [...]

Using the Rogue Detection Screen 46 5  Ad-hoc clients —W ir eless clients who ar e configured to communicate wirelessly outside of the network infrastructure. Ad-hoc clients ar e not necessarily malicious, but they do steal bandwidth from your infrastructure users. Ad-hoc clients are further categoriz ed into r ogues and interfer ing devices. [...]

466 C HAPTER 17: D ETECTING AND C OMBATTING R OGUE D EVICES Each rogue is listed only once, even if multiple entries for the rogue appear in the Activity Log tab. For ex ample, if a rogue is detected during three polling intervals, separate entrie s for each polling interval appear in the Activity Log. However , at the e nd of the hour , when the a[...]

Using the Rogue Detection Screen 46 7 Clients T ab The Clients tab lists details about the clients of rogue devices. T o di splay client information for a r ogue, sele ct the rogue in the Filtered List. T able 62 lists the information displayed on the Clients tab. T able 61 Listeners Columns Column Descripti on MAP MAP whose radio detected th e r o[...]

468 C HAPTER 17: D ETECTING AND C OMBATTING R OGUE D EVICES Displaying a Rogue’ s Geographical Location If building and floor information for the site is modeled in the network plan, you can display the likely phy sical lo cation of a rogue. 3WXM displays the floor plan for the floor where the r ogue is believed to be located, and displays t he a[...]

Displaying a Rog ue’s Geographical Location 46 9 2 Select the client under the Clients tab. 3 Click on the toolbar . The Device Location scr een appe ars, indicat ing the approximate location of the client. The client is most likely in the vicinity of the area indicated by the red squares in the floor plan. The number in r ed on the legend (0.90 [...]

470 C HAPTER 17: D ETECTING AND C OMBATTING R OGUE D EVICES Ignoring Friendly Thir d-Party Dev ices By default, when countermeasur es ar e enabled, M SS considers any third-party transmitter to be a r ogue device and can send countermeasures to pr event clients fr om using that device. T o prevent MSS from sending countermeasur es against a friendl[...]

Adding a Device to the Attack Li st 471 Adding a Device to the Attack List An attack list is a switch’ s list of AP MAC addresses to attack whenever they ar e prese nt on the network. 1 In the Filtered List of rogues on the Rogue Detection screen, select the devices you want to attack. 2 Click on the toolbar . The Se lect Devices dialog is displa[...]

472 C HAPTER 17: D ETECTING AND C OMBATTING R OGUE D EVICES 3 Enter the informatio n for the AP and place the icon for the AP in it s floor location, if applicable. (See “Pla cing Third-Party Access Points” on page 130.) When you have finished, the AP appears under Objects to Place in RF Planning. T o display the list Select the Configuration o[...]

Adding a Rogue’s Clients to the Black List 473 Adding a Rogue’ s Clients to the Black List The client black list is a switch’ s list of MAC addresses of wireless clients who are not allowed on the network. MSS pr events clients on the list from accessing the network through a WX switch. 1 In the Filtered List of rogues on the Rogue Detection [...]

474 C HAPTER 17: D ETECTING AND C OMBATTING R OGUE D EVICES[...]

18 O PTIMIZING A N ETWORK P LAN After yo u deploy a networ k plan to the 3C om equip ment in your live network, you can optimize the plan based on RF information from the network. The RF information can be fr om a site survey or fr om MAP radios.  Site survey—RF measurements come fr om a site survey file generated by the Ekahau Site Survey™ [...]

476 C HAPTER 18: O PTIM IZING A N ETWORK P LAN 5 Y ou can choose to import measur ements fr om the ne twork, a site survey file, or both: a If you want to use RF neighborhoo d information imported from a MAP in the network, clic k Ye s next to Network. b If you want to import measurements from a site survey file, click Ye s next to File, and in the[...]

Importing RF Measurements 477 Applying the RF Measurements to the Floor Plan T o apply the RF measurements to the floor plan: 1 Under Site Survey in the T a sk List panel, click Optimi ze . A wizard appears, listing the progress of the request.  The T otal number of RF measurements that did not intersect any object line lists the number of measu[...]

478 C HAPTER 18: O PTIM IZING A N ETWORK P LAN The measurements reflect how well the measuring MAPs can hear one another , and do not directly meas ure how well clients can hear the MAPs. For example, if the MAPs ar e mounted on the cei ling, attenuation of their signals to one another might be less than the attenuation of the same signals when rec[...]

Locating and Fix ing Coverage Holes 47 9 6 On the toolbar , click the radio type for which you want to display coverage: Y ou also can show coverage by right-clicking on the scope in the Coverage Areas sectio n, then selecting Show RF Coverage. Coverage for the selected scope(s) is displayed. This examp le shows 802.11a coverage, by transmit data r[...]

480 C HAPTER 18: O PTIM IZING A N ETWORK P LAN Fixing a Coverage Hole After you import RF measurements, op timize, an d display coverage, you can observe any wireless coverage holes in the network. T o fix a coverage hole, use any of the following methods:  Lock the MAPs in place, and use the Comp ute and Place task to recompute the number of MA[...]

A C HANGING 3WXM P RE F E RE NC E S This chapter discusses how to set 3Com Wi r eless LAN Switch Manager (3WXM) client pr eferences. It descri bes how to reset prefer ences values and change options for network synchr onization, user interface, persistence, tools, ce rtificate management, RF planning, and 3WXM logging. Overview Y ou can set 3WXM pr[...]

482 C HAPTER A: C HANGING 3WXM P REFERENCE S Changing Network Synchronization Options By default, 3WXM checks for configuration changes, events, and status changes on WX switches. Y ou can configur e checking (also called polling ) for configuration changes in the network made with the CLI, Web Manager , or another instance of 3WXM. If you do not e[...]

Changing Persistence Options 483 3 T o enable a confirmation prompt a fter you close a wiza r d, select the Wa r n checkbox. T o disable the confirmati on pr ompt , clear the Wa r n checkbox. By default, if you close a wizard, a pop-up box appears, asking whether you want to close the wizard. (Changes are lost if you close the wizar d.) If you clic[...]

484 C HAPTER A: C HANGING 3WXM P REFERENCE S Changing T ools Options Y ou can change the T elnet an d W eb br owser applications that start from the 3WXM T ools menu. The d efault T eln et application is Microsoft T elnet Client. The default Web browser is Microsoft Internet Explorer . T o change tools options: 1 Select T ools > Pr eferences . T[...]

Changing Options for RF Planning 485 Changing Options for RF Planning Y ou can change the following RF planning options:  T ypical transmit powe r for clients in the 3C om network .  Color schemes for showing RF information Configuring the T ypical Client’ s T ransmit Power T o change the typical client’ s transmit power: 1 Select T ools [...]

486 C HAPTER A: C HANGING 3WXM P REFERENCE S T o Change a Color 1 Select T ools > Pr eferences . The Pr eferences dialog box appe ars. 2 Click the RF tab. 3 Select one of the following tabs:  802.11a Channel Colors  802.11b/g Channel Colors  RF Obstacle Colors  Data Rate Colors  RSSI Band Colors  SNR Band Colors  Load Band C[...]

Changing Options for RF Planning 487 4 Do one of the fo llowing:  Change another color .  Click another Pr efer ences tab.  Click Close to close the Prefer ences dialog box. Defining a Color by Changing HSB Pr operties Y ou can define colors by changing the hue, saturation, an d brightness (HSB).  Hue is the color itself (for exampl e, [...]

488 C HAPTER A: C HANGING 3WXM P REFERENCE S 5 Click OK to accept the color . The RF Plan ning Opt ions tab in t he Prefer ences dialog bo x is active. 6 Do one of the fo llowing:  Change another color .  Click another Pr efer ences tab.  Click Close to close the Prefer ences dialog box. Defining a Color by Changing RGB Pr operties Y ou ca[...]

Changing 3WXM Loggi ng Options 48 9 3 In the Log Event Level list, select one of the following event levels:  Critical — A critical condition has occurred that requires immediate res ol ut ion .  Wa r n i n g — An event that might requir e attention has occurred.  Info — Informational messages only . No action is r equir ed.  Debu[...]

490 C HAPTER A: C HANGING 3WXM P REFERENCE S[...]

B C HANGING 3WXM S ERVICES P RE F E RE N C E S This chapter discusses how to change 3WXM Services pr eferences. Overview T o set 3WXM Services pr eferences, select T ools > 3WXM Services Setup from the toolbar in the main 3WXM window . See the following figure on the next page. This chapter describes how to change monitoring service prefe rences[...]

492 C HAPTER B: C HANGING 3WXM S ERVICES P R EFERENCES The 3WXM Services Setup window c ont ains a configuration ar ea and a message ar ea at the bottom. When you click Save to implement ch anges you make on one of the window’ s tabs , the monitoring service verifies the changes. If the changes are valid, the service implements the changes. Other[...]

Starting or Stopping the 3WXM Services 49 3 Starting or Stopping the 3WXM Services 3WXM Services is started automatica lly when you complete installation and starts automatically whenever you restart your system. 3Com recommends that all clients that a re using 3WXM Services be closed before you stop the ser vices. If a 3WXM client is using a netwo[...]

494 C HAPTER B: C HANGING 3WXM S ERVICES P R EFERENCES Connecting to 3WXM Services If a firewall is enabled on the host where yo u install 3WXM Services, 3WXM Services will not be able to communicate with 3WXM client or with WX switches unless the firewa ll is configured to allow through traffic for the SSL and SNMP ports (443 and 162 by def ault).[...]

Connecting to 3WXM Services 495 If the Certificate Check di alog is displa yed, click Accept . (For mor e certificate options, see the next section, “Certificate Check”.) If the Finish button does not become available, read the last mess age in the message area of the page to determine why the service could not be reached. Her e ar e common err[...]

496 C HAPTER B: C HANGING 3WXM S ERVICES P R EFERENCES T o complete the connection 1 Select one or both of the following options, within 60 seconds after the Certificate Check dialog is displayed:  Always accept self-s igned certificates. — Use this option to configure the 3WXM client to always accept a self-s igned certificate from the 3WXM m[...]

Changing Service Settings 49 7 Changing Service Settings The service settings contr ol the connection parameters, key store information, and access c ontrol to 3WXM Services. The port numbers used by 3WXM Ser v ices must not be used by other applications on the machine where the 3WXM Services is installed. If port 443 or 162 is used by another appl[...]

498 C HAPTER B: C HANGING 3WXM S ERVICES P R EFERENCES (For more information about this option, see “Replacing a Switch and Reusing its Configuration” on page 342.) 7 T o change the name of the key store file that contains the encryp tion keys the 3WXM Services uses for authenti cation with 3WXM, edit the name in the File box. The default name [...]

Changing WX Connection Settings 49 9 By default, 3WXM Services accepts certificates from WX switches re gar dless of whet her they ar e gener ate d by a certificate authority (CA) or they are self-signed certificates. When you disable this option, the Accept self-signed certificates option remains enabled. 6 T o prevent 3WX M Services fr om acce pt[...]

500 C HAPTER B: C HANGING 3WXM S ERVICES P R EFERENCES Changing Monitoring Settings By default, status monitoring and monitoring of WX notificati ons is enabled. Status monitoring supplies data for the Explore and Status Summary windows of the Monitor ta b. SNMP notifications (t raps) generated by WX switches supp ly data for the Client Monitor , R[...]

Changing Monitoring Settings 501 The data for so me reports also requires monit oring options to be enabled. For informat ion, see th e descriptions for each repor t in “Generating Reports” on page 383. T o change monitoring settings T o change monitoring settings, use the fo llowing pr ocedure. 1 Select T ools > 3WXM Se rvices Setup . The 3[...]

502 C HAPTER B: C HANGING 3WXM S ERVICES P R EFERENCES  Low SNR specifies how low the sign al-to-noise ratio (SNR) can be for a radio without tr iggering a TCA. Y ou can specify from 0 to 60 decibels (dB). The default is 20 dB.  Max clients per AP specifies the maximum number of clients that can be associated with a MAP wi thout triggerin g a[...]

Managing Network Plans 503 Managing Network Plans 3WXM Services regularly backs up network plans, at configurable intervals. In addition to these regular backups, you can create a backup at any time. Y ou can create a backup fr om within 3WXM or at a command line. Fr om within 3WXM, you also can change the settings for automatic backups. T o manage[...]

504 C HAPTER B: C HANGING 3WXM S ERVICES P R EFERENCES Changing Backup Settings T o change settings for automat ic backups 1 Access the Backup/Restore dialog. 2 T o change how often 3WXM automa tically backs up network plan s, select Hourly or Da ily from the Backup interval drop-down list. If you select Daily , specify th e time to c rea te the ba[...]

Managing Network Plans 505 5 T ype the IP address of the host where the other instance of 3WXM Services is installed. 3WXM Services must be running on the host to which you want to transfer the backup. 6 If the port on which the other instance of 3WXM Services listens fo r traffic from 3WXM is dif fer ent from the default, edit the number in the Se[...]

506 C HAPTER B: C HANGING 3WXM S ERVICES P R EFERENCES[...]

C O BTAINING S UPPORT FOR YOUR P R ODUCT Register Y our Product W arranty and other service benefits start from the date of purchase, so it is important to register your product quickly to ensure you get full use of the warranty and other service benefits available to you. W arranty and other service benefits are enabled thr ough product re gistrat[...]

508 C HAPTER C: O BTAINING S UPPORT FOR YOUR P RODUCT T roubleshoot Online Y ou will find support tools posted on the 3Com web site at http://www.3com.com/ 3Com Knowledgebase helps you troubleshoot 3Com products. This query-based interactive tool is located at http://knowledgebase.3com.com and contains thousands of technical solutions written by 3C[...]

Contact Us 509 T o send a product directly to 3Com for repair , you must first obtain a return authorization number (RMA). Pr oducts sent to 3Com, without authorization numbers clearly marked on the outside of the package, will be returned to the sender unopened, at the sender’ s expense. If your product is r egistered and under warranty , you ca[...]

510 C HAPTER C: O BTAINING S UPPORT FOR YOUR P RODUCT From the following countries, you may use the numbers s hown: Austria Belgium Denmark Finland France Germany Hungary Ireland Israel Italy 01 7956 7124 070 700 770 7010 7289 01080 2783 0825 809 622 01805 404 747 06800 12813 1407 3387 1800 945 379 4 199 161346 Luxembourg Netherlands Norway Poland [...]

I NDEX Numbers 3WXM restricting access to 50 software r equir ements 23 3WXM client installing 24 3WXM service installing 24 802.1Q tagging 209 802.1X configuring 303 802.1X authentication standard 303 A access control entries. See ACEs (access contr ol entries) access control lists. See ACL s (access control lists) ACL mapping 228 ACLs (access con[...]

512 I NDEX distributing WX software images 355 DNS (Domain Name System) configuring 203 drawing cropping, paper space 84 E error resolving 364 Event Viewer deleting filters 382 exporting filtered data 382 filtering by content 379 by facility 381 by severity 381 filters deleting 382 predefined 378 saving 382 predefined filters 378 reviewing event de[...]

I NDEX 513 M MAC address users creating 291 MAC user groups creating 292 management services configuring 186 MAP Auto-AP profile 269 MAP signatures enabling 285 mapping an ACL 228 MAPs configuring 272 configuring directly-connected 178, 275 configuring radio profiles 263 configuring radios 281 rebooting 356 Mobility Domains creating 62 definition 6[...]

514 I NDEX R radio profiles configuring 263 defined 263 radios configuring 281 RADIUS (Remote Authenticati on Dial-In User Services) server groups connecting to 298 defining 300 RADIUS (Remote Authenticati on Dial-In User Services) servers connecting to 298 defining default values 301 rebooting MAPs 356 WX switches 356 reports work orders 155 RF de[...]

I NDEX 515 configuring DHCP server 219 IGMP 214 static multicast ports 215 STP fast convergence 213 creating 207 definition 206 mapping ACLs to 228 roaming 207 tagging 209 tunnel affinity 218 users 206 W warnin g res ol vin g 364 watch list adding users to 437 Web AAA (W eb Portal) enabling 186 Web Portal enabling 186 wired authentication ports 179[...]

516 I NDEX[...]