Cisco 3900 Series, 2900 Series, and 1900 Series Software Configuration Guide

SUMMARY STEPS

1. interface wlan-ap0

2. ip address subnet mask

3. no shut

4. interface vlan1

5. ip address subnet mask

6. exit

7. exit

8. service-module wlan-ap 0 session

DETAILED STEPS

Tip If you want to create an IOS software alias for the Console to session into the wireless device, enter the alias exec dot11radio service-module wlan-ap 0 session command at the EXEC prompt. After entering this command, you automatically skip to the dot11 radio level in the IOS.

Closing the Session

To close the session between the wireless device and the router’s console, perform both of the following steps.

Wireless Device

1. Control-Shift-6 x

Router

2. disconnect

3. Press Enter twice.

Cisco Express Setup

To configure the Cisco Unified wireless device use the web-browser Cisco Express Setup tool:

Step 1 Establish a Console connection to the wireless device and get the BVI IP address by entering the show interface bvi1 IOS command.

Step 2 Open a browser window and enter the BVI IP address in the browser-window address line. Press enter and an Enter Network Password window appears.

Step 3 Enter your username. Cisco is the default User Name.

Step 4 Enter the wireless device password. Cisco is the default password. The Summary Status page appears. See the following URL for details about using the web-browser configuration page:
http://cisco.com/en/US/docs/wireless/access_point/12.4_10b_JA/configuration/guide/
scg12410b-chap4-first.html#wp1103336

Cisco IOS CLI

To configure the Autonomous wireless device, establish a session between the router and the access point, then use the Cisco IOS CLI tool:

• Configuring the Radio
• Configuring Wireless Security Settings
• Configuring Wireless Quality of Service (Optional)
• Configuring the Access Point in Hot Standby Mode (Optional)

Configuring the Radio

Configure the radio parameters on the wireless device to transmit signals. See “Configuring Radio Settings,” for specific configuration procedures.

Configuring Wireless Security Settings

• Configuring Authentication
• Configuring WEP and Cipher Suites
• Configuring Wireless VLANs
• Configuring the Access Point in Hot Standby Mode

Configuring Authentication

Authentication types are tied to the Service Set Identifiers (SSIDs) that are configured for the access point. If you want to serve different types of client devices with the same access point, configure multiple SSIDs.

Before a wireless client device can communicate on your network through the access point, it must authenticate to the access point by using open or shared-key authentication. For maximum security, client devices should also authenticate to your network using MAC-address or Extensible Authentication Protocol (EAP) authentication. Both of these authentication types rely on an authentication server on your network.

See Authentication Types for Wireless Devices at Cisco.com to select an authentication type: http://www.cisco.com/en/US/docs/routers/access/wireless/software/guide/
SecurityAuthenticationTypes.html

See RADIUS and TACACS+ Servers in a Wireless Environment at Cisco.com to set up a maximum security environment: http://www.cisco.com/en/US/docs/routers/access/wireless/software/guide/
SecurityRadiusTacacs_1.html.

Configuring Access Point as Local Authenticator

To provide local authentication service or backup authentication service for a WAN link failure or circumstance where a server fails, you can configure an access point to act as a local authentication server. The access point can authenticate up to 50 wireless client devices using Light Extensible Authentication Protocol (LEAP), Extensible Authentication Protocol-Flexible Authentication Secure Tunneling (EAP-FAST), or MAC-based authentication. The access point performs up to five authentications per second.

You configure the local authenticator access point manually with client user names and passwords because it does not synchronize its database with Remote Authentication Dial-In User Service (RADIUS) servers. You can specify a VLAN and a list of SSIDs that a client is allowed to use.

See Using the Access Point as a Local Authenticator at Cisco.com for details about setting up the wireless device in this role: http://www.cisco.com/en/US/docs/routers/access/wireless/software/guide/
SecurityLocalAuthent.html

Configuring WEP and Cipher Suites

Wired Equivalent Privacy (WEP) encryption scrambles the data transmitted between wireless devices to keep the communication private. Wireless devices and their wireless client devices use the same WEP key to encrypt and decrypt data. WEP keys encrypt both unicast and multicast messages. Unicast messages are addressed to one device on the network. Multicast messages are addressed to multiple devices on the network.

Cipher suites are sets of encryption and integrity algorithms designed to protect radio communication on your wireless LAN. You must use a cipher suite to enable Wi-Fi Protected Access (WPA) or Cisco Centralized Key Management (CCKM).

Cipher suites that contain TKIP provide the best security for your wireless LAN. Cipher suites that contain only WEP are the least secure.

See Configuring WEP and Cipher Suites for encryption procedures: http://www.cisco.com/en/US/docs/routers/access/wireless/software/guide/
SecurityCipherSuitesWEP.html

Configuring Wireless VLANs

If you use VLANs on your wireless LAN and assign SSIDs to VLANs you can create multiple SSIDs by using any of the four security settings defined in the “Security Types” section. A VLAN can be thought of as a broadcast domain that exists within a defined set of switches. A VLAN consists of a number of end systems, either hosts or network equipment (such as bridges and routers), connected by a single bridging domain. The bridging domain is supported on various pieces of network equipment such as LAN switches that operate bridging protocols between them with a separate group of protocols for each VLAN.

See Configuring Wireless VLANs at Cisco.com for more about wireless VLAN architecture: http://www.cisco.com/en/US/docs/routers/access/wireless/software/guide/
wireless_vlans.html

Note If you do not use VLANs on your wireless LAN, the security options that you can assign to SSIDs are limited because the encryption settings and authentication types are linked on the Express Security page.

Assigning SSIDs

You can configure up to 16 SSIDs on a wireless device in the role of an access point and configure a unique set of parameters for each SSID. For example, you might use one SSID to allow guests to have limited access to the network and another SSID to allow authorized users to have access to secure data.

See Service Set Identifiers at Cisco.com for more about creating multiple SSIDs, http://www.cisco.com/en/US/docs/routers/access/wireless/software/guide/ServiceSetID.html.

Note Without VLANs, encryption settings (WEP and ciphers) apply to an interface, such as the 2.4-GHz radio, and you cannot use more than one encryption setting on an interface. For example, when you create an SSID with static WEP with VLANs disabled, you cannot create additional SSIDs with Wi-Fi Protected Access (WPA) authentication because the SSIDs use different encryption settings. If you find that the security setting for an SSID conflicts with the settings for another SSID, you can delete one or more SSIDs to eliminate the conflict.

Security Types

Table 1 describes the four security types that you can assign to an SSID.

Configuring Wireless Quality of Service

Configuring Quality of Service (QoS) can provide preferential treatment to certain traffic at the expense of other traffic. Without QoS, the device offers best-effort service to each packet, regardless of the packet contents or size. It sends the packets without any assurance of reliability, delay bounds, or throughput. To configure quality of service (QoS) for your wireless device, see Quality of Service in a Wireless Environment at: http://www.cisco.com/en/US/docs/routers/access/wireless/software/guide/QualityOfService.html.

Configuring the Access Point in Hot Standby Mode

In hot standby mode, an access point is designated as a backup for another access point. The standby access point is placed near the access point that it monitors and is configured exactly like the monitored access point. The standby access point associates with the monitored access point as a client and sends Internet Access Point Protocol (IAPP) queries to the monitored access point through the Ethernet and radio ports. If the monitored access point fails to respond, the standby access point comes online and takes the monitored access point’s place in the network.

Except for the IP address, the standby access point’s settings should be identical to the settings on the monitored access point. If the monitored access point goes off line and the standby access point takes its place in the network, matching settings ensure that client devices can switch easily to the standby access point. See Hot Standby Access Points at Cisco.com for more information: http://www.cisco.com/en/US/docs/routers/access/wireless/software/guide/RolesHotStandby.html.

Preparing for the Upgrade

Perform these tasks to prepare for the upgrade:

• Secure an IP Address on the Access Point
• Prior to the Upgrade

Secure an IP Address on the Access Point

Secure an IP address on the access point so it can communicate with the WLC and download the Unified image upon boot up. The host router provides the access point DHCP server functionality through the DHCP pool. Then the access point communicates with the WLC and setup option 43 for the controller IP address in the DHCP pool configuration. The following is a sample configuration:

For more information about the WLC discovery process, see Cisco Wireless LAN Configuration Guide at Cisco.com : http://www.cisco.com/en/US/docs/wireless/controller/4.0/configuration/guide/ccfig40.html

Prior to the Upgrade

Perform the following steps.

1. Ping the WLC from the router to confirm IP connectivity.

2. Enter the service-module wlan-ap 0 session command to establish a session with the access point.

3. Confirm that the access point is running an autonomous boot image.

4. Enter the show boot command on the access point to confirm the mode setting is enabled. The following is sample output for the command:

Performing the Upgrade

To upgrade to Unified software, follow these steps:

Step 1 Issue the service-module wlan-ap 0 bootimage unified command to change the access point boot image to the Unified upgrade image, which is also known as a recovery image.

Note If the service-module wlan-ap 0 bootimage unified command does not work successfully, check to see whether the software license is still eligible.

On the access point console, use the show boot command to identify the access point’s boot image path:

Step 2 Issue the service-module wlan-ap 0 reload command to perform a graceful shutdown and reboot the access point and complete the upgrade process. Session into the access point and monitor the upgrade process.

See the “Cisco Express Setup” section for details about using the Web-based configuration page to configure the wireless device settings.

Troubleshooting an Upgrade or Reverting the AP to Autonomous Mode

Q. My access point failed to upgrade from autonomous software to Unified software and it appears to be stuck in the recovery mode. What is my next step?

Check the following items:

– Is the IP address on the BVI interface on the same subnet as the WLC?

– Can you ping the WLC from the router/access point to confirm connectivity?

– Is the access point set to the current date and time? Use the show clock command to confirm this information.

Q. My access point is attempting to boot, but it keeps failing. Why?
My access point is stuck in the recovery image and will not upgrade to the Unified software. Why?

The access point is stuck in recovery mode and you must use the service-module wlan-ap0 reset bootloader command to return the access point back to bootloader for manual image recovery.

Downgrading the Software on the Access Point

Use the service-module wlan-ap0 bootimage autonomous command to reset the access point BOOT back to the last autonomous image. Use the service-module wlan-ap 0 reload command to reload the access point with the autonomous software image.

Recovering Software on the Access Point

To recover the image on the access point, use the service-module wlan-ap0 reset bootloader command. This command returns the access point to the bootloader for manual image recovery.