- Show Commands for Viewing the Configuration
- show 802.11
- show 802.11 cleanair
- show 802.11 cleanair air-quality summary
- show 802.11 cleanair air-quality worst
- show 802.11 cleanair device ap
- show 802.11 cleanair device type
- show 802.11 cu-metrics
- show 802.11 extended
- show 802.11 l2roam
- show 802.11 media-stream
- show aaa auth
- show acl
- show acl cpu
- show advanced 802.11 channel
- show advanced 802.11 coverage
- show advanced 802.11 group
- show advanced 802.11 logging
- show advanced 802.11 monitor
- show advanced 802.11 profile
- show advanced 802.11 receiver
- show advanced 802.11 summary
- show advanced 802.11 txpower
- show advanced backup-controller
- show advanced client-handoff
- show advanced dot11-padding
- show advanced eap
- show advanced max-1x-sessions
- show advanced probe
- show advanced rate
- show advanced sip-preferred-call-no
- show advanced statistics
- show advanced timers
- show ap auto-rf
- show ap ccx rm
- show ap cdp
- show ap channel
- show ap config
- show ap config global
- show ap core-dump
- show ap crash-file
- show ap data-plane
- show ap eventlog
- show ap image
- show ap inventory
- show ap join stats detailed
- show ap join stats summary
- show ap join stats summary all
- show ap led-state
- show ap link-encryption
- show ap monitor-mode summary
- show ap retransmit
- show ap stats
- show ap summary
- show ap tcp-mss-adjust
- show ap wlan
- show arp kernel
- show arp switch
- show auth-list
- show boot
- show cac voice summary
- show call-control ap
- show call-control client
- show certificate compatibility
- show certificate lsc
- show certificate summary
- show route kernel
- show client ap
- show client calls
- show client ccx client-capability
- show client ccx frame-data
- show client ccx last-response-status
- show client ccx last-test-status
- show client ccx log-response
- show client ccx manufacturer-info
- show client ccx operating-parameters
- show client ccx profiles
- show client ccx results
- show client ccx rm
- show client ccx stats-report
- show client detail
- show client location-calibration summary
- show client probing
- show client roam-history
- show client summary
- show client summary guest-lan
- show client tsm
- show client username
- show client voice-diag
- show country
- show country channels
- show country supported
- show coredump summary
- show cpu
- show custom-web
- show database summary
- show debug
- show dhcp
- show dtls connections
- show dhcp proxy
- show dhcp timeout
- show eventlog
- show exclusionlist
- show flexconnect acl detailed
- show flexconnect acl summary
- show guest-lan
- show flexconnect group detail
- show flexconnect group summary
- show flexconnect office-extend
- show ike
- show interface
- show interface group
- show invalid-config
- show inventory
- show IPsec
- show lag eth-port-hash
- show lag ip-port-hash
- show lag summary
- show ldap
- show ldap statistics
- show ldap summary
- show license agent
- show license all
- show license capacity
- show license detail
- show license expiring
- show license evaluation
- show license feature
- show license file
- show license handle
- show license image-level
- show license in-use
- show license permanent
- show license status
- show license statistics
- show license summary
- show license udi
- show load-balancing
- show local-auth certificates
- show local-auth config
- show local-auth statistics
- show location
- show location statistics rfid
- show logging
- show loginsession
- show macfilter
- show memory monitor
- show reset
- show remote-lan
- show ipv6 acl
- show ipv6 neighbor-binding
- show ipv6 ra-guard
- show ipv6 summary
- show media-stream client
- show media-stream group detail
- show media-stream group summary
- show mesh ap
- show mesh astools stats
- show mesh backhaul
- show mesh cac
- show mesh client-access
- show mesh config
- show mesh env
- show mesh neigh
- show mesh path
- show mesh per-stats
- show mesh queue-stats
- show mesh public-safety
- show mesh security-stats
- show mesh stats
- show mgmtuser
- show mobility anchor
- show mobility foreign-map
- show mobility statistics
- show mobility summary
- show msglog
- show nac statistics
- show nac summary
- show netuser
- show netuser guest-roles
- show network
- show network summary
- show network multicast mgid detail
- show network multicast mgid summary
- show nmsp statistics
- show nmsp status
- show nmsp subscription
- show ntp-keys
- show pmk-cache
- show port
- show process
- show qos
- show radius acct statistics
- show radius auth statistics
- show radius rfc3576 statistics
- show radius summary
- show rfid client
- show rfid config
- show rfid detail
- show rfid summary
- show rf-profile summary
- show rf-profile details
- show rogue adhoc detailed
- show rogue adhoc summary
- show rogue ap clients
- show rogue ap detailed
- show rogue ap summary
- show rogue ap friendly summary
- show rogue ap malicious summary
- show rogue ap unclassified summary
- show rogue auto-contain
- show rogue client detailed
- show rogue client summary
- show rogue ignore-list
- show rogue rule detailed
- show rogue rule summary
- show route summary
- show rules
- show run-config
- show serial
- show sessions
- show snmpcommunity
- show snmpengineID
- show snmptrap
- show snmpv3user
- show snmpversion
- show spanningtree port
- show spanningtree switch
- show stats port
- show stats switch
- show switchconfig
- show sysinfo
- show tacacs acct statistics
- show tacacs athr statistics
- show tacacs auth statistics
- show tacacs summary
- show tech-support
- show time
- show trapflags
- show traplog
- show wlan
- show wps ap-authentication summary
- show wps cids-sensor
- show wps mfp
- show wps shun-list
- show wps signature detail
- show wps signature events
- show wps signature summary
- show wps summary
- show wps wips statistics
- show wps wips summary
- Configuring Controller Settings
CLI Commands
The Cisco Wireless LAN solution command-line interface (CLI) enables operators to connect an ASCII console to the Cisco Wireless LAN Controller and configure the controller and its associated access points.
This chapter contains the commands available in the Cisco Wireless LAN Controller release 7.2. The controllers currently covered are as follows:
- Cisco 5500 and Flex 7500 Series Wireless LAN Controllers
- Cisco Wireless Services Modules (WiSMs)
- Cisco Wireless LAN Controller Network Modules
- Catalyst 3750G Integrated Wireless LAN Controller Switches
This chapter contains the following sections:
- Show Commands for Viewing the Configuration
- Configuring Controller Settings
- Saving Configurations
- Clearing Configurations, Logfiles, and Other Actions
- Uploading and Downloading Files and Configurations
- Installing and Modifying Licenses
- Troubleshooting Commands
- Integrated Management Module Commands in Cisco Flex 7500 Series Controllers
Show Commands for Viewing the Configuration
To display Cisco Wireless LAN Controller options and settings, use the show commands.
- Show 802.11 Commands
- Show ACL Commands
- Show Advanced 802.11 Commands
- Show Access Point Commands
- Show Client Commands
- Show IPv6 Commands
- Show Media-Stream Commands
- Show Mesh Commands
- Show Mobility Commands
- Show RADIUS Commands
- Show Radio Frequency ID Commands
- Show RF-Profile Commands
- Show Rogue Commands
- Show TACACS Commands
- Show WPS Commands
Show 802.11 Commands
Use the show 802.11 commands to display more detailed 802.11a, 802.11b/g, or other supported 802.11 network settings.
show 802.11
To display basic 802.11a, 802.11b/g, or 802.11h network settings, use the show 802.11 command.
Syntax Description
Command Default
Examples
This example shows to display basic 802.11a network settings:
This example shows how to display basic 802.11h network settings:
Related Commands
show ap stats
show ap summary
show client summary
show interface
show network
show network summary
show port
show wlan
show 802.11 cleanair
To display the multicast-direct configuration state, use the show 802.11 cleanair command.
show 802.11 { a | b } cleanair config
Syntax Description
Command Default
Examples
This example shows how to display the 802.11a cleanair configuration:
Related Commands
config 802.11 cleanair alarm
config 802.11 cleanair device
show 802.11 cleanair air-quality summary
show 802.11 cleanair device ap
show 802.11 cleanair device type
show 802.11 cleanair air-quality summary
To display the air quality summary information for the 802.11 networks, use the
show 802.11 cleanair air-quality summary command.
show 802.11 { a | b } cleanair air-quality summary
Syntax Description
Displays a summary of 802.11 radio band air quality information. |
Command Default
Examples
This example shows how to display a summary of the air quality information for the 802.11a network:
Related Commands
config 802.11 cleanair alarm
config 802.11 cleanair device
show 802.11 cleanair
show 802.11 cleanair device ap
show 802.11 cleanair device type
show 802.11 cleanair air-quality worst
To display the worst air quality information for the 802.11 networks, use the
show 802.11 cleanair air-quality worst command.
show 802.11 { a | b } cleanair air-quality worst
Syntax Description
Displays the worst air quality information for 802.11 networks. |
Command Default
Examples
This example shows how to display worst air quality information for the 802.11a network:
Related Commands
config 802.11 cleanair alarm
config 802.11 cleanair device
show 802.11 cleanair
show 802.11 cleanair device ap
show 802.11 cleanair device type
show 802.11 cleanair device ap
To display the information of the device access point on the 802.11 radio band, use the show 802.11 cleanair device ap command.
show 802.11 { a | b } cleanair device ap cisco_ap
Syntax Description
Command Default
Examples
This example shows how to display the device access point for the 802.11a network:
Related Commands
config 802.11 cleanair alarm
config 802.11 cleanair device
show 802.11 cleanair
show 802.11 cleanair air-quality summary
show 802.11 cleanair device type
show 802.11 cleanair device type
To display the information of all the interferers device type detected by a specific access point on the 802.11 radio band, use the show 802.11 cleanair device type command.
show 802.11 { a | b } cleanair device type device_type
Syntax Description
Command Default
Examples
This example shows how to display the information of all the interferers detected by a specified access point for the 802.11a network:
show 802.11 cu-metrics
To display access point channel utilization metrics, use the show 802.11 cu-metrics command.
show 802.11 { a | b } cu-metrics cisco_ap
Syntax Description
Command Default
Examples
This example shows how to display AP channel utilization metrics of the AP myAP1:
show 802.11 extended
To display access point radio extended configurations, use the show 802.11 extended command.
show 802.11 { a | b } extended
Syntax Description
Command Default
Examples
This example shows how to display radio extended configurations:
show 802.11 l2roam
To display 802.11a or 802.11b/g Layer 2 client roaming information, use the show 802.11 l2roam command.
show 802.11 { a | b } l2roam {rf-param | statistics mac_address }
Syntax Description
Command Default
Examples
This example shows how to display 802.11b Layer 2 client roaming information, enter this command:
L2Roam 802.11bg RF Parameters.....................
Related Commands
show 802.11 media-stream
To display the multicast-direct configuration state, use the show 802.11 media-stream command.
show 802.11 { a | b } media-stream media-stream_name
Syntax Description
Command Default
Examples
This example shows how to display the media-stream configuration:
Related Commands
Show ACL Commands
Use the show acl commands to display system access control lists.
show aaa auth
To display the configuration settings for the AAA authentication server database, use the show aaa auth command.
Syntax Description
Command Default
Examples
This example shows how to display the configuration settings for the AAA authentication server database:
Related Commands
show acl
To display the access control lists (ACLs) that are configured on the controller, use the show acl command.
show acl { summary | detailed acl_name }
Syntax Description
Displays a summary of all ACLs configured on the controller. |
|
Command Default
Examples
This example shows how to display a summary of the access control lists:
This example shows how to display the detailed information of the access control lists:
Note The Counter field increments each time a packet matches an ACL rule, and the DenyCounter field increments each time a packet does not match any of the rules.
Related Commands
clear acl counters
config acl apply
config acl counter
config acl cpu
config acl create
config acl delete
Configure Interface Group Commands
config acl rule
show acl cpu
show acl cpu
To display the access control lists (ACLs) configured on the central processing unit (CPU), use the show acl cpu command.
Syntax Description
Command Default
Examples
This example shows how to display the access control lists on the CPU:
Related Commands
clear acl counters
config acl apply
config acl counter
config acl cpu
config acl create
config acl delete
config acl rule
Configure Interface Group Commands
show acl
Show Advanced 802.11 Commands
Use the show advanced 802.11 commands to display more detailed or advanced 802.11a, 802.11b/g, or other supported 802.11 network settings.
show advanced 802.11 channel
To display the automatic channel assignment configuration and statistics, use the show advanced 802.11 channel command.
show advanced 802.11 { a | b } channel
Syntax Description
Command Default
Examples
This example shows how to display the automatic channel assignment configuration and statistics:
Related Commands
config advanced 802.11 channel add
config advanced 802.11 channel cleanair-event
config advanced 802.11 channel dca anchor-time
config advanced 802.11 channel dca chan-width-11n
config advanced 802.11 channel dca interval
config advanced 802.11 channel dca sensitivity
config advanced 802.11 channel foreign
config advanced 802.11 channel load
config advanced 802.11 channel noise
config advanced 802.11 channel update
show advanced 802.11 channel
show advanced 802.11 coverage
To display the configuration and statistics for coverage hole detection, use the show advanced 802.11 coverage command.
show advanced 802.11 { a | b } coverage
Syntax Description
Command Default
Examples
This example shows how to display the statistics for coverage hole detection:
Related Commands
config advanced 802.11 coverage
config advanced 802.11 coverage exception global
config advanced 802.11 coverage fail-rate
config advanced 802.11 coverage level global
config advanced 802.11 coverage packet-count
config advanced 802.11 coverage rssi-threshold
show advanced 802.11 coverage
show advanced 802.11 group
To display 802.11a or 802.11b Cisco radio RF grouping, use the show advanced 802.11 group command.
show advanced 802.11 { a | b } group
Syntax Description
Command Default
Examples
This example shows how to display Cisco radio RF group settings:
Related Commands
show advanced 802.11 logging
To display 802.11a or 802.11b RF event and performance logging, use the show advanced 802.11 logging command.
show advanced 802.11 { a | b } logging
Syntax Description
Command Default
Examples
This example shows how to display 802.11b RF event and performance logging:
Related Commands
config advanced 802.11 logging channel
config advanced 802.11 logging coverage
config advanced 802.11 logging foreign
config advanced 802.11 logging load
config advanced 802.11 logging noise
config advanced 802.11 logging performance
config advanced 802.11 logging txpower
show advanced 802.11 channel
show advanced 802.11 monitor
To display the 802.11a or 802.11b default Cisco radio monitoring, use the show advanced 802.11 monitor command.
show advanced 802.11 { a | b } monitor
Syntax Description
Command Default
Examples
This example shows how to display the radio monitoring for the 802.11b network:
Related Commands
config advanced 802.11 monitor load
config advanced 802.11 monitor mode
config advanced 802.11 monitor noise
config advanced 802.11 monitor signal
show advanced 802.11 profile
To display the 802.11a or 802.11b lightweight access point performance profiles, use the show advanced 802.11 profile command.
show advanced 802.11 { a | b } profile { global | cisco_ap }
Syntax Description
Command Default
Examples
This example shows how to display the global configuration and statistics of an 802.11a profile:
This example shows how to display the configuration and statistics of a specific access point profile:
This response indicates that the performance profile for this lightweight access point is using the global defaults and has not been individually configured.
Related Commands
config advanced 802.11 profile clients
config advanced 802.11 profile customize
config advanced 802.11 profile foreign
config advanced 802.11 profile noise
show advanced 802.11 receiver
To display the configuration and statistics of the 802.11a or 802.11b receiver, use the show advanced 802.11 receiver command.
show advanced 802.11 { a | b } receiver
Syntax Description
Command Default
Examples
This example shows how to display the configuration and statistics of the 802.11a network settings:
Related Commands
show advanced 802.11 summary
To display the 802.11a or 802.11b Cisco lightweight access point name, channel, and transmit level summary, use the show advanced 802.11 summary command.
show advanced 802.11 { a | b } summary
Syntax Description
Command Default
Examples
This example shows how to display a summary of the 802.11b access point settings:
Note An asterisk (*) next to a channel number or power level indicates that it is being controlled by the global algorithm settings.
Related Commands
config advanced 802.11 7920VSIEConfig
config advanced 802.11 channel add
show advanced 802.11 channel
show advanced 802.11 txpower
To display the 802.11a or 802.11b automatic transmit power assignment, use the show advanced 802.11 txpower command.
show advanced 802.11 { a | b } txpower
Syntax Description
Command Default
Examples
This example shows how to display the configuration and statistics of the 802.11b transmit power cost:
Related Commands
show advanced backup-controller
To display a list of primary and secondary backup controllers, use the show advanced backup-controller command.
show advanced backup-controller
Syntax Description
Command Default
Examples
This example shows how to display the backup controller information:
Related Commands
config advanced backup-controller primary
config advanced backup-controller secondary
show advanced client-handoff
To display the number of automatic client handoffs after retries, use the show advanced client-handoff command.
Syntax Description
Command Default
Examples
This example shows how to display the client auto handoff mode after excessive retries:
Related Commands
show advanced dot11-padding
To display the state of over-the-air frame padding on a wireless LAN controller, use the show advanced dot11-padding command.
Syntax Description
Command Default
Examples
This example shows how to view the state of over-the-air frame padding:
Related Commands
config advanced dot11-padding
debug dot11
debug dot11 mgmt interface
debug dot11 mgmt msg
debug dot11 mgmt ssid
debug dot11 mgmt state-machine
debug dot11 mgmt station
show advanced eap
To display Extensible Authentication Protocol (EAP) settings, use the show advanced eap command.
Syntax Description
Command Default
Examples
This example shows how to display the EAP settings:
Related Commands
config advanced eap
config advanced timers eap-identity-request-delay
config advanced timers eap-timeout
show advanced max-1x-sessions
To display the maximum number of simultaneous 802.1X sessions allowed per access point, use the show advanced max-1x-sessions command.
Syntax Description
Command Default
Examples
This example shows how to display the maximum 802.1X sessions per access point:
Related Commands
show advanced probe
To display the number of probes sent to the WLAN controller per access point per client and the probe interval in milliseconds, use the show advanced probe command.
Syntax Description
Command Default
Examples
This example shows how to display the probe settings for the WLAN controller:
Probes fwd to controller per client per radio.... 12
Probe request rate-limiting interval............. 100 msec
Related Commands
show advanced rate
To display whether control path rate limiting is enabled or disabled, use the show advanced rate command.
Syntax Description
Command Default
Examples
This example shows how to display the switch control path rate limiting mode:
Related Commands
show advanced sip-preferred-call-no
To display the list of preferred call numbers, use the show advanced sip-preferred-call-no command.
show advanced sip-preferred-call-no
Syntax Description
Command Default
Examples
This example shows how to display the list of preferred call numbers:
show advanced statistics
To display whether or not the Cisco wireless LAN controller port statistics are enabled or disabled, use the show advanced statistics command.
Syntax Description
Command Default
Examples
This example shows how to display switch port statistics mode:
Related Commands
show advanced timers
To display the mobility anchor, authentication response, and rogue access point entry timers, use the show advanced timers command.
Syntax Description
Command Default
Examples
This example shows how to display the system timers setting:
Related Commands
config advanced timers ap-discovery-timeout
config advanced timers ap-fast-heartbeat
config advanced timers ap-heartbeat-timeout
config advanced timers ap-primary-discovery-timeout
config advanced timers auth-timeout
config advanced timers eap-identity-request-delay
config advanced timers eap-timeout
Show Access Point Commands
show ap auto-rf
To display the auto-RF settings for a Cisco lightweight access point, use the show ap auto-rf command.
show ap auto-rf 802.11 { a | b } cisco_ap
Syntax Description
Command Default
Examples
This example shows how to display auto-RF information for an access point:
show ap ccx rm
To display an access point’s Cisco Client eXtensions (CCX) radio management status information, use the show ap ccx rm command.
Syntax Description
Displays the CCX radio management status information for an access point. |
Command Default
Examples
This example shows how to display the status of the CCX radio management:
Related Commands
show ap cdp
To display the Cisco Discovery Protocol (CDP) information for an access point, use the show ap cdp command.
show ap cdp { all | ap-name cisco_ap | neighbors { all | ap-name cisco_ap | detail cisco_ap }}
Syntax Description
Displays details about a specific access point neighbor using CDP. |
|
Command Default
Examples
This example shows how to display the CDP status of all access points:
This example shows how to display the CDP status of a specified access point:
This example shows how to display details about all neighbors using CDP:
This example shows how to display details about a specific neighbor with a specified access point using CDP:
This example shows how to display details about neighbors using CDP:
Related Commands
show ap channel
To display the available channels for a specific mesh access point, use the show ap channel command.
Syntax Description
Command Default
Examples
This example shows how to display the available channels for a particular access point:
Related Commands
config 802.11-a channel ap
config 802.11h channelswitch
config 802.11h setchannel
show ap config
To display the detailed configuration for a lightweight access point, use the show ap config command.
show ap config { 802.11 { a | b }} [ summary ] cisco_ap
Syntax Description
Command Default
Examples
This example shows how to display the detailed configuration for an access point:
This example shows how to display the detailed configuration for another access point:
This example shows how to display the general configuration of a Cisco access point:
Related Commands
show ap config global
To display the global syslog server settings for all access points that join the controller, use the show ap config global command.
Syntax Description
Command Default
Examples
This example shows how to display global syslog server settings:
Related Commands
show ap core-dump
To display the memory core dump information for a lightweight access point, use the show ap core-dump command.
Syntax Description
Command Default
Examples
This example shows how to display memory core dump information:
Related Commands
show ap crash-file
To display the list of both crash and radio core dump files generated by lightweight access points, use the show ap crash-file command.
Syntax Description
Command Default
Examples
This example shows how to display the crash file generated by the access point:
Related Commands
config ap crash-file clear-all
config ap crash-file delete
config ap crash-file get-crash-file
config ap crash-file get-radio-core-dump
show ap data-plane
To display the data plane status for all access points or a specific access point, use the show ap data-plane command.
show ap data-plane { all | cisco_ap }
Syntax Description
Command Default
Examples
This example shows how to display the data plane status of all access points:
show ap eventlog
To display the contents of the event log file for an access point that is joined to the controller, use the show ap eventlog command.
Syntax Description
Command Default
Examples
This example shows how to display the event log of an access point:
show ap image
To display the detailed information about the predownloaded image for specified access points, use the
show ap image command.
show ap image { cisco_ap | all}
Syntax Description
Note If you have an AP that has the name all, it conflicts with the keyword all that specifies all access points. In this scenario, the keyword all takes precedence over the AP that is named all.
Command Default
Examples
This example shows how to display images present on all access points:
Related Commands
show ap inventory
To display inventory information for an access point, use the show ap inventory command.
Syntax Description
Command Default
Examples
This example shows how to display the inventory of an access point:
show ap join stats detailed
To display all join-related statistics collected for a specific access point, use the show ap join stats detailed command.
show ap join stats detailed ap_mac
Syntax Description
Access point Ethernet MAC address or the MAC address of the 802.11 radio interface. |
Command Default
Examples
This example shows how to display join information for a specific access point trying to join the controller:
Related Commands
show ap join stats detailed
show ap join stats summary
show ap join stats summary all
show ap join stats summary
To display the last join error detail for a specific access point, use the show ap join stats summary command.
show ap join stats summary ap_mac
Syntax Description
Access point Ethernet MAC address or the MAC address of the 802.11 radio interface. |
Command Default
Usage Guidelines
To obtain the MAC address of the 802.11 radio interface, enter the show interface command on the access point.
Examples
This example shows how to display specific join information for an access point:
Related Commands
show ap join stats summary all
To display the MAC addresses of all the access points that are joined to the controller or that have tried to join, use the show ap join stats summary all command.
show ap join stats summary all
Syntax Description
Command Default
Examples
This example shows how to display a summary of join information for all access points:
Related Commands
show ap led-state
To view the LED state of all access points or a specific access point, use the show ap led-state command.
show ap led-state {all | cisco_ap }
Syntax Description
Command Default
Examples
This example shows how to get the LED state of all access points:
Related Commands
show ap link-encryption
To display the MAC addresses of all the access points that are joined to the controller or that have tried to join, use the show ap link-encryption command.
show ap link-encryption {all | cisco_ap }
Syntax Description
Command Default
Examples
This example shows how to display the link encryption status of all access points:
Related Commands
show ap monitor-mode summary
To display the current channel-optimized monitor mode settings, use the show ap monitor-mode summary command.
Syntax Description
Command Default
Examples
This example shows how to display current channel-optimized monitor mode settings:
AP Name Ethernet MAC Status Scanning Channel List
------------------ ----------------- ---------- ----------------------
Related Commands
show ap retransmit
To display access point control packet retransmission parameters, use the show ap retransmit command.
show ap retransmit {all | cisco_ap }
Syntax Description
Command Default
Examples
This example shows how to display the control packet retransmission parameters of all access points on a network:
Related Commands
show ap stats
To display the statistics for a Cisco lightweight access point, use the show ap stats command.
show ap stats { 802.11 { a | b } | wlan } cisco_ap [tsm {client_mac | all}]
Syntax Description
Command Default
Examples
This example shows how to display statistics of an access point for the 802.11b network:
Related Commands
show ap summary
To display a summary of all lightweight access points attached to the controller, use the show ap summary command.
Syntax Description
(Optional) Type sequence of characters that make up the name of a specific AP or a group of APs, or enter a wild character search pattern. |
Command Default
Usage Guidelines
A list that contains each lightweight access point name, number of slots, manufacturer, MAC address, location, and the controller port number appears. When you specify
Examples
This example shows how to display a summary of all connected access points:
Related Commands
show ap tcp-mss-adjust
To display the Transmission Control Protocol (TCP) maximum segment size (MSS) information of access points, use the show ap tcp-mss-adjust command.
show ap tcp-mss-adjust { cisco_ap | all }
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Examples
This example shows how to display Transmission Control Protocol (TCP) maximum segment size (MSS) information of all access points:
Related Commands
show ap wlan
To display the Basic Service Set Identifier (BSSID) value for each WLAN defined on an access point, use the show ap wlan command.
show ap wlan 802.11 { a | b } cisco_ap
Syntax Description
Command Default
Examples
This example shows how to display BSSIDs of an access point for the 802.11b network:
Related Commands
show arp kernel
To display the kernel Address Resolution Protocol (ARP) cache information, use the show arp kernel command.
Syntax Description
Command Default
Examples
This example shows how to display kernel ARP cache information:
Related Commands
show arp switch
To display the Cisco wireless LAN controller MAC addresses, IP addresses, and port types, use the show arp switch command.
Syntax Description
Command Default
Examples
This example shows how to display Address Resolution Protocol (ARP) cache information for the switch:
Related Commands
show auth-list
To display the access point authorization list, use the show auth-list command.
Syntax Description
Command Default
Examples
This example shows how to display the access point authorization list:
Related Commands
clear tacacs auth statistics
clear stats local-auth
config auth-list add
config auth-list ap-policy
config auth-list delete
show boot
To display the primary and backup software build numbers with an indication of which is active, use the show boot command.
Syntax Description
Command Default
Usage Guidelines
Each Cisco wireless LAN controller retains one primary and one backup operating system software load in nonvolatile RAM to allow controllers to boot off the primary load (default) or revert to the backup load when desired.
Examples
This example shows how to display the default boot image information:
Related Commands
show cac voice summary
To view the list of all AP with brief voice statistics ( which includes bandwidth used, maximum bandwidth available, and the number of calls information), use the show cac voice summary command.
show cac voice { summary | stats 802.11 {a | b} AP_name }
Syntax Description
Command Default
Examples
This example shows how to display the list of all AP with brief voice statistics:
Related Commands
show call-control ap
Note The show call-control ap command is applicable only for SIP based calls.
To see the metrics for successful calls or the traps generated for failed calls, use the show call-control ap command.
show call-control ap { 802.11a | 802.11b } cisco_ap { metrics | traps }
Syntax Description
Command Default
Examples
This example shows how to display the metrics for successful calls generated for an access point:
This example shows how to display the metrics for the traps generated for an access point:
Usage Guidelines
To aid in troubleshooting, the output of this command shows an error code for any failed calls. Table 2-1 explains the possible error codes for failed calls.
show call-control client
To see call information for a call-aware client when Voice-over-IP (VoIP) snooping is enabled and the call is active, use the show call-control client command
show call-control client callInfo client_MAC_address
Syntax Description
Command Default
Examples
This example shows how to display the call information such as the IP port for calls related to the client:
Related Commands
show certificate compatibility
To display whether or not certificates are verified as compatible in the Cisco wireless LAN controller, use the show certificate compatibility command.
show certificate compatibility
Syntax Description
Command Default
Examples
This example shows how to display the status of the compatibility mode:
Related Commands
config certificate
config certificate lsc
show certificate lsc
show certificate summary
show local-auth certificates
show certificate lsc
To verify that the controller has generated a Locally Significant Certificate (LSC), use the show certificate lsc summary command.
show certificate lsc { summary | ap-provision }
Syntax Description
Displays a summary of LSC certificate settings and certificates. |
|
Displays details about the access points that are provisioned using the LSC. |
Command Default
Examples
This example shows how to display a summary of the LSC:
This example shows how to display the details about the access points that are provisioned using the LSC:
Related Commands
config certificate
config certificate lsc
show certificate compatibility
show certificate summary
show local-auth certificates
show certificate summary
To verify that the controller has generated a certificate, use the show certificate summary command.
Syntax Description
Command Default
Examples
This example shows how to display a summary of the certificate:
Related Commands
config certificate
config certificate lsc
show certificate compatibility
show certificate lsc
show local-auth certificates
show route kernel
To display the kernel route cache information, use the show route kernel command.
Syntax Description
Command Default
Examples
This example shows how to display the kernel route cache information:
Related Commands
clear arp
debug arp
show arp kernel
config route add
config route delete
Show Client Commands
show client ap
To display the clients on a Cisco lightweight access point, use the show client ap command.
show client ap 802.11 { a | b } cisco_ap
Syntax Description
Command Default
Usage Guidelines
The show client ap command may list the status of automatically disabled clients. Use the show exclusionlist command to view clients on the exclusion list (blacklisted).
Examples
This example shows how to display client information on an access point:
Related Commands
show client detail
show client summary
show client username
show country
show exclusionlist
show client calls
To display the total number of active or rejected calls on the controller, use the show client calls command.
show client calls { active | rejected } { 802.11a | 802.11bg | all }
Syntax Description
Command Default
Examples
This example shows how to display the active client calls on an 802.11a network:
Related Commands
show client ccx client-capability
To display the client’s capability information, use the show client ccx client-capability command.
show client ccx client-capability client_mac_address
Syntax Description
Command Default
Usage Guidelines
This command displays the client’s available capabilities, not the current settings for the capabilities.
Examples
This example shows how to display the client’s capability:
Related Commands
config client ccx get-client-capability
config client ccx get-operating-parameters
config client ccx get-profiles
config client ccx stats-request
show client ccx operating-parameters
show client ccx profiles
show client ccx stats-report
show client ccx frame-data
To display the data frames sent from the client for the last test, use the show client ccx frame-data command.
show client ccx frame-data client_mac_address
Syntax Description
Command Default
Examples
This example shows how to display the data frame sent from the client for the last test:
show client ccx last-response-status
To display the status of the last test response, use the show client ccx last-response-status command.
show client ccx last-response-status client_mac_address
Syntax Description
Command Default
Examples
This example shows how to display the status of the last test response:
Test Status........................ Success
Related Commands
config client ccx clear-reports
config client ccx clear-results
config client ccx default-gw-ping
config client ccx dhcp-test
config client ccx log-request
show client ccx last-response-status
show client ccx last-test-status
show client ccx last-test-status
To display the status of the last test, use the show client ccx last-test-status command.
show client ccx last-test-status client_mac_address
Syntax Description
Command Default
Examples
This example shows how to display the status of the last test of the client:
Test Type........................ Gateway Ping Test
Related Commands
config client ccx clear-reports
config client ccx clear-results
config client ccx default-gw-ping
config client ccx dhcp-test
config client ccx log-request
show client ccx last-response-status
show client ccx log-response
To display a log response, use the show client ccx log-response command.
show client ccx log-response { roam | rsna | syslog } client_mac_address
Syntax Description
Command Default
Examples
This example shows how to display the system log response:
This example shows how to display the client roaming log response:
Related Commands
show client ccx manufacturer-info
To display the client manufacturing information, use the show client ccx manufacturer-info command.
show client ccx manufacturer-info client_mac_address
Syntax Description
Command Default
Examples
This example shows how to display the client manufacturing information:
Related Commands
config client ccx get-client-capability
config client ccx get-manufacturer-info
config client ccx get-operating-parameters
config client ccx get-profiles
show client ccx operating-parameters
To display the client operating-parameters, use the show client ccx operating-parameters command.
show client ccx operating-parameters client_mac_address
Syntax Description
Command Default
Examples
This example shows how to display the client operating parameters:
Related Commands
config client ccx get-client-capability
config client ccx get-manufacturer-info
config client ccx get-operating-parameters
config client ccx get-profiles
show client ccx profiles
To display the client profiles, use the show client ccx profiles command.
show client ccx profiles client_mac_address
Syntax Description
Command Default
Examples
This example shows how to display the client profiles:
Related Commands
config client ccx get-client-capability
config client ccx get-manufacturer-info
config client ccx get-operating-parameters
config client ccx get-profiles
show client ccx results
To display the results from the last successful diagnostic test, use the show client ccx results command.
show client ccx results client_mac_address
Syntax Description
Command Default
Examples
This example shows how to display the results from the last successful diagnostic test:
Related Commands
config client ccx test-abort
config client ccx test-association
config client ccx test-dot1x
config client ccx test-profile
config client ccx clear-reports
config client ccx clear-results
show client ccx rm
To display Cisco Client eXtension (CCX) client radio management report information, use the show client ccx rm commands.
show client ccx rm client_MAC {status} | {report {chan-load | noise-hist | frame | beacon | pathloss}}
Syntax Description
Displays the client CCX radio management status information. |
|
Command Default
Examples
This example shows how to display the client radio management status information:
Channel Load Request............................. Enabled
Noise Histogram Request.......................... Enabled
Beacon Request................................... Enabled
Frame Request.................................... Enabled
Interval......................................... 30
Iteration........................................... 10
This example shows how to display the client radio management load reports:
Client Mac Address............................... 00:40:96:ae:53:bc
Timestamp........................................ 788751121
Incapable Flag................................... On
Refused Flag........................................ On
-----------------------
1 194
2 86
3 103
4 0
5 178
6 82
7 103
8 95
9 13
10 222
11 75
This example shows how to display the client radio management noise histogram reports:
Noise Histogram Report
Client Mac Address............................... 00:40:96:15:21:ac
Timestamp........................................ 4294967295
Incapable Flag................................... Off
Refused Flag........................................ Off
Related Commands
config client ccx default-gw-ping
config client ccx dhcp-test
show client ccx stats-report
To display the Cisco Client eXtensions (CCX) statistics report from a specified client device, use the show client ccx stats-report command.
show client ccx stats-report client_mac_address
Syntax Description
Command Default
Examples
This example shows how to displays the statistics report:
Related Commands
config client ccx default-gw-ping
config client ccx dhcp-test
config client ccx dns-ping
show client detail
To display detailed information for a client on a Cisco lightweight access point, use the show client detail command.
show client detail mac_address
Syntax Description
Command Default
Usage Guidelines
The show client ap command may list the status of automatically disabled clients. Use the show exclusionlist command to display clients on the exclusion list (blacklisted).
Examples
This example shows how to display the client detailed information:
Related Commands
show client location-calibration summary
To display client location calibration summary information, use the show client location-calibration summary command.
show client location-calibration summary
Syntax Description
Command Default
Examples
This example shows how to display the location calibration summary information:
Related Commands
show client probing
To display the number of probing clients, use the show client probing command.
Syntax Description
Command Default
Examples
This example shows how to display the number of probing clients:
Related Commands
show client roam-history
To display the roaming history of a specified client, use the show client roam-history command.
show client roam-history mac_address
Syntax Description
Command Default
Examples
This example shows how to display the roaming history of a specified client:
show client summary
To display a summary of clients associated with a Cisco lightweight access point, use the show client summary command.
Syntax Description
Command Default
Usage Guidelines
The show client ap command may list the status of automatically disabled clients. Use the show exclusionlist command to display clients on the exclusion list (blacklisted).
Examples
This example shows how to display a summary of the active clients:
Related Commands
show client summary guest-lan
To display the active wired guest LAN clients, use the show client summary guest-lan command.
Syntax Description
Command Default
Examples
This example shows how to display a summary of the active wired guest LAN clients:
Related Commands
show client tsm
To display the client traffic stream metrics (TSM) statistics, use the show client tsm command.
show client tsm 802.11 { a | b } client_mac { ap_mac | all }
Syntax Description
Specifies the list of all access points to which the client has associations. |
Command Default
Examples
This example shows how to display the client’s TSM for the 802.11a network:
Related Commands
show client username
To display the client data by the username, use the show client username command.
Syntax Description
Command Default
Examples
This example shows how to display the detailed information for a client by name:
Related Commands
show client voice-diag
To display voice diagnostics statistics, use the show client voice-diag command.
show client voice-diag {quos-map | roam-history | rssi | status | tspec}
Syntax Description
Command Default
Examples
This example shows how to display the status of voice diagnostics for clients:
Related Commands
show client ap
show client detail
show client summary
debug voice-diag
show country
To display the configured country and the radio types supported, use the show country command.
Syntax Description
Command Default
Examples
This example shows how to display the configured countries and supported radio types:
Related Commands
show country channels
To display the radio channels supported in the configured country, use the show country channels command.
Syntax Description
Command Default
Examples
This example shows how to display the auto-RF channels for the configured countries:
Related Commands
show country supported
To display a list of the supported country options, use the show country supported command.
Syntax Description
Command Default
Examples
This example shows how to display a list of all the supported countries:
Related Commands
show coredump summary
To display a summary of the controller’s core dump file, use the show coredump summary command.
Syntax Description
Command Default
Examples
This example shows how to display the core dump summary:
Related Commands
config coredump
config coredump ftp
config coredump username
show cpu
To display current WLAN controller CPU usage information, use the show cpu command.
Syntax Description
Command Default
Examples
This example shows how to display the current CPU usage information:
show custom-web
To display web authentication customization information, use the show custom-web command.
Syntax Description
Command Default
Examples
This example shows how to display the web authentication customization information:
Related Commands
config custom-web ext-webauth-mode
config custom-web ext-webauth-url
config custom-web ext-webserver
config custom-web redirectUrl
config custom-web webauth-type
config custom-web weblogo
config custom-web webmessage
config custom-web webtitle
show database summary
To display the maximum number of entries in the database, use the show database summary command.
Syntax Description
Command Default
Examples
This example shows how to display a summary of the local database configuration:
Related Commands
show debug
To determine if the MAC address and other flag debugging is enabled or disabled, sse the show debug command.
Syntax Description
Command Default
Examples
This example shows how to display if debugging is enabled:
Related Commands
show dhcp
To display the internal Dynamic Host Configuration Protocol (DHCP) server configuration, use the show dhcp command.
show dhcp { leases | summary | scope }
Syntax Description
Name of a scope to display the DHCP information for that scope. |
Command Default
Examples
This example shows how to display the allocated DHCP leases:
This example shows how to display the DHCP summary information:
This example shows how to display the DHCP information for the scope 003:
Related Commands
config dhcp
config dhcp proxy
config interface dhcp
config wlan dhcp_server
debug dhcp
debug dhcp service-port
debug disable-all
show dhcp proxy
show dtls connections
To display the Datagram Transport Layer Security (DTLS) server status, use the show dtls connections command.
Syntax Description
Command Default
Examples
This example shows how to display the established DTLS connections:
show dhcp proxy
To display the status of DHCP proxy handling, use the show dhcp proxy command.
Syntax Description
Command Default
Examples
This example shows how to display the status of dhcp proxy information:
Related Commands
config dhcp
config dhcp proxy
config interface dhcp
config wlan dhcp_server
debug dhcp
debug dhcp service-port
debug disable-all
show dhcp
show dhcp timeout
To display the DHCP timeout value, use the show dhcp timeout command.
Syntax Description
Command Default
Examples
This example shows how to display the DHCP timeout value:
Related Commands
config dhcp
config dhcp timeout
config interface dhcp
config wlan dhcp_server
debug dhcp
debug dhcp service-port
debug disable-all
show dhcp
show eventlog
To display the event log, use the show eventlog command.
Syntax Description
Command Default
Examples
This example shows how to display the event log entries:
show exclusionlist
To display a summary of all clients on the manual exclusion list (blacklisted) from associating with this Cisco wireless LAN controller, use the show exclusionlist command.
Syntax Description
Command Default
Usage Guidelines
Examples
This example shows how to display the exclusion list:
Related Commands
show flexconnect acl detailed
To display a detailed summary of FlexConnect access control lists, use the show flexconnect acl detailed command.
show flexconnect acl detailed acl-name
Syntax Description
Command Default
Examples
This example shows how to display the flexconnect detailed acls:
show flexconnect acl summary
To display a summary of all access control lists on FlexConnect access points, use the show flexconnect acl summary command.
Syntax Description
Command Default
Examples
This example shows how to display the flexconnect acl summary:
>
show flexconnect acl summary
show guest-lan
To display the configuration of a specific wired guest LAN, use the show guest-lan command.
Syntax Description
Command Default
Usage Guidelines
To display all wired guest LANs configured on the controller, use the show guest-lan summary command.
Examples
This example shows how to display the guest LAN configuration:
Related Commands
config guest-lan
config guest-lan custom-web ext-webauth-url
config guest-lan custom-web global disable
config guest-lan custom-web login_page
config guest-lan nac
config guest-lan security
show flexconnect group detail
To display the details for a specific FlexConnect group, use the show flexconnect group detail command.
show flexconnect group detail group_name
Syntax Description
Command Default
Examples
This example shows how to display the detailed information for a specific FlexConnect group:
Related Commands
show flexconnect group summary
To display the current list of FlexConnect groups, use the show flexconnect group summary command.
show flexconnect group summary
Syntax Description
Command Default
Examples
This example shows how to display the current list of FlexConnect groups:
Related Commands
show flexconnect office-extend
To display FlexConnect OfficeExtend access point information, use the show flexconnect office-extend command.
show flexconnect office-extend { summary | latency }
Syntax Description
Command Default
Examples
This example shows how to display information about the list of FlexConnect officeExtend access points:
This example shows how to display the FlexConnect officeExtend access point’s link delay:
Related Commands
show ike
To display active Internet Key Exchange (IKE) security associations (SAs), use the show ike command.
show ike { brief | detailed } IP_or_MAC_address
Syntax Description
Command Default
Examples
This example shows how to display the active Internet Key Exchange security associations:
show interface
To display details of the system interfaces, use the show interface command:
show interface { summary | detailed interface_name }
Syntax Description
Command Default
Examples
This example shows how to display a summary of the local interfaces:
This example shows how to display the detailed interface information:
Note Some WLAN controllers may have only one physical port listed because they have only one physical port.
Related Commands
show interface group
To display details of system interface groups, use the show interface group command:
show interface group { summary | detailed interface_group_name }
Syntax Description
Command Default
Examples
This example shows how to display a summary of local interface groups:
This example shows how to display the detailed interface group information:
Related Commands
show invalid-config
To see any ignored commands or invalid configuration values in an edited configuration file, use the show invalid-config command.
Syntax Description
Command Default
Usage Guidelines
You can execute this command only before the clear config or save config command.
Examples
This example shows how to display a list of any ignored commands or invalid configuration values in a configuration file:
show inventory
To display a physical inventory of the Cisco wireless LAN controller, use the show inventory command.
Syntax Description
Command Default
Usage Guidelines
Some wireless LAN controllers may have no crypto accelerator (VPN termination module) or power supplies listed because they have no provisions for VPN termination modules or power supplies.
Examples
This example shows how to display a physical inventory of the controller:
Related Commands
show IPsec
To display active Internet Protocol Security (IPsec) security associations (SAs), use the show IPsec command.
show IPsec { brief | detailed } IP_or_MAC_address
Syntax Description
Command Default
Examples
This example shows how to display brief information about the active Internet Protocol Security (IPsec) security associations (SAs):
Related Commands
config radius acct ipsec authentication
config radius acct ipsec disable
config radius acct ipsec enable
config radius acct ipsec encryption
config radius acct ipsec ike
config radius auth IPsec authentication
config radius auth IPsec disable
config radius auth IPsec encryption
config radius auth IPsec ike
config trapflags IPsec
config wlan security IPsec disable
config wlan security IPsec enable
config wlan security IPsec authentication
config wlan security IPsec encryption
config wlan security IPsec config
config wlan security IPsec ike authentication
config wlan security IPsec ike dh-group
config wlan security IPsec ike lifetime
config wlan security IPsec ike phase1
config wlan security IPsec ike contivity
show lag eth-port-hash
To display the physical port used for specific MAC addresses, use the show lag eth-port-hash command.
show lag eth-port-hash dest_MAC [ source_MAC ]
Syntax Description
(Optional) MAC address to determine output port for non-IP packets. |
Command Default
Examples
This example shows how to display the physical port used for a specific MAC address:
Related Commands
show lag ip-port-hash
To display the physical port used for specific IP addresses, use the show lag ip-port-hash command.
show lag ip-port-hash dest_IP [ source_IP ]
Syntax Description
(Optional) IP address to determine the output port for IP packets. |
Command Default
Usage Guidelines
For CAPWAP packets, enter the AP's IP address. For EOIP packets, enter the WLC's IP address. For WIRED_GUEST packets, enter its IP address. For nontunneled IP packets from WLC, enter the destination IP address. For other nontunneled IP packets, enter both destination and source IP addresses.
Examples
This example shows how to display the physical port used for a specific IP address:
Related Commands
show lag summary
To display the current link aggregation (LAG) status, use the show lag summary command.
Syntax Description
Command Default
Examples
This example shows how to display the current status of the LAG configuration:
Related Commands
show ldap
To display the Lightweight Directory Access Protocol (LDAP) server information for a particular LDAP server, use the show ldap command.
Syntax Description
Command Default
Examples
This example shows how to display the detailed LDAP server information:
Related Commands
config ldap
config ldap add
config ldap simple-bind
show ldap statistics
show ldap summary
show ldap statistics
To display all Lightweight Directory Access Protocol (LDAP) server information, use the show ldap statistics command.
Syntax Description
Examples
This example shows how to display the LDAP server statistics:
Related Commands
config ldap
config ldap add
config ldap simple-bind
show ldap
show ldap summary
show ldap summary
To display the current Lightweight Directory Access Protocol (LDAP) server status, use the show ldap summary command.
Syntax Description
Command Default
Examples
This example shows how to display a summary of configured LDAP servers:
Idx Server Address Port Enabled
Related Commands
config ldap
config ldap add
config ldap simple-bind
show ldap
show ldap statistics
show license agent
To display the license agent counter and session information on the Cisco 5500 Series Controller, use the show license agent command.
show license agent { counters | sessions }
Syntax Description
Command Default
Examples
This example shows how to display the license agent counters information:
This example shows how to display the license agent sessions information:
Related Commands
config license agent
clear license agent
show license all
show license detail
show license feature
show license image-level
show license summary
show license all
To display information for all licenses on the Cisco 5500 Series Controller, use the show license all command.
Syntax Description
Command Default
Examples
This example shows how to display all the licenses:
Related Commands
license install
license modify priority
show license agent
show license detail
show license feature
show license image-level
show license summary
show license capacity
To display the maximum number of access points allowed for this license on the Cisco 5500 Series Controller, the number of access points currently joined to the controller, and the number of access points that can still join the controller, use the show license capacity command.
Syntax Description
Command Default
Examples
This example shows how to display the license capacity:
Related Commands
license install
license modify priority
show license agent
show license all
show license detail
show license feature
show license image-level
show license summary
show license detail
To display details of a specific license on the Cisco 5500 Series Controller, use the show license detail command.
show license detail license_name
Syntax Description
Command Default
Examples
This example shows how to display the license details:
Related Commands
license install
license modify priority
show license agent
show license all
show license feature
show license image-level
show license summary
show license expiring
To display details of expiring licenses on the Cisco 5500 Series Controller, use the show license expiring command.
Syntax Description
Command Default
Examples
This example shows how to display the details of the expiring licenses:
Related Commands
license install
license modify priority
show license all
show license detail
show license evaluation
show license in-use
show license summary
show license evaluation
To display details of evaluation licenses on the Cisco 5500 Series Controller, use the show license evaluation command.
Syntax Description
Command Default
Examples
This example shows how to display the details of the evaluation licenses:
Related Commands
license install
license modify priority
show license all
show license detail
show license expiring
show license in-use
show license summary
show license feature
To display a summary of license-enabled features on the Cisco 5500 Series Controller, use the show license feature command.
Syntax Description
Command Default
Examples
This example shows how to display the license-enabled features:
Related Commands
license install
license modify priority
show license all
show license detail
show license expiring
show license evaluation
show license image-level
show license in-use
show license summary
show license file
To display a summary of license-enabled features on the Cisco 5500 Series Controller, use the show license file command.
Syntax Description
Examples
This example shows how to display the license files:
Related Commands
license install
show license all
show license detail
show license expiring
show license feature
show license image-level
show license in-use
show license summary
show license handle
To display the license handles on the Cisco 5500 Series Controller, use the show license handle command.
Syntax Description
Command Default
Examples
This example shows how to display the license handles:
Related Commands
license install
show license all
show license detail
show license expiring
show license feature
show license image-level
show license in-use
show license summary
show license image-level
To display the license image level that is in use on the Cisco 5500 Series Controller, use the show license image-level command.
Syntax Description
Command Default
Examples
This example shows how to display the image level license settings:
Related Commands
license install
license modify priority
show license all
show license detail
show license expiring
show license feature
show license in-use
show license summary
show license in-use
To display the licenses that are in use on the Cisco 5500 Series Controller, use the show license in-use command.
Syntax Description
Command Default
Examples
This example shows how to display the licenses that are in use:
Related Commands
license install
license modify priority
show license all
show license detail
show license evaluation
show license expiring
show license feature
show license image-level
show license permanent
show license summary
show license permanent
To display the permanent licenses on the Cisco 5500 Series Controller, use the show license permanent command.
Syntax Description
Command Default
Examples
This example shows how to display the permanent license’s information:
Related Commands
license install
license modify priority
show license all
show license detail
show license evaluation
show license expiring
show license feature
show license image-level
show license in-use
show license summary
show license status
To display the license status on the Cisco 5500 Series Controller, use the show license status command.
Syntax Description
Command Default
Examples
This example shows how to display the license status:
Related Commands
license install
license modify priority
show license all
show license detail
show license evaluation
show license expiring
show license feature
show license image-level
show license permanent
show license summary
show license statistics
To display license statistics on the Cisco 5500 Series Controller, use the show license statistics command.
Syntax Description
Command Default
Examples
This example shows how to display the license statistics:
Related Commands
license install
license modify priority
show license all
show license detail
show license evaluation
show license expiring
show license feature
show license image-level
show license permanent
show license summary
show license summary
To display a brief summary of all licenses on the Cisco 5500 Series Controller, use the show license summary command.
Syntax Description
Command Default
Examples
This example shows how to display a brief summary of all licenses:
Related Commands
license install
license modify priority
show license all
show license detail
show license evaluation
show license expiring
show license feature
show license image-level
show license permanent
show license summary
show license udi
To display unique device identifier (UDI) values for licenses on the Cisco 5500 Series Controller, use the show license udi command.
Syntax Description
Command Default
Examples
This example shows how to display the UDI values for licenses:
Related Commands
license install
license modify priority
show license all
show license detail
show license evaluation
show license expiring
show license feature
show license image-level
show license permanent
show license summary
show load-balancing
To display the status of the load-balancing feature, use the show load-balancing command.
Syntax Description
Command Default
Examples
This example shows how to display the load-balancing status:
Related Commands
show local-auth certificates
To display local authentication certificate information, use the show local-auth certificates command:
Syntax Description
Command Default
Examples
This example shows how to display the authentication certificate information stored locally:
Certificate issuer.............................. vendor
OU=WNBU Sydney, CN=wnbu-syd-acs-a.cisco.com
Issuer: C=AU, ST=NSW, L=Sydney, O=Cisco Systems
OU=WNBU Sydney, CN=wnbu-syd-acs-a.cisco.com
Valid: 2005 Jun 15th, 04:53:49 GMT to 2008 Jun 15th, 05:03:34 GMT
Device certificate:
Subject: MAILTO=test@test.net, C=AU, ST=NSW, L=Sydney
O=Cisco Systems, OU=WNBU Sydney, CN=concannon
Issuer: C=AU, ST=NSW, L=Sydney, O=Cisco Systems
OU=WNBU Sydney, CN=wnbu-syd-acs-a.cisco.com
Valid: 2006 Aug 9th, 05:14:16 GMT to 2007 Aug 9th, 05:24:16 GMT
OU=none, CN=ca, MAILTO=support@airespace.com
Issuer: C=US, ST=California, L=San Jose, O=airespace Inc
OU=none, CN=ca, MAILTO=support@airespace.com
Valid: 2003 Feb 12th, 23:38:55 GMT to 2012 Nov 11th, 23:38:55 GMT
Device certificate:
Subject: C=US, ST=California, L=San Jose, O=airespace Inc
CN=000b85335340, MAILTO=support@airespace.com
Issuer: C=US, ST=California, L=San Jose, O=airespace Inc
OU=none, CN=ca, MAILTO=support@airespace.com
Valid: 2005 Feb 22nd, 10:52:58 GMT to 2014 Nov 22nd, 10:52:58 GMT
OU=none, CN=ca, MAILTO=support@airespace.com
Issuer: C=US, ST=California, L=San Jose, O=airespace Inc
OU=none, CN=ca, MAILTO=support@airespace.com
Valid: 2003 Feb 12th, 23:38:55 GMT to 2012 Nov 11th, 23:38:55 GMT
Device certificate:
Subject: C=US, ST=California, L=San Jose, O=airespace Inc
CN=000b85335340, MAILTO=support@airespace.com
Issuer: C=US, ST=California, L=San Jose, O=airespace Inc
OU=none, CN=ca, MAILTO=support@airespace.com
Valid: 2005 Feb 22nd, 10:52:58 GMT to 2014 Nov 22nd, 10:52:58 GMT
Related Commands
clear stats local-auth
config local-auth active-timeout
config local-auth eap-profile
config local-auth method fast
config local-auth user-credentials
debug aaa local-auth
show local-auth config
show local-auth statistics
show local-auth config
To display local authentication configuration information, use the show local-auth config command.
Syntax Description
Command Default
Examples
This example shows how to display the local authentication configuration information:
Related Commands
clear stats local-auth
config local-auth active-timeout
config local-auth eap-profile
config local-auth method fast
config local-auth user-credentials
debug aaa local-auth
show local-auth certificates
show local-auth statistics
show local-auth statistics
To display local Extensible Authentication Protocol (EAP) authentication statistics, use the show local-auth statistics command:
Syntax Description
Command Default
Examples
This example shows how to display the local authentication certificate statistics:
Related Commands
clear stats local-auth
config local-auth active-timeout
config local-auth eap-profile
config local-auth method fast
config local-auth user-credentials
debug aaa local-auth
show local-auth certificates
show local-auth config
show location
To display location system information, use the show location command.
show location [ detail mac_address | summary ]
Syntax Description
Command Default
Examples
This example shows how to display the location summary information:
Related Commands
clear location rfid
clear location statistics rfid
config location
show location statistics rfid
show location statistics rfid
To see any radio frequency identification (RFID)-related errors, use the show location statistics rfid command.
Syntax Description
Command Default
Examples
This example shows how to display the detailed location RFID statistics:
Related Commands
clear location rfid
clear location statistics rfid
config location
show location
show logging
To display the syslog facility logging parameters and buffer contents, use the show logging command.
Syntax Description
Command Default
Examples
This example shows how to display the current settings and buffer content details:
Related Commands
config logging syslog host
config logging syslog facility
config logging syslog level
show loginsession
To display the existing sessions, use the show loginsession command.
Syntax Description
Command Default
Examples
This example shows how to display the current session details:
Related Commands
show macfilter
To display the MAC filter parameters, use the show macfilter command.
show macfilter { summary | detail MAC }
Syntax Description
Command Default
Usage Guidelines
The MAC delimiter (none, colon, or hyphen) for MAC addresses sent to RADIUS servers is displayed. The MAC filter table lists the clients that are always allowed to associate with a wireless LAN.
Examples
This example shows how to display the detailed display of a MAC filter entry:
This example shows how to display a summary of the MAC filter parameters:
Related Commands
config macfilter
config macfilter description
config macfilter interface
config macfilter ip-address
config macfilter mac-delimiter
config macfilter radius-compat
config macfilter wlan-id
show memory monitor
To display a summary of memory analysis settings and any discovered memory issues, use the show memory monitor command.
show memory monitor [ detail ]
Syntax Description
(Optional) Displays details of any memory leaks or corruption. |
Command Default
Usage Guidelines
Be careful when changing the defaults for the config memory monitor command unless you know what you are doing, you have detected a problem, or you are collecting troubleshooting information.
Examples
This example shows how to display a summary of memory monitoring settings and a summary of test results:
This example shows how to display the monitor test results:
Related Commands
config memory monitor errors
config memory monitor leaks
debug memory
show reset
To display the scheduled system reset parameters, use the show reset command.
Syntax Description
Command Default
Examples
This example shows how to display the scheduled system reset parameters:
Related Commands
reset system at
reset system in
reset system cancel
reset system notify-time
show remote-lan
To display information about remote LAN configuration, use the show remote-lan command.
show remote-lan { summary | remote-lan-id }
Syntax Description
Command Default
Examples
This example shows how to display a summary of all remote LANs:
This example shows configuration information about the remote LAN with the remote-lan-id 2:
Related Commands
config memory monitor errors
config memory monitor leaks
debug memory
Show IPv6 Commands
Use the show ipv6 commands to display the IPv6 settings and information.
show ipv6 acl
To display the IPv6 access control lists (ACLs) that are configured on the controller, use the show ipv6 acl command.
show ipv6 acl detailed acl_name | summary
Syntax Description
IPv6 ACL name. The name can be up to 32 alphanumeric characters. |
|
Command Default
Examples
This example shows how to display the detailed information of the access control lists:
Related Commands
show ipv6 neighbor-binding
To display the IPv6 Neigbhor Binding data that are configured on the controller, use the show ipv6 neighbor-binding command.
show ipv6 neighbor-binding {capture-policy | counters | detailed { mac | port | vlan } | features | policies | ra-throttle { statistics vlan_id | routers vlan_id } | summary }
Syntax Description
Command Default
Examples
This example shows how to display the IPv6 Neigbor Binding data summary:
Related Commands
show ipv6 ra-guard
To display the RA guard statistics, use the show ipv6 ra-guard command.
show ipv6 ra-guard{ap | wlc} summary
Syntax Description
Command Default
Examples
This example shows how to display the RA guard statistics for an Access Point:
This example shows how to display the RA guard statistics for an Controller:
Related Commands
show ipv6 summary
To display the IPv6 Configuration settings, use the show ipv6 summary command.
Syntax Description
Command Default
Examples
This example shows how to display the IPv6 Configuration Settings:
Related Commands
Show Media-Stream Commands
Use the show media-stream commands to display the multicast-direct configuration state.
show media-stream client
To display the details for a specific media-stream client or a set of clients, use the show media-stream client command.
show media-stream client media-stream_name | summary
Syntax Description
Name of the media-stream client of which the details is to be displayed. |
|
Command Default
Examples
This example shows how to display a summary media-stream clients:
Related Commands
show media-stream group detail
To display the details for a specific media-stream group, use the show media-stream group detail command.
show media-stream group detail media-stream_name
Syntax Description
Command Default
Examples
This example shows how to display media-stream group configuration details:
Related Commands
show media-stream group summary
To display the summary of the media stream and client information, use the show media-stream group summary command.
show media-stream group summary
Syntax Description
Command Default
Examples
This example shows how to display a summary of the media-stream group:
Related Commands
Show Mesh Commands
To display settings for outdoor and indoor mesh access points, use the show mesh commands.
show mesh ap
To display settings for mesh access points, use the show mesh ap command.
show mesh ap { summary | tree }
Syntax Description
Command Default
Examples
This example shows how to display a summary format:
This example shows how to display settings in a hierarchical (tree) format:
Related Commands
config mesh alarm
config mesh astools
config mesh battery-state
show mesh astools stats
To display antistranding statistics for outdoor mesh access points, use the show mesh astools stats command.
show mesh astools stats [ cisco_ap ]
Syntax Description
(Optional) Antistranding feature statistics for a designated mesh access point. |
Command Default
Examples
This example shows how to display anti-stranding statistics on all outdoor mesh access points:
This example shows how to display anti-stranding statistics for access point sb_map1 :
Related Commands
show mesh backhaul
To check the current backhaul, use the show mesh backhaul command.
Syntax Description
Command Default
Examples
This example shows how to display the current backhaul:
If the current backhaul is 5 GHz, the output is as follows:
Related Commands
show mesh cac
To display call admission control (CAC) topology and the bandwidth used or available in a mesh network, use the show mesh cac command.
show mesh cac { summary | { bwused { voice | video } | access | callpath | rejected } cisco_ap }
Syntax Description
Command Default
Examples
This example shows how to display a summary of the call admission control settings:
This example shows how to display the mesh topology and the voice bandwidth used or available:
This example shows how to display the access voice calls in progress in a tree topology:
Related Commands
config 802.11 cac video acm
config 802.11 cac video max-bandwidth
config 802.11 cac video roam-bandwidth
config 802.11 cac video tspec-inactivity-timeout
config 802.11 cac voice acm
config 802.11 cac voice max-bandwidth
config 802.11 cac voice roam-bandwidth
config 802.11 cac voice tspec-inactivity-timeout
config 802.11 cac voice load-based
debug cac
show mesh client-access
To display the backhaul client access configuration setting, use the show mesh client-access command.
Syntax Description
Command Default
Examples
This example shows how to display backhaul client access configuration settings for a mesh access point:
Related Commands
show mesh config
To display mesh configuration settings, use the show mesh config command.
Syntax Description
Command Default
Examples
This example shows how to display global mesh configuration settings:
Related Commands
show mesh env
To display global or specific environment summary information for mesh networks, use the show mesh env command.
show mesh env { summary | cisco_ap }
Syntax Description
Name of access point for which environment summary information is requested. |
Command Default
Examples
This example shows how to display global environment summary information:
This example shows how to display an environment summary for an access point:
Related Commands
show mesh neigh
To display summary or detailed information about the mesh neighbors for a specific mesh access point, use the show mesh neigh command.
show mesh neigh { detail | summary } { cisco_ap | all }
Syntax Description
Displays the channel and signal-to-noise ratio (SNR) details between the designated mesh access point and its neighbor. |
|
Displays the mesh neighbors for a designated mesh access point. |
|
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Examples
This example shows how to display a neighbor summary of an access point:
This example shows how to display the detailed neighbor statistics of an access point:
Table 2-2 lists the output flags displayed for the config mesh linktest command.
Related Commands
show mesh path
To display the channel and signal-to-noise ratio (SNR) details for a link between a mesh access point and its neighbor, use the show mesh path command.
Syntax Description
Command Default
Examples
This example shows how to display channel and SNR details for a designated link path:
Related Commands
config mesh battery-state
config mesh client-access
config mesh linktest
config mesh range
show mesh config
show mesh neigh
show mesh stats
show mesh per-stats
To display the percentage of packet errors for packets transmitted by the neighbors of a specified mesh access point, use the show mesh per-stats command.
show mesh per-stats summary { cisco_ap | all }
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Usage Guidelines
The packet error rate percentage equals 1, which is the number of successfully transmitted packets divided by the number of total packets transmitted.
Examples
This example shows how to display the percentage of packet errors for packets transmitted by the neighbors to a mesh access point:
Related Commands
config mesh linktest
config mesh range
show mesh config
show mesh neigh
show mesh stats
show mesh queue-stats
To display the number of packets in a client access queue by type for a particular mesh access point, use the show mesh queue-stats command.
show mesh queue-stats { cisco_ap | all }
Syntax Description
Name of access point for which you want packet queue statistics. |
|
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Examples
This example shows how to display packet queue statistics for access point ap417:
Related Commands
config mesh client-access
config mesh multicast
show mesh client-access
show mesh config
show mesh stats
show mgmtuser
show mesh public-safety
To display 4.8-GHz public safety settings, use the show mesh public-safety command.
Syntax Description
Command Default
Examples
This example shows how to view 4.8-GHz public safety settings:
Related Commands
config 802.11-a
config 802.11-a antenna extAntGain
config 802.11-a channel ap
config 802.11-a txpower ap
config mesh public-safety
config mesh security
show mesh ap
show mesh security-stats
show mesh stats
show mesh security-stats
To display packet error statistics for a specific access point, use the show mesh security-stats command.
show mesh security-stats { cisco_ap | all }
Syntax Description
Name of access point for which you want packet error statistics. |
|
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Usage Guidelines
This command shows packet error statistics and a count of failures, timeouts, and successes with respect to associations and authentications as well as reassociations and reauthentications for the specified access point and its child.
Examples
This example shows how to display packet error statistics for access point ap417:
Related Commands
config mesh alarm
config mesh linkdata
config mesh linktest
config mesh security
show mesh stats
To display the mesh statistics for a Cisco lightweight access point, use the show mesh stats command.
Syntax Description
Command Default
Examples
This example shows how to display statistics of an access point:
Related Commands
config mesh alarm
config mesh client-access
config mesh ethernet-bridging vlan-transparent
config mesh linkdata
config mesh linktest
config mesh security
show mesh per-stats
show mesh queue-stats
show mesh security-stats
show mgmtuser
To display the local management user accounts on the Cisco wireless LAN controller, use the show mgmtuser command.
Syntax Description
Command Default
Examples
This example shows how to display a list of management users:
Related Commands
config mgmtuser add
config mgmtuser delete
config mgmtuser description
config mgmtuser password
Show Mobility Commands
Use the show mobility commands to display mobility settings.
show mobility anchor
To display the wireless LAN anchor export list for the Cisco wireless LAN controller mobility groups or to display a list and status of controllers configured as mobility anchors for a specific WLAN or wired guest LAN, use the show mobility anchor command.
show mobility anchor [ wan wlan_id | guest-lan guest_lan_id ]
Syntax Description
Command Default
Usage Guidelines
The status field display (see example) shows one of the following values:
- UP—The controller is reachable and able to pass data.
- CNTRL_PATH_DOWN—The mpings failed. The controller cannot be reached through the control path and is considered failed.
- DATA_PATH_DOWN—The epings failed. The controller cannot be reached and is considered failed.
- CNTRL_DATA_PATH_DOWN—Both the mpings and epings failed. The controller cannot be reached and is considered failed.
Examples
This example shows how to display a mobility wireless LAN anchor list:
Related Commands
config guest-lan mobility anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
config wlan mobility anchor
debug mobility
show mobility anchor
show mobility foreign-map
show mobility statistics
show mobility summary
show mobility foreign-map
To display a mobility wireless LAN foreign map list, use the show mobility foreign-map command.
show mobility foreign-map wlan wlan_id
Syntax Description
Command Default
Examples
This example shows how to get a mobility wireless LAN foreign map list:
Related Commands
config wlan mobility foreign-map
config mobility group member
config wlan mobility anchor
debug mobility
show mobility anchor
show mobility summary
show mobility statistics
To display the statistics information for the Cisco wireless LAN controller mobility groups, use the show mobility statistics command.
Syntax Description
Command Default
Examples
This example shows how to display statistics of the mobility manager:
Related Commands
config mobility group anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
debug mobility
show mobility anchor
show mobility summary
show mobility summary
To display the summary information for the Cisco wireless LAN controller mobility groups, use the show mobility summary command.
Syntax Description
Command Default
Usage Guidelines
Examples
This example shows how to display a summary of the mobility manager:
Related Commands
config guest-lan mobility anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
config wlan mobility anchor
debug mobility
show mobility anchor
show mobility statistics
show msglog
To display the message logs written to the Cisco wireless LAN controller database, use the show msglog command.
Syntax Description
Command Default
Usage Guidelines
If there are more that 15 entries, you are prompted to display the messages shown in the example.
Examples
This example shows how to display message logs:
show nac statistics
To display detailed Network Access Control (NAC) information about a Cisco wireless LAN controller, use the show nac statistics command.
Syntax Description
Command Default
Examples
This example shows how to display detailed statistics of network access control settings:
Related Commands
show nac summary
config guest-lan nac
config wlan nac
debug nac
show nac summary
To display NAC summary information for a Cisco wireless LAN controller, use the show nac summary command.
Syntax Description
Command Default
Examples
This example shows how to display a summary information of network access control settings:
Related Commands
show nac statistics
config guest-lan nac
config wlan nac
debug nac
show netuser
To display the configuration of a particular user in the local user database, use show netuser command.
show netuser { detail user_name | guest-roles | summary }
Syntax Description
Displays detailed information about the specified network user. |
|
Command Default
Examples
This example shows how to display a summary of all users in the local user database:
This example shows how to display detailed information on the specified network user:
Related Commands
config netuser add
config netuser delete
config netuser description
config netuser guest-role apply
config netuser wlan-id
show netuser guest-roles
show netuser guest-roles
To display a list of the current quality of service (QoS) roles and their bandwidth parameters, use the show netuser guest-roles command.
Syntax Description
Command Default
Examples
This example shows how to display a QoS role for the guest network user:
Related Commands
config netuser add
config netuser delete
config netuser description
config netuser guest-role apply
config netuser wlan-id
show netuser guest-roles
show netuser
show network
To display the current status of 802.3 bridging for all WLANs, use the show network command.
Syntax Description
Command Default
Examples
This example shows how to display the network details:
Related Commands
Configure Network Commands
show network summary
show network multicast mgid detail
show network multicast mgid summary
show network summary
To display the network configuration of the Cisco wireless LAN controller, use the show network summary command.
Syntax Description
Command Default
Examples
This example shows how to display a summary configuration:
Related Commands
Configure Network Commands
show network
show network multicast mgid detail
show network multicast mgid summary
show network multicast mgid detail
To display all the clients joined to the multicast group in a specific multicast group identification (MGID), use the show network multicast mgid detail command.
show network multicast mgid detail mgid_value
Syntax Description
Command Default
Examples
This example shows how to display details of the multicast database:
Related Commands
show network
show network summary
show network multicast mgid summary
show network multicast mgid summary
To display all the multicast groups and their corresponding multicast group identifications (MGIDs), use the show network multicast mgid summary command.
show network multicast mgid summary
Syntax Description
Command Default
Examples
This example shows how to display a summary of multicast groups and their MGIDs:
Related Commands
show network
show network summary
show network multicast mgid detail
show nmsp statistics
To display Network Mobility Services Protocol (NMSP) counters, use the show nmsp statistics command.
show nmsp statistics { summary | connection all }
Syntax Description
Command Default
Examples
This example shows how to display a summary of common NMSP counters:
This example shows how to display all the connection-specific NMSP counters:
Related Commands
show nmsp status
To display the status of active Network Mobility Services Protocol (NMSP) connections, use the show nmsp status command.
Syntax Description
Command Default
Examples
This example shows how to display the status of the active NMSP connections:
Related Commands
clear locp statistics
clear nmsp statistics
show nmsp statistics
show nmsp subscription
To display the Network Mobility Services Protocol (NMSP) services that are active on the controller, use the show nmsp subscription command.
show nmsp subscription { summary | detail ip_addr }
Syntax Description
Command Default
Examples
This example shows how to display a summary of all the NMSP services to which the controller is subscribed:
This example shows how to display details of all the NMSP services:
Related Commands
clear locp statistics
clear nmsp statistics
show nmsp statistics
show ntp-keys
To display network time protocol authentication key details, use the show ntp-keys command.
Syntax Description
Command Default
Examples
This example shows how to display NTP authentication key details:
Related Commands
show pmk-cache
To display information about the pairwise master key (PMK) cache, use the show pmk-command command.
Syntax Description
Command Default
Examples
This example shows how to display information about a single entry in the PMK cache:
This example shows how to display information about all entries in the PMK cache:
Related Commands
show port
To display the Cisco wireless LAN controller port settings on an individual or global basis, use the show port command.
Syntax Description
Command Default
Examples
This example shows how to display information about an individual wireless LAN controller port:
Note Some WLAN controllers may not have multicast or Power over Ethernet (PoE) listed because they do not support those features.
This example shows how to display a summary of all ports:
Note Some WLAN controllers may have only one port listed because they have only one physical port.
Related Commands
clear stats port
config ap port
config interface port
config network web-auth port
Configure Port Commands
config spanningtree port mode
config spanningtree port pathcost
config spanningtree port priority
show stats port
show process
To display how various processes in the system are using the CPU at that instant in time, use the show process command.
Syntax Description
Displays how various system tasks are using the CPU at that moment. |
|
Displays the allocation and deallocation of memory from various processes in the system at that moment. |
Command Default
Usage Guidelines
This command is helpful in understanding if any single task is monopolizing the CPU and preventing other tasks from being performed.
Examples
This example shows how to display various tasks in the system that are using the CPU at a given moment:
This example shows how to display the allocation and deallocation of memory from various processes at a given moment:
Related Commands
show qos
To display quality of service (QoS) information, use the show qos command.
show qos { bronze | gold | platinum | silver }
Syntax Description
Displays QoS information for the bronze profile of the WLAN. |
|
Displays QoS information for the platinum profile of the WLAN. |
|
Displays QoS information for the silver profile of the WLAN. |
Command Default
Examples
This example shows how to display QoS information for the silver profile:
Related Commands
Show RADIUS Commands
show radius acct statistics
To display the RADIUS accounting server statistics for the Cisco wireless LAN controller, use the show radius acct statistics command.
Syntax Description
Command Default
Examples
This example shows how to display RADIUS accounting server statistics:
Related Commands
config radius acct
config radius acct ipsec authentication
config radius acct ipsec disable
config radius acct network
show radius auth statistics
show radius summary
show radius auth statistics
To display the RADIUS authentication server statistics for the Cisco wireless LAN controller, use the show radius auth statistics command.
Syntax Description
Command Default
Examples
This example shows how to display RADIUS authentication server statistics:
Related Commands
config radius auth
config radius auth management
config radius auth network
show radius summary
show radius rfc3576 statistics
To display the RADIUS rfc3576 server statistics for the Cisco wireless LAN controller, use the show radius rfc3576 statistics command.
show radius rfc3576 statistics
Syntax Description
Command Default
Usage Guidelines
RFC 3576, an extension to the RADIUS protocol, allows dynamic changes to a user session, which includes support for disconnecting users and changing authorizations applicable to a user session; that is, it provides support for Disconnect and Change-of-Authorization (CoA) messages. Disconnect messages cause a user session to be terminated immediately. CoA messages modify session authorization attributes such as data filters.
Examples
This example shows how to display the RADIUS RFC-3576 server statistics:
Related Commands
config radius auth rfc3576
show radius auth statistics
show radius summary
show radius summary
To display the RADIUS authentication and accounting server summary, use the show radius summary command.
Syntax Description
Command Default
Examples
This example shows how to display a RADIUS authentication server summary:
Related Commands
Show Radio Frequency ID Commands
Use the show rfid commands to display radio frequency ID settings.
show rfid client
To display the radio frequency identification (RFID) tags that are associated to the controller as clients, use the show rfid client command.
Syntax Description
Command Default
Usage Guidelines
When the RFID tag is not in client mode, the above fields are blank.
Examples
This example shows how to display the RFID tag that is associated to the controller as clients:
Related Commands
config rfid status
config rfid timeout
show rfid config
show rfid detail
show rfid summary
show rfid config
To display the current radio frequency identification (RFID) configuration settings, use the show rfid config command.
Syntax Description
Command Default
Examples
This example shows how to display the current RFID configuration settings:
Related Commands
config rfid status
config rfid timeout
show rfid client
show rfid detail
show rfid summary
show rfid detail
To display detailed radio frequency identification (RFID) information for a specified tag, use the show rfid detail command.
Syntax Description
Command Default
Examples
This example shows how to display detailed RFID information:
Related Commands
config rfid status
config rfid timeout
show rfid config
show rfid client
show rfid summary
show rfid summary
To display a summary of the radio frequency identification (RFID) information for a specified tag, use the show rfid summary command.
Syntax Description
Command Default
Examples
This example shows how to display a summary of RFID information:
Related Commands
config rfid status
config rfid timeout
show rfid client
show rfid config
show rfid detail
Show RF-Profile Commands
Use the show RF-Profile commands to display RF profiles details.
show rf-profile summary
To display a summary of RF profiles in the controller, use the show rf-profile summary command.
Syntax Description
Command Default
Examples
This example shows how to display the summary of RF profile:
Related Commands
config rogue adhoc
config rogue rule
show rogue adhoc summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
show rf-profile details
To display the RF profile details in the Cisco wireless LAN controller, use the show rf-profile details command.
show rf-profile details rf-profile-name
Syntax Description
Command Default
Examples
This example shows how to display the list of RF profile:
Related Commands
config rogue adhoc
config rogue rule
show rogue adhoc summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
Show Rogue Commands
Use the show rogue commands to display unverified (rogue) device settings.
show rogue adhoc detailed
To display details of an ad-hoc rogue access point detected by the Cisco wireless LAN controller, use the show rogue adhoc client detailed command.
Syntax Description
Command Default
Examples
This example shows how to display detailed ad-hoc rogue MAC address information:
Related Commands
config rogue adhoc
config rogue rule
show rogue adhoc summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
show rogue adhoc summary
To display a summary of the ad-hoc rogue access points detected by the Cisco wireless LAN controller, use the show rogue adhoc summary command.
Syntax Description
Command Default
Examples
This example shows how to display a summary of all ad-hoc rogues:
Related Commands
config rogue adhoc
config rogue rule
show rogue adhoc detailed
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
show rogue ap clients
To display details of rogue access point clients detected by the Cisco wireless LAN controller, use the show rogue ap clients command.
show rogue ap clients ap_mac_address
Syntax Description
Command Default
Examples
This example shows how to display details of rogue access point clients:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue rule
config trapflags rogueap
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue ap detailed
To display details of a rogue access point detected by the Cisco wireless LAN controller, use the show rogue-ap detailed command.
show rogue ap detailed ap_mac_address
Syntax Description
Command Default
Examples
This example shows how to display detailed information of a rogue access point:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue rule
show rogue ap clients
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue ap summary
To display a summary of the rogue access points detected by the Cisco wireless LAN controller, use the show rogue-ap summary command.
Syntax Description
Command Default
Examples
This example shows how to display a summary of all rogue access points:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue rule
show rogue ap clients
show rogue ap detailed
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue ap friendly summary
To display a list of the friendly rogue access points detected by the controller, use the show rogue-ap friendly summary command.
show rogue ap friendly summary
Syntax Description
Command Default
Examples
This example shows how to display a summary of all friendly rogue access points:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue ap malicious summary
To display a list of the malicious rogue access points detected by the controller, use the show rogue ap malicious summary command.
show rogue ap malicious summary
Syntax Description
Command Default
Examples
This example shows how to display a summary of all malicious rogue access points:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap unclassified summary
show rogue ap unclassified summary
To display a list of the unclassified rogue access points detected by the controller, use the show rogue ap unclassified summary command.
show rogue ap unclassified summary
Syntax Description
Command Default
Examples
This example shows how to display a list of all unclassified rogue access points:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue auto-contain
To display information about rogue auto-containment, use the show rogue auto-contain command.
Syntax Description
Command Default
Examples
This example shows how to display information about rogue auto-containment:
Related Commands
show rogue client detailed
To display details of a rogue client detected by a Cisco wireless LAN controller, use the show rogue client detailed command.
show rogue client detailed MAC
Syntax Description
Command Default
Examples
This example shows how to display detailed information for a rogue client:
Related Commands
show rogue client summary
show rogue ignore-list
config rogue client
config rogue rule
show rogue client summary
To display a summary of the rogue clients detected by the Cisco wireless LAN controller, use the show rogue client summary command.
Syntax Description
Command Default
Examples
This example shows how to display a list of all rogue clients:
Related Commands
show rogue client detailed
show rogue ignore-list
config rogue client
config rogue rule
show rogue ignore-list
To display a list of rogue access points that are configured to be ignored, use the show rogue ignore-list command.
Syntax Description
Command Default
Examples
This example shows how to display a list of all rogue access points that are configured to be ignored:
Related Commands
config rogue adhoc
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue client
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue client detailed
show rogue client summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
show rogue rule detailed
To display detailed information for a specific rogue classification rule, use the show rogue rule detailed command.
show rogue rule detailed rule_name
Syntax Description
Command Default
Examples
This example shows how to display detailed information on a specific rogue classification rule:
Related Commands
config rogue rule
show rogue ignore-list
show rogue rule summary
show rogue rule summary
To display the rogue classification rules that are configured on the controller, use the show rogue rule summary command.
Syntax Description
Command Default
Examples
This example shows how to display a list of all rogue rules that are configured on the controller:
Related Commands
config rogue rule
show rogue ignore-list
show rogue rule detailed
show route summary
To display the routes assigned to the Cisco wireless LAN controller service port, use the show route summary command.
Syntax Description
Command Default
Examples
This example shows how to display all the configured routes:
Related Commands
show rules
To display the active internal firewall rules, use the show rules command.
Syntax Description
Command Default
Examples
This example shows how to display active internal firewall rules:
show run-config
To display a comprehensive view of the current Cisco wireless LAN controller configuration, use the show run-config command.
show run-config [ no ap | commands ]
Syntax Description
(Optional) Displays a list of user-configured commands on the controller. |
Command Default
Usage Guidelines
These commands have replaced the show running-config command.
Some WLAN controllers may have no Crypto Accelerator (VPN termination module) or power supplies listed because they have no provisions for VPN termination modules or power supplies.
The show run-config command shows only values configured by the user. It does not show system-configured default values.
Examples
This example shows how to display the current controller running configuration:
Related Commands
show serial
To display the serial (console) port configuration, use the show serial command.
Syntax Description
Command Default
Examples
This example shows how to display EIA-232 parameters and the serial port inactivity timeout:
Related Commands
show sessions
To display the console port login timeout and maximum number of simultaneous command-line interface (CLI) sessions, use the show sessions command.
Syntax Description
Command Default
Examples
This example shows how to display the CLI session configuration setting:
The response indicates that the CLI sessions never time out and that the Cisco wireless LAN controller can host up to five simultaneous CLI sessions.
Related Commands
show snmpcommunity
To display Simple Network Management Protocol (SNMP) community entries, use the show snmpcommunity command.
Syntax Description
Command Default
Examples
This example shows how to display SNMP community entries:
Related Commands
config snmp community accessmode
config snmp community create
config snmp community delete
config snmp community ipaddr
config snmp community mode
config snmp syscontact
show snmpengineID
To display the SNMP engine ID, use the show snmpengineID command.
Syntax Description
Command Default
Examples
This example shows how to display the SNMP engine ID:
Related Commands
show snmptrap
To display Cisco wireless LAN controller Simple Network Management Protocol (SNMP) trap receivers and their status, use the show snmptrap command.
Syntax Description
Command Default
Examples
This example shows how to display SNMP trap receivers and their status:
Related Commands
config snmp trapreceiver create
config snmp trapreceiver delete
config snmp trapreceiver delete
show snmpv3user
To display Simple Network Management Protocol (SNMP) version 3 configuration, use the show snmpv3user command.
Syntax Description
Command Default
Examples
This example shows how to display SNMP version 3 configuration information:
Related Commands
show snmpversion
To display which versions of Simple Network Management Protocol (SNMP) are enabled or disabled on your controller, use the show snmpversion command.
Syntax Description
Command Default
Examples
This example shows how to display the SNMP v1/v2/v3 status:
Related Commands
show spanningtree port
To display the Cisco wireless LAN controller spanning tree port configuration, use the show spanningtree port command.
Syntax Description
Command Default
Usage Guidelines
When the a Cisco 4400 Series wireless LAN controller is configured for port redundancy, the Spanning Tree Protocol (STP) must be disabled for all ports on the Cisco 4400 Series Wireless LAN Controller. STP can remain enabled on the switch connected to the Cisco 4400 Series Wireless LAN Controller.
Note Some WLAN controllers do not support the spanning tree function.
Examples
This example shows how to display spanning tree values on a per port basis:
Related Commands
config spanningtree port mode
config spanningtree port pathcost
config spanningtree port priority
show spanningtree switch
show spanningtree switch
To display the Cisco wireless LAN controller network (DS port) spanning tree configuration, use the show spanningtree switch command.
Syntax Description
Command Default
Usage Guidelines
Some WLAN controllers do not support the spanning tree function.
Examples
This example shows how to display spanning tree values on a per switch basis:
Related Commands
config spanningtree switch bridgepriority
config spanningtree switch forwarddelay
config spanningtree switch hellotime
config spanningtree switch maxage
config spanningtree switch mode
show stats port
To display physical port receive and transmit statistics, use the show stats port command.
show stats port { detailed port | summary port }
Syntax Description
Command Default
Examples
This example shows how to display the port summary information:
This example shows how to display the detailed port information:
Related Commands
config port adminmode
config port autoneg
config port linktrap
config port power
config port linktrap
show stats switch
To display the network (DS port) receive and transmit statistics, use the show stats switch command.
show stats switch { detailed | summary }
Syntax Description
Command Default
Examples
This example shows how to display switch summary statistics:
This example shows how to display detailed switch statistics:
Related Commands
config switchconfig mode
config switchconfig secret-obfuscation
show switchconfig
show switchconfig
To display parameters that apply to the Cisco wireless LAN controller, use the show switchconfig command.
Syntax Description
Command Default
Examples
This example shows how to display parameters that apply to the Cisco wireless LAN controller:
Related Commands
config switchconfig mode
config switchconfig fips-prerequisite
config switchconfig flowcontrol
config switchconfig strong-pwd
config switchconfig secret-obfuscation
show stats switch
show sysinfo
To display high-level Cisco wireless LAN controller information, use the show sysinfo command.
Syntax Description
Command Default
Examples
This example shows how to display wireless LAN controller information:
Related Commands
Show TACACS Commands
Use the show tacacs commands to display Terminal Access Controller Access Control System (TACACS) protocol settings and statistics.
show tacacs acct statistics
To display detailed radio frequency identification (RFID) information for a specified tag, use the show tacacs acct statistics command.
Syntax Description
Command Default
Examples
This example shows how to display detailed RFID information:
Related Commands
config tacacs acct
config tacacs acct
config tacacs athr
config tacacs auth
show tacacs summary
show tacacs summary
show tacacs athr statistics
To display TACACS+ server authorization statistics, use the show tacacs athr statistics command.
Syntax Description
Command Default
Examples
This example shows how to display TACACS server authorization statistics:
Related Commands
config tacacs acct
config tacacs acct
config tacacs athr
config tacacs auth
show tacacs summary
show tacacs auth statistics
show tacacs summary
show tacacs auth statistics
To display TACACS+ server authentication statistics, use the show tacacs auth statistics command.
Syntax Description
Command Default
Examples
This example shows how to display TACACS server authentication statistics:
Related Commands
config tacacs acct
config tacacs acct
config tacacs athr
config tacacs auth
show tacacs summary
show tacacs summary
show tacacs summary
To display TACACS+ server summary information, use the show tacacs summary command.
Syntax Description
Command Default
Examples
This example shows how to display TACACS server summary information:
Related Commands
config tacacs acct
config tacacs acct
config tacacs athr
config tacacs auth
show tacacs summary
show tacacs athr statistics
show tacacs auth statistics
show tech-support
To display Cisco wireless LAN controller variables frequently requested by Cisco Technical Assistance Center (TAC), use the show tech-support command.
Syntax Description
Command Default
Examples
This example shows how to display system resource information:
show time
To display the Cisco wireless LAN controller time and date, use the show time command.
Syntax Description
Command Default
Examples
This example shows how to display the controller time and date when authentication is not enabled:
This example shows successful authentication of NTP Message results in the AUTH Success:
This example shows that if the packet received has errors, then the NTP Msg Auth status will show AUTH Failure:
This example shows that if there is no response from NTP server for the packets, the NTP Msg Auth status will be blank:
Related Commands
config time manual
config time ntp
config time timezone
config time timezone location
config time timezone location
show trapflags
To display the Cisco wireless LAN controller Simple Network Management Protocol (SNMP) trap flags, use the show trapflags command.
Syntax Description
Command Default
Examples
This example shows how to display controller SNMP trap flags:
Related Commands
config trapflags 802.11-Security
config trapflags aaa
config trapflags ap
config trapflags authentication
config trapflags client
config trapflags configsave
config trapflags IPsec
config trapflags linkmode
show traplog
To display the Cisco wireless LAN controller Simple Network Management Protocol (SNMP) trap log, use the show traplog command.
Syntax Description
Command Default
Examples
This example shows how to display controller SNMP trap log settings:
Related Commands
show wlan
To display configuration information for a specified wireless LAN or a foreign access point, or to display wireless LAN summary information, use the show wlan command.
show wlan {apgroups | summary | wlan_id | foreignAp }
Syntax Description
(Optional) Displays the configuration for support of foreign access points. |
Command Default
Examples
This example shows how to display a summary of wireless LANs for wlan_id 1:
This example shows how to display a summary of all WLANs:
This example shows how to display the configuration for support of foreign access points:
This example shows how to display the AP groups:
Related Commands
config wlan
config wlan 7920-support
config wlan acl
config wlan interface
config wlan roamed-voice-client re-anchor
show wlan
Show WPS Commands
Use the show wps commands to display Wireless Protection System (WPS) settings.
show wps ap-authentication summary
To display the access point neighbor authentication configuration on the controller, use the show wps ap-authentication summary command.
show wps ap-authentication summary
Syntax Description
Command Default
Examples
This example shows how to display a summary of the Wireless Protection System (WPS) access point neighbor authentication:
Related Commands
show wps cids-sensor
To display Intrusion Detection System (IDS) sensor summary information or detailed information on a specified Wireless Protection System (WPS) IDS sensor, use the show wps cids-sensor command.
show wps cids-sensor { summary | detail index }
Syntax Description
Command Default
Examples
This example shows how to display all settings for the selected sensor:
Related Commands
show wps mfp
To display Management Frame Protection (MFP) information, use the show wps mfp command.
show wps mfp { summary | statistics }
Syntax Description
Command Default
Examples
This example shows how to display a summary of the MFP configuration and status:
This example shows how to display the MFP statistics:
Related Commands
show wps shun-list
To display the Intrusion Detection System (IDS) sensor shun list, use the show wps shun-list command.
Syntax Description
Command Default
Examples
This example shows how to display the IDS system sensor shun list:
Related Commands
show wps signature detail
To display installed signatures, use the show wps signature detail command.
show wps signature detail sig-id
Syntax Description
Command Default
Examples
This example shows how to display information on the attacks detected by standard signature 1:
Related Commands
config wps signature
config wps signature frequency
config wps signature interval
config wps signature mac-frequency
config wps signature quiet-time
config wps signature reset
show wps signature summary
show wps summary
show wps signature events
To display more information about the attacks detected by a particular standard or custom signature, use the show wps signature events command.
show wps signature events { summary | { standard | custom } precedenceID { summary | detailed }
Syntax Description
Displays Standard Intrusion Detection System (IDS) signature settings. |
|
Command Default
Examples
This example shows how to display the number of attacks detected by all enabled signatures:
This example shows how to display a summary of information on the attacks detected by standard signature 1:
Related Commands
config wps signature
config wps signature frequency
config wps signature interval
config wps signature mac-frequency
config wps signature quiet-time
config wps signature reset
show wps signature summary
show wps summary
show wps signature summary
To see individual summaries of all of the standard and custom signatures installed on the controller, use the show wps signature summary command.
Syntax Description
Command Default
Examples
This example shows how to display a summary of all of the standard and custom signatures:
Related Commands
config wps signature
config wps signature frequency
config wps signature interval
config wps signature mac-frequency
config wps signature quiet-time
config wps signature reset
show wps signature events
show wps summary
show wps summary
To display Wireless Protection System (WPS) summary information, use the show wps summary command.
Syntax Description
Command Default
Examples
This example shows how to display WPS summary information:
Related Commands
config wps signature
config wps signature frequency
config wps signature interval
config wps signature mac-frequency
config wps signature quiet-time
config wps signature reset
show wps signature events
show wps signature summary
show wps wips statistics
To display the current state of the Cisco Wireless Intrusion Prevention System (wIPS) operation on the controller, use the show wps wips statistics command.
Syntax Description
Command Default
Examples
This example shows how to display the statistics of the wIPS operation:
Related Commands
config 802.11 enable
config ap mode
config ap monitor-mode
show ap config
show ap monitor-mode summary
show wps wips summary
show wps wips summary
To display the adaptive Cisco Wireless Intrusion Prevention System (wIPS) configuration that the Wireless Control System (WCS) forwards to the controller, use the show wps wips summary command.
Syntax Description
Command Default
Examples
This example shows how to display a summary of the wIPS configuration:
Related Commands
config 802.11 enable
config ap mode
config ap monitor-mode
show ap config
show ap monitor-mode summary
show wps wips statistics
Configuring Controller Settings
Use the config commands to configure Cisco wireless LAN (WLAN) controller options and settings.
- Configure 802.11 Network Commands
- Configure 802.11 Antenna Commands
- Configure 802.11 CleanAir Commands
- Configure 802.11 CAC Commands
- Config ACL Commands
- Configure Advanced 802.11 Commands
- Configure Advanced 802.11 Coverage Commands
- Configure Access Point Commands
- Configure Band-Select Commands
- Configure Client Commands
- Configure Guest-LAN Commands
- Configure Interface Group Commands
- Configure IPv6 Commands
- Configure Macfilter Commands
- Configure Memory Monitor Commands
- Configure Mesh Commands
- Configure Management-User Commands
- Configure Mobility Commands
- Configure Message Log Level Commands
- Configure Media-Stream Commands
- Configure Net User Commands
- Configure Network Commands
- Configure Port Commands
- Configure RADIUS Account Commands
- Configure RADIUS Authentication Server Commands
- Configure Rogue Commands
- Configure SNMP Commands
- Configure Spanning Tree Protocol Commands
- Configure TACACS Commands
- Configure Trap Flag Commands
- Configure Wireless LAN Commands
- Configure Wireless LAN Security Commands
- Configure WPS Commands
Configure 802.11 Network Commands
Use the config 802.11 commands to configure settings and devices on 802.11a, 802.11b/g, 802.11h, or other supported 802.11 networks.
Configure 802.11 Public Safety Commands
Use the config 802.11-a commands to configure settings specifically for 4.9-GHz or 5.8-GHz public safety frequencies.
config 802.11-a
To enable or disable the 4.9-GHz and 5.8-GHz public safety channels on an access point, use the config 802.11-a commands.
config { 802.11-a49 | 802.11-a58 }{ enable | disable } cisco_ap
Syntax Description
Enables the use of this frequency on the designated access point. |
|
Disables the use of this frequency on the designated access point. |
|
Command Default
Examples
This example shows how to enable the 4.9-GHz public safety channel on ap_24 access point:
Related Commands
config 802.11-a antenna extAntGain
config 802.11-a channel ap
config 802.11-a txpower ap
show mesh public-safety
config 802.11-a antenna extAntGain
To configure the external antenna gain for the 4.9-GHz and 5.8-GHz public safety channels on an access point, use the config 802.11-a antenna extAntGain commands.
config { 802.11-a49 | 802.11-a58 } antenna extAntGain ant_gain cisco_ap { global | channel_no }
Syntax Description
Command Default
Usage Guidelines
Before you enter the config 802.11-a antenna extAntGain command, disable the 802.11 Cisco radio with the config 802.11-a disable command.
After you configure the external antenna gain, use the config 802.11-a enable command to re-enable the 802.11 Cisco radio.
Examples
This example shows how to configure an 802.11-a49 external antenna gain of 10 dBi for AP1 :
Related Commands
config 802.11-a
config 802.11-a channel ap
config 802.11-a txpower ap
Show 802.11 Commands
config 802.11-a channel ap
To configure the channel properties for the 4.9-GHz and 5.8-GHz public safety channels on an access point, use the config 802.11-a channel ap command.
config { 802.11-a49 | 802.11-a58 } channel ap cisco_ap { global | channel_no }
Syntax Description
Command Default
Examples
This example shows how to set the channel properties:
Related Commands
config 802.11-a
config 802.11-a antenna extAntGain
config 802.11-a channel ap
config 802.11-a txpower ap
config 802.11-a txpower ap
To configure the transmission power properties for the 4.9-GHz and 5.8-GHz public safety channels on an access point, use the config 802.11-a txpower ap command.
config { 802.11-a49 | 802.11-a58 } txpower ap cisco_ap { global | power_level }
Syntax Description
Transmission power value to the designated mesh access point. Valid values are 1 through 5, inclusive. |
Command Default
Examples
This example shows how to configure an 802.11-a49 transmission power level of 4 for AP1 :
Related Commands
config 802.11-a
config 802.11-a antenna extAntGain
config 802.11-a channel ap
Show 802.11 Commands
Configure 802.11b Commands
Use the config 802.11b commands to configure settings specifically for an 802.11b/g network.
config 802.11b 11gSupport
To enable or disable the Cisco wireless LAN solution 802.11g network, use the config 802.11b 11gSupport command.
config 802.11b 11gSupport { enable | disable }
Syntax Description
Command Default
Usage Guidelines
Before you enter the config 802.11b 11gSupport { enable | disable } command, disable the 802.11 Cisco radio with the config 802.11 disable command.
After you configure the support for the 802.11g network, use the config 802.11 enable command to enable the 802.11 radio.
Note To disable an 802.11a, 802.11b and/or 802.11g network for an individual wireless LAN, use the config wlan radio command.
Examples
This example shows how to enable the 802.11g network:
Related Commands
show sysinfo
show 802.11b
config 802.11b enable
config wlan radio
config 802.11b disable
config 802.11a disable
config 802.11a enable
config 802.11b preamble
To change the 802.11b preamble as defined in subclause 18.2.2.2 to long (slower, but more reliable) or short (faster, but less reliable), use the config 802.11b preamble command.
config 802.11b preamble { long | short }
Syntax Description
Command Default
Usage Guidelines
Note You must reboot the Cisco wireless LAN controller (reset system) with save to implement this command.
This parameter must be set to long to optimize this Cisco wireless LAN controller for some clients, including SpectraLink NetLink telephones.
This command can be used any time that the CLI interface is active.
Examples
This example shows how to change the 802.11b preamble to short:
Related Commands
Configure 802.11h Commands
Use the config 802.11h commands to configure settings specifically for an 802.11h network.
config 802.11h channelswitch
To configure a 802.11h channel switch announcement, use the config 802.11h channelswitch command.
config 802.11h channelswitch { enable mode value | disable }
Syntax Description
Command Default
Examples
This example shows how to disable the 802.11h switch announcement:
Related Commands
config 802.11h powerconstraint
To configure the 802.11h power constraint value, use the config 802.11h powerconstraint command.
config 802.11h powerconstraint value
Syntax Description
Command Default
Examples
This example shows how to configure the 802.11h power constraint to 5:
Related Commands
config 802.11h setchannel
To configure a new channel using 802.11h channel announcement, use the config 802.11h setchannel command.
config 802.11h setchannel cisco_ap
Syntax Description
Command Default
Examples
This example shows how to configure a new channel using the 802.11h channel:
Related Commands
Configure 802.11 11n Support Commands
Use the config 802.11 11nsupport commands to configure settings for an 802.11n network.
config 802.11 11nsupport
To enable 802.11n support on the network, use the config 802.11 11nsupport command.
config 802.11 { a | b } 11nsupport { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the 802.11n support on an 802.11a network:
Related Commands
config 802.11 11nsupport mcs tx
config 802.11 11nsupport a-mpdu tx priority
config 802.11a disable network
config 802.11a disable
config 802.11a channel ap
config 802.11a txpower ap
config 802.11a chan_width
config 802.11 11nsupport a-mpdu tx priority
To specify the aggregation method used for 802.11n packets, use the config 802.11 11nsupport a-mpdu tx priority command.
config 802.11 { a | b } 11nsupport a-mpdu tx priority { 0-7 | all } { enable | disable }
Syntax Description
Command Default
Usage Guidelines
Aggregation is the process of grouping packet data frames together rather than transmitting them separately. Two aggregation methods are available: Aggregated MAC Protocol Data Unit (A-MPDU) and Aggregated MAC Service Data Unit (A-MSDU). A-MPDU is performed in the software whereas A-MSDU is performed in the hardware.
Aggregated MAC Protocol Data Unit priority levels assigned per traffic type are as follows:
- 1—Background
- 2—Spare
- 0—Best effort
- 3—Excellent effort
- 4—Controlled load
- 5—Video, less than 100-ms latency and jitter
- 6—Voice, less than 10-ms latency and jitter
- 7—Network control
- all—Configure all of the priority levels at once.
Note Configure the priority levels to match the aggregation method used by the clients.
Examples
This example shows how to configure all the priority levels at once so that the traffic associated with the priority level uses A-MSDU transmission:
Related Commands
config 802.11 11nsupport mcs tx
config 802.11a disable network
config 802.11a disable
config 802.11a channel ap
config 802.11a txpower ap
config 802.11 11nsupport a-mpdu tx scheduler
To configure the 802.11n-5 GHz A-MPDU transmit aggregation scheduler, use the config 802.11 11nsupport a-mpdu tx scheduler command.
config 802.11 { a | b } 11nsupport a-mpdu tx scheduler { enable | disable | timeout rt timeout-value }
Syntax Description
Command Default
Usage Guidelines
Ensure that the 802.11 network is disabled before you enter this command.
Examples
This example shows how to configure the A-MPDU transmit aggregation scheduler realtime traffic timeout of 100 milliseconds :
Related Commands
config 802.11 11nsupport mcs tx
config 802.11a disable network
config 802.11a disable
config 802.11a channel ap
config 802.11a txpower ap
config 802.11 11nsupport antenna
To configure an access point to use a specific antenna, use the config 802.11 11nsupport antenna command.
config 802.11 { a | b } 11nsupport antenna { tx | rx } cisco_ap { A | B | C } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to configure access point AP1 to use the antenna tx to transmit:
Related Commands
config 802.11 11nsupport mcs tx
config 802.11a disable network
config 802.11a disable
config 802.11a channel ap
config 802.11a txpower ap
config 802.11a chan_width
config 802.11 11nsupport guard-interval
To configure the guard interval, use the config 802.11 11nsupport guard-interval command.
config 802.11 { a | b } 11nsupport guard-interval { any | long }
Syntax Description
Command Default
Examples
This example shows how to configure a long guard interval:
Related Commands
config 802.11 11nsupport mcs tx
config 802.11a disable network
config 802.11a disable
config 802.11a channel ap
config 802.11a txpower ap
config 802.11a chan_width
config 802.11 11nsupport mcs tx
To specify the modulation and coding scheme (MCS) rates at which data can be transmitted between the access point and the client, use the config 802.11 11nsupport mcs tx command.
config 802.11 { a | b } 11nsupport mcs tx { 0-15 } { enable | disable }
Syntax Description
Specifies the modulation and coding scheme data rates as follows: |
|
Command Default
Examples
This example shows how to specify MCS rates:
Related Commands
config 802.11 11nsupport
config wlan wmm required
config 802.11 11nsupport a-mpdu tx priority
config 802.11a disable network
config 802.11a disable
config 802.11a channel ap
config 802.11a txpower ap
config 802.11a chan_width
config 802.11 11nsupport rifs
To configure the Reduced Interframe Space (RIFS) between data frames and its acknowledgement, use the config 802.11 11nsupport rifs command.
config 802.11 { a | b } 11nsupport rifs { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable RIFS:
Related Commands
config 802.11 11nsupport mcs tx
config 802.11a disable network
config 802.11a disable
config 802.11a channel ap
config 802.11a txpower ap
config 802.11a chan_width
Configure 802.11 Antenna Commands
Use the config 802.11 antenna commands to configure radio antenna settings for Cisco lightweight access points on different 802.11 networks.
config 802.11 antenna diversity
To configure the diversity option for 802.11 antennas, use the config 802.11 antenna diversity command.
config 802.11 { a | b } antenna diversity { enable | sideA | sideB } cisco_ap
Syntax Description
Command Default
Examples
This example shows how to enable antenna diversity for AP01 on an 802.11b network:
This example shows how to enable diversity for AP01 on an 802.11a network, using an external antenna connected to the Cisco lightweight access point left port (sideA):
Related Commands
config 802.11 disable
config 802.11 enable
config 802.11 antenna extAntGain
config 802.11 antenna mode
config 802.11 antenna selection
Show 802.11 Commands
config 802.11 antenna extAntGain
To configure external antenna gain for an 802.11 network, use the config 802.11 antenna extAntGain command.
config 802.11 { a | b } antenna extAntGain antenna_gain cisco_ap
Syntax Description
Command Default
Usage Guidelines
Before you enter the config 802.11 antenna extAntGain command, disable the 802.11 Cisco radio with the config 802.11 disable command.
After you configure the external antenna gain, use the config 802.11 enable command to enable the 802.11 Cisco radio.
Examples
This example shows how to configure an 802.11a external antenna gain of 0.5 dBm for AP1 :
Related Commands
config 802.11 disable
config 802.11 enable
config 802.11 antenna diversity
config 802.11 antenna mode
config 802.11 antenna selection
Show 802.11 Commands
config 802.11 antenna mode
To configure the Cisco lightweight access point to use one internal antenna for an 802.11 sectorized 180-degree coverage pattern or both internal antennas for an 802.11 360-degree omnidirectional pattern, use the config 802.11 antenna mode command.
config 802.11 { a | b } antenna mode { omni | sectorA | sectorB } cisco_ap
Syntax Description
Command Default
Examples
This example shows how to configure access point AP01 antennas for a 360-degree omnidirectional pattern on an 802.11b network:
Related Commands
config 802.11 disable
config 802.11 enable
config 802.11 antenna diversity
config 802.11 antenna extAntGain
config 802.11 antenna selection
Show 802.11 Commands
config 802.11 antenna selection
To select the internal or external antenna selection for a Cisco lightweight access point on an 802.11 network, use the config 802.11 antenna selection command.
config 802.11 { a | b } antenna selection { internal | external } cisco_ap
Syntax Description
Command Default
Examples
This example shows how to configure access point AP02 on an 802.11b network to use the internal antenna:
Related Commands
config 802.11 disable
config 802.11 enable
config 802.11 antenna diversity
config 802.11 antenna extAntGain
config 802.11 antenna mode
config 802.11 antenna selection
Show 802.11 Commands
config 802.11 beacon period
To change the beacon period globally for an 802.11a, 802.11b, or other supported 802.11 network, use the config 802.11 beacon period command.
config 802.11 { a | b } beacon period time_units
Note Disable the 802.11 network before using this command. See the “Usage Guidelines” section.
Syntax Description
Beacon interval in time units (TU). One TU is 1024 microseconds. |
Command Default
Usage Guidelines
In Cisco wireless LAN solution 802.11 networks, all Cisco lightweight access point wireless LANs broadcast a beacon at regular intervals. This beacon notifies clients that the 802.11a service is available and allows the clients to synchronize with the lightweight access point.
Before you change the beacon period, make sure that you have disabled the 802.11 network by using the config 802.11 disable command. After changing the beacon period, enable the 802.11 network by using the config 802.11 enable command.
Examples
This example shows how to configure an 802.11a network for a beacon period of 120 time units:
Related Commands
show 802.11a
config 802.11b beaconperiod
config 802.11a disable
config 802.11a enable
config 802.11 beamforming
To enable or disable beamforming on the network or on individual radios, enter the config 802.11 beamforming command.
config 802.11 { a | b } beamforming { global | ap ap_name } { enable | disable }
Syntax Description
Command Default
Usage Guidelines
When you enable beamforming on the network, it is automatically enabled for all the radios applicable to that network type.
Follow these guidelines for using beamforming:
- Beamforming is supported only for legacy orthogonal frequency-division multiplexing (OFDM) data rates (6, 9, 12, 18, 24, 36, 48, and 54 mbps).
Note Beamforming is not supported for complementary-code keying (CCK) data rates (1, 2, 5.5, and 11 Mbps).
- Beamforming is supported only on access points that support 802.11n (AP1250 and AP1140).
- Two or more antennas must be enabled for transmission.
- All three antennas must be enabled for reception.
- OFDM rates must be enabled.
If the antenna configuration restricts operation to a single transmit antenna, or if OFDM rates are disabled, beamforming is not used.
Examples
This example shows how to enable beamforming on the 802.11a network:
Related Commands
show ap config {802.11a | 802.11b}
show 802.11a
config 802.11b beaconperiod
config 802.11a disable
config 802.11a enable
Configure 802.11 CleanAir Commands
Use the config 802.11 cleanair commands to configure cleanair settings on different 802.11 networks.
config 802.11 cleanair
To enable or disable CleanAir for the 802.11 a or 802.11 b/g network, use the config 802.11 cleanair command.
config 802.11 cleanair {enable | disable} { network | cisco_ap }
Command Default
Examples
This example shows how to enable the CleanAir settings on access point ap_24:
Related Commands
config 802.11 cleanair device
To configure CleanAir interference device types, use the config 802.11 cleanair device command.
config 802.11a cleanair device { enable | disable } device_type
Syntax Description
Command Default
Examples
This example shows how to enable the CleanAir reporting for the device type jammer:
This example shows how to disable the CleanAir reporting for the device type video:
This example shows how to enable the CleanAir interference device reporting:
Related Commands
config 802.11 cleanair alarm
To configure the triggering of the air quality alarms, use the config 802.11 cleanair alarm command.
config 802.11 cleanair alarm
{air-quality {disable | enable | threshold threshold }
device { disable [ device_type | all ] |
unclassified [enable | disable | threshold threshold ]
enable [ device_type | all ] | reporting [ enable | disable ]}
Syntax Description
Command Default
Examples
This example shows how to enable the CleanAir alarm to monitor the air quality:
This example shows how to enable the CleanAir alarm for the device type video:
This example shows how to enable alarm reporting for the CleanAir interference devices:
Related Commands
Configure 802.11 CAC Commands
Use the config 802.11 cac commands to configure Call Admission Control (CAC) protocol settings.
config 802.11 cac video acm
To enable or disable video Call Admission Control (CAC) for the 802.11a or 802.11b/g network, use the config 802.11 cac video acm command.
config 802.11 { a | b } cac video acm { enable | disable }
Syntax Description
Command Default
Usage Guidelines
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering save config command.
- Enable voice or video CAC for the network you wish to configure by entering the config 802.11 { a | b } cac voice acm enable, or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to enable the video CAC for the 802.11a network:
This example shows how to disable the video CAC for the 802.11b network:
Related Commands
config 802.11 cac video max-bandwidth
config 802.11 cac video roam-bandwidth
config 802.11 cac video tspec-inactivity-timeout
config 802.11 cac video max-bandwidth
To set the percentage of the maximum bandwidth allocated to clients for video applications on the 802.11a or 802.11b/g network, use the config 802.11 cac video max-bandwidth command.
config 802.11 { a | b } cac video max-bandwidth bandwidth
Syntax Description
Command Default
Usage Guidelines
The maximum radio frequency (RF) bandwidth cannot exceed 85% for voice and video. Once the client reaches the value specified, the access point rejects new calls on this network.
Note If this parameter is set to zero (0), the controller assumes that you do not want to allocate any bandwidth and allows all bandwidth requests.
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the config 802.11 { a | b } cac voice acm enable, or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco wireless LAN controller Configuration Guide for your release.
Examples
This example shows how to specify the percentage of the maximum allocated bandwidth for video applications on the selected radio band:
Related Commands
config 802.11 cac video acm
config 802.11 cac video roam-bandwidth
config 802.11 cac voice stream-size
config 802.11 cac voice roam-bandwidth
config 802.11 cac video roam-bandwidth
To configure the percentage of the maximum allocated bandwidth reserved for roaming video clients on the 802.11a or 802.11b/g network, use the config 802.11 cac video roam-bandwidth command.
config 802.11 { a | b } cac video roam-bandwidth bandwidth
Syntax Description
Command Default
Usage Guidelines
The controller reserves the specified bandwidth from the maximum allocated bandwidth for roaming video clients.
Note If this parameter is set to zero (0), the controller assumes that you do not want to do any bandwidth allocation and, therefore, allows all bandwidth requests.
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable command.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to specify the percentage of the maximum allocated bandwidth reserved for roaming video clients on the selected radio band:
Related Commands
config 802.11 cac video acm
config 802.11 cac video max-bandwidth
config 802.11 cac video tspec-inactivity-timeout
config 802.11 cac video tspec-inactivity-timeout
To process or ignore the Wi-Fi Multimedia (WMM) traffic specifications (TSPEC) inactivity timeout received from an access point, use the config 802.11 cac video tspec-inactivity-timeout command.
config 802.11 { a | b } cac video tspec-inactivity-timeout { enable | ignore }
Syntax Description
Command Default
Usage Guidelines
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to process the response to TSPEC inactivity timeout messages received from an access point:
This example shows how to ignore the response to TSPEC inactivity timeout messages received from an access point:
Related Commands
config 802.11 cac video acm
config 802.11 cac video max-bandwidth
config 802.11 cac video roam-bandwidth
config 802.11 cac voice acm
To enable or disable bandwidth-based voice Call Admission Control (CAC) for the 802.11a or 802.11b/g network, use the config 802.11 cac voice acm command.
config 802.11 { a | b } cac voice acm { enable | disable }
Syntax Description
Command Default
Usage Guidelines
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to enable the bandwidth-based CAC:
This example shows how to disable the bandwidth-based CAC:
Related Commands
config 802.11 cac voice max-bandwidth
To set the percentage of the maximum bandwidth allocated to clients for voice applications on the 802.11a or 802.11b/g network, use the config 802.11 cac voice max-bandwidth command.
config 802.11 { a | b } cac voice max-bandwidth bandwidth
Syntax Description
Command Default
Usage Guidelines
The maximum radio frequency (RF) bandwidth cannot exceed 85% for voice and video. Once the client reaches the value specified, the access point rejects new calls on this network.
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to specify the percentage of the maximum allocated bandwidth for voice applications on the selected radio band:
Related Commands
config 802.11 cac voice acm
config 802.11 cac voice load-based
config 802.11 cac voice roam-bandwidth
config 802.11 cac voice stream-size
config 802.11 cac voice tspec-inactivity-timeout
config 802.11 exp-bwreq
config 802.11 tsm
config wlan
save config
show wlan
show wlan summary
config 802.11 cac voice roam-bandwidth
To configure the percentage of the maximum allocated bandwidth reserved for roaming voice clients on the 802.11a or 802.11b/g network, use the config 802.11 cac voice roam-bandwidth command.
config 802.11 { a | b } cac voice roam-bandwidth bandwidth
Syntax Description
Command Default
Usage Guidelines
The maximum radio frequency (RF) bandwidth cannot exceed 85% for voice and video. The controller reserves the specified bandwidth from the maximum allocated bandwidth for roaming voice clients.
Note If this parameter is set to zero (0), the controller assumes you do not want to allocate any bandwidth and therefore allows all bandwidth requests.
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to configure the percentage of the maximum allocated bandwidth reserved for roaming voice clients on the selected radio band:
Related Commands
config 802.11 cac voice acm
config 802.11 cac voice max-bandwidth
config 802.11 cac voice stream-size
config 802.11 cac voice tspec-inactivity-timeout
To process or ignore the Wi-Fi Multimedia (WMM) traffic specifications (TSPEC) inactivity timeout received from an access point, use the config 802.11 cac voice tspec-inactivity-timeout command.
config 802.11 { a | b } cac voice tspec-inactivity-timeout { enable | ignore }
Syntax Description
Command Default
Usage Guidelines
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
Related Commands
config 802.11 cac voice acm,
config 802.11 cac voice load-based
config 802.11 cac voice max-bandwidth
config 802.11 cac voice roam-bandwidth
config 802.11 cac voice stream-size
config 802.11 cac voice load-based
To enable or disable load-based Call Admission Control (CAC) for the 802.11a or 802.11b/g network, use the config 802.11 cac voice load-based command.
config 802.11 { a | b } cac voice load-based { enable | disable }
Syntax Description
Command Default
Usage Guidelines
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to enable the voice load-based CAC parameters:
This example shows how to disable the voice load-based CAC parameters:
Related Commands
config 802.11 cac voice acm
config 802.11 cac voice max-bandwidth
config 802.11 cac voice roam-bandwidth
config 802.11 cac voice stream-size
config 802.11 cac voice tspec-inactivity-timeout
config 802.11 cac voice max-calls
Note Do not use the config 802.11 cac voice max-calls command if the SIP call snooping feature is disabled and if the SIP based CAC requirements are not met.
To configure the maximum number of voice call supported by the radio, use the config 802.11 cac voice max-calls command.
config 802.11 { a | b } cac voice max-calls number
Syntax Description
Command Default
0, which means that there is no maximum limit check for the number of calls.
Usage Guidelines
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to configure the maximum number of voice calls supported by radio:
Related Commands
config 802.11 cac voice acm
config 802.11 cac voice load-based
config 802.11 cac voice max-bandwidth
config 802.11 cac voice roam-bandwidth
config 802.11 cac voice tspec-inactivity-timeout
config 802.11 exp-bwreq
config 802.11 cac voice sip bandwidth
Note SIP bandwidth and sample intervals are used to compute per call bandwidth in case of the SIP-based CAC.
To configure the bandwidth that is required per call for the 802.11a or 802.11b/g network, use the config 802.11 cac voice sip bandwidth command.
config 802.11 { a | b } cac voice sip bandwidth bw_kbps sample-interval number_msecs
Syntax Description
Packetization sample interval in msecs. The sample interval for SIP codec is 20 seconds. |
Command Default
Usage Guidelines
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to configure the bandwidth and voice packetization interval for a SIP codec:
Related Commands
config 802.11 cac voice acm
config 802.11 cac voice load-based
config 802.11 cac voice max-bandwidth
config 802.11 cac voice roam-bandwidth
config 802.11 cac voice tspec-inactivity-timeout
config 802.11 exp-bwreq
config 802.11 cac voice sip codec
To configure the codec name and sample interval as parameters and to calculate the required bandwidth per call for the 802.11a or 802.11b/g network, use the config 802.11 cac voice sip codec command.
config 802.11 { a | b } cac voice sip codec {g711 | g729} sample-interval number_msecs
Syntax Description
Packetization interval in msecs. The sample interval for SIP codec value is 20 seconds. |
Command Default
Usage Guidelines
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to configure the codec name and sample interval as parameters for SIP G711 codec:
This example shows how to configure the codec name and sample interval as parameters for SIP G729 codec:
Related Commands
config 802.11 cac voice acm
config 802.11 cac voice load-based
config 802.11 cac voice max-bandwidth
config 802.11 cac voice roam-bandwidth
config 802.11 cac voice tspec-inactivity-timeout
config 802.11 exp-bwreq
config 802.11 cac voice stream-size
To configure the number of aggregated voice Wi-Fi Multimedia (WMM) traffic specification (TSPEC) streams at a specified data rate for the 802.11a or 802.11b/g network, use the config 802.11 cac voice stream-size command.
config 802.11 { a | b } cac voice stream-size stream_size number mean_datarate max-streams number
Syntax Description
Command Default
The default number of streams is 2 and the mean data rate of a stream is 84 kbps.
Usage Guidelines
Call Admission Control (CAC) commands require that the WLAN you are planning to modify is configured for Wi-Fi Multimedia (WMM) protocol and the quality of service (QoS) level be set to Platinum.
Before you can configure CAC parameters on a network, you must complete the following prerequisites:
- Disable all WLANs with WMM enabled by entering the config wlan disable wlan_id command.
- Disable the radio network you wish to configure by entering the config 802.11 { a | b } disable network command.
- Save the new configuration by entering the save config command.
- Enable voice or video CAC for the network you wish to configure by entering the
config 802.11 { a | b } cac voice acm enable or config 802.11 { a | b } cac video acm enable commands.
For complete instructions, see the “Configuring Voice and Video Parameters” section in the “Configuring Controller Settings” chapter of the Cisco Wireless LAN Controller Configuration Guide for your release.
Examples
This example shows how to configure the number of aggregated voice traffic specifications stream with the stream size 5 and the mean data rate of 85000 kbps:
Related Commands
config 802.11 cac voice acm
config 802.11 cac voice load-based
config 802.11 cac voice max-bandwidth
config 802.11 cac voice roam-bandwidth
config 802.11 cac voice tspec-inactivity-timeout
config 802.11 exp-bwreq
config 802.11 channel
To configure an 802.11 network or a single access point for automatic or manual channel selection, use the config 802.11 channel command.
config 802.11 { a | b } channel { global [ auto | once | off ]} | ap { ap_name [ global | channel ]}
Syntax Description
Command Default
Usage Guidelines
When configuring 802.11 channels for a single lightweight access point, enter the config 802.11 disable command to disable the 802.11 network. Enter the config 802.11 channel command to set automatic channel selection by Radio Resource Management (RRM) or manually set the channel for the 802.11 radio, and enter the config 802.11 enable command to enable the 802.11 network.
Note See the Channels and Maximum Power Settings for Cisco Aironet Lightweight Access Points document for the channels supported by your access point. The power levels and available channels are defined by the country code setting and are regulated on a country-by-country basis.
Examples
This example shows how to have RRM automatically configure the 802.11a channels for automatic channel configuration based on the availability and interference:
This example shows how to configure the 802.11b channels one time based on the availability and interference:
This example shows how to turn 802.11a automatic channel configuration off:
This example shows how to configure the 802.11b channels in access point AP01 for automatic channel configuration:
This example shows how to configure the 802.11a channel 36 in access point AP01 as the default channel:
Related Commands
show 802.11a
config 802.11a disable
config 802.11a enable
config 802.11b channel
config country
config 802.11 channel ap
To set the operating radio channel for an access point, use the config 802.11 channel ap command.
config 802.11 { a | b } channel ap cisco_ap { global | channel_no }
Syntax Description
Command Default
Examples
This example shows how to enable auto-RF for access point AP01 on an 802.11b network:
Related Commands
config 802.11 chan_width
To configure the channel width for a particular access point, use the config 802.11 chan_width command.
config 802.11{ a | b } chan_width cisco_ap { 20 | 40 }
Syntax Description
Command Default
Usage Guidelines
This parameter can be configured only if the primary channel is statically assigned.
Statically configuring an access point’s radio for 20- or 40-MHz mode overrides the globally configured DCA channel width setting (configured by using the config advanced 802.11 channel dca chan-width-11n command). If you change the static configuration back to global on the access point radio, the global DCA configuration overrides the channel width configuration that the access point was previously using.
Examples
This example shows how to configure the channel width for access point AP01 on an 802.11 network using 40-MHz channels:
Related Commands
config 802.11 11nsupport
config wlan wmm required
config 802.11 11nsupport a-mpdu tx priority
config 802.11a disable network
config 802.11a disable
config 802.11a channel ap
config 802.11b disable
config 802.11b channel ap
config 802.11a txpower ap
config 802.11 disable
To disable radio transmission for an entire 802.11 network or for an individual Cisco radio, use the config 802.11 disable command.
config 802.11 { a | b } disable { network | cisco_ap }
Syntax Description
Command Default
The transmission is enabled for the entire network by default.
Usage Guidelines
Note You must use this command to disable the network before using many config 802.11 commands.
This command can be used any time that the CLI interface is active.
Examples
This example shows how to disable the entire 802.11a network:
This example shows how to disable access point AP01 802.11b transmissions:
Related Commands
show sysinfo
show 802.11a
config 802.11a enable
config 802.11b disable
config 802.11b enable
config 802.11a beaconperiod
config 802.11 dtpc
To enable or disable the Dynamic Transmit Power Control (DTPC) setting for an 802.11 network, use the config 802.11 dtpc command.
config 802.11 { a | b } dtpc { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable DTPC for an 802.11a network:
Related Commands
show 802.11a
config 802.11a beaconperiod
config 802.11a disable
config 802.11a enable
config 802.11 enable
To enable radio transmission for an entire 802.11 network or for an individual Cisco radio, use the config 802.11 enable command.
config 802.11 { a | b } enable { network | cisco_ap }
Syntax Description
Command Default
The transmission is enabled for the entire network by default.
Usage Guidelines
Note Use this command in conjunction with the config 802.11 disable command when configuring 802.11 settings.
This command can be used any time that the CLI interface is active.
Examples
This example shows how to enable radio transmission for the entire 802.11a network:
This example shows how to enable radio transmission for AP1 on an 802.11b network:
Related Commands
show sysinfo
show 802.11a
config wlan radio
config 802.11a disable
config 802.11b disable
config 802.11b enable
config 802.11b 11gSupport enable
config 802.11b 11gSupport disable
config 802.11 exp-bwreq
To enable or disable the Cisco Client eXtension (CCX) version 5 expedited bandwidth request feature for an 802.11 radio, use the config 802.11 exp-bwreq command.
config 802.11 { a | b } exp-bwreq { enable | disable }
Syntax Description
Command Default
The expedited bandwidth request feature is disabled by default.
Usage Guidelines
When this command is enabled, the controller configures all joining access points for this feature.
Examples
This example shows how to enable the CCX expedited bandwidth settings:
This example shows how to disable the CCX expedited bandwidth settings:
Related Commands
config 802.11 fragmentation
To configure the fragmentation threshold on an 802.11 network, use the config 802.11 fragmentation command.
config 802.11 { a | b } fragmentation threshold
Note This command can only be used when the network is disabled using the config 802.11 disable command.
Syntax Description
Command Default
Examples
This example shows how to configure the fragmentation threshold on an 802.11a network with the threshold number of 6500 bytes:
Related Commands
config 802.11 l2roam rf-params
To configure 802.11a or 802.11b/g Layer 2 client roaming parameters, use the
config 802.11 l2roam rf-params command.
config 802.11 { a | b } l2roam rf-params {default | custom min_rssi roam_hyst scan_thresh trans_time }
Syntax Description
Command Default
Usage Guidelines
For high-speed client roaming applications in outdoor mesh environments, we recommend that you set the trans_time to 1 second.
Examples
This example shows how to configure custom Layer 2 client roaming parameters on an 802.11a network:
Related Commands
config 802.11 max-clients
To configure the maximum number of clients per access point, use the config 802.11 max-clients command.
config 802.11 { a | b } max-clients max-clients
Syntax Description
Configures the maximum number of client connections per access point. The valid range is 1 to 200. |
Command Default
Examples
This example shows how to set the maximum number of clients at 22:
Related Commands
config 802.11 rate
To set mandatory and supported operational data rates for an 802.11 network, use the config 802.11 rate command.
config 802.11 { a | b } rate { disabled | mandatory | supported } rate
Syntax Description
Specifies that a client supports the data rate in order to use the network. |
|
Specifies to allow any associated client that supports the data rate to use the network. |
|
Command Default
Usage Guidelines
The data rates set with this command are negotiated between the client and the Cisco wireless LAN controller. If the data rate is set to mandatory, the client must support it in order to use the network. If a data rate is set as supported by the Cisco wireless LAN controller, any associated client that also supports that rate may communicate with the Cisco lightweight access point using that rate. It is not required that a client is able to use all the rates marked supported in order to associate.
Examples
This example shows how to set the 802.11b transmission at a mandatory rate at 12 Mbps:
Related Commands
config 802.11 tsm
To enable or disable the video Traffic Stream Metric (TSM) option for the 802.11a or 802.11b/g network, use the config 802.11 tsm command.
config 802.11 { a | b } tsm { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the video TSM option for the 802.11b/g network:
This example shows how to disable the video TSM option for the 802.11b/g network:
Related Commands
config 802.11 txPower
To configure the transmit power level for all access points or a single access point in an 802.11 network, use the config 802.11 txPower command.
config 802.11 { a | b } txPower { global [ auto | once | power_level ]}
config 802.11 { a | b } txPower { ap ap_name [ global | power_level ]}
Syntax Description
Command Default
The command default ( global, auto) is for automatic configuration by RRM.
Usage Guidelines
The supported power levels depends on the specific access point used and the regulatory region. For example, the 1240 series access point supports eight levels and the 1200 series access point supports six levels. See the Channels and Maximum Power Settings for Cisco Aironet Lightweight Access Points document for the maximum transmit power limits for your access point. The power levels and available channels are defined by the country code setting and are regulated on a country-by-country basis.
Examples
This example shows how to automatically set the 802.11a radio transmit power level in all lightweight access points:
This example shows how to manually set the 802.11b radio transmit power to level 5 for all lightweight access points:
This example shows how to automatically set the 802.11b radio transmit power for access point AP1:
This example shows how to manually set the 802.11a radio transmit power to power level 2 for access point AP1:
Related Commands
show ap config 802.11a
config 802.11b txPower
config country
config aaa auth
To configure the AAA authentication search order for management users, use the config aaa auth command.
config aaa auth mgmt [ aaa_server_type ]
Syntax Description
Command Default
Usage Guidelines
You can enter two AAA server types as long as one of the server types is local. You cannot enter radius and tacacs together.
Examples
This example shows how to configure the AAA authentication search order for controller management users by the authentication server type local:
Related Commands
config aaa auth mgmt
To configure the order of authentication when multiple databases are configured, use the config aaa auth mgmt command.
config aaa auth mgmt [radius | tacacs]
Syntax Description
(Optional) Configures the order of authentication for RADIUS servers. |
|
(Optional) Configures the order of authentication for TACACS servers. |
Command Default
Examples
This example shows how to configure the order of authentication for the RADIUS server:
This example shows how to configure the order of authentication for the TACACS server:
Related Commands
Config ACL Commands
Use the config acl commands to configure the system access control lists.
config acl apply
To apply an access control list (ACL) to the data path, use the config acl apply command.
Syntax Description
Command Default
Usage Guidelines
For a Cisco 2100 Series Wireless LAN Controller, you must configure a preauthentication ACL on the wireless LAN for the external web server. This ACL should then be set as a wireless LAN preauthentication ACL under Web Policy. However, you do not need to configure any preauthentication ACL for Cisco 4400 Series Wireless LAN Controllers.
Examples
This example shows how to apply an ACL to the data path:
Related Commands
config acl counter
To see if packets are hitting any of the access control lists (ACLs) configured on your controller, use the config acl counter command.
config acl counter { start | stop }
Syntax Description
Command Default
Usage Guidelines
ACL counters are available only on the following controllers: 4400 series, Cisco WiSM, and Catalyst 3750G Integrated Wireless LAN Controller Switch.
Examples
This example shows how to enable ACL counters on your controller:
Related Commands
config acl create
To create a new access control list (ACL), use the config acl create command.
Syntax Description
Command Default
Usage Guidelines
For a Cisco 2100 Series Wireless LAN Controller, you must configure a preauthentication ACL on the wireless LAN for the external web server. This ACL should then be set as a wireless LAN preauthentication ACL under Web Policy. However, you do not need to configure any preauthentication ACL for Cisco 4400 Series Wireless LAN Controllers.
Examples
This example shows how to create a new ACL:
Related Commands
config acl cpu
To create a new access control list (ACL) rule that restricts the traffic reaching the CPU, use the config acl cpu command.
config acl cpu rule_name { wired | wireless | both }
Syntax Description
Command Default
Usage Guidelines
This command allows you to control the type of packets reaching the CPU.
Examples
This example shows how to create an ACL named acl101 on the CPU and apply it to wired traffic:
Related Commands
config acl delete
To delete an access control list (ACL), use the config acl delete command.
Syntax Description
Command Default
Usage Guidelines
For a Cisco 2100 Series Wireless LAN Controller, you must configure a preauthentication ACL on the wireless LAN for the external web server. This ACL should then be set as a wireless LAN preauthentication ACL under Web Policy. However, you do not need to configure any preauthentication ACL for Cisco 4400 Series Wireless LAN Controllers.
Examples
This example shows how to delete an ACL named acl101 on the CPU:
Related Commands
config acl rule
To configure ACL rules, use the config acl rule command.
config acl rule
{action rule_name rule_index { permit | deny } |
add rule_name rule_index |
change index rule_name old_index new_index |
delete rule_name rule_index |
destination address rule_name rule_index ip_address netmask |
destination port range rule_name rule_index start_port end_port |
direction rule_name rule_index { in | out | any } |
dscp rule_name rule_index dscp |
protocol rule_name rule_index protocol |
source address rule_name rule_index ip_address netmask |
source port range rule_name rule_index start_port end_port |
swap index rule_name index_1 index_2 }
Syntax Description
Command Default
Usage Guidelines
For a Cisco 2100 Series Wireless LAN Controller, you must configure a preauthentication ACL on the wireless LAN for the external web server. This ACL should then be set as a wireless LAN preauthentication ACL under Web Policy. However, you do not need to configure any preauthentication ACL for Cisco 4400 Series Wireless LAN Controllers.
Examples
This example shows how to configure an ACL to permit access:
Related Commands
Configure Advanced 802.11 Commands
Use the config advanced 802.11 commands to configure advanced settings and devices on 802.11a, 802.11b/g, or other supported 802.11 networks.
config advanced 802.11 7920VSIEConfig
To configure the Cisco unified wireless IP phone 7920 VISE parameters, use the config advanced 802.11 7920VSIEConfig command.
config advanced 802.11 { a | b } 802.11b 7920VSIEConfig { call-admission-limit limit |
G711-CU-Quantum quantum }
Syntax Description
Command Default
Examples
This example shows how to configure the call admission limit for 7920 VISE parameters:
config advanced fastpath pkt-capture
To configure the fastpath packet capture, use the config advanced fastpath pkt-capture command.
config advanced fastpath pkt-capture { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the fastpath packet capture:
config advanced fastpath fastcache
To configure the fastpath fast cache control, use the config advanced fastpath fastcache command.
config advanced fastpath fastcache { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the fastpath fast cache control:
Configure Advanced 802.11 Channel Commands
Use the config advanced 802.11 channel commands to configure Dynamic Channel Assignment (DCA) settings on supported 802.11 networks.
config advanced 802.11 channel add
To add channel to the 802.11 networks auto RF channel list, use the config advanced 802.11 channel add command.
config advanced 802.11 { a | b } channel {add | delete} channel_number
Syntax Description
Deletes a channel from the 802.11 network auto RF channel list. |
|
Channel number to add to the 802.11 network auto RF channel list. |
Command Default
Examples
This example shows how to add a channel to the 802.11a network auto RF channel list:
This example shows how to delete a channel from the 802.11a network auto RF channel list:
Related Commands
show advanced 802.11a channel
config advanced 802.11b channel update
config advanced 802.11 channel cleanair-event
To configure cleanair event driven Radio Resource Management (RRM) parameters for all 802.11 Cisco lightweight access points, use the config advanced 802.11 channel cleanair-event command.
config advanced 802.11 { a | b } channel cleanair-event {enable | disable | sensitivity [low | medium | high | custom threshold [1-99]] | }
Syntax Description
Command Default
Examples
This example shows how to enable the cleanair event-driven RRM parameters:
This example shows how to set the high sensitivity for cleanair event-driven RRM:
Related Commands
show advanced 802.11a channel
config advanced 802.11b channel update
config advanced 802.11 channel cleanair-event
To configure cleanair event driven Radio Resource Management (RRM) parameters for all 802.11 Cisco lightweight access points, use the config advanced 802.11 channel cleanair-event command.
config advanced 802.11 { a | b } channel cleanair-event {enable | disable | sensitivity [low | medium | high]}
Syntax Description
Command Default
Examples
This example shows how to enable the cleanair event-driven RRM parameters:
This example shows how to set the high sensitivity for cleanair event-driven RRM:
Related Commands
config advanced 802.11 channel dca anchor-time
To specify the time of day when the Dynamic Channel Assignment (DCA) algorithm is to start, use the config advanced 802.11 channel dca anchor-time command.
config advanced 802.11 { a | b } channel dca anchor-time value
Syntax Description
Hour of the time between 0 and 23. These values represent the hour from 12:00 a.m. to 11:00 p.m. |
Command Default
Examples
This example shows how to configure the time of delay when the dynamic channel assignment algorithm starts:
Related Commands
config advanced 802.11 channel dca interval
config advanced 802.11 channel dca sensitivity
show advanced 802.11 channel
config advanced 802.11 channel dca chan-width-11n
To configures the Dynamic Channel Assignment (DCA) channel width for all 802.11n radios in the 5-GHz band, use the config advanced 802.11 channel dca chan-width-11n command:
config advanced 802.11 { a | b } channel dca chan-width-11n { 20 | 40 }
Syntax Description
Command Default
Usage Guidelines
If you choose 40, be sure to set at least two adjacent channels in the config advanced 802.11 channel { add | delete } channel_number command (for example, a primary channel of 36 and an extension channel of 40). If you set only one channel, that channel is not used for 40-MHz channel width.
To override the globally configured DCA channel width setting, you can statically configure an access point’s radio for 20- or 40-MHz mode using the config 802.11 chan_width command. If you then change the static configuration to global on the access point radio, the global DCA configuration overrides the channel width configuration that the access point was previously using.
Examples
This example shows how to add a channel to the 802.11a network auto channel list:
Related Commands
config 802.11 chan_width
config advanced 802.11 channel dca interval
config advanced 802.11 channel dca sensitivity
show advanced 802.11 channel
config advanced 802.11 channel dca interval
To specify how often the Dynamic Channel Assignment (DCA) is allowed to run, use the config advanced 802.11 channel dca interval command.
config advanced 802.11 { a | b } channel dca interval value
Syntax Description
Valid values are 0, 1, 2, 3, 4, 6, 8, 12, or 24 hours. 0 is 10 minutes (600 seconds). |
Command Default
Usage Guidelines
If your controller supports only OfficeExtend access points, we recommend that you set the DCA interval to 6 hours for optimal performance. For deployments with a combination of OfficeExtend access points and local access points, the range of 10 minutes to 24 hours can be used.
Examples
This example shows how often the DCA algorithm is allowed to run:
Related Commands
config advanced 802.11 channel dca anchor-time
config advanced 802.11 channel dca sensitivity
show advanced 802.11 channel
config advanced 802.11 channel dca min-metric
To configure the minimum5 GHz RSSI energy metric for DCA, use the config advanced 802.11 channel dca min-metric command.
config advanced 802.11 { a | b } channel dca min-metric RSSI_value
Syntax Description
Minimum received signal strength indicator (RSSI) that is required for the DCA to trigger a channel change. The range is from –100 to –60 dBm. |
Command Default
Examples
This example shows how to configure the minimum 5 GHz RSSI energy metric for DCA:
In the above example, the RRM must detect an interference energy of at least -80 dBm in RSSI for the DCA to trigger a channel change.
Related Commands
config advanced 802.11 channel dca anchor-time
config advanced 802.11 channel dca sensitivity
show advanced 802.11 channel
config advanced 802.11 channel dca sensitivity
To specify how sensitive the Dynamic Channel Assignment (DCA) algorithm is to environmental changes (for example, signal, load, noise, and interference) when determining whether or not to change channels, use the config advanced 802.11 channel dca sensitivity command.
config advanced 802.11 { a | b } channel dca sensitivity { low | medium | high }
Syntax Description
Command Default
Usage Guidelines
The DCA sensitivity thresholds vary by radio band as shown in Table 2-3 .
To aid in troubleshooting, the output of this command shows an error code for any failed calls. Table 2-1 explains the possible error codes for failed calls.
|
|
|
---|---|---|
|
||
|
||
|
Examples
This example shows how to configure the value of DCA algorithm’s sensitivity to low:
Related Commands
config advanced 802.11 channel dca anchor-time
config advanced 802.11 channel dca interval
show advanced 802.11 channel
config advanced 802.11 channel foreign
To have Radio Resource Management (RRM) consider or ignore foreign 802.11a interference avoidance in making channel selection updates for all 802.11a Cisco lightweight access points, use the config advanced 802.11 channel foreign command.
config advanced 802.11 { a | b } channel foreign { enable | disable }
Syntax Description
Enables the foreign access point 802.11a interference avoidance in the channel assignment. |
|
Disables the foreign access point 802.11a interference avoidance in the channel assignment. |
Command Default
Examples
This example shows how to have RRM consider foreign 802.11a interference when making channel selection updates for all 802.11a Cisco lightweight access points:
Related Commands
config advanced 802.11 channel load
To have Radio Resource Management (RRM) consider or ignore the traffic load in making channel selection updates for all 802.11a Cisco lightweight access points, use the config advanced 802.11 channel load command.
config advanced 802.11 { a | b } channel load { enable | disable }
Syntax Description
Enables the Cisco lightweight access point 802.11a load avoidance in the channel assignment. |
|
Disables the Cisco lightweight access point 802.11a load avoidance in the channel assignment. |
Command Default
Examples
This example shows how to have RRM consider the traffic load when making channel selection updates for all 802.11a Cisco lightweight access points:
Related Commands
config advanced 802.11 channel noise
To have Radio Resource Management (RRM) consider or ignore non-802.11a noise in making channel selection updates for all 802.11a Cisco lightweight access points, use the config advanced 802.11 channel noise command.
config advanced 802.11 { a | b } channel noise { enable | disable }
Syntax Description
Enables non-802.11a noise avoidance in the channel assignment. or ignore. |
|
Disables the non-802.11a noise avoidance in the channel assignment. |
Command Default
Examples
This example shows how to have RRM consider non-802.11a noise when making channel selection updates for all 802.11a Cisco lightweight access points:
Related Commands
config advanced 802.11 channel outdoor-ap-dca
To enable or disable the controller to avoid checking the non-DFS channels, use the config advanced 802.11 channel outdoor-ap-dca command.
config advanced 802.11 { a | b } channel outdoor-ap-dca { enable | disable }
Syntax Description
Enables 802.11 network dca list option for outdoor access point. |
|
Disables 802.11 network dca list option for outdoor access point. |
Command Default
Usage Guidelines
The config advanced 802.11 { a | b } channel outdoor-ap-dca { enable | disable } command is applicable only for deployments having outdoor access points such as 1522 and 1524.
Examples
This example shows how to enable the 802.11a dca list option for outdoor access point:
Related Commands
config advanced 802.11 channel pda-prop
To enable or disable propogation of persistent devices, use the config advanced 802.11 channel pda-prop command.
config advanced 802.11 { a | b } channel pda-prop { enable | disable }
Syntax Description
Enables the 802.11 network DCA list option for the outdoor access point. |
|
Disables the 802.11 network DCA list option for the outdoor access point. |
Command Default
Examples
This example shows how to enable or disable propagation of persistent devices:
config advanced 802.11 channel update
To have Radio Resource Management (RRM) initiate a channel selection update for all 802.11a Cisco lightweight access points, use the config advanced 802.11 channel update command.
config advanced 802.11 { a | b } channel update
Syntax Description
Command Default
Examples
This example shows how to initiate a channel selection update for all 802.11a network access points:
Related Commands
show advanced 802.11a channel
config advanced 802.11b channel update
Configure Advanced 802.11 Coverage Commands
Use the config advanced 802.11 coverage commands to configure coverage hole detection settings on supported 802.11 networks.
config advanced 802.11 coverage
To enable or disable coverage hole detection, use the config advanced 802.11 coverage command.
config advanced 802.11 { a | b } coverage { enable | disable }
Syntax Description
Command Default
Usage Guidelines
If you enable coverage hole detection, the controller automatically determines, based on data that is received from the access points, whether any access points have clients that are potentially located in areas with poor coverage.
If both the number and percentage of failed packets exceed the values that you entered in the config advanced 802.11 coverage packet-count and config advanced 802.11 coverage fail-rate commands for a 5-second period, the client is considered to be in a pre-alarm condition. The controller uses this information to distinguish between real and false coverage holes and excludes clients with poor roaming logic. A coverage hole is detected if both the number and percentage of failed clients meet or exceed the values entered in the config advanced 802.11 coverage level global and config advanced 802.11 coverage exception global commands over a 90-second period. The controller determines whether the coverage hole can be corrected and, if appropriate, mitigates the coverage hole by increasing the transmit power level for that specific access point.
Examples
This example shows how to enable coverage hole detection on 802.11a network:
>
config advanced 802.11a coverage enable
Related Commands
config advanced 802.11 coverage exception global
config advanced 802.11 coverage fail-rate
config advanced 802.11 coverage level global
config advanced 802.11 coverage packet-count
config advanced 802.11 coverage rssi-threshold
show advanced 802.11 coverage
config advanced 802.11 coverage exception global
To specify the percentage of clients on an access point that are experiencing a low signal level but cannot roam to another access point, use the config advanced 802.11 coverage exception global command.
config advanced 802.11 { a | b } coverage exception global percent
Syntax Description
Command Default
Usage Guidelines
If both the number and percentage of failed packets exceed the values that you entered in the config advanced 802.11 coverage packet-count and config advanced 802.11 coverage fail-rate commands for a 5-second period, the client is considered to be in a pre-alarm condition. The controller uses this information to distinguish between real and false coverage holes and excludes clients with poor roaming logic. A coverage hole is detected if both the number and percentage of failed clients meet or exceed the values entered in the config advanced 802.11 coverage level global and config advanced 802.11 coverage exception global commands over a 90-second period. The controller determines whether the coverage hole can be corrected and, if appropriate, mitigates the coverage hole by increasing the transmit power level for that specific access point.
Examples
This example shows how to specify the percentage of clients for all 802.11a access points that are experiencing a low signal level:
>
config advanced 802.11a coverage exception global 50
Related Commands
config advanced 802.11 coverage
config advanced 802.11 coverage fail-rate
config advanced 802.11 coverage level global
config advanced 802.11 coverage packet-count
config advanced 802.11 coverage rssi-threshold
show advanced 802.11 coverage
config advanced 802.11 coverage fail-rate
To specify the failure rate threshold for uplink data or voice packets, use the config advanced 802.11 coverage fail-rate command.
config advanced 802.11 { a | b } coverage { data | voice } fail-rate percent
Syntax Description
Failure rate as a percentage. Valid values are from 1 to 100 percent. |
Command Default
Usage Guidelines
If both the number and percentage of failed packets exceed the values that you entered in the config advanced 802.11 coverage packet-count and config advanced 802.11 coverage fail-rate commands for a 5-second period, the client is considered to be in a pre-alarm condition. The controller uses this information to distinguish between real and false coverage holes and excludes clients with poor roaming logic. A coverage hole is detected if both the number and percentage of failed clients meet or exceed the values entered in the config advanced 802.11 coverage level global and config advanced 802.11 coverage exception global commands over a 90-second period. The controller determines whether the coverage hole can be corrected and, if appropriate, mitigates the coverage hole by increasing the transmit power level for that specific access point.
Examples
This example shows how to configure the threshold count for minimum uplink failures for data packets:
>
config advanced 802.11a coverage data fail-rate 80
Related Commands
config advanced 802.11 coverage
config advanced 802.11 coverage exception global
config advanced 802.11 coverage level global
config advanced 802.11 coverage packet-count
config advanced 802.11 coverage rssi-threshold
show advanced 802.11 coverage
config advanced 802.11 coverage level global
To specify the minimum number of clients on an access point with an received signal strength indication (RSSI) value at or below the data or voice RSSI threshold, use the config advanced 802.11 coverage level global command.
config advanced 802.11 { a | b } coverage level global clients
Syntax Description
Command Default
Usage Guidelines
If both the number and percentage of failed packets exceed the values that you entered in the config advanced 802.11 coverage packet-count and config advanced 802.11 coverage fail-rate commands for a 5-second period, the client is considered to be in a pre-alarm condition. The controller uses this information to distinguish between real and false coverage holes and excludes clients with poor roaming logic. A coverage hole is detected if both the number and percentage of failed clients meet or exceed the values entered in the config advanced 802.11 coverage level global and config advanced 802.11 coverage exception global commands over a 90-second period. The controller determines whether the coverage hole can be corrected and, if appropriate, mitigates the coverage hole by increasing the transmit power level for that specific access point.
Examples
This example shows how to specify the minimum number of clients on all 802.11a access points with an RSSI value at or below the RSSI threshold:
Related Commands
config advanced 802.11 coverage
config advanced 802.11 coverage exception global
config advanced 802.11 coverage fail-rate
config advanced 802.11 coverage packet-count
config advanced 802.11 coverage rssi-threshold
show advanced 802.11 coverage
config advanced 802.11 coverage packet-count
To specify the minimum failure count threshold for uplink data or voice packets, use the config advanced 802.11 coverage packet-count command.
config advanced 802.11 { a | b } coverage { data | voice } packet-count packets
Syntax Description
Minimum number of packets. Valid values are from 1 to 255 packets. |
Command Default
Usage Guidelines
If both the number and percentage of failed packets exceed the values that you entered in the config advanced 802.11 coverage packet-count and config advanced 802.11 coverage fail-rate commands for a 5-second period, the client is considered to be in a pre-alarm condition. The controller uses this information to distinguish between real and false coverage holes and excludes clients with poor roaming logic. A coverage hole is detected if both the number and percentage of failed clients meet or exceed the values entered in the config advanced 802.11 coverage level global and config advanced 802.11 coverage exception global commands over a 90-second period. The controller determines whether the coverage hole can be corrected and, if appropriate, mitigates the coverage hole by increasing the transmit power level for that specific access point.
Examples
This example shows how to configure the failure count threshold for uplink data packets:
>
config advanced 802.11a coverage data packet-count 100
Related Commands
config advanced 802.11 coverage
config advanced 802.11 coverage exception global
config advanced 802.11 coverage fail-rate
config advanced 802.11 coverage level global
config advanced 802.11 coverage rssi-threshold
show advanced 802.11 coverage
config advanced 802.11 coverage rssi-threshold
To specify the minimum receive signal strength indication (RSSI) value for packets that are received by an access point, use the config advanced 802.11 coverage rssi-threshold command.
config advanced 802.11 { a | b } coverage { data | voice } rssi-threshold rssi
Syntax Description
Command Default
Usage Guidelines
The rssi value that you enter is used to identify coverage holes (or areas of poor coverage) within your network. If the access point receives a packet in the data or voice queue with an RSSI value that is below the value that you enter, a potential coverage hole has been detected.
The access point takes RSSI measurements every 5 seconds and reports them to the controller in 90-second intervals.
If both the number and percentage of failed packets exceed the values that you entered in the config advanced 802.11 coverage packet-count and config advanced 802.11 coverage fail-rate commands for a 5-second period, the client is considered to be in a pre-alarm condition. The controller uses this information to distinguish between real and false coverage holes and excludes clients with poor roaming logic. A coverage hole is detected if both the number and percentage of failed clients meet or exceed the values entered in the config advanced 802.11 coverage level global and config advanced 802.11 coverage exception global commands over a 90-second period. The controller determines whether the coverage hole can be corrected and, if appropriate, mitigates the coverage hole by increasing the transmit power level for that specific access point.
Examples
This example shows how to configure the minimum receive signal strength indication threshold value for data packets that are received by an 802.11a access point:
>
config advanced 802.11a coverage data rssi-threshold -60
Related Commands
config advanced 802.11 coverage
config advanced 802.11 coverage exception global
config advanced 802.11 coverage fail-rate
config advanced 802.11 coverage level global
config advanced 802.11 coverage packet-count
show advanced 802.11 coverage
config advanced 802.11 edca-parameters
To enable a specific enhanced distributed channel access (EDCA) profile on the 802.11a network, use the config advanced 802.11 edca-parameters command.
config advanced 802.11 { a | b } edca-parameters {wmm-default | svp-voice | optimized-voice | optimized-video-voice | custom-voice}
Syntax Description
Command Default
Examples
This example shows how to enable Spectralink voice priority parameters:
Related Commands
config advanced 802.11 factory
To reset 802.11a advanced settings back to the factory defaults, use the config advanced 802.11 factory command.
config advanced 802.11 { a | b } factory
Syntax Description
Command Default
Examples
This example shows how to return all the 802.11a advanced settings to their factory defaults:
Related Commands
config advanced 802.11 group-member
To configure members in 802.11 static RF group, use the config advanced 802.11 group-member command.
config advanced 802.11 { a | b } group-member { add | remove } controller controller-ip-address
Syntax Descriptiono
Command Default
Examples
This example shows how to add a controller in the the 802.11a automatic RF group:
Related Commands
config advanced 802.11 group-mode
To set the 802.11a automatic RF group selection mode on or off, use the config advanced 802.11 group-mode command.
config advanced 802.11 { a | b } group-mode { auto | leader | off | restart }
Syntax Descriptiono
Sets the 802.11a RF group selection to automatic update mode. |
|
Sets the 802.11a RF group selection to static mode, and sets this controller as the group leader. |
|
Command Default
Examples
This example shows how to turn the 802.11a automatic RF group selection mode on:
This example shows how to turn the 802.11a automatic RF group selection mode off:
Related Commands
Configure Advanced 802.11 Logging Commands
Use the config advanced 802.11 logging commands to configure report log settings on supported 802.11 networks.
config advanced 802.11 logging channel
To turn the channel change logging mode on or off, use the config advanced 802.11 logging channel command.
config advanced 802.11 { a | b } logging channel { on | off }
Syntax Description
Command Default
Examples
This example shows how to turn the 802.11a logging channel selection mode on:
Related Commands
config advanced 802.11 logging coverage
To turn the coverage profile logging mode on or off, use the config advanced 802.11 logging coverage command.
config advanced 802.11 { a | b } logging coverage { on | off }
Syntax Description
Command Default
Examples
This example shows how to turn the 802.11a coverage profile violation logging selection mode on:
Related Commands
config advanced 802.11 logging foreign
To turn the foreign interference profile logging mode on or off, use the config advanced 802.11 logging foreign command.
config advanced 802.11 { a | b } logging foreign { on | off }
Syntax Description
Enables the 802.11 foreign interference profile violation logging. |
|
Disables the 802.11 foreign interference profile violation logging. |
Command Default
Examples
This example shows how to turn the 802.11a foreign interference profile violation logging selection mode on:
Related Commands
config advanced 802.11 logging load
To turn the 802.11a load profile logging mode on or off, use the config advanced 802.11 logging load command.
config advanced 802.11 { a | b } logging load { on | off }
Syntax Description
Command Default
Examples
This example shows how to turn the 802.11a load profile logging mode on:
Related Commands
config advanced 802.11 logging noise
To turn the 802.11a noise profile logging mode on or off, use the config advanced 802.11 logging noise command.
config advanced 802.11 { a | b } logging noise { on | off }
Syntax Description
Command Default
Examples
This example shows how to turn the 802.11a noise profile logging mode on:
Related Commands
config advanced 802.11 logging performance
To turn the 802.11a performance profile logging mode on or off, use the config advanced 802.11 logging performance command.
config advanced 802.11 { a | b } logging performance { on | off }
Syntax Description
Command Default
Examples
This example shows how to turn the 802.11a performance profile logging mode on:
Related Commands
config advanced 802.11 logging txpower
To turn the 802.11a transmit power change logging mode on or off, use the config advanced 802.11 logging txpower command.
config advanced 802.11 { a | b } logging txpower { on | off }
Syntax Description
Command Default
Examples
This example shows how to turn the 802.11a transmit power change mode on:
Related Commands
Configure Advanced 802.11 Monitor Commands
Use the config advanced 802.11 monitor commands to configure monitor settings on supported 802.11 networks.
config advanced 802.11 monitor channel-list
To set the 802.11a noise, interference, and rogue monitoring channel list, use the config advanced 802.11 monitor channel-list command.
config advanced 802.11 { a | b } monitor channel-list { all | country | dca }
Syntax Description
Monitors the channels used by the automatic channel assignment. |
Command Default
Examples
This example shows how to monitor the channels used in the configured country:
Related Commands
config advanced 802.11 monitor coverage
To set the coverage measurement interval between 60 and 3600 seconds, use the config advanced 802.11 monitor coverage command.
config advanced 802.11 { a | b } monitor coverage seconds
Syntax Description
Command Default
Examples
This example shows how to set the coverage measurement interval to 60 seconds:
Related Commands
config advanced 802.11 monitor load
To set the load measurement interval between 60 and 3600 seconds, use the config advanced 802.11 monitor load command.
config advanced 802.11 { a | b } monitor load seconds
Syntax Description
Command Default
Examples
This example shows how to set the load measurement interval to 60 seconds:
Related Commands
config advanced 802.11 monitor mode
To enable or disable 802.11a access point monitoring, use the config advanced 802.11 monitor mode command.
config advanced 802.11 { a | b } monitor mode { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the 802.11a access point monitoring:
Related Commands
config advanced 802.11 monitor ndp-type
To configure 802.11 access point radio resource management neighbor discovery protocol type, use the following command:
config advanced 802.11 { a | b } monitor ndp-type { protected | transparent }
Syntax Description
Specifies the Tx RRM transparent neighbor discovery protocol. |
Command Default
Usage Guidelines
Before you configure the 802.11 access point RRM neighbor discovery protocol type, ensure that you have disabled the network by entering the config 802.11 disable network command.
Examples
This example shows how to enable the 802.11a access point RRM neighbor discovery protocol type as protected:
Related Commands
show advanced 802.11 monitor
config advanced 802.11 monitor mode
config 802.11 disable
config advanced 802.11 monitor noise
To set the 802.11a noise measurement interval between 60 and 3600 seconds, use the config advanced 802.11 monitor noise command.
config advanced 802.11 { a | b } monitor noise seconds
Syntax Description
Command Default
Examples
This example shows how to set the noise measurement interval to 120 seconds:
Related Commands
config advanced 802.11 monitor signal
To set the signal measurement interval between 60 and 3600 seconds, use the config advanced 802.11 monitor signal command.
config advanced 802.11 { a | b } monitor signal seconds
Syntax Description
Command Default
Examples
This example shows how to set the signal measurement interval to 120 seconds:
Related Commands
show advanced 802.11a monitor
config advanced 802.11b monitor signal
Configure Advanced 802.11 Profile Commands
Use the config advanced 802.11 profile commands to configure Cisco lightweight access point profile settings on supported 802.11 networks.
- config advanced 802.11 profile clients
- config advanced 802.11 profile customize
- config advanced 802.11 profile foreign
- config advanced 802.11 profile noise
- config advanced 802.11 profile throughput
- config advanced 802.11 profile utilization
- config advanced 802.11 receiver
- config advanced 802.11 tpc-version
- config advanced 802.11 tpcv2-intense
- config advanced 802.11 tpcv2-per-chan
- config advanced 802.11 tpcv2-thresh
- config advanced 802.11 txpower-update
- config advanced backup-controller primary
- config advanced backup-controller secondary
- config advanced client-handoff
- config advanced dot11-padding
- config advanced assoc-limit
- config advanced eap
- config advanced max-1x-session
- config advanced rate
- config advanced sip-preferred-call-no
- config advanced statistics
- config advanced probe filter
- config advanced probe limit
- config advanced timers ap-discovery-timeout
- config advanced timers ap-fast-heartbeat
- config advanced timers ap-heartbeat-timeout
- config advanced timers ap-primary-discovery-timeout
- config advanced timers auth-timeout
- config advanced timers eap-timeout
- config advanced timers eap-identity-request-delay
config advanced 802.11 profile clients
To set the Cisco lightweight access point clients threshold between 1 and 75 clients, use the config advanced 802.11 profile clients command.
config advanced 802.11 { a | b } profile clients { global | cisco_ap } clients
Syntax Description
802.11a Cisco lightweight access point client threshold between 1 and 75 clients. |
Command Default
Examples
This example shows how to set all Cisco lightweight access point clients thresholds to 25 clients:
This example shows how to set the AP1 clients threshold to 75 clients:
Related Commands
config advanced 802.11 profile customize
To turn customizing on or off for an 802.11a Cisco lightweight access point performance profile, use the config advanced 802.11 profile customize command.
config advanced 802.11 { a | b } profile customize cisco_ap { on | off }
Syntax Description
Customizes performance profiles for this Cisco lightweight access point. |
|
Uses global default performance profiles for this Cisco lightweight access point. |
Command Default
Examples
This example shows how to turn performance profile customization on for 802.11a Cisco lightweight access point AP1:
Related Commands
config advanced 802.11 profile foreign
To set the foreign 802.11a transmitter interference threshold between 0 and 100 percent, use the config advanced 802.11 profile foreign command.
config advanced 802.11 { a | b } profile foreign { global | cisco_ap } percent
Syntax Description
802.11a foreign 802.11a interference threshold between 0 and 100 percent. |
Command Default
Examples
This example shows how to set the foreign 802.11a transmitter interference threshold for all Cisco lightweight access points to 50 percent:
This example shows how to set the foreign 802.11a transmitter interference threshold for AP1 to 0 percent:
Related Commands
config advanced 802.11 profile noise
To set the 802.11a foreign noise threshold between –127 and 0 dBm, use the config advanced 802.11 profile noise command.
config advanced 802.11 { a | b } profile noise { global | cisco_ap } dBm
Syntax Description
Configures all 802.11a Cisco lightweight access point specific profiles. |
|
Command Default
Examples
This example shows how to set the 802.11a foreign noise threshold for all Cisco lightweight access points to –127 dBm:
This example shows how to set the 802.11a foreign noise threshold for AP1 to 0 dBm:
Related Commands
config advanced 802.11 profile throughput
To set the Cisco lightweight access point data-rate throughput threshold between 1000 and 10000000 bytes per second, use the config advanced 802.11 profile throughput command.
config advanced 802.11 { a | b } profile throughput { global | cisco_ap } value
Syntax Description
Configures all 802.11a Cisco lightweight access point specific profiles. |
|
802.11a Cisco lightweight access point throughput threshold between 1000 and 10000000 bytes per second. |
Command Default
Examples
This example shows how to set all Cisco lightweight access point data-rate thresholds to 1000 bytes per second:
This example shows how to set the AP1 data-rate threshold to 10000000 bytes per second:
Related Commands
config advanced 802.11 profile utilization
To set the RF utilization threshold between 0 and 100 percent, use the config advanced 802.11 profile utilization command. The operating system generates a trap when this threshold is exceeded.
config advanced 802.11 { a | b } profile utilization { global | cisco_ap } percent
Syntax Description
Configures a global Cisco lightweight access point specific profile. |
|
Command Default
Examples
This example shows how to set the RF utilization threshold for all Cisco lightweight access points to 0 percent:
This example shows how to set the RF utilization threshold for AP1 to 100 percent:
Related Commands
config advanced 802.11 receiver
To set the advanced receiver configuration settings, use the config advanced 802.11 receiver command.
config advanced 802.11 { a | b } receiver default
config advanced 802.11 { a | b } receiver rxstart jumpThreshold value
Syntax Description
Command Default
Examples
This example shows how to prevent changes to receiver parameters while the network is enabled:
Related Commands
config advanced 802.11 tpc-version
To configure the Transmit Power Control (TPC) version for a radio, use the config advanced 802.11 tpc-version command.
config advanced 802.11 { a | b } tpc-version { 1 | 2 }
Syntax Description
Command Default
Examples
This example shows how to configure the TPC version as 1 for the 802.11a radio:
Related Commands
config advanced 802.11 tpcv1-thresh
To configure the threshold for Transmit Power Control (TPC) version 1 of a radio, use the config advanced 802.11 tpcv1-thresh command.
config advanced 802.11 { a | b } tpcv1-thresh threshold
Syntax Description
Examples
This example shows how to configure the threshold as –60 dBm for TPC version 1 of the 802.11a radio:
Related Commands
config advanced 802.11 tpc-version
config advanced 802.11 tpcv2-thresh
config advanced 802.11 tpcv2-intense
To configure the computational intensity for Transmit Power Control (TPC) version 2 of a radio, use the config advanced 802.11 tpcv2-intense command.
config advanced 802.11 { a | b } tpcv2-intense intensity
Syntax Description
Examples
This example shows how to configure the computational intensity as 50 for TPC version 2 of the 802.11a radio:
Related Commands
config advanced 802.11 tpc-version
config advanced 802.11 tpcv2-thresh
config advanced 802.11 tpcv2-per-chan
config advanced 802.11 tpcv2-per-chan
To configure the Transmit Power Control Version 2 on a per-channel basis, use the config advanced 802.11 tpcv2-per-chan command.
config advanced 802.11 { a | b } tpcv2-per-chan { enable | disable }
Syntax Description
Enables the configuration of TPC version 2 on a per-channel basis. |
|
Disables the configuration of TPC version 2 on a per-channel basis. |
Examples
This example shows how to enable TPC version 2 on a per-channel basis for the 802.11a radio:
Related Commands
config advanced 802.11 tpc-version
config advanced 802.11 tpcv2-thresh
config advanced 802.11 tpcv2-intense
config advanced 802.11 tpcv2-thresh
To configure the threshold for Transmit Power Control (TPC) version 2 of a radio, use the config advanced 802.11 tpcv2-thresh command.
config advanced 802.11 { a | b } tpcv2-thresh threshold
Syntax Description
Examples
This example shows how to configure the threshold as –60 dBm for TPC version 2 of the 802.11a radio:
Related Commands
config advanced 802.11 tpc-version
config advanced 802.11 tpcv1-thresh
config advanced 802.11 tpcv2-per-chan
config advanced 802.11 txpower-update
To initiate updates of the 802.11a transmit power for every Cisco lightweight access point, use the config advanced 802.11 txpower-update command.
config advanced 802.11 { a | b } txpower-update
Syntax Description
Command Default
Examples
This example shows how to initiate updates of 802.11a transmit power for an 802.11a access point:
Related Commands
config advanced backup-controller primary
To configure a primary backup controller for a specific controller, use the config advanced backup-controller primary command.
config advanced backup-controller primary backup_controller_name backup_controller_ip_address
Syntax Description
Command Default
Usage Guidelines
To delete a primary backup controller entry, enter 0.0.0.0 for the controller IP address.
Examples
This example shows how to configure the primary backup controller:
Related Commands
config advanced backup-controller secondary
To configure a secondary backup controller for a specific controller, use the config advanced backup-controller secondary command.
config advanced backup-controller secondary backup_controller_name backup_controller_ip_address
Syntax Description
Command Default
Usage Guidelines
To delete a secondary backup controller entry, enter 0.0.0.0 for the controller IP address.
Examples
This example shows how to configure a secondary backup controller:
Related Commands
config advanced client-handoff
To set the client handoff to occur after a selected number of 802.11 data packet excessive retries, use the config advanced client-handoff command.
config advanced client-handoff num_of_retries
Syntax Description
Number of excessive retries before client handoff (from 0 to 255). |
Command Default
Usage Guidelines
This command is supported only for the1000/1510 series access points.
Examples
This example shows how to set the client handoff to 100 excessive retries:
Related Commands
config advanced dot11-padding
To enable or disable over-the-air frame padding, use the config advanced dot11-padding command.
config advanced dot11-padding { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable over-the-air frame padding:
Related Commands
debug dot11
debug dot11 mgmt interface
debug dot11 mgmt msg
debug dot11 mgmt ssid
debug dot11 mgmt state-machine
debug dot11 mgmt station
show advanced dot11-padding
config advanced assoc-limit
To configure the rate at which access point radios send association and authentication requests to the controller, use the config advanced assoc-limit command.
config advanced assoc-limit { enable [ number of associations per interval | interval in milliseconds ] | disable }
Syntax Description
(Optional) Number of association request per access point slot in a given interval. The valid range is 1 to 100. |
|
(Optional) Association request limit interval. The valid range is 100 to 10000. |
Command Default
Usage Guidelines
When 200 or more wireless clients try to associate to a controller at the same time, the clients no longer become stuck in the DHCP_REQD state when you use the config advanced assoc-limit command to limit association requests from access points.
Examples
This example shows how to configure the number of association requests per access point slot in a given interval of 20 with the association request limit interval of 250:
config advanced eap
To configure advanced extensible authentication protocol (EAP) settings, use the config advanced eap command.
config advanced eap [eapol-key-timeout timeout | eapol-key-retries retries | identity-request-timeout timeout |
identity-request-retries retries |
key-index index |
max-login-ignore-identity-response {enable | disable}
request-timeout timeout |
request-retries retries]
Syntax Description
Command Default
Examples
This example shows how to configure the key index used for dynamic wired equivalent privacy (WEP):
Related Commands
config advanced max-1x-session
To configure the maximum number of simultaneous 802.1X sessions allowed per access point, use the config advanced max-1x-sessions command.
config advanced max-1x-sessions no_of_sessions
Syntax Description
Specifies the number of Maximum 802.1x session initiation per AP at a time, The range is from 0 to 255, where 0 indicates unlimited. |
Command Default
Examples
This example shows how to configure the maximum number of simultaneous 802.1X sessions:
config advanced rate
To enable or disable switch control path rate limiting, use the config advanced rate command.
config advanced rate [ enable | disable ]
Syntax Description
Command Default
Examples
This example shows how to enable switch control path rate limiting:
config advanced sip-preferred-call-no
To configure voice prioritization, use the config advanced sip-preferred-call-no command.
config advanced sip-preferred-call-no call_index { call_number | none }
Syntax Description
Command Default
Usage Guidelines
Before you configure voice prioritization, you must complete the following prerequisites:
- Set the voice to the platinum QoS level by entering the config wlan qos wlan-id platinum command.
- Enable the admission control (ACM) to this radio by entering the config 802.11 { a | b } cac { voice | video } acm enable command.
- Enable the call-snooping feature for a particular WLAN by entering the config wlan call-snoop enable wlan-id command.
To view statistics about preferred calls, enter the show ap stats { 802.11 { a | b } | wlan } cisco_ap command.
Examples
This example shows how to add a new preferred call for index 2:
Related Commands
config wlan qos
config 802.11 cac video acm
config 802.11 cac voice acm
config wlan call-snoop
show ap stats
config advanced statistics
To enable or disable the Cisco wireless LAN controller port statistics collection, use the config advanced statistics command.
config advanced statistics { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable the switch port statistics collection settings:
Related Commands
config advanced probe filter
To enable or disable the filtering of probe requests forwarded from an access point to the controller, use the config advanced probe filter command.
config advanced probe filter { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the filtering of probe requests forwarded from an access point to the controller:
Related Commands
config advanced probe limit
config radius acct ipsec authentication
show advanced probe
show radius acct statistics
config advanced probe limit
To limit the number of probes sent to the WLAN controller per access point per client in a given interval, use the config advanced probe limit command.
config advanced probe limit num_probes interval
Syntax Description
Number of probe requests (from 1 to 100) forwarded to the controller per client per access point radio in a given interval. |
|
Command Default
The default num_probes is 2 probe requests.
The default interval is 500 milliseconds.
Examples
This example shows how to set the number of probes per access point per client to 5 and the probe interval to 800 milliseconds:
Related Commands
config advanced probe filter
config radius acct ipsec authentication
show advanced probe
Configure Advanced Timers Commands
User the advanced timers commands to configure advanced 802.11a settings.
config advanced timers ap-discovery-timeout
To configure the Cisco lightweight access point discovery time-out, use the config advanced timers ap-discovery-timeout command.
config advanced timers ap-discovery-timeout seconds
Syntax Description
Cisco lightweight access point discovery timeout value between 1 and 10 seconds. |
Command Default
Usage Guidelines
The Cisco lightweight access point discovery timeout is how often a Cisco wireless LAN controller attempts to discover unconnected Cisco lightweight access points.
Examples
This example shows how to configure an access point discovery-timeout with the timeout value of 20:
Related Commands
show advanced timers
config advanced timers ap-fast-heartbeat
config advanced timers ap-heartbeat-timeout
config advanced timers ap-primary-discovery-timeout
config advanced timers auth-timeout
config advanced timers ap-fast-heartbeat
To enable or disable the fast heartbeat timer which reduces the amount of time it takes to detect a controller failure for local, FlexConnect, or all access points, use the config advanced timers ap-fast-heartbeat command.
config advanced timers ap-fast-heartbeat {local | flexconnect | all} {enable | disable} interval
Syntax Description
Command Default
Examples
This example shows how to enable the fast heartbeat interval for access point in local mode:
This example shows how to enable the fast heartbeat interval for access point in FlexConnect mode:
This example shows how to enable the fast heartbeat interval for all access points:
This example shows how to disable the fast heartbeat interval for all access point:
Related Commands
show advanced timers
config advanced timers ap-discovery-timeout
config advanced timers ap-heartbeat-timeout
config advanced timers ap-primary-discovery-timeout
config advanced timers auth-timeout
config advanced timers ap-heartbeat-timeout
To configure the Cisco lightweight access point heartbeat timeout, use the config advanced timers ap-heartbeat-timeout command.
config advanced timers ap-heartbeat-timeout seconds
Syntax Description
Cisco lightweight access point heartbeat timeout value between 1 and 30 seconds. |
Command Default
Usage Guidelines
The Cisco lightweight access point heartbeat timeout controls how often the Cisco lightweight access point sends a heartbeat keep-alive signal to the Cisco wireless LAN controller.
This seconds value should be at least three times larger than the fast heartbeat timer.
Examples
This example shows how to configure an access point heartbeat timeout to 20:
Related Commands
show advanced timers
config advanced timers ap-discovery-timeout
config advanced timers ap-fast-heartbeat
config advanced timers ap-primary-discovery-timeout
config advanced timers auth-timeout
config advanced timers ap-primary-discovery-timeout
To configure the access point primary discovery request timer, use the config advanced timers ap-primary-discovery-timeout command.
config advanced timers ap-primary-discovery-timeout interval
Syntax Description
Access point primary discovery request timer between 30 and 3600 seconds. |
Command Default
Examples
This example shows how to configure the access point primary discovery request timer to 1200 seconds:
Related Commands
show advanced timers
config advanced timers ap-discovery-timeout
config advanced timers ap-fast-heartbeat
config advanced timers ap-heartbeat-timeout
config advanced timers auth-timeout
config advanced timers auth-timeout
To configure the authentication timeout, use the config advanced timers auth-timeout command.
config advanced timers auth-timeout seconds
Syntax Description
Authentication response timeout value in seconds between 10 and 600. |
Command Default
Examples
This example shows how to configure the authentication timeout to 20 seconds:
Related Commands
show advanced timers
config advanced timers ap-fast-heartbeat
config advanced timers ap-discovery-timeout
config advanced timers ap-heartbeat-timeout
config advanced timers ap-primary-discovery-timeout
config advanced timers eap-timeout
To configure the Extensible Authentication Protocol (EAP) expiration timeout, use the config advanced timers eap-timeout command.
config advanced timers eap-timeout seconds
Syntax Description
Command Default
Examples
This example shows how to configure the EAP expiration timeout to 10 seconds:
Related Commands
config advanced timers eap-identity-request-delay
To configure the advanced Extensible Authentication Protocol (EAP) identity request delay in seconds, use the config advanced timers eap-identity-request-delay command.
config advanced timers eap-identity-request-delay seconds
Syntax Description
Advanced EAP identity request delay in number of seconds between 0 and 10. |
Command Default
Examples
This example shows how to configure the advanced EAP identity request delay to 8 seconds:
Related Commands
config advanced timers auth-timeout
config advanced timers rogue-ap
show advanced timers
Configure Access Point Commands
Use the config ap commands to configure access point settings.
config ap
To enable or disable a Cisco lightweight access point or to add or delete a third-party (foreign) access point, use the config ap command.
config ap {{ enable | disable } cisco_ap | { add | delete } MAC port { enable | disable } IP_address }
Syntax Description
Port number through which the foreign access point can be reached. |
|
Command Default
Examples
This example shows how to disable lightweight access point AP1:
This example shows how to add a foreign access point with MAC address 12:12:12:12:12:12 and IP address 192.12.12.1 from port 2033:
Related Commands
config ap bhrate
To configure the Cisco bridge backhaul Tx rate, use the config ap bhrate command.
config ap bhrate { rate | auto } cisco_ap
Syntax Description
Cisco bridge backhaul Tx rate in kbps. The valid values are 6000, 12000, 18000, 24000, 36000, 48000, and 54000. |
|
Command Default
Usage Guidelines
In previous software releases, the default value for bridge data rate was 24000 (24 Mbps). In controller software release 6.0, the default value for bridge data rate is auto. If you configured the default bridge data rate value (24000) in a previous controller software release, the bridge data rate is configured with the new default value (auto) when you upgrade to controller software release 6.0. However, if you configured a non default value (for example, 18000) in a previous controller software release, that configuration setting is preserved when you upgrade to software release 6.0.
When the bridge data rate is set to auto, the mesh backhaul chooses the highest rate where the next higher rate cannot be used due to unsuitable conditions for that specific rate (and not because of conditions that affect all rates).
Examples
This example shows how to configure the Cisco bridge backhaul Tx rate to 54000 kbps:
Related Commands
config ap autoconvert
To automatically convert all access points to a FlexConnect mode or monitor mode upon joining the controller, use the confip ap autoconvert command:
config ap autoconvert { flexconnect | monitor | disable }
Syntax Description
Command Default
Usage Guidelines
When access points in local mode connect to a Cisco 7500 Series Controller, they do not serve clients. The access point details are available in the controller. To enable access points to serve clients or perform monitoring related tasks when connected to the Cisco 7500 Series Controller, the access points must be in FlexConnect mode or monitor mode.
Examples
This example shows how to automatically convert all APs to the FlexConnect mode:
This example shows how to disable the autoconvert option on the APs:
Related Commands
config ap bhrate
To configure the Cisco bridge backhaul Tx rate, use the config ap bhrate command.
config ap bhrate { rate | auto } cisco_ap
Syntax Description
Cisco bridge backhaul Tx rate in kbps. The valid values are 6000, 12000, 18000, 24000, 36000, 48000, and 54000. |
|
Command Default
Usage Guidelines
In previous software releases, the default value for bridge data rate was 24000 (24 Mbps). In controller software release 6.0, the default value for bridge data rate is auto. If you configured the default bridge data rate value (24000) in a previous controller software release, the bridge data rate is configured with the new default value (auto) when you upgrade to controller software release 6.0. However, if you configured a non default value (for example, 18000) in a previous controller software release, that configuration setting is preserved when you upgrade to software release 6.0.
When the bridge data rate is set to auto, the mesh backhaul chooses the highest rate where the next higher rate cannot be used due to unsuitable conditions for that specific rate (and not because of conditions that affect all rates).
Examples
This example shows how to configure the Cisco bridge backhaul Tx rate to 54000 kbps:
Related Commands
config ap bridgegroupname
To set or delete a bridge group name on a Cisco lightweight access point, use the config ap bridgegroupname command.
config ap bridgegroupname { set groupname | delete } cisco_ap
Syntax Description
Deletes a Cisco lightweight access point’s bridge group name. |
|
Command Default
Usage Guidelines
Only access points with the same bridge group name can connect to each other. Changing the AP bridgegroupname may strand the bridge AP.
Examples
This example shows how to delete a bridge group name on Cisco access point’s bridge group name AP02:
Related Commands
config ap bridging
To enable or disable Ethernet-to-Ethernet bridging on a Cisco lightweight access point, use the config ap bridging command.
config ap bridging { enable | disable } cisco_ap
Syntax Description
Enables the Ethernet-to-Ethernet bridging on a Cisco lightweight access point. |
|
Command Default
Examples
This example shows how to enable bridging on an access point:
This example shows hot to disable bridging on an access point:
Related Commands
config ap cdp
To enable or disable the Cisco Discovery Protocol (CDP) on a Cisco lightweight access point, use the config ap cdp command.
config ap cdp { enable | disable | interface { ethernet interface_number | slot slot_id }} { cisco_ap | all }
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Enabled on radio interfaces of mesh APs and disabled on radio interfaces of non-mesh APs. Enabled on Ethernet interfaces of all APs.
Usage Guidelines
The config ap cdp disable all command disables CDP on all access points that are joined to the controller and all access points that join in the future. CDP remains disabled on both current and future access points even after the controller or access point reboots. To enable CDP, enter the config ap cdp enable all command.
Note CDP over Ethernet/radio interfaces is available only when CDP is enabled. After you enable CDP on all access points joined to the controller, you may disable and then reenable CDP on individual access points using the config ap cdp {enable | disable} cisco_ap command. After you disable CDP on all access points joined to the controller, you may not enable and then disable CDP on individual access points.
Examples
This example shows how to enable CDP on all access points:
This example shows how to disable CDP on ap02 access point:
This example shows how to enable CDP for Ethernet interface number 2 on all access points:
Related Commands
config ap core-dump
To configure a Cisco lightweight access point’s memory core dump, use the config ap core-dump command.
config ap core-dump { disable | enable tftp_server_ipaddress filename { compress | uncompress } { cisco_ap | all }
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Usage Guidelines
Examples
This example shows how to configure and compress the core dump file:
Related Commands
config ap crash-file clear-all
config ap crash-file delete
config ap crash-file get-crash-file
config ap crash-file get-radio-core-dump
config ap port
config ap crash-file clear-all
To delete all crash and radio core dump files, use the config ap crash-file clear-all command.
config ap crash-file clear-all
Syntax Description
Command Default
Examples
This example shows how to delete all crash files:
Related Commands
config ap core-dump
config ap crash-file delete
config ap crash-file get-crash-file
config ap crash-file get-radio-core-dump
config ap port
config ap crash-file delete
To delete a single crash or radio core dump file, use the config ap crash-file delete command.
config ap crash-file delete filename
Syntax Description
Command Default
Examples
This example shows how to delete crash file 1:
Related Commands
config ap core-dump
config ap crash-file clear-all
config ap crash-file get-crash-file
config ap crash-file get-radio-core-dump
config ap port
config ap crash-file get-crash-file
To collect the latest crash data for a Cisco lightweight access point, use the config ap crash-file get-crash-file command.
config ap crash-file get-crash-file cisco_ap
Syntax Description
Command Default
Usage Guidelines
Use the transfer upload datatype command to transfer the collected data to the Cisco wireless LAN controller.
Examples
This example shows how to collect the latest crash data for access point AP3:
Related Commands
config ap core-dump
config ap crash-file clear-all
config ap crash-file delete
config ap crash-file get-radio-core-dump
config ap port
config ap crash-file get-radio-core-dump
To get a Cisco lightweight access point’s radio core dump, use the config ap crash-file get-radio-core-dump command.
config ap crash-file get-radio-core-dump slot_id cisco_ap
Syntax Description
Command Default
Examples
This example shows how to collect the radio core dump for access point AP02 and slot 0:
Related Commands
config ap core-dump
config ap crash-file clear-all
config ap crash-file delete
config ap crash-file get-crash-file
config ap port
config ap dot1xuser
To configure the global authentication username and password for all access points currently joined to the controller as well as any access points that join the controller in the future, use the config ap dot1xuser command.
config ap dot1xuser add username user password password { all | cisco_ap }
Syntax Description
Command Default
Usage Guidelines
You must enter a strong password. Strong passwords have the following characteristics:
Examples
This example shows how to configure the global authentication username and password for all access points:
Related Commands
config ap dot1xuser delete
config ap dot1xuser disable
show ap summary
config ap dot1xuser delete
To force a specific access point to use the controller’s global authentication settings, use the config ap dot1xuser delete command.
config ap dot1xuser delete cisco_ap
Syntax Description
Command Default
Examples
This example shows how to delete access point AP01 to use the controller’s global authentication settings:
Related Commands
config ap dot1xuser
config ap dot1xuser disable
show ap summary
config ap dot1xuser disable
To disable authentication for all access points or for a specific access point, use the config ap dot1xuser disable command.
config ap dot1xuser disable { all | cisco_ap }
Syntax Description
Command Default
Usage Guidelines
You can disable 802.1X authentication for a specific access point only if global 802.1X authentication is not enabled. If global 802.1X authentication is enabled, you can disable 802.1X for all access points only.
Examples
This example shows how to disable the authentication for access point cisco_ap1:
Related Commands
config ap dot1xuser
config ap dot1xuser delete
show ap summary
config ap ethernet
To configure the duplex and speed settings on the wireless LAN and the lightweight access points, use the config ap ethernet command.
config ap ethernet duplex [auto | half | full] speed [auto | 10 | 100 | 1000] {all | cisco_ap}
Syntax Description
Command Default
Examples
This example shows how to configure the Ethernet port duplex half settings 10 Mbps for all access points:
Related Commands
config ap group-name
To specify a descriptive group name for a Cisco lightweight access point, use the config ap group-name command.
config ap group-name groupname cisco_ap
Syntax Description
Command Default
Usage Guidelines
The Cisco lightweight access point must be disabled before changing this parameter.
Examples
This example shows how to configure a descriptive name for access point AP01:
Related Commands
config ap group-name
config wlan apgroup
show ap summary
show ap wlan
config ap flexconnect radius auth set
To configure a primary or secondary RADIUS server for a specific FlexConnect access point, use the config ap flexconnect radius auth set command.
config ap flexconnect radius auth set { primary | secondary } ip_address auth_port secret
Syntax Description
Specifies the primary RADIUS server for a specific FlexConnect access point. |
|
Specifies the secondary RADIUS server for a specific FlexConnect access point. |
|
Command Default
Examples
This example shows how to configure a primary RADIUS server for a specific access point:
Related Commands
config ap mode flexconnect
config ap flexconnect vlan wlan
config ap flexconnect vlan
config ap flexconnect vlan native
config ap flexconnect vlan
To enable or disable VLAN tagging for a FlexConnect access, use the config ap flexconnect vlan command.
config ap flexconnect vlan { enable | disable } cisco_ap
Syntax Description
Command Default
Disabled. Once enabled, WLANs enabled for local switching inherit the VLAN assigned at the controller.
Examples
This example shows how to enable the access point’s VLAN tagging for a FlexConnect access:
Related Commands
config ap flexconnect radius auth set
config ap flexconnect vlan add
To add a VLAN to a FlexConnect access point, use the config ap flexconnect vlan add command.
config ap flexconnect vlan add vlan-id acl in-acl out-acl cisco_ap
Syntax Description
Inbound ACL name that contains up to 32 alphanumeric characters. |
|
Outbound ACL name that contains up to 32 alphanumeric characters. |
|
Command Default
Examples
This example shows how to configure the FlexConnect access point:
Related Commands
config ap flexconnect radius auth set
config ap flexconnect vlan native
To configure a native VLAN for a FlexConnect access, use the config ap flexconnect vlan native command.
config ap flexconnect vlan native vlan-id cisco_ap
Syntax Description
Command Default
Examples
This example shows how to configure a native VLAN for a FlexConnect access point mode:
Related Commands
config ap flexconnect vlan wlan
To assign a VLAN ID to a FlexConnect access point, use the config ap flexconnect vlan wlan command.
config ap flexconnect vlan wlan ip_address vlan-id cisco_ap
Syntax Description
Command Default
Examples
This example shows how to assign a VLAN ID to a FlexConnect access point:
Related Commands
config ap flexconnect web-policy acl
To add or delete a Web Policy ACL on a FlexConnect access point, use the config ap flexconnect web-policy acl command.
config ap flexconnect web-policy acl { add | delete } acl_name cisco_ap
Syntax Description
Examples
This example shows how to add a Web Policy ACL on a FlexConnect access point:
Related Commands
config ap flexconnect web-auth wlan
To map a Web-Auth or a Web Passthrough ACL to a WLAN for a FlexConnect access point, use the config ap flexconnect web-auth wlan command.
config ap flexconnect web-auth wlan wlan_id cisco_ap acl_name { enable | disable }
Syntax Description
Name of the Cisco lightweight access point that is in FlexConnect mode. |
|
Name of the Web-Auth or a Web Passthrough ACL that you want to map to the WLAN on the FlexConnect access point. |
|
Examples
This example shows how to enable a Web-Auth or a Web Passthrough ACL ( mywebauthacl) to a WLAN ID 1 for a FlexConnect access point AP02:
Related Commands
config ap flexconnect web-auth
To assign a VLAN ID to a FlexConnect access point, use the config ap flexconnect vlan wlan command.
config ap flexconnect vlan wlan ip_address vlan-id cisco_ap
Syntax Description
Command Default
Examples
This example shows how to assign a VLAN ID to a FlexConnect access point:
Related Commands
config ap image predownload
To configure an image on a specified access point, use the config ap image predownload command.
config ap image predownload { abort | primary | backup } {cisco_ap | all}
Syntax Description
Predownloads an image to a Cisco access point from the controller's primary image. |
|
Predownloads an image to a Cisco access point from the controller's backup image. |
|
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Examples
This example shows how to predownload an image to an access point from the primary image:
Related Commands
config ap image swap
To swap an access point’s primary and backup images, use the config ap image swap command.
config ap image swap {cisco_ap | all}
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Examples
This example shows how to swap an access point’s primary and secondary images:
Related Commands
config ap led-state
To enable or disable the LED-State for an access point, use the config ap led-state command.
config ap led-state { enable | disable } { cisco_ap | all }
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Examples
This example shows how to enable the LED state for an access point:
Related Commands
config ap link-encryption
To enable or disable the Datagram Transport Layer Security (DTLS) data encryption for access points on the 5500 series controller, use the config ap link-encryption command.
config ap link-encryption { enable | disable } { cisco_ap | all }
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
DTLS data encryption is enabled automatically for OfficeExtend access points but disabled by default for all other access points.
Usage Guidelines
Only Cisco 5500 Series Controllers support DTLS data encryption. This feature is not available on other controller platforms. If an access point with data encryption enabled tries to join any other controller, the access point joins the controller, but data packets are sent unencrypted.
Only Cisco 1130, 1140, 1240, and 1250 series access points support DTLS data encryption, and data-encrypted access points can join a Cisco 5500 Series Controller only if the wplus license is installed on the controller. If the wplus license is not installed, the access points cannot join the controller.
Examples
This example shows how to enable the data encryption for an access point:
Related Commands
config ap link-latency
To enable or disable link latency for a specific access point or for all access points currently associated to the controller, use the config ap link-latency command:
config ap link-latency {enable | disable | reset} { cisco_ap | all}
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Usage Guidelines
This command enables or disables link latency only for access points that are currently joined to the controller. It does not apply to access points that join in the future.
Examples
This example shows how to enable the link latency for all access points:
Related Commands
config ap location
To modify the descriptive location of a Cisco lightweight access point, use the config ap location command.
config ap location location cisco_ap
Syntax Description
Location name of the access point (enclosed by double quotation marks). |
|
Command Default
Usage Guidelines
The Cisco lightweight access point must be disabled before changing this parameter.
Examples
This example shows how to configure the descriptive location for access point AP1:
Related Commands
config ap logging syslog level
To set the severity level for filtering syslog messages for a particular access point or for all access points, use the config ap logging syslog level command.
config ap logging syslog level severity_level { cisco_ap | all }
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Usage Guidelines
If you set a syslog level, only those messages whose severity is equal to or less than that level are sent to the access point. For example, if you set the syslog level to Warnings (severity level 4), only those messages whose severity is between 0 and 4 are sent to the access point.
Examples
This example shows how to set the severity for filtering syslog messages to 3:
Related Commands
config logging syslog host
config logging syslog facility
show logging
config ap mgmtuser add
To configure username, password, and secret password for AP management, use the config ap mgmtuser add command.
config ap mgmtuser add username AP_username password AP_password secret secret
{ all | cisco_ap }
Syntax Description
Configures the secret password for privileged AP management. |
|
Applies configuration to every AP that does not have a specific username. |
|
Command Default
Usage Guidelines
The following requirements are enforced on the password:
- The password should contain characters from at least three of the following classes: lowercase letters, uppercase letters, digits, and special characters.
- No character in the password can be repeated more than three times consecutively.
- The password sould not contain management username or reverse of usename.
- The password should not contain words like Cisco, oscic, admin, nimda or any variant obtained by changing the capitalization of letters by substituting 1, |, or ! or substituting 0 for o or substituting $ for s.
The following requirement is enforced on the secret password:
Examples
This example shows how to add a username, password, and secret password for AP management:
Related Commands
config ap mgmtuser delete
To force a specific access point to use the controller’s global credentials, use the config ap mgmtuser delete command.
config ap mgmtuser delete cisco_ap
Syntax Description
Command Default
Examples
This example shows how to delete the credentials of an access point:
Related Commands
config ap mode
To change a Cisco wireless LAN controller communication option for an individual Cisco lightweight access point, use the config ap mode command.
config ap mode { bridge | flexconnect | local | reap | rogue | sniffer | se-connect
monitor [ submode { none | wips }]} cisco_ap
Syntax Description
Converts from a lightweight access point to a mesh access point (bridge mode). |
|
Converts from an indoor mesh access point (MAP or RAP) to a nonmesh lightweight access point (local mode). |
|
Command Default
Usage Guidelines
The sniffer mode captures and forwards all the packets from the clients on that channel to a remote machine that runs AiroPeek or other supported packet analyzer software. It includes information on the timestamp, signal strength, packet size and so on.
Examples
This example shows how to set the controller to communicate with access point AP91 in bridge mode:
This example shows how to set the controller to communicate with access point AP01 in local mode:
This example shows how to set the controller to communicate with access point AP91 in remote office (REAP) mode:
This example shows how to set the controller to communicate with access point AP91 in remote office (REAP) mode:
This example shows how to set the controller to communicate with access point AP91 in a wired rogue access point detector mode:
This example shows how to set the controller to communicate with access point AP02 in wireless sniffer mode:
This example shows how to set the controller to communicate with access point AP02 in wIPS submode:
Related Commands
config 802.11 enable
config ap mode
config ap monitor-mode
show ap config
show ap monitor-mode summary
show wps wips statistics
config ap monitor-mode
To configure Cisco lightweight access point channel optimization, use the config ap monitor-mode command.
config ap monitor-mode { 802.11b fast-channel | no-optimization | tracking-opt | wips-optimized } cisco_ap
Syntax Description
Command Default
Examples
This example shows how to configure a Cisco wireless intrusion prevention system (wIPS) monitor mode on access point AP01:
Related Commands
config 802.11 enable
config ap mode
show ap config
show ap monitor-mode summary
show wps wips statistics
show wps wips summary
config ap name
To modify the name of a Cisco lightweight access point, use the config ap name command.
config ap name new_name old_name
Syntax Description
Command Default
Examples
This example shows how to modify the name of access point AP1 to AP2:
Related Commands
config ap port
To configure the port for a foreign access point, use the config ap port command.
Syntax Description
Command Default
Examples
This example shows how to configure the port for a foreign access point MAC address:
Related Commands
config ap power injector
To configure the power injector state for an access point, use the config ap power injector command.
config ap power injector { enable | disable } { cisco_ap | all} { installed | override | switch_MAC }
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Examples
This example shows how to enable the power injector state for all access points:
Related Commands
config ap power pre-standard
To enable or disable the inline power Cisco pre-standard switch state for an access point, use the config ap power pre-standard command.
config ap power pre-standard { enable | disable } cisco_ap
Syntax Description
Enables the inline power Cisco pre-standard switch state for an access point. |
|
Disables the inline power Cisco pre-standard switch state for an access point. |
|
Command Default
Examples
This example shows how to enable the inline power Cisco pre-standard switch state for access point AP02:
Related Commands
config ap primary-base
To set the Cisco lightweight access point primary Cisco wireless LAN controller, use the config ap primary-base command.
config ap primary-base controller_name cisco_ap [controller_ip_address]
Syntax Description
Command Default
Usage Guidelines
The Cisco lightweight access point associates with this Cisco wireless LAN controller for all network operations and in the event of a hardware reset.
OfficeExtend access points do not use the generic broadcast or over-the air (OTAP) discovery process to find a controller. You must configure one or more controllers because OfficeExtend access points try to connect only to their configured controllers.
Examples
This example shows how to set an access point primary Wireless LAN controller:
Related Commands
config ap priority
To assign a priority designation to an access point that allows it to reauthenticate after a controller failure by priority rather than on a first-come-until-full basis, use the config ap priority command.
config ap priority {1 | 2 | 3 | 4} cisco_ap
Syntax Description
Command Default
Usage Guidelines
In a failover situation, if the backup controller does not have enough ports to allow all the access points in the affected area to reauthenticate, it gives priority to higher-priority access points over lower-priority ones, even if it means replacing lower-priority access points.
Examples
This example shows how to assign a priority designation to access point AP02 that allows it to reauthenticate after a controller failure by assigning a reauthentication priority 3:
Related Commands
config network ap-priority
show ap summary
show network summary
config ap reporting-period
To reset a Cisco lightweight access point, use the config ap reporting-period command.
config ap reporting-period period
Syntax Description
Command Default
Examples
This example shows how to reset an access point reporting period to 120 seconds:
Related Commands
config ap reset
To reset a Cisco lightweight access point, use the config ap reset command.
Syntax Description
Command Default
Examples
This example shows how to reset an access point:
Related Commands
config ap retransmit interval
To configure the access point control packet retransmission interval, use the config ap retransmit interval command.
config ap retransmit interval seconds {all | cisco_ap}
Syntax Description
AP control packet retransmission timeout between 2 and 5 seconds. |
|
Command Default
Examples
This example shows how to configure the retransmission interval for all access points globally:
Related Commands
config ap retransmit count
To configure the access point control packet retransmission count, use the config ap retransmit count command.
config ap retransmit count count {all | cisco_ap}
Syntax Description
Number of times control packet will be retransmitted (range is 3 to 8 times). |
|
Command Default
Examples
This example shows how to configure the retransmission retry count for a specific access point:
Related Commands
config ap role
To specify the role of an access point in a mesh network, use the config ap role command.
config ap role { rootAP | meshAP } cisco_ap
Syntax Description
Designates the mesh access point as a root access point (RAP). |
|
Designates the mesh access point as a mesh access point (MAP). |
|
Command Default
Usage Guidelines
Use the meshAP keyword if the access point has a wireless connection to the controller, or use the rootAP keyword if the access point has a wired connection to the controller. Changing the AP's role will cause the AP to reboot.
Examples
This example shows how to designate mesh access point AP02 as a root access point:
Related Commands
config ap rst-button
To configure the Reset button for an access point, use the config ap rst-button command.
config ap rst-button { enable | disable } cisco_ap
Syntax Description
Command Default
Examples
This example shows how to configure the reset button for access point AP03:
Related Commands
config ap secondary-base
To set the Cisco lightweight access point secondary Cisco wireless LAN controller, use the config ap secondary-base command.
config ap secondary-base controller_name cisco_ap [controller_ip_address]
Syntax Description
Command Default
Usage Guidelines
The Cisco lightweight access point associates with this Cisco wireless LAN controller for all network operations and in the event of a hardware reset.
OfficeExtend access points do not use the generic broadcast or over-the air (OTAP) discovery process to find a controller. You must configure one or more controllers because OfficeExtend access points try to connect only to their configured controllers.
Examples
This example shows how to set an access point secondary Cisco wireless controller:
Related Commands
config ap sniff
To enable or disable sniffing on an access point, use the config ap sniff command.
config ap sniff { 802.11a | 802.11b }{ enable channel server_ip | disable } cisco_ap
Syntax Description
IP address of the remote machine running Omnipeek, Airopeek, |
|
Command Default
Usage Guidelines
When the sniffer feature is enabled on an access point, it starts sniffing the signal on the given channel. It captures and forwards all the packets to the remote computer that runs Omnipeek, Airopeek, AirMagnet, or Wireshark software. It includes information on the timestamp, signal strength, packet size and so on.
Before an access point can act as a sniffer, a remote computer that runs one of the listed packet analyzers must be set up so that it can receive packets sent by the access point. After the Airopeek installation, copy the following.dll files to the location where airopeek is installed:
Examples
This example shows how to enable the sniffing on the 802.11a an access point primary Wireless LAN controller:
Related Commands
show ap config
config ap sniff 802.11b
config ap ssh
To enable Secure Shell (SSH) connectivity on an access point, use the config ap ssh command.
config ap ssh {enable | disable} cisco_ap
Syntax Description
Command Default
Usage Guidelines
The Cisco lightweight access point associates with this Cisco wireless LAN controller for all network operation and in the event of a hardware reset.
Examples
This example shows how to enable SSH connectivity on access point Cisco_ap2:
Related Commands
config ap static-ip
To configure Cisco lightweight access point static IP address settings, use the config ap static-ip command.
config ap static-ip { enable cisco_ap ip_address net_mask gateway | disable cisco_ap | add { domain { cisco_ap | all } domain_name } | { nameserver { cisco_ap | all } dns_ip_address } | delete { domain | nameserver } { cisco_ap | all }}
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Usage Guidelines
An access point cannot discover the controller using Domain Name System (DNS) resolution if a static IP address is configured for the access point, unless you specify a DNS server and the domain to which the access point belongs.
After you enter the IP, netmask, and gateway addresses, save your configuration to reboot the access point. After the access point rejoins the controller, you can enter the domain and DNS server information.
Examples
This example shows how to configure an access point static IP address:
Related Commands
config ap stats-timer
To set the time in seconds that the Cisco lightweight access point sends its DOT11 statistics to the Cisco wireless LAN controller, use the config ap stats-timer command.
config ap stats-timer period cisco_ap
Syntax Description
Time in seconds from 0 to 65535. A zero value disables the timer. |
|
Command Default
Usage Guidelines
A value of 0 (zero) means that the Cisco lightweight access point does not send any DOT11 statistics. The acceptable range for the timer is from 0 to 65535 seconds, and the Cisco lightweight access point must be disabled to set this value.
Examples
This example shows how to set the stats timer to 600 seconds for access point AP2:
Related Commands
config ap syslog host global
To configure a global syslog server for all access points that join the controller, use the config ap syslog host global command.
config ap syslog host global syslog_server_IP_address
Syntax Description
Command Default
Usage Guidelines
By default, the global syslog server IP address for all access points is 255.255.255.255. Make sure that the access points can reach the subnet on which the syslog server resides before configuring the syslog server on the controller. If the access points cannot reach this subnet, the access points are unable to send out syslog messages.
Examples
This example shows how to configure a global syslog server for all access points:
Related Commands
config ap syslog host specific
show ap config global
show ap config general
config ap syslog host specific
To configure a syslog server for a specific access point, use the config ap syslog host specific command.
config ap syslog host specific cisco_ap syslog_server_IP_address
Syntax Description
Command Default
Usage Guidelines
By default, the syslog server IP address for each access point is 0.0.0.0, indicating that it is not yet set. When the default value is used, the global access point syslog server IP address is pushed to the access point.
Examples
This example shows how to configure a syslog server:
Related Commands
config ap syslog host global
show ap config global
show ap config general
config ap tcp-adjust-mss
To enable or disable the TCP maximum segment size (MSS) on a particular access point or on all access points, use the config ap tcp-adjust-mss command.
config ap tcp-adjust-mss { enable | disable } { cisco_ap | all } size
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Usage Guidelines
When you enable this feature, the access point checks for TCP packets to and from wireless clients in its data path. If the MSS of these packets is greater than the value that you configured or greater than the default value for the CAPWAP tunnel, the access point changes the MSS to the new configured value.
Examples
This example shows how to enable the TCP MSS on access point Cisco_ap1 with a segment size of 1200 bytes:
Related Commands
config ap telnet
To enable Telnet connectivity on an access point, use the config ap telnet command.
config ap telnet {enable | disable} cisco_ap
Syntax Description
Command Default
Usage Guidelines
The Cisco lightweight access point associates with this Cisco wireless LAN controller for all network operation and in the event of a hardware reset.
Examples
This example shows how to enable Telnet connectivity on access point cisco_ap1:
This example shows how to disable Telnet connectivity on access point cisco_ap1:
Related Commands
config ap tertiary-base
To set the Cisco lightweight access point tertiary Cisco wireless LAN controller, use the config ap tertiary-base command.
config ap tertiary-base controller_name cisco_ap [controller_ip_address]
Syntax Description
Command Default
Usage Guidelines
OfficeExtend access points do not use the generic broadcast or over-the air (OTAP) discovery process to find a controller. You must configure one or more controllers because OfficeExtend access points try to connect only to their configured controllers.
The Cisco lightweight access point associates with this Cisco wireless LAN controller for all network operations and in the event of a hardware reset.
Examples
This example shows how to set the access point teritary wireless LAN controller:
Related Commands
config ap tftp-downgrade
To configure the settings used for downgrading a lightweight access point to an autonomous access point, use the config ap ftp-downgrade command.
config ap tftp-downgrade { tftp_ip_address | image_filename | ap_name }
Syntax Description
Command Default
Examples
This example shows how to configure the settings for downgrading access point ap1240_102301:
Related Commands
config ap username
To assign a username and password to access either a specific access point or all access points, use the config ap username command
config ap username user_id password passwd [all | ap_name]
Syntax Description
Command Default
Examples
This example shows how to assign a username and password to a specific access point:
This example shows how to assign the same username and password to a all access points:
config ap venue
To configure the venue information for 802.11u network on an access point, use the config ap venue command.
config ap venue { add venue_name venue-group venue-type lang-code cisco-ap | delete }
Syntax Description
Specifies the venue group category. See Table 2-4 . |
|
Specifies a venue type. This value depends on the venue-group specified. See Table 2-4 . |
|
Language used. An ISO-14962-1997 encoded string that defines the language. This string is a three character language code. Enter the first three letters of the language in English (for example: eng for English). |
|
Command Default
Examples
The command shows how to set the venue details for an access point named cisco-ap1:
> config ap venue add test 11 34 eng cisco-ap1
|
|
|
---|---|---|
Related Commands
config wlan mobile-concierge dot11u
config ap wlan
To enable or disable wireless LAN override for a Cisco lightweight access point radio, use the config ap wlan command.
config ap wlan { enable | disable } { 802.11a | 802.11b } wlan_id cisco_ap
Syntax Description
Cisco wireless LAN controller ID assigned to a wireless LAN. |
|
Command Default
Examples
This example shows how to enable wireless LAN override on the AP03 802.11a radio:
Related Commands
config auth-list add
To create an authorized access point entry, use the config auth-list add command.
config auth-list add { mic | ssc } AP_MAC [ AP_key ]
Syntax Description
Specifies that the access point has a manufacture-installed certificate. |
|
Specifies that the access point has a self-signed certificate. |
|
Command Default
Examples
This example shows how to create an authorized access point entry with a manufacturer-installed certificate on MAC address 00:0b:85:02:0d:20:
Related Commands
config auth-list ap-policy
To configure an access point authorization policy, use the config auth-list ap-policy command.
config auth-list ap-policy { authorize-ap { enable | disable } | ssc { enable | disable }}
Syntax Description
Command Default
Examples
This example shows how to enable an access point authorization policy:
This example shows how to enable an access point with a self-signed certificate to connect:
Related Commands
config auth-list delete
To delete an access point entry, use the config auth-list delete command.
config auth-list delete AP_MAC
Syntax Description
Command Default
Examples
This example shows how to delete an access point entry for MAC address 00:0b:85:02:0d:20:
Related Commands
Configure Band-Select Commands
Use the config band-select command to configure the band selection feature on the controller.
config band-select cycle-count
To set the band select probe cycle count, use the config band-select cycle-count command.
config band-select cycle-count cycle_count
Syntax Description
Command Default
Examples
This example shows how to set the proble cycle count for band select to 8:
Related Commands
config band-select cycle-threshold
config band-select expire
config band-select client-rssi
config band-select cycle-threshold
To set the time threshold for a new scanning cycle, use the config band-select cycle-threshold command.
config band-select cycle-threshold cycle_threshold
Syntax Description
Value for the cycle threshold between 1 and 1000 milliseconds. |
Command Default
Examples
This example shows how to set the time threshold for a new scanning cycle with threshold value of 700 milliseconds:
Related Commands
config band-select cycle-threshold
config band-select expire
config band-select client-rssi
config band-select expire
To set the entry expire for band select, use the config band-select expire command.
config band-select expire {suppression | dual-band} seconds
Syntax Description
Command Default
Examples
This example shows how to set the suppression expire to 70 seconds:
Related Commands
config band-select cycle-threshold
config band-select cycle-count
config band-select client-rssi
config band-select client-rssi
To set the client received signal strength indicator (RSSI) threshold for band select, use the config band-select client-rssi command.
config band-select client-rssi client_rssi
Syntax Description
Minimum dBM of a client RSSI to respond to probe between 20 and 90. |
Command Default
Examples
This example shows how to set the RSSI threshold for band select to 70:
Related Commands
config band-select cycle-threshold
config band-select expire
config band-select cycle-count
config boot
To change a Cisco wireless LAN controller boot option, use the config boot command.
config boot { primary | backup }
Syntax Description
Command Default
Usage Guidelines
Each Cisco wireless LAN controller can boot off the primary, last-loaded operating system image (OS) or boot off the backup, earlier-loaded OS image.
Examples
This example shows how to set the primary image as active so that the LAN controller can boot off the primary, last loaded image:
This example shows how to set the backup image as active so that the LAN controller can boot off the backup, earlier loaded OS image:
Related Commands
config cdp timer
To configure the Cisco Discovery Protocol (CDP) maximum hold timer, use the config cdp timer command.
Syntax Description
Command Default
Examples
This example shows how to configure the CDP maximum hold timer to 150 seconds:
config certificate
To configure Secure Sockets Layer (SSL) certificates, use the config certificate command.
config certificate { generate { webadmin | webauth } | compatibility { on | off }}
Syntax Description
Specifies the compatibility mode for inter-Cisco wireless LAN controller IPsec settings. |
|
Command Default
Examples
This example shows how to generate a new web administration SSL certificate:
This example shows how to configure the compatibility mode for inter-Cisco wireless LAN controller IPsec settings:
Related Commands
config certificate lsc
show certificate compatibility
show certificate lsc
show certificate summary
show local-auth certificates
config certificate lsc
To configure Locally Significant Certificate (LSC) certificates, use the config certificate lsc commands.
config certificate lsc { enable | disable | ca-server http://url:port/path | ca-cert { add | delete } |
subject-params country state city orgn dept email | other-params keysize } |
ap-provision { auth-list { add | delete } ap_mac | revert-cert retries }
Syntax Description
Command Default
The default value of keysize is 2048 bits.
The default value of retries is 3.
Usage Guidelines
You can configure only one CA server. To configure a different CA server, delete the configured CA server by using the config certificate lsc ca-server delete command, and then configure a different CA server.
If you configure an access point provision list, only the access points in the provision list are provisioned when you enable AP provisioning (in Step 8). If you do not configure an access point provision list, all access points with an MIC or SSC certificate that join the controller are LSC provisioned.
Examples
This example shows how to enable the LSC settings:
This example shows how to enable the LSC settings for Certificate Authority (CA) server settings:
This example shows how to add a CA certificate from the CA server and add it to the controller’s certificate database:
This example shows how to configure an LSC certificate with the keysize of 2048 bits:
Related Commands
config certificate
show certificate compatibility
show certificate lsc
show certificate summary
show local-auth certificates
Configure Client Commands
User the config client commands to configure client settings.
config client ccx clear-reports
To clear the client reporting information, use the config client ccx clear-reports command.
config client ccx clear-reports client_mac_address
Syntax Description
Command Default
Examples
This example shows how to clear the reporting information of the client MAC address 172.19.28.40:
Related Commands
config client ccx get-profiles
config client ccx get-operating-parameters
config client ccx get-manufacturer-info
config client ccx get-client-capability
show client ccx profiles
show client ccx operating-parameters
show client ccx manufacturer-info
show client ccx client-capability
config client ccx stats-request
show client ccx stats-report
config client ccx clear-results
To clear the test results on the controller, use the config client ccx clear-results command.
config client ccx clear-results client_mac_address
Syntax Description
Command Default
Examples
This example shows how to clear the test results of the client MAC address 172.19.28.40:
Related Commands
config client ccx default-gw-ping
config client ccx
config client ccx dns-ping
config client ccx dns-resolve
config client ccx test-association
config client ccx test-dot1x
config client ccx test-profile
config client ccx test-abort
config client ccx send-message
show client ccx last-test-status
show client ccx last-response-status
show client ccx results
show client ccx frame-data
config client ccx default-gw-ping
To send a request to the client to perform the default gateway ping test, use the config client ccx default-gw-ping command.
config client ccx default-gw-ping client_mac_address
Syntax Description
Command Default
Usage Guidelines
This test does not require the client to use the diagnostic channel.
Examples
This example shows how to send a request to the client 00:E0:77:31:A3:55 to perform the default gateway ping test:
Related Commands
config client ccx dhcp-test
config client ccx dns-ping
config client ccx dns-resolve
config client ccx test-association
config client ccx test-dot1x
config client ccx test-profile
config client ccx test-abort
config client ccx clear-results
config client ccx send-message
show client ccx last-test-status
show client ccx last-response-status
show client ccx results
show client ccx frame-data
config client ccx dhcp-test
To send a request to the client to perform the DHCP test, use the config client ccx dhcp-test command.
config client ccx dhcp-test client_mac_address
Syntax Description
Command Default
Usage Guidelines
This test does not require the client to use the diagnostic channel.
Examples
This example shows how to send a request to the client 00:E0:77:31:A3:55 to perform the DHCP test:
Related Commands
config client ccx default-gw-ping
config client ccx dns-ping
config client ccx dns-resolve
config client ccx test-association
config client ccx test-dot1x
config client ccx test-profile
config client ccx test-abort
config client ccx clear-results
config client ccx send-message
show client ccx last-test-status
show client ccx last-response-status
show client ccx results
show client ccx frame-data
config client ccx dns-ping
To send a request to the client to perform the Domain Name System (DNS) server IP address ping test, use the config client ccx dns-ping command.
config client ccx dns-ping client_mac_address
Syntax Description
Command Default
Usage Guidelines
This test does not require the client to use the diagnostic channel.
Examples
This example shows how to send a request to the client 00:E0:77:31:A3:55 to perform the DNS server IP address ping test:
Related Commands
config client ccx default-gw-ping
config client ccx dhcp
config client ccx dns-resolve
config client ccx test-association
config client ccx test-dot1x
config client ccx test-profile
config client ccx test-abort
config client ccx clear-results
config client ccx send-message
show client ccx last-test-status
show client ccx last-response-status
show client ccx results
show client ccx frame-data
config client ccx dns-resolve
To send a request to the client to perform the Domain Name System (DNS) resolution test to the specified hostname, use the config client ccx dns-resolve command.
config client ccx dns-resolve client_mac_address host_name
Syntax Description
Command Default
Usage Guidelines
This test does not require the client to use the diagnostic channel.
Examples
This example shows how to send a request to the client 00:E0:77:31:A3:55 to perform the DNS name resolution test to the specified hostname:
Related Commands
config client ccx default-gw-ping
config client ccx dhcp
config client ccx dns-ping
config client ccx test-association
config client ccx test-dot1x
config client ccx test-profile
config client ccx test-abort
config client ccx clear-results
config client ccx send-message
show client ccx last-test-status
show client ccx last-response-status
show client ccx results
show client ccx frame-data
config client ccx get-client-capability
To send a request to the client to send its capability information, use the config client ccx get-client-capability command.
config client ccx get-client-capability client_mac_address
Syntax Description
Command Default
Examples
This example shows how to send a request to the client 172.19.28.40 to send its capability information:
Related Commands
config client ccx get-profiles
config client ccx get-operating-parameters
config client ccx get-manufacturer-info
config client ccx clear-reports
show client ccx profiles
show client ccx operating-parameters
show client ccx manufacturer-info
show client ccx client-capability
config client ccx stats-request
show client ccx stats-report
config client ccx get-manufacturer-info
To send a request to the client to send the manufacturer’s information, use the config client ccx get-manufacturer-info command.
config client ccx get-manufacturer-info client_mac_address
Syntax Description
Command Default
Examples
This example shows how to send a request to the client 172.19.28.40 to send the manufacturer’s information:
Related Commands
config client ccx get-profiles
config client ccx get-operating-parameters
config client ccx get-client-capability
config client ccx clear-reports
show client ccx profiles
show client ccx operating-parameters
show client ccx manufacturer-info
show client ccx client-capability
config client ccx stats-request
show client ccx stats-report
config client ccx get-operating-parameters
To send a request to the client to send its current operating parameters, use the config client ccx get-operating-parameters command.
config client ccx get-operating-parameters client_mac_address
Syntax Description
Command Default
Examples
This example shows how to send a request to the client 172.19.28.40 to send its current operating parameters:
Related Commands
config client ccx get-profiles
config client ccx get-manufacturer-info
config client ccx get-client-capability
config client ccx clear-reports
show client ccx profiles
show client ccx operating-parameters
show client ccx manufacturer-info
show client ccx client-capability
config client ccx stats-request
show client ccx stats-report
config client ccx get-profiles
To send a request to the client to send its profiles, use the config client ccx get-profiles command.
config client ccx get-profiles client_mac_address
Syntax Description
Command Default
Examples
This example shows how to send a request to the client 172.19.28.40 to send its profile details:
Related Commands
config client ccx get-operating-parameters
config client ccx get-manufacturer-info
config client ccx get-client-capability
config client ccx clear-reports
show client ccx profiles
show client ccx operating-parameters
show client ccx manufacturer-info
show client ccx client-capability
config client ccx stats-request
show client ccx stats-report
config client ccx log-request
To configure a Cisco client eXtension (CCX) log request for a specified client device, use the config client ccx log-request command.
config client ccx log-request log_type {roam | rsna | syslog} client_mac_address
Syntax Description
Command Default
Examples
This example shows how to specify the request to specify the client CCS system log:
This example shows how to specify the client CCX roaming log:
This example shows how to specify the client CCX RSNA log:
Related Commands
config client ccx send-message
To send a message to the client, use the config client ccx send-message command.
config client ccx send-message client_mac_address message_id
Syntax Description
Command Default
Examples
This example shows how to send a message to the client MAC address 172.19.28.40 with the message user-action-required:
Related Commands
config client ccx default-gw-ping
config client ccx dhcp
config client ccx dns-ping
config client ccx dns-resolve
config client ccx test-association
config client ccx test-dot1x
config client ccx test-profile
config client ccx test-abort
config client ccx clear-results
show client ccx last-test-status
show client ccx last-response-status
show client ccx results
show client ccx frame-data
config client ccx stats-request
To send a request for statistics, use the config client ccx stats-request command.
config client ccx stats-request measurement_duration stats_name {dot11 | security} client_mac_address
Syntax Description
Command Default
Examples
This example shows how to specify dot11 counter settings:
Related Commands
config client ccx test-abort
To send a request to the client to abort the current test, use the config client ccx test-abort command.
config client ccx test-abort client_mac_address
Syntax Description
Command Default
Usage Guidelines
Examples
This example shows how to send a request to the client 11:11:11:11:11:11 to abort the correct test settings:
Related Commands
config client ccx default-gw-ping
config client ccx dhcp
config client ccx dns-ping
config client ccx dns-resolve
config client ccx test-association
config client ccx test-dot1x
config client ccx test-profile
config client ccx clear-results
config client ccx send-message
show client ccx last-test-status
show client ccx last-response-status
show client ccx results
show client ccx frame-data
config client ccx test-association
To send a request to the client to perform the association test, use the config client ccx test-association command.
config client ccx test-association client_mac_address ssid bssid 802.11 { a | b | g } channel
Syntax Description
Command Default
Examples
This example shows how to send a request to the client MAC address 00:0E:77:31:A3:55 to perform the basic SSID association test:
Related Commands
config client ccx default-gw-ping
config client ccx dhcp
config client ccx dns-ping
config client ccx dns-resolve
config client ccx test-dot1x
config client ccx test-profile
config client ccx test-abort
config client ccx clear-results
config client ccx send-message
show client ccx last-test-status
show client ccx last-response-status
show client ccx results
show client ccx frame-data
config client ccx test-dot1x
To send a request to the client to perform the 802.1x test, use the config client ccx test-dot1x command.
config client ccx test-dot1x client_mac_address profile_id bssid 802.11 { a | b | g } channel
Syntax Description
Command Default
Examples
This example shows how to send a request to the client to perform the 802.11b test with the profile name profile_01:
Related Commands
config client ccx default-gw-ping
config client ccx dhcp
config client ccx dns-ping
config client ccx dns-resolve
config client ccx test-association
config client ccx test-profile
config client ccx test-abort
config client ccx clear-results
config client ccx send-message
show client ccx last-test-status
show client ccx last-response-status
show client ccx results
show client ccx frame-data
config client ccx test-profile
To send a request to the client to perform the profile redirect test, use the config client ccx test-profile command.
config client ccx test-profile client_mac_address profile_id
Syntax Description
Note The profile_id should be from one of the client profiles for which client reporting is enabled. |
Command Default
Examples
This example shows how to send a request to the client to perform the profile redirect test with the profile name profile_01:
Related Commands
config client ccx default-gw-ping
config client ccx dhcp
config client ccx dns-ping
config client ccx dns-resolve
config client ccx test-association
config client ccx test-dot1x
config client ccx test-abort
config client ccx clear-results
config client ccx send-message
show client ccx last-test-status
show client ccx last-response-status
show client ccx results
show client ccx frame-data
config client deauthenticate
To disconnect a client, use the config client deauthenticate command.
config client deauthenticate MAC
Syntax Description
Command Default
Examples
This example shows how to deauthenticate a client:
Related Commands
config client location-calibration
To configure link aggregation, use the config client location-calibration command.
config client location-calibration {enable mac_address interval | disable mac_address}
Syntax Description
(Optional) Specifies that client location calibration is enabled. |
|
(Optional) Specifies that client location calibration is disabled. |
Command Default
Examples
This example shows how to enable the client location calibration for the client 37:15:85:2a with a measurement interval of 45 seconds:
Related Commands
config coredump
To enable or disable the controller to generate a core dump file following a crash, use the config cordump command.
config coredump { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the controller to generate a core dump file following a crash:
Related Commands
config coredump ftp
config coredump username
show coredump summary
config coredump ftp
To automatically upload a controller core dump file to an FTP server after experiencing a crash, use the config coredump ftp command:
config coredump ftp server_ip_address filename
Syntax Description
IP address of the FTP server to which the controller sends its core dump file. |
|
Command Default
Usage Guidelines
The controller must be able to reach the FTP server to use this command.
Examples
This example shows how to configure the controller to upload a core dump file named core_dump_controller to an FTP server at network address 192.168.0.13 :
Related Commands
config coredump
config coredump username
show coredump summary
config coredump username
To specify the FTP server username and password when uploading a controller core dump file after experiencing a crash, use the config coredump username command.
config coredump username ftp_username password ftp_password
Syntax Description
Command Default
Usage Guidelines
The controller must be able to reach the FTP server to use this command.
Examples
This example shows how to specify a FTP server username of admin and password adminpassword for the core dump file upload:
Related Commands
config country
To configure the controller’s country code, use the config country command.
Syntax Description
Command Default
Usage Guidelines
Cisco wireless LAN controllers must be installed by a network administrator or qualified IT professional and the installer must select the proper country code. Following installation, access to the unit should be password protected by the installer to maintain compliance with regulatory requirements and to ensure proper unit functionality. See the related product guide for the most recent country codes and regulatory domains.
You can use the show country command to display a list of supported countries.
Examples
This example shows how to configure the controller’s country code to DE:
Related Commands
config cts sxp
To configure Cisco TrustSec SXP (CTS) connections on the controller, use the config cts sxp command.
config cts sxp { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable CTS on the controller:
Related Commands
config cts sxp connection
config cts sxp default password
config cts sxp retry period
config cts sxp connection
To configure a Cisco TrustSec SXP (CTS) connection on the controller, use the config cts sxp connection command.
config cts sxp connection { delete | peer } ip-address
Syntax Description
Configures the next hop switch with which the controller is connected. |
|
Command Default
Usage Guidelines
Default password should be configured before adding CTS connections.
Examples
This example shows how to configure a peer for a CTS connection:
Related Commands
config cts sxp
config cts sxp default password
config cts sxp retry period
config cts sxp default password
To configure the default password for MD5 Authentication of SXP messages, use the config cts sxp default password command.
config cts sxp default password password
Syntax Description
Default password for MD5 Authentication of SXP messages. The password should contain a minimum of six characters. |
Command Default
Examples
This example shows how to configure the default password for MD5 Authentication of SXP messages:
Related Commands
config cts sxp retry period
To configure the SXP retry period, use the config cts sxp retry period command.
config cts sxp retry period time-in-seconds
Syntax Description
Time after which a CTS connection should be again tried for after a failure to connect. |
Command Default
Examples
This example shows how to configure the SXP retry period as 20 seconds:
Related Commands
config cts sxp
config cts sxp connection
config cts sxp default password
config custom-web ext-webauth-mode
To configure external URL web-based client authorization for the custom-web authentication page, use the config custom-web ext-webauth-mode command.
config custom-web ext-webauth-mode { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the external URL web-based client authorization:
Related Commands
config custom-web redirectUrl
config custom-web weblogo
config custom-web webmessage
config custom-web webtitle
config custom-web ext-webauth-url
config custom-web logout-popup
show custom-web
config custom-web ext-webauth-url
To configure the complete external web authentication URL for the custom-web authentication page, use the config custom-web ext-webauth-url command.
config custom-web ext-webauth-url URL
Syntax Description
Command Default
Examples
This example shows how to configure the complete external web authentication URL http://www.AuthorizationURL.com/ for the web-based client authorization:
Related Commands
config custom-web redirectUrl
config custom-web weblogo
config custom-web webmessage
config custom-web webtitle
config custom-web ext-webauth-mode
config custom-web logout-popup
show custom-web
config custom-web ext-webserver
To configure an external web server, use the config custom-web ext-webserver command.
config custom-web ext-webserver { add index IP_address | delete index }
Syntax Description
Index of the external web server in the list of external web server. The index must be a number between 1 and 20. |
|
Command Default
Examples
This example shows how to add the index of the external web server 2 to the IP address of the external web server 192.23.32.19:
Related Commands
config custom-web logout-popup
config custom-web ext-webauth-mode
config custom-web logout-popup
To enable or disable the custom web authentication logout popup, use the config custom-web logout-popup command.
config custom-web logout-popup { enable | disable }
Syntax Description
Enables the custom web authentication logout popup. This page appears after a successful login or a redirect of the custom web authentication page. |
|
Command Default
Examples
This example shows how to disable the custom web authentication logout popup:
Related Commands
config custom-web ext-webauth-mode
config custom-web redirectUrl
To configure the redirect URL for the custom-web authentication page, use the config custom-web redirectUrl command.
config custom-web redirectUrl URL
Syntax Description
Command Default
Examples
This example shows how to configure the URL that is redirected to abc.com:
Related Commands
config custom-web ext-webauth-mode
config custom-web ext-webauth-url
config custom-web webauth-type
To configure the type of web authentication, use the config custom-web webauth-type command.
config custom-web webauth-type { internal | customized | external }
Syntax Description
Command Default
Examples
This example shows how to configure the type of the web authentication type to internal:
Related Commands
config custom-web ext-webauth-mode
config custom-web ext-webauth-url
config custom-web weblogo
To configure the web authentication logo for the custom-web authentication page, use the config custom-web weblogo command.
config custom-web weblogo { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the web authentication logo:
Related Commands
config custom-web ext-webauth-mode
config custom-web ext-webauth-url
config custom-web webmessage
To configure the custom web authentication message text for the custom-web authentication page, use the config custom-web webmessage command.
config custom-web webmessage message
Syntax Description
Command Default
Examples
This example shows how to configure the message text Thisistheplace for webauthentication:
Related Commands
config custom-web ext-webauth-mode
config custom-web webtitle
To configure the web authentication title text for the custom-web authentication page, use the config custom-web webtitle command.
config custom-web webtitle title
Syntax Description
Command Default
Examples
This example shows how to set the custom title text Helpdesk for web authentication:
Related Commands
config custom-web ext-webauth-mode
config database size
To configure the local database, use the config database command.
Syntax Description
Command Default
Usage Guidelines
Use the show database command to display local database configuration.
Examples
This example shows how to configure the DHCP lease for scope 003.
Related Commands
config dhcp
To configure the internal DHCP, use the config dhcp command.
config dhcp { address-pool scope start end | create-scope scope |
default-router scope router_1 [ router_2 ] [ router_3 ] | delete-scope scope | disable scope |
dns-servers scope dns1 [ dns2 ] [ dns3 ] | domain scope domain |
enable scope | lease scope lease_duration |
netbios-name-server scope wins1 [ wins2 ] [ wins3 ] |
network scope network netmask | opt-82 remote-id { ap_mac | ap_mac : ssid | ap-ethmac }}
Syntax Description
Command Default
Usage Guidelines
Use the show dhcp command to display the internal DHCP configuration.
Examples
This example shows how to configure the DHCP lease for the scope 003:
Related Commands
config dhcp proxy
config dhcp timeout
config interface dhcp
config wlan dhcp_server
debug dhcp
debug dhcp service-port
debug disable-all
show dhcp
show dhcp proxy
config dhcp proxy
To specify the level at which DHCP packets are modified, use the config dhcp proxy command.
config dhcp proxy { enable | disable {bootp-broadcast [enable | disable]} }
Syntax Description
Allows the controller to modify the DHCP packets without a limit. |
|
Reduces the DHCP packet modification to the level of a relay. |
|
Command Default
Usage Guidelines
Examples
This example shows how to disable the DHCP packet modification:
This example shows how to enable the DHCP BootP broadcast option:
Related Commands
config dhcp
config dhcp timeout
config interface dhcp
config wlan dhcp_server
config wlan passive-client
debug dhcp
debug dhcp service-port
debug disable-all
show dhcp
show dhcp proxy
config dhcp timeout
To configure a DHCP timeout, use the config dhcp timeout command.
config dhcp timeout timeout-value
Syntax Description
Command Default
Examples
This example shows how to set the DHCP timeout to 10 seconds:
Related Commands
config dhcp
config interface dhcp
config wlan dhcp_server
config wlan passive-client
debug dhcp
debug dhcp service-port
debug disable-all
show dhcp
show dhcp proxy
config exclusionlist
To create or delete an exclusion list entry, use the config exclusionlist command.
config exclusionlist { add MAC [ description ] | delete MAC | description MAC [ description ]}
Syntax Description
(Optional) Description, up to 32 characters, for an excluded entry. |
Command Default
Examples
This example shows how to create a local exclusion list entry for the MAC address xx:xx:xx:xx:xx:xx:
This example shows how to delete a local exclusion list entry for the MAC address xx:xx:xx:xx:xx:xx:
Related Commands
Configure Guest-LAN Commands
Use the config guest-lan commands to create, delete, enable, and disable the wireless LAN commands.
config guest-lan
To create, delete, enable or disable a wireless LAN, use the config guest-lan command.
config guest-lan { create | delete } guest_lan_id interface_name | { enable | disable } guest_lan_id
Syntax Description
Command Default
Examples
This example shows how to enable a wireless LAN with the LAN ID 16:
Related Commands
config guest-lan custom-web ext-webauth-url
To redirect guest users to an external server before accessing the web login page, use the config guest-lan custom-web ext-webauth-url command to specify the URL of the external server.
config guest-lan custom-web ext-webauth-url ext_web_url guest_lan_id
Syntax Description
Command Default
Examples
This example shows how to enable a wireless LAN with the LAN ID 16:
Related Commands
config guest-lan custom-web global disable
To use a guest-LAN specific custom web configuration rather than a global custom web configuration, use the config guest-lan custom-web global disable command.
config guest-lan custom-web global disable guest_lan_id
Syntax Description
Command Default
Usage Guidelines
If you enter the config guest-lan custom-web global enable guest_lan_id command, the custom web authentication configuration at the global level is used.
Examples
This example shows how to disable the global web configuration for guest LAN ID 1:
Related Commands
config guest-lan
config guest-lan create
config guest-lan custom-web ext-webauth-url
config guest-lan custom-web login_page
config guest-lan custom-web webauth-type
config guest-lan custom-web login_page
To enable wired guest users to log into a customized web login page, use the config guest-lan custom-web login_page command.
config guest-lan custom-web login_page page_name guest_lan_id
Syntax Description
Command Default
Examples
This example shows how to customize a web login page custompage1 for guest LAN ID 1:
Related Commands
config guest-lan
config guest-lan create
config guest-lan custom-web ext-webauth-url
config guest-lan custom-web webauth-type
To define the web login page for wired guest users, use the config guest-lan custom-web webauth-type command.
config guest-lan custom-web webauth-type {internal | customized | external} guest_lan_id
Syntax Description
Displays the default web login page for the controller. This is the default value. |
|
Displays the custom web login page that was previously configured. |
|
Command Default
Examples
This example shows how to configure the guest LAN with the webauth-type as internal for guest LAN ID 1:
Related Commands
config guest-lan ingress-interface
To configure the wired guest VLAN’s ingress interface which provides a path between the wired guest client and the controller by way of the Layer 2 access switch, use the config guest-lan ingress-interface command.
config guest-lan ingress-interface guest_lan_id interface_name
Syntax Description
Command Default
Examples
This example shows how to provide a path between the wired guest client and the controller with guest LAN ID 1 and the interface name guest01:
Related Commands
config guest-lan interface
To configure an egress interface to transmit wired guest traffic out of the controller, use the config guest-lan interface command.
config guest-lan interface guest_lan_id interface_name
Syntax Description
Command Default
Examples
This example shows how to configure an egress interface to transmit guest traffic out of the controller for guest LAN ID 1 and interface name guest01:
Related Commands
config guest-lan mobility anchor
To add or delete mobility anchor, use the config guest-lan mobility anchor command.
config guest-lan mobility anchor { add | delete } wlan_id anchor_ip
Syntax Description
Command Default
Examples
This example shows how to delete a mobility anchor for WAN ID 4 and the anchor IP 192.168.0.14 :
Related Commands
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
config wlan mobility anchor
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config guest-lan nac
To enable or disable Network Admission Control (NAC) out-of-band support for a guest LAN, use the config guest-lan nac command:
config guest-lan nac { enable | disable } guest_lan_id
Syntax Description
Command Default
Examples
This example shows how to enable the NAC out-of-band support for guest LAN ID 3:
Related Commands
show nac statistics
show nac summary
config wlan nac
debug nac
config guest-lan security
To configure the security policy for the wired guest LAN, use the config guest-lan security command.
config guest-lan security {{web-auth {enable | disable | acl | server-precedence} guest_lan_id | {web-passthrough {acl | email-input | disable | enable} guest_lan_id}}
Syntax Description
Configures the authentication server precedence order for web authentication users. |
|
Specifies the web captive portal with no authentication required. |
|
Command Default
Examples
This example shows how to configure the security web authentication policy for guest LAN ID 1:
Related Commands
config flexconnect acl
To apply access control lists configured on a FlexConnect access point, use the config flexconnect acl command.
config flexconnect acl { apply | create | delete } acl_name
Syntax Description
Examples
This example shows how to apply the ACL configured on a FlexConnect access point:
config flexconnect acl rule
To configure access control list (ACL) rules on a FlexConnect access point, use the config flexconnect acl rule command.
config flexconnect acl rule
{action rule_name rule_index { permit | deny } |
add rule_name rule_index |
change index rule_name old_index new_index |
delete rule_name rule_index |
destination address rule_name rule_index ip_address netmask |
destination port range rule_name rule_index start_port end_port |
direction rule_name rule_index { in | out | any } |
dscp rule_name rule_index dscp |
protocol rule_name rule_index protocol |
source address rule_name rule_index ip_address netmask |
source port range rule_name rule_index start_port end_port |
swap index rule_name index_1 index_2 }
Syntax Description
Command Default
Examples
This example shows how to configure an ACL to permit access:
Related Commands
config flexconnect group
To add, delete, or configure a FlexConnect group, use the config flexconnect group command.
config flexconnect group group_name
{ add | delete | ap { add | delete } ap-mac | radius server { add | delete }{ primary | secondary } server_index } | radius ap {authority | disable | eap-fast | enable | leap | pac-timeout | server-key| user}} predownload {disable | enable | master ap_name | slave {retry-count | ap-name} cisco_ap | start}
Syntax Description
Command Default
Usage Guidelines
Examples
This example shows how to add a FlexConnect group for MAC address 192.12.1.2:
This example shows how to add a RADIUS server as a primary server for a FlexConnect group with the server index number 1:
Related Commands
config ap mode
config flexconnect join min-latency
config flexconnect office-extend
debug flexconnect group
show flexconnect group detail
show flexconnect group summary
config flexconnect group vlan
To configure VLAN for a FlexConnect group, use the config flexconnect group vlan command.
config flexconnect group group_name vlan { add vlan-id acl in-aclname out-aclname } | { delete vlan-id }
Syntax Description
Examples
This example shows how to add VLAN ID 1 for the FlexConnect group myflexacl where the in-bound ACL name is in-acl and the out-bound ACL is out-acl:
Related Commands
debug flexconnect group
show flexconnect group detail
show flexconnect group summary
config flexconnect group web-auth
To configure Web-Auth ACL for a FlexConnect group, use the config flexconnect group web-auth command.
config flexconnect group group_name web-auth wlan wlan-id acl acl-name { enable | disable }
Syntax Description
Examples
This example shows how to enable Web-Auth ACL webauthacl for the FlexConnect group myflexacl on WLAN ID 1:
Related Commands
debug flexconnect group
show flexconnect group detail
show flexconnect group summary
config flexconnect group web-policy
To configure Web Policy ACL for a FlexConnect group, use the config flexconnect group web-policy command.
config flexconnect group group_name web-policy acl { add | delete } acl-name
Syntax Description
Examples
This example shows how to add the Web Policy ACL mywebpolicyacl to the FlexConnect group myflexacl:
Related Commands
debug flexconnect group
show flexconnect group detail
show flexconnect group summary
config flexconnect join min-latency
To enable or disable the access point to choose the controller with the least latency when joining, use the config flexconnect join min-latency command.
config flexconnect join min-latency { enable | disable } cisco_ap
Syntax Description
Enables the access point to choose the controller with the least latency when joining. |
|
Disables the access point to choose the controller with the least latency when joining. |
|
Command Default
Usage Guidelines
When you enable this feature, the access point calculates the time between the discovery request and discovery response and joins the controller that responds first. This command is supported only on the following controller releases:
Examples
This example shows how to enable the access point to choose the controller with the least latency when joining:
Related Commands
config ap mode
config flexconnect group
config flexconnect office-extend
config flexconnect office-extend
To configure an OfficeExtend access point, use the config flexconnect office-extend command.
config flexconnect office-extend {{ enable | disable } cisco_ap | clear-personalssid-config cisco_ap }
Syntax Description
Command Default
OfficeExtend mode is enabled automatically when you enable FlexConnect mode on the access point.
Usage Guidelines
Currently, only Cisco Aironet 1130 series and 1140 series access points that are joined to a Cisco 5500 Series Controller with a WPlus license can be configured to operate as OfficeExtend access points.
Rogue detection is disabled automatically when you enable the OfficeExtend mode for an access point. OfficeExtend access points, which are deployed in a home environment, are likely to detect a large number of rogue devices. You can enable or disable rogue detection for a specific access point or for all access points by using the config rogue detection { enable | disable } { cisco_ap | all } command.
DTLS data encryption is enabled automatically when you enable the OfficeExtend mode for an access point. However, you can enable or disable DTLS data encryption for a specific access point or for all access points by using the config ap link-encryption { enable | disable } { cisco_ap | all } command.
Telnet and SSH access are disabled automatically when you enable the OfficeExtend mode for an access point. However, you can enable or disable Telnet or SSH access for a specific access point by using the config ap telnet { enable | disable } cisco_ap or config ap ssh { enable | disable } cisco_ap command.
Link latency is enabled automatically when you enable the OfficeExtend mode for an access point. However, you can enable or disable link latency for a specific access point or for all access points currently associated to the controller by using the config ap link-latency { enable | disable } { cisco_ap | all } command.
Examples
This example shows how to enable the office-extend mode for the access point Cisco_ap:
This example shows how to clear only the access point’s personal SSID for the access point Cisco_ap:
Related Commands
debug flexconnect group
show flexconnect group detail
show flexconnect group summary
Configure Interface Group Commands
Use the config interface group to create and delete an interface group.
config interface group
To add an interface to the existing interface group, use the config interface group interface command.
config interface group
{ create interface-group-name interface-group-description } |
{ delete interface-group-name } |
{ interface { add | delete } interface-group-name interface-name } |
{ description interface-group-name interface-group-description }
Syntax Description
Interface group’s description to be entered within double-quotes. Valid range is up to 32 characters. |
|
Edits the list of interface represented by the interface group. |
|
Command Default
Examples
This example shows how to create a new interface group with the name int-grp-10:
config interface acl
To configure an interface’s access control list, use the config interface acl command.
config interface acl { ap-manager | management | interface_name } { ACL | none }
Syntax Description
Command Default
Usage Guidelines
For a Cisco 2100 Series Wireless LAN Controller, you must configure a preauthentication ACL on the wireless LAN for the external web server. This ACL should then be set as a wireless LAN preauthentication ACL under Web Policy. However, you do not need to configure any preauthentication ACL for Cisco 4400 Series Wireless LAN Controllers.
Examples
This example shows how to configure an access control list with a value None:
Related Commands
config interface address
To configure address information for an interface, use the config interface address command.
config interface address
{ ap-manager IP_address netmask gateway |
management IP_address netmask gateway |
service-port IP_address netmask |
virtual IP_address |
interface-name interface-name IP_address netmask gateway }
Syntax Description
Specifies the interface identified by the interface-name parameter. |
|
Command Default
Usage Guidelines
For Cisco 5500 Series Controllers, you are not required to configure an AP-manager interface. The management interface acts like an AP-manager interface by default.
Examples
This example shows how to configure an access point manager interface with IP address 10.109.15.7, network mask 255.255.0.0, and gateway address 10.109.15.1:
Related Commands
config interface ap-manager
To enable or disable access point manager features on the management or dynamic interface, use the config interface ap-manager command.
config interface ap-manager { management | interface_name } { enable | disable }
Syntax Description
Enables access point manager features on a dynamic interface. |
|
Disables access point manager features on a dynamic interface. |
Command Default
Usage Guidelines
Use the management option to enable or disable dynamic AP management for the management interface. For Cisco 5500 Series Controllers, the management interface acts like an AP-manager interface by default. If desired, you can disable the management interface as an AP-manager interface and create another dynamic interface as an AP manager.
When you enable this feature for a dynamic interface, the dynamic interface is configured as an AP-manager interface (only one AP-manager interface is allowed per physical port). A dynamic interface that is marked as an AP-manager interface cannot be used as a WLAN interface.
Examples
This example shows how to disable an access point manager myinterface:
Related Commands
config interface create
To create a dynamic interface (VLAN) for wired guest user access, use the config interface create command.
config interface create interface_name vlan-id
Syntax Description
Command Default
Examples
This example shows how to create a dynamic interface with the interface named lab2 and VLAN ID 6:
Related Commands
config interface delete
To delete a dynamic interface, use the config interface delete command.
config interface delete interface-name
Syntax Description
Command Default
Examples
This example shows how to delete a dynamic interface named VLAN501:
Related Commands
config interface dhcp
To configure DHCP options on an interface, use the config interface dhcp command.
config interface dhcp
{ ap-manager [ primary dhcp_server secondary dhcp_server | option-82 [ enable | disable ] ] | management [ primary dhcp_server secondary dhcp_server | option-82 [ enable | disable ] ] |
service-port { enable | disable } | dynamic-interface name [ primary dhcp_server secondary dhcp_server | option-82 [ enable | disable ] ]}
Syntax Description
Specifies the interface and the primary DHCP server. Optionally, you can also enter the address of the alternate DHCP server. |
|
Command Default
Examples
This example shows how to configure ap-manager server with the primary DHCP server 10.21.15.01 and secondary DHCP server 10.21.15.25:
This example shows how to configure DHCP option 82 on the ap-manager:
This example shows how to enable the DHCP for the out-of-band service port:
Related Commands
config dhcp
config dhcp proxy
config interface dhcp
config wlan dhcp_server
debug dhcp
debug dhcp service-port
debug disable-all
show dhcp
show dhcp proxy
show interface
config interface group
To configure interface groups, use the config interface group command.
config interface group {{create | delete} interface_group_name description_details} | {description interface_group_name description_details} | { interface { add | delete } interface_group_name interface_name}}
Syntax Description
Command Default
Examples
This example shows how to create a new interface group and add a description to the group:
This example shows how to delete an interface group:
This example shows how to add an interface to an interface group:
Related Commands
config interface guest-lan
To enable or disable the guest LAN VLAN, use the config interface guest-lan command.
config interface guest-lan interface_name {enable | disable}
Syntax Description
Command Default
Examples
This example shows how to enable the guest LAN feature on the interface named myinterface:
Related Commands
config interface hostname
To configure the Domain Name System (DNS) hostname of the virtual gateway interface, use the config interface hostname command.
config interface hostname virtual DNS_host
Syntax Description
Command Default
This example shows how to configure virtual gateway interface to use the specified virtual address of the fully qualified DNS hostname DNS_Host:
Related Commands
config interface nat-address
To deploy your Cisco 5500 Series Controller behind a router or other gateway device that is using one-to-one mapping network address translation (NAT), use the config interface nat-address command.
config interface nat-address { management | dynamic-interface interface_name } {{ enable | disable } | { set public_IP_address }}
Syntax Description
Command Default
Usage Guidelines
These NAT commands can be used only on Cisco 5500 Series Controllers and only if the management interface is configured for dynamic AP management.
These commands are supported for use only with one-to-one-mapping NAT, where each private client has a direct and fixed mapping to a global address. They do not support one-to-many NAT, which uses source port mapping to enable a group of clients to be represented by a single IP address.
Examples
This example shows how to enable one-to-one mapping NAT on the management interface:
This example shows how to set the external NAP IP address 10.10.10.10 on the management interface:
Related Commands
config interface port
To map a physical port to the interface (if a link aggregation trunk is not configured), use the config interface port command.
config interface port { management | interface_name } primary_port [ secondary_port ]
Syntax Description
Command Default
Usage Guidelines
You can use the management option for all controllers except the Cisco 5500 Series Controllers.
Examples
This example shows how to configure the LAb02 interface’s primary port number to 3:
Related Commands
config interface quarantine vlan
To configure a quarantine VLAN on any dynamic interface, use the config interface quarantine vlan command.
config interface quarantine vlan interface-name vlan_id
Syntax Description
Command Default
Examples
This example shows how to configure a quarantine VLAN on the quarantine interface with the VLAN ID 10:
Related Commands
config interface vlan
To configure an interface’s VLAN identifier, use the config interface vlan command.
config interface vlan { ap-manager | management | interface-name } vlan
Syntax Description
Command Default
Examples
This example shows how to configure VLAN ID 10 on the management interface:
Related Commands
config lag
To enable or disable link aggregation (LAG), use the config lag command.
Syntax Description
Command Default
Examples
This example shows how to enable LAG settings:
This example shows how to disable LAG settings:
Related Commands
config ldap
To configure the Lightweight Directory Access Protocol (LDAP) server settings, use the config ldap command.
config ldap {add | delete | disable | enable | retransmit-timeout} index
Syntax Description
Command Default
Examples
This example shows how to enable LDAP server index 10:
Related Commands
config ldap add
To configure a Lightweight Directory Access Protocol (LDAP) server, use the config ldap add command.
config lap add index server_ip_address port user_base user_attr user_type
Syntax Description
Distinguished name for the subtree that contains all of the users. |
|
Command Default
Examples
This example shows how to configure a LDAP server with the index10, server IP address 10.31.15.45, port number 2:
Related Commands
config ldap simple-bind
To configure the local authentication bind method for the Lightweight Directory Access Protocol (LDAP) server, use the config ldap simple-bind command.
config ldap simple-bind {anonymous index | authenticated index username username password password }
Syntax Description
Specifies that a username and password be entered to secure access to the LDAP server. |
|
Command Default
Examples
This example shows how to configure the local authentication bind method that allows anonymous access to the LDAP server:
Related Commands
config license agent
To configure the license agent on the Cisco 5500 Series Controller, use the config license agent command.
config license agent { default {disable | authenticate [none] }} { listener http {disable | { plaintext | encrypt } url authenticate [acl acl ] {max-message size ] [none] }} { max-session sessions } { notify {disable | url } username password }
Syntax Description
Command Default
The license agent is disabled by default.
The listener is disabled by default.
Notify is disabled by default.
Usage Guidelines
If your network contains various Cisco licensed devices, you might consider using the CLM to manage all of the licenses using a single application. CLM is a secure client/server application that manages Cisco software licenses network wide.
The license agent is an interface module that runs on the controller and mediates between CLM and the controller’s licensing infrastructure. CLM can communicate with the controller using various channels, such as HTTP, Telnet, and so on. If you want to use HTTP as the communication method, you must enable the license agent on the controller.
The license agent receives requests from the CLM and translates them into license commands. It also sends notifications to the CLM. It uses XML messages over HTTP or HTTPS to receive the requests and send the notifications. For example, if the CLM sends a license clear command, the agent notifies the CLM after the license expires.
Note You can download the CLM software and access user documentation at this URL: http://www.cisco.com/en/US/products/ps7138/index.html
Examples
This example shows how to authenticate the default license agent settings:
This example shows how to configure the license agent with the number of maximum sessions allowed as 5:
Related Commands
config license boot
To specify the license level to be used on the next reboot of the Cisco 5500 Series Controller, use the config license boot command.
config license boot { base | wplus | auto }
Syntax Description
Command Default
Usage Guidelines
If you enter auto, the licensing software automatically chooses the license level to use on the next reboot. It generally chooses permanent licenses over evaluation licenses and wplus licenses over base licenses.
Note If you are considering upgrading from a base license to a wplus license, you can try an evaluation wplus license before upgrading to a permanent wplus license. To activate the evaluation license, you need to set the image level to wplus in order for the controller to use the wplus evaluation license instead of the base permanent license.
Note To prevent disruptions in operation, the controller does not switch licenses when an evaluation license expires. You must reboot the controller in order to return to a permanent license. Following a reboot, the controller defaults to the same feature set level as the expired evaluation license. If no permanent license at the same feature set level is installed, the controller uses a permanent license at another level or an unexpired evaluation license.
Examples
This example shows how to set the license boot settings to wplus:
Related Commands
config load-balancing
To globally configure aggressive load balancing on the controller, use the config load-balancing command.
config load-balancing { window client_count | status { enable | disable } | denial denial_count }
Syntax Description
Command Default
Usage Guidelines
Load-balancing-enabled WLANs do not support time-sensitive applications like voice and video because of roaming delays.
When you use Cisco 7921 and 7920 Wireless IP Phones with controllers, make sure that aggressive load balancing is disabled on the voice WLANs for each controller. Otherwise, the initial roam attempt by the phone might fail, causing a disruption in the audio path.
Examples
This example shows how to enable the aggressive load-balancing settings:
Related Commands
config local-auth active-timeout
To specify the amount of time in which the controller attempts to authenticate wireless clients using local Extensible Authentication Protocol (EAP) after any pair of configured RADIUS servers fails, use the config local-auth active-timeout command.
config local-auth active-timeout timeout
Syntax Description
Command Default
Examples
This example shows how to specify the active timeout to authenticate wireless clients using EAP to 500 seconds:
Related Commands
clear stats local-auth
config local-auth eap-profile
config local-auth method fast
config local-auth user-credentials
debug aaa local-auth
show local-auth certificates
show local-auth config
show local-auth statistics
config local-auth eap-profile
To configure local Extensible Authentication Protocol (EAP) authentication profiles, use the config local-auth eap-profile command.
config local-auth eap-profile {[add | delete] profile_name |
cert-issuer {cisco | vendor} |
method [add | delete] method profile_name |
method method local-cert {enable | disable} profile_name |
method method client-cert {enable | disable} profile_name |
method method peer-verify ca-issuer {enable | disable} |
method method peer-verify cn-verify {enable | disable} |
method method peer-verify date-valid {enable | disable}
Syntax Description
Command Default
Examples
This example shows how to create a local EAP profile named FAST01:
This example shows how to add the EAP-FAST method to a local EAP profile:
This example shows how to specify Cisco as the issuer of the certificates that will be sent to the client for an EAP-FAST profile:
This example shows how to specify that the incoming certificate from the client be validated against the CA certificates on the controller:
Related CommandsAre you sure you want to start? (y/N)y Are you sure you want to start? (y/N)y
config local-auth active-timeout
config local-auth method fast
config local-auth user-credentials
show local-auth certificates
show local-auth config
show local-auth statistics
clear stats local-auth
debug aaa local-auth
config local-auth method fast
To configure an EAP-FAST profile, use the config local-auth method fast command.
config local-auth method fast {anon-prov [enable | disable] | authority-id auth_id
pac-ttl days | server-key key_value}
Syntax Description
Command Default
Examples
This example shows how to disable the controller to allows anonymous provisioning:
This example shows how to configure the authority identifier 0125631177 of the local EAP-FAST server:
This example shows how to configure the number of days to 10 for the PAC to remain viable:
Related Commands
config local-auth active-timeout
config local-auth eap-profile
config local-auth user-credentials
show local-auth certificates
show local-auth config
show local-auth statistics
clear stats local-auth
debug aaa local-auth
config local-auth user-credentials
To configure the local Extensible Authentication Protocol (EAP) authentication database search order for user credentials, use the config local-auth user credentials command.
config local-auth user-credentials { local [ldap] | ldap [local]}
Syntax Description
Specifies that the local database is searched for the user credentials. |
|
(Optional) Specifies that the Lightweight Directory Access Protocol (LDAP) database is searched for the user credentials. |
Command Default
Usage Guidelines
The order of the specified database parameters indicate the database search order.
Examples
This example shows how to specify the order in which the local EAP authentication database is searched:
In the above example, the local database is searched first and then the LDAP database.
Related Commands
config local-auth active-timeout
config local-auth eap-profile
config local-auth method fast
show local-auth certificates
show local-auth config
show local-auth statistics
clear stats local-auth
debug aaa local-auth
config location
To configure a location-based system, use the config location command.
config location { add location [ description ] | delete location | enable | disable |
description location description | algorithm { simple | rssi-average } |
{ rssi-half-life | expiry } [ client | calibrating-client | tags | rogue-aps ] seconds |
notify-threshold [ client | tags | rogue-aps ] threshold |
interface-mapping { add | delete } location wlan_id interface_name |
plm { client { enable | disable } burst_interval | calibrating { enable | disable } { uniband | multiband }}}
Syntax Description
Command Default
See the “Syntax Description” section for default values of individual arguments and keywords.
Examples
This example shows how to specify the simple algorithm for averaging RSSI and SNR values on a location-based controller:
Related Commands
clear location rfid
clear location statistics rfid
show location
show location statistics rfid
config logging buffered
To set the severity level for logging messages to the controller buffer, use the config logging buffered command.
config logging buffered security_level
Syntax Description
Command Default
Examples
This example shows how to set the controller buffer severity level for logging messages to 4:
Related Commands
config logging syslog facility
config logging syslog level
show logging
config logging console
To set the severity level for logging messages to the controller console, use the config logging console command.
config logging console security_level
Syntax Description
Command Default
Examples
This example shows how to set the controller console severity level for logging messages to 3:
Related Commands
config logging syslog facility
config logging syslog level
show logging
config logging debug
To save debug messages to the controller buffer, the controller console, or a syslog server, use the config logging debug command.
config logging debug { buffered | console | syslog } {enable | disable }
Syntax Description
Command Default
Examples
This example shows how to save the debug messages to the controller console:
Related Commands
config logging fileinfo
To cause the controller to include information about the source file in the message logs or to prevent the controller from displaying this information, use the config logging fileinfo command.
config logging fileinfo {enable | disable}
Syntax Description
Includes information about the source file in the message logs. |
|
Prevents the controller from displaying information about the source file in the message logs. |
Command Default
Examples
This example shows how to enable the controller to include information about the source file in the message logs:
Related Commands
config logging procinfo
To cause the controller to include process information in the message logs or to prevent the controller from displaying this information, use the config logging procinfo command.
config logging procinfo {enable | disable}
Syntax Description
Prevents the controller from displaying process information in the message logs. |
Command Default
Examples
This example shows how to enable the controller to include the process information in the message logs:
Related Commands
config logging traceinfo
To cause the controller to include traceback information in the message logs or to prevent the controller from displaying this information, use the config logging traceinfo command.
config logging traceinfo {enable | disable}
Syntax Description
Prevents the controller from displaying traceback information in the message logs. |
Command Default
Examples
This example shows how to disable the controller to include the traceback information in the message logs:
Related Commands
config logging syslog host
To configure a remote host for sending syslog messages, use the config logging syslog host command.
config logging syslog host { host_IP_address }
Syntax Description
Command Default
Usage Guidelines
To remove a remote host that was configured for sending syslog messages, enter the config logging syslog host host_IP_address delete command.
Examples
This example shows how to configure a remote host 10.92.125.52 for sending the syslog messages:
Related Commands
config logging syslog facility
config logging syslog level
show logging
config logging syslog facility
To set the facility for outgoing syslog messages to the remote host, use the config logging syslog facility command.
config logging syslog facility facility_code
Syntax Description
Command Default
Examples
This example shows how to set the facility for outgoing syslog messages to authorization:
Related Commands
config logging syslog host
config logging syslog level
show logging
config logging syslog level
To set the severity level for filtering syslog messages to the remote host, use the config logging syslog level command.
config logging syslog level severity_level
Syntax Description
Command Default
Examples
This example shows how to set the severity level for syslog messages to 3:
Related Commands
config logging syslog host
config logging syslog facility
show logging
config loginsession close
To close all active Telnet session(s), use the config loginsession close command.
config loginsession close { session_id | all }
Syntax Description
Command Default
Examples
This example shows how to close all active Telnet sessions:
Related Commands
config lsc mesh
To enable the locally significant certificate (LSC) on mesh access points, use the config lsc mesh command.
config lsc mesh { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable LSC on mesh access point:
Related Commands
Configure IPv6 Commands
config ipv6 acl
To create or delete an IPv6 acl on the Cisco wireless LAN controller, use the config ipv6 acl command.
config ipv6 acl { apply ipv6_acl_name } | { create ipv6_acl_name }| { delete ipv6_acl_name }| { rule {action rule_name rule_index { permit | deny } |
add rule_name rule_index |
change index rule_name old_index new_index |
delete rule_name rule_index |
destination address rule_name rule_index ip_address netmask |
destination port range rule_name rule_index start_port end_port |
direction rule_name rule_index { in | out | any } |
dscp rule_name rule_index dscp |
protocol rule_name rule_index protocol |
source address rule_name rule_index ip_address netmask |
source port range rule_name rule_index start_port end_port |
swap index rule_name index_1 index_2 } }
Syntax Description
IPv6 ACL name that contains up to 32 alphanumeric characters. |
|
Command Default
Usage Guidelines
For a Cisco 2100 Series Wireless LAN Controller, you must configure a preauthentication ACL on the wireless LAN for the external web server. This ACL should then be set as a wireless LAN preauthentication ACL under Web Policy. However, you do not need to configure any preauthentication ACL for Cisco 4400 Series Wireless LAN Controllers.
Examples
This example shows how to configure an IPv6 ACL to permit access:
Related Commands
config ipv6 neighbor-binding
To configure the Neigbor Binding table on the Cisco wireless LAN controller, use the config ipv6 neighbor-binding command.
config ipv6 neigbor-binding [ timers { down-lifetime down_time | reachable-lifetime reachable_time | stale-lifetime stale_time }] | [ ra-throttle { allow at-least at_least_value } | { enable | disable } | { interval-option { ignore | passthrough | throttle } } | { max-through { no_mcast_RA | no-limit }} | { throttle-period throttle_period }]
Syntax Description
Command Default
Examples
This example shows how to configure the Neigbor Binding table :
Related Commands
config ipv6 ns-mcast-fwd
To configure the NS multicast cachemiss forwarding, use the config ipv6 ns-mcast-fwd command.
config ipv6 ns-mcast-fwd { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to configure an NS Multicast Forwarding:
Related Commands
config ipv6 ra-guard
To configure the filter for RA packets originating from client on AP, use the config ipv6 ra-guard command.
config ipv6 ra-guard ap { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable IPv6 RA guard:
Related Commands
Configure Macfilter Commands
Use the config macfilter commands to configure macfilter settings.
config macfilter
To create or delete a MAC filter entry on the Cisco wireless LAN controller, use the config macfilter command.
config macfilter { add client_MAC wlan_id [ interface_name] [ description] [macfilter_IP] |
delete client_MAC}
Syntax Description
Command Default
Usage Guidelines
Use the config macfilter add command to add a client locally to a wireless LAN on the Cisco wireless LAN controller. This filter bypasses the RADIUS authentication process.
Examples
This example shows how to add a MAC filer entry 00:E0:77:31:A3:55 with the wireless LAN ID 1, interface name labconnect, and MAC filter IP 10.92.125.51 on the controller:
Related Commands
config macfilter description
To add a description to a MAC filter, use the config macfilter description command.
config macfilter description MAC description
Syntax Description
(Optional) Description within double quotes (up to 32 characters). |
Command Default
Examples
This example shows how to set the description MAC filter 01 to MAC address 11:11:11:11:11:11:
Related Commands
config macfilter interface
To create a MAC filter client interface, use the config macfilter interface command.
config macfilter interface MAC interface
Syntax Description
Command Default
Examples
This example shows how to create a MAC filer interface Lab01 on client 11:11:11:11:11:11 :
Related Commands
config macfilter ip-address
To assign an IP address to an existing MAC filter entry if one was not assigned using the config macfilter add command, use the config macfilter ip-address command.
config macfilter ip-address MAC_address IP_address
Syntax Description
IP address for a specific MAC address in the local MAC filter database. |
Command Default
Examples
This example shows how to specify IP address 10.92.125.51 for a MAC 00:E0:77:31:A3:55 in the local MAC filter database:
Related Commands
config macfilter mac-delimiter
To set the MAC delimiter (colon, hyphen, none, and single-hyphen) for MAC addresses sent to RADIUS servers, use the config macfilter mac-delimiter command.
config macfilter mac-delimiter { none | colon | hyphen | single-hyphen }
Syntax Description
Sets the delimiter to a colon (for example, xx:xx:xx:xx:xx:xx). |
|
Sets the delimiter to a hyphen (for example, xx-xx-xx-xx-xx-xx). |
|
Sets the delimiter to a single hyphen (for example, xxxxxx-xxxxxx). |
Command Default
Examples
This example shows how to have the operating system send MAC addresses to the RADIUS server in the form aa:bb:cc:dd:ee:ff:
This example shows how to have the operating system send MAC addresses to the RADIUS server in the form aa-bb-cc-dd-ee-ff:
This example shows how to have the operating system send MAC addresses to the RADIUS server in the form aabbccddeeff:
Related Commands
config macfilter radius-compat
To configure the Cisco wireless LAN controller for compatibility with selected RADIUS servers, use the config macfilter radius-compat command.
config macfilter radius-compat { Cisco | free | other }
Syntax Description
Command Default
Examples
This example shows how to configure the Cisco ACS compatibility mode to “other”:
Related Commands
config macfilter wlan-id
To modify a wireless LAN ID for a MAC filter, use the config macfilter wlan-id command.
config macfilter wlan-id MAC wlan_id
Syntax Description
Wireless LAN identifier to associate with. A value of zero is not allowed. |
Command Default
Examples
This example shows how to modify client wireless LAN ID 2 for a MAC filer 11:11:11:11:11:11:
Related Commands
config remote-lan
To configure a remote LAN, use the config remote-lan command.
config remote-lan { enable | disable } remote-lan-id | all
Syntax Description
Command Default
Examples
This example shows how to enable a remote LAN with ID 2 :
Related Commands
config remote-lan aaa-override
To configure user policy override through AAA on a remote LAN, use the config remote-lan aaa-override command.
config remote-lan aaa-override { enable | disable } remote-lan-id
Syntax Description
Command Default
Examples
This example shows how to enable user policy override through AAA on a remote LAN where the remote LAN ID is 2 :
Related Commands
config remote-lan acl
To specify an access control list (ACL) for a remote LAN, use the config remote-lan acl command.
config remote-lan acl remote-lan-id acl_name
Syntax Description
Note Use the show acl summary command to know the ACLs available. |
Command Default
Examples
This example shows how to specify ACL1 for a remote LAN whose ID is 2:
Related Commands
config remote-lan create
To configure a new remote LAN connection, use the config remote-lan create command.
config remote-lan create remote-lan-id name
Syntax Description
Remote LAN name. Valid values are up to 32 alphanumeric characters. |
Command Default
Examples
This example shows how to configure a new remote LAN, MyRemoteLAN, with the LAN ID as 3:
Related Commands
config remote-lan custom-web
To configure web authentication for a remote LAN, use the config remote-lan custom-web command.
config remote-lan custom-web
{ ext-webauth-url URL remote-lan-id } |
{ global { enable | disable } remote-lan-id } |
{ login-page page-name remote-lan-id} |
{ loginfailure-page {page-name | none } remote-lan-id} |
{ logout-page {page-name | none } remote-lan-id} |
{ webauth-type { internal | customized | external } remote-lan-id}
Syntax Description
Remote LAN name. Valid values are up to 32 alphanumeric characters. |
Command Default
Usage Guidelines
Follow these guidelines when you use the config remote-lan custom-web command:
– Ensure that Web-Auth or Web-Passthrough Security is in enabled state. To enable Web-Auth, use the config remote-lan security web-auth enable command. To enable Web-Passthrough, use the config remote-lan security web-passthrough enable command.
– Ensure that the global status of the remote LAN is in disabled state. To enable the global status of the remote LAN, use the config remote-lan custom-web global disable command.
– Ensure that the remote LAN is in disabled state. To disable a remote LAN, use the config remote-lan disable command.
– When you configure a customized login page, ensure that you have a login page configured. To configure a login page, use the config remote-lan custom-web login-page command.
– When you configure an external login page, ensure that you have configured preauthentication ACL for external web authentication to function.
Examples
This example shows how to configure an external web authentication URL for a remote LAN with ID 3:
This example shows how to enable the global status of a remote LAN with ID 3:
This example shows how to configure the login page for a remote LAN with ID 3:
This example shows how to configure a web authentication type with the default login page for a remote LAN with ID 3:
Related Commands
config remote-lan delete
To delete a remote LAN connection, use the config remote-lan delete command.
config remote-lan delete remote-lan-id
Syntax Description
Command Default
Examples
This example shows how to delete a remote LAN with ID 3:
Related Commands
config remote-lan dhcp_server
To configure a dynamic host configuration protocol (DHCP) server for a remote LAN, use the config remote-lan dhcp_server command.
config remote-lan dhcp_server remote-lan-id ip_address
Syntax Description
Command Default
Examples
This example shows how to configure a DHCP server for a remote LAN with ID 3:
Related Commands
config remote-lan exclusionlist
To configure the exclusion list timeout on a remote LAN, use the config remote-lan exclusionlist command.
config remote-lan exclusionlist remote-lan-id {seconds | disabled | enabled }
Syntax Description
Exclusion list timeout in seconds. A value of 0 requires an administrator override. |
|
Command Default
Examples
This example shows how to configure the exclusion list timeout to 20 seconds on a remote LAN with ID 3:
Related Commands
config remote-lan interface
To configure an interface for a remote LAN, use the config remote-lan interface command.
config remote-lan interface remote-lan-id interface_name
Syntax Description
Command Default
Examples
This example shows how to configure an interface myinterface for a remote LAN with ID 3:
Related Commands
config remote-lan ldap
To configure a remote LAN’s LDAP servers, use the config remote-lan ldap command.
config remote-lan ldap {add | delete} remote-lan-id index
Syntax Description
Command Default
Examples
This example shows how to add an LDAP server with the index number 10 for a remote LAN with ID 3:
Related Commands
config remote-lan mac-filtering
To configure MAC filtering on a remote LAN, use the config remote-lan mac-filtering command.
config remote-lan mac-filtering {enable | disable} remote-lan-id
Syntax Description
Command Default
Examples
This example shows how to disable MAC filtering on a remote LAN with ID 3:
Related Commands
config remote-lan max-associated-clients
To configure the maximum number of client connections on a remote LAN, use the config remote-lan max-associated-clients command.
config remote-lan max-associated-clients remote-lan-id max-clients
Syntax Description
Configures the maximum number of client connections on a remote LAN. |
Command Default
Examples
This example shows how to configure 10 client connections on a remote LAN with ID 3:
Related Commands
config remote-lan radius_server
To configure the Remote Authentication Dial In User Service (RADIUS) servers on a remote LAN, use the config remote-lan radius_server command.
config remote-lan radius_server
{acct {add | delete} remote-lan-id server-index | {enable | disable} remote-lan-id} |
{ auth {add | delete} remote-lan-id server-index | {enable | disable} remote-lan-id} |
{ overwrite-interface {enable | disable} remote-lan-id}
Syntax Description
Command Default
Examples
This example shows how to enable RADIUS accounting for a remote LAN with ID 3:
Related Commands
config remote-lan security
To configure security policy for a remote LAN, use the config remote-lan security command.
config remote-lan security {{web-auth {enable | disable | acl | server-precedence} remote-lan-id | {web-passthrough {acl | email-input | disable | enable} remote-lan-id }}
Syntax Description
Configures the authentication server precedence order for web authentication users. |
|
Specifies the web captive portal with no authentication required. |
Command Default
Examples
This example shows how to configure the security web authentication policy for remote LAN ID 1:
Related Commands
config remote-lan session-timeout
To configure client session timeout, use the config remote-lan session-timeout command.
config remote-lan session-timeout remote-lan-id seconds
Syntax Description
Timeout or session duration in seconds. A value of zero is equivalent to no timeout. |
Command Default
Examples
This example shows how to configure the client session timeout to 6000 seconds for a remote LAN with ID 1:
Related Commands
config remote-lan webauth-exclude
To configure web authentication exclusion on a remote LAN, use the config remote-lan webauth-exclude command.
config remote-lan webauth-exclude remote-lan-id {enable | disable}
Syntax Description
Command Default
Examples
This example shows how to enable web authentication exclusion on a remote LAN with ID 1:
Related Commands
Configure Memory Monitor Commands
To troubleshoot hard-to-solve or hard-to-reproduce memory problems, use the config memory monitor commands.
Note The commands in this section can be disruptive to your system and should be run only when you are advised to do so by the Cisco Technical Assistance Center (TAC).
config memory monitor errors
To enable or disable monitoring for memory errors and leaks, use the config memory monitor errors command:
config memory monitor errors { enable | disable }
Syntax Description
Command Default
Usage Guidelines
Note Be cautious about changing the defaults for the config memory monitor command unless you know what you are doing, you have detected a problem, or you are collecting troubleshooting information.
Examples
This example shows how to enable monitoring for memory errors and leaks for a controller:
Related Commands
config memory monitor leaks
debug memory
show memory monitor
config memory monitor leaks
To configure the controller to perform an auto-leak analysis between two memory thresholds, use the config memory monitor leaks command.
config memory monitor leaks low_thresh high_thresh
Syntax Description
Command Default
The default value for low_thresh is 10000 KB; the default value for high_thresh is 30000 KB.
Usage Guidelines
Note Be cautious about changing the defaults for the config memory monitor command unless you know what you are doing, you have detected a problem, or you are collecting troubleshooting information.
Use this command if you suspect that a memory leak has occurred.
If the free memory is lower than the low_thresh threshold, the system crashes, generating a crash file. The default value for this parameter is 10000 KB, and you cannot set it below this value.
Set the high_thresh threshold to the current free memory level or higher so that the system enters auto-leak-analysis mode. After the free memory reaches a level lower than the specified high_thresh threshold, the process of tracking and freeing memory allocation begins. As a result, the debug memory events enable command shows all allocations and frees, and the show memory monitor detail command starts to detect any suspected memory leaks.
Examples
This example shows how to set the threshold values for auto-leak-analysis mode to 12000 KB for the low threshold and 35000 KB for the high threshold:
Related Commands
config memory monitor errors
debug memory
show memory monitor
Configure Mesh Commands
Use the configure mesh commands to set mesh access point settings.
config mesh alarm
To configure alarm settings for outdoor mesh access points, use the config mesh alarm command.
config mesh alarm { max-hop | max-children | low-snr | high-snr | association |
parent-change count } value
Syntax Description
Command Default
See the “Syntax Description” section for command and argument value ranges.
Examples
This example shows how to set the maximum hops threshold to 8:
This example shows how to set the upper SNR threshold to 25:
Related Commands
config mesh client-access
config mesh ethernet-bridging vlan-transparent
config mesh full-sector-dfs
config mesh multicast
config mesh radius-server
config mesh security
config mesh slot-bias
show mesh ap
show mesh security-stats
show mesh stats
show mgmtuser
config mesh astools
To globally enable or disable the anti-stranding feature for outdoor mesh access points, use the config mesh astools command.
config mesh astools { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable anti-stranding on all outdoor mesh access points:
Related Commands
config mesh security
show mesh ap
show mesh astools stats
show mesh config
show mesh stats
show mgmtuser
config mesh backhaul rate-adapt
To globally configure the backhaul Tx rate adaptation (universal access) settings for indoor and outdoor mesh access points, use the config mesh backhaul rate-adapt command.
config mesh backhaul rate-adapt [ all | bronze | silver | gold | platinum ] { enable | disable }
Syntax Description
Command Default
Usage Guidelines
To use this command, mesh backhaul with client access must be enabled by using the config mesh client-access command.
Note After this feature is enabled, all mesh access points reboot.
Examples
This example shows how to set the backhaul client access to the best-effort level:
Related Commands
config mesh backhaul slot
To configure the slot radio as a downlink backhaul, use the config mesh backhaul slot command.
config mesh backhaul slot slot_id { enable | disable } cisco_ap
Syntax Description
Name of the Root AP of the sector on which the backhaul needs to be enabled or disabled. |
Command Default
Usage Guidelines
For 2.4 GHz, only slot 0 and 1 are valid. If slot 0 is enabled, then slot 1 is automatically be disabled. If slot 0 is disabled, then slot 1 is automatically enabled. The config mesh backhaul slot command is applicable only to AP1522.
Examples
This example shows how to enable slot 1 as the preferred backhaul for the root AP myrootap1:
Related Commands
config mesh battery-state
To configure the battery state for Cisco Aironet 1520 series mesh access points, use the config mesh battery-state command.
config mesh battery-state { enable | disable } { all | cisco_ap }
Syntax Description
Enables the battery-state for 1520 series mesh access points. |
|
Disables the battery-state for 1520 series mesh access points. |
|
Command Default
Examples
This example shows how to set the backhaul client access to the best-effort level:
config mesh client-access
To enable or disable client access to the mesh backhaul on indoor and outdoor mesh access points, use the config mesh client-access command.
config mesh client-access { enable [ extended ] | disable }
Syntax Description
Command Default
Usage Guidelines
Backhaul interfaces (802.11a radios) act as primary Ethernet interfaces. Backhauls function as trunks in the network and carry all VLAN traffic between the wireless and wired network. No configuration of primary Ethernet interfaces is required.
When this feature is enabled, Cisco Aironet 1520 series (152x) mesh access points allow wireless client association over the 802.11a radio, which implies that a 152x mesh access point can carry both backhaul traffic and 802.11a client traffic over the same 802.11a radio.
When this feature is disabled, the 152x carries backhaul traffic over the 802.11a radio and allows client association only over the 802.11b/g radio.
Examples
This example shows how to enable client access extended to allow a wireless client association over the 802.11a radio:
This example shows how to restrict a wireless client association to the 802.11b/g radio:
Related Commands
show mesh ap
show mesh client-access
show mesh config
show mesh stats
config mesh ethernet-bridging vlan-transparent
To configure how a mesh access point handles VLAN tags for Ethernet bridged traffic, use the config mesh ethernet-bridging vlan-transparent command.
config mesh ethernet-bridging vlan-transparent { enable | disable }
Syntax Description
Command Default
Usage Guidelines
VLAN transparent is enabled as a default to ensure a smooth software upgrade from 4.1.192.xxM releases to release 5.2. Release 4.1.192.xxM does not support VLAN tagging.
Examples
This example shows how to configure Ethernet packets as untagged:
This example shows how to drop tagged Ethernet packets:
Related Commands
config mesh client-access
config mesh linkdata
config mesh linktest
config mesh multicast
show mesh ap
show mesh client-access
show mesh config
show mesh stats
config mesh full-sector-dfs
To globally enable or disable full-sector Dynamic Frequency Selection (DFS) on mesh access points, use the config mesh full-sector-dfs command.
config mesh full-sector-dfs { enable | disable }
Syntax Description
Command Default
Usage Guidelines
This command instructs the mesh sector to make a coordinated channel change on the detection of a radar signal. For example, if a mesh access point (MAP) detects a radar signal, the MAP will notify the root access point (RAP), and the RAP will initiate a sector change.
All MAPs and the RAP that belong to that sector go to a new channel, which lowers the probability of MAPs stranding when radar is detected on the current backhaul channel, and no other valid parent is available as backup.
Each sector change causes the network to be silent for 60 seconds (as dictated by the DFS standard).
It is expected that after a half hour, the RAP will go back to the previously configured channel, which means that if radar is frequently observed on a RAP's channel, it is important that you configure a different channel for that RAP to exclude the radar affected channel at the controller.
Examples
This example shows to enable full-sector DFS on mesh access points:
Related Commands
config mesh alarm
config mesh battery-state
config mesh client-access
config mesh linkdata
config mesh linktest
config mesh range
show mesh ap
show mesh security-stats
show mesh stats
show mgmtuser
config mesh linkdata
To enable external MAC filtering of access points, use the config mesh linkdata command.
config mesh linkdata destination_ap_name
Syntax Description
Command Default
Usage Guidelines
Note The config mesh linktest and config mesh linkdata commands are designed to be used together to verify information between a source and a destination access point. To get this information, first execute the config mesh linktest command with the access point that you want link data from in the dest_ap argument. When the command completes, enter the config mesh linkdata command and list the same destination access point, to display the link data will display (see example).
MAC filtering uses the local MAC filter on the controller by default.
When external MAC filter authorization is enabled, if the MAC address is not found in the local MAC filter, then the MAC address in the external RADIUS server is used.
MAC filtering protects your network against rogue mesh access points by preventing access points that are not defined on the external server from joining.
Before employing external authentication within the mesh network, the following configuration is required:
Examples
This example shows how to enable external MAC address filtering on access point AP001d.710d.e300:
This example shows how to enable external MAC filtering on access point AP001d.71d.e300:
Related Commands
config mesh alarm
config mesh client-access
config mesh ethernet-bridging vlan-transparent
config mesh linktest
config mesh radius-server
show mesh ap
show mesh client-access
show mesh config
show mesh stats
config mesh linktest
To verify client access between mesh access points, use the config mesh linktest command.
config mesh linktest source_ap { dest_ap | dest_MAC } datarate packet_rate packet_size duration
Syntax Description
Command Default
Usage Guidelines
Note The config mesh linktest and config mesh linkdata commands are designed to be used together to verify information between a source and a destination access point. To get this information, first enter the config mesh linktest command with the access point that you want link data from in the dest_ap argument. When the command completes, enter the config mesh linkdata command and list the same destination access point, to display the link data.
The following warning message appears when you run a linktest that might oversubscribe the link:
Examples
This example shows how to verify client access between mesh access points SB_MAP1 and SB_RAP2 at 36 Mbps, 20 fps, 100 frame size, and 15 second duration:
Table 2-5 lists the output flags displayed for the config mesh linktest command.
Related Commands
config mesh battery-state
config mesh client-access
config mesh full-sector-dfs
config mesh linkdata
config mesh multicast
config mesh range
show mesh client-access
show mesh config
show mesh security-stats
show mesh stats
config mesh lsc
To configure a locally significant certificate (LSC) on mesh access points, use the config mesh lsc command.
config mesh lsc { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable LSC on mesh access points:
Related Commands
config mesh multicast
To configure multicast mode settings to manage multicast transmissions within the mesh network, use the config mesh multicast command.
config mesh multicast { regular | in | in-out }
Syntax Description
Command Default
Usage Guidelines
Multicast for mesh networks cannot be enabled using the controller GUI.
Mesh multicast modes determine how bridging-enabled access points mesh access points (MAPs) and root access points (RAPs) send multicasts among Ethernet LANs within a mesh network. Mesh multicast modes manage non-LWAPP multicast traffic only. LWAPP multicast traffic is governed by a different mechanism.
You can use the controller CLI to configure three mesh multicast modes to manage video camera broadcasts on all mesh access points. When enabled, these modes reduce unnecessary multicast transmissions within the mesh network and conserve backhaul bandwidth.
When using in-out mode, it is important to properly partition your network to ensure that a multicast sent by one RAP is not received by another RAP on the same Ethernet segment and then sent back into the network.
Note If 802.11b clients need to receive CAPWAP multicasts, then multicast must be enabled globally on the controller as well as on the mesh network (by using the config network multicast global command). If multicast does not need to extend to 802.11b clients beyond the mesh network, you should disable the global multicast parameter.
Examples
This example shows how to multicast video across the entire mesh network and all its segments by bridging-enabled RAPs and MAPs:
Related Commands
config network multicast global
config mesh battery-state
config mesh client-access
config mesh linktest
show mesh ap
show mesh config
show mesh stats
config mesh parent preferred
To configure a preferred parent for a mesh access point, use the config mesh parent preferred command.
config mesh parent preferred cisco_ap {mac_address | none }
Syntax Description
Command Default
Usage Guidelines
A child AP selects the preferred parent based on the following conditions:
- The preferred parent is the best parent.
- The preferred parent has a link SNR of at least 20 dB (other parents, however good, are ignored).
- The preferred parent has a link SNR in the range of 12 dB and 20 dB, but no other parent is significantly better (that is, the SNR is more than 20 percent better). For an SNR lower than 12 dB, the configuration is ignored.
- The preferred parent is not blacklisted.
- The preferred parent is not in silent mode because of dynamic frequency selection (DFS).
- The preferred parent is in the same bridge group name (BGN). If the configured preferred parent is not in the same BGN and no other parent is available, the child joins the parent AP using the default BGN.
Examples
This example shows how to configure a preferred parent with the MAC address 00:21:1b:ea:36:60 for a mesh access point myap1:
This example shows how to clear a preferred parent with the MAC address 00:21:1b:ea:36:60 for a mesh access point myap1, by using the keyword none:
Related Commands
config network multicast global
config mesh battery-state
config mesh client-access
config mesh linktest
show mesh ap
show mesh config
show mesh stats
config mesh public-safety
To enable or disable the 4.9-GHz public safety band for mesh access points, use the config mesh public-safety command.
config mesh public-safety { enable | disable } { all | cisco_ap }
Syntax Description
Command Default
Usage Guidelines
4.9 GHz is a licensed frequency band restricted to public-safety personnel.
Examples
This example shows how to enable the 4.9-GHz public safety band for all mesh access points:
Related Commands
config mesh range
config mesh security
show mesh ap
show mesh config
show mesh public-safety
show mesh security-stats
show mesh stats
config mesh radius-server
To enable or disable external authentication for mesh access points, use the config mesh radius-server command.
config mesh radius-server index { enable | disable }
Syntax Description
Disables the external authentication for mesh access points. |
Command Default
Examples
This example shows how to enable external authentication for mesh access points:
Related Commands
config mesh alarm
config mesh security
show mesh ap
show mesh security-stats
show mesh stats
config mesh range
To globally set the maximum range between outdoor mesh root access points (RAPs) and mesh access points (MAPs), use the config mesh range command.
config mesh range [ distance ]
Syntax Description
(Optional) Maximum operating range (150 to 132000 ft) of the mesh access point. |
Command Default
Usage Guidelines
After this command is enabled, all outdoor mesh access points reboot. This command does not affect indoor access points.
Examples
This example shows how to set the range between an outdoor mesh RAP and a MAP:
Are you sure you want to start? (y/N) y
Related Commands
config mesh astools
config mesh ethernet-bridging vlan-transparent
config mesh full-sector-dfs
config mesh linkdata
config mesh linktest
show mesh ap
show mesh stats
config mesh secondary-backhaul
To configure a secondary backhaul on the mesh network, use the config mesh secondary-backhaul command.
config mesh secondary-backhaul { enable [ force-same-secondary-channel ] |
disable [ rll-retransmit | rll-transmit ]}
Syntax Description
Command Default
Usage Guidelines
Note The secondary backhaul access feature is not supported by Cisco 1520 and 1524 indoor mesh access points in the 5.2 release.
This command uses a secondary backhaul radio as a temporary path for traffic that cannot be sent on the primary backhaul due to intermittent interference.
Examples
This example shows ho to enable a secondary backhaul radio and force all access points rooted at the first hop node to have the same secondary channel:
Related Commands
config mesh battery-state
config mesh backhaul slot
show mesh client-access
show mesh config
show mesh stats
config mesh security
To configure the security settings for mesh networks, use the config mesh security commands.
config mesh security {{{ rad-mac-filter | force-ext-auth } { enable | disable }} | eap | psk }
Syntax Description
Command Default
Examples
This example shows how to configure EAP as the security option for all mesh access points:
This example shows how to configure PSK as the security option for all mesh access points:
Related Commands
config mesh alarm
config mesh client-access
config mesh public-safety
config mesh radius-server
show mesh ap
show mesh client-access
show mesh config
show mesh security-stats
show mesh stats
config mesh slot-bias
To enable or disable slot bias for serial backhaul mesh access points, use the config mesh slot-bias command.
config mesh slot-bias { enable | disable }
Syntax Description
Command Default
Usage Guidelines
Follow these guidelines when using this command:
- The config mesh slot-bias command is a global command and therefore applicable to all 1524SB APs associated with the same controller.
- Slot bias is applicable only when both slot 1 and slot 2 are available. If a slot radio does not have a channel that is available because of dynamic frequency selection (DFS), the other slot takes up both the uplink and downlink roles.
- If slot 2 is not available because of hardware issues, slot bias functions normally. Corrective action should be taken by disabling the slot bias or fixing the antenna.
Examples
This example shows how to disable slot bias for serial backhaul mesh APs:
Related Commands
config mesh alarm
config mesh client-access
config mesh public-safety
config mesh radius-server
show mesh ap
show mesh client-access
show mesh config
show mesh security-stats
show mesh stats
Configure Management-User Commands
Use the config mgmtuser commands to configure management user settings.
config mgmtuser add
To add a local management user to the Cisco wireless LAN controller, use the config mgmtuser add command.
config mgmtuser add username password { read-write | read-only } [ description ]
Syntax Description
Command Default
Examples
This example shows how to create a management user account with read-write access:
Related Commands
config mgmtuser delete
To delete a management user from the Cisco wireless LAN controller, use the config mgmtuser delete command.
config mgmtuser delete username
Syntax Description
Account username. The username can be up to 24 alphanumeric characters. |
Command Default
Examples
This example shows how to delete a management user account admin from the Cisco wireless LAN controller:
Related Commands
config mgmtuser description
To add a description to an existing management user login to the Cisco wireless LAN controller, use the config mgmtuser description command.
config mgmtuser description username description
Syntax Description
Account username. The username can be up to 24 alphanumeric characters. |
|
Description of the account. The description can be up to 32 alphanumeric characters within double quotes. |
Command Default
Examples
This example shows how to add a description “primary-user” to the management user “admin”:
Related Commands
config mgmtuser password
To change a management user password, use the config mgmtuser password command.
config mgmtuser password username password
Syntax Description
Account username. The username can be up to 24 alphanumeric characters. |
|
Account password. The password can be up to 24 alphanumeric characters. |
Command Default
Examples
This example shows how to change the password of the management user “admin” with the new password 5rTfm:
Related Commands
Configure Mobility Commands
Use the config mobility commands to configure mobility (roaming) settings.
config mobility dscp
To configure the mobility intercontroller DSCP value, use the config mobility dscp command.
config mobility dscp dscp_value
Syntax Description
Command Default
Examples
This example shows how to configure the mobility intercontroller DSCP value to 40:
Related Commands
config guest-lan mobility anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
config wlan mobility anchor
debug mobility
config mobility group anchor
To create a new mobility anchor for the WLAN or wired guest LAN, enter, use the config mobility group anchor command.
config mobility group anchor { add | delete } { wlan wlan_id | guest-lan guest_lan_id } anchor_ip
Syntax Description
Command Default
Usage Guidelines
The wlan_id or guest_lan_id must exist and be disabled.
Auto-anchor mobility is enabled for the WLAN or wired guest LAN when you configure the first mobility anchor. Deleting the last anchor disables the auto-anchor mobility feature and resumes normal mobility for new associations.
Examples
This example shows how to add a mobility anchor with the IP address 192.12.1.5 to a wireless LAN ID 2:
This example shows how to delete a mobility anchor with the IP address 193.13.1.15 from a wireless LAN:
Related Commands
config guest-lan mobility anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
config wlan mobility anchor
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config mobility group domain
To configure the mobility domain name, use the config mobility group domain command.
config mobility group domain domain_name
Syntax Description
Domain name. The domain name can be up to 31 case-sensitive characters. |
Command Default
Examples
This example shows how to configure a mobility domain name lab1:
Related Commands
config mobility group anchor
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config mobility group keepalive count
To configure the controller to detect failed mobility group members (including anchor controllers), use the config mobility group keepalive count commands.
config mobility group keepalive count count
Syntax Description
Number of times that a ping request is sent to a mobility group member before the member is considered unreachable. The valid range is 3 to 20. The default is 3. |
Command Default
Examples
This example shows how to specify the number of times a ping request is sent to a mobility group member before the member is considered unreachable to 3 counts:
Related Commands
config mobility group anchor
config mobility group domain
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config mobility group keepalive interval
To configure the controller to detect failed mobility group members (including anchor controllers), use the config mobility group keepalive command.
config mobility group keepalive interval
Syntax Description
Interval of time between each ping request sent to a mobility group member. The valid range is 1 to 30 seconds. The default value is 10 seconds. |
Command Default
Examples
This example shows how to specify the amount of time between each ping request sent to a mobility group member to 10 seconds:
Related Commands
config mobility group anchor
config mobility group domain
config mobility group keepalive count
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config mobility group member
To add or delete users from the mobility group member list, use the config mobility group member command.
config mobility group member { add MAC IP_address [ group_name ] | delete MAC }
Syntax Description
(Optional) Member switch group name (if different from the default group name). |
|
Command Default
Examples
This example shows how to add a mobility group member to the list:
Related Commands
config mobility group anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config mobility group multicast-address
To configure the multicast group IP address for nonlocal groups within the mobility list, use the config mobility group multicast-address command:
config mobility group multicast-address group_name IP_address
Syntax Description
Member switch group name (if different from the default group name). |
|
Command Default
Examples
This example shows how to configure the multicast group IP address 10.10.10.1 for a group named test:
Related Commands
config mobility group anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config mobility multicast-mode
To enable or disable multicast mobility mode, use the config mobility multicast-mode command.
config mobility multicast-mode { enable | disable } local_group_multicast_address
Syntax Description
Command Default
Examples
This example shows how to enable the multicast mobility mode for the local mobility group IP address 157.168.20.0:
Related Commands
config mobility group anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility secure-mode
config mobility statistics reset
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config mobility secure-mode
To configure the secure mode for mobility messages between Cisco wireless LAN controllers, use the config mobility secure-mode command.
config mobility secure-mode { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the secure mode for mobility messages:
Related Commands
config mobility group anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility statistics reset
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config mobility statistics reset
To reset the mobility statistics, use the config mobility statistics command.
config mobility statistics reset
Syntax Description
Command Default
Examples
This example shows how to reset the mobility group statistics:
Related Commands
config mobility group anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
Configure Message Log Level Commands
Use the config msglog commands to configure msglog level settings.
config msglog level critical
To reset the message log so that it collects and displays only critical (highest-level) messages, use the config msglog level critical command.
Syntax Description
Command Default
Usage Guidelines
The message log always collects and displays critical messages, regardless of the message log level setting.
Examples
This example shows how to configure the message log severity level and display critical messages:
Related Commands
config msglog level error
To reset the message log so that it collects and displays both critical (highest-level) and error (second-highest) messages, use the config msglog level error command.
Syntax Description
Command Default
Examples
This example shows how to reset the message log to collect and display critical and noncritical error messages:
Related Commands
config msglog level security
To reset the message log so that it collects and displays critical (highest-level), error (second-highest), and security (third-highest) messages, use the config msglog level security command.
Syntax Description
Command Default
Examples
This example shows how to reset the message log so that it collects and display critical, noncritical, and authentication or security-related errors:
Related Commands
config msglog level verbose
To reset the message log so that it collects and displays all messages, use the config msglog level verbose command.
Syntax Description
Command Default
Examples
This example shows how to reset the message logs so that it collects and display all messages:
Related Commands
config msglog level warning
To reset the message log so that it collects and displays critical (highest-level), error (second-highest), security (third-highest), and warning (fourth-highest) messages, use the config msglog level warning command.
Syntax Description
Command Default
Examples
This example shows how to reset the message log so that it collects and displays warning messages in addition to critical, noncritical, and authentication or security-related errors:
Related Commands
Configure Media-Stream Commands
Use the config media-stream commands to configure media stream settings.
config 802.11 media-stream multicast-direct
To configure the media stream multicast-direct parameters for the 802.11 networks, use the config 802.11 media-stream multicast-direct commands.
config {802.11a | 802.11b} media-stream multicast-direct {admission-besteffort {enable | disable}} | {enable | disable} | {client-maximum | radio-maximum { value | no-limit }}
Syntax Description
Command Default
Usage Guidelines
Before you configure the media stream multicast-direct parameters on a 802.11 network, ensure that the network is nonoperational.
Examples
This example shows how to enable a media stream multicast-direct settings on an 802.11a network:
This example shows how to admit the media stream to the best-effort queue:
This example shows how to set the maximum number of streams allowed on a client:
Related Commands
config 802.11 media-stream video-redirect
show 802.11a media-stream name
show media-stream group summary
show media-stream group detail
config 802.11 media-stream video-redirect
To configure the media stream video-redirect for the 802.11 networks, use the config 802.11 media-stream video-redirect command.
config {802.11a | 802.11b} media-stream video-redirect {enable | disable}
Syntax Description
Command Default
Usage Guidelines
Before you configure the media stream video-redirect on a 802.11 network, ensure that the network is nonoperational.
Examples
This example shows how to enable media stream traffic redirection on an 802.11a network:
Related Commands
config 802.11 media-stream multicast-direct
show 802.11a media-stream name
show media-stream group summary
show media-stream group detail
config 802.11 multicast data-rate
To configure the minimum multicast datarate, use the config 802.11 multicast data-rate command.
config {802.11a | 802.11b} multicast data-rate data-rate [ ap ap-name | default ]
Syntax Description
Minimum multicast datarates. The options are 6, 9, 12, 18, 24, 36, 48, 54. Enter 0 to specify that APs will dynamically adjust the number of the buffer allocated for multicast. |
|
Command Default
The default is 0 where the configuration is disabled and the multicast rate is the lowest mandatory data rate and unicast client data rate.
Usage Guidelines
When you configure the datarate without the AP name or default keyword, you globally reset all the APs to the new value and update the controller global default with this new datarate value. If you configure the data-rate with default keyword, you only update the controller global default value and do not reset the value of APs already joined the controller. The APs that join the controller after the new datarate value is set will receive the new datarate value.
Examples
This example shows how to configure minimum multicast datarate settings:
config media-stream multicast direct
To configure the media-stream multicast direct, use the config media-stream multicast direct command.
config media-stream multicast-direct {enable | disable}
Syntax Description
Command Default
Usage Guidelines
Media-stream multicast-direct requires load based Call Admission Control (CAC) to run.
Examples
This example shows how to enable media-stream multicast-direct settings:
This example shows how to disable media-stream multicast-direct settings:
Related Commands
show 802.11a media-stream name
config media-stream message
To configure various parameters of message configuration, use the config media-stream message command.
config media-stream message {state [enable | disable] | url url | email email | phone phone_number | note note}
Syntax Description
Command Default
Usage Guidelines
Media-stream multicast-direct requires load-based Call Admission Control (CAC) to run.
Examples
This example shows how to enable the session announcement message state:
This example shows how to configure the session announcement e-mail address:
Related Commands
show 802.11a media-stream name
config media-stream add
To configure the various global media-stream configurations, use the config media-stream add command.
config media-stream add multicast-direct media_stream_name start-IP end-IP
[template {very-coarse | coarse | ordinary | low-resolution | med-resolution | high-resolution}| detail {bandwidth | packet-size {periodic | initial}} qos priority {drop | fallback}
Syntax Description
Command Default
Usage Guidelines
Media-stream multicast-direct requires load-based Call Admission Control (CAC) to run.
Examples
This example shows how to configure a new media stream:
Related Commands
show 802.11a media-stream name
config media-stream admit
To allow traffic for a media stream group, use the config media-stream admit command.
config media-stream admit media_stream_name
Syntax Description
Command Default
Usage Guidelines
When you try to allow traffic for the media stream group, you will be prompted that IGMP snooping will be disabled and enabled again, and all clients might observe a glitch on the multicast traffic.
Examples
This example shows how to allow traffic for a media stream group:
Related Commands
show 802.11a media-stream name
config media-stream deny
To block traffic for a media stream group, use the config media-stream block command.
config media-stream block media_stream_name
Syntax Description
Command Default
Usage Guidelines
When you try to block traffic for the media stream group, you will be prompted that IGMP snooping will be disabled and enabled again, and all clients might observe a glitch on the multicast traffic.
Examples
This example shows how to block traffic for a media stream group:
Related Commands
show 802.11a media-stream name
config media-stream delete
To configure the various global media-stream configurations, use the config media-stream delete command.
config media-stream delete media_stream_name
Syntax Description
Command Default
Usage Guidelines
Media-stream multicast-direct requires load-based Call Admission Control (CAC) to run.
Examples
This example shows how to configure the media stream named abc:
Related Commands
show 802.11a media-stream name
Configure Net User Commands
Use the config netuser commands to configure netuser settings.
config netuser add
To add a guest user on a WLAN or wired guest LAN to the local user database on the controller, use the config netuser add command.
config netuser add username password { wlan wlan_id | guestlan guestlan_id } userType guest lifetime lifetime description description
Syntax Descriptionl
Command Default
Usage Guidelines
Local network usernames must be unique because they are stored in the same database.
Examples
This example shows how to add a permanent usernamed Jane to the wireless network for 1 hour:
This example shows how to add a guest usernamed George to the wireless network for 1 hour:
Related Commands
config netuser delete
To delete an existing user from the local network, use the config netuser delete command.
config netuser delete username
Syntax Description
Network username. The username can be up to 24 alphanumeric characters. |
Command Default
Usage Guidelines
Local network usernames must be unique because they are stored in the same database.
Examples
This example shows how to delete an existing username named able1 from the network:
Related Commands
config netuser description
To add a description to an existing net user, use the config netuser description command.
config netuser description username description
Syntax Description
Network username. The username can contain up to 24 alphanumeric characters. |
|
(Optional) User description. The description can be up to 32 alphanumeric characters enclosed in double quotes. |
Command Default
Examples
This example shows how to add a user description “HQ1 Contact” to an existing network user named able 1:
Related Commands
config netuser guest-lan-id
To configure a wired guest LAN ID for a network user, use the config netuser guest- lan-id command.
config netuser guest-lan-id username lan_id
Syntax Description
Network username. The username can be 24 alphanumeric characters. |
|
Enter a Wired Guest LAN Identifier to associate with the user. A zero value associates the user with any wired LAN. |
Command Default
Examples
This example shows how to configure a wired LAN ID 2 to associate with the user named aire1:
Related Commands
config netuser guest-role apply
To apply a quality of service (QoS) role to a guest user, use the config netuser guest-role apply command.
config netuser guest-role apply username role_name
Syntax Description
Command Default
Usage Guidelines
If you do not assign a QoS role to a guest user, the Role field in the User Details shows the role as default. The bandwidth contracts for this user are defined in the QoS profile for the WLAN.
If you want to unassign a QoS role from a guest user, use the config netuser guest-role apply username default. This user now uses the bandwidth contracts defined in the QoS profile for the WLAN.
Examples
This example shows how to apply a QoS role to a guest user jsmith with the QoS guest role named Contractor:
Related Commands
config netuser guest-role create
To create a quality of service (QoS) role for a guest user, use the config netuser guest-role create command.
config netuser guest-role create role_name
Syntax Description
Command Default
Usage Guidelines
To delete a QoS role, use the config netuser guest-role delete role-name.
Examples
This example shows how to create a QoS role for the guest user named guestuser1:
Related Commands
config netuser guest-role delete
To delete a quality of service (QoS) role for a guest user, use the config netuser guest-role delete command.
config netuser guest-role delete role_name
Syntax Description
Command Default
Examples
This example shows how to delete a quality of service (QoS) role for guestuser1:
Related Commands
config netuser guest-role qos data-rate average-data-rate
To configure the average data rate for TCP traffic on a per user basis, use the config netuser guest-role qos data-rate average-data-rate command.
config netuser guest-role qos data-rate average-data-rate role_name rate
Syntax Description
Command Default
Usage Guidelines
For the role_name parameter in each of these commands, enter a name for the new QoS role. The name uniquely identifies the role of the QoS user (such as contractor, vendor, and so on.). For the rate parameter, you can enter a value between 0 and 60,000 Kbps (inclusive). A value of 0 imposes no bandwidth restriction on the QoS role.
Examples
This example shows how to configure an average rate for the QoS guest named guestuser1:
Related Commands
config netuser guest-role create
config netuser guest-role qos data-rate average-realtime-rate
To configure the average data rate for TCP traffic on a per user basis, use the config netuser guest-role qos data-rate average-realtime-rate command.
config netuser guest-role qos data-rate average-realtime-rate role_name rate
Syntax Description
Command Default
Usage Guidelines
For the role_name parameter in each of these commands, enter a name for the new QoS role. The name uniquely identifies the role of the QoS user (such as contractor, vendor, and so on.). For the rate parameter, you can enter a value between 0 and 60,000 Kbps (inclusive). A value of 0 imposes no bandwidth restriction on the QoS role.
Examples
This example shows how to configure an average data rate for the QoS guest user named guestuser1 with the rate for TCP traffic of 0 Kbps:
Related Commands
config netuser guest-role
config netuser guest-role qos data-rate average-data-rate
config netuser guest-role qos data-rate burst-data-rate
To configure the peak data rate for TCP traffic on a per user basis, use the config netuser guest-role qos data-rate burst-data-rate command.
config netuser guest-role qos data-rate burst-data-rate role_name rate
Syntax Description
Command Default
Usage Guidelines
The burst data rate should be greater than or equal to the average data rate. Otherwise, the QoS policy may block traffic to and from the wireless client.
For the role_name parameter in each of these commands, enter a name for the new QoS role. The name uniquely identifies the role of the QoS user (such as contractor, vendor, and so on.). For the rate parameter, you can enter a value between 0 and 60,000 Kbps (inclusive). A value of 0 imposes no bandwidth restriction on the QoS role.
Examples
This example shows how to configure the peak data rate for the QoS guest named guestuser1 with the rate for TCP traffic of 0 Kbps:
Related Commands
config netuser guest-role create
config netuser guest-role delete
config netuser guest-role qos data-rate average-data-rate
config netuser guest-role qos data-rate burst-realtime-rate
To configure the burst real-time data rate for UDP traffic on a per user basis, use the config netuser guest-role qos data-rate burst-realtime-rate command.
config netuser guest-role qos data-rate burst-realtime-rate role_name rate
Syntax Description
Command Default
Usage Guidelines
The burst real-time rate should be greater than or equal to the average real-time rate. Otherwise, the quality of service (QoS) policy may block traffic to and from the wireless client.
For the role_name parameter in each of these commands, enter a name for the new QoS role. The name uniquely identifies the role of the QoS user (such as contractor, vendor, and so on.). For the rate parameter, you can enter a value between 0 and 60,000 Kbps (inclusive). A value of 0 imposes no bandwidth restriction on the QoS role.
Examples
This example shows how to configure a burst real-time rate for the QoS guest user named guestuser1 with the rate for TCP traffic of 0 Kbps:
Related Commands
config netuser lifetime
To configure the lifetime for a Guest Network User, use the config netuser lifetime command.
config netuser lifetime username time
Syntax Description
Network username. The username can be up to 50 alphanumeric characters. |
|
Enter lifetime between 60 to 2592000 seconds or 0 for no limit. |
Command Default
Examples
This example shows how to configure a the lifetime for a Guest Network User:
Related Commands
config netuser maxUserLogin
To configure the maximum number of login sessions allowed for a network user, use the config netuser maxUserLogin command.
config netuser maxUserLogin count
Syntax Description
Maximum number of login sessions for a single user. The allowed values are from 0 (unlimited) to 8. |
Command Default
Examples
This example shows how to configure the maximum number of login sessions for a single user to 8:
Related Commands
config netuser password
To change a local network user password, use the config netuser password command.
config netuser password username password
Syntax Description
Network username. The username can be up to 24 alphanumeric characters. |
|
Network user password. The password can contain up to 24 alphanumeric characters. |
Command Default
Examples
This example shows how to change the network user password from aire1 to aire2:
Related Commands
config netuser wlan-id
To configure a wireless LAN ID for a network user, use the config netuser wlan-id command.
config netuser wlan-id username wlan_id
Syntax Description
Network username. The username can be 24 alphanumeric characters. |
|
Wireless LAN identifier to associate with the user. A zero value associates the user with any wireless LAN. |
Command Default
Examples
This example shows how to configure a wireless LAN ID 2 to associate with the user named aire1:
Related Commands
Configure Network Commands
Use the config network commands to configure network settings.
config network 802.3-bridging
To enable or disable 802.3 bridging on a controller, use the config network 802.3-bridging command.
config network 802.3-bridging { enable | disable }
Syntax Description
Command Default
Usage Guidelines
In controller software release 5.2, the software-based forwarding architecture for Cisco 2100 Series Controllers is being replaced with a new forwarding plane architecture. As a result, Cisco 2100 Series Controllers and the Cisco wireless LAN controller Network Module for Cisco Integrated Services Routers bridge 802.3 packets by default. Therefore, 802.3 bridging can now be disabled only on Cisco 4400 Series Controllers, the Cisco WiSM, and the Catalyst 3750G Wireless LAN Controller Switch.
To determine the status of 802.3 bridging, enter the show netuser guest-roles command.
Examples
This example shows how to enable the 802.3 bridging:
Related Commands
config network allow-old-bridge-aps
To configure an old bridge access point’s ability to associate with a switch, use the config network allow-old-bridge-aps command.
config network allow-old-bridge-aps { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to configure an old bridge access point to associate with the switch:
Related Commands
config network ap-discovery
To configure the use of NAT IP in an AP discovery response, use the config network ap-discovery command.
config network ap-discovery nat-ip-only { enable | disable }
Syntax Description
Enables use of NAT IP only in discovery response. This is the default. |
|
Enables use of both NAT IP and non NAT IP in discovery response. |
Command Default
Usage Guidelines
- If the config interface nat-address management command is set, then this command controls which address(es) are sent in the CAPWAP discovery responses.
- If all APs are on the outside of the NAT gateway of the controller, then enter the config network ap-discovery nat-ip-only enable, and only the management NAT address is sent.
- If the controller has both APs on the outside and the inside of its NAT gateway, then enter the config network ap-discovery nat-ip-only disable command, and both the management NAT address and the management inside address are sent. Ensure that you have entered the config ap link-latency disable all command to avoid stranding APs.
Examples
Related Commands
config network ap-fallback
To configure Cisco lightweight access point fallback, use the config network ap-fallback command.
config network ap-fallback { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the Cisco lightweight access point fallback:
Related Commands
config network ap-priority
To enable or disable the option to prioritize lightweight access points so that after a controller failure they reauthenticate by priority rather than on a first-come-until-full basis, use the config network ap-priority command.
config network ap-priority { enable | disable }
Syntax Description
Enables the lightweight access point priority reauthentication. |
|
Disables the lightweight access point priority reauthentication. |
Command Default
Examples
This example shows how to enable the lightweight access point priority reauthorization:
Related Commands
config network apple-talk
To configure AppleTalk bridging, use the config network apple-talk command.
config network apple-talk { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to configure AppleTalk bridging:
Related Commands
config network arptimeout
To set the Address Resolution Protocol (ARP) entry timeout value, use the config network arptimeout command.
config network arptimeout seconds
Syntax Description
Timeout in seconds. The minimum value is 10. The default value is 300. |
Command Default
Examples
This example shows how to set the ARP entry timeout value to 240 seconds:
Related Commands
config network bridging-shared-secret
To configure the bridging shared secret, use the config network bridging-shared-secret command.
config network bridging-shared-secret shared_secret
Syntax Description
Bridging shared secret string. The string can contain up to 10 bytes. |
Command Default
Usage Guidelines
This command creates a secret that encrypts backhaul user data for the mesh access points that connect to the switch.
The zero-touch configuration must be enabled for this command to work.
Examples
This example shows how to configure the bridging shared secret string “shhh1”:
Related Commands
config network broadcast
To enable or disable broadcast packet forwarding, use the config network broadcast command.
config network broadcast {enable | disable}
Syntax Description
Command Default
Usage Guidelines
This command allows you to enable or disable broadcasting. You must enable multicast mode before enabling broadcast forwarding. Use the config network multicast mode command to configure multicast mode on the controller.
Note The default multicast mode is unicast in case of all controllers except for Cisco 2106 Controllers.
The broadcast packets and multicast packets can be independently controlled. If multicast is off and broadcast is on, broadcast packets still reach the access points, based on the configured multicast mode.
Examples
This example shows how to enable broadcast packet forwarding:
Related Commands
show network summary
config network multicast global
config network multicast mode
config network fast-ssid-change
To enable or disable fast Service Set Identifier (SSID) changing for mobile stations, use the config network fast-ssid-change command.
config network fast-ssid-change { enable | disable }
Syntax Description
Command Default
Usage Guidelines
When you enable the Fast SSID Change feature, the controller allows clients to move between SSIDs. When the client sends a new association for a different SSID, the client entry in the controller connection table is cleared before the client is added to the new SSID.
When you disable the FastSSID Change feature, the controller enforces a delay before clients are allowed to move to a new SSID.
Examples
This example shows how to enable the fast SSID changing for mobile stations:
Related Commands
config network ip-mac-binding
To validate the source IP address and MAC address binding within client packets, use the config network ip-mac-binding command.
config network ip-network-binding { enable | disable }
Syntax Description
Command Default
Usage Guidelines
In controller software release 5.2, the controller enforces strict IP address-to-MAC address binding in client packets. The controller checks the IP address and MAC address in a packet, compares them to the addresses that are registered with the controller, and forwards the packet only if they both match. In previous releases, the controller checks only the MAC address of the client and ignores the IP address.
Note You might want to disable this binding check if you have a routed network behind a workgroup bridge (WGB).
Examples
This example shows how to validate the source IP and MAC address within client packets:
config network master-base
To enable or disable the Cisco wireless LAN controller as an access point default primary, use the config network master-base command.
config network master-base { enable | disable }
Syntax Description
Command Default
Usage Guidelines
This setting is only used upon network installation and should be disabled after the initial network configuration. Because the primary Cisco wireless LAN controller is normally not used in a deployed network, the primary Cisco wireless LAN controller setting can be saved from 6.0.199.0 or later releases.
Examples
This example shows how to enable the Cisco wireless LAN controller as a default primary:
config network mgmt-via-wireless
To enable Cisco wireless LAN controller management from an associated wireless client, use the config network mgmt-via-wireless command.
config network mgmt-via-wireless { enable | disable }
Syntax Description
Command Default
Usage Guidelines
This feature allows wireless clients to manage only the Cisco wireless LAN controller associated with the client and the associated Cisco lightweight access point. That is, clients cannot manage another Cisco wireless LAN controller with which they are not associated.
Examples
This example shows how to configure switch management from a wireless interface:
Related Commands
config network multicast global
To enable or disable multicasting on the controller, use the config network multicast global command.
config network multicast global { enable | disable }
Syntax Description
Command Default
Usage Guidelines
The config network broadcast { enable | disable } command allows you to enable or disable broadcasting without enabling or disabling multicasting as well. This command uses the multicast mode configured on the controller (by using the config network multicast mode command) to operate.
Examples
This example shows how to enable the global multicast support:
Related Commands
config network multicast igmp query interval
To configure the IGMP query interval, use the config network multicast igmp query interval command.
config network multicast igmp query interval value
Syntax Description
Frequency at which controller sends IGMP query messages. The range is from 15 to 2400 seconds. |
Command Default
Usage Guidelines
To configure IGMP query interval, ensure that you do the following:
Examples
This example shows how to configure the IGMP query interval at 20 seconds:
Related Commands
config network multicast global
config network multicast igmp snooping
config network multicast igmp timeout
config network multicast igmp snooping
To enable or disable IGMP snooping, use the config network multicast igmp snooping command.
config network multicast igmp snooping {enable | disable}
Syntax Description
Command Default
Examples
This example shows how to enable internet IGMP snooping settings:
Related Commands
config network multicast global
config network multicast igmp query interval
config network multicast igmp timeout
config network multicast igmp timeout
To set the IGMP timeout value, use the config network multicast igmp timeout command.
config network multicast igmp timeout value
Syntax Description
Command Default
Usage Guidelines
You can enter a timeout value between 30 and 7200 seconds. The controller sends three queries in one timeout value at an interval of timeout/3 to see if any clients exist for a particular multicast group. If the controller does not receive a response through an IGMP report from the client, the controller times out the client entry from the MGID table. When no clients are left for a particular multicast group, the controller waits for the IGMP timeout value to expire and then deletes the MGID entry from the controller. The controller always generates a general IGMP query (to destination address 224.0.0.1) and sends it on all WLANs with an MGID value of 1.
Examples
This example shows how to configure the timeout value 50 for IGMP network settings:
Related Commands
config network multicast global
config network multicast igmp snooping
config network multicast igmp query interval
config network multicast l2mcast
To configure the Layer 2 multicast on an interface or all interfaces, use the config network multicast l2mcast command.
config network multicast l2mcast { enable | disable } { all | interface-name }
Syntax Description
Interface name for which the Layer 2 multicast is to enabled or disabled. |
Command Default
Examples
This example shows how to enable Layer 2 multicast for all interfaces:
Related Commands
config network multicast global
config network multicast igmp snooping
config network multicast igmp query interval
config network multicast mld
config network multicast mld
To configure the Multicast Listener Discovery (MLD) parameters, use the config network multicast mld command.
config network multicast mld { query interval interval-value | snooping { enable | disable } | timeout timeout-value }
Syntax Description
Query interval in seconds. The valid value is between 15 seconds to 2400 seconds. |
|
Timeout value in seconds. The valid range is between 30 seconds to 7200 seconds. |
Command Default
Examples
This example shows how to set a query interval of 20 seconds for MLD query messages:
Related Commands
config network multicast global
config network multicast igmp snooping
config network multicast igmp query interval
config network multicast l2mcast
config network multicast mode multicast
To configure the controller to use the multicast method to send broadcast or multicast packets to an access point, use the config network multicast mode multicast command.
config network multicast mode multicast
Syntax Description
Command Default
Examples
This example shows how to configure the multicast mode to send a single copy of data to multiple receivers:
Related Commands
config network multicast mode unicast
To configure the controller to use the unicast method to send broadcast or multicast packets to an access point, use the config network multicast mode unicast command.
config network multicast mode unicast
Syntax Description
Command Default
Examples
This example shows how to configure the controller to use the unicast mode:
Related Commands
config network oeap-600 dual-rlan-ports
To configure the Ethernet port 3 of Cisco OfficeExtend 600 Series access points to operate as a remote LAN port in addition to port 4, use the config network oeap-600 dual-rlan-ports command.
config network oeap-600 dual-rlan-ports { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the Ethernet port 3 of Cisco OfficeExtend 600 Series access points to operate as a remote LAN port:
Related Commands
config network oeap-600 local-network
To configure access to the local network for the Cisco 600 Series OfficeExtend access points, use the config network oeap-600 local-network { enable | disable } command.
config network oeap-600 local-network { enable | disable }
Syntax Description
Enables access to the local network for the Cisco 600 Series OfficeExtend access points. |
|
Disables access to the local network for the Cisco 600 Series OfficeExtend access points. |
Command Default
Examples
This example shows how to enable access to the local network for the Cisco 600 Series OfficeExtend access points:
Related Commands
config network otap-mode
To enable or disable over-the-air provisioning (OTAP) of Cisco lightweight access points, use the config network otap-mode command.
config network otap-mode { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable the OTAP provisioning:
Related Commands
config network rf-network-name
To set the RF-Network name, use the config network rf-network-name command.
config network rf-network-name name
Syntax Description
Command Default
Examples
This example shows how to set the RF-network name to travelers:
Related Commands
config network secureweb
To change the state of the secure web (https is http and SSL) interface for management users, use the config network secureweb command.
config network secureweb { enable | disable }
Syntax Description
Command Default
Usage Guidelines
This command allows management users to access the controller GUI using http://ip-address. Web mode is not a secure connection.
Examples
This example shows how to enable the secure web interface settings for management users:
Related Commands
config network secureweb cipher-option
To enable or disable secure web mode with increased security, or to enable or disable Secure Sockets Layer (SSL v2) for web administration and web authentication, use the config network secureweb cipher-option command.
config network secureweb cipher-option { high | sslv2 } { enable | disable }
Syntax Description
Configures whether or not 128-bit ciphers are required for web administration and web authentication. |
|
Configures SSLv2 for both web administration and web authentication. |
|
Command Default
The default is disabled for secure web mode with increased security and enabled for SSL v2.
Usage Guidelines
Note The cipher-option high command allows users to access the controller GUI using http://ip-address but only from browsers that support 128-bit (or larger) ciphers.
When cipher-option sslv2 is disabled, users cannot connect using a browser configured with SSLv2 only. They must use a browser that is configured to use a more secure protocol such as SSLv3 or later.
Examples
This example shows how to enable secure web mode with increased security:
This example shows how to disable SSL v2:
Related Commands
config network ssh
To allow or disallow new Secure Shell (SSH) sessions, use the config network ssh command.
config network ssh { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the new SSH session:
Related Commands
config network telnet
To allow or disallow new Telnet sessions, use the config network telnet command.
config network telnet { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to configure the new Telnet sessions:
Related Commands
config network usertimeout
To change the timeout for idle client sessions, use the config network usertimeout command.
config network usertimeout seconds
Syntax Description
Timeout duration in seconds. The minimum value is 90. The default value is 300. |
Command Default
Usage Guidelines
Use this command to set the idle client session duration on the Cisco wireless LAN controller. The minimum duration is 90 seconds.
Examples
This example shows how to configure the idle session timeout to 1200 seconds:
Related Commands
config network web-auth captive-bypass
To configure the controller to support bypass of captive portals at the network level, use the config network web-auth captive-bypass command.
config network web-auth captive-bypass { enable | disable }
Syntax Description
Disallows the controller to support bypass of captive portals. |
Command Default
Examples
This example shows how to configure the controller to support bypass of captive portals:
Related Commands
config network web-auth port
To configure an additional port to be redirected for web authentication at the network level, use the config network web-auth port command.
config network web-auth port port
Syntax Description
Command Default
Examples
This example shows how to configure an additional port number 1200 to be redirected for web authentication:
Related Commands
config network web-auth proxy-redirect
To configure proxy redirect support for web authentication clients, use the config network web-auth proxy-redirect command.
config network web-auth proxy-redirect { enable | disable }
Syntax Description
Allows proxy redirect support for web authentication clients. |
|
Disallows proxy redirect support for web authentication clients. |
Command Default
Examples
This example shows how to enable proxy redirect support for web authentication clients:
Related Commands
config network web-auth secureweb
To configure the secure web (https) authentication for clients, use the config network web-auth secureweb command.
config network web-auth secureweb { enable | disable }
Syntax Description
Command Default
Usage Guidelines
If you configure the secure web (https) authentication for clients using the config network web-auth secureweb disable command, then you must reboot the Cisco WLC to implement the change.
Examples
This example shows how to enable the secure web (https) authentication for clients:
Related Commands
config network webmode
To enable or disable the web mode, use the config network webmode command.
config network webmode { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable the web interface mode:
Related Commands
config network web-auth
To configure the network-level web authentication options, use the config network web-auth command.
config network web-auth { port port-number } | { proxy-redirect { enable | disable }}
Syntax Description
Command Default
Usage Guidelines
You must reset the system for the configuration to take effect.
Examples
This example shows how to enable proxy redirect support for web authentication clients:
Related Commands
show network summary
show run-config
config network zero-config
To configure bridge access point ZeroConfig support, use the config network zero-config command.
config network zero-config { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the bridge access point ZeroConfig support:
Related Commands
config paging
To enable or disable scrolling of the page, use the config paging command.
Note Paging cannot be saved in configuration file. This is because paging configuration is enabled or disabled per tenset/console session and the sessions are dynamic and cannot be stored.
config paging { enable | disable }
Syntax Description
Command Default
Related Commands
config passwd-cleartext
To enable or disable temporary display of passwords in plain text, use the config passwd-cleartext command.
config passwd-cleartext { enable | disable }
Syntax Description
Command Default
Usage Guidelines
This command must be enabled if you want to see user-assigned passwords displayed in clear text when using the show run-config command.
To execute this command, you must enter an admin password. This command is valid only for this particular session. It is not saved following a reboot.
Examples
This example shows how to enable display of passwords in plain text:
Related Commands
Configure Port Commands
config port adminmode
To enable or disable the administrative mode for a specific controller port or for all ports, use the config port adminmode command.
config port adminmode { all | port } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable port 8:
This example shows how to enable all ports:
Related Commands
config port autoneg
config port linktrap
config port multicast appliance
config port power
show port
transfer download port
config port autoneg
To configure 10/100BASE-T Ethernet ports for physical port autonegotiation, use the config port autoneg command.
config port autoneg { all | port } { enable | disable }
Syntax Description
Command Default
The default for all ports is that autonegotiation is enabled.
Examples
This example shows how to turn on physical port autonegotiation for all front-panel Ethernet ports:
This example shows how to disable physical port autonegotiation for front-panel Ethernet port 19:
Related Commands
config port adminmode
config port linktrap
config port multicast appliance
config port power
show port
transfer download port
config port linktrap
To enable or disable the up and down link traps for a specific controller port or for all ports, use the config port linktrap command.
config port linktrap { all | port } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable port 8 traps:
This example shows how to enable all port traps:
Related Commands
config port adminmode
config port autoneg
config port multicast appliance
config port power
show port
transfer download port
config port multicast appliance
To enable or disable the multicast appliance service for a specific controller port or for all ports, use the config port multicast appliance commands.
config port multicast appliance { all | port } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable multicast appliance service on all ports:
This example shows how to disable multicast appliance service on port 8:
Related Commands
config port adminmode
config port autoneg
config port linktrap
config port power
show port
transfer download port
config port power
To enable or disable Power over Ethernet (PoE) for a specific controller port or for all ports, use the config port power commands.
config port power { all | port } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable PoE on all ports:
This example shows how to disable PoE on port 8:
Related Commands
config port adminmode
config port autoneg
config port linktrap
config port multicast appliance
show port
transfer download port
config prompt
To change the CLI system prompt, use the config prompt command.
Syntax Description
New CLI system prompt enclosed in double quotes. The prompt can be up to 31 alphanumeric characters and is case sensitive. |
Command Default
Usage Guidelines
Because the system prompt is a user-defined variable, it is omitted from the rest of this documentation.
Examples
This example shows how to change the CLI system prompt to Cisco 4400:
config qos average-data-rate
To define the average data rate in Kbps for TCP traffic per user, use the config qos average-data-rate command.
config qos average-data-rate { bronze | silver | gold | platinum } rate
Syntax Description
Average data rate for TCP traffic per user. A value between 0 and 60,000 Kbps (inclusive). A value of 0 imposes no bandwidth restriction on the QoS profile. |
Command Default
Examples
This example shows how to configure the average data rate 0 Kbps for the queue gold:
Related Commands
config qos average-realtime-rate
config qos average-realtime-rate
To define the average real-time data rate in Kbps for UDP traffic per user, use the config qos average-realtime-rate command.
config qos average-realtime-rate { bronze | silver | gold | platinum } rate
Syntax Description
Command Default
Examples
This example shows how to configure the average real-time actual rate for queue gold:
Related Commands
config qos burst-data-rate
To define the peak data rate in Kbps for TCP traffic per user, use the config qos burst-data-rate command.
config qos burst-data-rate { bronze | silver | gold | platinum } rate
Syntax Description
Peak data rate for TCP traffic per user. A value between 0 and 60,000 Kbps (inclusive). A value of 0 imposes no bandwidth restriction on the QoS profile. |
Command Default
Examples
This example shows how to configure the peak rate 30000 Kbps for the queue gold:
Related Commands
config qos average-realtime-rate
config qos burst-realtime-rate
To define the burst real-time data rate in Kbps for UDP traffic per user, use the config qos burst-realtime-rate command.
config qos burst-realtime-rate { bronze | silver | gold | platinum } rate
Syntax Description
Command Default
Examples
This example shows how to configure the burst real-time actual rate 2000 Kbps for the queue gold:
Related Commands
config qos description
To change the profile description, use the config qos description command.
config qos description { bronze | silver | gold | platinum } description
Syntax Description
Specifies the QoS profile description for the queue platinum. |
|
Command Default
Examples
This example shows how to configure the QoS profile description “description” for the queue gold:
Related Commands
config qos average-realtime-rate
config qos max-rf-usage
To specify the maximum percentage of RF usage per access point, use the config qos max-rf-usage command.
config qos max-rf-usage { bronze | silver | gold | platinum } usage_percentage
Syntax Description
Command Default
Examples
This example shows how to specify the maximum percentage of RF usage for the queue gold:
Related Commands
config qos dot1p-tag
To define the maximum value (0-7) for the priority tag associated with packets that fall within the profile, use the config qos dot1p-tag command.
config qos dot1p-tag { bronze | silver | gold | platinum } dot1p_tag
Syntax Description
Command Default
Examples
This example shows how to configure the a QoS 802.1p tag for the queue gold with the dot1p tag value of 5:
Related Commands
config qos priority
To define the maximum and default QoS levels for unicast and multicast traffic when you assign a QoS profile to a WLAN, use the config qos priority command.
config qos priority { bronze | silver | gold | platinum } { maximum-priority | default-unicast-priority | default-multicast-priority }
Syntax Description
Usage Guidelines
The maximum priority level should not be lower than the default unicast and multicast priority levels.
Examples
This example shows how to configure the QoS priority for a gold profile of the WLAN with voice as the maximum priority, video as the default unicast priority, and besteffort as the default multicast priority.
Related Commands
config qos protocol-type
To define the maximum value (0-7) for the priority tag associated with packets that fall within the profile, use the config qos protocol-type command.
config qos protocol-type { bronze | silver | gold | platinum } { none | dot1p}
Syntax Description
Command Default
Examples
This example shows how to configure the QoS protocol type silver:
Related Commands
config qos queue_length
To specify the maximum number of packets that access points keep in their queues, use the config qos queue_length command.
config qos queue_length { bronze | silver | gold | platinum } queue_length
Syntax Description
Command Default
Examples
This example shows how to configure the QoS length for the queue “gold” with the maximum queue length value as 12:
Related Commands
Configure RADIUS Account Commands
Use the config radius acct commands to configure RADIUS account server settings.
config radius acct
To add, delete, or configure settings for a RADIUS accounting server for the Cisco wireless LAN controller, use the config radius acct command.
config radius acct {{ enable | disable | delete } index } |
add index server_ip port { ascii | hex } secret }
Syntax Description
RADIUS server index. The controller begins the search with 1. |
|
RADIUS server’s UDP port number for the interface protocols. |
|
Command Default
When adding a RADIUS server, the port number defaults to 1813 and the state is enabled.
Examples
This example shows how to configure a priority 1 RADIUS accounting server at 10.10.10.10 using port 1813 with a login password of admin :
Related Commands
config radius acct ipsec authentication
To configure IPsec authentication for the Cisco wireless LAN controller, use the
config radius acct ipsec authentication command.
config radius acct ipsec authentication { hmac-md5 | hmac-sha1 } index
Syntax Description
Command Default
Examples
This example shows how to configure the IPsec hmac-md5 authentication service on the RADIUS accounting server index 1:
Related Commands
config radius acct ipsec disable
To disable IPsec support for an accounting server for the Cisco wireless LAN controller, use the config radius acct ipsec disable command.
config radius acct ipsec disable index
Syntax Description
Command Default
Examples
This example shows how to disable the IPsec support for RADIUS accounting server index 1:
Related Commands
config radius acct ipsec enable
To enable IPsec support for an accounting server for the Cisco wireless LAN controller, use the config radius acct ipsec enable command.
config radius acct ipsec enable index
Syntax Description
Command Default
Examples
This example shows how to enable the IPsec support for RADIUS accounting server index 1:
Related Commands
config radius acct ipsec encryption
To configure IPsec encryption for an accounting server for the Cisco wireless LAN controller, use the config radius acct ipsec encryption command.
config radius acct ipsec encryption {3des | aes | des} index
Syntax Description
Command Default
Examples
This example shows how to configure the IPsec 3DES encryption for RADIUS server index value 3:
Related Commands
config radius acct ipsec ike
To configure Internet Key Exchange (IKE) for the Cisco wireless LAN controller, use the
config radius acct ipsec command.
config radius acct ipsec ike dh-group { group-1 | group-2 | group-5 } |
lifetime seconds | phase1 { aggressive | main }} index
Syntax Description
Command Default
Examples
This example shows how to configure an IKE lifetime of 23 seconds for RADIUS server index 1:
Related Commands
config radius acct mac-delimiter
To specify the delimiter to be used in the MAC addresses that are sent to the RADIUS accounting server, use the config radius acct mac-delimiter command.
config radius acct mac-delimiter { colon | hyphen | single-hyphen | none }
Syntax Description
Sets the delimiter to a colon (for example, xx:xx:xx:xx:xx:xx). |
|
Sets the delimiter to a hyphen (for example, xx-xx-xx-xx-xx-xx). |
|
Sets the delimiter to a single hyphen (for example, xxxxxx-xxxxxx). |
|
Command Default
Examples
This example shows how to set the delimiter hyphen to be used in the MAC addresses that are sent to the RADIUS accounting server for the network users:
Related Commands
config radius acct network
To configure a default RADIUS server for network users, use the config radius acct network command.
config radius acct network index { enable | disable }
Syntax Description
Enables the server as a network user’s default RADIUS server. |
|
Disables the server as a network user’s default RADIUS server. |
Command Default
Examples
This example shows how to configure a default RADIUS accounting server for the network users with RADIUS server index1:
Related Commands
config radius acct retransmit-timeout
To change the default transmission timeout for a RADIUS accounting server for the Cisco wireless LAN controller, use the config radius acct retransmit-timeout command.
config radius acct retransmit-timeout index timeout
Syntax Description
Command Default
Examples
This example shows how to configure retransmission timeout value 5 seconds between the retransmission:
Related Commands
Configure RADIUS Authentication Server Commands
Use the config radius auth commands to configure RADIUS authentication server settings.
config radius auth
To add, delete, or configure settings for a RADIUS authentication server for the Cisco wireless LAN controller, use the config radius auth command.
config radius auth {{ enable | disable | delete } index } |
add index server_ip port { ascii | hex } secret
Syntax Description
RADIUS server index. The controller begins the search with 1. |
|
Adds a RADIUS authentication server. See the “Defaults” section. |
|
RADIUS server’s UDP port number for the interface protocols. |
|
Command Default
When adding a RADIUS server, the port number defaults to 1813 and the state is enabled.
Examples
This example shows how to configure a priority 1 RADIUS authentication server at 10.10.10.10 using port 1812 with a login password of admin :
Related Commands
config radius auth IPsec authentication
To configure IPsec support for an authentication server for the Cisco wireless LAN controller, use the config radius auth IPsec authentication command.
config radius auth IPsec authentication { hmac-md5 | hmac-sha1 } index
Syntax Description
Command Default
Examples
This example shows how to configure the IPsec hmac-md5 support for RADIUS authentication server index 1:
Related Commands
config radius auth IPsec disable
To disable IPsec support for an authentication server for the Cisco wireless LAN controller, use the config radius auth IPsec disable command.
config radius auth IPsec {enable | disable} index
Syntax Description
Command Default
Examples
This example shows how to enable the IPsec support for RADIUS authentication server index 1:
This example shows how to disable the IPsec support for RADIUS authentication server index 1:
Related Commands
config radius auth IPsec encryption
To configure IPsec encryption support for an authentication server for the Cisco wireless LAN controller, use the config radius auth IPsec command.
config radius auth IPsec encryption { 3des | aes | des } index
Syntax Description
Command Default
Examples
This example shows how to configure IPsec 3dec encryption RADIUS authentication server index 3:
Related Commands
config radius auth IPsec ike
To configure Internet Key Exchange (IKE) for the Cisco wireless LAN controller, use the config radius auth IPsec ike command.
config radius auth IPsec ike { dh-group { group-1 | group-2 | group-5 } |
lifetime seconds | phase1 { aggressive | main }} index
Syntax Description
Command Default
Examples
This example shows how to configure IKE lifetime of 23 seconds for RADIUS authentication server index 1:
Related Commands
config radius auth keywrap
To enable and configure Advanced Encryption Standard (AES) key wrap, which makes the shared secret between the controller and the RADIUS server more secure, use the config radius auth keywrap command.
config radius auth keywrap { enable | disable | add { ascii | hex } kek mack index }
Syntax Description
Index of the RADIUS authentication server on which to configure the AES key wrap. |
Command Default
Examples
This example shows how to enable the AES key wrap for a RADIUS authentication server:
Related Commands
config radius auth mac-delimiter
To specify a delimiter to be used in the MAC addresses that are sent to the RADIUS authentication server, use the config radius auth mac-delimiter command.
config radius auth mac-delimiter { colon | hyphen | single-hyphen | none }
Syntax Description
Sets a delimiter to a colon (for example, xx:xx:xx:xx:xx:xx). |
|
Sets a delimiter to a hyphen (for example, xx-xx-xx-xx-xx-xx). |
|
Sets a delimiter to a single hyphen (for example, xxxxxx-xxxxxx). |
|
Command Default
Examples
This example shows how to specify a delimiter hyphen to be used for a RADIUS authentication server:
Related Commands
config radius auth management
To configure a default RADIUS server for management users, use the config radius auth management command.
config radius auth management index { enable | disable }
Syntax Description
Enables the server as a management user’s default RADIUS server. |
|
Disables the server as a management user’s default RADIUS server. |
Command Default
Examples
This example shows how to configure a RADIUS server for management users:
Related Commands
config radius auth mgmt-retransmit-timeout
To configure a default RADIUS server retransmission timeout for management users, use the config radius auth mgmt-retransmit-timeout command.
config radius auth mgmt-retransmit-timeout index retransmit-timeout
Syntax Description
Command Default
Examples
This example shows how to configure a default RADIUS server retransmission timeout for management users:
Related Commands
config radius auth network
To configure a default RADIUS server for network users, use the config radius auth network command.
config radius auth network index { enable | disable }
Syntax Description
Disables the server as a network user default RADIUS server. |
Command Default
Examples
This example shows how to configure a default RADIUS server for network users:
Related Commands
config radius auth retransmit-timeout
To change a default transmission timeout for a RADIUS authentication server for network users, use the config radius auth retransmit-timeout command.
config radius auth retransmit-timeout index timeout
Syntax Description
Command Default
Examples
This example shows how to configure a retransmission timeout of 5 seconds for a RADIUS authentication server:
Related Commands
config radius auth rfc3576
To configure RADIUS RFC-3576 support for the authentication server for the Cisco wireless LAN controller, use the config radius auth rfc3576 command.
config radius auth rfc3576 { enable | disable } index
Syntax Description
Command Default
Usage Guidelines
RFC 3576, which is an extension to the RADIUS protocol, allows dynamic changes to a user session. RFC 3576 includes support for disconnecting users and changing authorizations applicable to a user session. Disconnect messages cause a user session to be terminated immediately; CoA messages modify session authorization attributes such as data filters.
Examples
This example shows how to enable the RADIUS RFC-3576 support for a RADIUS authentication server:
Related Commands
config radius auth server-timeout
To configure a retransmission timeout value for a RADIUS accounting server, use the config radius auth server-timeout command.
config radius auth server-timeout index timeout
Syntax Description
Command Default
Examples
This example shows how to configure a server timeout value of 2 seconds for RADIUS authentication server index 10:
Related Commands
config radius aggressive-failover disabled
To configure the controller to mark a RADIUS server as down (not responding) after the server does not reply to three consecutive clients, use the config radius aggressive-failover disabled command.
config radius aggressive-failover disabled
Syntax Description
Command Default
Examples
This example shows how to configure the controller to mark a RADIUS server as down:
Related Commands
config radius backward compatibility
To configure RADIUS backward compatibility for the Cisco wireless LAN controller, use the config radius backward compatibility command.
config radius backward compatibility { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the RADIUS backward compatibility settings:
Related Commands
config radius callStationIdCase
To configure callStationIdCase information sent in RADIUS messages for the Cisco wireless LAN controller, use the config radius callStationIdCase command.
config radius callStationIdCase { legacy | lower | upper }
Syntax Description
Sends Call Station IDs for layer 2 auth to RADIUS in uppercase. |
|
Command Default
Examples
This example shows how to send the call station ID Case (lowercase or uppercase) to use the IP address:
Related Commands
config radius callStationIdType
To configure callStationIdType information sent in RADIUS messages for the Cisco wireless LAN controller, use the config radius callStationIdType command.
config radius callStationIdType { ipaddr | macaddr | ap-macaddr | ap-macaddr-ssid }
Syntax Description
Command Default
Usage Guidelines
This command uses the selected calling station ID for communications with RADIUS servers and other applications.
Examples
This example shows how to configure the call station ID type to use the IP address:
This example shows how to configure the call station ID type to use the system’s MAC address:
This example shows how to configure the call station ID type to use the access point’s MAC address:
Related Commands
config radius fallback-test
To configure the RADIUS server fallback behavior, use the config radius fallback-test command.
config radius fallback-test mode {off | passive | active}} | {username username} | {interval interval}
Syntax Description
Command Default
Examples
This example shows how to disable the RADIUS accounting server fallback behavior:
This example shows how to configure the controller to revert to a preferable server from the available backup servers without using the extraneous probe messages:
This example shows how to configure the controller to revert to a preferable server from the available backup servers by using RADIUS probe messages:
Related Commands
config advanced probe filter
config advanced probe limit
show advanced probe
show radius acct statistics
config rfid auto-timeout
To configure an automatic timeout of radio frequency identification (RFID) tags, use the config rfid auto-timeout command.
config rfid auto-timeout { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable an automatic timeout of RFID tags:
Related Commands
config rfid status
To configure radio frequency identification (RFID) tag data tracking, use the config rfid status command.
config rfid status { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to configure RFID tag tracking settings:
Related Commands
config rfid timeout
To configure a static radio frequency identification (RFID) tag data timeout, use the config rfid timeout command.
Syntax Description
Command Default
Examples
This example shows how to configure a static RFID tag data timeout of 60 seconds.
Related Commands
Configure RF-Profile commands
Use the configure rf-profile commands to configure rf-profiles.
config rf-profile create
To create a RF profile, use the config rf-profile create command.
config rf-profile create { 802.11a | 802.11b/g } profile-name
Syntax Description
Command Default
Examples
This example shows how to create a new RF profile:
Related Commands
config rogue auto-contain level
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rf-profile data-rates
To configure the data-rate on a RF profile, use the config rf-profile data-rates command.
config rf-profile data-rates {disabled | mandatory | supported } data-rate profile-name
Syntax Description
802.11 operational rates, which are 1*, 2*, 5.5*, 6, 9, 11*, 12, 18, 24, 36, 48 and 54, where * denotes 802.11b only rates. |
|
Command Default
Examples
This example shows how to set a data-rate to mandatory for a RF profile:
Related Commands
config rogue auto-contain level
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rf-profile delete
To delete a RF profile, use the config rf-profile delete command.
config rf-profile delete profile-name
Syntax Description
Command Default
Examples
This example shows how to delete a RF profile:
Related Commands
config rogue auto-contain level
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rf-profile description
To provide a description to a RF profile, use the config rf-profile description command.
config rf-profile description description profile-name
Syntax Description
Command Default
Examples
This example shows how to add a description to a RF profile:
Related Commands
config rogue auto-contain level
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rf-profile tx-power-control-thresh-v1
To configure TPCv1 to a RF profile, use the config rf-profile tx-power-control-thresh-v1 command.
config rf-profile tx-power-control-thresh-v1 tpc-threshold profile-name
Syntax Description
Command Default
Examples
This example shows how to configure TPCv1 on a RF profile:
Related Commands
config rogue auto-contain level
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rf-profile tx-power-control-thresh-v2
To configure TPCv2 to a RF profile, use the config rf-profile tx-power-control-thresh-v2 command.
config rf-profile tx-power-control-thresh-v2 tpc-threshold profile-name
Syntax Description
Command Default
Examples
This example shows how to configure TPCv2 on a RF profile:
Related Commands
config rogue auto-contain level
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rf-profile tx-power-max
To configure maximum auto-rf to a RF profile, use the config rf-profile tx-power-max command.
config rf-profile tx-power-max tx-power-max profile-name
Syntax Description
Command Default
Examples
This example shows how to configure tx-power-max on a RF profile:
Related Commands
config rogue auto-contain level
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rf-profile tx-power-min
To configure minimum auto-rf to a RF profile, use the config rf-profile tx-power-min command.
config rf-profile tx-power-max tx-power-min profile-name
Syntax Description
Command Default
Examples
This example shows how to configure tx-power-min on a RF profile:
Related Commands
config rogue auto-contain level
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
Configure Rogue Commands
Use the configure rogue commands to configure policy settings for unidentified (rogue) clients.
config rogue adhoc
To globally or individually configure the status of an Independent Basic Service Set (IBSS or ad-hoc) rogue access point, use the config rogue adhoc command.
config rogue adhoc { enable | disable | external rogue_MAC | alert { rogue_MAC | all } |
auto-contain [ monitor_ap ] | contain rogue_MAC 1234_aps }
Syntax Description
Command Default
The default for this command is enabled and is set to alert. The default for auto-containment is disabled.
Usage Guidelines
The controller continuously monitors all nearby access points and automatically discovers and collects information on rogue access points and clients. When the controller discovers a rogue access point, it uses RLDP to determine if the rogue is attached to your wired network.
Note RLDP is not supported for use with Cisco autonomous rogue access points. These access points drop the DHCP Discover request sent by the RLDP client. Also, RLDP is not supported if the rogue access point channel requires dynamic frequency selection (DFS).
When you enter any of the containment commands, the following warning appears:
The 2.4- and 5-GHz frequencies in the Industrial, Scientific, and Medical (ISM) band are open to the public and can be used without a license. As such, containing devices on another party’s network could have legal consequences.
Enter the auto-contain command with the monitor_ap argument to monitor the rogue access point without containing it. Enter the auto-contain command without the optional monitor_ap to automatically contain all wired ad-hoc rogues detected by the controller.
Examples
This example shows how to enable the detection and reporting of ad-hoc rogues:
This example shows how to enable alerts for all ad-hoc rogue access points:
Related Commands
config rogue auto-contain level
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue ap classify
To classify the status of a rogue access point, use the config rogue ap classify command.
config rogue ap classify { friendly state { internal | external } ap_mac
config rogue ap classify { malicious | unclassified } state { alert | contain } ap_mac}
Syntax Description
Command Default
These commands are disabled by default. Therefore, all unknown access points are categorized as unclassified by default.
Usage Guidelines
A rogue access point cannot be moved to the unclassified class if its current state is contain.
When you enter any of the containment commands, the following warning appears: “Using this feature may have legal consequences. Do you want to continue?” The 2.4- and 5-GHz frequencies in the Industrial, Scientific, and Medical (ISM) band are open to the public and can be used without a license. As such, containing devices on another party’s network could have legal consequences.
Examples
This example shows how to classify a rogue access point as friendly and can be trusted:
This example shows how to classify a rogue access point as malicious and to send an alert:
This example shows how to classify a rogue access point as unclassified and to contain it:
Related Commands
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue ap friendly
To add a new friendly access point entry to the friendly MAC address list, or delete an existing friendly access point entry from the list, use the config rogue ap friendly command.
config rogue ap friendly { add | delete } ap_mac
Syntax Description
Command Default
Examples
This example shows how to add a new friendly access point with MAC address 11:11:11:11:11:11 to the friendly MAC address list:
Related Commands
config rogue ap classify
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue ap rldp
To enable, disable, or initiate the Rogue Location Discovery Protocol (RLDP), use the config rogue ap rldp command.
config rogue ap rldp enable { alarm-only | auto-contain } [ monitor_ap_only ]
config rogue ap rldp initiate rogue_mac_address
config rogue ap rldp disable
Syntax Description
Command Default
Usage Guidelines
When you enter any of the containment commands, the following warning appears: “Using this feature may have legal consequences. Do you want to continue?” The 2.4- and 5-GHz frequencies in the Industrial, Scientific, and Medical (ISM) band are open to the public and can be used without a license. As such, containing devices on another party’s network could have legal consequences.
Examples
This example shows how to enable RLDP on all access points:
This example shows how to enable RLDP on monitor-mode access point ap_1:
This example shows how to start RLDP on the rogue access point with MAC address 123.456.789.000:
This example shows how to disable RLDP on all access points:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue ap ssid
To generate an alarm only, or to automatically contain a rogue access point that is advertising your network’s service set identifier (SSID), use the config rogue ap ssid command.
config rogue ap ssid { alarm | auto-contain }
Syntax Description
Generates only an alarm when a rogue access point is discovered to be advertising your network’s SSID. |
|
Automatically contains the rogue access point that is advertising your network’s SSID. |
Command Default
Usage Guidelines
When you enter any of the containment commands, the following warning appears: “Using this feature may have legal consequences. Do you want to continue?” The 2.4- and 5-GHz frequencies in the Industrial, Scientific, and Medical (ISM) band are open to the public and can be used without a license. As such, containing devices on another party’s network could have legal consequences.
Examples
This example shows how to automatically contain a rogue access point that is advertising your network’s SSID:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap timeout
config rogue ap valid-client
config rogue rule
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue ap timeout
To specify the number of seconds after which the rogue access point and client entries expire and are removed from the list, use the config rogue ap timeout command.
config rogue ap timeout seconds
Syntax Description
Value of 240 to 3600 seconds (inclusive), with a default value of 1200 seconds. |
Command Default
Examples
This example shows how to set an expiration time for entries in the rogue access point and client list to 2400 seconds:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap valid-client
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue auto-contain level
To configure rogue auto-containment level, use the config rogue auto-contain level command.
config rogue auto-contain level level [ monitor_ap_only ]
Syntax Description
Command Default
Usage Guidelines
The controller continuously monitors all nearby access points and automatically discovers and collects information on rogue access points and clients. When the controller discovers a rogue access point, it uses any of the configured autocontainment policies to start autocontainment. The policies for initiating autocontainment are rogue on wire (detected through RLDP or rogue detector AP), rogue using managed SSID, Valid client on Rogue AP, and AdHoc Rogue.
Note RLDP is not supported for use with Cisco autonomous rogue access points. These access points drop the DHCP Discover request sent by the RLDP client. Also, RLDP is not supported if the rogue access point channel requires dynamic frequency selection (DFS).
When you enter any of the containment commands, the following warning appears:
The 2.4- and 5-GHz frequencies in the Industrial, Scientific, and Medical (ISM) band are open to the public and can be used without a license. As such, containing devices on another party’s network could have legal consequences.
Examples
This example shows how to configure the auto-contain level to 3:
Related Commands
config rogue adhoc
show rogue adhoc summary
show rogue client summary
show rogue ignore-list
show rogue rule summary
config rogue ap valid-client
To generate an alarm only, or to automatically contain a rogue access point to which a trusted client is associated, use the config rogue ap valid-client command.
config rogue ap valid-client { alarm | auto-contain }
Syntax Description
Generates only an alarm when a rogue access point is discovered to be associated with a valid client. |
|
Automatically contains a rogue access point to which a trusted client is associated. |
Command Default
Usage Guidelines
When you enter any of the containment commands, the following warning appears: “Using this feature may have legal consequences. Do you want to continue?” The 2.4- and 5-GHz frequencies in the Industrial, Scientific, and Medical (ISM) band are open to the public and can be used without a license. As such, containing devices on another party’s network could have legal consequences.
Examples
This example shows how to automatically contain a rogue access point that is associated with a valid client:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue client
To configure rogue clients, use the config rogue client command.
config rogue client { aaa { enable | disable } | alert ap_mac | contain client_mac } num_of_APs
Syntax Description
Command Default
Examples
This example shows how to enable the AAA server or local database to check MAC addresses:
This example shows how to disable the AAA server or local database from checking MAC addresses:
Related Commands
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue client detailed
show rogue client summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue detection
To enable or disable rogue detection, use the config rogue detection command.
config rogue detection { enable | disable } {cisco_ap | all}
Syntax Description
Note If an AP itself is configured with the name ‘all’, then the ‘all access points’ case takes precedence over the AP that is named ‘all’.
Command Default
Usage Guidelines
Rogue detection is enabled by default for all access points joined to the controller except for OfficeExtend access points. OfficeExtend access points are deployed in a home environment and are likely to detect a large number of rogue devices.
Examples
This example shows how to enable rogue detection on the access point Cisco_AP:
Related Commands
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue client detailed
show rogue client summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue detection min-rssi
To configure the minimum Received Signal Strength Indicator (RSSI) value at which APs can detect rogues and create a rogue entry in the controller, use the config rogue detection min-rssi command.
config rogue detection min-rssi rssi-in-dBm
Syntax Description
Minimum RSSI value.The valid range is from–70 dBm to –128 dBm, and the default value is –128 dBm. |
Usage Guidelines
This feature is applicable to all the AP modes.
There can be many rogues with very weak RSSI values that do not provide any valuable information in rogue analysis. Therefore, you can use this option to filter rogues by specifying the minimum RSSI value at which APs should detect rogues.
Examples
This example shows how to configure the minimum RSSI value:
Related Commands
config rogue detection
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue client detailed
show rogue client summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue detection monitor-ap
To configure the rogue report interval for all monitor mode Cisco APs, use the config rogue detection monitor-ap command.
config rogue detection monitor-ap { report-interval | transient-rogue-interval } time-in-seconds
Syntax Description
Interval at which rogues are consistently scanned for by APs after the first time the rogues are scanned for. |
|
Usage Guidelines
This feature is applicable to APs that are in monitor mode only.
Using the transient interval values, you can control the time interval at which APs should scan for rogues. APs can also filter the rogues based on their transient interval values.
Examples
This example shows how to configure the rogue report interval to 60 seconds:
This example shows how to configure the transient rogue interval to 300 seconds:
Related Commands
config rogue detection
config rogue detection min-rssi
config rogue rule
config trapflags rogueap
show rogue ap clients
show rogue client detailed
show rogue client summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config rogue rule
To add and configure rogue classification rules, use the config rogue rule commands.
config rogue rule { add ap priority priority classify { friendly | malicious } rule_name |
classify { friendly | malicious } rule_name |
condition ap { set | delete } condition_type condition_value rule_name |
{ enable | delete | disable } { all | rule_name } |
match { all | any } |
priority priority rule_name }
Syntax Description
Command Default
Usage Guidelines
For your changes to be effective, you must enable the rule. You can configure up to 64 rules.
Examples
This example shows how to create a rule called rule_1 with a priority of 1 and a classification as friendly :
This example shows how to enable rule_1:
This example shows how to change the priority of the last command:
This example shows how to change the classification of the last command:
This example shows how to disable the last command:
This example shows how to delete SSID_2 from the user-configured SSID list in rule-5:
Related Commands
config rogue adhoc
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
config rogue client
config trapflags rogueap
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show rogue client detailed
show rogue client summary
show rogue ignore-list
show rogue rule detailed
show rogue rule summary
config route add
To configure a network route from the service port to a dedicated workstation IP address range, use the config route add command.
config route add ip_address netmask gateway
Syntax Description
Command Default
Examples
This example shows how to configure a network route to a dedicated workstation IP address 10.1.1.0, subnet mask 255.255.255.0, and gateway 10.1.1.1:
Related Commands
config route delete
To remove a network route from the service port, use the config route delete command.
config route delete ip_address
Syntax Description
Command Default
Examples
This example shows how to delete a route from the network IP address 10.1.1.0:
Related Commands
config serial baudrate
To set the serial port baud rate, use the config serial baudrate command.
config serial baudrate { 1200 | 2400 | 4800 | 9600 | 19200 | 38400 | 57600 }
Syntax Description
Command Default
Examples
This example shows how to configure a serial baud rate with the default connection speed of 9600:
Related Commands
config serial timeout
To set the timeout of a serial port session, use the config serial timeout command.
Syntax Description
Timeout in minutes from 0 to 160. A value of 0 indicates no timeout. |
Command Default
Usage Guidelines
Use this command to set the timeout for a serial connection to the front of the Cisco wireless LAN controller from 0 to 160 minutes where 0 is no timeout.
Examples
This example shows how to configure the timeout of a serial port session to 10 minutes:
Related Commands
config service timestamps
To enable or disable timestamps in message logs, use the config service timestamps command.
config service timestamps { debug | log } { datetime | disable }
Syntax Description
Specifies to timestamp message logs with the standard date and time. |
|
Command Default
Examples
This example shows how to configure timestamp message logs with the standard date and time:
This example shows how to prevent message logs being timestamped:
Related Commands
config sessions maxsessions
To configure the number of Telnet CLI sessions allowed by the Cisco wireless LAN controller, use the config sessions maxsessions command.
config sessions maxsessions session_num
Syntax Description
Command Default
Usage Guidelines
Up to five sessions are possible while a setting of zero prohibits any Telnet CLI sessions.
Examples
This example shows how to configure the number of allowed CLI sessions to 2:
Related Commands
config sessions timeout
To configure the inactivity timeout for Telnet CLI sessions, use the config sessions timeout command.
config sessions timeout timeout
Syntax Description
Timeout of Telnet session in minutes (from 0 to 160). A value of 0 indicates no timeout. |
Command Default
Examples
This example shows how to configure the inactivity timeout for Telnet sessions to 20 minutes:
Related Commands
config slot
To configure various slot parameters, use the config slot command.
config slot slot_id { enable | disable | channel ap | chan_width | txpower ap | antenna extAntGain antenna_gain | rts } cisco_ap
Syntax Description
External antenna gain value in.5 dBi units (such as 2.5 dBi = 5). |
|
Name of the Cisco access point on which the channel is configured. |
Command Default
Examples
This example shows how to enable slot 3 for the access point abc:
This example shows how to configure rts for the access point abc:
Related Commands
Configure SNMP Commands
Use the config snmp commands to configure Simple Network Management Protocol (SNMP) settings.
config snmp community accessmode
To modify the access mode (read only or read/write) of an SNMP community, use the config snmp community accessmode command.
config snmp community accessmode { ro | rw } name
Syntax Description
Command Default
Two communities are provided by default with the following settings:
Examples
This example shows how to configure read/write access mode for SNMP community:
Related Commands
show snmp community
config snmp community mode
config snmp community create
config snmp community delete
config snmp community ipaddr
config snmp community create
To create a new SNMP community, use the config snmp community create command.
config snmp community create name
Syntax Description
Command Default
Usage Guidelines
Use this command to create a new community with the default configuration.
Examples
This example shows how to create a new SNMP community named test:
Related Commands
show snmp community
config snmp community mode
config snmp community accessmode
config snmp community delete
config snmp community ipaddr
config snmp community delete
To delete an SNMP community, use the config snmp community delete command.
config snmp community delete name
Syntax Description
Command Default
Examples
This example shows how to delete an SNMP community named test:
Related Commands
show snmp community
config snmp community mode
config snmp community accessmode
config snmp community create
config snmp community ipaddr
config snmp community ipaddr
To configure the IP address of an SNMP community, use the config snmp community ipaddr command.
config snmp community ipaddr ip_address ip_mask name
Syntax Description
Command Default
Examples
This example shows how to configure an SNMP community with the IP address 10.10.10.10, IP mask 255.255.255.0, and SNMP community named public:
Related Commands
show snmp community
config snmp community mode
config snmp community accessmode
config snmp community create
config snmp community delete
config snmp community ipaddr
config snmp community mode
To enable or disable an SNMP community, use the config snmp community mode command.
config snmp community mode { enable | disable } name
Syntax Description
Command Default
Examples
This example shows how to enable the SNMP community named public:
Related Commands
show snmp community
config snmp community accessmode
config snmp community create
config snmp community delete
config snmp community ipaddr
config snmp engineID
To configure the SNMP engine ID, use the config snmp engineID command.
config snmp engineID { engine_id | default }
Syntax Description
Engine ID in hexadecimal characters (a minimum of 10 and a maximum of 24 characters are allowed). |
|
Command Default
Usage Guidelines
The SNMP engine ID is a unique string used to identify the device for administration purposes. You do need to specify an engine ID for the device because a default string is automatically generated using Cisco’s enterprise number and the MAC address of the first interface on the device.
If you change the engine ID, then a reboot is required for the change to take effect.
Examples
This example shows how to configure the SNMP engine ID with the value fffffffffff:
Related Commands
config snmp syscontact
To set the SNMP system contact name, use the config snmp syscontact command.
config snmp syscontact contact
Syntax Description
SNMP system contact name. The contact can be up to 31 alphanumeric characters. |
Command Default
Examples
This example shows how to set the SMNP system contact named Cisco WLAN Solution_administrator:
Related Commands
config snmp syslocation
To configure the SNMP system location name, use the config snmp syslocation command.
config snmp syslocation location
Syntax Description
SNMP system location name. The location can be up to 31 alphanumeric characters. |
Command Default
Examples
This example shows how to configure the SNMP system location name to Building_2a:
Related Commands
config snmp trapreceiver create
To configure a server to receive SNMP traps, use the config snmp trapreceiver create command.
config snmp trapreceiver create name ip_address
Syntax Description
Command Default
Usage Guidelines
The IP address must be valid for the command to add the new server.
Examples
This example shows how to add a new SNMP trap receiver with the SNMP community named test and IP address 10.1.1.1:
Related Commands
config snmp trapreceiver delete
To delete a server from the trap receiver list, use the config snmp trapreceiver delete command.
config snmp trapreceiver delete name
Syntax Description
SNMP community name. The name can contain up to 16 characters. |
Command Default
Examples
This example shows how to delete a server named test from the SNMP trap receiver list:
Related Commands
config snmp trapreceiver mode
To send or disable sending traps to a selected server, use the config snmp trapreceiver mode command.
config snmp trapreceiver mode { enable | disable } name
Syntax Description
Command Default
Usage Guidelines
This command enables or disables the Cisco wireless LAN controller from sending the traps to the selected server.
Examples
This example shows how to disable an SNMP trap receiver from sending traps to a server named server1:
Related Commands
config snmp v3user create
To create a version 3 SNMP user, use the config snmp v3user create command.
config snmp v3user create username { ro | rw } { none | hmacmd5 | hmacsha } { none | des | aescfb128 } [ auth_key ] [ encrypt_key ]
Syntax Description
Command Default
SNMP v3 username AccessMode Authentication Encryption
Examples
This example shows how to add an SNMP username named test with read-only privileges and no encryption or authentication:
Related Commands
config snmp v3user delete
To delete a version 3 SNMP user, use the config snmp v3user delete command.
config snmp v3user delete username
Syntax Description
Command Default
Examples
This example shows how to remove an SNMP user named test:
Related Commands
config snmp version
To enable or disable selected SNMP versions, use the config snmp version command.
config snmp version { v1 | v2 | v3 } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable SNMP version v1:
Related Commands
Configure Spanning Tree Protocol Commands
Use the config spanningtree commands to configure Spanning Tree Protocol settings.
config spanningtree port mode
To turn fast or 802.1D Spanning Tree Protocol (STP) on or off for one or all Cisco wireless LAN controller ports, use the config spanningtree port mode command.
config spanningtree port mode { off | 802.1d | fast } { port | all }
Syntax Description
Command Default
Usage Guidelines
When the Cisco 4400 Series Wireless LAN Controller is configured for port redundancy, STP must be disabled for all ports on the controller. STP can remain enabled on the switch connected to the controller.
Entering this command allows the controller to set up STP, detect logical network loops, place redundant ports on standby, and build a network with the most efficient pathways.
Examples
This example shows how to disable STP for all Ethernet ports:
This example shows how to turn on STP 802.1D mode for Ethernet port 24:
This example shows how to turn on fast STP mode for Ethernet port 2:
Related Commands
show spanningtree port
config spanningtree switch mode
config spanningtree port pathcost
config spanningtree port priority
config spanningtree port pathcost
To set the Spanning Tree Protocol (STP) path cost for an Ethernet port, use the config spanningtree port pathcost command.
config spanningtree port pathcost { cost | auto } { port | all }
Syntax Description
Port number (1 through 12 or 1 through 24), or all to configure all ports. |
|
Command Default
Usage Guidelines
When the Cisco 4400 Series Wireless LAN Controller is configured for port redundancy, STP must be disabled for all ports on the controller. STP can remain enabled on the switch that is connected to the controller.
Examples
This example shows how to have the STP algorithm automatically assign a path cost for all ports:
This example shows how to have the STP algorithm use a port cost of 200 for port 22:
Related Commands
show spanningtree port
config spanningtree port mode
config spanningtree port priority
config spanningtree port priority
To configure the Spanning Tree Protocol (STP) port priority, use the config spanningtree port priority command.
config spanningtree port priority priority_num port
Syntax Description
Command Default
Usage Guidelines
When the Cisco 4400 Series Wireless LAN Controller is configured for port redundancy, STP must be disabled for all ports on the controller. STP can remain enabled on the switch connected to the controller.
Examples
This example shows how to set Ethernet port 2 to STP priority 100:
Related Commands
show spanningtree port
config spanningtree switch mode
config spanningtree port mode
config spanningtree port pathcost
config spanningtree switch bridgepriority
To set the bridge ID, use the config spanningtree switch bridgepriority command.
config spanningtree switch bridgepriority priority_num
Syntax Description
Command Default
Usage Guidelines
Note When the Cisco 4400 Series Wireless LAN Controller is configured for port redundancy, STP must be disabled for all ports on the controller. STP can remain enabled on the switch connected to the controller.
The value of the writable portion of the Bridge ID, that is, the first two octets of the (8 octet long) Bridge ID. The other (last) 6 octets of the Bridge ID are given by the value of Bridge MAC address. The value may be specified as a number between 0 and 65535.
Examples
This example shows how to configure spanning tree values on a per switch basis with the bridge priority 40230:
Related Commands
show spanningtree switch
config spanningtree switch forwarddelay
config spanningtree switch hellotime
config spanningtree switch maxage
config spanningtree switch mode
config spanningtree switch forwarddelay
To set the bridge timeout, use the config spanningtree switch forwarddelay command.
config spanningtree switch forwarddelay seconds
Syntax Description
Command Default
Usage Guidelines
The value that all bridges use for forwarddelay when this bridge is acting as the root. 802.1D-1990 specifies that the range for this setting is related to the value of the STP bridge maximum age. The granularity of this timer is specified by 802.1D-1990 to be 1 second. An agent may return a badValue error if a set is attempted to a value that is not a whole number of seconds. The default is 15. Valid values are 4 through 30 seconds.
Examples
This example shows how to configure spanning tree values on a per switch basis with the bridge timeout as 20 seconds:
Related Commands
config spanningtree switch bridgepriority
config spanningtree switch hellotime
config spanningtree switch maxage
config spanningtree switch mode
config switchconfig flowcontrol
config spanningtree switch hellotime
To set the hello time, use the config spanningtree switch hellotime command.
config spanningtree switch hellotime seconds
Syntax Description
Command Default
Usage Guidelines
All bridges use this value for HelloTime when this bridge is acting as the root. The granularity of this timer is specified by 802.1D- 1990 to be 1 second. Valid values are 1 through 10 seconds.
Examples
This example shows how to configure the STP hello time to 4 seconds:
Related Commands
show spanningtree switch
spanningtree switch bridgepriority
config spanningtree switch forwarddelay
config spanningtree switch maxage
config spanningtree switch mode
config spanningtree switch maxage
To set the maximum age, use the config spanningtree switch maxage command.
config spanningtree switch maxage seconds
Syntax Description
Command Default
Usage Guidelines
All bridges use this value for MaxAge when this bridge is acting as the root. 802.1D-1990 specifies that the range for this parameter is related to the value of Stp Bridge Hello Time. The granularity of this timer is specified by 802.1D-1990 to be 1 second. Valid values are 6 through 40 seconds.
Examples
This example shows how to configure the STP bridge maximum age to 30 seconds:
Related Commands
show spanningtree switch
config spanningtree switch bridgepriority
config spanningtree switch forwarddelay
config spanningtree switch hellotime
config spanningtree switch mode
config spanningtree switch mode
To turn the Cisco wireless LAN controller Spanning Tree Protocol (STP) on or off, use the config spanningtree switch mode command.
config spanningtree switch mode { enable | disable }
Syntax Description
Command Default
Usage Guidelines
Using this command allows the controller to set up STP, detect logical network loops, place redundant ports on standby, and build a network with the most efficient pathways.
Examples
This example shows how to support STP on all Cisco wireless LAN controller ports:
Related Commands
show spanningtree switch
config spanningtree switch bridgepriority
config spanningtree switch forwarddelay
config spanningtree switch hellotime
config spanningtree switch maxage
config spanningtree port mode
config switchconfig boot-break
To enable or disable the breaking into boot prompt by pressing the Esc key at system startup, use the config switchconfig boot-break command.
config switchconfig boot-break { enable | disable }
Syntax Description
Enables the breaking into boot prompt by pressing the Esc key at system startup. |
|
Disables the breaking into boot prompt by pressing the Esc key at system startup. |
Command Default
Usage Guidelines
You must enable the features that are prerequisites for the Federal Information Processing Standard (FIPS) mode before enabling or disabling the breaking into boot prompt.
Examples
This example shows how to enable the breaking into boot prompt by pressing the Esc key at system startup:
Related Commands
show switchconfig
config switchconfig flowcontrol
config switchconfig mode
config switchconfig secret-obfuscation
config switchconfig fips-prerequisite
config switchconfig strong-pwd
config switchconfig fips-prerequisite
To enable or disable the features that are prerequisites for the Federal Information Processing Standard (FIPS) mode, use the config switchconfig fips-prerequisite command.
config switchconfig fips-prerequisite { enable | disable }
Syntax Description
Enables the features that are prerequisites for the FIPS mode. |
|
Disables the features that are prerequisites for the FIPS mode. |
Command Default
Usage Guidelines
You must configure the FIPS authorization secret before you can enable or disable the FIPS prerequisite features.
Examples
This example shows how to enable the features that are prerequisites for the FIPS mode:
Related Commands
show switchconfig
config switchconfig boot-break
config switchconfig flowcontrol
config switchconfig mode
config switchconfig secret-obfuscation
config switchconfig strong-pwd
config switchconfig strong-pwd
To enable or disable your controller to check the strength of newly created passwords, use the config switchconfig strong-pwd command.
config switchconfig strong-pwd case-check | consecutive-check | default-check | username-check | all-checks { enable | disable }
Syntax Description
Checks at least three combinations: lower-case characters, upper-case characters, digits, or special characters. |
|
Command Default
Examples
This example shows how to enable the case check feature of the strong password check:
Related Commands
show switchconfig
config switchconfig boot-break
config switchconfig flowcontrol
config switchconfig mode
config switchconfig fips-prerequisite
config switchconfig secret-obfuscation
config switchconfig flowcontrol
To enable or disable 802.3x flow control, use the config switchconfig flowcontrol command.
config switchconfig flowcontrol { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable 802.3x flow control on Cisco wireless LAN controller parameters:
Related Commands
config switchconfig mode
To configure Lightweight Access Port Protocol (LWAPP) transport mode for Layer 2 or Layer 3, use the config switchconfig command.
config switchconfig mode { L2 | L3 }
Syntax Description
Command Default
Examples
This example shows how to configure LWAPP transport mode to Layer 3:
Related Commands
config switchconfig secret-obfuscation
To enable or disable secret obfuscation, use the config switchconfig secret-obfuscation command.
config switchconfig secret-obfuscation { enable | disable }
Syntax Description
Command Default
Secrets and user passwords are obfuscated in the exported XML configuration file.
Usage Guidelines
To keep the secret contents of your configuration file secure, do not disable secret obfuscation. To further enhance the security of the configuration file, enable configuration file encryption.
Examples
This example shows how to enable secret obfuscation:
Related Commands
config sysname
To set the Cisco wireless LAN controller system name, use the config sysname command.
Syntax Description
System name. The name can contain up to 31 alphanumeric characters. |
Command Default
Examples
This example shows how to configure the system named Ent_01:
Related Commands
Configure TACACS Commands
Use the config tacacs commands to configure TACACS+ settings.
config tacacs acct
To configure TACACS+ accounting server settings, use the config tacacs acct command.
config tacacs acct add {server_index ip_address port type secret_key} | delete {server_index} |
disable {server_index} | enable {server_index} | retransmit-timeout {server_index seconds}
Syntax Description
Changes the default retransmit timeout for the TACACS+ server. |
|
Command Default
Examples
This example shows how to add a new TACACS+ accounting server index 3 with the IP address 10.0.0.0, port number 10, and secret key 12345678 in ASCII:
This example shows how to change the default retransmit timeout of 30 seconds for the TACACS+ accounting server:
Related Commands
config tacacs athr
To configure TACACS+ authorization server settings, use the config tacacs athr command.
config tacacs athr add {server_index ip_address port type secret_key} | delete {server_index}|
disable {server_index} | enable {server_index} | retransmit-timeout {server_index seconds}
Syntax Description
Changes the default retransmit timeout for the TACACS+ server for network users. |
|
Command Default
Examples
This example shows how to add a new TACACS+ authorization server index 3 with the IP address 10.0.0.0, port number 4, and secret key 12345678 in ASCII:
This example shows how to change the default retransmit timeout of 30 seconds for the TACACS+ authorization server:
Related Commands
config tacacs athr mgmt-server-timeout
To configure a default TACACS+ authorization server timeout for management users, use the config tacacs athr mgmt-server-timeout command.
config tacacs athr mgmt-server-timeout index timeout
Syntax Description
Command Default
Examples
This example shows how to configure a default TACACS+ authorization server timeout for management users:
Related Commands
config tacacs auth
To configure TACACS+ authentication server settings, use the config tacacs auth command.
config tacacs auth add {server_index ip_address port type secret_key} | delete {server_index} |
disable {server_index} | enable {server_index} | retransmit-timeout {server_index seconds}
Syntax Description
(Optional) Changes the default retransmit timeout for the TACACS+ server for network users. |
|
Command Default
Examples
This example shows how to add a new TACACS+ authentication server index 2 with the IP address 10.0.0.3, port number 6, and secret key 12345678 in ASCII:
This example shows how to change the default retransmit timeout of 30 seconds for TACACS+ authentication server:
Related Commands
config tacacs auth mgmt-server-timeout
To configure a default TACACS+ authentication server timeout for management users, use the config tacacs auth mgmt-server-timeout command.
config tacacs auth mgmt-server-timeout index timeout
Syntax Description
Command Default
Examples
This example shows how to configure a default TACACS+ authentication server timeout for management users:
Related Commands
config time manual
To set the system time, use the config time manual command.
config time manual MM / DD / YY HH : MM : SS
Syntax Description
Command Default
Examples
This example shows how to configure the system date to 04/04/2010 and time to 15:29:00:
Related Commands
config time ntp
To set the Network Time Protocol (NTP), use the config time ntp command.
config time ntp { auth { enable server_index key_index | disable server_index }} | { interval seconds } | { key-auth { add key_index md5 { ascii | hex } key_value | delete key_index }} | { server server_index ip-address }
Syntax Description
Specifies the ASCII key format (a maximum of 16 characters). |
|
Specifies the hexadecimal key format (a maximum of 32 digits). |
|
Command Default
Examples
This example shows how to configure the NTP polling interval to 7000 seconds:
This example shows how to enable NTP authentication where the server index is 4 and the key index is 1:
This example shows how to add an NTP authentication key of value ff where the key format is in hexadecimal characters and the key index is 1:
This example shows how to add an NTP authentication key of value ff where the key format is in ASCII characters and the key index is 1:
Related Commands
config time timezone
To configure the system time zone, use the config time timezone command.
config time timezone { enable | disable } delta_hours delta_mins
Syntax Description
Local hour difference from the Universal Coordinated Time (UCT). |
|
Command Default
Examples
This example shows how to enable the daylight saving time:
Related Commands
config time timezone location
To set the location of the time zone in order to have daylight saving time set automatically when it occurs, use the config time timezone location command.
config time timezone location location_index
Syntax Description
Command Default
Examples
This example shows how to set the location of the time zone in order to set the daylight saving time to location index 10 automatically:
Related Commands
Configure Trap Flag Commands
Use the config trapflags commands to configure trap flags settings.
config trapflags 802.11-Security
To enable or disable sending 802.11 security-related traps, use the config trapflags 802.11-Security command.
config trapflags 802.11-Security wepDecryptError { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable the 802.11 security related traps:
Related Commands
config trapflags aaa
To enable or disable the sending of AAA server-related traps, use the config trapflags aaa command.
config trapflags aaa { auth | servers } { enable | disable }
Syntax Description
Enables trap sending when an AAA authentication failure occurs for management user, net user, or MAC filter. |
|
Command Default
Examples
This example shows how to enable the sending of AAA server-related traps:
Related Commands
config trapflags ap
To enable or disable the sending of Cisco lightweight access point traps, use the config trapflags ap command.
config trapflags ap { register | interfaceUp } { enable | disable }
Syntax Description
Enables sending a trap when a Cisco lightweight access point registers with Cisco switch. |
|
Enables sending a trap when a Cisco lightweight access point interface (A or B) comes up. |
|
Command Default
Examples
This example shows how to prevent traps from sending access point-related traps:
Related Commands
config trapflags authentication
To enable or disable sending traps with invalid SNMP access, use the config trapflags authentication command.
config trapflags authentication { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to prevent sending traps on invalid SNMP access:
Related Commands
config trapflags client
To enable or disable the sending of client-related DOT11 traps, use the config trapflags client command.
config trapflags client { 802.11-disassocate | 802.11-deauthenticate | 802.11-authfail | 802.11-assocfail | excluded } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the sending of Dot11 disassociation trap to clients:
Related Commands
config trapflags configsave
To enable or disable the sending of configuration-saved traps, use the config trapflags configsave command.
config trapflags configsave { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the sending of configuration-saved traps:
Related Commands
config trapflags IPsec
To enable or disable the sending of IPsec traps, use the config trapflags IPsec command.
config trapflags IPsec { esp-auth | esp-reply | invalidSPI | ike-neg | suite-neg | invalid-cookie } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the sending of IPsec traps when ESP authentication failure occurs:
Related Commands
config trapflags linkmode
To enable or disable Cisco wireless LAN controller level link up/down trap flags, use the config trapflags linkmode command.
config trapflags linkmode { enable | disable }
Syntax Description
Enables Cisco wireless LAN controller level link up/down trap flags. |
|
Disables Cisco wireless LAN controller level link up/down trap flags. |
Command Default
Examples
This example shows how to enable the Cisco wireless LAN controller level link up/down trap:
Related Commands
config trapflags multiusers
To enable or disable the sending of traps when multiple logins are active, use the config trapflags multiusers command.
config trapflags multiusers { enable | disable }
Syntax Description
Enables the sending of traps when multiple logins are active. |
|
Disables the sending of traps when multiple logins are active. |
Command Default
Examples
This example shows how to disable the sending of traps when multiple logins are active:
Related Commands
config trapflags rogueap
To enable or disable sending rogue access point detection traps, use the config trapflags rogueap command.
config trapflags rogueap { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable the sending of rogue access point detection traps:
Related Commands
config rogue ap classify
config rogue ap friendly
config rogue ap rldp
config rogue ap ssid
config rogue ap timeout
config rogue ap valid-client
show rogue ap clients
show rogue ap detailed
show rogue ap summary
show rogue ap friendly summary
show rogue ap malicious summary
show rogue ap unclassified summary
show trapflags
config trapflags rrm-params
To enable or disable the sending of Radio Resource Management (RRM) parameters traps, use the config trapflags rrm-params command.
config trapflags rrm-params { tx-power | channel | antenna } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the sending of RRM parameter-related traps:
Related Commands
config trapflags rrm-profile
To enable or disable the sending of Radio Resource Management (RRM) profile-related traps, use the config trapflags rrm-profile command.
config trapflags rrm-profile { load | noise | interference | coverage } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable the sending of RRM profile-related traps:
Related Commands
config trapflags stpmode
To enable or disable the sending of spanning tree traps, use the config trapflags stpmode command.
config trapflags stpmode { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable the sending of spanning tree traps:
Related Commands
config trapflags wps
To enable or disable Wireless Protection System (WPS) trap sending, use the config trapflags wps command.
config trapflags wps { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to disable the WPS traps sending:
Related Commands
config wgb vlan
To configure WGB VLAN client support, use the config wgb vlan command.
config wgb vlan { enable | disable }
Syntax Description
Enables wired clients behind a WGB to connect to an anchor controller in a DMZ. |
|
Disables wired clients behind a WGB from connecting to an anchor controller in a DMZ. |
Command Default
Examples
This example shows how to enable WGB VLAN client support:
Configure Wireless LAN Commands
Use the config wlan commands to configure wireless LAN command settings.
config wlan
To create, delete, enable, or disable a wireless LAN, use the config wlan command.
config wlan { enable | disable | create | delete } wlan_id [ name | foreignAp name ssid | all ]
Syntax Description
(Optional) WLAN profile name up to 32 alphanumeric characters. |
|
Command Default
Usage Guidelines
When you create a new WLAN using the config wlan create command, it is created in disabled mode. Leave it disabled until you have finished configuring it.
If you do not specify an SSID, the profile name parameter is used for both the profile name and the SSID.
If the management and AP-manager interfaces are mapped to the same port and are members of the same VLAN, you must disable the WLAN before making a port-mapping change to either interface. If the management and AP-manager interfaces are assigned to different VLANs, you do not need to disable the WLAN.
An error message appears if you try to delete a WLAN that is assigned to an access point group. If you proceed, the WLAN is removed from the access point group and from the access point’s radio.
Examples
This example shows how to enable wireless LAN identifier 16:
Related Commands
config wlan 7920-support
To configure support for phones, use the config wlan 7920-support command.
config wlan 7920-support { client-cac-limit | ap-cac-limit } { enable | disable } wlan_id
Syntax Description
Command Default
Usage Guidelines
You cannot enable both WMM mode and client-controlled CAC mode on the same WLAN.
Examples
This example shows how to enable the phone support that requires client-controlled CAC with wireless LAN ID 8:
Related Commands
config wlan 802.11e
To configure 802.11e support on a wireless LAN, use the config wlan 802.11e command.
config wlan 802.11e { allow | disable | require } wlan_id
Syntax Description
Command Default
Usage Guidelines
802.11e provides quality of service (QoS) support for LAN applications, which are critical for delay sensitive applications such as Voice over Wireless IP (VoWIP).
802.11e enhances the 802.11 Media Access Control layer (MAC layer) with a coordinated time division multiple access (TDMA) construct, and adds error-correcting mechanisms for delay sensitive applications such as voice and video. The 802.11e specification provides seamless interoperability and is especially well suited for use in networks that include a multimedia capability.
Examples
This example shows how to allow 802.11e on the wireless LAN with LAN ID 1:
Related Commands
config wlan aaa-override
To configure a user policy override via AAA on a wireless LAN, use the config wlan aaa-override command.
config wlan aaa-override { enable | disable } { wlan_id | foreignAp }
Syntax Description
Command Default
Usage Guidelines
When AAA override is enabled, and a client has conflicting AAA and Cisco wireless LAN controller wireless LAN authentication parameters, client authentication is performed by the AAA server. As part of this authentication, the operating system will move clients from the default Cisco wireless LAN VLAN to a VLAN returned by the AAA server and predefined in the controller interface configuration (only when configured for MAC filtering, 802.1X, and/or WPA operation). In all cases, the operating system will also use QoS, DSCP, 802.1p priority tag values, and ACLs provided by the AAA server, as long as they are predefined in the controller interface configuration. (This VLAN switching by AAA override is also referred to as Identity Networking.)
If the corporate wireless LAN primarily uses a management interface assigned to VLAN 2, and if AAA override returns a redirect to VLAN 100, the operating system redirects all client transmissions to VLAN 100, regardless of the physical port to which VLAN 100 is assigned.
When AAA override is disabled, all client authentication defaults to the controller authentication parameter settings, and authentication is performed by the AAA server if the controller wireless LAN does not contain any client-specific authentication parameters.
The AAA override values may come from a RADIUS server, for example.
Examples
This example shows how to configure user policy override via AAA on wireless LAN ID 1:
Related Commands
config wlan acl
To configure a wireless LAN access control list (ACL), use the config wlan acl command.
config wlan acl wlan_id [acl_name | none]
Syntax Description
(Optional) Clears the ACL settings for the specified wireless LAN. |
Command Default
Examples
This example shows how to configure a WLAN access control list with WLAN ID 1 and ACL named office_1:
Related Commands
config wlan apgroup
To manage access point group VLAN features, use the config wlan apgroup command.
config wlan apgroup { add apgroup_name wlan_id [ interface_name | interface_group_name] |
delete apgroup_name |
description apgroup_name description |
interface-mapping { add | delete } apgroup_name wlan_id interface_name |
nac-snmp { enable | disable } apgroup_name wlan_id
profile-mapping { add | delete } apgroup_name
venue { add | delete } apgroup_name
wlan-radio-policy apgroup_name wlan-id { 802.11a-only | 802.11bg | 802.11g-only | all }}
Syntax Description
Command Default
Usage Guidelines
An error message appears if you try to delete an access point group that is used by at least one access point. Before you can delete an AP group in controller software release 6.0, move all APs in this group to another group. The access points are not moved to the default-group access point group as in previous releases. To see the APs, enter the show wlan apgroups command. To move APs, enter the config ap group-name groupname cisco_ap command.
Examples
This example shows how to enable the NAC out-of band support on access point group 4:
Related Commands
config wlan broadcast-ssid
To configure an Service Set Identifier (SSID) broadcast on a wireless LAN, use the config wlan broadcast-ssid command.
config wlan broadcast-ssid { enable | disable } wlan_id
Syntax Description
Command Default
Examples
This example shows how to configure an SSID broadcast on wireless LAN ID 1:
Related Commands
config wlan call-snoop
To enable or disable Voice-over-IP (VoIP) snooping for a particular WLAN, use the config wlan call-snoop command.
config wlan call-snoop { enable | disable } wlan_id
Syntax Description
Command Default
Usage Guidelines
WLAN should be with Platinum QoS and it needs to be disabled while invoking this CLI
Examples
This example shows how to enable VoIP snooping for WLAN 3:
Related Commands
show wlan
show call-control ap
show call-control client
config wlan
config wlan chd
To enable or disable Coverage Hole Detection (CHD) for a wireless LAN, use the config wlan chd command.
config wlan chd wlan_id { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable CHD for WLAN 3:
Related Commands
config wlan ccx aironet-ie
To enable or disable Aironet information elements (IEs) for a WLAN, use the config wlan ccx aironet-ie command.
config wlan ccx aironet-ie { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable Aironet information elements for a WLAN:
Related Commands
config wlan channel-scan defer-priority
To configure the controller to defer priority markings for packets that can defer off channel scanning, use the config wlan channel-scan defer-priority command.
config wlan channel-scan defer-priority priority [ enable | disable ] wlan_id
Syntax Description
(Optional) Enables packet at given priority to defer off channel scanning. |
|
(Optional) Disables packet at gven priority to defer off channel scanning. |
|
Command Default
Usage Guidelines
The priority value should be set to 6 on the client and on the WLAN.
Examples
This example shows how to enable the controller to defer priority markings that can defer off channel scanning with user priority value 6 and WLAN id 30:
Related Commands
config wlan
config wlan channel-scan defer-time
show client detail
config wlan channel-scan defer-time
To assign the channel scan defer time in milliseconds, use the config wlan channel-scan defer-time command.
config wlan channel-scan defer-time msecs wlan_id
Syntax Description
Command Default
Usage Guidelines
The time value in milliseconds should match the requirements of the equipment on your wlan.
Examples
This example shows how to assign the scan defer time to 40 milliseconds for WLAN id 50:
Related Commands
config wlan
config wlan channel-scan defer-priority
show client detail
config wlan dhcp_server
To configure the internal DHCP server for a wireless LAN, use the config wlan dhcp_server command.
config wlan dhcp_server { wlan_id | foreignAp } ip_address [ required ]
Syntax Description
IP address of the internal DHCP server (this parameter is required). |
|
(Optional) Specifies whether DHCP address assignment is required. |
Command Default
Usage Guidelines
The preferred method for configuring DHCP is to use the primary DHCP address assigned to a particular interface instead of the DHCP server override. If you enable the override, you can use the show wlan command to verify that the DHCP server has been assigned to the WLAN.
Examples
This example shows how to configure an IP address 10.10.2.1 of the internal DHCP server for wireless LAN ID 16:
Related Commands
config dhcp
config dhcp proxy
config interface dhcp
debug dhcp
debug dhcp service-port
debug disable-all
show dhcp
show dhcp proxy
config wlan diag-channel
To enable the diagnostic channel troubleshooting on a particular WLAN, use the config wlan diag-channel command.
config wlan diag-channel [ enable | disable ] wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable the wireless LAN diagnostic channel for WLAN ID 1:
Related Commands
config wlan dtim
To configure a Delivery Traffic Indicator Message (DTIM) for 802.11 radio network config wlan dtim command.
config wlan dtim { 802.11a | 802.11b } dtim wlan_id
Syntax Description
Command Default
Examples
This example shows how to configure DTIM for 802.11a radio network with DTIM value 128 and WLAN ID 1:
Related Commands
config wlan exclusionlist
To configure the wireless LAN exclusion list, use the config wlan exclusionlist command.
config wlan exclusionlist { wlan_id [ enabled | disabled | time ] |
foreignAp [ enabled | disabled | time ]}
Syntax Description
Command Default
Usage Guidelines
Examples
This example shows how to enable the exclusion list for WLAN ID 1:
Related Commands
show wlan
show wlan summary
config wlan flexconnect ap-auth
To configure local authentication of clients associated with FlexConnect on a locally switched WLAN, use the config wlan flexconnect ap-auth command.
config wlan flexconnect ap-auth wlan_id { enable | disable }
Syntax Description
Configures local authentication of clients associated with an FlexConnect on a locally switched WLAN. |
|
Command Default
Usage Guidelines
Local switching must be enabled on the WLAN where you want to configure local authentication of clients associated with FlexConnect.
Examples
This example shows how to enable authentication of clients associated with FlexConnect on a specified WLAN:
Related Commands
config wlan flexconnect learn-ipaddr
To enable or disable client IP address learning for the Cisco WLAN controller, use the config wlan flexconnect learn-ipaddr command.
config wlan flexconnect learn-ipaddr wlan_id { enable | disable }
Syntax Description
Command Default
Disabled when the config wlan flexconnect local-switching command is disabled.
Enabled when the config wlan flexconnect local-switching command is enabled.
Usage Guidelines
If the client is configured with Layer 2 encryption, the controller cannot learn the client IP address, and the controller will periodically drop the client. Disable this option to keep the client connection without waiting to learn the client IP address.
Note The ability to disable IP address learning is not supported with FlexConnect central switching.
Examples
This example shows how to disable client IP address learning for WLAN 6:
Related Commands
config wlan flexconnect local-switching
To configure the WLAN for local switching, use the config wlan flexconnect local switching command.
config wlan flexconnect local-switching { enable | disable } wlan_id
Syntax Description
Command Default
Usage Guidelines
When you enable the config wlan flexconnect local-switching command, the config wlan flexconnect learn-ipaddr command is enabled by default.
Note The ability to disable IP address learning is not supported with FlexConnect central switching.
Examples
This example shows how to enable WLAN 6 for local switching:
Related Commands
config wlan flexconnect learn-ipaddr
config wlan flexconnect ap-auth
show wlan
config wlan interface
To configure a wireless LAN interface or an interface group, use the config wlan interface command.
config wlan interface { wlan_id | foreignAp } interface-name | interface-group-name
Syntax Description
Command Default
Examples
This example shows how to configure an interface named VLAN901:
Related Commands
config wlan ipv6 acl
To configure IPv6 access control list (ACL) on a wireless LAN, use the config wlan ipv6 acl command.
config wlan ipv6 acl wlan_id acl_name
Syntax Description
Command Default
Examples
This example shows how to configure an IPv6 ACL for local switching:
Related Commands
config wlan kts-cac
To configure the Key Telephone System-based CAC policy for a WLAN, use the config wlan kts-cac command.
config wlan kts-cac { enable | disable } wlan_id
Syntax Description
Command Default
Usage Guidelines
To enable the KTS-based CAC policy for a WLAN, ensure that you do the following:
Examples
This example shows how to enable the KTS-based CAC policy for a WLAN with the ID 4:
Related Commands
config wlan
config wlan qos
config wlan flexconnect local-switching
config wlan wmm
config 802.11a cac voice
config wlan ldap
To add or delete a link to a configured Lightweight Directory Access Protocol (LDAP) server, use the config wlan ldap command.
config wlan ldap { add wlan_id server_id | delete wlan_id { all | server_id }}
Syntax Description
Command Default
Usage Guidelines
Use this command to specify the LDAP server priority for the WLAN.
To specify the LDAP server priority, one of the following must be configured and enabled:
Note Local EAP was introduced in controller software release 4.1; LDAP support on Web authentication was introduced in controller software release 4.2.
Examples
This example shows how to add a link to a configured LDAP server with the WLAN ID 100 and server ID 4:
Related Commands
config wlan load-balance
To override the global load balance configuration and enable or disable load balancing on a particular WLAN, use the config wlan load-balance command.
config wlan load-balance allow { enable | disable } wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable band selection on a wireless LAN with WLAN ID 3:
Related Commands
config wlan mac-filtering
To change the state of MAC filtering on a wireless LAN, use the config wlan mac-filtering command.
config wlan mac-filtering { enable | disable } { wlan_id | foreignAp }
Syntax Description
Command Default
Examples
This example shows how to enable the MAC filtering on WLAN ID 1:
Related Commands
config wlan max-associated-clients
To configure the maximum number of client connections on a wireless LAN, guest LAN, or remote LAN, use the config wlan max-associated-clients command.
config wlan max-associated-clients max_clients wlan_id
Syntax Description
Specifies the maximum number of client connections to be accepted. |
|
Command Default
Examples
This example shows how to specify the maximum number of client connections on WLAN ID 2:
Related Commands
config wlan max-radio-clients
To configure the maximum number of WLAN client per access point, use the config wlan max-radio-clients command.
config wlan max-radio-clients max_radio_clients wlan_id
Syntax Description
Specifies the maximum number of client connections to be accepted per access point radio. The valid range is from 1 to 200. |
|
Command Default
Examples
This example shows how to specify the maximum number of client connections per access point radio on WLAN ID 2:
Related Commands
config wlan media-stream
To configure multicast-direct for a wireless LAN media stream, use the config wlan media-stream command.
config wlan media-stream multicast-direct { wlan_id | all} {enable | disable}
Syntax Description
Command Default
Usage Guidelines
Media stream multicast-direct requires load based Call Admission Control (CAC) to run. WLAN quality of service (QoS) needs to be set to either gold or platinum.
Examples
This example shows how to enable the global multicast-direct media stream with WLAN ID 2:
Related Commands
config wlan mfp
To configure management frame protection (MFP) options for the wireless LAN, use the config wlan mfp command.
config wlan mfp {client [enable | disable] wlan_id |
infrastructure protection [enable | disable] wlan_id}
Syntax Description
(Optional) Configures the infrastructure MFP for the wireless LAN. |
Command Default
Examples
This example shows how to configure client management frame protection for WLAN ID 1:
Related Commands
config wlan mobile-concierge dot11u
To enable or disable 802.11u on a WLAN, use the config wlan mobile-concierge dot11u command.
config wlan mobile-concierge dot11u
{3gpp-info {add index country_code network_code wlan_id | delete index wlan_id }
disable wlan_id
domain {add wlan_id domain-index domain-name | delete wlan_id | modify wlan_id domain-index domain-name }
enable wlan_id
hessid hess_id wlan_id
ip-addr-type {add ipv4_type ipv6_type wlan_id | delete wlan_id }
net-auth-type network_auth_type_value wlan_id
oui {add wlan_id | delete wlan_id | modify wlan_id oui-index oui-name is-beacon }
params wlan_id network-type internet-bit
realm {add | delete | modify}}
Syntax Description
Command Default
Examples
This example shows how to configure client management frame protection for WLAN ID 1:
Related Commands
config wlan mobile-concierge dot11u realm
config wlan mobile-concierge dot11u realm
To configure realms for your 802.11u enabled WLANs, use the config wlan mobile-concierge dot11u realm command.
config wlan mobile-concierge dot11u realm { add |delete | modify} [auth-method | eap-method | realm-name] wlan_id realm-index eap-index auth-index auth-method auth-parameter
Syntax Description
Authentication method to be used. The range is 1-4. The following options are available: |
|
Authentication parameter to use. This value depends on the auth-method used. |
Command Default
Examples
This example shows how to add a new realm with EAP-Method and inner authentication type as EAP-TLS for WLAN ID 3:
Related Commands
config wlan mobile-concierge hotspot2
config wlan mobile-concierge hotspot2
To configure the hotspot2 parameters, use the config wlan mobile-concierge hotspot2 command.
config wlan mobile-concierge hotspot2 {
disable |
enable |
operator-name { add wlan_id index operator_name language-code | delete wlan_id index-name | modify wlan_id index operator-name language-code } |
port-config { add wlan_id index ip-protocol port-number status | delete wlan_id port-config-index | modify wlan_id port-config-index ip-protocol port-number status }|
wan-metrics { add wlan_id link-status symet-link downlink-speed uplink-speed | delete wlan_id }}
Syntax Description
Examples
The following command configures the wan-metrics parameters.
Related Commands
config wlan mobile-concierge msap
To configure the Mobility Service Advertisment Protocol (MSAP) parameters on a WLAN, use the config wlan mobile-concierge msap command.
config wlan mobile-concierge msap { disable | enable | server-id server-id } wlan-id
Syntax Description
Command Default
Examples
This example show how to configure an MSAP server ID for WLAN 331.
Related Commands
config wlan mobility anchor
To change the state of MAC filtering on a wireless LAN, use the config wlan mobility anchor command.
config wlan mobility anchor { add | delete } wlan_id ip_address
Syntax Description
Command Default
Examples
This example shows how to configure the mobility wireless LAN anchor list with WLAN ID 4 and IP address 192.168.0.14:6:
Related Commands
config guest-lan mobility anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config wlan mobility foreign-map
config wlan mobility foreign-map
To configure interfaces or interface groups for foreign controllers, use the config wlan mobility foreign-map command.
config wlan mobility foreign-map { add | delete } wlan_id foreign_mac_address {interface_name | interface_group_name}
Syntax Description
Adds an interface or interface group to the map of foreign controllers. |
|
Deletes an interface or interface group from the map of foreign controllers. |
|
Command Default
Examples
This example shows how to add an interface group for foreign controllers with WLAN ID 4 and a foreign switch MAC address on WLAN 00:21:1b:ea:36:60:
Related Commands
show mobility foreign-map
config mobility group member
config wlan mobility anchor
debug mobility
show mobility anchor
show mobility summary
config wlan multicast buffer
To configure the radio multicast packet buffer size, use the config wlan multicast buffer command.
config wlan multicast buffer {enable | disable} buffer-size wlan_id
Syntax Description
Radio multicast packet buffer size. The range is from 30 to 60. Enter 0 to indicate APs will dynamically adjust the number of buffers allocated for multicast. |
|
Command Default
Examples
This example shows how to configure radio multicast buffer settings:
Related Commands
config wlan multicast interface
To configure a multicast interface for a wireless LAN, use the config wlan multicast interface command.
config wlan multicast interface wlan_id { enable | disable } interface_name
Syntax Description
Note The interface name can only be specified in lower case characters. |
Command Default
Examples
This example shows how to enable the multicast interface feature for a wireless LAN with WLAN ID 4 and interface name myinterface1:
Related Commands
config guest-lan mobility anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
debug mobility
show mobility anchor
show mobility statistics
show mobility summary
config wlan mobility foreign-map
config wlan nac
To enable or disable Network Admission Control (NAC) out-of-band support for a WLAN, use the config wlan nac command.
config wlan nac { snmp | radius } { enable | disable } wlan_id
Syntax Description
Command Default
Usage Guidelines
You should enable AAA override before you enable the Radius NAC state. You also should disable FlexConnect local switching before you enable the Radius NAC state.
Examples
This example shows how to configure SNMP NAC support for WLAN 13:
This example shows how to configure RADIUS NAC support for WLAN 34:
Related Commands
show nac statistics
show nac summary
config guest-lan nac
debug nac
config wlan passive-client
To configure passive-client feature on a wireless LAN, use the config wlan passive-client command.
config wlan passive-client {enable | disable} wlan_id
Syntax Description
Command Default
Usage Guidelines
You need to enable the global multicast mode and multicast-multicast mode by using the config network multicast global and config network multicast mode commands before entering this command.
Note You should configure the multicast in multicast-multicast mode only not in unicast mode. The passive client feature does not work with multicast-unicast mode in this release.
Examples
This example shows how to configure the passive client on wireless LAN ID 2:
Related Commands
config wlan
config wlan
config network multicast global
config network multicast mode multicast
show wlan
config wlan peer-blocking
To configure peer-to-peer blocking on a WLAN, use the config wlan peer-blocking command.
config wlan peer-blocking { disable | drop | forward-upstream } wlan_id
Syntax Description
Command Default
Examples
This example shows how to disable the peer-to-peer blocking for WLAN ID 1:
Related Commands
config wlan profiling
To configure profiling of a client on a WLAN, use the config wlan profiling command.
config wlan profiling radius { enable | disable } wlan_id
Syntax Description
Command Default
Usage Guidelines
Ensure that you have disabled the WLAN before configuring client profiling on the WLAN.
Examples
This example shows how to enable profiling of a client on WLAN ID 1:
Related Commands
config wlan qos
To change the quality of service for a wireless LAN, use the config wlan qos command.
config wlan qos wlan_id { bronze | silver | gold | platinum }
config wlan qos foreignAp { bronze | silver | gold | platinum }
Syntax Description
Command Default
Examples
This example shows how to set the highest level of service on wireless LAN 1:
Related Commands
config wlan radio
To set the Cisco radio policy on a wireless LAN, use the config wlan radio command.
config wlan radio wlan_id { all | 802.11a | 802.11b g | 802.11g | 802.11ag }
Syntax Description
Configures the wireless LAN on only 802.11b/g (only 802.11b if 802.11g is disabled). |
|
Command Default
Examples
This example shows how to configure the wireless LAN on all radio bands:
Related Commands
config 802.11a enable
config 802.11a disable
config 802.11b enable
config 802.11b disable
config 802.11b 11gSupport enable
config 802.11b 11gSupport disable
show wlan
config wlan radius_server acct
To configure RADIUS accounting servers of a WLAN, use the config wlan radius_server acct command.
config wlan radius_server acct { enable | disable } wlan_id | { add wlan_id server_id | delete wlan_id { all | server_id }}
Syntax Description
Command Default
Examples
This example shows how to enable RADIUS accounting for the WLAN 2:
This example shows how to add a link to a configured RADIUS accounting server:
Related Commands
config 802.11a enable
config 802.11a disable
config 802.11b enable
config 802.11b disable
config 802.11b 11gSupport enable
config 802.11b 11gSupport disable
show wlan
config wlan radius_server acct interim-update
To configure the interim update of a RADIUS accounting server of a WLAN, use the config wlan radius_server acct interim-update command.
config wlan radius_server acct interim-update { interval | enable | disable } wlan_id
Syntax Description
Command Default
Examples
This example shows how to specify an interim update of 200 seconds to a RADIUS accounting server of WLAN 2:
Related Commands
config 802.11a enable
config 802.11a disable
config 802.11b enable
config 802.11b disable
config 802.11b 11gSupport enable
config 802.11b 11gSupport disable
show wlan
config wlan radius_server auth
To configure RADIUS authentication servers of a WLAN, use the config wlan radius_server auth command.
config wlan radius_server auth { enable wlan_id | disable wlan_id } { add wlan_id server_id | delete wlan_id { all | server_id }}
Syntax Description
Command Default
Examples
This example shows how to add a link to a configured RADIUS authentication server with WLAN ID 1 and Server ID 1:
Related Commands
config 802.11a enable
config 802.11a disable
config 802.11b enable
config 802.11b disable
config 802.11b 11gSupport enable
config 802.11b 11gSupport disable
show wlan
config wlan radius_server acct interim-update
To configure a wireless LAN’s RADIUS servers, use the config wlan radius_server acct interim-update command.
config wlan radius_server acct interim-update { enable wlan_id | disable wlan_id }{ interval wlan_id }
Syntax Description
Command Default
Usage Guidelines
This command helps to set some time as a default if the timeout interval is not specified.
Examples
This example shows how to force the 10 minutes as the default, if timeout interval is not specified:
Related Commands
config 802.11a enable
config 802.11a disable
config 802.11b enable
config 802.11b disable
config 802.11b 11gSupport enable
config 802.11b 11gSupport disable
show wlan
config wlan radius_server overwrite-interface
To configure a wireless LAN’s RADIUS dynamic interface, use the config wlan radius_server overwrite-interface command.
config wlan radius_server overwrite-interface { enable | disable } wlan_id
Syntax Description
Command Default
Usage Guidelines
The controller uses the management interface as identity. If the RADIUS server is on a directly connected dynamic interface, the traffic is sourced from the dynamic interface. Otherwise, the management IP address is used.
If the feature is enabled, controller uses the interface specified on the WLAN configuration as identity and source for all RADIUS related traffic on the WLAN.
Examples
This example shows how to enable RADIUS dynamic interface for a WLAN with an ID 1:
Related Commands
config 802.11a enable
config 802.11a disable
config 802.11b enable
config 802.11b disable
config 802.11b 11gSupport enable
config 802.11b 11gSupport disable
show wlan
config wlan roamed-voice-client re-anchor
To configure a roamed voice client’s reanchor policy, use the config wlan roamed-voice-client re-anchor command.
config wlan roamed-voice-client re-anchor { enable | disable } wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable a roamed voice client’s reanchor policy where WLAN ID is 1:
Related Commands
config wlan sip-cac disassoc-client
To enable client disassociation in case of session initiation protocol (SIP) call admission control (CAC) failure, use the config wlan sip-cac disassoc-client command:
config wlan sip-cac disassoc-client { enable | disable } wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable a client disassociation on a SIP CAC failure where the WLAN ID is 1:
Related Commands
config wlan sip-cac send-486busy
To configure sending session initiation protocol (SIP) 486 busy message if a SIP call admission control (CAC) failure occurs, use the config wlan sip-cac send-486busy command:
config wlan sip-cac send-486busy { enable | disable } wlan_id
Syntax Description
Enables sending a SIP 486 busy message upon a SIP CAC failure. |
|
Disables sending a SIP 486 busy message upon a SIP CAC failure. |
|
Command Default
Examples
This example shows how to enable sending a SIP 486 busy message upon a SIP CAC failure where the WLAN ID is 1:
Related Commands
config wlan static-ip tunneling
To configure static IP client tunneling support on a WLAN, use the config wlan static-ip tunneling command.
config wlan static-ip tunneling {enable | disable} wlan-id
Syntax Description
Command Default
Examples
This example shows how to enable static IP client tunneling support for WLAN ID 3:
Related Commands
Configure Wireless LAN Security Commands
Use the config wlan security commands to configure wireless LAN security settings.
config wlan security 802.1X
To change the state of 802.1X security on the wireless LAN Cisco radios, use the config wlan security 802.1X command.
config wlan security 802.1X { enable { wlan_id | foreignAp } | disable { wlan_id | foreignAp } |
encryption { wlan_id | foreignAp } { 0 | 40 | 104 }}
Syntax Description
Command Default
Usage Guidelines
To change the encryption level of 802.1X security on the wireless LAN Cisco radios, use the following key sizes:
Examples
This example shows how to configure 802.1X security on WLAN ID 16:
Related Commands
config wlan security ckip
To configure Cisco Key Integrity Protocol (CKIP) security options for the wireless LAN, use the config wlan security ckip command.
config wlan security ckip { enable | disable } wlan_id
[ akm psk set-key { hex | ascii }{ 40 | 104 } key key_index wlan_id |
mmh-mic { enable | disable } wlan_id |
kp { enable | disable } wlan_id ]
Syntax Description
Command Default
Examples
This example shows how to configure a CKIP WLAN encryption key of 104 bits (26 hexadecimal characters) for PSK key index 2 on WLAN 03:
Related Commands
config wlan security cond-web-redir
To enable or disable conditional web redirect, use the config wlan security cond-web-redir command.
config wlan security cond-web-redir { enable | disable } wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable the conditional web direct on WLAN ID 2:
Related Commands
config wlan security eap-passthru
To configure the 802.1X frames pass through on to the external authenticator, use the config wlan security eap-passthru command.
config wlan security eap-passthru { enable | disable } wlan_id
Syntax Description
Enables 802.1X frames pass through to external authenticator. |
|
Disables 802.1X frames pass through to external authenticator. |
|
Command Default
Examples
This example shows how to enable the 802.1X frames pass through to external authenticator on WLAN ID 2:
Related Commands
config wlan security ft
To configure 802.11r fast transition parameters, use the config wlan security ft command.
config wlan security ft { enable | disable | { reassociation-timeout timeout-in-seconds }} wlan_id
Syntax Description
Reassociation timeout value in seconds. The valid range is 1 to 100 seconds. |
|
Command Default
Usage Guidelines
Examples
This example shows how to enable 802.11r fast transition roaming support on WLAN ID 2:
This example shows how to set the reassociation timeout value of 20 seconds for 802.11r fast transition roaming support on WLAN ID 2:
Related Commands
config wlan security ft over-the-ds
To configure 802.11r fast transition parameters over a distributed system, use the config wlan security ft over-the-ds command.
config wlan security ft over-the-ds { enable | disable } wlan_id
Syntax Description
Enables 802.11r fast transition roaming support over a distributed system. |
|
Disables 802.11r fast transition roaming support over a distributed system. |
|
Command Default
Usage Guidelines
Examples
This example shows how to enable 802.11r fast transition roaming support over a distributed system on WLAN ID 2:
Related Commands
config wlan security IPsec disable
To disable IPsec security, use the config wlan security IPsec disable command.
config wlan security IPsec disable { wlan_id | foreignAp }
Syntax Description
Command Default
Examples
This example shows how to disable the IPsec for WLAN ID 16:
Related Commands
config wlan security IPsec enable
To enable IPsec security, use the config wlan security IPsec enable command.
config wlan security IPsec enable { wlan_id | foreignAp }
Syntax Description
Command Default
Examples
This example shows how to enable the IPsec for WLAN ID 16:
Related Commands
config wlan security IPsec authentication
To modify the IPsec security authentication protocol used on the wireless LAN, use the config wlan security IPsec authentication command.
config wlan security IPsec authentication { hmac-md5 | hmac-sha-1 } { wlan_id | foreignAp }
Syntax Description
Command Default
Examples
This example shows how to configure the IPsec HMAC-SHA-1 security authentication parameter for WLAN ID 1:
Related Commands
config wlan security IPsec encryption
To modify the IPsec security encryption protocol used on the wireless LAN, use the config wlan security IPsec encryption command.
config wlan security IPsec encryption { 3des | aes | des } { wlan_id | foreignAp }
Syntax Description
Command Default
Examples
This example shows how to configure the IPsec aes encryption:
Related Commands
config wlan security IPsec config
To configure the propriety Internet Key Exchange (IKE) CFG-Mode parameters used on the wireless LAN, use the config wlan security IPsec config command.
config wlan security IPsec config qotd ip_address { wlan_id | foreignAp }
Syntax Description
Command Default
Usage Guidelines
IKE is used as a method of distributing the session keys (encryption and authentication), as well as providing a way for the VPN endpoints to agree on how the data should be protected. IKE keeps track of connections by assigning a bundle of Security Associations (SAs), to each connection.
Examples
This example shows how to configure the quote-of-the-day server IP 44.55.66.77 for cfg-mode for WLAN 1:
Related Commands
config wlan security IPsec ike authentication
To modify the IPsec Internet Key Exchange (IKE) authentication protocol used on the wireless LAN, use the config wlan security IPsec ike authentication command.
config wlan security IPsec ike authentication { certificates { wlan_id | foreignAp } | pre-share-key { wlan_id | foreignAp } key | xauth-psk { wlan_id | foreignAp } key }
Syntax Description
Command Default
Examples
This example shows how to configure the IKE certification mode:
Related Commands
config wlan security IPsec ike dh-group
To modify the IPsec Internet Key Exchange (IKE) Diffie Hellman group used on the wireless LAN, use the config wlan security IPsec ike dh-group command.
config wlan security IPsec ike dh-group { wlan_id | foreignAp } { group-1 | group-2 | group-5 }
Syntax Description
Command Default
Examples
This example shows how to configure the Diffe Hellman group parameter for group-1:
Related Commands
config wlan security IPsec ike lifetime
To modify the IPsec Internet Key Exchange (IKE) lifetime used on the wireless LAN, use the config wlan security IPsec ike lifetime command.
config wlan security IPsec ike lifetime { wlan_id | foreignAp } seconds
Syntax Description
Command Default
Examples
This example shows how to configure the IPsec IKE lifetime use on the wireless LAN:
Related Commands
config wlan security IPsec ike phase1
To modify IPsec Internet Key Exchange (IKE) Phase 1 used on the wireless LAN, use the config wlan security IPsec ike phase1 command.
config wlan security IPsec ike phase1 { aggressive | main } { wlan_id | foreignAp }
Syntax Description
Command Default
Examples
This example shows how to modify IPsec IKE Phase 1:
Related Commands
config wlan security IPsec ike contivity
To modify Nortel’s Contivity VPN client support on the wireless LAN, use the config wlan security IPsec ike contivity command.
config wlan security IPsec ike contivity { enable | disable } { wlan_id | foreignAp }
Syntax Description
Command Default
Examples
This example shows how to modify Contivity VPN client support:
Related Commands
config wlan security passthru
To modify the IPsec pass-through used on the wireless LAN, use the config wlan security passthru command.
config wlan security passthru { enable | disable } { wlan_id | foreignAp } [ ip_address ]
Syntax Description
(Optional) IP address of the IPsec gateway (router) that is terminating the VPN tunnel. |
Command Default
Examples
This example shows how to modify IPsec pass-through used on the wireless LAN:
Related Commands
config wlan security splash-page-web-redir
To enable or disable splash page web redirect, use the config wlan security splash-page-web-redir command.
config wlan security splash-page-web-redir { enable | disable } wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable spash page web redirect:
Related Commands
config wlan security static-wep-key authentication
To configure static Wired Equivalent Privacy (WEP) key 802.11 authentication on a wireless LAN, use the config wlan security static-wep-key authentication command.
config wlan security static-wep-key authentication { shared-key | open } wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable the static WEP shared key authentication for WLAN ID 1:
Related Commands
config wlan security static-wep-key disable
To disable the use of static Wired Equivalent Privacy (WEP) keys, use the config wlan security static-wep-key disable command.
config wlan security static-wep-key disable wlan_id
Syntax Description
Command Default
Examples
This example shows how to disable the static WEP keys for WLAN ID 1:
Related Commands
config wlan security static-wep-key enable
To enable the use of static Wired Equivalent Privacy (WEP) keys, use the config wlan security static-wep-key enable command.
config wlan security static-wep-key enable wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable the use of static WEK keys for WLAN ID 1:
Related Commands
config wlan security static-wep-key encryption
To configure the static Wired Equivalent Privacy (WEP) keys and indexes, use the config wlan security static-wep-key encryption command.
config wlan security static-wep-key encryption wlan_id { 40 | 104 } { hex | ascii } key key-index
Syntax Description
Command Default
Usage Guidelines
One unique WEP key index can be applied to each wireless LAN. Because there are only four WEP key indexes, only four wireless LANs can be configured for static WEP Layer 2 encryption.
Examples
This example shows how to configure the static WEP keys for WLAN ID 1 that uses hexadecimal character 0201702001 and key index 2:
Related Commands
config wlan security web-auth
To change the status of web authentication used on wireless LAN, use the config wlan security web-auth command.
config wlan security web-auth {{ acl | enable | disable } { wlan_id | foreignAp } [ ipv4_acl_name | none ]} | { on-macfilter-failure wlan_id} | { server-precedence wlan_id [local | ldap | radius]} | { flexacl wlan_id [ ipv4_acl_name | none ] } | { ipv6 acl wlan_id [ ipv6_acl_name | none ] }
Syntax Description
Configures the authentication server precedence order for Web-Auth users. |
|
Command Default
Examples
This example shows how to configure the security policy for WLAN ID 1 and an acl named ACL03:
Related Commands
config wlan security web-passthrough acl
To add an access control list (ACL) to the wireless LAN definition, use the config wlan security web-passthrough acl command.
config wlan security web-passthrough acl { wlan_id | foreignAp } { acl_name | none }
Syntax Description
Command Default
Examples
This example shows how to add an ACL to the wireless LAN definition:
Related Commands
config wlan security web-passthrough disable
To disable a web captive portal with no authentication required on a wireless LAN, use the config wlan security web-passthrough disable command.
config wlan security web-passthrough disable { wlan_id | foreignAp }
Syntax Description
Command Default
Examples
This example shows how to disable a web captive portal with no authentication required on wireless LAN ID 1:
Related Commands
config wlan security web-passthrough email-input
To configure a web captive portal using an e-mail address, use the config wlan security web-passthrough email-input command.
config wlan security web-passthrough email-input { enable | disable } { wlan_id | foreignAp }
Syntax Description
Command Default
Examples
This example shows how to configure a web captive portal using an e-mail address:
Related Commands
config wlan security web-passthrough enable
To enable a web captive portal with no authentication required on the wireless LAN, use the config wlan security web-passthrough enable command.
config wlan security web-passthrough enable { wlan_id | foreignAp }
Syntax Description
Command Default
Examples
This example shows how to enable a web captive portal with no authentication required on wireless LAN ID 1:
Related Commands
config wlan security wpa akm 802.1x
To configure authentication key-management using 802.1X, use the config wlan security wpa akm 802.1x command.
config wlan security wpa akm 802.1x { enable | disable } wlan_id
Syntax Description
Command Default
Examples
This example shows how to configure authentication using 802.1X :
Related Commands
config wlan security wpa akm cckm
To configure authentication key-management using Cisco Centralized Key Management (CCKM), use the config wlan security wpa akm cckm command.
config wlan security wpa akm cckm { enable wlan_id | disable wlan_id | timestamp-tolerance }
Syntax Description
CCKM IE time-stamp tolerance. The range is between 1000 to 5000 milliseconds; the default is 1000 milliseconds. |
Command Default
Examples
This example shows how to configure authentication key-management using CCKM :
Related Commands
config wlan security wpa akm ft
To configure authentication key-management using 802.11r fast transition 802.1X, use the config wlan security wpa akm ft command.
config wlan security wpa akm ft [over-the-air | over-the-ds | psk] [ reassociation-timeout seconds ] {enable | disable} wlan_id
Syntax Description
Configures 802.11r fast transition roaming over-the-air support. |
|
Configures reassoication deadline interval. The valid range is between 1 to 100 seconds. The default value is 20 seconds. |
|
Command Default
Examples
This example shows how to configure authentication key-management using 802.11r fast transition:
Related Commands
config wlan security wpa psk
To configure the Wi-Fi protected access (WPA) preshared key mode, use the config wlan security wpa akm psk command.
config wlan security wpa akm psk {enable | disable | set-key key-format key } wlan_id
Syntax Description
Command Default
Examples
This example shows how to configure the WPA preshared key mode:
Related Commands
config wlan security wpa disable
To disable WPA1, use the config wlan security wpa disable command.
config wlan security wpa disable wlan_id
Syntax Description
Command Default
Examples
This example shows how to disable WPA:
Related Commands
config wlan security wpa enable
To enable WPA1, use the config wlan security wpa enable command.
config wlan security wpa enable wlan_id
Syntax Description
Command Default
Examples
This example shows how to configure the WPA on WLAN ID 1:
Related Commands
config wlan security wpa ciphers
To configure the Wi-Fi protected authentication (WPA1) or Wi-Fi protected authentication (WPA2), use the config wlan security wpa ciphers command.
config wlan security wpa {wpa1 | wpa2} ciphers {aes | tkip} { enable | disable } wlan_id
Syntax Description
Command Default
Usage Guidelines
If you are not specifying the WPA versions, it implies the following:
Examples
This example shows how to encrypt the WPA:
Related Commands
config wlan security wpa wpa1 disable
To disable WPA1, use the config wlan security wpa wpa1 disable command.
config wlan security wpa wpa1 disable wlan_id
Syntax Description
Command Default
Examples
This example shows how to disable WPA1:
Related Commands
config wlan security wpa wpa1 enable
To enable WPA1, use the config wlan security wpa wpa1 enable command.
config wlan security wpa wpa1 enable wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable WPA1:
Related Commands
config wlan security wpa wpa2 disable
To disable WPA2, use the config wlan security wpa wpa2 disable command.
config wlan security wpa wpa2 disable wlan_id
Syntax Description
Command Default
Examples
This example shows how to disable WPA2:
Related Commands
config wlan security wpa wpa2 enable
To enable WPA2, use the config wlan security wpa wpa2 enable command.
config wlan security wpa wpa2 enable wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable WPA2:
Related Commands
config wlan security wpa wpa2 cache
To configure caching methods on a WLAN, use the config wlan security wpa wpa2 cache command.
config wlan security wpa wpa2 cache sticky { enable | disable } wlan_id
Syntax Description
Configures Sticky Key Caching (SKC) roaming support on the WLAN. |
|
Command Default
Usage Guidelines
Beginning in Release 7.2 and later releases, the controller supports Sticky PMKID Caching (SKC). In SKC (Sticky Key caching) also known as PKC (Pro Active Key caching), the client stores each Pairwise Master Key (PMK) ID (PMKID) against a Pairwise Master Key Security Association (PMKSA). When a client finds an AP for which it has the PMKSA, it sends the PMKID in the association request to the AP. If the PMKSA is alive in the AP, the AP provides support for fast roaming. In SKC, full authentication is done on each new AP to which the client associates and the client must keep the PMKSA associated with all APs.
Examples
This example shows how to enable SKC roaming support on a WLAN:
Related Commands
config wlan security wpa wpa2 enable
config wlan security wpa wpa2 disable
config wlan security wpa wpa2 ciphers
To configure WPA2 ciphers and to enable or disable Advanced Encryption Standard (AES) or Temporal Key Integrity Protocol (TKIP) data encryption for WPA2, use the config wlan security wpa wpa2 ciphers command.
config wlan security wpa wpa2 ciphers {aes | tkip} { enable | disable } wlan_id
Syntax Description
Command Default
Examples
This example shows how to enable AES data encryption for WPA2:
Related Commands
config wlan security wpa wpa2 enable
config wlan security wpa wpa2 disable
config wlan session-timeout
To change the timeout of wireless LAN clients, use the config wlan session-timeout command.
config wlan timeout { wlan_id | foreignAp } seconds
Syntax Description
Timeout or session duration in seconds. A value of zero is equivalent to no timeout. |
Command Default
Examples
This example shows how to configure the client timeout to 6000 seconds for WLAN ID 1:
Related Commands
config wlan webauth-exclude
To release the guest user IP address when the web authentication policy time expires and exclude the guest user from acquiring an IP address for three minutes, use the config wlan webauth-exclude command.
config wlan webauth-exclude wlan_id {enable | disable}
Syntax Description
Command Default
Usage Guidelines
You can use this command for guest WLANs that are configured with web authentication.
This command is applicable when you configure the internal DHCP scope on the controller.
By default, when the web authentication timer expires for a guest user, the guest user can immediately reassociate with the same IP address before another guest user can acquire the IP address. If there are many guest users or limited IP address in the DHCP pool, some guest users might not be able to acquire an IP address.
When you enable this feature on the guest WLAN, the guest user’s IP address is released when the web authentication policy time expires and the guest user is excluded from acquiring an IP address for three minutes. The IP address is available for another guest user to use. After three minutes, the excluded guest user can reassociate and acquire an IP address, if available.
Examples
This example shows how to enable the web authentication exclusion for WLAN ID 5:
Related Commands
config wlan wmm
To configure Wi-Fi Multimedia (WMM) mode on a wireless LAN, use the config wlan wmm command.
config wlan wmm { allow | disable | require } wlan_id
Syntax Description
Specifies that clients use WMM on the specified wireless LAN. |
|
Command Default
Usage Guidelines
When the controller is in Layer 2 mode and WMM is enabled, you must put the access points on a trunk port in order to allow them to join the controller.
Examples
The following example shows you how to configure wireless LAN ID 1 to allow WMM.
The following exmaple shows you how to configure wireless LAN ID 1 to specify that clients use WMM.
Related Commands
Configure WPS Commands
Use the config wps commands to configure Wireless Protection System (WPS) settings.
config wps ap-authentication
To configure access point neighbor authentication, use the config wps ap-authentication command.
config wps ap-authentication [enable | disable | threshold threshold_value]
Syntax Description
(Optional) Specifies that WMM-enabled clients are on the wireless LAN. |
|
Command Default
Examples
This example shows how to configure WMM-enabled clients with the threshold value 25:
Related Commands
config wps auto-immune
To enable or disable protection from Denial of Service (DoS) attacks, use the config wps auto-immune command.
config wps auto-immune { enable | disable }
Syntax Description
Command Default
Usage Guidelines
A potential attacker can use specially crafted packets to mislead the Intrusion Detection System (IDS) into treating a legitimate client as an attacker. It causes the controller to disconnect this legitimate client and launch a DoS attack. The auto-immune feature, when enabled, is designed to protect against such attacks. However, conversations using Cisco 792x phones might be interrupted intermittently when the auto-immune feature is enabled. If you experience frequent disruptions when using 792x phones, you might want to disable this feature.
Examples
This example shows how to configure the auto-immune mode:
Related Commands
config wps cids-sensor
To configure Intrusion Detection System (IDS) sensors for the Wireless Protection System (WPS), use the config wps cids-sensor command.
config wps cids-sensor {[add index ip_address username password] | [delete index] |
[enable index] | [disable index] | [port index port] | [interval index query_interval] |
[fingerprint index sha1 fingerprint]}
Syntax Description
Command Default
Command defaults are listed below as follows:
Examples
This example shows how to configure the intrusion detection system with the IDS index 1, IDS sensor IP address 10.0.0.51, IDS username Sensor_user0doc1, and IDS password passowrd01:
Related Commands
config wps client-exclusion
To configure client exclusion policies, use the config wps client-exclusion command.
config wps client-exclusion {802.11-assoc | 802.11-auth | 802.1x-auth | ip-theft | web-auth | all} {enable | disable}
Syntax Description
Command Default
Examples
This example shows how to disable clients on the 802.11 association attempt after five consecutive failures:
Related Commands
config wps mfp
To configure Management Frame Protection (MFP), use the config wps mfp command.
config wps mfp infrastructure {enable | disable}
Syntax Description
Command Default
Examples
This example shows how to enable the infrastructure MFP:
Related Commands
config wps shun-list re-sync
To force the controller to synchronization with other controllers in the mobility group for the shun list, use the config wps shun-list re-sync command.
Syntax Description
Command Default
Examples
This example shows how to configure the controller to synchronize with other controllers for the shun list:
Related Commands
config wps signature
To enable or disable Intrusion Detection System (IDS) signature processing, or to enable or disable a specific IDS signature, use the config wps signature command.
config wps signature { standard | custom } state signature_id { enable | disable }
Syntax Description
Enables the IDS signature processing or a specific IDS signature. |
|
Disables IDS signature processing or a specific IDS signature. |
Command Default
Usage Guidelines
If IDS signature processing is disabled, all signatures are disabled, regardless of the state configured for individual signatures.
Examples
This example shows how to enable IDS signature processing, which enables the processing of all IDS signatures:
This example shows how to disable a standard individual IDS signature:
Related Commands
config wps signature frequency
config wps signature interval
config wps signature mac-frequency
config wps signature quiet-time
config wps signature reset
show wps signature events
show wps signature summary
show wps summary
config wps signature frequency
To specify the number of matching packets per interval that must be identified at the individual access point level before an attack is detected, use the config wps signature frequency command.
config wps signature frequency signature_id frequency
Syntax Description
Number of matching packets per interval that must be at the individual access point level before an attack is detected. The range is 1 to 32,000 packets per interval. |
Command Default
Usage Guidelines
If IDS signature processing is disabled, all signatures are disabled, regardless of the state configured for individual signatures.
Examples
This example shows how to set the number of matching packets per interval per access point before an attack is detected to 1800 for signature ID 4:
Related Commands
config wps signature
config wps signature interval
config wps signature mac-frequency
config wps signature quiet-time
config wps signature reset
show wps signature events
show wps signature summary
show wps summary
config wps signature interval
To specify the number of seconds that must elapse before the signature frequency threshold is reached within the configured interval, use the config wps signature interval command.
config wps signature interval signature_id interval
Syntax Description
Number of seconds that must elapse before the signature frequency threshold is reached. The range is 1 to 3,600 seconds. |
Command Default
Usage Guidelines
If IDS signature processing is disabled, all signatures are disabled, regardless of the state configured for individual signatures.
Examples
This example shows how to set the number of seconds to elapse before reaching the signature frequency threshold to 200 for signature ID 1:
Related Commands
config wps signature
config wps signature frequency
config wps signature mac-frequency
config wps signature quiet-time
config wps signature reset
show wps signature events
show wps signature summary
show wps summary
config wps signature mac-frequency
To specify the number of matching packets per interval that must be identified per client per access point before an attack is detected, use the config wps signature mac-frequency command.
config wps signature mac-frequency signature_id mac_frequency
Syntax Description
Number of matching packets per interval that must be identified per client per access point before an attack is detected. The range is 1 to 32,000 packets per interval. |
Command Default
Usage Guidelines
If IDS signature processing is disabled, all signatures are disabled, regardless of the state configured for individual signatures.
Examples
This example shows how to set the number of matching packets per interval per client before an attack is detected to 50 for signature ID 3:
Related Commands
config wps signature
config wps signature frequency
config wps signature interval
config wps signature quiet-time
config wps signature reset
show wps signature events
show wps signature summary
show wps summary
config wps signature quiet-time
To specify the length of time after which no attacks have been detected at the individual access point level and the alarm can stop, use the config wps signature quiet-time command.
config wps signature quiet-time signature_id quiet_time
Syntax Description
Length of time after which no attacks have been detected at the individual access point level and the alarm can stop. The range is 60 to 32,000 seconds. |
Command Default
Usage Guidelines
If IDS signature processing is disabled, all signatures are disabled, regardless of the state configured for individual signatures.
Examples
This example shows how to set the number of seconds after which no attacks have been detected per access point to 60 for signature ID 1:
Related Commands
config wps signature
config wps signature frequency
config wps signature interval
config wps signature mac-frequency
config wps signature reset
show wps signature events
show wps signature summary
show wps summary
config wps signature reset
To reset a specific Intrusion Detection System (IDS) signature or all IDS signatures to default values, use the config wps signature reset command.
config wps signature reset { signature_id | all }
Syntax Description
Command Default
Usage Guidelines
If IDS signature processing is disabled, all signatures are disabled, regardless of the state configured for individual signatures.
Examples
This example shows how to reset the IDS signature 1 to default values:
Related Commands
config wps signature
config wps signature frequency
config wps signature interval
config wps signature mac-frequency
config wps signature quiet-time
show wps signature events
show wps signature summary
show wps summary
Capwap Access Point Commands
Use the capwap ap commands to configure capwap access point settings.
capwap ap controller ip address
To configure the controller IP address into the capwap access point from the access point’s console port, use the capwap ap controller ip address command.
capwap ap controller ip address ip_address
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to configure the controller IP address 10.23.90.81 into the capwap access point:
Related Commands
capwap ap dot1x
capwap ap hostname
capwap ap ip address
capwap ap ip default-gateway
capwap ap log-server
capwap ap primary-base
capwap ap primed-timer
capwap ap secondary-base
capwap ap tertiary-base
capwap ap dot1x
To configure the dot1x username and password into the capwap access point from the access point’s console port, use the capwap ap dot1x command.
capwap ap dot1x username user_name password password
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to configure the dot1x username ABC and password pass01:
Related Commands
capwap ap controller ip address
capwap ap hostname
capwap ap ip address
capwap ap ip default-gateway
capwap ap log-server
capwap ap primary-base
capwap ap primed-timer
capwap ap secondary-base
capwap ap tertiary-base
capwap ap hostname
To configure the access point host name from the access point’s console port, use the capwap ap hostname command.
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases. This command is available only for Lightweight AP IOS Software recovery image (rcvk9w8) without private-config. You can remove the private-config by using the clear capwap private-config command.
Examples
This example shows how to configure the hostname WLC into the capwap access point:
Related Commands
capwap ap controller ip address
capwap ap dot1x
capwap ap ip address
capwap ap ip default-gateway
capwap ap log-server
capwap ap primary-base
capwap ap primed-timer
capwap ap secondary-base
capwap ap tertiary-base
capwap ap ip address
To configure the IP address into the capwap access point from the access point’s console port, use the capwap ap ip address command.
capwap ap ip address ip_address
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to configure the IP address 10.0.0.0.1 into capwap access point:
Related Commands
capwap ap controller ip address
capwap ap dot1x
capwap ap hostname
capwap ap ip default-gateway
capwap ap log-server
capwap ap primary-base
capwap ap primed-timer
capwap ap secondary-base
capwap ap tertiary-base
capwap ap ip default-gateway
To configure the default gateway from the access point’s console port, use the capwap ap ip default-gateway command.
capwap ap ip default-gateway default_gateway
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to configure the capwap access point with the default gateway address 10.0.0.1:
Related Commands
capwap ap controller ip address
capwap ap dot1x
capwap ap hostname
capwap ap ip address
capwap ap log-server
capwap ap primary-base
capwap ap primed-timer
capwap ap secondary-base
capwap ap tertiary-base
capwap ap log-server
To configure the system log server to log all the capwap errors, use the capwap ap log-server command.
capwap ap log-server ip_address
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to configure the syslog server with the IP address 10.0.0.1:
Related Commands
capwap ap controller ip address
capwap ap dot1x
capwap ap hostname
capwap ap ip address
capwap ap ip default-gateway
capwap ap primary-base
capwap ap primed-timer
capwap ap secondary-base
capwap ap tertiary-base
capwap ap primary-base
To configure the primary controller name and IP address into the capwap access point from the access point’s console port, use the capwap ap primary-base command.
capwap ap primary-base controller_name controller_ip_address
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to configure the primary controller name WLC1 and primary controller IP address 10.92.109.1 into the capwap access point:
Related Commands
capwap ap controller ip address
capwap ap dot1x
capwap ap hostname
capwap ap ip address
capwap ap ip default-gateway
capwap ap log-server
capwap ap primed-timer
capwap ap secondary-base
capwap ap tertiary-base
capwap ap primed-timer
To configure the primed timer into the capwap access point, use the capwap ap primed-timer command.
capwap ap primed-timer { enable | disable }
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to enable the primed-timer settings:
Related Commands
capwap ap controller ip address
capwap ap dot1x
capwap ap hostname
capwap ap ip address
capwap ap ip default-gateway
capwap ap log-server
capwap ap primary-base
capwap ap secondary-base
capwap ap tertiary-base
capwap ap secondary-base
To configure the secondary controller name and IP address into the capwap access point from the access point’s console port, use the capwap ap secondary-base command.
capwap ap secondary-base controller_name controller_ip_address
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to configure the secondary controller name WLC2 and secondary controller IP address 10.92.108.2 into the capwap access point:
Related Commands
capwap ap controller ip address
capwap ap dot1x
capwap ap hostname
capwap ap ip address
capwap ap ip default-gateway
capwap ap log-server
capwap ap primary-base
capwap ap primed-timer
capwap ap tertiary-base
capwap ap tertiary-base
To configure the tertiary controller name and IP address into the capwap access point from the access point’s console port, use the capwap ap tertiary-base command.
capwap ap tertiary-base controller_name controller_ip_address
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to configure the tertiary controller name WLC3 and secondary controller IP address 10.80.72.2 into the capwap access point:
Related Commands
capwap ap controller ip address
capwap ap dot1x
capwap ap hostname
capwap ap ip address
capwap ap ip default-gateway
capwap ap log-server
capwap ap primary-base
capwap ap primed-timer
capwap ap secondary-base
lwapp ap controller ip address
To configure the controller IP address into the FlexConnect access point from the access point’s console port, use the lwapp ap controller ip address command.
lwapp ap controller ip address ip_address
Syntax Description
Command Default
Usage Guidelines
This command must be entered from an access point’s console port.
Prior to changing the FlexConnect configuration on an access point using the access point’s console port, the access point must be in standalone mode (not connected to a controller) and you must remove the current LWAPP private configuration by using the clear lwapp private-config command.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to configure the controller IP address 10.92.109.1 into the FlexConnect access point:
Related Commands
Saving Configurations
Use the save config command before you log out of the command line interface to save all previous configuration changes.
save config
To save Cisco wireless LAN controller configurations, use the save config command.
Syntax Description
Command Default
Examples
This example shows how to save the Cisco wireless LAN controller settings:
Related Commands
test pmk-cache delete
To delete an entry in the Pairwise Master Key (PMK) cache from all Cisco wireless LAN controllers in the mobility group, use the test pmk-cache delete command.
test pmk-cache delete { all | mac_address }
Syntax Description
Command Default
Examples
This example shows how to delete all entries in the PMK cache:
Related Commands
Clearing Configurations, Logfiles, and Other Actions
Use the clear command to clear existing configurations, log files, and other functions.
clear acl counters
To clear the current counters for an access control list (ACL), use the clear acl counters command.
Syntax Description
Command Default
Usage Guidelines
Note ACL counters are available only on the following controllers: Cisco 4400 Series Controller, Cisco WiSM, and Catalyst 3750G Integrated Wireless LAN Controller Switch.
Examples
This example shows how to clear the current counters for acl1:
Related Commands
clear ap-config
To clear (reset to the default values) the configuration settings of a lightweight access point, use the clear ap-config command.
Syntax Description
Command Default
Usage Guidelines
Entering this command does not clear the static IP address of the access point.
Examples
This example shows how to clear the access point’s configuration settings for the access point named ap1240_322115:
Related Commands
clear ap-eventlog
To delete the existing event log and create an empty event log file for a specific access point or for all access points joined to the controller, use the clear ap-eventlog command.
clear ap-eventlog {specific ap_name | all}
Syntax Description
Name of the access point for which the event log file will be emptied. |
|
Deletes the event log for all access points joined to the controller. |
Command Default
Examples
This example shows how to delete the event log for all access points:
Related Commands
clear ap join stats
To clear the join statistics for all access points or for a specific access point, use the clear ap join stats command.
clear ap join stats { all | ap_mac }
Syntax Description
Command Default
Examples
This example shows how to clear the join statistics of all the access points:
Related Commands
clear arp
To clear the Address Resolution Protocol (ARP) table, use the clear arp command.
Syntax Description
Command Default
Examples
This example shows how to cleat the ARP table:
Related Commands
clear transfer
clear download filename
clear download mode
clear download path
clear download serverip
clear download start
clear upload datatype
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear client tsm
To clear the traffic stream metrics (TSM) statistics for a particular access point or all the access points to which this client is associated, use the clear client tsm command.
clear client tsm { 802.11a | 802.11b } client_mac { ap_mac | all }
Syntax Description
Command Default
Examples
This example shows how to clear the TSM for the MAC address 00:40:96:a8:f7:98:
Related Commands
clear config
To reset configuration data to factory defaults, use the clear config command.
Syntax Description
Command Default
Examples
This example shows how to reset the configuration data to factory defaults:
Related Commands
clear transfer
clear download filename
clear download mode
clear download path
clear download serverip
clear download start
clear upload datatype
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear ext-webauth-url
To clear the external web authentication URL, use the clear ext-webauth-url command.
Syntax Description
Command Default
Examples
This example shows how to clear the external web authentication URL:
Related Commands
clear transfer
clear download datatype
clear download filename
clear download mode
clear download path
clear download serverip
clear download start
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear license agent
To clear the license agent’s counter or session statistics, use the clear license agent command.
clear license agent { counters | sessions }
Syntax Description
Command Default
Examples
This example shows how to clear the license agent’s counter settings:
Related Commands
clear location rfid
To clear a specific radio frequency identification (RFID) tag or all of the RFID tags in the entire database, use the clear location rfid command.
clear location rfid { mac_address | all }
Syntax Description
Command Default
Examples
This example shows how to clear all of the RFID tags in the database:
Related Commands
clear location statistics rfid
config location
show location
show location statistics rfid
clear location statistics rfid
To clear radio frequency identification (RFID) statistics, use the clear location statistics rfid command.
clear location statistics rfid
Syntax Description
Command Default
Examples
This example shows how to clear RFID statistics:
Related Commands
clear location statistics rfid
config location
show location
clear locp statistics
To clear the Location Protocol (LOCP) statistics, use the clear locp statistics command.
Syntax Description
Command Default
Examples
This example shows how to clear the statistics related to LOCP:
Related Commands
clear login-banner
To remove the login banner file from the controller, use the clear login-banner command.
Syntax Description
Command Default
Examples
This example shows how to clear the login banner file:
Related Commands
clear lwapp private-config
To clear (reset to default values) an access point’s current Lightweight Access Point Protocol (LWAPP) private configuration, which contains static IP addressing and controller IP address configurations, use the clear lwapp private-config command.
Syntax Description
Command Default
Usage Guidelines
This command is executed from the access point console port.
Prior to changing the FlexConnect configuration on an access point using the access point’s console port, the access point must be in standalone mode (not connected to a controller) and you must remove the current LWAPP private configuration by using the clear lwapp private-config command.
Note The access point must be running Cisco IOS Release 12.3(11)JX1 or higher releases.
Examples
This example shows how to clear an access point’s current LWAPP private configuration:
Related Commands
clear nmsp statistics
To clear the Network Mobility Services Protocol (NMSP) statistics, use the clear nmsp statistics command.
Syntax Description
Command Default
Examples
This example shows how to delete the NMSP statistics log file:
Related Commands
clear radius acct statistics
To clear the RADIUS accounting statistics on the controller, use the clear radius acc statistics command.
clear radius acct statistics [index | all]
Syntax Description
Command Default
Examples
This example shows how to clear the RADIUS accounting statistics:
Related Commands
clear tacacs auth statistics
To clear the RADIUS authentication server statistics in the controller, use the clear tacacs auth statistics command.
clear radius tacacs auth statistics [index | all]
Syntax Description
Command Default
Examples
This example shows how to clear the RADIUS authentication server statistics:
Related Commands
clear redirect-url
To clear the custom web authentication redirect URL on the Cisco wireless LAN controller, use the clear redirect-url command.
Syntax Description
Command Default
Examples
This example shows how to clear the custom web authentication redirect URL:
Related Commands
clear transfer
clear download datatype
clear download filename
clear download mode
clear download path
clear download start
clear upload datatype
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear stats ap wlan
To clear the WLAN statistics, use the clear stats ap wlan command.
Syntax Description
Command Default
Examples
This example shows how to clear the WLAN configuration elements of the access point cisco_ap:
Related Commands
clear stats local-auth
To clear the local Extensible Authentication Protocol (EAP) statistics, use the clear stats local-auth command.
Syntax Description
Command Default
Examples
This example shows how to clear the local EAP statistics:
Related Commands
config local-auth active-timeout
config local-auth eap-profile
config local-auth method fast
config local-auth user-credentials
debug aaa local-auth
show local-auth certificates
show local-auth config
show local-auth statistics
clear stats mobility
To clear mobility manager statistics, use the clear stats mobility command.
Syntax Description
Command Default
Examples
This example shows how to cleat mobility manager statistics:
Related Commands
clear transfer
clear download datatype
clear download filename
clear download mode
clear download serverip
clear download start
clear upload datatype
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear stats port
clear stats port
To clear statistics counters for a specific port, use the clear stats port command.
Syntax Description
Command Default
Examples
This example shows how to clear the statistics counters for port 9:
Related Commands
clear transfer
clear download datatype
clear download filename
clear download mode
clear download serverip
clear download start
clear upload datatype
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear stats radius
To clear the statistics for one or more RADIUS servers, use the clear stats radius command.
clear stats radius { auth | acct} {index | all}
Syntax Description
Command Default
Examples
This example shows how to clear the statistics for all RADIUS authentication servers:
Related Commands
clear transfer
clear download datatype
clear download filename
clear download mode
clear download serverip
clear download start
clear upload datatype
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear stats switch
To clear all switch statistics counters on a Cisco wireless LAN controller, use the clear stats switch command.
Syntax Description
Command Default
Examples
This example shows how to clear all switch statistics counters:
Related Commands
clear transfer
clear download datatype
clear download filename
clear download mode
clear download path
clear download start
clear upload datatype
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear stats tacacs
To clear the TACACS+ server statistics on the controller, use the clear stats tacacs command.
clear stats tacacs [auth | athr | acct] [index | all]
Syntax Description
(Optional) Clears the TACACS+ authentication server statistics. |
|
(Optional) Clears the TACACS+ authorization server statistics. |
|
Command Default
Examples
This example shows how to clear the TACACS+ accounting server statistics for index 1:
Related Commands
clear transfer
To clear the transfer information, use the clear transfer command.
Syntax Description
Command Default
Examples
This example shows how to clear the transfer information:
Related Commands
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload pac
transfer upload password
transfer upload path
transfer upload port
transfer upload serverip
transfer upload start
transfer upload username
clear traplog
To clear the trap log, use the clear traplog command.
Syntax Description
Command Default
Examples
This example shows how to clear the trap log:
Related Commands
clear transfer
clear download datatype
clear download filename
clear download mode
clear download path
clear download serverip
clear download start
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear webimage
To clear the custom web authentication image, use the clear webimage command.
Syntax Description
Command Default
Examples
This example shows how to clear the custom web authentication image:
Related Commands
clear transfer
clear download datatype
clear download filename
clear download mode
clear download path
clear download serverip
clear download start
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear webmessage
To clear the custom web authentication message, use the clear webmessage command.
Syntax Description
Command Default
Examples
This example shows how to clear the custom web authentication message:
Related Commands
clear transfer
clear download datatype
clear download filename
clear download mode
clear download path
clear download serverip
clear download start
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
clear webtitle
To clear the custom web authentication title, use the clear webtitle command.
Syntax Description
Command Default
Examples
This example shows how to clear the custom web authentication title:
Related Commands
clear transfer
clear download datatype
clear download filename
clear download mode
clear download path
clear download serverip
clear download start
clear upload filename
clear upload mode
clear upload path
clear upload serverip
clear upload start
Resetting the System Reboot Time
Use the reset command to schedule a reboot of the controller and access points.
reset system at
To reset the system at a specified time, use the reset system at command.
reset system at YYYY-MM-DD HH: MM: SS image {no-swap | swap} reset-aps [save-config]
Syntax Description
Command Default
Examples
This example shows how to reset the system at 2010-03-29 and 12:01:01 time:
Related Commands
reset system in
To specify the amount of time delay before the devices reboot, use the reset system in command.
reset system in HH: MM: SS image {swap | no-swap} reset-aps save-config
Syntax Description
Command Default
Examples
This example shows how to reset the system after a delay of 00:01:01:
Related Commands
reset system cancel
To cancel a scheduled reset, use the reset system cancel command.
Syntax Description
Command Default
Examples
This example shows how to cancel a scheduled reset:
Related Commands
reset system notify-time
To configure the trap generation prior to scheduled resets, use the reset system notify-time command.
reset system notify-time minutes
Syntax Description
Number of minutes before each scheduled reset at which to generate a trap. |
Command Default
Examples
This example shows how to configure the trap generation to 10 minutes before the scheduled resets:
Related Commands
Uploading and Downloading Files and Configurations
Use the transfer command to transfer files to or from the Cisco wireless LAN controller.
transfer download certpasswor
To set the password for the.PEM file so that the operating system can decrypt the web administration SSL key and certificate, use the transfer download certpassword command.
transfer download certpassword private_key_password
Syntax Description
Command Default
Examples
This example shows how to transfer a file to the switch with the certificate’s private key password certpassword:
Related Commands
clear transfer
transfer download filename
transfer download mode
transfer download path
transfer download serverip
transfer download start
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload path
transfer upload serverip
transfer upload start
transfer download datatype
To set the download file type, use the transfer download datatype command.
transfer download datatype { config | code | image | signature | webadmincert | webauthbundle | eapdevcert | eapcacert }
Syntax Description
Downloads a certificate for web administration to the system. |
|
Command Default
Examples
This example shows how to download an executable image to the system:
Related Commands
clear transfer
transfer download certpassword
transfer download filename
transfer download mode
transfer download path
transfer download serverip
transfer download start
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload path
transfer upload serverip
transfer upload start
transfer download filename
To download a specific file, use the transfer download filename command.
transfer download filename filename
Syntax Description
Command Default
Examples
This example shows how to transfer a file named build603:
Related Commands
clear transfer
transfer download certpassword
transfer download mode
transfer download path
transfer download serverip
transfer download start
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload path
transfer upload serverip
transfer upload start
transfer download mode
To set the transfer mode, use the transfer download mode command.
transfer download mode {ftp | tftp}
Syntax Description
Command Default
Examples
This example shows how to transfer a file using the TFTP mode:
Related Commands
clear transfer
transfer download certpassword
transfer download filename
transfer download path
transfer download serverip
transfer download start
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload path
transfer upload serverip
transfer upload start
transfer download password
To set the password for an FTP transfer, use the transfer download password command.
transfer download password password
Syntax Description
Command Default
Examples
This example shows how to set the password for FTP transfer to pass01:
Related Commands
transfer download mode
transfer download port
transfer download username
transfer download path
To set a specific FTP or TFTP path, use the transfer download path command.
Syntax Description
Note Pathnames on a TFTP or FTP server are relative to the server’s default or root directory. For example, in the case of the Solarwinds TFTP server, the path is “/”. |
Command Default
Examples
This example shows how to transfer a file to the path c:\install\version2:
Related Commands
clear transfer
transfer download certpassword
transfer download filename
transfer download mode
transfer download serverip
transfer download start
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload path
transfer upload serverip
transfer upload start
transfer download port
To specify the FTP port, use the transfer download port command.
Syntax Description
Command Default
Examples
This example shows how to specify FTP port number 23:
Related Commands
transfer download mode
transfer download password
transfer download username
transfer download serverip
To configure the IP address of the TFTP server from which to download information, use the transfer download serverip command.
transfer download serverip TFTP_server ip_address
Syntax Description
Command Default
Examples
This example shows how to configure the IP address of the TFTP server with the IP address 175.34.56.78:
Related Commands
clear transfer
transfer download certpassword
transfer download filename
transfer download mode
transfer download path
transfer download start
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload path
transfer upload serverip
transfer upload start
transfer download start
To initiate a download, use the transfer download start command.
Syntax Description
Command Default
Examples
This example shows how to initiate a download:
Related Commands
clear transfer
transfer download certpassword
transfer download filename
transfer download mode
transfer download path
transfer download serverip
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload path
transfer upload serverip
transfer upload start
transfer download tftpPktTimeout
To specify the TFTP packet timeout, use the transfer download tftpPktTimeout command.
transfer download tftpPktTimeout timeout
Syntax Description
Command Default
Examples
This example shows how to transfer a file with the TFTP packet timeout of 55 seconds:
Related Commands
clear transfer
transfer download certpassword
transfer download filename
transfer download mode
transfer download path
transfer download serverip
transfer download start
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload path
transfer upload serverip
transfer upload start
transfer download tftpMaxRetries
To specify the number of allowed TFTP packet retries, use the transfer download tftpMaxRetries command.
transfer download tftpMaxRetries retries
Syntax Description
Number of allowed TFTP packet retries between 1 and 254 seconds. |
Command Default
Examples
This example shows how to set the number of allowed TFTP packet retries to 55:
Related Commands
clear transfer
transfer download certpassword
transfer download filename
transfer download mode
transfer download path
transfer download serverip
transfer download start
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload path
transfer upload serverip
transfer upload start
transfer download username
To specify the FTP username, use the transfer download username command.
transfer download username username
Syntax Description
Command Default
Examples
This example shows how to set the FTP username to ftp_username:
Related Commands
transfer download mode
transfer download password
transfer download port
transfer encrypt
To configure encryption for configuration file transfers, use the transfer encrypt command.
transfer encrypt { enable | disable | set-key key }
Syntax Description
Specifies the encryption key for configuration file transfers. |
|
Command Default
Examples
This example shows how to enable the encryption settings:
Related Commands
clear transfer
transfer download datatype
transfer download filename
transfer download mode
transfer download path
transfer download serverip
transfer upload datatype
transfer download filename
transfer download mode
transfer download path
transfer download serverip
transfer download start
transfer upload datatype
To set the controller to upload specified log and crash files, use the transfer upload datatype command.
transfer upload datatype { config | coredump | crashfile | errorlog | invalid-config | pac | packet-capture | panic-crash-file | radio-core-dump | signature | systemtrace | traplog | watchdog-crash-file }
Syntax Description
Uploads a console dump file resulting from a software-watchdog-initiated controller reboot following a crash. |
Command Default
Examples
This example shows how to upload the system error log file:
Related Commands
clear transfer
transfer upload filename
transfer upload mode
transfer upload pac
transfer upload password
transfer upload path
transfer upload port
transfer upload serverip
transfer upload start
transfer upload username
transfer upload filename
To upload a specific file, use the transfer upload filename command.
transfer upload filename filename
Syntax Description
Command Default
Examples
This example shows how to upload a file build603:
Related Commands
clear transfer
transfer upload datatype
transfer upload mode
transfer upload pac
transfer upload password
transfer upload path
transfer upload port
transfer upload serverip
transfer upload start
transfer upload username
transfer upload mode
To configure the transfer mode, use the transfer upload mode command.
transfer upload mode { ftp | tftp }
Syntax Description
Command Default
Examples
This example shows how to set the transfer mode to TFTP:
Related Commands
clear transfer
transfer upload datatype
transfer upload filename
transfer upload pac
transfer upload password
transfer upload path
transfer upload port
transfer upload serverip
transfer upload start
transfer upload username
transfer upload pac
To load a Protected Access Credential (PAC) to support the local authentication feature and allow a client to import the PAC, use the transfer upload pac command.
transfer upload pac username validity password
Syntax Description
Command Default
Usage Guidelines
Examples
This example shows how to upload a PAC with the username user1, validity period 53, and password pass01:
Related Commands
clear transfer
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload password
transfer upload path
transfer upload port
transfer upload serverip
transfer upload start
transfer upload username
transfer upload password
To configure the password for FTP transfer, use the transfer upload password command.
transfer upload password password
Syntax Description
Command Default
Examples
This example shows how to configure the password for the FTP transfer to pass01:
Related Commands
clear transfer
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload pac
transfer upload path
transfer upload port
transfer upload serverip
transfer upload start
transfer upload username
transfer upload path
To set a specific upload path, use the transfer upload path command.
Syntax Description
Command Default
Examples
This example shows how to set the upload path to c:\install\version2:
Related Commands
clear transfer
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload pac
transfer upload password
transfer upload port
transfer upload serverip
transfer upload start
transfer upload username
transfer upload port
To specify the FTP port, use the transfer upload port command.
Syntax Description
Command Default
Examples
This example shows how to specify FTP port 23:
Related Commands
clear transfer
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload pac
transfer upload password
transfer upload path
transfer upload serverip
transfer upload start
transfer upload username
transfer upload serverip
To configure the IP address of the TFTP server to upload files to, use the transfer upload serverip command.
transfer upload serverip ip_address
Syntax Description
Command Default
Examples
This example shows how to set the IP address of the TFTP server to 175.31.56.78:
Related Commands
clear transfer
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload pac
transfer upload password
transfer upload path
transfer upload port
transfer upload start
transfer upload username
transfer upload start
To initiate an upload, use the transfer upload start command.
Syntax Description
Command Default
Examples
This example shows how to initiate an upload of a file:
Related Commands
clear transfer
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload pac
transfer upload password
transfer upload path
transfer upload port
transfer upload serverip
transfer upload username
transfer upload username
To specify the FTP username, use the transfer upload username command.
transfer download username username
Syntax Description
Username required to access the FTP server. The username can contain up to 31 characters. |
Command Default
Examples
This example shows how to set the FTP username to ftp_username:
Related Commands
clear transfer
transfer upload datatype
transfer upload filename
transfer upload mode
transfer upload pac
transfer upload password
transfer upload path
transfer upload port
transfer upload serverip
transfer upload start
Installing and Modifying Licenses
Use the license commands to install, remove, modify, or rehost licenses.
Note The license commands are available only on the Cisco 5500 Series Controller.
Note For detailed information on installing and rehosting licenses on the Cisco 5500 Series Controller, see the “Installing and Configuring Licenses” section in Chapter 4 of the Cisco Wireless LAN Controller Configuration Guide.
license clear
To remove a license from the Cisco 5500 Series Controller, use the license clear command.
Syntax Description
Command Default
Usage Guidelines
You can delete an expired evaluation license or any unused license. You cannot delete unexpired evaluation licenses, the permanent base image license, or licenses that are in use by the controller.
Examples
This example shows how to remove the license settings of the license named wplus-ap-count:
Related Commands
license comment
license install
license revoke
license save
show license all
license comment
To add comments to a license or delete comments from a license on the Cisco 5500 Series Controller, use the license comment command.
license comment { add | delete } license_name comment_string
Syntax Description
Command Default
Examples
This example shows how to add a comment “wplus ap count license” to the license name wplus-ap-count:
Related Commands
license clear
license install
license revoke
license save
show license all
license install
To install a license on the Cisco 5500 Series Controller, use the license install command.
Syntax Description
URL of the TFTP server (tftp:// server_ip / path / filename). |
Command Default
Usage Guidelines
We recommend that the access point count be the same for the base-ap-count and wplus-ap-count licenses installed on your controller. If your controller has a base-ap-count license of 100 and you install a wplus-ap-count license of 12, the controller supports up to 100 access points when the base license is in use but only a maximum of 12 access points when the wplus license is in use.
You cannot install a wplus license that has an access point count greater than the controller's base license. For example, you cannot apply a wplus-ap-count 100 license to a controller with an existing base-ap-count 12 license. If you attempt to register for such a license, an error message appears indicating that the license registration has failed. Before upgrading to a wplus-ap-count 100 license, you would first have to upgrade the controller to a base-ap-count 100 or 250 license.
Examples
This example shows how to install a license on the controller from the URL tftp://10.10.10.10/path/license.lic:
Related Commands
license clear
license modify priority
license revoke
license save
show license all
license modify priority
To raise or lower the priority of the base-ap-count or wplus-ap-count evaluation license on a Cisco 5500 Series Controller, use the license modify priority command.
license modify priority license_name { high | low }
Syntax Description
Command Default
Usage Guidelines
If you are considering upgrading to a license with a higher access point count, you can try an evaluation license before upgrading to a permanent version of the license. For example, if you are using a permanent license with a 50 access point count and want to try an evaluation license with a 100 access point count, you can try out the evaluation license for 60 days.
AP-count evaluation licenses are set to low priority by default so that the controller uses the ap-count permanent license. If you want to try an evaluation license with an increased access point count, you must change its priority to high. If you no longer want to have this higher capacity, you can lower the priority of the ap-count evaluation license, which forces the controller to use the permanent license.
Note You can set the priority only for ap-count evaluation licenses. AP-count permanent licenses always have a medium priority, which cannot be configured.
Note If the ap-count evaluation license is a wplus license and the ap-count permanent license is a base license, you must also change the feature set to wplus.
Note To prevent disruptions in operation, the controller does not switch licenses when an evaluation license expires. You must reboot the controller in order to return to a permanent license. Following a reboot, the controller defaults to the same feature set level as the expired evaluation license. If no permanent license at the same feature set level is installed, the controller uses a permanent license at another level or an unexpired evaluation license.
Examples
This example shows how to set the priority of the wplus-ap-count to high:
Related Commands
license clear
license install
license revoke
license save
show license all
license revoke
To rehost a license on a Cisco 5500 Series Controller, use the license revoke command.
license revoke { permission_ticket_url | rehost rehost_ticket_url }
Syntax Description
URL of the TFTP server (tftp:// server_ip / path / filename) where you saved the permission ticket. |
|
URL of the TFTP server (tftp:// server_ip / path / filename) where you saved the rehost ticket. |
Command Default
Usage Guidelines
Before you revoke a license, save the device credentials by using the license save credential url command.
You can rehost all permanent licenses except the permanent base image license. Evaluation licenses and the permanent base image license cannot be rehosted.
In order to rehost a license, you must generate credential information from the controller and use it to obtain a permission ticket to revoke the license from the Cisco licensing site ( https://tools.cisco.com/SWIFT/Licensing/PrivateRegistrationServlet). Next, you must obtain a rehost ticket and use it to obtain a license installation file for the controller on which you want to install the license.
For detailed information on rehosting licenses, see the “Installing and Configuring Licenses” section in Chapter 4 of the Cisco Wireless LAN Controller Configuration Guide.
Examples
This example shows how to revoke the license settings from the saved permission ticket URL tftp://10.10.10.10/path/permit_ticket.lic:
This example shows how to revoke the license settings from the saved rehost ticket URL tftp://10.10.10.10/path/rehost_ticket.lic:
Related Commands
license clear
license install
license modify priority
license save
show license all
license save
To save a backup copy of all installed licenses or license credentials on the Cisco 5500 Series Controller, use the license save command.
Syntax Description
URL of the TFTP server (tftp:// server_ip / path / filename). |
Command Default
Usage Guidelines
Save the device credentials before you revoke the license by using the license revoke command.
Examples
This example shows how to save a backup copy of all installed licenses or license credentials on tftp://10.10.10.10/path/cred.lic:
Related Commands
license clear
license install
license modify priority
license revoke
show license all
Troubleshooting Commands
Use the debug commands to manage system debugging.
Note Enabling all debug commands on a system with many clients authenticating may result in some debugs being lost.
debug aaa
To configure AAA debug options, use the debug aaa command.
debug aaa {[ all | detail | events | packet | ldap | local-auth | tacacs ] [ enable | disable ]}
Syntax Description
(Optional) Specifies debugging of the AAA Lightweight Directory Access Protocol (LDAP) events. |
|
(Optional) Specifies debugging of the AAA local Extensible Authentication Protocol (EAP) events. |
|
Command Default
Examples
This example shows how to enable the debugging of AAA LDAP events:
Related Commands
debug aaa local-auth
To debug AAA local authentication on the controller, use the debug aaa local-auth command.
debug aaa local-auth { db | shim | eap { framework | method } { all | errors | events | packets | sm }} { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the debugging of the AAA local EAP authentication:
Related Commands
clear stats local-auth
config local-auth active-timeout
config local-auth eap-profile
config local-auth method fast
config local-auth user-credentials
show local-auth certificates
show local-auth config
show local-auth statistics
debug airewave-director
To configure the Airewave Director software debug options, use the debug airwave-director command.
debug airewave-director { all | channel | detail | error | group | manager | message | packet | power | profile | radar | rf-change } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the debugging of Airewave Director profile events:
Related Commands
debug ap
To enable or disable remote debugging of Cisco lightweight access points or to remotely execute a command on a lightweight access point, use the debug ap command.
debug ap { enable | disable | command cmd } cisco_ap
Syntax Description
Command Default
Examples
This example shows how to enable remote debugging on access point AP01:
This example shows how to execute the config ap location command on access point AP02:
This example shows how to execute the flash LED command on access point AP03:
Related Commands
debug ap enable
To enable or disable remote debugging of Cisco lightweight access points or to remotely execute a command on a lightweight access point, use the debug ap enable command.
debug ap { enable | disable | command cmd } cisco_ap
Syntax Description
Command Default
Examples
This example shows how to enable remote debugging on access point AP01:
This example shows how to disable remote debugging on access point AP02:
This example shows how to execute the flash LED command on access point AP03:
Related Commands
debug ap show stats
To troubleshoot video messages and statistics of Cisco lightweight access points, use the debug ap show stats command.
debug ap show stats { 802.11a | 802.11b } cisco_ap { tx-queue | packet | load | multicast | client { client_MAC | video | all } | video metrics }
Syntax Description
Command Default
Examples
This example shows how to troubleshoot the access point AP01’s transmit queue traffic on an 802.11a network:
This example shows how to troubleshoot the access point AP02’s multicast supported rates on an 802.11b/g network:
This example shows how to troubleshoot the metrics of a client identified by its MAC address, associated with the access point AP01 on an 802.11a network:
This example shows how to troubleshoot the metrics of all clients associated with the access point AP01 on an 802.11a network:
Related Commands
debug ap show stats video
To troubleshoot video messages and statistics of Cisco lightweight access points, use the debug ap show stats video command.
debug ap show stats video cisco_ap { multicast mgid mgid_value | admission | bandwidth }
Syntax Description
Dispalys multicast database related information for the specified MGID of an access point. |
|
Command Default
Examples
This example shows how to troubleshoot the access point AP01’s multicast group that is identified by the group’s Layer 2 MGID database number:
This example shows how to troubleshoot the access point AP01’s video bandwidth:
Related Commands
debug arp
To configure Address Resolution Protocol (ARP) debug options, use the debug arp command.
debug arp { all | detail | events | message } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable ARP debug settings:
This example shows how to disable ARP debug settings:
Related Commands
debug bcast
To configure debugging of broadcast options, use the debug bcast command.
debug bcast { all | error | message | igmp | detail } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable broadcast debug settings:
This example shows how to disable broadcast debug settings:
Related Commands
debug cac
To configure Call Admission Control (CAC) debug options, use the debug cac command.
debug cac { all | event | kts | packet }{ enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debug CAC settings:
Related Commands
config 802.11 cac video acm
config 802.11 { enable | disable } network
config 802.11 cac video max-bandwidth
config 802.11 cac video roam-bandwidth
config 802.11 cac video tspec-inactivity-timeout
config 802.11 cac voice acm
config 802.11 cac voice load-based
config 802.11 cac voice max-bandwidth
config 802.11 cac voice roam-bandwidth
config 802.11 cac voice stream-size
config 802.11 cac voice tspec-inactivity-timeout
debug call-control
To debug the SIP call control settings, use the debug call-control command.
debug call-control { all | event }{ enable | disable }
Syntax Description
Configures debugging options for all SIP call control messages. |
|
Command Default
Examples
This example shows how to enable debugging of all SIP call control messages:
debug capwap
To obtain troubleshooting information about Control and Provisioning of Wireless Access Points (CAPWAP) settings, use the debug capwap command.
debug capwap { detail | dtls-keepalive | errors | events | hexdump | info | packet | payload } { enable | disable }
Syntax Description
Configures debugging for CAPWAP DTLS data keepalive packets settings. |
|
Command Default
Examples
This example shows how to enable debug CAPWAP detail settings:
Related Commands
debug capwap reap
To obtain troubleshooting information about Control and Provisioning of Wireless Access Points (CAPWAP) settings on a FlexConnect access point, use the debug capwap reap command.
debug capwap reap [ mgmt | load ]
Syntax Description
Command Default
Examples
This example shows how to debug FlexConnect client authentication and association messages:
Related Commands
debug client
To debug if the passive client is associated correctly with the access point and if the passive client has moved into the DHCP required state at the controller, use the debug client command.
Syntax Description
Command Default
Examples
This example shows how to debug a passive client with mac address 00:0d:28:f4:c0:45:
Related Commands
debug crypto
To configure hardware cryptographic debug options, use the debug crypto command.
debug crypto { all | sessions | trace | warning } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable the debugging of hardware crypto sessions:
Related Commands
debug dhcp
To configure DHCP debug options, use the debug dhcp command.
debug dhcp { message | packet } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable DHCP debug settings:
Related Commands
config dhcp
config dhcp proxy
config interface dhcp
config wlan dhcp_server
debug dhcp service-port
debug disable-all
show dhcp
show dhcp proxy
debug dhcp service-port
To enable or disable debugging of Dynamic Host Configuration Protocol (DHCP) packets on the service port, use the debug dhcp service-port command.
debug dhcp service-port { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debugging of DHCP packets on a service port:
Related Commands
config dhcp
config dhcp proxy
config interface dhcp
config wlan dhcp_server
debug dhcp
debug disable-all
show dhcp
show dhcp proxy
debug disable-all
To disable all debug messages, use the debug disable-all command.
Syntax Description
Command Default
Examples
This example shows how to disable all debug messages:
debug dot11
To configure dot11 events debug options, use the debug dot11 command.
debug dot11 { all | load-balancing | management | mobile | nmsp | probe | rldp | rogue | state } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable dot11 debug settings:
Related Commands
debug disable-all
debug dot11 mgmt interface
debug dot11 mgmt msg
debug dot11 mgmt ssid
debug dot11 mgmt state-machine
debug dot11 mgmt station
debug dot11 mgmt interface
To debug 802.11 management interface events, use the debug dot11 mgmt interface command.
Syntax Description
Command Default
Examples
This example shows how to debug dot11 management interface events:
Related Commands
debug disable-all
debug dot11
debug dot11 mgmt msg
debug dot11 mgmt ssid
debug dot11 mgmt state-machine
debug dot11 mgmt station
debug dot11 mgmt msg
To debug 802.11 management messages, use the debug dot11 mgmt msg command.
Syntax Description
Command Default
Examples
This example shows how to debug dot11 management messages:
Related Commands
debug disable-all
debug dot11
debug dot11 mgmt interface
debug dot11 mgmt ssid
debug dot11 mgmt state-machine
debug dot11 mgmt station
debug dot11 mgmt ssid
To debug 802.11 Service Set Identifier (SSID) management events, use the debug dot11 mgmt ssid command.
Syntax Description
Command Default
Examples
This example shows how to debug dot11 SSID management events:
Related Commands
debug disable-all
debug dot11
debug dot11 mgmt interface
debug dot11 mgmt msg
debug dot11 mgmt state-machine
debug dot11 mgmt station
debug dot11 mgmt state-machine
To debug the 802.11 state machine, use the debug dot11 mgmt state-machine command.
debug dot11 mgmt state-machine
Syntax Description
Command Default
Examples
This example shows how to debug dot11 state machine settings:
Related Commands
debug disable-all
debug dot11
debug dot11 mgmt interface
debug dot11 mgmt msg
debug dot11 mgmt ssid
debug dot11 mgmt station
debug dot11 mgmt station
To debug client events, use the debug dot11 mgmt station command.
Syntax Description
Command Default
Examples
This example shows how to debug management station settings:
Related Commands
debug disable-all
debug dot11
debug dot11 mgmt interface
debug dot11 mgmt msg
debug dot11 mgmt ssid
debug dot11 mgmt state-machine
debug dot1x
To configure dot1x debug options, use the debug dot1x command.
debug dot1x { aaa | all | events | packet | states } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debugging of dot1x mobile state transitions:
This example shows how to disable debugging of all dot1x interactions:
Related Commands
debug disable-all
debug dot11
debug dot11 mgmt interface
debug dot11 mgmt msg
debug dot11 mgmt ssid
debug dot11 mgmt state-machine
debug dot11 mgmt station
debug ft events
To configure debugging of fast transition events, use the debug ft events command.
debug ft events { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debugging of fast transition events:
Related Commands
debug ft keys
To configure debugging of 802.11r key generation, use the debug ft keys command.
debug ft keys { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debugging of 802.11r key generation:
Related Commands
debug group
To enable or disable debugging of access point groups, use the debug group command.
debug group { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debugging of access point groups:
Related Commands
debug flexconnect aaa
To enable or disable debugging of FlexConnect backup RADIUS server events or errors, use the debug flexconnect aaa command.
debug flexconnect aaa { event | error } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debugging of FlexConnect RADIUS server events:
Related Commands
debug disable-all
debug flexconnect cckm
debug flexconnect group
config flexconnect group
show flexconnect group detail
show flexconnect group summary
show radius summary
debug flexconnect acl
To enable or disable debugging of FlexConnect access control lists (ACLs), use the debug flexconnect acl command.
debug flexconnect acl { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debugging of FlexConnect ACLs:
Related Commands
debug disable-all
debug flexconnect cckm
debug flexconnect group
config flexconnect group
show flexconnect group detail
show flexconnect group summary
show radius summary
debug flexconnect cckm
To enable or disable debugging of FlexConnect Cisco Centralized Key Management (CCKM) fast roaming, use the debug flexconnect cckm command.
debug flexconnect cckm { enable | disable }
Syntax Description
Enables debugging of FlexConnect CCKM fast roaming settings. |
|
Disables debugging of FlexConnect CCKM fast roaming settings. |
Command Default
Examples
This example shows how to enable debugging of FlexConnect CCKM fast roaming events:
Related Commands
debug disable-all
debug flexconnect aaa
debug flexconnect group
config flexconnect group
show flexconnect group detail
show flexconnect group summary
show radius summary
debug flexconnect group
To enable or disable debugging of FlexConnect access point groups, use the debug flexconnect group command.
debug flexconnect group { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debugging of FlexConnect access point groups:
Related Commands
debug disable-all
debug flexconnect aaa
debug flexconnect cckm
config flexconnect group
show flexconnect group detail
show flexconnect group summary
debug l2age
To configure debugging of Layer 2 age timeout messages, use the debug l2age command.
debug l2age { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable Layer2 age debug settings:
Related Commands
debug lwapp console cli
To begin debugging the access point console CLI, use the debug lwapp console cli command from the access point console port.
Syntax Description
Command Default
Usage Guidelines
This access point CLI command must be entered from the access point console port.
Examples
This example shows how to begin debugging the access point console:
Related Commands
debug mac
To configure MAC address debugging, use the debug mac command.
debug mac { disable | addr MAC }
Syntax Description
Command Default
Examples
This example shows how to configure MAC address debugging settings:
Related Commands
debug media-stream
To enable or disable media stream debugging, use the debug media-stream command.
debug media-stream { admission | config | errors | event | history | rrc} {enable | disable }
Syntax Description
Configures debugging of the media stream radio resource management. |
|
Command Default
Examples
This example shows how to enable debugging of the media stream history:
Related Commands
config media-stream multicast direct
show media-stream group summary
debug memory
To enable or disable debugging of errors or events during controller memory allocation, use the debug memory command
debug memory { errors | events } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debugging of memory leak events:
Related Commands
config memory monitor errors
config memory monitor leaks
show memory monitor
debug mesh security
To begin debugging mesh security problems, use the debug mesh security command.
debug mesh security { all | events | errors }{ enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable debugging of mesh security error messages:
Related Commands
debug mobility
To debug wireless mobility issues, use the debug mobility command.
debug mobility {{ directory | handoff | multicast } { enable | disable } |
keep-alive { enable | disable } IP_address
Syntax Description
Command Default
Examples
This example shows how to enable debugging of wireless mobility packets:
Related Commands
config guest-lan mobility anchor
config mobility group domain
config mobility group keepalive count
config mobility group keepalive interval
config mobility group member
config mobility group multicast-address
config mobility multicast-mode
config mobility secure-mode
config mobility statistics reset
config wlan mobility anchor
show mobility anchor
show mobility statistics
show mobility summary
debug nac
To configure debugging of Network Access Control (NAC), use the debug nac command.
debug nac { events | packet } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable NAC debug settings:
Related Commands
show nac statistics
show nac summary
config guest-lan nac
config wlan nac
debug nmsp
To configure debugging of the Network Mobility Services Protocol (NMSP), use the debug nmsp command.
debug nmsp { all | connection | detail | error | event | message | packet }
Syntax Description
Configures debugging for NMSP transmit and receive messages. |
|
Command Default
Examples
This example shows how to configure debugging of NMSP connection events:
Related Commands
debug ntp
To configure debugging of the Network Time Protocol (NTP), use the debug ntp command.
debug ntp { detail | low | packet } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable NTP debug settings:
Related Commands
debug packet logging
To configure logging of packets sent to the controller CPU, use the debug packet logging command.
debug packet logging { acl | disable | enable { rx | tx | all } packet_count display_size | format { hex2pcap | text2pcap }}
debug packet logging acl { clear-all | driver { rule_index action npu_encap port } | eoip-eth { rule_index action dst src type vlan }| eoip-ip { rule_index action src dst proto src_port dst_port } | eth { rule_index action dst src type vlan } | ip { rule_index action src dst proto src_port dst_port }| lwapp-dot11 { rule_index action dst src bssid type }| lwapp-ip { rule_index action src dst proto src_port dst_port }}
Syntax Description
Defaults
Examples
This example shows how to enable logging of the packets:
Related Commands
debug pem
To configure the access policy manager debug options, use the debug pem command.
debug pem { events | state } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable access policy manager debug settings:
Related Commands
debug pm
To configure debugging of the security policy manager module, use the debug pm command.
debug pm { all disable | { config | hwcrypto | ikemsg | init | list | message | pki | rng | rules |
sa-export | sa-import | ssh-l2tp | ssh-appgw | ssh-engine | ssh-int | ssh-pmgr | ssh-ppp | ssh-tcp } { enable | disable }}
Syntax Description
Command Default
Examples
This example shows how to configure debugging of PKI-related events:
Related Commands
debug poe
To configure debugging of Power over Ethernet (PoE) debug options, use the debug poe command.
debug poe { detail | error | message } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable PoE debug settings:
Related Commands
debug rbcp
To configure Router Blade Control (RBCP) debug options, use the debug rbcp command.
debug rbcp { all | detail | errors | packet } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable RBCP debug settings:
Related Commands
debug rfid
To configure radio-frequency identification (RFID) debug options, use the debug rfid command.
debug rfid { all | detail | errors | nmsp | receive } { enable | disable }
Syntax Description
Configures debugging of RFID Network Mobility Services Protocol (NMSP) messages. |
|
Command Default
Examples
This example shows how to enable debugging of RFID error messages:
Related Commands
debug service ap-monitor
To debug the access point monitor service, use the debug service ap-monitor command.
debug service ap-monitor { all | error | event | nmsp | packet } { enable | disable }
Syntax Description
Configures debugging of access point monitor Network Mobility Services Protocol (NMSP) events. |
|
Command Default
Examples
This example shows how to debug access point monitor NMSP events:
Related Commands
debug snmp
To configure SNMP debug options, use the debug snmp command.
debug snmp { agent | all | mib | trap } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable SNMP debug settings:
Related Commands
debug transfer
To configure transfer debug options, use the debug transfer command.
debug transfer { all | tftp | trace } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable transfer/upgrade settings:
Related Commands
debug voice-diag
To trace call or packet flow, use the debug voice-diag command.
debug voice-diag { enable client_mac1 [ client_mac2 ] [ verbose ] | disable }
Syntax Description
Command Default
Usage Guidelines
Follow these guidelines when you use the debug voice-diag command:
- When the command is entered, the validity of the client(s) is not checked.
- A few output messages of the command are sent to the WCS.
- The command expires automatically after 60 minutes.
- The command provides the details of the call flow between a pair of client MACs involved in an active call.
Note Voice diagnostics can be enabled for a maximum of two voice clients at a time.
Examples
This example shows how to enable transfer/upgrade settings:
Related Commands
debug web-auth
To configure debugs for web authenticated clients, use the debug web-auth command.
debug web-auth { redirect { enable mac mac_address | disable } | webportal-server { enable | disable }}
Syntax Description
Configures debug of web authenticated and redirected clients. |
|
Command Default
Examples
This example shows how to enable debugging of a web authenticated and redirected client:
Related Commands
debug wcp
To configure WLAN Control Protocol (WCP) debug options, use the debug wcp command.
debug wcp { events | packet } { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable WCP debug settings:
Related Commands
debug wps sig
To troubleshoot Wireless Provisioning Service (WPS) signature settings, use the debug wps sig command.
debug wps sig { enable | disable }
Syntax Description
Command Default
Examples
This example shows how to enable WPS signature settings:
Related Commands
debug wps mfp
To debug WPS Management Frame Protection (MFP) settings, use the debug wps mfp command.
debug wps mfp { client | capwap | detail | report | mm }{ enable | disable }
Syntax Description
Configures debugging for MFP messages between the controller and access points. |
|
Configures debugging for MFP mobility (inter-controller) messages. |
|
Command Default
Examples
This example shows how to enable debugging of WPS MFP settings:
Related Commands
eping
To test the mobility Ethernet over IP (EoIP) data packet communication between two controllers, use the eping command.
eping mobility_peer_IP_address
Syntax Description
IP address of a controller that belongs to a mobility group. |
Command Default
Usage Guidelines
This command tests the mobility data traffic over the management interface.
Note This ping test is not Internet Control Message Protocol (ICMP) based. The term “ping” is used to indicate an echo request and an echo reply message.
Examples
This example shows how to test EoIP data packets and to set the IP address of a controller that belongs to a mobility group to 172.12.35.31:
Related Commands
mping
To test mobility UDP control packet communication between two controllers, use the mping command.
mping mobility_peer_IP_address
Syntax Description
IP address of a controller that belongs to a mobility group. |
Command Default
Usage Guidelines
This test runs over mobility UDP port 16666. It tests whether the mobility control packet can be reached over the management interface.
Note This ping test is not Internet Control Message Protocol (ICMP) based. The term “ping” is used to indicate an echo request and an echo reply message.
Examples
This example shows how to test mobility UDP control packet communications and to set the IP address of a controller that belongs to a mobility group to 172.12.35.31:
Related Commands
eping
config logging buffered debugging
show logging
debug mobility handoff enable
Integrated Management Module Commands in Cisco Flex 7500 Series Controllers
Use the imm commands to manage the Integrated Management Module (IMM) in the Cisco Flex 7500 Series Controllers.
imm address
To configure the static IP address of the IMM, use the imm address command.
imm address ip-addr netmask gateway
Syntax Description
Command Default
Examples
This example shows how to set the static IP address of an IMM:
Related Commands
imm dhcp
To configure DHCP for the IMM, use the imm dhcp command.
imm dhcp { enable | disable | fallback }
Syntax Description
Enables DHCP for the IMM, but if it fails, then uses static IP of the IMM |
Command Default
Examples
This example shows how to enable DHCP for the IMM:
Related Commands
imm mode
To configure the IMM mode, use the imm mode command.
imm mode { shared | dedicated }
Syntax Description
Command Default
Examples
This example shows how to set the IMM in shared mode:
Related Commands
imm restart
To restart the IMM, use the imm restart command.
Syntax Description
Command Default
Related Commands
imm summary
To view the IMM parameters, use the imm summary command.
Syntax Description
Command Default
Examples
This example shows a typical summary of the IMM:
Related Commands
imm username
To configure the logon credentials for a user of the IMM, use the imm username command.
imm username username password
Syntax Description
Examples
This example shows how to set the logon credentials for a user of the IMM: