config ap link-encryption {enable | disable} {all | Cisco_AP}

The default value is disabled.

show ap link-encryption {all | Cisco_AP}

This command also shows authentication errors, which tracks the number of integrity check failures, and replay errors, which tracks the number of times that the access point receives the same packet.

show dtls connections

config network master-base disable

• Choose Monitor > Access Points Summary > 802.11a/n (or 802.11b/g/n) > Radios > Details to open the 802.11a/n (or 802.11b/g/n) Radios page.

• Choose Wireless > Access Points > Radios > 802.11a/n (or 802.11b/g/n) to open the 802.11a/n (or 802.11b/g/n) Radios page.

  These pages show all of the 802.11a/n or 802.11b/g/n access point radios that are joined to the controller and their current settings.

  The total number of access point radios appears in the upper right-hand corner of the page. If the list of radios spans multiple pages, you can access these pages by clicking the page number links. Each page shows up to 25 access point radios.

  Note	In a Cisco Unified Wireless Network environment, the 802.11a/n and 802.11b/g/n radios should not be differentiated based on their Base Radio MAC addresses, as they may have the same addresses. Instead, the radios should be differentiated based on their physical addresses.

• MAC Address—Base radio MAC address of an access point radio.

• AP Name—Access point name.

  Note	When you enable the MAC address filter, the other filters are disabled automatically. When you enable any of the other filters, the MAC address filter is disabled automatically.

• CleanAir Status—Select one or more of the following check boxes to specify the operating status of the access points:

  • UP—The spectrum sensor for the access point radio is currently operational.

  • DOWN—The spectrum sensor for the access point radio is currently not operational because an error has occurred. The most likely reason for the error is that the access point radio is disabled.

  • ERROR—The spectrum sensor for the access point radio has crashed, making CleanAir monitoring nonoperational for this radio. We recommend rebooting the access point or disabling CleanAir functionality on the radio.

  • N/A—The access point radio is not capable of supporting CleanAir functionality. Currently, only Cisco Aironet 3500 series access point radios can be configured for Cisco CleanAir.

You can set a global username, password, and enable password that all access points inherit as they join the controller including access points that are currently joined to the controller and any that join in the future. You can override the global credentials and assign a unique username, password, and enable password for a specific access point. The following are requirements enforced on the password:

• The password should contain characters from at least three of the following classes: lowercase letters, uppercase letters, digits, and special characters.

• No character in the password can be repeated more than three times consecutively.

• The password should not contain the management username or the reverse of the username.

• The password should not contain words like Cisco, oscic, admin, nimda or any variant obtained by changing the capitalization of letters by substituting 1, |, or ! or substituting 0 for o or substituting $ for s.

1. Choose Access Points > All APs to open the All APs page.
2. Click the name of the access point for which you want to override the global credentials.
3. Choose the Credentials tab. The All APs > Details for (Credentials) page appears.
4. Select the Over-ride Global Credentials check box to prevent this access point from inheriting the global username, password, and enable password from the controller. The default value is unselected.
5. In the Username, Password, and Enable Password text boxes, enter the unique username, password, and enable password that you want to assign to this access point.

   Note	The information that you enter is retained across controller and access point reboots and if the access point joins a new controller.

6. Click Apply to commit your changes.
7. Click Save Configuration to save your changes.

   Note	If you want to force this access point to use the controller’s global credentials, unselect the Over-ride Global Credentials check box.

The credentials that you enter in this command are retained across controller and access point reboots and if the access point joins a new controller.

show ap summary

To view summary of specific access point you can specify the access point name. You can also use wildcard searches when filtering for access points.

config ap tftp-downgrade tftp-server-ip-address filename access-point-name

Enter the Ethernet MAC address for all APs except when in bridge mode (where you need to enter the radio Mac address).

1. Click Add to access the Add AP to Authorization List area.
2. In the MAC Address text box, enter the MAC address of the access point.
3. From the Certificate Type drop-down list, choose MIC, SSC, or LSC.
4. Click Add. The access point appears in the access point authorization list.

   Note	To remove an access point from the authorization list, hover your cursor over the blue drop-down arrow for the access point and choose Remove.

   Note	To search for a specific access point in the authorization list, enter the MAC address of the access point in the Search by MAC text box and click Search.

• To configure a global syslog server for all access points that join this controller, enter this command:

  config ap syslog host global syslog_server_IP_address

  Note

  By default, the global syslog server IPv4/IPv6 address for all access points is 255.255.255.255. Make sure that the access points can reach the subnet on which the syslog server resides before configuring the syslog server on the controller. If the access points cannot reach this subnet, the access points are unable to send out syslog messages.

  Note	Only one Syslog Server is used for both IPv4 and IPv6.

• To configure a syslog server for a specific access point, enter this command:

  config ap syslog host specific Cisco_AP syslog_server_IP_address

  Note	By default, the syslog server IPv4/IPv6 address for each access point is 0.0.0.0, which indicates that the access point is not yet set. When the default value is used, the global access point syslog server IP address is pushed to the access point.

show ap config global

Information similar to the following appears:

AP global system logging host.................... 255.255.255.255


show ap config general Cisco_AP

config ap crash-file get-radio-core-dump slot Cisco_AP

For the slot parameter, enter the slot ID of the radio that crashed.

show ap crash-file

• TFTP
• FTP

1. In the Server Login Username text box, enter the FTP server login name.
2. In the Server Login Password text box, enter the FTP server login password.
3. In the Server Port Number text box, enter the port number of the FTP server. The default value for the server port is 21.

• transfer upload mode {tftp | ftp}

• transfer upload datatype radio-core-dump

• transfer upload serverip server_ip_address

• transfer upload path server_path_to_file

• transfer upload filename filename

  Note	The filename that you enter should match the filename generated on the controller. You can determine the filename on the controller by entering the show ap crash-file command.

  Note

  Ensure that the filename and server_path_to_file do not contain these special characters: \, :, *, ?, ", <, >, and |. You can use only / (forward slash) as the path separator. If you use the disallowed special characters in the filename, then the special characters are replaced with _ (underscores); and if you use the disallowed special characters in the server_path_to_file, then the path is set to the root path.

• transfer upload username username

• transfer upload password password

• transfer upload port port

  Note	The default value for the port parameter is 21.

transfer upload start

config ap core-dump enable tftp_server_ip_address filename {compress | uncompress} {ap_name | all}

where

• tftp_server_ip_address is the IP address of the TFTP server to which the access point sends core dump files.

  Note	The access point must be able to reach the TFTP server.

• filename is the name that the access points uses to label the core file.

• compress configures the access point to send compressed core files whereas uncompress configures the access point to send uncompressed core files.

  Note	When you choose compress, the file is saved with a .gz extension (for example, dump.log.gz). This file can be opened with WinZip.

• ap_name is the name of a specific access point for which core dumps are uploaded and all is all access points converted to lightweight mode.

show ap crash-file

Information similar to the following appears:

Local Core Files:
lrad_AP1130.rdump0 (156)
The number in parentheses indicates the size of the file. The size should be greater than zero if a core dump file is available.

show ap crash-file Cisoc_AP

1. In the DNS IP Address text box, enter the IPv4/IPv6 address of the DNS server.
2. In the Domain Name text box, enter the name of the domain to which the access point belongs.
3. Click Apply to commit your changes.
4. Click Save Configuration to save your changes.

For IPv4—config ap static-ip enable Cisco_AP ip_address mask gateway

For IPv6—config ap static-ip enable Cisco_AP ip_address prefix_length gateway

The access point reboots and rejoins the controller, and the static IP address that you specified in Step 1 is pushed to the access point.

1. To specify a DNSv4/DNSv6 server so that a specific access point or all access points can discover the controller using DNS resolution, enter this command:

   config ap static-ip add nameserver {Cisco_AP | all} ip_address

   Note	To delete a DNSv4/DNSv6 server for a specific access point or all access points, enter the config ap static-ip delete nameserver {Cisco_AP | all} command.

2. To specify the domain to which a specific access point or all access points belong, enter this command:

   config ap static-ip add domain {Cisco_AP | all} domain_name

   Note	To delete a domain for a specific access point or all access points, enter this command: config ap static-ip delete domain {Cisco_AP | all}.

3. Enter the save config command to save your changes.

• For IPv4:

  show ap config general Cisco_AP

  Information similar to the following appears:

  show ap config general <Cisco_AP>
  
  Cisco AP Identifier.............................. 4
  Cisco AP Name................................. AP6
  ...
  IP Address Configuration......................... Static IP assigned
  IP Address....................................... 10.10.10.118
  IP NetMask....................................... 255.255.255.0
  Gateway IP Addr............................... 10.10.10.1
  
  Domain........................................... Domain1
  Name Server................................... 10.10.10.205
...

  

• For IPv6:

  show ap config general Cisco_AP

  Information similar to the following appears:

  show ap config general <Cisco_AP>
  
  Cisco AP Identifier.............................. 16
  Cisco AP Name.................................... AP2602I-A-K9-1
  ...
  IPv6 Address Configuration....................... DHCPv6
  IPv6 Address..................................... 2001:9:2:16:1ae:a1da:c2c7:44b
  IPv6 Prefix Length............................... 128
  Gateway IPv6 Addr................................ fe80::c60a:cbff:fe79:53c4
  NAT External IP Address.......................... None
  
  ...
  IPv6 Capwap UDP Lite............................. Enabled
  Capwap Prefer Mode............................... Ipv6 (ApGroup Config)
  Hotspot Venue Group.............................. Unspecified
  Hotspot Venue Type............................... Unspecified
  DNS server IP ............................. Not Available
  

The range for the AP Fast Heartbeat Timeout value for Cisco Flex 7500 Controllers is 10–15 (inclusive) and is 1–10 (inclusive) for other controllers. The default value for the heartbeat timeout for Cisco Flex 7500 Controllers is 10. The default value for other controllers is 1 second.

The range for the FlexConnect Mode AP Fast Heartbeat Timeout value for Cisco Flex 7500 Controllers is 10–15 (inclusive) and is 1–10 for other controllers. The default value for the heartbeat timeout for Cisco Flex 7500 Controllers is 10. The default value for other controllers is 1 second.

1. Choose Access Points > All APs to open the All APs page.
2. Click the name of the access point for which you want to configure primary, secondary, and tertiary backup controllers.
3. Choose the High Availability tab to open the All APs > Details for (High Availability) page.
4. If desired, enter the name and IP address of the primary controller for this access point in the Primary Controller text boxes.

   Note

   Entering an IP address for the backup controller is optional in this step and the next two steps. If the backup controller is outside the mobility group to which the access point is connected (the primary controller), then you need to provide the IP address of the primary, secondary, or tertiary controller, respectively. The controller name and IP address must belong to the same primary, secondary, or tertiary controller. Otherwise, the access point cannot join the backup controller.

5. If desired, enter the name and IP address of the secondary controller for this access point in the Secondary Controller text boxes.
6. If desired, enter the name and IP address of the tertiary controller for this access point in the Tertiary Controller text boxes.
7. Click Apply to commit your changes.

config ap primary-base controller_name Cisco_AP [controller_ip_address]

config ap secondary-base controller_name Cisco_AP [controller_ip_address]

config ap tertiary-base controller_name Cisco_AP [controller_ip_address]

config advanced backup-controller primary system name ip_addr

config advanced backup-controller secondary system name ip_addr

config advanced timers ap-fast-heartbeat {local | flexconnect | all} {enable | disable} interval

where all is both local and FlexConnect access points, and interval is a value between 1 and 10 seconds (inclusive). Specifying a small heartbeat interval reduces the amount of time that it takes to detect a controller failure. The default value is disabled.Configure the access point heartbeat timer by entering this command:

config advanced timers ap-heartbeat-timeout interval

where interval is a value between 1 and 30 seconds (inclusive). This value should be at least three times larger than the fast heartbeat timer. The default value is 30 seconds.

config advanced timers ap-primary-discovery-timeout interval

where interval is a value between 30 and 3600 seconds. The default value is 120 seconds.

config advanced timers ap-discovery-timeout interval

where interval is a value between 1 and 10 seconds (inclusive). The default value is 10 seconds.

config advanced timers auth-timeout interval

where interval is a value between 5 and 600 seconds (inclusive). The default value is 10 seconds.

save config

• show ap config general Cisco_AP

• show advanced backup-controller

• show advanced timers

Information similar to the following appears for the show ap config general Cisco_AP command for Primary Cisco Switch IP Address using IPv4:

Cisco AP Identifier.............................. 1
Cisco AP Name.................................... AP5
Country code..................................... US  - United States
Regulatory Domain allowed by Country............. 802.11bg:-AB    802.11a:-AB
AP Country code.................................. US  - United States
AP Regulatory Domain............................. 802.11bg:-A    802.11a:-N
Switch Port Number .............................. 1
MAC Address...................................... 00:13:80:60:48:3e
IP Address Configuration......................... DHCP
IP Address....................................... 1.100.163.133
...
Primary Cisco Switch Name........................ 1-5508
Primary Cisco Switch IP Address.................. 2.2.2.2
Secondary Cisco Switch Name...................... 1-4404
Secondary Cisco Switch IP Address................ 2.2.2.2
Tertiary Cisco Switch Name....................... 2-4404
Tertiary Cisco Switch IP Address................. 1.1.1.4
...


Information similar to the following appears for the show ap config general Cisco_AP command for Primary Cisco Switch IP Address using IPv6:

Cisco AP Identifier.............................. 1
Cisco AP Name.................................... AP6
Country code..................................... US - United States
Regulatory Domain allowed by Country............. 802.11bg:-A 802.11a:-A
AP Country code.................................. US - United States
AP Regulatory Domain............................. 802.11bg:-A 802.11a:-A
Switch Port Number .............................. 13
MAC Address...................................... 44:2b:03:9a:9d:30
IPv6 Address Configuration....................... DHCPv6
IPv6 Address..................................... 2001:9:5:96:295d:3b2:2db2:9b47
IPv6 Prefix Length............................... 128
Gateway IPv6 Addr................................ fe80::6abd:abff:fe8c:764a
NAT External IP Address.......................... None
CAPWAP Path MTU.................................. 1473
Telnet State..................................... Globally Disabled
Ssh State........................................ Globally Disabled
Cisco AP Location................................ _5500
Cisco AP Floor Label............................. 0
Cisco AP Group Name.............................. IPv6-Same_VLAN
Primary Cisco Switch Name........................ Maulik_WLC_5500-HA
Primary Cisco Switch IP Address.................. 2001:9:5:95::11

Information similar to the following appears for the show advanced backup-controller command when configured using IPv4:

AP primary Backup Controller .................... controller1 10.10.10.10
AP secondary Backup Controller ............... 0.0.0.0

Information similar to the following appears for the show advanced backup-controller command when configured using IPv6:

AP primary Backup Controller .................... WLC_5500-2 fd09:9:5:94::11
AP secondary Backup Controller .................. vWLC 9.5.92.11

Information similar to the following appears for the show advanced timers command: