Cisco 1200 Access Point

Cisco's 1200 Series access point is the standard-bearer for standalone access points. It runs a version of Cisco's Internetwork Operating System (IOS). At first, 1200s ran a system based on VxWorks, but Cisco released an IOS upgrade to bring the 1200 in to the fold. The upgrade tool is available from Cisco's support web site. No new features or continuing development has been done on VxWorks for quite some time.

On an individual basis, the Cisco 1200 can be managed from either a web interface or an IOS command-line interface. Larger installations can be managed through the Wireless LAN Solutions Engine (WLSE). The command-line interface is available through a local console serial cable with a Cisco RJ-45 pinout, or once the network interface is configured, telnet or SSH.

Setting Up the 1200

Hardware setup on the 1200 is straightforward. It may be powered either from a local power supply or with a Cisco-specific power injector. The power circuitry is the same. The power supply puts out 48 volts, just as a power injector would.

The 1200 uses a Bridge-group Virtual Interface (BVI). BVIs are a software construct used in IOS that allows routing and bridging of protocols over the same interface. APs need to bridge 802.11 frames to 802.3, but also need to route IP for management purposes, which makes BVIs the obvious choice. Configure the IP address on a BVI from the global configuration prompt. APs may get their IP address either from a static assignment, or from a built-in DHCP client. Both commands are shown below:

ap1200# configure terminal ap1200(config)# interface BVI1 ap1200(config-if)# ip address 192.168.1.5 255.255.255.0 ap1200(config-if)# ip address dhcp client-id FastEthernet0

To check on the status of the interface and see what addresses have been assigned, use show ip interface:

ap1200#show ip interface brief Interface IP-Address OK? Method Status Protocol Dot11Radio0 unassigned YES TFTP up up FastEthernet0 unassigned YES NVRAM up up Virtual-Dot11Radio0 unassigned YES TFTP down down BVI1 192.168.5.191 YES DHCP up up

Configuring Radio Interfaces

The 1200 has two radios. Radio 0 is the 2.4 GHz radio, which is usually 802.11g, but may be 802.11b in older hardware. Radio 1 is the 5 GHz radio. Each radio can be configured independently by using the interface configuration commands. Data rates can be allowed simply by entering them with the speed command, or they may be labeled as required by prefacing them with basic-. In the following command list, the first speed command allows all data rates. The second requires 1 Mbps and 2 Mbps operation, but allows 5.5 Mbps and 11 Mbps operation. The last two are special. speed range allows all, but requires only the slowest speed. speed throughput sets all data rates to required.

ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# speed 1.0 2.0 5.5 11.0 ap1200(config-if)# speed basic-1.0 basic-2.0 5.5 11.0 ap1200(config-if)# speed range ap1200(config-if)# speed throughput

Transmission power may be configured for each radio by setting a local maximum power in milliwatts. Like speed, power is an interface-specific configuration command. 802.11b/g radios are capable of up to 100 mW power. Due to limitations in chip design with OFDM, 802.11a radios are only capable of 40 mW transmission.

ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# power local 100

In addition to power settings, the operating channel may be configured for each radio with the channel command. As an argument, channel takes the frequency in MHz. Alternatively, using the least-congested keyword will force the AP to monitor all channels and pick the clearest one.

ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# channel 2412 ap1200(config-if)# channel least-congested

Two different types of 802.11b preambles are used. Long preambles are more compatible, but short preambles give much better performance. Generally, this option should be set to short unless there is a known older device that needs to use the network. To disable short preamble, use the no preamble-short interface command.

ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# no preamble-short

Beacon frames are used to announce the existence of a network, as well as announce buffered with DTIM information elements. The Beacon interval can be tuned to balance delivery of buffered frames with battery consumption using the beacon period and beacon dtim-period commands.

ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# beacon period 100 ap1200(config-if)# beacon dtim-period 5

In addition to the Beacon interval, the RTS/CTS threshold can be configured. Lower values will cause RTS/CTS handshaking to occur. Depending on the environment, it might also be worth altering the number of times a frame will be retransmitted, or the threshold at which it will be fragmented using the following commands.

ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# rts threshold 2000 ap1200(config-if)# rts retries 2 ap1200(config-if)# packet retries 8 ap1200(config-if)# fragment-threshold 1500

Internetworking

Different clients will encapsulate frames in different ways. By far the most common is to use RFC 1042 SNAP encapsulation, which is the default. IOS allows configuration of 802.1H as well. The setting is global for a radio, and cannot be configured on a per-protocol basis.

ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# payload-encapsulation snap ap1200(config-if)# payload-encapsulation dot1h

With dynamic VLAN assignment, the use of VLANs on the wired side is becoming increasingly common. IOS on the 1200 supports both native and tagged VLANs. It is important to assign VLAN 1, the native VLAN, to the same IP network as other devices on the network to ensure communication across the so-called native VLAN. The native VLAN is noted by adding the keyword native at the end of an encapsulation command for the subinterface.

ap1200# configure terminal ap1200(config)# interface dot11radio0.1 ap1200(config-subif)# encapsulation dot1q 1 native ap1200(config-subif)# interface fastethernet0.1 ap1200(config-subif)# encapsulation dot1q 1 native

Further VLANs can be configured in a similar way, omitting the native. It is common practice to keep the subinterface number equal to the VLAN tag. For example, to configure VLAN 10, the following commands would be used. To configure VLAN 20, all the references to 10 would be replaced with 20.

ap1200# configure terminal ap1200(config)# interface dot11radio0.10 ap1200(config-subif)# encapsulation dot1q 10 ap1200(config-subif)# interface fastethernet0.10 ap1200(config-subif)# encapsulation dot1q 10

Configuring Security

Radio networks are broadcast from an AP as an SSID. Each SSID acts somewhat like its own virtual self-contained access point within the 1200. Each SSID can have its own security configuration, as well as its own VLAN mapping. Interestingly enough, the VLAN mapping is slightly spongy. A default VLAN can be assigned to an SSID. If the RADIUS server in use returns a different VLAN, the client device will be re-mapped on to the specified VLAN.[] The per-SSID default will only be used when nothing is supplied by the RADIUS server. (This approach is not quite as clean as many other products on the market, which work on an either/or basis with default VLANs and RADIUS servers.)

[] Cisco APs require a set of RADIUS tunnel attributes to be supplied, and they must be tagged. It requires the Tunnel-Type attribute to be set to "VLAN", the Tunnel-Medium-Type attribute to be set to IEEE-802, and the Tunnel-Private-Group-ID attribute to be set to the VLAN ID.

Authentication to each SSID is configured using the authentication command. In general, this command will be set to "open" authentication, but may add EAP authentication as an optional method. The following commands configure an SSID of babelfish to map to VLAN 42 while requiring EAP authentication against the server group rad_eap.

ap1200# configure terminal ap1200(config)# interface dot11radio 0 ap1200(config-if)# ssid babelfish ap1200(config-ssid)# vlan 42 ap1200(config-ssid)# authentication open eap rad_eap

To define the RADIUS server for EAP authentication, define each server, and associate it with a group. By default, RADIUS servers that are not assigned UDP ports are assigned to the old RADIUS ports (1645 and 1646), so they must be explicitly assigned to the new ports.

ap1200# configure terminal ap1200(config)#radius-server host 192.168.200.187 auth-port 1645 acct-port 1646 key MySecret ap1200(config)#radius-server host 192.168.200.188 auth-port 1812 acct-port 1813 key MySecret ap1200(config)#aaa group server radius rad_eap ap1200(config-sg-radius)#server 192.168.200.187 auth-port 1645 acct-port 1646 ap1200(config-sg-radius)#server 192.168.200.188 auth-port 1812 acct-port 1813

Configuring WPA-PSK

WPA preshared keys are configured through the SSID command. By setting the SSID up for WPA key management, it is possible to specify either an ASCII or hexadecimal pre-shared key for use with WPA.

ap1200(config)#interface dot11radio 0 ap1200(config-if)#ssid LuminiferousEther ap1200(config-ssid)#authentication key-management wpa optional ap1200(config-ssid)#wpa-psk ascii Thisisaverylongsecretpresharedkey!

Monitoring

A basic monitoring tool is the list of associated stations, which can be obtained from an unprivileged prompt:

ap1200> show dot11 association 802.11 Client Stations on Dot11Radio0: SSID [LuminiferousEther] : MAC Address IP address Device Name Parent State 0002.2d6e.abda 192.168.200.150 - - self Assoc

To view details on a particular association, ask for it by MAC address. The complete association record will be printed out, including the types of encryption in use. This station is associated and uses TKIP for encryption.

ap1200> show dot11 association 0002.2d6e.abda Address : 0002.2d6e.abda Name : IP Address : 192.168.200.150 Interface : Dot11Radio 0 Device : - Software Version : CCX Version : State : Assoc Parent : self SSID : LuminiferousEther VLAN : 0 Hops to Infra : 1 Association Id : 120 Clients Associated: 0 Repeaters associated: 0 Tunnel Address :0.0.0.0 Key Mgmt type : WPA PSK Encryption : TKIP Current Rate : 11.0 Capability : Supported Rates : 1.0 2.0 5.5 11.0 Signal Strength : -39 dBm Connected for : 1463 seconds Signal Quality : 79 % Activity Timeout : 55 seconds Power-save : Off Last Activity : 4 seconds ago Packets Input : 535 Packets Output : 245 Bytes Input : 61629 Bytes Output : 137018 Duplicates Rcvd : 0 Data Retries : 18 Decrypt Failed : 0 RTS Retries : 0 MIC Failed : 0 MIC Missing : 0

Troubleshooting

IOS has extensive debugging facilities that can be used to troubleshoot problems. Tracing is activated by the debug command, which is followed by the area to perform tracing on. By default, tracing is sent to the console. If you are attached to the device over the network, you will need to send the debugging output to the current login screen with the following command:

ap1200# terminal monitor

The most troublesome part of working with secure 802.11 networks is the initial association and key distribution phase. Troubleshooting of these actions can be accomplished with debug dot11 and its subcommands. Some common troubleshooting debugging commands are shown in Table 20-2.

Turning off debugging is simple. Just enter the following command:

ap1200# undebug all