Alcatel-Lucent AOS-W 6.5.3.x User manual

AOS-W 6.5.3.x
User Guide

Revision 01 | June 2017 AOS-W 6.5.3.x | User Guide
Copyright Information
Alcatel-Lucent and the Alcatel-Lucent Enterprise logo are trademarks of Alcatel-Lucent. To view other
trademarks used by affiliated companies of ALE Holding, visit:
enterprise.alcatel-lucent.com/trademarks
All other trademarks are the property of their respective owners. The information presented is subject to
change without notice. Neither ALE Holding nor any of its affiliates assumes any responsibility for inaccuracies
contained herein. (2017)
Open Source Code
This product includes code licensed under the GNU General Public License, the GNU Lesser General Public
License, and/or certain other open source licenses.

AOS-W 6.5.3.x |User Guide Contents | 3
Contents
Contents 3
Revision History 18
About this Guide 19
What's New In AOS-W 6.5.x 19
Fundamentals 31
Related Documents 32
Conventions 32
Contacting Support 34
The Basic User-Centric Networks 35
Understanding Basic Deployment and Configuration Tasks 35
Switch Configuration Workflow 38
Connect the Switch to the Network 39
OAW-40xx Series and OAW-4x50 Series Switches 40
Using the LCD Screen 42
Configuring a VLAN to Connect to the Network 45
Enabling Wireless Connectivity 49
Enabling Wireless Connectivity 49
Configuring Your User-Centric Network 49
Replacing a Switch 49
Control Plane Security 56
Control Plane Security Overview 57
Configuring Control Plane Security 57
Managing AP Whitelists 59
Managing Whitelists on Master and Local Switches 66
Working in Environments with Multiple Master Switches 70
Replacing a Switch on a Multi-Switch Network 73

4| Contents AOS-W 6.5.3.x| User Guide
Configuring Control Plane Security after Upgrading 76
Troubleshooting Control Plane Security 77
Software Licenses 79
Getting Started with AOS-W Licenses 79
License Types and Usage 79
Licensing Best Practices and Limitations 82
Centralized Licensing Overview 83
Configuring Centralized Licensing 89
Installing a License 91
Deleting a License 93
Monitoring and Managing Centralized Licenses 94
Network Configuration Parameters 97
Campus WLAN Workflow 97
Understanding VLAN Assignments 98
Configuring VLANs 105
Configuring Ports 110
Configuring Static Routes 113
Configuring the Loopback IP Address 113
Configuring the Switch IP Address 114
Configuring GRE Tunnels 115
Configuring GRE Tunnel Groups 124
Jumbo Frame Support 127
IPv6 Support 130
Understanding IPv6 Notation 130
Understanding IPv6 Topology 130
Enabling IPv6 131
Enabling IPv6 Support for Switch and APs 131
Filtering an IPv6 Extension Header (EH) 139
Configuring a Captive Portal over IPv6 139

Working with IPv6 Router Advertisements (RAs) 140
RADIUS Over IPv6 144
TACACS Over IPv6 145
DHCPv6 Server 146
Understanding AOS-W Supported Network Configuration for IPv6 Clients 148
Understanding AOS-W Authentication and Firewall Features that Support IPv6 149
Managing IPv6 User Addresses 154
Understanding IPv6 Exceptions and Best Practices 155
Link Aggregation Control Protocol 157
Understanding LACP Best Practices and Exceptions 157
Configuring LACP 158
LACP Sample Configuration 160
OSPFv2 161
Understanding OSPF Deployment Best Practices and Exceptions 161
Understanding OSPFv2 by Example using a WLAN Scenario 162
Understanding OSPFv2 by Example using a Branch Scenario 163
Configuring OSPF 165
Sample Topology and Configuration 166
Authentication Servers 178
Understanding Authentication Server Best Practices and Exceptions 178
Understanding Servers and Server Groups 178
Configuring Authentication Servers 179
Managing the Internal Database 196
Configuring Server Groups 199
Assigning Server Groups 205
Configuring Authentication Timers 210
Authentication Server Load Balancing 211
MAC-based Authentication 212
Configuring MAC-Based Authentication 212
AOS-W 6.5.3.x |User Guide Contents | 5

6| Contents AOS-W 6.5.3.x| User Guide
Configuring Clients 213
BranchSwitch Config for Cloud Services Switches 215
Branch Deployment Features 216
Scalable Site-to-Site VPN Tunnels 217
Layer-3 Redundancy for Branch Switch Masters 217
WAN Failure (Authentication) Survivability 218
WAN Health Check 224
WAN Optimization through IP Payload Compression 224
Interface Bandwidth Contracts 225
Branch Integration with a Palo Alto Networks (PAN) Portal 226
Branch Switch Routing Features 229
Cloud Management 230
Zero-Touch Provisioning 230
Using Smart Config to create a Branch Config Group 233
PortFast and BPDU Guard 254
Preventing WANLink Failure on Virtual APs 257
Branch WAN Dashboard 257
802.1X Authentication 259
Understanding 802.1X Authentication 259
Configuring 802.1X Authentication 262
Enabling 802.1X Supplicant Support on an AP 270
Sample Configurations 271
Performing Advanced Configuration Options for 802.1X 287
Application Single Sign-On Using L2 Authentication 287
Device Name as User Name for Non-802.1X Authentication 290
Stateful and WISPr Authentication 291
Working With Stateful Authentication 291
Working With WISPr Authentication 292
Understanding Stateful Authentication Best Practices 292

Configuring Stateful 802.1X Authentication 292
Configuring Stateful NTLM Authentication 293
Configuring Stateful Kerberos Authentication 294
Configuring WISPr Authentication 295
Certificate Revocation 298
Understanding OCSP and CRL 298
Configuring the Switch as an OCSP Client 299
Configuring the Switch as a CRL Client 301
Configuring the Switch as an OCSP Responder 302
Certificate Revocation Checking for SSH Pubkey Authentication 303
OCSPConfiguration for AOS-W VIA 304
Captive Portal Authentication 306
Understanding Captive Portal 306
Configuring Captive Portal in the Base Operating System 307
Using Captive Portal with a PEFNG License 309
Sample Authentication with Captive Portal 312
Configuring Guest VLANs 318
Configuring Captive Portal Authentication Profiles 319
Enabling Optional Captive Portal Configurations 324
Personalizing the Captive Portal Page 328
Creating and Installing an Internal Captive Portal 330
Creating Walled Garden Access 339
Enabling Captive Portal Enhancements 341
Netdestination for AAAA Records 345
Virtual Private Networks 346
Planning a VPN Configuration 346
Working with VPN Authentication Profiles 350
Configuring a Basic VPN for L2TP/IPsec 352
Configuring a VPN for L2TP/IPsec with IKEv2 356
AOS-W 6.5.3.x |User Guide Contents | 7

8| Contents AOS-W 6.5.3.x| User Guide
Configuring a VPN for Smart Card Clients 361
Configuring a VPN for Clients with User Passwords 362
Configuring Remote Access VPNs for XAuth 363
Working with Remote Access VPNs for PPTP 364
Working with Site-to-Site VPNs 365
Working with VPN Dialer 373
Roles and Policies 375
Configuring Firewall Policies 375
User Roles 385
Assigning User Roles 387
Understanding Global Firewall Parameters 393
Using AppRF 2.0 397
ClearPass Policy Manager Integration 402
Introduction 402
Important Points to Remember 402
Enabling Downloadable Role on a Switch 403
Sample Configuration 403
Virtual APs 411
Virtual AP Configuration Workflow 411
Virtual AP Profiles 412
Changing a Virtual AP Forwarding Mode 420
Radio Resource Management (802.11k) 420
BSSTransition Management (802.11v) 428
Fast BSS Transition ( 802.11r) 428
SSIDProfiles 430
WLAN Authentication 438
High-Throughput Virtual APs 441
Guest WLANs 446
Changing a Virtual AP Forwarding Mode 449

Adaptive Radio Management 450
Understanding ARM 450
Client Match 452
ARM Coverage and Interference Metrics 454
Configuring ARM Profiles 455
Assigning an ARM Profile to an AP Group 465
Using Multi-Band ARM for 802.11a/802.11g Traffic 465
Band Steering 466
Dynamic Bandwidth Switch 467
Enabling Traffic Shaping 468
Traffic Steering 470
Spectrum Load Balancing 471
Reusing Channels to Control RX Sensitivity Tuning 471
Configuring Non-802.11 Noise Interference Immunity 472
Troubleshooting ARM 472
Wireless Intrusion Prevention 474
Working with the Reusable Wizard 474
Monitoring the Dashboard 477
Detecting Rogue APs 478
Working with Intrusion Detection 481
Configuring Intrusion Protection 493
Configuring the WLAN Management System 497
Understanding Client Blacklisting 501
Working with WIP Advanced Features 503
Configuring TotalWatch 504
Administering TotalWatch 506
Tarpit Shielding Overview 507
Configuring Tarpit Shielding 507
AOS-W 6.5.3.x |User Guide Contents | 9

10| Contents AOS-W 6.5.3.x| User Guide
Access Points 509
Important Points to Remember 509
APDiscovery Logic 510
Basic Functions and Features 523
Naming and Grouping APs 524
Understanding AP Configuration Profiles 526
Before you Deploy an AP 533
Enable Switch Discovery 533
Enable DHCP to Provide APs with IP Addresses 534
AP Provisioning Profiles 535
Configuring Installed APs 538
Optional AP Configuration Settings 543
RF Management 558
Optimizing APs Over Low-Speed Links 572
AP Scanning Optimization 580
Channel Group Scanning 582
Configuring AP Channel Assignments 583
Managing AP Console Settings 585
Link Aggregation Support on OAW-AP220 Series, OAW-AP270 Series, and OAW-AP320 Series 588
Recording Consolidated AP-Provisioned Information 592
Intelligent Power Monitoring 593
Secure Enterprise Mesh 595
Mesh Overview Information 595
Mesh Configuration Procedures 595
Understanding Mesh Access Points 595
Understanding Mesh Links 597
Understanding Mesh Profiles 599
Understanding Remote Mesh Portals (RMPs) 603
Understanding the AP Boot Sequence 604