Aruba Networks AirOS v2.3 User manual

Aruba AirOS
v2.3 User Guide
TM
1322 Crossman Avenue
Sunnyvale, California 94089
Net www.arubanetworks.com
Tel [phone]
Fax [phone]

ii Aruba AirOS Part 0500036-02
v2.3 User Guide January 2005
Copyright
Copyright © 2005 Aruba Wireless Networks, Inc. All rights reserved.
Specifications in this manual are subject to change without notice.
Originated in the USA.
Trademarks
AirOS, Aruba 5000, and Aruba 52 are trademarks of Aruba Wireless Networks, Inc. in the United States and
certain other countries.
Any other trademarks appearing in this manual are the property of their respective companies.
Legal Notice
The use of Aruba Wireless Networks Inc. switching platforms and software, by all individuals or
corporations, to terminate Cisco or Nortel VPN client devices constitutes complete acceptance of liability by
that individual or corporation for this action and indemnifies, in full, Aruba Wireless Networks Inc. from any
and all legal actions that might be taken against it with respect to infringement of copyright on behalf of Cisco
Systems or Nortel Networks.

Contents iii
Contents
Preface . . . . . . . . . . . . . . . . . . . . . . vii
Document Organization . . . . . . . . . . . . . . . . vii
Related Documents. . . . . . . . . . . . . . . . . . . viii
Text Conventions . . . . . . . . . . . . . . . . . . . viii
Contacting Aruba Wireless Networks . . . . . . . . . . ix
Chapter 1 Deploying Access Points . . . . . . . . . . . 1
Overview. . . . . . . . . . . . . . . . . . . . . . . . . 1
Getting Started. . . . . . . . . . . . . . . . . . . . . . 2
Chapter 2 Configuring Network Parameters . . . . 9
Conceptual Overview . . . . . . . . . . . . . . . . . . . 9
Network Configuration . . . . . . . . . . . . . . . . . 10
Create/Edit a VLAN . . . . . . . . . . . . . . . . 10
Configuring a Port to Be an Access Port . . . . . . . 11
Configuring a Trunk Port . . . . . . . . . . . . . 13
Configuring Static Routes . . . . . . . . . . . . . 15
Modifying the Loopback IP Address . . . . . . . . 16
Chapter 3 Configuring Redundancy . . . . . . . . . . 19
Conceptual Overview . . . . . . . . . . . . . . . . . . 19
Redundancy Configuration . . . . . . . . . . . . . . . 20
Configuring Local Switch Redundancy . . . . . . . 20
Master Switch Redundancy. . . . . . . . . . . . . 24
Master-local Switch Redundancy . . . . . . . . . . 28

iv Aruba AirOS Part 0500036-02
v2.3 User Guide January 2005
Chapter 4 Configuring Wireless LANs . . . . . . . . 33
Conceptual Overview. . . . . . . . . . . . . . . . . . 33
Configuring WLAN—802.11 Networks. . . . . . . . . 34
Pre-requisites . . . . . . . . . . . . . . . . . . . 34
Configuring WLANs—Radio Configuration . . . . . . 41
Configuring WLANs—Advanced. . . . . . . . . . . . 43
Example . . . . . . . . . . . . . . . . . . . . . . . . 45
Adaptive Radio Management . . . . . . . . . . . . . . 47
Deciding the Channel Setting. . . . . . . . . . . . 48
Deciding Power Settings . . . . . . . . . . . . . . 48
Advantages of Using ARM . . . . . . . . . . . . . 48
Configuring ARM . . . . . . . . . . . . . . . . . . . 49
Chapter 5 Configuring Firewall Roles and Policies 51
Configuring Policies . . . . . . . . . . . . . . . . . . 52
Creating a New Policy . . . . . . . . . . . . . . . 52
Editing an Existing Policy . . . . . . . . . . . . . 58
Applying the Policy to a User Role . . . . . . . . . 60
Chapter 6 Configuring AAA Servers . . . . . . . . . 67
Authentication Timers . . . . . . . . . . . . . . . . . 67
Accessing the Configuration page . . . . . . . . . . 67
Authentication Servers . . . . . . . . . . . . . . . . . 69
RADIUS Server Configuration . . . . . . . . . . . 69
Editing an Existing Entry. . . . . . . . . . . . . . 71
Deleting an Existing Entry . . . . . . . . . . . . . 71
LDAP Server Settings . . . . . . . . . . . . . . . 72
Editing an Existing Entry. . . . . . . . . . . . . . 74
Deleting an Existing Entry . . . . . . . . . . . . . 74
Internal Database. . . . . . . . . . . . . . . . . . 75
Editing an Existing Entry. . . . . . . . . . . . . . 77
Deleting an Entry . . . . . . . . . . . . . . . . . 77
Configuring Server Rules . . . . . . . . . . . . . . . . 78
Example . . . . . . . . . . . . . . . . . . . . . . 80
Chapter 7 Configuring the Captive Portal . . . . . 83
Configuring Captive Portals for Guest Logon . . . . . . 83
Example . . . . . . . . . . . . . . . . . . . . . . 87
Configuring Captive Portal for User Logon . . . . . . . 88
Example . . . . . . . . . . . . . . . . . . . . . . 93
Personalizing the Captive Portal Page . . . . . . . . . . 94

Contents v
Chapter 8 Configuring 802.1x Security . . . . . . . 99
Configuring Wireless User Authentication Only . . . . 100
Configuring the Authentication Servers . . . . . . 103
Example . . . . . . . . . . . . . . . . . . . . . 106
Configuring User and Machine Authentication . . . . 108
Example . . . . . . . . . . . . . . . . . . . . . 114
Configuring MAC-based Authentication . . . . . . . 117
Configuring the Switch . . . . . . . . . . . . . . 117
Configuring Users . . . . . . . . . . . . . . . . 119
Configuring 802.1x for Wired Users. . . . . . . . . . 121
Modifying the 802.1x Settings . . . . . . . . . . 122
Resetting the 802.1x Settings . . . . . . . . . . . 122
Advanced Configuration Options of 802.1x . . . . 123
Default Open Ports . . . . . . . . . . . . . . . . . . 125
Chapter 9 Configuring Virtual Private Networks 127
VPN Configuration. . . . . . . . . . . . . . . . . . 127
Enabling VPN Authentication . . . . . . . . . . 127
Configuring VPN with L2TP IPSec . . . . . . . 129
Enabling Src NAT . . . . . . . . . . . . . . . . 131
IKE Shared Secrets . . . . . . . . . . . . . . . 131
IKE Policies . . . . . . . . . . . . . . . . . . . 132
Configuring Aruba Dialer Example . . . . . . . . 134
Examples. . . . . . . . . . . . . . . . . . . . . . . 136
Chapter 10 Intrusion Detection . . . . . . . . . . . . . 147
Rogue/Interfering AP Detection . . . . . . . . . . . 147
Denial of Service Detection . . . . . . . . . . . . 148
Man-In-The-Middle Detection . . . . . . . . . . 148
Signature Detection . . . . . . . . . . . . . . . 149
WLAN Policies . . . . . . . . . . . . . . . . . 149
Configuring Rogue AP Detection . . . . . . . . . 150
Configuring Denial of Service Attack Detection . . 152
Configuring Man-In-The-Middle Attack Detection 155
Configuring Signature Detection . . . . . . . . . 157
Adding a New Signature Pattern . . . . . . . . . 159
Configuring WLAN Policies . . . . . . . . . . . 162
Configuring Wireless Bridge Detection . . . . . . 163

vi Aruba AirOS Part 0500036-02
v2.3 User Guide January 2005
Chapter 11 System and Network
Management. . . . . . . . . . . . . . . . . . . . . . . . . . 167
Configuring SNMP for the Aruba WLAN Switch . . . 167
Configuring SNMP for the Access Points . . . . . . . 172
SNMP Traps from the Switch . . . . . . . . . . . . 178
SNMP traps from Access Point/Air Monitor . . . . . 181
Configuring Logging . . . . . . . . . . . . . . . . . 185
Chapter 12 Configuring Quality of Service
for Voice Applications . . . . . . . . . . . . . . . . 191
Configuring QoS for SVP . . . . . . . . . . . . . . 192
Configuring QoS for SIP . . . . . . . . . . . . . . . 197
Chapter 13 Topology Example One . . . . . . . . . . 203
Chapter 14 Topology Example Two . . . . . . . . . . 211
Chapter 15 Topology Example Three . . . . . . . . . 223
Chapter 16 Topology Example Four . . . . . . . . . . 237
Topology Diagram . . . . . . . . . . . . . . . . 239
Topology Description . . . . . . . . . . . . . . 239

Preface vii
Preface
This preface includes the following information:
zAn overview of the sections in this manual
zA list of related documentation for further reading
zA key to the various text conventions used throughout this manual
zAruba Wireless Networks support and service information
Document Organization
This user guide includes instructions and examples for commonly used, basic wireless LAN
(WLAN) switch configurations such as Virtual Private Networks (VPNs), firewalls, and
redundancy. This guide shows you how to configure your environment with the most
commonly needed features and services.
To use this guide effectively, apply the configuration or configurations required and skip the
rest. Unless otherwise indicated, chapters are not dependent on each other. That is, you do not
need to configure a feature in an earlier chapter before you can configure a feature in a
subsequent chapter. Chapter order is not significant.
For information on parameters and settings on the WebUI, refer to the Aruba AirOS Reference
Guide.

viii Aruba AirOS Part 0500036-02
v2.3 User Guide January 2005
Related Documents
The following items are part of the complete documentation set for the Aruba system:
zAruba WLAN Switch Installation Guides
zAruba AP Installation Guides
zAruba AirOS Reference Guide
Text Conventions
The following conventions are used throughout this manual to emphasize important concepts:
TABLE 1Text Conventions
Type Style Description
Italics This style is used to emphasize important terms and to mark the
titles of books.
System items This fixed-width font depicts the following:
zSample screen output
zSystem prompts
zFilenames, software devices, and certain commands when men-
tioned in the text.
Commands In the command examples, this bold font depicts text that the user
must type exactly as shown.
<Arguments> In the command examples, italicized text within angle brackets
represents items that the user should replace with information
appropriate to their specific situation. For example:
# send <text message>
In this example, the user would type “send” at the system prompt
exactly as shown, followed by the text of the message they wish to
send. Do not type the angle brackets.
[ Optional ] In the command examples, items enclosed in brackets are optional.
Do not type the brackets.
{ Item A | Item B } In the command examples, items within curled braces and separated
by a vertical bar represent the available choices. Enter only one
choice. Do not type the braces or bars.

Preface ix
Contacting Aruba Wireless Networks
Web Site
E-mail
Telephone Numbers
zMain Site http://www.arubanetworks.com
zSupport http://www.arubanetworks.com/support
zSales [e-mail]
zSupport [e-mail]
zMain 408-227-4500
zFax 408-227-4550
zSales 408-754-1201
zSupport In the U.S.:800-WI-FI-LAN (800-943-4526)
International:408-754-1200

xArubaAirOS Part 0500036-02
v2.3 User Guide January 2005

Deploying Access Points 1
Chapter 1
CHAPTER 1
Deploying Access Points
This chapter outlines the recommended methods used to deploy and provision Aruba Access
Points (APs) in an enterprise network environment, detailing the various provisioning options
and steps required.
Overview
Aruba wireless APs (also applicable to APs deployed as Air Monitors (AMs) are designed to be
low-touch configuration devices that require only minimal provisioning to make them fully
operational on an Aruba-enabled WLAN network. Once the AP has established Layer-3
communication with its host Aruba WLAN switch, advanced configuration and provisioning
may be applied either to individual APs or globally across the entire wireless network centrally
using the WebUI of the Master Aruba Switch.

2ArubaAirOS Part 0500036-02
v2.3 User Guide January 2005
Getting Started
1 Planning
Decide where you wish to locate the APs in advance of physical installation. Aruba RF
Plan can be utilized to provide an AP placement map relative to a building floor plan to
ensure optimal RF coverage. (For more information on RF Plan, see the Aruba RF Plan
for Windows User Guide.)
When deploying APs, note the AP MAC address and serial number against the physical
location. This will be useful in assigning location code identifiers to APs (see “Assigning
AP Location Codes” below), which will greatly enhance location-based services and wire-
less network calibration.
2 Provisioning the Network for AP-Switch Communications
There are deployment prerequisites that must be met before deploying APs in a live net-
work environment. These prerequisites ensure that the APs are able to discover and attach
to a host Aruba WLAN switch (defined as the master). This also relieves the administra-
tor from the need to manually configure each AP.
NOTE—Aruba APs can only obtain their software image and configuration from a
master Aruba WLAN switch.
The deployment prerequisites for Aruba APs are:
zA Valid IP Address
Aruba APs require a unique IP address on a subnet that has routable Layer-3 connec-
tivity to a master Aruba WLAN switch. Aruba recommends assigning the AP an IP
address via DHCP (either from an existing network server or directly from an Aruba
WLAN switch configured with a DHCP server).
To configure the AP IP address, go to“Assigning the IP Address to the AP”.
zMaster Aruba WLAN Switch/loopback IP Address
This is the IP address from which the AP will attach to and obtain its software image
and configuration. The master Aruba WLAN switch/loopback IP address can be
provided to an Aruba AP using one of the following methods:

Deploying Access Points 3
Chapter 1
DNS Server
Configuration
Aruba APs are factory configured with aruba-master as the
DNS host name. A DNS server on the network can be
configured with an entry for aruba-master with the master
Aruba WLAN switch/loopback IP address as the resolution.
To configure this option see “DNS Server-derived AP
Provisioning ”.
DHCP Server
Configuration
A DHCP server on the same subnet as the AP can be configured
to not only provide the AP its own IP address, but also provide
the IP address of a master Aruba WLAN switch to which the AP
should attach. This is achieved by configuring the DHCP
standard vendor specific option (attribute 43) in the DHCP
server, with the desired master Aruba WLAN switch/loopback
IP address. When the DHCP server returns its offer to the AP,
this attribute will be returned with it.
To configure this option see “DHCP Server-derived AP
Provisioning ”.
Aruba Discovery
Protocol (ADP) - Plug
and Play
Aruba APs are factory configured with ADP, a feature that
allows plug and play provisioning for APs connected via Layer
2/3 to a master Aruba WLAN switch on an ADP-enabled
network.
ADP equipped APs send out periodic multicast and broadcast
queries to locate a master Aruba WLAN switch. If an Aruba
switch is present in the same broadcast domain as the APs, it will
respond with the switch/loopback IP address of the master
switch.
If the APs and Aruba switch reside in different broadcast
domains, the APs can discover the Aruba master switch using IP
multicast (IP multicast must be enabled in the network for this to
function). The ADP multicast queries are sent to the IP
multicast group address 224.0.82.11.
Alternatively, you can configure a master Aruba WLAN switch
address as the IP Helper/relay address on any Layer-3 switch on
the same broadcast domain as the APs, thus mitigating the need
to enable multicast in the network.
ADP also functions for APs connected directly to Ethernet ports
on a master Aruba WLAN switch. To configure this option see
“Aruba Discovery Protocol (ADP)”.

4ArubaAirOS Part 0500036-02
v2.3 User Guide January 2005
Step 2a. Assigning the IP Address to the AP
Either configure a DHCP server in the same subnet where the APs will be connected
to the network, or configure a device in the same subnet to act as a relay agent for a
DHCP server on a different subnet that can provide the AP with its IP information.
If you are planning on using a network-based DHCP server, skip to “A P - M a s t e r
Switch Provisioning”.
If the APs are on the same subnet as the master Aruba WLAN switch, the Aruba
switch can be used as a DHCP server to manage IP address assignment to APs. (The
Aruba WLAN switch must be the only DHCP server for this subnet.)
To enable DHCP server capability on an Aruba
switch:
zNavigate to the Configuration > DHCP Server page.
zCreate a DHCP server pool configuration.
zCreate an excluded address range.
zClick Apply to apply the configuration to the switch.
zClick Start to start the on-switch DHCP server.
Step 2b.AP-Master Switch Provisioning
It is imperative that the administrator chooses one of the aforementioned options to
provide the Access Points with the master Aruba WLAN switch/loopback IP address.
To configure each of these options see below:
DNS Server-derived AP Provisioning
When DNS server-derived provisioning is the chosen option to provide the AP
with the master Aruba WLAN switch/loopback IP address, verify that the DNS
server used by the AP (usually supplied by DHCP) has an entry configured for
the standard name aruba-master.

Deploying Access Points 5
Chapter 1
NOTE—The APs request for DNS resolution is for the Fully Qualified Domain
Name aruba-master so make sure that this name is configured. After initial pro-
visioning, if the default domain name values are changed, make sure the AP and
switch domain name settings match.
Aruba recommends DNS server-derived AP configuration because it involves
minimal changes to the network and offers the greatest flexibility in placement of
APs.
If you select this option, skip the remainder of this section and proceed to
“Deploying APs in the Network”.
DHCP Server-derived AP Provisioning
When DHCP server-derived provisioning is the chosen option to provide the AP
with the master Aruba WLAN switch/loopback IP address, make sure the
DHCP server is configured to return the Aruba vendor-specific attribute
information in its DHCP offer to the AP.
Configure the DHCP server to send the Aruba master switch IP address within
the DHCP vendor-specific attribute option 43. The vendor class identifier used
to identify DHCP requests from Aruba APs is ArubaAP.
NOTE—DHCP requires the format and contents of the vendor class identifier to be
correct (ArubaAP).
If you select this option, skip the remainder of this section and proceed to “Deploying
APs in the Network”.
Aruba Discovery Protocol (ADP)
NOTE—When APs are NOT on the same broadcast domain as the master Aruba
WLAN switch, you must enable multicast or employ IP Helper to relay broadcast
messages across the network for ADP to function correctly.
If ADP is the preferred option to provide the AP with the master Aruba WLAN
switch/loopback IP address, and the APs are on the same broadcast domain as
any master Aruba WLAN switch, no additional network configuration is
required. APs will send broadcast queries to which a master Aruba WLAN
switch will respond, along with its switch/loopback IP address, and the APs will
boot to this switch.
ADP is enabled on all Aruba WLAN switches by factory default. However, to
ensure that ADP discovery is enabled on your switch use the following command:
(Aruba2400) #show adp config

6ArubaAirOS Part 0500036-02
v2.3 User Guide January 2005
ADP Configuration
-----------------
key value
--- -----
discovery enable
igmp-join enable
If ADP discovery is not enabled, use the following command to enable it:
(Aruba2400) (config) #adp discovery enable
When APs are connected to Aruba switches indirectly (via an IP-routed
network), the administrator needs to make sure that multicast routing is enabled
in the network, and that all routers are configured to listen for IGMP joins from
the master Aruba WLAN switch and to route these multicast packets.
Make sure both ADP discovery and IGMP-join options are enabled. Verify using
the show adp config command as shown above.
Should ADP discovery or IGMP-join options not be enabled:
zEnable ADP discovery by entering:
(Aruba2400) (config) #adp discovery enable
zEnable IGMP join by entering:
(Aruba2400) (config) #adp igmp-join enable
zProceed to “Deploying APs in the Network” below.
3 Deploying APs in the Network
You are now ready to physically install the APs and attach them to the network. (For infor-
mation on mounting and powering options please refer to the AP hardware installation
guide that shipped with the AP.)
When deploying APs, note the AP MAC address and serial number against the physical
location. This will be useful in assigning location code identifiers to APs (see “Assigning
AP Location Codes” below), which will greatly enhance location-based services and wire-
less network calibration.
zPhysically install the Access Point in the desired location.
zConnect the Access Point to the network port.
zMake sure power is available to the AP using 802.3af-compliant Power over
Ethernet (PoE) or via the optionally available AC power adapter kits. (The
POWER and ENET LEDs on the AP will respectively indicate power/network
link states.)
zAPs will now attempt to locate their master Aruba WLAN switch in the network.

Deploying Access Points 7
Chapter 1
4 Assigning AP Location Codes
Now the APs are provisioned on the network, the final step in Access Point deployment is
to configure (re-provision) each AP with a unique location code, which is used for location
service capability. This location code is numerical and in the format 1.2.3 (where 1=build-
ing, 2=floor, 3=location). This can be configured for each AP in the network using the
WebUI of the master Aruba WLAN switch.
To configure an AP with a unique location code:
zNavigate to the Maintenance > Program AP > Re-provision page.
This page displays a list of APs that have registered with the Master switch with
either their default location code (-1.-1.-1) or their currently configured location
code (if the AP has been provisioned already).
zSelect the AP that is to be configured from the list. This can be selected by using
the MAC address of the AP or the serial number of the AP. Click Enable to start
provisioning the AP.

8ArubaAirOS Part 0500036-02
v2.3 User Guide January 2005
zEnter the location code in the format explained above.
zIf the AP being provisioned is a model with detachable antenna capability (such as
an Aruba AP-60) enter the antenna gain in dBi, for example 4.0. This is
mandatory for all detachable antenna models as the AP will not will bring up its
radio interface or function as an AP without it.
zClick Apply to apply the configuration to the AP.
NOTE—The configuration does not take effect until the AP is rebooted.
zNavigate to the Maintenance > Reboot AP page.
zSelect the AP from the list of the APs and click Reboot to reboot the AP.
zNavigate to the Maintenance > Program AP > Re-provision page to confirm
that the new settings have taken effect.

Configuring Network Parameters 9
Chapter 2
CHAPTER 2
Configuring Network
Parameters
This section outlines the steps involved to configure the various network parameters required
to set up an Aruba WLAN switch. This includes configuring VLANs, IP interfaces, static
routes, and loopback IP addresses.
Conceptual Overview
The concept of VLAN is used in the Aruba WLAN Switch as a layer 2 broadcast domain as
well as a layer 3 IP interface, similar to most layer 2/3 switches. The administrator can
configure a set of ports to be members of a VLAN and define an IP address/netmask for the
VLAN interface. A single physical port can be a member of multiple VLANs by use of 802.1q
trunking/tagging.
The loopback IP address is a logical IP interface that is used by the Aruba WLAN Switches
and APs to communicate amongst each other. To make use of this interface, ensure that the IP
address is reachable through one of the VLAN interfaces. The examples and configuration
guidelines below will illustrate the same.

10 Aruba AirOS Part 0500036-02
v2.3 User Guide January 2005
Network Configuration
Create/Edit a VLAN
1 Navigate to the Configuration > Switch > VLAN page on the WebUI.
2 Click Add to create a new VLAN. To edit an existing VLAN click Edit for this
VLAN. On the next screen (as shown below), enter the VLAN ID, the IP address
and network mask of the VLAN interface. If required, the address of the DHCP
server for that VLAN can also be configured by clicking Add.
The VLAN can be assigned to the required ports by selecting the appropriate
boxes in the Assign this VLAN to Ports fields. However, the recommended proce-
dure for assigning VLANs to ports is explained in the following section.