Bluesocket BlueSecure 1800v2 User manual

1
BlueSecureTM Access Point 1800v2
Installation Guide
Bluesocket, Inc
10 North Avenue
Burlington, MA 01803 USA
[phone]
.bluesocket.com
Document Version 1.0

BlueSecure™ Access Point 1800 Installation Guide
2
Copyright Notice
Copyright © 2010 Bluesocket, Inc.
All rights reserved. No part of this docu ent ay be reproduced in any for or by
any eans, electronic or anual, including photocopying without the written
per ission of Bluesocket, Inc. The products described in this docu ent ay be
protected by one or ore U.S. patents, foreign patents, or pending patents. This
docu ent is provided “as is” without warranty of any kind, either express or
i plied, including, but not li ited to, the i plied warranties of erchantability,
fitness for a particular purpose, or non-infringe ent. This publication could include
technical inaccuracies or typographical errors. Changes are periodically added to
the infor ation herein; these changes will be incorporated in new editions of the
docu ent. Bluesocket inc. ay ake i prove ents or changes in the products or
the progra s described in this docu ent at any ti e.
Trademarks
Bluesocket, The Bluesocket Logo, Secure Mobility, BlueView, and BlueSecure are
trade arks or registered trade arks of Bluesocket, Inc. Bluetooth is a trade ark
owned by Bluetooth SIG, Inc., U.S.A. and is licensed to Bluesocket, Inc. All other
trade arks, trade na es and co pany na es referenced herein are used for
identification purposes only and are the property of their respective owners.

BlueSecure™ Access Point 1800 Installation Guide
3
Table of Contents
I. Overview ............................................................................................................................4
II. Familiarizing Yourself with the BSAP-1800 ardware................................................5
III. Provisioning Your Bluesocket WLAN for BSAPs ..........................................................8
IV. Selecting a BSAP Installation Location ......................................................................11
V. Wall Mounting the BSAP-1800.......................................................................................12
VI. Ceiling Mounting Kit for the BSAP-1800....................................................................13
VII. Connecting and Powering the BSAP..........................................................................16
VIII. Using the BSAP Command Line Interface (CLI) ...................................................18
IX. General Specifications.................................................................................................24

BlueSecure™ Access Point 1800 Installation Guide
4
I. Overview
The BlueSecure Access Point 1800 is an 802.11n-based “thin” access point that works in
conjunction with BlueSecure Controllers (BSCs) for enterprise wireless LAN (WLAN)
deployments. The BlueSecure Access Point 1800 features dual radios supporting 802.11a/n and
802.11b/g/n with a high performance internal antenna.
BSAPs are simple to configure and require only minimal provisioning to make them operational
on a WLAN secured and managed by a BlueSecure Controller
BSAPs can be directly attached to any existing Layer-2 or Layer-3 Ethernet switch and
communicate with the BSC across any subnet boundary. Once the BSAP has discovered and
established Layer-2 or Layer-3 communication with its home (i.e., host) BlueSecure Controller,
advanced configuration and provisioning may be applied either to individual BSAPs or globally
across the entire WLAN using the BSC’s web-based Administrator Console.
Figure 1: BSAPs Automatically Discover BSCs across L2/L Networks
Once the BlueSecure Access Point has downloaded its configuration from the BlueSecure
Controller, the BSAP initializes its radios and begins servicing clients.
This guide provides complete installation procedures for your BSAP including:
• Familiarizing yourself with the BSAP hardware
• Provisioning your Bluesocket WLAN for BSAPs
• Selecting a BSAP installation location
• Connecting and powering the BSAP
• Using the BSAP command line interface (CLI)

BlueSecure™ Access Point 1800 Installation Guide
5
II. Familiarizing Yourself with the BSAP-1800 Hardware
Make sure that you receive the following items in the package:
1 - BSAP-1800
1 - Wall-mounting ardware (Wall/table bracket/stand, 4 screws, 4 wall anchors)
8 - Adhesive rubber feet
1 - Ceiling mounting ardware
Please spend a few minutes familiarizing yourself with the BSAP-1800 enclosure.
Antenna
The BSAP-1800 has a high-performance internal antenna (no external antenna is required)
LED Indicators
The following LED indicators are located on the top of the BSAP-1800 housing.

BlueSecure™ Access Point 1800 Installation Guide
6
Table 1: Status and Radio LED Definitions
Status 2.4Ghz LED 5Ghz LED Description
Yellow Solid Off Off Initial power-up
Green Solid Off Off Initializing software and acquiring an IP
address
Green Blink Off Off Discovering Bluesocket controller
Green Solid Green
Solid/Blink
Green
Solid/Blink
Radios Activated and passing traffic
Orange Solid Off Off Software Upgrade
Table 2: Network LED Definitions
Network LED Description
Off No Link Detected
Amber - ON 10/100 Link Detect with No Activity
Amber - Blinking 10/100 Link Detect with with Activity
Green - ON 1000 Link Detect with No Activity
Green - Blinking 1000 Link Detect with with Activity
The BSAP does not have a power switch. It’s powered on when connected to a Power over
Ethernet (PoE) from a PoE injector (BSAP-POE-001-00-0), switch or other network device that
supplies power over the network cable based on the IEEE 802.3af standard.
Ethernet/PoE Connector
The BSAP-1800 has one auto-sensing 10BASE-T/100BASE-TX/1000BaseT RJ-45 connector that
can be attached directly to 10BASE-T/100BASE-TX/1000BaseT switches to provide a full-duplex
link. These segments must conform to the IEEE 802.3 or 802.3u specifications.
This connector uses an MDI (i.e., internal straight-through) pin configuration. You can use
straight-through twisted-pair cable to connect this port to most network interconnection devices

BlueSecure™ Access Point 1800 Installation Guide
7
such as a switch or router that provide MDI-X ports. This connector will sense the correct wiring
polarity, so no crossover cable is required.
The BSAP appears as an Ethernet node and performs a bridging function by moving packets
from the wired LAN to remote workstations on the wireless infrastructure.
The Ethernet/PoE RJ-45 connector also supports Power over Ethernet (PoE) based on the IEEE
802.3af standard.
802.3af specifies Power over Ethernet for “mid-span”, where a PoE injector is located in the
path between the network and the AP, as well as “PSE”, where the power is supplied by the
network switch the AP is attached to. Mid-span devices typically provide power on the unused
pairs (4+5 & 7+8) and only provide 100Mbps maximum throughput. To realize the full benefit
of 802.11n, the BSAP-1800 should be connected to a Gigabit Ethernet PoE switch or injector,
such as Bluesocket model BSAP-POE-001-00-0.
Reset Button
Use this button to reset the BSAP or restore its factory default configuration. If you hold down
the button for less than 5 seconds, the BSAP will perform a hardware reset. If you hold down
the button for 5 seconds or more, any configuration changes you may have made are removed,
and the factory default configuration is restored to the BSAP.
Serial Console Port
Use this port to connect a console device to the BSAP-1800 via special rollover serial cable. The
console device can be a laptop running a program like Tera-Term or yper-terminal. The
default settings are 115200, 8 data bits, no parity (N), and 1 stop bit (no flow control).
Kensington Security Slot
The BSAP includes a Kensington security slot on the side panel. You can prevent unauthorized
removal of the BSAP by wrapping a Kensington security cable (not provided) around an
unmovable object, inserting the lock into the slot, and turning the key.

BlueSecure™ Access Point 1800 Installation Guide
8
III. Provisioning Your Bluesocket WLAN for BSAPs
There are prerequisites that must be met before deploying BSAPs in a live network
environment. These prerequisites ensure that the BSAPs are able to discover and connect to a
BlueSecure Controller. Implementing these prerequisites also relieves you from needing to
manually configure each BSAP-1800.
The deployment prerequisites for BSAPs are:
• BSAP IP Address - Each BSAP requires a unique IP address.
• Host BlueSecure Controller IP Address - Each BSAP also needs the IP address of
the host BSC to which it will connect and from which it will obtain its software image
and configuration.
This section describes how to provision your Bluesocket WLAN when deploying BSAPs:
• On the same Layer-2 subnet as the BSC
• Across a routed network with Layer-3 connectivity to the BSC
Deploying BSAPs on the Same Layer-2 Subnet as the BSC
If the BSAPs are on the same subnet as the home BlueSecure Controller, you can run a D CP
server on the BSC to manage IP address assignment to BSAPs. In this scenario, the BlueSecure
Controller must be the only D CP server for the subnet.
Alternatively, you can configure the BlueSecure Controller to run a D CP relay agent to relay
D CP communications between the BSAPs and a D CP server on your network.
Figure 2: Deploying BSAPs on the same Layer-2 subnet as the BSC
When you run a D CP server or a D CP relay agent on the BSC to assign IP addresses to
BSAPs on the managed side, the BSC will also pass its IP address to the BSAPs automatically
using vendor-specific option 43. The BSAP will then connect to the IP provided by the D CP
vendor option as its host BSC.

BlueSecure™ Access Point 1800 Installation Guide
9
See the BlueSecure Controller Setup and Administration Guide for detailed D CP server and
D CP relay agent configuration procedures.
In this deployment scenario, simply connect and power on the BSAPs. They will automatically
discover and communicate with their home BSC.
Deploying BSAPs with Layer- Connectivity to the BSC
You can also deploy BSAPs on a routed network with Layer-3 connectivity to the BSC
Figure : Deploying BSAPs across a routed network
In this deployment scenario, you must ensure that each BSAP is able to communicate with the
BSC across the routed network by verifying that:
• There are no NAT devices between the BSAPs and the BSC
• Protocol 97, UDP Port 53 (DNS), and TCP/UDP Port 33333 traffic is allowed between the
BSAPs and the BSC
Each BSAP will receive its IP address from your existing network D CP server.
The BSAP also needs the IP address of the home BSC to which it will connect and from which it
will obtain its software image and configuration. Again, this is not needed if the BSAP is on the
managed side getting a relayed IP address from the BSC. You can provide the home BSC IP
address to a BSAP using one of the following methods:
• DHCP Server Option 4
You can manually configure the D CP server on your network to send BSC IP addresses
to BSAPs using D CP vendor-specific option 43.
In D CP requests sent from the BSAP, the BSAP uses option 60 Vendor class identifier
with a value of BlueSecure.AP1500 to identify itself to the D CP server (Note that all
BSAPs —1500,1540, 1800, and 1800 —identify as AP1500 for option 43).

BlueSecure™ Access Point 1800 Installation Guide
10
Option 43 is configured as a comma-separated list, for example
"192.168.100.23,192.168.100.98,F192.168.100.25 "
ere the “F” denotes failover BSC. If all the primary BSCs fails (those without F
in front of their IP), the AP associates to the failover BSC.
Refer to the documentation supplied with your D CP server when configuring vendor-
specific option 43
• DNS Server Configuration
BSAPs are factory configured with apdiscovery as the DNS hostname. You can configure
a DNS server on your network with an entry for apdiscovery with the home BSC
Controller IP address as the resolution.
To configure this, add a NAME record to the DNS server for apdiscovery (at the domain
server that the BAP will receive). Point this name to one or more BSC IP addresses
(managed, protected or VLAN depending on the network configuration).
So for example, if there are two BSCs (192.168.100.23 and 192.168.100.28), and the
domain is customer.com, add two NAME records to customer.com, for the name
apdiscovery.customer.com. One should resolve to 192.168.100.23 and one to
192.168.100.28. PTR (i.e., pointer) records are not needed for this portion of discovery.

BlueSecure™ Access Point 1800 Installation Guide
11
IV. Selecting a BSAP Installation Location
BlueSecure Access Points should be positioned for maximum throughput and range between
other BSAPs and wireless client devices. Normally, you should locate the BSAP on the ceiling
away from obstructions.
Range and performance are dictated by the distance between the BSAP and client radios, and
by obstacles that may be present in a specific building or office environment. The following
positioning guidelines are suggested:
• Document all the BSAPs and client devices you wish to include in your wireless network.
Record the MAC address, serial number, and placement of each BSAP.
• Wired LAN and power connections must be available for each BSAP at the desired
installation location. If a power outlet is not available near the access point, mid-span power
inserters are recommended.
• If building blueprints or floor plans are available, use them to define potential client device
locations and likely roaming areas.
• Identify possible obstacles or sources of interference that could affect signal strength (for
example, walls, metal objects).
• Install the BSAP in an area where large steel structures such as beams, pillars, shelving
units, bookcases, and filing cabinets do not obstruct radio signals to and from the BSAP.
• Once BSAPs have been installed and configured, use site survey and monitoring utilities
supplied with the client adapters to test signal strength at various locations. Modify the
positioning of the BSAPs and client stations as required for optimum performance.

BlueSecure™ Access Point 1800 Installation Guide
12
V. Wall Mounting the BSAP-1800
Use the white plastic mounting bracket that comes with the BSAP-1800 to install the AP on a
wall or electrical box. To mount the BSAP-1800, follow these steps:
1. Screw the mounting bracket to the wall or electrical box.
2. If mounting to drywall, use the four screws and the four wall anchors.
3. If mounting to a US electrical box, use two threaded screws and insert into the holes
marked “B” in the diagram shown below:
4. Connect the Ethernet cable (for power and network connection) to the port on the back of
the BSAP-1800.

BlueSecure™ Access Point 1800 Installation Guide
13
VI. Ceiling Mounting Kit for the BSAP-1800
The BSAP-1800 also comes with a ceiling mounting kit that enables the AP to be mounted on
the T-bar of standard drop ceilings.
To mount the BSAP-1800:
1. Attach the metal slider to the back of the BSAP-1800 using the two small screws. The slider
should still be able to slide after the screws are tightened.
Make sure that the slide is left in the same position as shown above.
2. Clip the metal ceiling bracket to a suitable location on the ceiling tile separator.

BlueSecure™ Access Point 1800 Installation Guide
14
3. Slide the moveable section into place and tighten the screw (found underneath) to secure it.
4. Position the BSAP-1800 so that the two tabs from the ceiling bracket locate in the slots
in the BSAP-1800 (A), then slide the slider across to lock the BSAP-1800 to the bracket
(B).

BlueSecure™ Access Point 1800 Installation Guide
15

BlueSecure™ Access Point 1800 Installation Guide
16
VII. Connecting and Powering the BSAP
Follow these instructions to connect your BlueSecure BSAP to your Bluesocket WLAN and then
power it up:
1. Make a note of the 12-character MAC address and the serial number listed on the back of
the BSAP-1800 before mounting the BSAP to a wall or other surface. You will need this
information during configuration.
2. Position the BSAP-1800 for best radio performance.
The BSAP-1800 should be place where it has the best unobstructed view of the coverage
area. If possible, mounting the BSAP-1800 on the ceiling will provide the best performance
in a typical office environment. For more information, please refer to Bluesocket’s web site.
3. The BSAP derives its operating power directly from the RJ-45 connector when connected to
a device that provides IEEE 802.3af compliant Power over Ethernet (PoE).
Caution: If the BSAP is used in a medical environment, it must use an IEC/EN60601-1
compliant power adapter. See

BlueSecure™ Access Point 1800 Installation Guide
17
for a description of the IEC/EN60601-1 compliant power adapter.
Verify that the PWR LED stops flashing and remains on, and that the other status LEDs start
functioning as described in the section entitled
LED Indicators
.
4. Connect the BSAP to your Bluesocket WLAN.
You can connect the BSAP-1800 to a 10/100/1000 Mbps Ethernet through a network device
such as a hub or a switch, or to a 1000BaseT Gigabit Ethernet interface. Connect the RJ-45
Ethernet connector on the BSAP’s back panel to your network using category 5 UTP
Ethernet cable. When the BSAP and the connected device are powered on, the BSAP’s
Ethernet Link LED should light indicating a valid network connection.

BlueSecure™ Access Point 1800 Installation Guide
18
VIII. Using the BSAP Command Line Interface (CLI)
Note: Normally you will not need to access the BSAP CLI. In a properly provisioned Bluesocket
WLAN, the BSAP will automatically discover and communicate with the BSC. We recommend
that you use the CLI to configure the BSAP only in a lab or test environment, or where a pre-
defined static IP address is desired.
You can connect to the serial console port or the Ethernet port to perform local configuration of
the BSAP using its command line interface (CLI). You can use the BSAP’s CLI to manually
configure:
• BSAP’s Network Configuration (IP address, Default Gateway)
• IP address of the home BSC from which the BSAP will download its configuration and
software image
• Site survey mode
Accessing the BSAP CLI via serial port
Connect the special serial DB-9 to RJ-45 serial cable (rollover cable) to the BSAP-1800 serial
port.
1. Run a terminal program on your laptop configured with the following settings:
Speed: 115,200
Data Bits: 8
Parity: None
Stop Bits: 1
Flow Control: None
2. Initiate the connection to the BSAP CLI
Accessing the BSAP CLI via Ethernet (i.e SSH)
Access the BSAP CLI using an SS client (the example uses putty) For example:
1. The default management IP address for the BSAP-1800 is 192.168.190.1. Configure your
laptop computer to have a static IP address in this same subnet, for example
192.168.190.2.
2. Ping the AP from the laptop to make sure it can be seen.
3. Configure putty to use SS and then connect to the IP address of the AP (by default
192.168.190.1) on port 2335.

BlueSecure™ Access Point 1800 Installation Guide
19
4. Enter the following username and password in lowercase at the displayed CLI login
prompts:
BlueAP login: adm1n (i.e., adm “one” n)
Password: blue1socket (i.e., blue “one” socket).
You can change the password from the main menu of the CLI (option f - Change Login
Password).
Navigating the BSAP CLI
The BSAP CLI main menu provides access to these options:
• Network Configuration - Configure the BSAP’s network settings including its IP address
and the IP address of the BSC to which it will connect.
• Save/Apply Configuration - After you have configured the BSAP’s network settings, you
must apply them before they become active.
• Restore Defaults - Restore the BSAP to its default settings.
• Show Version Information - Display BSAP version information.
• Reboot AP - After applying the BSAP’s configuration settings, you must reboot the BSAP to
effect the new configuration.

BlueSecure™ Access Point 1800 Installation Guide
20
• Site Survey Configuration - In site survey mode, the BSAP beacons known SSIDs on its
802.11a/n and 802.11 b/g/n radios operating at a configurable power level and channel to
facilitate a WLAN site survey. Rebooting the BSAP following a site survey, restores the
BSAP’s existing configuration. See
•
• Using the BSAP’s Site Survey Mode for details on using the BSAP’s site survey mode.
When operating in a submenu, press h to return directly to the main menu (or home menu).
Press p to return to the previous menu.
BSAP Default Configuration
The BSAP is shipped with the following default configuration.
IP_ADDR_MODE: D CP (0)
IP_ADDR 0.0.0.0
NETMASK 0.0.0.0
GW_ADDR 0.0.0.0
DNS_ADDR 0.0.0.0
WG_ADDR_MODE Discover BSC (0)
WG_ADDR 0.0.0.0
MNGMT_IP_ADDR 192.168.190.1
The two options for IP address mode are:
• (0) DHCP - The BSAP runs a D CP client and receives its IP address from a D CP
server.
• (1) Static IP - You assign the BSAP a static IP address via its CLI.
The two options for WG address mode are:
• (0) Discover - The BSAP automatically discovers the IP address of the BSC to which it
is to connect.
• (1) Static Configuration - Using the BSAP CLI, you will configure the IP address of
the BSC to which the BSAP is to connect.
Setting the BSAP and Home BSC IP Addresses Using the CLI
To set the BSAP and ome BSC IP addresses using the CLI:
1. Enter 1 at the BSAP CLI main menu command prompt.
The BSAP CLI network configuration menu appears: