Cisco Small Business WAP551 Instruction Manual

Cisco Small Business
WAP551 Wireless-N Access Point with PoE
and
WAP561 Wireless-N Selectable-Band Access Point
with PoE
ADMINISTRATION
GUIDE

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 1
Contents
Chapter 1: Getting Started 5
Starting the Web-Based Configuration Utility 5
Using the Access Point Setup Wizard 6
Getting Started 9
Window Navigation 10
Chapter 2: Status and Statistics 12
System Summary 12
Network Interfaces 14
Traffic Statistics 15
WorkGroup Bridge Transmit/Receive 16
Associated Clients 16
TSPEC Client Associations 18
TSPEC Status and Statistics 20
TSPEC AP Statistics 22
Radio Statistics 22
Email Alert Status 24
Log 24
Chapter 3: Administration 25
System Settings 26
User Accounts 26
Time Settings 28
Log Settings 30
Email Alert 32
HTTP/HTTPS Service 35
Management Access Control 37
Manage Firmware 38
Download/Backup Configuration File 40
Configuration Files Properties 42

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 2
Contents
Copy/Save Configuration 42
Reboot 43
Discovery—Bonjour 44
Packet Capture 44
Support Information 51
Chapter 4: LAN 52
Port Settings 52
VLAN and IPv4 Address Settings 53
IPv6 Addresses 54
IPv6 Tunnel 56
Chapter 5: Wireless 58
Radio 58
Rogue AP Detection 66
Networks 69
Scheduler 81
Scheduler Association 83
Bandwidth Utilization 83
MAC Filtering 84
WDS Bridge 85
WorkGroup Bridge 89
Quality of Service 92
WPS Setup 95
WPS Process 102
Chapter 6: System Security 105
RADIUS Server 105
802.1X Supplicant 107
Password Complexity 109

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 3
Contents
WPA-PSK Complexity 110
Chapter 7: Client Quality of Service 111
Client QoS Global Settings 111
ACL 111
Class Map 118
Policy Map 123
Client QoS Association 125
Client QoS Status 127
Chapter 8: Simple Network Management Protocol 129
General SNMP Settings 129
Views 132
Groups 133
Users 135
Targets 136
Chapter 9: Captive Portal 138
Captive Portal Global Configuration 139
Instance Configuration 140
Instance Association 143
Web Portal Customization 143
Local Groups 147
Local Users 148
Authenticated Clients 149
Failed Authentication Clients 150
Chapter 10: Single Point Setup 152
Single Point Setup Overview 152
Access Points 157

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 4
Contents
Sessions 160
Channel Management 161
Wireless Neighborhood 165
Chapter A: Deauthentication Message Reason Codes 168
Deauthentication Reason Code Table 168
Appendix B: Where to Go From Here 170

1
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 5
Getting Started
This chapter provides an introduction to the Wireless Access Point (WAP) devices
web-based configuration utility, and includes these topics:
•Starting the Web-Based Configuration Utility
•Using the Access Point Setup Wizard
•Getting Started
•Window Navigation
Starting the Web-Based Configuration Utility
This section describes system requirements and how to navigate the web-based
configuration utility.
Supported Browsers
•Internet Explorer 7.0 or later
•Chrome 5.0 or later
•Firefox 3.0 or later
•Safari 3.0 or later
Browser Restrictions
•If you are using Internet Explorer 6, you cannot directly use an IPv6 address
to access the WAP device. You can, however, use the Domain Name System
(DNS) server to create a domain name that contains the IPv6 address, and
then use that domain name in the address bar in place of the IPv6 address.
•When using Internet Explorer 8, you can configure security settings from
Internet Explorer. Select Tools > Internet Options and then select the
Security tab. Select Local Intranet and select Sites. Select Advanced and
then select Add. Add the intranet address of the WAP device (http://<ip-

Getting Started
Using the Access Point Setup Wizard
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 6
1
address>) to the local intranet zone. The IP address can also be specified
as the subnet IP address, so that all addresses in the subnet are added to
the local intranet zone.
•If you have multiple IPv6 interfaces on your management station, use the
IPv6 global address instead of the IPv6 local address to access the WAP
device from your browser.
By default, the web-based AP configuration utility logs out after 10 minutes of
inactivity. See HTTP/HTTPS Service for instructions on changing the default
timeout period.
To log out, click Logout in the top right corner of the web-based AP configuration
utility.
Using the Access Point Setup Wizard
The first time that you log into the WAP device (or after it has been reset to the
factory default settings), the Access Point Setup Wizard appears to help you
perform initial configurations. Follow these steps to complete the wizard:
NOTE If you click Cancel to bypass the Wizard, the Change Password page appears. You
can then change the default password for logging in. For all other settings, the
factory default configurations apply.
You must log in again after changing your password.
STEP 1 Click Next on the Welcome page of the Wizard. The Configure Device - IP
Address window appears.
STEP 2 Click Dynamic IP Address (DHCP) if you want the WAP device to receive an IP
address from a DHCP server. Or select Static IP Address to configure IP Address
manually. For a description of these fields, see VLAN and IPv4 Address Settings.
STEP 3 Click Next. The Single Point Setup — Set a Cluster window appears. For a
description of Single Point Setup, see Single Point Setup.
STEP 4 To create a new Single Point Setup of WAP devices, select Create a New Cluster
and specify a New Cluster Name. When you configure your devices with the
same cluster name and enable Single Point Setup mode on other WAP devices,
they automatically join the group.

Getting Started
Using the Access Point Setup Wizard
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 7
1
If you already have a cluster on your network, you can add this device to it by
clicking Join an Existing Cluster, and then entering the Existing Cluster Name.
If you do not want this device to participate in a Single Point Setup at this time,
click Do not Enable Single Point Setup.
(Optional) You can enter text in the AP Location field to note the physical location
of the WAP device.
STEP 5 Click Next. The Configure Device - Set System Date and Time window appears.
STEP 6 Select your time zone, and then set the system time manually or set up the WAP
device to get its time from an NTP server. For a description of these options, see
Time Settings.
STEP 7 Click Next. The Enable Security - Set Password window appears.
STEP 8 Enter a New Password and enter it again in the Confirm Password text box. For
more information about passwords, see User Accounts.
NOTE You can uncheck the Password Complexity box if you wish to disable
the password security rules. However, we strongly recommend keeping the
password security rules enabled.
STEP 9 Click Next. The Enable Security - Name Your Wireless Network window appears
for the Radio 1 interface.
NOTE For this window and the following two windows (Wireless Security
and VLAN ID), you configure these settings for the Radio 1 interface first.
Then, for WAP561 devices, the windows repeat to enable you to configure
these settings for Radio 2.
STEP 10 Enter a Network Name. This name serves as the SSID for the default wireless
network.
STEP 11 Click Next. The Enable Security - Secure Your Wireless Network window appears.
STEP 12 Choose a security encryption type and enter a security key. For a description of
these options, see System Security.
STEP 13 Click Next. The Wizard displays the Enable Security- Assign the VLAN ID For Your
Wireless Network window.
STEP 14 Enter a VLAN ID for traffic received on the wireless network.
It is suggested that you assign a different VLAN ID from the default (1) to wireless
traffic, in order to segregate it from management traffic on VLAN 1.
STEP 15 Click Next.

Getting Started
Using the Access Point Setup Wizard
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 8
1
STEP 16 For the WAP561 device, the Network Name, Wireless Security, and VLAN ID
pages show to enable configuring Radio 2. When finished with configuring Radio
2, click Next.
The Wizard displays the Enable Captive Portal - Create Your Guest Network
window.
STEP 17 Select whether or not to set up an authentication method for guests on your
network, and click Next.
If you click No, skip to STEP 25.
If you click Yes, the Wizard displays the Enable Captive Portal - Name Your Guest
Network window.
STEP 18 Specify a Guest Network Name for Radio 1. For the WAP561 device, select
whether the guest network uses Radio 1 or Radio 2.
STEP 19 Click Next. The Wizard displays the Enable Captive Portal - Secure Your Guest
Network window.
STEP 20 Choose a security encryption type for the guest network and enter a security key.
For a description of these options, see System Security.
STEP 21 Click Next. The Wizard displays the Enable Captive Portal - Assign the VLAN ID
window.
STEP 22 Specify a VLAN ID for the guest network. The guest network VLAN ID should be
different from the management VLAN ID.
STEP 23 Click Next. The Wizard displays the Enable Captive Portal - Enable Redirect URL
window.
STEP 24 Select Enable Redirect URL and specify a fully qualified domain name or IP
address in the Redirect URL field (including http://). If specified, guest network
users are redirected to the specified URL after authenticating.
STEP 25 Click Next. The Wizard displays the Summary - Confirm Your Settings window.
STEP 26 Review the settings that you configured. Click Back to reconfigure one or more
settings. If you click Cancel, all settings are returned to the previous or default
values.
STEP 27 If they are correct, click Submit. Your WAP setup settings are saved and a
confirmation window appears.
STEP 28 Click Finish. The Getting Started window appears.

Getting Started
Getting Started
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 9
1
Getting Started
To simplify device configuration through quick navigation, the Getting Started
page provides links for performing common tasks. The Getting Started page is the
default window every time you log into the web-based AP configuration utility.
Links on the Getting Started Page
Category Link Name (on the Page) Linked Page
Initial Setup Run Setup Wizard Using the Access
Point Setup Wizard
Configure Radio Settings Radio
Configure Wireless Network Settings Networks
Configure LAN Settings LAN
Run WPS WPS Setup
Configure Single Point Setup Single Point Setup
Device
Status
System Summary System Summary
Wireless Status Network Interfaces
Quick
Access
Change Account Password User Accounts
Upgrade Device Firmware Manage Firmware
Backup/Restore Configuration Download/Backup
Configuration File

Getting Started
Window Navigation
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 10
1
Window Navigation
This section describes the features of the web-based AP configuration utility.
The Configuration Utility header contains standard information and appears at the
top on every page. It provides these buttons:
A navigation pane, or main menu, is located on the left side of each page. The
navigation pane is a list of the top-level features of the WAP devices. If a main
menu item is preceded by an arrow, select to expand and display the submenu of
each group. You can then select on the desired submenu item to open the
associated page.
The table below describes the commonly used buttons that appear on various
pages in the system.
Buttons
Button Name Description
(User) The account name (Administrator or Guest) of the user
logged into the WAP device. The factory default user
name is cisco.
Log Out Click to log out of the web-based AP configuration utility.
About Click to show the WAP device type and version number.
Help Click to show the online help. The online help is designed
to be viewed with browsers using UTF-8 encoding. If the
online help shows errant characters, verify that the
encoding settings on your browser are set to UTF-8.
Management Buttons
Button Name Description
Add Adds a new entry to the table or database.
Cancel Cancels the changes made to the page.
Clear All Clears all entries in the log table.
Delete Deletes an entry in a table. Select an entry first.

Getting Started
Window Navigation
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 11
1
Edit Edits or modifies an existing entry. Select an entry first.
Refresh Redisplays the current page with the latest data.
Save Saves the settings or configuration.
Update Updates the new information to the startup
configuration.
Management Buttons (Continued)
Button Name Description

2
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 12
Status and Statistics
This chapter describes how to display status and statistics and contains these
topics:
•System Summary
•Network Interfaces
•Traffic Statistics
•WorkGroup Bridge Transmit/Receive
•Associated Clients
•TSPEC Client Associations
•TSPEC Status and Statistics
•TSPEC AP Statistics
•Radio Statistics
•Email Alert Status
•Log
System Summary
The System Summary page shows basic information such as the hardware model
description, software version, and the time that has elapsed since the last reboot.
To view system information, select Status and Statistics > System Summary in
the navigation pane. Or, select System Summary under Device Status on the
Getting Started page.
The System Summary page shows this information:
•PID VID—The WAP hardware model and version.

Status and Statistics
System Summary
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 13
2
•Serial Number—The serial number of the Cisco WAP device.
•Base MAC Address—The WAP MAC address.
•Firmware Version (Active Image)—The firmware version number of the
active image.
•Firmware MD5 Checksum (Active Image)—The checksum for the active
image.
•Firmware Version (Non-active)—The firmware version number of the
backup image.
•Firmware MD5 Checksum (Non-active)—The checksum for the backup
image.
•Host Name—A name assigned to the device.
•System Uptime—The time that has elapsed since the last reboot.
•System Time—The current system time.
•
The TCP/UDP Service table shows basic information about protocols and
services operating on the WAP.
•Service—The name of the service, if available.
•Protocol—The underlying transport protocol that the service uses (TCP or
UDP).
•Local IP Address—The IP address, if any, of a remote device that is
connected to this service on the WAP device. All indicates that any IP
address on the device can use this service.
•Local Port—The port number for the service.
•Remote IP Address—The IP address of a remote host, if any, that is using
this service. All indicates that the service is available to all remote hosts that
access the system.
•Remote Port—The port number of any remote device communicating with
this service.
•Connection State—The state of the service. For UDP, only connections in
the Active or Established states appear in the table. The TCP states are:
-Listening—The service is listening for connection requests.

Status and Statistics
Network Interfaces
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 14
2
-Active—A connection session is established and packets are being
transmitted and received.
-Established—A connection session is established between the WAP
device and a server or client, depending on the role of each device with
respect to this protocol.
-Time Wait—The closing sequence has been initiated and the WAP is
waiting for a system-defined timeout period (typically 60 seconds)
before closing the connection.
You can click Refresh to refresh the screen and show the most current information.
Network Interfaces
Use the Network Interfaces page to show configuration and status information
about the wired and wireless interfaces. To show the Network Interfaces page,
select Status and Statistics > Network Interface in the navigation pane.
The Network Interfaces page shows this information:
•LAN Status—These settings apply to the internal interface.
To change any of these settings, click the Edit link. After you click Edit, you
are redirected to the VLAN and IPv4 Address Settings page. See VLAN and
IPv4 Address Settings for descriptions of these fields.
•Radio Status—These settings include the Wireless Radio mode (Enabled
or Disabled), the MAC address associated with the radio interface (or both
radio interfaces for WAP561 devices), the 802.11 mode (a/b/g/n), and the
channel used by the interface.
To change the wireless settings, click the Edit link. After you click Edit, you
are redirected to the Radio page. See Radio for descriptions of these fields.
•Interface Status—This table lists status information for each Virtual Access
Point (VAP) and on each Wireless Distribution System (WDS) interface. On
WAP561 devices, WLAN0 or WLAN1 precedes the VAP interface ID to
indicate the associated radio interface. WLAN0 represents radio 1 and
WLAN1 represents radio 2.

Status and Statistics
Traffic Statistics
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 15
2
If the VAP has been configured, the table lists the SSID, the administrative
status (up or down), the MAC address of the radio interface, the VLAN ID,
the name of any associated scheduler profile, and the current state (active
or inactive). The state indicates whether the VAP is exchanging data with a
client.
You can click Refresh to refresh the screen and show the most current information.
Traffic Statistics
Use the Traffic Statistics page to view basic information about the WAP. It also
provides a real-time display of transmit and receive statistics for the Ethernet
interface, the Virtual Access Points (VAPs), and any WDS interfaces. All transmit
and receive statistics reflect the totals since the WAP was last started. If you
reboot the WAP, these figures indicate transmit and receive totals since the reboot.
To show the Traffic Statistics page, select Status and Statistics > Traffic
Statistics in the navigation pane.
The Traffic Statistics page shows summary data and statistics for traffic in each
direction.
•Network Interface—Name of the Ethernet interface and each VAP and
WDS interface.
On WAP561 devices, WLAN0 and WLAN1 precede the VAP interface name
to indicate the radio interface (WLAN0 represents radio 1 and WLAN1
represents radio 2).
•Total Packets—The total packets sent (in Transmit table) or received (in
Received table) by this WAP device.
•Total Bytes—The total bytes sent (in Transmit table) or received (in
Received table) by this WAP device.
•Total Dropp e d Packet s—The total number of dropped packets sent (in
Transmit table) or received (in Received table) by this WAP device.
•Total Dropped Bytes—The total number of dropped bytes sent (in Transmit
table) or received (in Received table) by this WAP device.
•Errors—The total number of errors related to sending and receiving data on
this WAP device.
You can click Refresh to refresh the screen and show the most current information.

Status and Statistics
WorkGroup Bridge Transmit/Receive
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 16
2
WorkGroup Bridge Transmit/Receive
The WorkGroup Bridge Transmit/Receive page shows packet and byte counts for
traffic between stations on a WorkGroup Bridge. For information on configuring
WorkGroup Bridges, see WorkGroup Bridge.
To show the WorkGroup Bridge Transmit/Receive page, select Status and
Statistics > WorkGroup Bridge in the navigation pane.
Each network interface that is configured as a WorkGroup Bridge interface shows
these fields:
•Network Interface—Name of the Ethernet or VAP interface. On WAP561
devices, WLAN0 represents radio 1 and WLAN1 represents radio 2.
•Status and Statistics—Whether the interface is disconnected or is
administratively configured as up or down.
•VLAN ID—Virtual LAN (VLAN) ID. You can use VLANs to establish multiple
internal and guest networks on the same WAP device. The VLAN ID is set on
the VAP tab.
•Name (SSID)—Wireless network name. Also known as the SSID, this
alphanumeric key uniquely identifies a wireless local area network. The
SSID is set on the VAP tab.
Additional information appears for the transmit and receive direction for each
WorkGroup Bridge interface:
•Total Packets—The total number of packets bridged between the wired
clients in the WorkGroup Bridge and the wireless network.
•Total Bytes—The total number of bytes bridged between the wired clients
in the WorkGroup Bridge and the wireless network.
You can click Refresh to refresh the screen and show the most current information.
Associated Clients
You can use the Associated Clients page to view the client stations associated
with a particular access point.
To show the Associated Clients page, select Status and Statistics > Associated
Clients in the navigation pane.

Status and Statistics
Associated Clients
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 17
2
The associated stations are shown along with information about packet traffic
transmitted and received for each station.
•Total Number of Associated Clients—The total number of clients currently
associated with the WAP device.
•Network Interface—The VAP the client is associated with. On WAP561
devices, WLAN0 and WLAN1 precede the VAP interface name to indicate
the radio interface (WLAN0 represents radio 1 and WLAN1 represents
radio 2).
•Station—The MAC address of the associated wireless client.
•Status—The Authenticated and Associated Status shows the underlying
IEEE 802.11 authentication and association status, which is present no
matter which type of security the client uses to connect to the WAP device.
This status does not show IEEE 802.1X authentication or association status.
These are some points to keep in mind with regard to this field:
-If the WAP device security mode is None or Static WEP, the
authentication and association status of clients appears as expected;
that is, if a client shows as authenticated to the WAP device, it is able to
transmit and receive data. (The reason why is that Static WEP uses only
IEEE 802.11 authentication.)
-If the WAP device uses IEEE 802.1X or WPA security, it is possible for a
client association to appear as authenticated (through IEEE 802.11
security) although it is not actually authenticated through the second
layer of security.
•From Station/To Station—For the From Station, the counters indicate the
packets or bytes received by the wireless client. For the To Station, the
counters indicate the number of packets and bytes transmitted from the
WAP device to the wireless client.
-Packets—Number of packets received (transmitted) from the wireless
client.
-Bytes—Number of bytes received (transmitted) from the wireless client.
-Drop Packets—Number of packets dropped after being received
(transmitted).
-Drop Bytes—Number of bytes that dropped after being received
(transmitted).

Status and Statistics
TSPEC Client Associations
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 18
2
-TS Violate Packets (From Station)—Number of packets sent from a
client STA to the WAP device in excess of its active Traffic Stream (TS)
uplink bandwidth, or for an access category requiring admission control
to which the client STA has not been admitted.
-TS Violate Packets (To Station)—Number of packets sent from the
WAP device to a client STA in excess of its active TS downlink
bandwidth, or for an access category requiring admission control to
which the client STA has not been admitted.
•Up Time—The amount of time the client has been associated with the WAP
device.
You can click Refresh to refresh the screen and show the most current information.
TSPEC Client Associations
The TSPEC Client Associations page provides real-time information about the
TSPEC client data transmitted and received by this access point. The tables on
the TSPEC Client Associations page show voice and video packets transmitted
and received since the association started, along with status information.
A TSPEC is a traffic specification that is sent from a QoS-capable wireless client to
a WAP device requesting a certain amount of network access for the Traffic
Stream (TS) it represents. A traffic stream is a collection of data packets identified
by the wireless client as belonging to a particular user priority. An example of a
voice traffic stream is a Wi-Fi CERTIFIED telephone handset that marks its codec-
generated data packets as voice priority traffic. An example of a video traffic
stream is a video player application on a wireless laptop that prioritizes a video
conference feed from a corporate server.
To view TSPEC client association statistics, select Status and Statistics > TSPEC
Client Associations in the navigation pane.
The TSPEC Client Associations page shows this information:
Status and Statistics:
•Network Interface—Radio interface used by the client. On WAP561
devices, WLAN0 represents radio 1 and WLAN1 represents radio 2.
•SSID—Service set identifier associated with this TS client.
•Station—Client station MAC address.

Status and Statistics
TSPEC Client Associations
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point 19
2
•TS Identifier—TSPEC Traffic Session Identifier (range 0 to 7).
•Access Category—TS Access Category (voice or video).
•Direction—Traffic direction for this TS. Direction can be one of these
options:
-uplink—From client to device.
-downlink—From device to client.
-bidirectional
•User Priority—User Priority (UP) for this TS. The UP is sent with each
packet in the UP portion of the IP header. Typical values are as follows:
-6 or 7 for voice
-4 or 5 for video
The value may differ depending on other priority traffic sessions.
•Medium Time—Time that the TS traffic occupies the transmission medium.
•Excess Usage Events—Number of times that the client has exceeded the
medium time established for its TSPEC. Minor, infrequent violations are
ignored.
•VAP MAC Address—Virtual Access Point MAC address.
Statistics:
•Network Interface—Radio interface used by the client.
•Station—Client station MAC address.
•TS Identifier—TSPEC Traffic Session Identifier (range 0 to 7).
•Access Category—TS Access Category (voice or video).
•Direction—The traffic direction for this TS. Direction can be one of these
options:
-uplink—From client to device.
-downlink—From device to client.
-bidirectional