Cisco WAP121 Instruction Manual

Cisco Small Business
WAP121 Wireless-N Access Point with PoE and
WAP321 Wireless-N Selectable-Band Access Point
with PoE
ADMINISTRATION
GUIDE

© 2012 Cisco Systems, Inc. All rights reserved. 78-20373-01
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,
go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner
does not imply a partnership relationship between Cisco and any other company. (1110R)

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 3
Contents
Chapter 1: Getting Started 8
Starting the Web-based Configuration Utility 8
Launching the Web-based Configuration Utility 9
Logging Out 10
Using the Access Point Setup Wizard 10
Getting Started 11
Window Navigation 12
Configuration Utility Header 12
Navigation Window 13
Management Buttons 13
Chapter 2: Viewing Statistics 14
System Summary 14
Network Interfaces 16
Traffic Statistics 17
WorkGroup Bridge Transmit/Receive 18
Associated Clients 19
TSPEC Client Associations 20
TSPEC Status and Statistics 22
TSPEC AP Statistics 24
RADIO Statistics 24
Email Alert Status 26
Log 27
Chapter 3: Administration 28
System Settings 29
User Accounts 29
Adding a User 29
Changing a User Password 30
Time Settings 31

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 4
Contents
Log Settings 33
Configuring the Persistent Log 33
Remote Log Server 34
Email Alert 35
Email Alert Examples: 37
HTTP/HTTPS Service 37
Configuring HTTP and HTTPS Services 37
Managing SSL Certificates 39
Telnet/SSH Service 40
Management Access Control 40
Firmware Upgrade 41
TFTP Upgrade 41
HTTP Upgrade 42
Download/Backup Configuration File 43
Backing Up a Configuration File 43
Downloading a Configuration File 44
Configuration Files Properties 45
Copy/Save Configuration 46
Reboot 47
Discovery—Bonjour 47
Packet Capture 48
Packet Capture Configuration 49
Local Packet Capture 50
Remote Packet Capture 51
Packet Capture File Download 54
Chapter 4: LAN Settings 55
Port Settings 55
LAN Settings 56
Chapter 5: Wireless Settings 59

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 5
Contents
Radio 60
Rogue AP Detection 67
Networks 70
SSID Naming Conventions 70
VLAN IDs 71
Configuring VAPs 71
Configuring Security Settings 74
Scheduler 83
Adding Scheduler Profiles 83
Configuring Scheduler Rules 84
Scheduler Association 85
Bandwidth Utilization 85
MAC Filtering 86
Configuring a MAC Filter List Locally on the WAP device 86
Configuring MAC Authentication on the RADIUS Server 88
WDS Bridge 88
Work Group Bridge 90
Quality of Service 93
WPS Setup 96
WPS Overview 96
Configuring WPS Settings 102
WPS Process 104
Enrolling a Client Using the PIN Method 104
Enrolling a Client Using the Push Button Method 105
Viewing Instance Summary Information 105
Chapter 6: System Security 106
RADIUS Server 106
802.1X Supplicant 108
Password Complexity 110
WPA-PSK Complexity 111

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 6
Contents
Chapter 7: Client Quality of Service 112
ACLs 112
IPv4 and IPv6 ACLs 112
MAC ACLs 113
Configuring ACLs 113
Class Map 119
Adding a Class Map 120
Defining a Class Map 120
Policy Map 124
Client QoS Association 126
Client QoS Status 128
Chapter 8: Simple Network Management Protocol 130
SNMP Overview 130
General SNMP Settings 131
SNMP Views 133
SNMP Groups 134
SNMP Users 136
SNMP Targets 137
Chapter 9: Captive Portal 139
Global Captive Portal Configuration 140
Instance Configuration 141
Instance Association 144
Upload Binary Files 145
Web Customization 146
Web Customization Preview 149
Local Groups 149
Local Users 150
Authenticated Clients 151

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 7
Contents
Failed Authentication Clients 152
Appendix A: Where to Go From Here 154

1
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 8
Getting Started
This chapter provides an introduction to the web-based access point
configuration utility, and includes these topics:
•Starting the Web-based Configuration Utility
•Using the Access Point Setup Wizard
•Getting Started
•Window Navigation
Starting the Web-based Configuration Utility
This section describes system requirements and how to navigate the web-based
configuration utility.
Supported Browsers
•Internet Explorer 7.0 or later
•Chrome 5.0 or later
•Firefox 3.0 or later
•Safari 3.0 or later
Browser Restrictions
•If you are using Internet Explorer 6, you cannot directly use an IPv6 address
to access the WAP device. You can, however, use the DNS (Domain Name
System) server to create a domain name that contains the IPv6 address,
and then use that domain name in the address bar in place of the IPv6
address.
•When using Internet Explorer 8, you can configure security settings from
Internet Explorer. Click Tools > Internet Options and then select the
Security tab. Select Local Intranet and click Sites. Click Advanced and

Getting Started
Starting the Web-based Configuration Utility
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 9
1
then click Add. Add the intranet address of the WAP device (http://<ip-
address>) to the local intranet zone. The IP address can also be specified
as the subnet IP address, so that all addresses in the subnet are added to
the local intranet zone.
•If you have multiple IPv6 interfaces on your management station, use the
IPv6 global address instead of the IPv6 local address to access the WAP
device from your browser.
Launching the Web-based Configuration Utility
To open the web-based configuration utility:
STEP 1 Open a Web browser.
STEP 2 Enter the IP address of the WAP device that you are configuring in the address bar
on the browser, and then press Enter. The Login page opens.
•To find your IP address, you can use the Cisco FindIT Network Discovery
Utility. This tool enables you to automatically discover all supported Cisco
Small Business devices in the same local network segment as your
computer. For more information, see www.cisco.com/go/findit.
•For further instructions on how to locate the IP address of your WAP device,
see the Quick Start Guide. See Where to Go From Here for document
locations.
STEP 3 Enter the user name and password. The factory default user name is cisco and the
default password is cisco.
STEP 4 Click Login. The Access Point Startup Wizard page opens.
If this is the first time that you logged on with the default user name (cisco) and the
default password (cisco) or your password has expired, the Change Admin
Password page opens. Enter the new password and confirm it, click Apply, and
then click Close. The new password is saved. Then, enter the user name cisco and
the new password on the Login page.
See Using the Access Point Setup Wizard, page 10 for instructions on using the
wizard.

Getting Started
Using the Access Point Setup Wizard
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 10
1
Logging Out
By default, the web-based configuration utility logs out after 10 minutes of
inactivity. See HTTP/HTTPS Service for instructions on changing the default
timeout period.
To logout, click Logout in the top right corner of the web-based configuration
utility.
Using the Access Point Setup Wizard
The first time that you log into the WAP device (or after it has been reset to the
factory default settings), the Access Point Startup Wizard displays to help you
perform initial configurations. Follow these steps to complete the wizard:
NOTE If you click Cancel to bypass the Wizard, the Change Password page displays. You
can then change the default password for logging in. For all other settings, the
factory default configuration will apply.
STEP 1 Click Next on the Welcome page of the Wizard. The Configure Device - IP
Address window displays.
STEP 2 Click Dynamic IP Address (DHCP) if you want the WAP device to receive an IP
address from a DHCP server. Or select Static IP Address to configure IP Address
manually. For a description of these fields, see LAN Settings, page 56.
STEP 3 Click Next. The Configure Device - Set System Date and Time window displays.
STEP 4 Select your time zone, and then set the system time manually or set up the WAP
device to get its time from an NTP server. For a description of these options, see
Time Settings, page 31.
STEP 5 Click Next. The Enable Security - Set Password window displays.
STEP 6 Enter a New Password and enter it again in the Confirm Password text box. For
more information about passwords, see User Accounts, page 29.
NOTE You can click the Password Complexity check box if you wish to
disable the password security rules. However, it is strongly recommend to
keep the password security rules enabled.
STEP 7 Click Next. The Enable Security - Name Your Wireless Network window
displays.

Getting Started
Getting Started
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 11
1
STEP 8 Enter a Network Name. This name serves as the SSID for the default wireless
network.
STEP 9 Click Next. The Enable Security - Secure Your Wireless Network window
displays.
STEP 10 Choose a security encryption type and enter a security key. For a description of
these options, see System Security, page 106.
STEP 11 Click Next. The Wizard displays the Enable Security- Confirm Security Settings
window.
STEP 12 Review the settings that you configured. Click Back to reconfigure one or more
settings. If you click Cancel, all settings are returned to the previous or default
values.
STEP 13 If they are correct, click Submit. Your WAP setup settings will be saved and a
confirmation window displays
STEP 14 Click Finish. The Getting Started window displays.
Getting Started
To simplify device configuration through quick navigation, the Getting Started
page provides links for performing common tasks. The Getting Started page is
the default window every time you log into the web-based configuration utility and
it provides links for performing common tasks.
Links on the Getting Started Page
Category Link Name (on the Page) Linked Page
Initial Setup Run Setup Wizard Using the Access
Point Setup Wizard
Configure Radio Settings Radio
Configure Wireless Network Settings Networks
Configure LAN Settings LAN Settings
Run WPS WPS Setup
Device
Status
System Summary System Summary
Wireless Status Network Interfaces

Getting Started
Window Navigation
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 12
1
Window Navigation
This section describes the features of the web-based configuration utility.
Configuration Utility Header
Configuration Utility Header
The Configuration Utility header contains standard information and is displayed at
the top on every page. It provides these buttons:
Quick
Access
Change Account Password User Accounts
Upgrade Device Firmware Firmware Upgrade
Backup/Restore Configuration Download/Backup
Configuration File
Other
Resources
Support Cisco WAP support
site
Forums Cisco Support
Community site
Links on the Getting Started Page (Continued)
Category Link Name (on the Page) Linked Page
Buttons
Button Name Description
(User) The account name (Administrator or Guest) of the user
logged into the WAP device. The factory default user
name is cisco.
Log Out Click to log out of the web-based configuration utility.
About Click to display the WAP device type and version number.
Help Click to display the online help.

Getting Started
Window Navigation
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 13
1
Navigation Window
Navigation Window / Main Menu
A navigation window, or main menu, is located on the left side of each page. The
navigation window is a list of the top-level features of the WAP devices. If a main
menu item is preceded by an arrow, click to expand and display the sub-menu of
each group. You can then click on the desired sub-menu item to open the
associated page.
Management Buttons
Management Buttons
The table below describes the commonly used buttons that appear on various
pages in the system.
Management Buttons
Button Name Description
Add Adds a new entry to the table or database.
Cancel Cancels the changes made to the page.
Clear All Clears all entries in the log table.
Delete Deletes an entry in a table. Select an entry first.
Edit Edits or modifies an existing entry. Select an entry first.
Refresh Redisplays the current page with the latest data.
Save Saves the settings or configuration.
Update Updates the new information to the Running
Configuration.

2
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 14
Viewing Statistics
This chapter describes how to display Cisco WAP121 and WAP321 statistics and
contains these topics.
•System Summary
•Network Interfaces
•Traffic Statistics
•WorkGroup Bridge Transmit/Receive
•Associated Clients
•TSPEC Client Associations
•TSPEC Status and Statistics
•TSPEC AP Statistics
•RADIO Statistics
•Email Alert Status
•Log
System Summary
The System Summary page displays basic information such as the hardware
model description, software version, and system up time.
To view system information, click Status and Statistics > System Summary in the
navigation window. Or, click System Summary under Device Status on the
Getting Started page.
The System Summary page displays this information:
•PID VID—The WAP hardware model and version.

Viewing Statistics
System Summary
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 15
2
•Serial Number—The serial number of the Cisco WAP121 and WAP321.
•Base MAC Address—The WAP MAC address.
•Firmware Version—The firmware version number of the active image.
•Firmware MD5 Checksum—The checksum for the active image.
•Host Name—A name assigned to the device.
•System Uptime—The time that has elapsed since the last reboot.
•System Time—The current system time.
The TCP/UDP Service table displays basic information about protocols and
services operating on the WAP.
•Service—The name of the service, if available.
•Protocol—The underlying transport protocol that the service uses (TCP or
UDP).
•Local IP Address—The IP address, if any, of a remote device that is
connected to this service on the WAP device. All indicates that any IP
address on the device can use this service.
•Local Port—The port number for the service.
•Remote IP Address—The IP address of a remote host, if any, that is using
this service. All indicates that the service is available to all remote hosts that
access the system.
•Remote Port—The port number of any remote device communicating with
this service.
•Connection State—The state of the service. For UDP, only connections in
the Active state display in the table. In the Active state, a connection is
established between the WAP device and a client or server. The TCP states
are:
-Listening—The service is listening for connection requests.
-Active—A connection session is established and packets are being
transmitted and received.
-Established—A connection session is established between the WAP
device and a server or client, depending on each device’s role with
respect to this protocol.

Viewing Statistics
Network Interfaces
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 16
2
-Time Wait—The closing sequence has been initiated and the WAP is
waiting for a system-defined timeout period (typically 60 seconds)
before closing the connection.
You can click Refresh to refresh the screen and display the most current
information.
Network Interfaces
Use the Network Interfaces page to display configuration and status information
about the wired and wireless interfaces. To display this page, click Status and
Statistics > Network Interface in the navigation window.
The Network Interfaces page displays this information:
•LAN Status—These settings apply to the internal interface. For the
WAP321, the display includes if Green Ethernet mode is enabled.
To change any of these settings, click the Edit link. After you click Edit, you
are redirected to the LAN page. See LAN Settings, page 56 for
descriptions of these fields.
•Radio Status—These settings include the Wireless Radio mode (Enabled
or Disabled), the MAC address associated with each radio interface, the
802.11 mode (a/b/g/n), and the channel used by the interface.
To change the wireless settings, click the Edit link. After you click Edit, you
are redirected to the Radio page. See Radio, page 60 for descriptions of
these fields.
You can click Refresh to refresh the screen and display the most current
information.

Viewing Statistics
Traffic Statistics
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 17
2
Traffic Statistics
Use the Traffic Statistics page to view basic information about the WAP. It also
provides a real-time display of transmit and receive statistics for the Ethernet
interface and the Virtual Access Points (VAPs) on both radio interfaces. All transmit
and receive statistics reflect the totals since the WAP was last started. If you
reboot the WAP, these figures indicate transmit and receive totals since the reboot.
To display this page, click Status and Statistics > Traffic Statistics in the
navigation window.
The Traffic Statistics page displays summary data and statistics for traffic in each
direction.
•Network Interface—Name of the Ethernet or VAP interface.
•Name (SSID)—Wireless network name. Also known as the SSID, this
alphanumeric key uniquely identifies a wireless local area network. The
SSID is set on the VAP tab. See Configuring VAPs, page 71.
•Status—Whether the interface is up or down.
•MAC Address—MAC address for the specified interface. The WAP device
has a unique MAC address for each interface.
•VLAN ID—Virtual LAN (VLAN) ID. You can use VLANs to establish multiple
internal and guest networks on the same WAP device. The VLAN ID is set on
the VAP tab. See Configuring VAPs, page 71. The statistics display
separately for the transmit and receive traffic.
•Total Packets—The total packets sent (in Transmit table) or received (in
Received table) by this WAP device.
•Total Bytes—The total bytes sent (in Transmit table) or received (in
Received table) by this WAP device.
•Total Dropped Packet s—The total number of dropped packets sent (in
Transmit table) or received (in Received table) by this WAP device.
•Total Dropped Bytes—The total number of dropped bytes sent (in Transmit
table) or received (in Received table) by this WAP device.
•Errors—The total number of errors related to sending and receiving data on
this WAP device.
You can click Refresh to refresh the screen and display the most current
information.

Viewing Statistics
WorkGroup Bridge Transmit/Receive
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 18
2
WorkGroup Bridge Transmit/Receive
The WorkGroup Bridge Transmit/Receive page displays packet and byte counts
for traffic between stations on a workgroup bridge. For information on configuring
workgroup bridges, see Work Group Bridge, page 90.
To display this page, click Status and Statistics > WorkGroup Bridge in the
navigation window.
This information displays for each network interface that is configured as a
workgroup bridge interface:
•Network Interface—Name of the Ethernet or VAP interface.
•Status and Statistics—Whether the interface is disconnected or is
administratively configured as up or down.
•VLAN ID—Virtual LAN (VLAN) ID. You can use VLANs to establish multiple
internal and guest networks on the same WAP device. The VLAN ID is set on
the VAP tab. See Configuring VAPs, page 71.
•Name (SSID)—Wireless network name. Also known as the SSID, this
alphanumeric key uniquely identifies a wireless local area network. The
SSID is set on the VAP tab. See Configuring VAPs, page 71.
This additional information displays for the transmit and receive direction for each
workgroup bridge interface:
•Total Packets—The total number of packets bridged between the wired
clients in the workgroup bridge and the wireless network.
•Total Bytes—The total number of bytes bridged between the wired clients
in the workgroup bridge and the wireless network.
You can click Refresh to refresh the screen and display the most current
information.

Viewing Statistics
Associated Clients
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 19
2
Associated Clients
You can use the Associated Clients page to view the client stations associated
with a particular access point.
To display this page, click Status and Statistics > Associated Clients in the
navigation window.
The associated stations are displayed along with information about packet traffic
transmitted and received for each station.
•Total Number of Associated Clients—The total number of clients currently
associated with the WAP device.
•Network Interface—The VAP the client is associated with. For example, an
entry of wlan0vap2 means the client is associated with the radio interface
(wlan0) and VAP 2.
•Station—The MAC address of the associated wireless client.
•Status—The Authenticated and Associated Status shows the underlying
IEEE 802.11 authentication and association status, which is present no
matter which type of security the client uses to connect to the WAP device.
This status does not show IEEE 802.1X authentication or association status.
These are some points to keep in mind with regard to this field:
-If the WAP device security mode is None or Static WEP, the
authentication and association status of clients showing on the Client
Associations tab will be in line with what is expected; that is, if a client
shows as authenticated to the WAP device, it will be able to transmit and
receive data. (This is because Static WEP uses only IEEE 802.11
authentication.)
-If the WAP device uses IEEE 802.1X or WPA security, it is possible for a
client association to show on this tab as authenticated (through IEEE
802.11 security) but not actually authenticated through the second layer
of security.
•From Station/To Station—For the From Station, the below counters
indicate the packets or bytes received by the wireless client. For the To
Station, these counters indicate the number of packets and bytes
transmitted from the WAP device to the wireless client.
-Packets—Number of packets received (transmitted) from the wireless
client.

Viewing Statistics
TSPEC Client Associations
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 20
2
-Bytes—Number of bytes received (transmitted) from the wireless client.
-Drop Packets—Number of packets dropped after being received
(transmitted).
-Drop Bytes—Number of bytes that dropped after being received
(transmitted).
-TS Violate Packets (From Station)—Number of packets sent from a
client STA to the WAP device in excess of its active Traffic Stream (TS)
uplink bandwidth, or for an access category requiring admission control
to which the client STA has not been admitted.
-TS Violate Packets (To Station)—Number of packets sent from the
WAP device to a client STA in excess of its active TS downlink
bandwidth, or for an access category requiring admission control to
which the client STA has not been admitted.
•Up Time—The amount of time the client has been associated with the WAP
device.
You can click Refresh to refresh the screen and display the most current
information.
TSPEC Client Associations
The TSPEC Client Associations page provides information about the TSPEC
client data transmitted and received by this access point. The tables on this page
show voice and video packets transmitted and received by the association, along
with status information.
This page shows a real-time display of the transmit and receive statistics for the
TSPEC clients. All transmit and receive statistics shown are totals since the client
association started.
A TSPEC is a traffic specification that is sent from a QoS-capable wireless client to
a WAP device requesting a certain amount of network access for the Traffic
Stream (TS) it represents. A traffic stream is a collection of data packets identified
by the wireless client as belonging to a particular user priority. An example of a
voice traffic stream is a Wi-Fi CERTIFIED telephone handset that marks its codec-
generated data packets as voice priority traffic. An example of a video traffic
stream is a video player application on a wireless laptop that prioritizes a video
conference feed from a corporate server.