Cisco WAP121 Instruction Manual

Cisco Small Business
WAP121 Wireless-N Access Point with PoE
and
WAP321 Wireless-N Selectable-Band Access Point
with PoE
ADMINISTRATION
GUIDE

© 2012 Cisco Systems, Inc. All rights reserved. 78-20373-02
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,
go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner
does not imply a partnership relationship between Cisco and any other company. (1110R)

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 1
Contents
Chapter 1: Getting Started 7
Starting the Web-Based Configuration Utility 7
Launching the Web-Based Configuration Utility 8
Logging Out 9
Using the Access Point Setup Wizard 9
Getting Started 12
Window Navigation 13
Configuration Utility Header 13
Navigation Pane 13
Management Buttons 14
Chapter 2: Status and Statistics 15
System Summary 15
Network Interfaces 17
Traffic Statistics 18
WorkGroup Bridge Transmit/Receive 18
Associated Clients 19
TSPEC Client Associations 21
TSPEC Status and Statistics 23
TSPEC AP Statistics 24
Radio Statistics 25
Email Alert Status 26
Log 27
Chapter 3: Administration 28
System Settings 29
User Accounts 29
Adding a User 30
Changing a User Password 30
Time Settings 31

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 2
Contents
Log Settings 33
Configuring the Persistent Log 33
Remote Log Server 34
Email Alert 35
Email Alert Examples 37
HTTP/HTTPS Service 38
Configuring HTTP and HTTPS Services 38
Managing SSL Certificates 39
Management Access Control 40
Upgrade Firmware 41
TFTP Upgrade 41
HTTP Upgrade 42
Firmware Recovery 43
Download/Backup Configuration File 45
Backing Up a Configuration File 45
Downloading a Configuration File 46
Configuration Files Properties 47
Copy/Save Configuration 47
Reboot 48
Discovery—Bonjour 49
Packet Capture 49
Packet Capture Configuration 50
Local Packet Capture 51
Remote Packet Capture 52
Packet Capture File Download 55
Support Information 56
Chapter 4: LAN 57
Port Settings 57
VLAN and IPv4 Address Settings 58
IPv6 Addresses 59

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 3
Contents
Chapter 5: Wireless 62
Radio 62
Rogue AP Detection 69
Viewing the Rogue AP List 70
Creating and Saving a Trusted AP List 72
Importing a Trusted AP List 72
Networks 73
SSID Naming Conventions 73
VLAN IDs 74
Configuring VAPs 74
Configuring Security Settings 77
None (Plain-text) 77
Static WEP 77
Dynamic WEP 79
WPA Personal 81
WPA Enterprise 83
Scheduler 85
Adding Scheduler Profiles 85
Configuring Scheduler Rules 86
Scheduler Association 87
Bandwidth Utilization 88
MAC Filtering 88
Configuring a MAC Filter List Locally on the WAP Device 88
Configuring MAC Authentication on the RADIUS Server 89
WDS Bridge 90
WEP on WDS Links 92
WPA/PSK on WDS Links 92
WorkGroup Bridge 93
Quality of Service 96
WPS Setup 99
WPS Overview 99
Usage Scenarios 100

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 4
Contents
WPS Roles 101
Enabling and Disabling WPS on a VAP 101
External and Internal Registration 102
Client Enrollment 102
Optional Use of Built-In Registrar 103
Lockdown Capability 103
VAP Configuration Changes 104
External Registration 104
Exclusive Operation of WPS Transactions 105
Backward Compatibility with WPS Version 1.0 105
Configuring WPS Settings 105
Instance Status 107
WPS Process 107
Enrolling a Client Using the PIN Method 107
Enrolling a Client Using the Push Button Method 108
Viewing Instance Status Information 109
Viewing Instance Summary Information 109
Chapter 6: System Security 110
RADIUS Server 110
802.1X Supplicant 112
Password Complexity 114
WPA-PSK Complexity 115
Chapter 7: Client Quality of Service 116
Client QoS Global Settings 116
ACL 116
IPv4 and IPv6 ACLs 117
MAC ACLs 117
Configuring ACLs 117
Class Map 124
Adding a Class Map 124
Defining a Class Map 125
Policy Map 129

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 5
Contents
Client QoS Association 130
Client QoS Status 132
Chapter 8: Simple Network Management Protocol 134
SNMP Overview 134
General SNMP Settings 135
Views 137
Groups 138
Users 140
Targets 141
Chapter 9: Captive Portal 143
Captive Portal Global Configuration 144
Instance Configuration 145
Instance Association 148
Web Portal Customization 148
Uploading and Deleting Images 151
Local Groups 152
Local Users 153
Authenticated Clients 154
Failed Authentication Clients 155
Chapter 10: Single Point Setup 157
Single Point Setup Overview 157
Managing Single Point Setup Across WAP Devices 158
Single Point Setup Negotiation 159
Operation of a WAP Device Dropped From a Single Point Setup 160
Propagation of Configuration Settings and Parameters in
Single Point Setup 160
Access Points 162
Configuring the WAP Device for Single Point Setup 162

Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 6
Contents
Viewing Single Point Setup Information 164
Adding a New Access Point to a Single Point Setup Cluster 164
Removing an Access Point from a Single Point Setup Cluster 165
Navigating to Configuration Information for a Specific WAP Device 165
Navigating to a WAP Device Using its IP Address in a URL 166
Sessions 166
Channel Management 167
Viewing Channel Assignments and Setting Locks 169
Current Channel Assignments Table 169
Proposed Channel Assignments Table 170
Configuring Advanced Settings 170
Wireless Neighborhood 171
Viewing Details for a Cluster Member 173

1
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 7
Getting Started
This chapter provides an introduction to the Wireless Access Point (WAP) devices
web-based configuration utility, and includes these topics:
•Starting the Web-Based Configuration Utility
•Using the Access Point Setup Wizard
•Getting Started
•Window Navigation
Starting the Web-Based Configuration Utility
This section describes system requirements and how to navigate the web-based
configuration utility.
Supported Browsers
•Internet Explorer 7.0 or later
•Chrome 5.0 or later
•Firefox 3.0 or later
•Safari 3.0 or later
Browser Restrictions
•If you are using Internet Explorer 6, you cannot directly use an IPv6 address
to access the WAP device. You can, however, use the Domain Name System
(DNS) server to create a domain name that contains the IPv6 address, and
then use that domain name in the address bar in place of the IPv6 address.
•When using Internet Explorer 8, you can configure security settings from
Internet Explorer. Select Tools > Internet Options and then select the
Security tab. Select Local Intranet and select Sites. Select Advanced and
then select Add. Add the intranet address of the WAP device (http://<ip-

Getting Started
Starting the Web-Based Configuration Utility
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 8
1
address>) to the local intranet zone. The IP address can also be specified
as the subnet IP address, so that all addresses in the subnet are added to
the local intranet zone.
•If you have multiple IPv6 interfaces on your management station, use the
IPv6 global address instead of the IPv6 local address to access the WAP
device from your browser.
Launching the Web-Based Configuration Utility
To open the configuration utility:
STEP 1 Open a web browser.
Enter the IP address of the WAP device that you are configuring in the address bar
on the browser and then press Enter. The Login page opens.
•To find your IP address, you can use the Cisco FindIT Network Discovery
Utility. This tool enables you to automatically discover all supported Cisco
Small Business devices in the same local network segment as your
computer. For more information, go to cisco.com and enter www.cisco.com/
go/findit.
•For further instructions on how to locate the IP address of your WAP device,
see the WAP device Quick Start Guide.
STEP 2 Enter the user name and password. The factory default user name is cisco and the
default password is cisco.
STEP 3 Click Log In. The Access Point Setup Wizard page opens.
If this is the first time that you logged on with the default user name (cisco) and the
default password (cisco) or your password has expired, the Change Admin
Password page opens. Enter the new password and confirm it, click Apply, and
then click Close. The new password is saved. Then, enter the user name cisco and
the new password on the Login page.
See Using the Access Point Setup Wizard for instructions on using the wizard.

Getting Started
Using the Access Point Setup Wizard
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 9
1
Logging Out
By default, the configuration utility logs out after 10 minutes of inactivity. See
HTTP/HTTPS Service for instructions on changing the default timeout period.
To log out, click Logout in the top right corner of the configuration utility.
Using the Access Point Setup Wizard
The first time that you log into the WAP device (or after it has been reset to the
factory default settings), the Access Point Setup Wizard appears to help you
perform initial configurations. Follow these steps to complete the wizard:
NOTE If you click Cancel to bypass the Wizard, the Change Password page appears. You
can then change the default password for logging in. For all other settings, the
factory default configurations apply.
You must log in again after changing your password.
STEP 1 Click Next on the Welcome page of the Wizard. The Configure Device - IP
Address window appears.
STEP 2 Click Dynamic IP Address (DHCP) if you want the WAP device to receive an IP
address from a DHCP server. Or select Static IP Address to configure IP Address
manually. For a description of these fields, see VLAN and IPv4 Address Settings.
STEP 3 Click Next. The Single Point Setup — Set a Cluster window appears. For a
description of Single Point Setup, see Single Point Setup.
STEP 4 To create a new Single Point Setup of WAP devices, select Create a New Cluster
and specify a New Cluster Name. When you configure your devices with the
same cluster name and enable Single Point Setup mode on other WAP devices,
they automatically join the group.
If you already have a cluster on your network, you can add this device to it by
clicking Join an Existing Cluster, and then entering the Existing Cluster Name.
If you do not want this device to participate in a Single Point Setup at this time,
click Do not Enable Single Point Setup.
(Optional) You can enter text in the AP Location field to note the physical location
of the WAP device.
STEP 5 Click Next. The Configure Device - Set System Date and Time window appears.

Getting Started
Using the Access Point Setup Wizard
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 10
1
STEP 6 Select your time zone, and then set the system time manually or set up the WAP
device to get its time from an NTP server. For a description of these options, see
Time Settings.
STEP 7 Click Next. The Enable Security - Set Password window appears.
STEP 8 Enter a New Password and enter it again in the Confirm Password text box. For
more information about passwords, see User Accounts.
NOTE You can uncheck the Password Complexity box if you wish to disable
the password security rules. However, we strongly recommend keeping the
password security rules enabled.
STEP 9 Click Next. The Enable Security - Name Your Wireless Network window appears.
STEP 10 Enter a Network Name. This name serves as the SSID for the default wireless
network.
STEP 11 Click Next. The Enable Security - Secure Your Wireless Network window appears.
STEP 12 Choose a security encryption type and enter a security key. For a description of
these options, see System Security.
STEP 13 Click Next. The Wizard displays the Enable Security- Assign the VLAN ID For Your
Wireless Network window.
STEP 14 Enter a VLAN ID for traffic received on the wireless network.
It is suggested that you assign a different VLAN ID from the default (1) to wireless
traffic, in order to segregate it from management traffic on VLAN 1.
STEP 15 Click Next.
For the WAP121 device, the Wizard displays the Summary - Confirm Your Settings
window. Skip to STEP 24.
For the WAP321 device, the Wizard displays the Enable Captive Portal - Create
Your Guest Network window.
STEP 16 Select whether or not to set up an authentication method for guests on your
network (WAP321 only), and click Next.
If you click No, skip to STEP 24.
If you click Yes, the Wizard displays the Enable Captive Portal - Name Your Guest
Network window.
STEP 17 Specify a Guest Network Name.

Getting Started
Using the Access Point Setup Wizard
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 11
1
STEP 18 Click Next. The Wizard displays the Enable Captive Portal - Secure Your Guest
Network window.
STEP 19 Choose a security encryption type for the guest network and enter a security key.
For a description of these options, see System Security.
STEP 20 Click Next. The Wizard displays the Enable Captive Portal - Assign the VLAN ID
window.
STEP 21 Specify a VLAN ID for the guest network. The guest network VLAN ID should be
different from the management VLAN ID.
STEP 22 Click Next. The Wizard displays the Enable Captive Portal - Enable Redirect URL
window.
STEP 23 Select Enable Redirect URL and specify a fully qualified domain name or IP
address in the Redirect URL field (including http://). If specified, guest network
users are redirected to the specified URL after authenticating.
STEP 24 Click Next. The Wizard displays the Summary - Confirm Your Settings window.
STEP 25 Review the settings that you configured. Click Back to reconfigure one or more
settings. If you click Cancel, all settings are returned to the previous or default
values.
STEP 26 If they are correct, click Submit. Your WAP setup settings are saved and a
confirmation window appears.
STEP 27 Click Finish. The Getting Started window appears.

Getting Started
Getting Started
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 12
1
Getting Started
To simplify device configuration through quick navigation, the Getting Started
page provides links for performing common tasks. The Getting Started page is the
default window every time you log into the configuration utility.
Links on the Getting Started Page
Category Link Name (on the Page) Linked Page
Initial Setup Run Setup Wizard Using the Access
Point Setup Wizard
Configure Radio Settings Radio
Configure Wireless Network Settings Networks
Configure LAN Settings LAN
Run WPS WPS Setup
Configure Single Point Setup Single Point Setup
Device
Status
System Summary System Summary
Wireless Status Network Interfaces
Quick
Access
Change Account Password User Accounts
Upgrade Device Firmware Upgrade Firmware
Backup/Restore Configuration Download/Backup
Configuration File
Other
Resources
Support A link to the Cisco WAP
support site.
Forums A link to the Cisco
Support Community
site.
Wireless Planning Tool A link to Fluke networks
AirMagnet Planner for
Cisco Small Business.

Getting Started
Window Navigation
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 13
1
Window Navigation
This section describes the features of the configuration utility.
Configuration Utility Header
The Configuration Utility header contains standard information and appears at the
top on every page. It provides these buttons:
Navigation Pane
A navigation pane, or main menu, is located on the left side of each page. The
navigation pane is a list of the top-level features of the WAP devices. If a main
menu item is preceded by an arrow, select to expand and display the submenu of
each group. You can then select on the desired submenu item to open the
associated page.
Buttons
Button Name Description
(User) The account name (Administrator or Guest) of the user
logged into the WAP device. The factory default user
name is cisco.
Log Out Click to log out of the configuration utility.
About Click to show the WAP device type and version number.
Help Click to show the online help. The online help is designed
to be viewed with browsers using UTF-8 encoding. If the
online help shows errant characters, verify that the
encoding settings on your browser are set to UTF-8.

Getting Started
Window Navigation
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 14
1
Management Buttons
The table below describes the commonly used buttons that appear on various
pages in the system.
Management Buttons
Button Name Description
Add Adds a new entry to the table or database.
Cancel Cancels the changes made to the page.
Clear All Clears all entries in the log table.
Delete Deletes an entry in a table. Select an entry first.
Edit Edits or modifies an existing entry. Select an entry first.
Refresh Redisplays the current page with the latest data.
Save Saves the settings or configuration.
Update Updates the new information to the startup
configuration.

2
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 15
Status and Statistics
This chapter describes how to display status and statistics and contains these
topics:
•System Summary
•Network Interfaces
•Traffic Statistics
•WorkGroup Bridge Transmit/Receive
•Associated Clients
•TSPEC Client Associations
•TSPEC Status and Statistics
•TSPEC AP Statistics
•Radio Statistics
•Email Alert Status
•Log
System Summary
The System Summary page shows basic information such as the hardware model
description, software version, and the time that has elapsed since the last reboot.
To view system information, select Status and Statistics > System Summary in
the navigation pane. Or, select System Summary under Device Status on the
Getting Started page.
The System Summary page shows this information:
•PID VID—The WAP hardware model and version.

Status and Statistics
System Summary
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 16
2
•Serial Number—The serial number of the Cisco WAP device.
•Base MAC Address—The WAP MAC address.
•Firmware Version—The firmware version number of the active image.
•Firmware MD5 Checksum—The checksum for the active image.
•Host Name—A name assigned to the device.
•System Uptime—The time that has elapsed since the last reboot.
•System Time—The current system time.
•Power Source—The system may be powered by a power adapter, or may
be receiving power-over-Ethernet from PoE power-sourcing equipment
(PSE).
The TCP/UDP Service table shows basic information about protocols and
services operating on the WAP.
•Service—The name of the service, if available.
•Protocol—The underlying transport protocol that the service uses (TCP or
UDP).
•Local IP Address—The IP address, if any, of a remote device that is
connected to this service on the WAP device. All indicates that any IP
address on the device can use this service.
•Local Port—The port number for the service.
•Remote IP Address—The IP address of a remote host, if any, that is using
this service. All indicates that the service is available to all remote hosts that
access the system.
•Remote Port—The port number of any remote device communicating with
this service.
•Connection State—The state of the service. For UDP, only connections in
the Active state appear in the table. In the Active state, a connection is
established between the WAP device and a client or server. The TCP states
are:
-Listening—The service is listening for connection requests.
-Active—A connection session is established and packets are being
transmitted and received.

Status and Statistics
Network Interfaces
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 17
2
-Established—A connection session is established between the WAP
device and a server or client, depending on the role of each device with
respect to this protocol.
-Time Wait—The closing sequence has been initiated and the WAP is
waiting for a system-defined timeout period (typically 60 seconds)
before closing the connection.
You can click Refresh to refresh the screen and show the most current information.
Network Interfaces
Use the Network Interfaces page to show configuration and status information
about the wired and wireless interfaces. To show the Network Interfaces page,
select Status and Statistics > Network Interface in the navigation pane.
The Network Interfaces page shows this information:
•LAN Status—These settings apply to the internal interface. For the
WAP321, the information indicates whether or not Green Ethernet mode is
enabled.
To change any of these settings, click the Edit link. After you click Edit, you
are redirected to the VLAN and IPv4 Address Settings page. See VLAN and
IPv4 Address Settings for descriptions of these fields.
•Radio Status—These settings include the Wireless Radio mode (Enabled
or Disabled), the MAC address associated with the radio interface, the
802.11 mode (a/b/g/n), and the channel used by the interface.
To change the wireless settings, click the Edit link. After you click Edit, you
are redirected to the Radio page. See Radio for descriptions of these fields.
•Interface Status—This table lists status information for each Virtual Access
Point (VAP) and on each Wireless Distribution System (WDS) interface.
If the VAP has been configured, the table lists the SSID, the administrative
status (up or down), the MAC address of the radio interface, the VLAN ID,
the name of any associated scheduler profile, and the current state (active
or inactive). The state indicates whether the VAP is exchanging data with a
client.
You can click Refresh to refresh the screen and show the most current information.

Status and Statistics
Traffic Statistics
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 18
2
Traffic Statistics
Use the Traffic Statistics page to view basic information about the WAP. It also
provides a real-time display of transmit and receive statistics for the Ethernet
interface, the Virtual Access Points (VAPs), and any WDS interfaces. All transmit
and receive statistics reflect the totals since the WAP was last started. If you
reboot the WAP, these figures indicate transmit and receive totals since the reboot.
To show the Traffic Statistics page, select Status and Statistics > Traffic
Statistics in the navigation pane.
The Traffic Statistics page shows summary data and statistics for traffic in each
direction.
•Network Interface—Name of the Ethernet interface and each VAP and
WDS interface.
Each VAP interface name is followed by its SSID in parentheses.
•Total Packets—The total packets sent (in Transmit table) or received (in
Received table) by this WAP device.
•Total Bytes—The total bytes sent (in Transmit table) or received (in
Received table) by this WAP device.
•Total Dropp ed Packet s—The total number of dropped packets sent (in
Transmit table) or received (in Received table) by this WAP device.
•Total Dropped Bytes—The total number of dropped bytes sent (in Transmit
table) or received (in Received table) by this WAP device.
•Errors—The total number of errors related to sending and receiving data on
this WAP device.
You can click Refresh to refresh the screen and show the most current information.
WorkGroup Bridge Transmit/Receive
The WorkGroup Bridge Transmit/Receive page shows packet and byte counts for
traffic between stations on a WorkGroup Bridge. For information on configuring
WorkGroup Bridges, see WorkGroup Bridge.
To show the WorkGroup Bridge Transmit/Receive page, select Status and
Statistics > WorkGroup Bridge in the navigation pane.