Cisco WAP131 Instruction Manual

Cisco WAP131 Wireless-N Dual Radio Access Point
with PoE
Cisco WAP351 Wireless-N Dual Radio Access Point
with 5 Ports Switch
ADMINISTRATION
GUIDE

© 2014 Cisco Systems, Inc. All rights reserved. OL-32504-01
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,
go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner
does not imply a partnership relationship between Cisco and any other company. (1110R)

Cisco WAP131 and WAP351 Administration Guide 3
Contents
Chapter 1: Getting Started 9
Getting Started with the Configuration 9
Supported Browsers 9
Browser Restrictions 9
Launching the Web-based Configuration Utility 10
Logging Out 11
Using the Access Point Setup Wizard 11
Configuring Cisco WAP131 Setup Wizard 12
Configuring Cisco WAP351 Setup Wizard 13
Changing the Default Password 16
Quick Start Configuration 17
Window Navigation 18
Configuration Utility Header 18
Navigation Pane/Main Menu 18
Management Buttons 19
Chapter 2: Status and Statistics 20
System Summary 20
Network Interfaces 22
Traffic Statistics 25
WorkGroup Bridge Transmit/Receive 25
Associated Clients 26
Radio Statistics 28
Email Alert Status 29
View Log 30
TSPEC Client Associations 30
TSPEC Status and Statistics 32
TSPEC AP Statistics 34

Cisco WAP131 and WAP351 Administration Guide 4
Contents
Chapter 3: Administration 35
System Settings 36
User Accounts 36
Adding a User 37
Changing a User Password 37
Time Settings 38
Automatically Acquiring the Time Settings through NTP 38
Manually Configuring the Time Settings 39
Log Settings 40
Configuring the Persistent Log 40
Configuring Remote Log Server 41
Email Alert 42
Configuring Email Alert Settings 43
Email Alert Examples 44
HTTP/HTTPS Service 45
Configuring HTTP and HTTPS Services 45
Managing SSL Certificates 47
Management Access Control 48
Manage Firmware 48
Swapping the Firmware Image 49
TFTP Upgrade 49
HTTP/HTTPS Upgrade 50
Manage Configuration File 51
Backup Configuration File 51
Download Configuration File 52
Copy/Save Configuration 53
Configuration Files Properties 54
Reboot 54
Discovery—Bonjour 55
Packet Capture 56
Packet Capture Configuration 56

Cisco WAP131 and WAP351 Administration Guide 5
Contents
Local Packet Capture 57
Remote Packet Capture 59
Packet Capture Status 62
Packet Capture File Download 62
Support Information 63
Spanning Tree Settings 63
Chapter 4: LAN 65
Port Settings 65
Configuring Port Settings for Cisco WAP131 65
Configuring Port Settings for Cisco WAP351 66
VLAN Configuration 67
Configuring VLAN Settings for Cisco WAP131 67
Configuring VLAN Settings for Cisco WAP351 68
IPv4 Setting 69
IPv6 Setting 70
Chapter 5: Wireless 74
Radio 74
Rogue AP Detection 81
Viewing the Rogue AP List 82
Saving the Trusted AP List 84
Importing a Trusted AP List 84
Networks 85
SSID Naming Conventions 85
VLAN IDs 86
Configuring VAPs 86
Configuring Security Settings 89
None (Plain-text) 89
Static WEP 89
Static WEP Rules 91
Dynamic WEP 91

Cisco WAP131 and WAP351 Administration Guide 6
Contents
WPA Personal 93
WPA Enterprise 94
Scheduler 97
Adding Scheduler Profiles 97
Configuring Scheduler Rules 98
Scheduler Association 99
Bandwidth Utilization 99
MAC Filtering 100
Configuring a MAC Filter List Locally on the WAP device 100
Configuring MAC Authentication on the RADIUS Server 101
WDS Bridge 102
Configuring STP for Cisco WAP131 103
Configuring Untagged VLAN for Cisco WAP351 103
Configuring WDS Bridge 104
WEP on WDS Links 105
WPA/PSK on WDS Links 105
WorkGroup Bridge 106
Quality of Service 109
Chapter 6: System Security 113
RADIUS Server 113
802.1X/802.1X Supplicant 115
Configure 802.1X Supplicant for Cisco WAP131 115
Configure 802.1X for Cisco WAP351 117
Password Complexity 120
WPA-PSK Complexity 121
Chapter 7: Quality of Service 122
Global Settings 122
Configuring QoS Settings for Cisco WAP131 122
Configuring QoS Settings for Cisco WAP351 123

Cisco WAP131 and WAP351 Administration Guide 7
Contents
Class Map 124
Configuring an IPv4 Class Map 124
Configuring an IPv6 Class Map 127
Configuring a MAC Class Map 129
Policy Map 131
QoS Association 133
QoS Status 133
Chapter 8: ACL 135
ACL Rule 135
IPv4 and IPv6 ACLs 135
MAC ACLs 136
Workflow to Configure ACLs 136
Configure IPv4 ACLs 136
Configure IPv6 ACLs 140
Configure MAC ACLs 142
ACL Association 144
ACL Status 145
Chapter 9: SNMP 147
General 147
Views 150
Groups 151
Users 153
Targets 154
Chapter 10: Captive Portal 156
Global Configuration 157
Local Groups/Users 158
Local Groups 158
Local Users 159

Cisco WAP131 and WAP351 Administration Guide 8
Contents
Instance Configuration 160
Instance Association 163
Web Portal Customization 164
Configuring CP Authentication Page 164
Uploading and Deleting Images 167
Authenticated Clients 168
Chapter 11: Single Point Setup 170
Single Point Setup Overview 170
Managing Single Point Setup Across Access Points 171
Single Point Setup Negotiation 172
Operation of a Device Dropped From a Single Point Setup 173
Configuration Parameters Propagated and Not Propagated to Single Point
Setup Access Points 173
Access Points 175
Configuring the WAP Device for Single Point Setup 175
Viewing Single Point Setup Information 176
Adding a WAP Device to a Single Point Setup 177
Removing a WAP Device from a Single Point Setup 177
Navigating to Configuration Information for a Specific Device 177
Navigating to a Device Using its IP Address in a URL 178
Sessions 178
Channel Management 180
Configuring and Viewing the Channel Assignments 180
Viewing Channel Assignments and Setting Locks 181
Configuring Advanced Settings 182
Wireless Neighborhood 183
Viewing Neighboring Devices 183
Viewing Details for a Single Point Setup Member 185
Appendix A: Where to Go From Here 186

1
Cisco WAP131 and WAP351 Administration Guide 9
Getting Started
This chapter provides an introduction to the web-based Configuration Utility of the
Cisco WAP131 and WAP351 Wireless-N Dual Radio Access Points. It includes
these topics:
•Getting Started with the Configuration
•Using the Access Point Setup Wizard
•Changing the Default Password
•Quick Start Configuration
•Window Navigation
Getting Started with the Configuration
This section describes system requirements and how to access the web-based
Configuration Utility.
Supported Browsers
Before you begin to use the configuration utility, make sure that you have a
computer with Internet Explorer 7.0 or later, Firefox 3.0 or later, Chrome 5.0 or later,
or Safari 3.0 or later.
Browser Restrictions
•If you are using Internet Explorer 6, you cannot directly use an IPv6 address
to access the WAP device. You can, however, use the Domain Name System
(DNS) server to create a domain name that contains the IPv6 address, and
then use that domain name in the address bar in place of the IPv6 address.

Getting Started
Getting Started with the Configuration
Cisco WAP131 and WAP351 Administration Guide 10
1
•When using Internet Explorer 8, you can configure security settings from
Internet Explorer.
-Select Tools -> Internet Options and then select the Security tab.
-Select Local Intranet and then select Sites.
-Select Advanced and then select Add. Add the intranet address of the
WAP device (http://<ip- address>) to the local intranet zone. The IP
address can also be specified as the subnet IP address so that all
addresses in the subnet are added to the local intranet zone.
•If you have multiple IPv6 interfaces on your management station, use the
IPv6 global address instead of the IPv6 local address to access the WAP
device from your browser.
Launching the Web-based Configuration Utility
Follow these steps to access the configuration utility from your computer to
configure the WAP device:
STEP 1 Connect the WAP deviceto the same network (IP subnet) as your computer. The
factory default IP address configuration of the WAP device is DHCP. Make sure
that your DHCP server is running and can be reached.
STEP 2 Locate the IP address of the WAP device.
a. The WAP device can be accessed and managed by Cisconetwork tools and
services including the Cisco FindIT Network Discovery Utility that enables you
to automatically discover all supported Cisco devices in the same local
network segment as your computer. You can get a snapshot view of each
device or launch the product configurationutility to view and configure the
settings. For more information, see http://www.cisco.com/go/findit.
b. The WAP device is Bonjour-enabled and automatically broadcasts its services
and listens for services being advertised by other Bonjour-enabled devices. If
you have a Bonjour-enabled browser, such as Microsoft Internet Explorer with a
Bonjour plug-in, or the Apple Mac Safari browser, you can find the WAP device
on your local network without knowing its IP address.
You can download the complete Bonjour for Microsoft Internet Explorer browser
from Apple’s website by visiting: http://www.apple.com/bonjour/.
c. Locate the IP address assigned by your DHCP server by accessing your router
or DHCP server. See your DHCP server instructions for more information.

Getting Started
Using the Access Point Setup Wizard
Cisco WAP131 and WAP351 Administration Guide 11
1
STEP 3 Launch a web browser, such as Microsoft Internet Explorer.
STEP 4 In the address bar, enter the default DHCP address and press the Enter key.
STEP 5 Enter the default user name of cisco and password of cisco in the Username and
Password fields.
STEP 6 Click Log In. The Access Point Setup Wizard appears.
Follow the Setup Wizard instructions to finish the WAP device installation. We
strongly recommend that you use the Setup Wizard for the first installation. See
Using the Access Point Setup Wizard for more information.
Logging Out
By default, the configuration utility logs out after 10 minutes of inactivity. See
HTTP/HTTPS Service for instructions on changing the default timeout period.
To log out, click Logout in the top right corner of the configuration utility.
Using the Access Point Setup Wizard
The first time that you log into the WAP device (or after it has been reset to the
factory default settings), the Access Point Setup Wizard appears to help you
perform initial configuration.
NOTE If you click Cancel to bypass the wizard, the Change Password page appears. You
can then change the default password for logging in (see Changing the Default
Password for more information). For all other settings, the factory default
configurations apply.

Getting Started
Using the Access Point Setup Wizard
Cisco WAP131 and WAP351 Administration Guide 12
1
Configuring Cisco WAP131 Setup Wizard
Follow these steps to complete the wizard (you must log in again after changing
your password):
STEP 1 Click Next on the Welcome page of the wizard. The Configure Device - IP Address
window appears.
STEP 2 Click Dynamic IP Address (DHCP) if you want the WAP device to receive an IP
address from a DHCP server, or click Static IP Address to configure the IP
address manually. For a description of these fields, see IPv4 Setting.
STEP 3 Click Next. The Configure Device - Set System Date and Time window appears.
STEP 4 Select your time zone and then set the system time manually or set up the WAP
device to get its time from an NTP server. For a description of these options, see
Time Settings.
STEP 5 Click Next. The Configure Device - Set Password window appears.
STEP 6 Enter a new password in the New Password field and enter it again in the Confirm
Password field.
NOTE Uncheck Password Complexity if you want to disable the password
security rules. However, we strongly recommend keeping the password security
rules enabled. For more information about passwords, see Password Complexity.
STEP 7 Click Next. The Configure Radio 1 - Name Your Wireless Network window
appears.
STEP 8 Enter a Network Name. This name serves as the SSID for the default wireless
network.
STEP 9 Click Next. The Configure Radio 1 - Secure Your Wireless Network window
appears.
STEP 10 Choose a security encryption type and enter a security key. For a description of
these options, see Configuring Security Settings.
STEP 11 Click Next. The Configure Radio 1 - Assign The VLAN ID For Your Wireless
Network window appears.
STEP 12 Enter a VLAN ID for traffic received on the wireless network.

Getting Started
Using the Access Point Setup Wizard
Cisco WAP131 and WAP351 Administration Guide 13
1
We recommend that you assign a different VLAN ID from the default (1) to wireless
traffic, in order to segregate it from management traffic on VLAN 1.
STEP 13 Click Next. Repeat the step 7 to step 12 to configure the settings for Radio 2
interface.
STEP 14 Click Next. The Summary - Confirm Your Settings window appears.
STEP 15 Review the settings that you configured. Click Back to reconfigure one or more
settings. If you click Cancel, all settings are returned to the previous or default
values.
STEP 16 If they are correct, click Submit. Your WAP setup settings are saved and a
confirmation window appears.
STEP 17 Click Finish.
The WAP device was configured successfully. You are required to log in again with
the new password.
Configuring Cisco WAP351 Setup Wizard
Follow these steps to complete the wizard (you must log in again after changing
your password):
STEP 1 Click Next on the Welcome page of the wizard. The Configure Device - IP Address
window appears.
STEP 2 Click Dynamic IP Address (DHCP) if you want the WAP device to receive an IP
address from a DHCP server, or click Static IP Address to configure the IP
address manually. For a description of these fields, see IPv4 Setting.
STEP 3 Click Next. The Single Point Setup — Set A Cluster window appears. For a
description of Single Point Setup, see Single Point Setup.
STEP 4 To create a new Single Point Setup of the WAP device, click Create a New Cluster
and enter a New Cluster Name. When you configure your devices with the same
cluster name and enable the Single Point Setup mode on other WAP devices, they
automatically join the group.

Getting Started
Using the Access Point Setup Wizard
Cisco WAP131 and WAP351 Administration Guide 14
1
If you already have a cluster on your network, you can add this device to it by
clicking Join an Existing Cluster, and then entering the Existing Cluster Name.
If you do not want this device to participate in a Single Point Setup at this time,
click Do not Enable Single Point Setup.
(Optional) You can enter the location in the AP Location field to note the physical
location of the WAP device.
STEP 5 Click Next. The Configure Device - Set System Date And Time window appears.
STEP 6 Choose your time zone, and then set the system time manually or set up the WAP
device to get its time from an NTP server. For a description of these options, see
Time Settings.
STEP 7 Click Next. The Configure Device - Set Password window appears.
STEP 8 Enter a New Password and enter it again in the Confirm Password field.
NOTE Uncheck Password Complexity if you want to disable the password
security rules. However, we strongly recommend keeping the password security
rules enabled. For more information about passwords, see Password Complexity.
STEP 9 Click Next. The Configure Radio 1 - Name Your Wireless Network window
appears.
STEP 10 Enter a Network Name. This name serves as the SSID for the default wireless
network.
STEP 11 Click Next. The Configure Radio 1 - Secure Your Wireless Network window
appears.
STEP 12 Choose a security encryption type and enter a security key. For a description of
these options, see Configuring Security Settings.
STEP 13 Click Next. The Configure Radio 1 - Assign The VLAN ID For Your Wireless
Network window appears.
STEP 14 Choose the VLAN ID for traffic received on the wireless network.
We recommend that you assign a different VLAN ID from the default (1) to the
wireless traffic, in order to segregate it from the management traffic on VLAN 1.
STEP 15 Click Next. Repeat the step 9 to step 14 to configure the settings for Radio 2
interface.
STEP 16 Click Next. The Enable Captive Portal - Create Your Guest Network window
appears.

Getting Started
Using the Access Point Setup Wizard
Cisco WAP131 and WAP351 Administration Guide 15
1
STEP 17 Select whether or not to set up an authentication method for guests on your
network, and click Next.
If you click No, skip to Step 25.
If you click Yes, the Enable Captive Portal - Name Your Guest Network window
appears.
STEP 18 Specify a Guest Network Name.
STEP 19 Click Next. The Enable Captive Portal - Secure Your Guest Network window
appears.
STEP 20 Choose a security encryption type for the guest network and enter a security key.
For a description of these options, see Configuring Security Settings.
STEP 21 Click Next. The Enable Captive Portal - Assign the VLAN ID window appears.
STEP 22 Specify a VLAN ID for the guest network. The guest network VLAN ID should be
different from the management VLAN ID.
STEP 23 Click Next. The Enable Captive Portal - Enable Redirect URL window appears.
STEP 24 Check Enable Redirect URL and enter a fully qualified domain name (FQDN) or IP
address in the Redirect URL field (including http://). If specified, the guest
network users are redirected to the specified URL after authenticating.
STEP 25 Click Next. The Summary - Confirm Your Settings window appears.
STEP 26 Review the settings that you configured. Click Back to reconfigure one or more
settings. If you click Cancel, all settings are returned to the previous or default
values.
STEP 27 If they are correct, click Submit. Your setup settings are saved and a confirmation
window appears.
STEP 28 Click Finish.
The WAP device was configured successfully. You are required to log in again with
the new password.

Getting Started
Changing the Default Password
Cisco WAP131 and WAP351 Administration Guide 16
1
Changing the Default Password
For security reasons, you are required to change the administrative password
from its default settings at your first login. If you click Cancel to bypass the wizard,
the Change Password page appears. You can then change the default password
for logging in.
Password complexity is enabled by default. The minimum password complexity
requirements are shown on the Change Password page. The new password must
comply with the default complexity rules, or it can be disabled temporarily by
disabling Password Complexity. See Password Complexity for more
information.
To change the default administrative password:
STEP 1 Enter the following fields to set a new password:
•Old Password—Enter the current password (default is cisco).
•New Password—Enter a new password.
•Confirm Password—Enter the new password again for confirmation.
•Password Strength Meter—Displays the strength of the new password.
•Password Complexity—The password complexity enabled by default
requires the password to conform to the following complexity settings:
-Is different from the user name.
-Is different from the current password.
-Has a minimum length of eight characters.
-Contains characters from at least three character classes (uppercase
letters, lowercase letters, numbers, and special characters available on a
standard keyboard).
NOTE Check Disable next to the Password Complexity option if you want to
disable the password complexity rules. However, we strongly recommend keeping
the password complexity rules enabled.
STEP 2 Click Save.
The Getting Started page appears. You are now ready to configure the WAP
device.

Getting Started
Quick Start Configuration
Cisco WAP131 and WAP351 Administration Guide 17
1
Quick Start Configuration
To simplify the device configuration through quick navigation, the Getting Started
page provides links for performing common tasks. The Getting Started page is the
default window every time that you log into the configuration utility.
There are three hot links on the Getting Started page that take you to specific web
pages for more information. You can:
•Click the Support link to direct you to the product support page.
•Click the Forums link to direct you to the Cisco Support Community page.
•Click the Wireless Planning Tool link to direct you to the AirMagnet Planner
page.
Category Link Name (on the Page) Linked Page
Initial Setup Run Setup Wizard Using the Access Point
Setup Wizard
Configure Radio Settings Radio
Configure Wireless Network
Settings
Networks
Configure LAN Settings LAN
Configure Port Settings Port Settings
Configure Single Point Setup
(for WAP351 only)
Single Point Setup
Quick Access Change Account Password User Accounts
Upgrade Device Firmware Manage Firmware
Backup/Restore
Configuration
Manage Configuration
File
Device Status System Summary System Summary
Wireless Status Network Interfaces

Getting Started
Window Navigation
Cisco WAP131 and WAP351 Administration Guide 18
1
Window Navigation
This section describes the features of the configuration utility.
Configuration Utility Header
The configuration utility header contains standard information and appears at the
top on every page. It provides these buttons:
Navigation Pane/Main Menu
A navigation pane, or main menu, is located on the left side of each page. The
navigation pane is a list of the top-level features of the WAP device. If a main menu
item is preceded by an arrow, select to expand and display the submenu of each
group. You can then select on the desired submenu item to open the associated
page.
Button Name Description
(User) The account name (Administrator or Guest) of the user
logged into the WAP device. The factory default user
name is cisco.
Log Out Click to log out of the configuration utility.
About Click to show the WAP device type and version
number.
Help Click to show the context-sensitive online help. The
online help is designed to be viewed with browsers
using UTF-8 encoding. If the online help shows errant
characters, verify that the encoding settings on your
browser are set to UTF-8.

Getting Started
Window Navigation
Cisco WAP131 and WAP351 Administration Guide 19
1
Management Buttons
The following table describes the commonly used buttons that appear on various
pages in the system:
Button Name Description
Add Adds a new entry to the table or database.
Cancel Cancels the changes made to the page.
Clear All Clears all entries in the log table.
Delete Deletes an entry in a table. Select an entry first.
Edit Edits or modifies an existing entry. Select an entry first.
Refresh Redisplays the current page with the latest data.
Save Saves the settings or configuration.
Update Updates the new information to the startup
configuration.

2
Cisco WAP131 and WAP351 Administration Guide 20
Status and Statistics
This chapter describes how to display status and statistics of the WAP device. It
contains these topics:
•System Summary
•Network Interfaces
•Traffic Statistics
•WorkGroup Bridge Transmit/Receive
•Associated Clients
•Radio Statistics
•Email Alert Status
•View Log
•TSPEC Client Associations
•TSPEC Status and Statistics
•TSPEC AP Statistics
System Summary
The System Summary page shows basic information such as the hardware model
description, software version, and the time that has elapsed since the last reboot.
To view system information, select Status and Statistics > System Summary, or
click System Summary under Device Status on the Getting Started page.
The following information is displayed:
•PID VID—The hardware model and version of the WAP device.
•Serial Number—The serial number of the WAP device.