Cisco WAP371 Instruction Manual

Cisco Small Business
WAP371 Wireless-AC/N Dual Radio Access Point
with Single Point Setup
ADMINISTRATION
GUIDE

Cisco Small Business WAP371 Wireless Access Point Administration Guide 1
Contents
Chapter 1: Getting Started 5
Starting the Web-Based Configuration Utility 5
Using the Access Point Setup Wizard 6
Getting Started 9
Window Navigation 10
Chapter 2: Status and Statistics 13
System Summary 13
Network Interfaces 15
Traffic Statistics 16
WorkGroup Bridge Transmit/Receive 16
Associated Clients 17
TSPEC Client Associations 18
TSPEC Status and Statistics 20
TSPEC AP Statistics 22
Radio Statistics 22
Email Alert Status 24
Log 24
Chapter 3: Administration 25
System Settings 25
User Accounts 26
Time Settings 28
Log Settings 29
Email Alert 31
LED Display 34
HTTP/HTTPS Service 35
Management Access Control 37
Manage Firmware 37
Download/Backup Configuration File 39

Cisco Small Business WAP371 Wireless Access Point Administration Guide 2
Contents
Configuration Files Properties 41
Copy/Save Configuration 42
Reboot 42
Discovery—Bonjour 43
Packet Capture 44
Support Information 50
Chapter 4: LAN 52
Port Settings 52
VLAN and IPv4 Address Settings 53
IPv6 Addresses 54
IPv6 Tunnel 56
LLDP 57
Chapter 5: Wireless 60
Radio 60
Rogue AP Detection 68
Networks 71
Scheduler 82
Scheduler Association 85
Bandwidth Utilization 86
MAC Filtering 86
WDS Bridge 88
WorkGroup Bridge 91
Quality of Service 94
Chapter 6: System Security 99
RADIUS Server 99
802.1X Supplicant 101
Password Complexity 102

Cisco Small Business WAP371 Wireless Access Point Administration Guide 3
Contents
WPA-PSK Complexity 103
Chapter 7: Client Quality of Service 105
Client QoS Global Settings 105
ACL 105
Class Map 113
Policy Map 117
Client QoS Association 119
Client QoS Status 121
Chapter 8: Simple Network Management Protocol 123
General SNMP Settings 123
Views 126
Groups 127
Users 129
Targets 130
Chapter 9: Captive Portal 132
Local Groups 132
Local Users 133
Instance Configuration 134
Instance Association 137
Web Portal Customization 138
Captive Portal Global Configuration 142
Authenticated Clients 143
Failed Authentication Clients 144
Chapter 10: Single Point Setup 145
Single Point Setup Overview 145
Access Points 149

Cisco Small Business WAP371 Wireless Access Point Administration Guide 4
Contents
Sessions 152
Channel Management 154
Wireless Neighborhood 157
Appendix A: Deauthentication Message Reason Codes 161
Deauthentication Reason Code Table 161
Appendix B: Where to Go From Here 163

1
Cisco Small Business WAP371 Wireless Access Point Administration Guide 2
Getting Started
This chapter provides an introduction to the Wireless Access Point (WAP) devices web-based
configuration utility, and includes these topics:
• Starting the Web-Based Configuration Utility
• Using the Access Point Setup Wizard
• Getting Started
• Window Navigation
Starting the Web-Based Configuration Utility
This section describes system requirements and how to navigate the web-based configuration
utility.
Supported Browsers
•Internet Explorer 7.0 or later
•Chrome 5.0 or later
•Firefox 3.0 or later
•Safari 3.0 or later
Browser Restrictions
•If you are using Internet Explorer 6, you cannot directly use an IPv6 address to access
the AP. You can, however, use the Domain Name System (DNS) server to create a
domain name that contains the IPv6 address, and then use that domain name in the
address bar in place of the IPv6 address.
•When using Internet Explorer 8, you can configure security settings from Internet
Explorer. Select Tools > Internet Options and then select the Security tab. Select
Local Intranet and select Sites. Select Advanced and then select Add. Add the
intranet address of the AP (http://<ip-address>) to the local intranet zone. The IP

Getting Started
Using the Access Point Setup Wizard
Cisco Small Business WAP371 Wireless Access Point Administration Guide 3
1
address can also be specified as the subnet IP address, so that all addresses in the
subnet are added to the local intranet zone.
•If you have multiple IPv6 interfaces on your management station, use the IPv6 global
address instead of the IPv6 local address to access the AP from your browser.
Logging Out
By default, the web-based AP configuration utility logs out after 10 minutes of inactivity. See
HTTP/HTTPS Service for instructions on changing the default timeout period.
To log out, click Logout in the top right corner of the web-based AP configuration utility.
Using the Access Point Setup Wizard
The first time that you log into the AP (or after it has been reset to the factory default settings),
the Access Point Setup Wizard appears to help you perform initial configurations. Follow
these steps to complete the wizard:
NOTE If you click Cancel to bypass the Wizard, the Change Password page appears. You can then
change the default password for logging in. For all other settings, the factory default
configurations apply.
You must log in again after changing your password.
STEP 1 Click Next on the Welcome page of the Wizard. The Configure Device - IP Address window
appears.
STEP 2 Click Dynamic IP Address (DHCP) if you want the WAP device to receive an IP address from
a DHCP server. Or select Static IP Address to configure IP Address manually. For a
description of these fields, see VLAN and IPv4 Address Settings.
STEP 3 Click Next. The Single Point Setup — Set a Cluster window appears. For a description of
Single Point Setup, see Single Point Setup.
STEP 4 To create a new Single Point Setup of WAP devices, select Create a New Cluster and specify a
New Cluster Name. When you configure your devices with the same cluster name and enable
Single Point Setup mode on other WAP devices, they automatically join the group.

Getting Started
Using the Access Point Setup Wizard
Cisco Small Business WAP371 Wireless Access Point Administration Guide 4
1
If you already have a cluster on your network, you can add this device to it by clicking Join an
Existing Cluster, and then entering the Existing Cluster Name.
If you do not want this device to participate in a Single Point Setup at this time, click Do not
Enable Single Point Setup.
(Optional) You can enter text in the AP Location field to note the physical location of the WAP
device.
STEP 5 Click Next. The Configure Device - Set System Date and Time window appears.
STEP 6 Select your time zone, and then set the system time manually or set up the WAP device to get
its time from an NTP server. For a description of these options, see Time Settings.
STEP 7 Click Next. The Enable Security - Set Password window appears.
STEP 8 Enter a New Password and enter it again in the Confirm Password text box. For more
information about passwords, see User Accounts.
NOTE You can uncheck the Password Complexity box if you wish to disable the
password security rules. However, we strongly recommend keeping the password
security rules enabled.
STEP 9 Click Next. The Enable Security - Name Your Wireless Network window appears for the
Radio 1 interface.
NOTE For this window and the following two windows (Wireless Security and VLAN
ID), you configure these settings for the Radio 1 interface first. Then the windows
repeat to enable you to configure these settings for Radio 2.
STEP 10 Enter a Network Name. This name serves as the SSID for the default wireless network.
STEP 11 Click Next. The Enable Security - Secure Your Wireless Network window appears.
STEP 12 Choose a security encryption type and enter a security key. For a description of these options,
see System Security.
STEP 13 Click Next. The Wizard displays the Enable Security- Assign the VLAN ID For Your Wireless
Network window.
STEP 14 Enter a VLAN ID for traffic received on the wireless network.
It is suggested that you assign a different VLAN ID from the default (1) to wireless traffic, in
order to segregate it from management traffic on VLAN 1.
STEP 15 Click Next.
STEP 16 For the WAP371 device, the Network Name, Wireless Security, and VLAN ID pages show to
enable configuring Radio 2. When finished with configuring Radio 2, click Next.

Getting Started
Using the Access Point Setup Wizard
Cisco Small Business WAP371 Wireless Access Point Administration Guide 5
1
The Wizard displays the Enable Captive Portal - Create Your Guest Network window.
STEP 17 Select whether or not to set up an authentication method for guests on your network, and click
Next.
If you click No, skip to STEP 25.
If you click Yes, the Wizard displays the Enable Captive Portal - Name Your Guest Network
window.
STEP 18 Specify a Guest Network Name for Radio 1. For the WAP371 device, select whether the guest
network uses Radio 1 or Radio 2.
STEP 19 Click Next. The Wizard displays the Enable Captive Portal - Secure Your Guest Network
window.
STEP 20 Choose a security encryption type for the guest network and enter a security key. For a
description of these options, see System Security.
STEP 21 Click Next. The Wizard displays the Enable Captive Portal - Assign the VLAN ID window.
STEP 22 Specify a VLAN ID for the guest network. The guest network VLAN ID should be different
from the management VLAN ID.
STEP 23 Click Next. The Wizard displays the Enable Captive Portal - Enable Redirect URL window.
STEP 24 Select Enable Redirect URL and specify a fully qualified domain name or IP address in the
Redirect URL field (including http://). If specified, guest network users are redirected to the
specified URL after authenticating.
STEP 25 Click Next. The Wizard displays the Summary - Confirm Your Settings window.
STEP 26 Review the settings that you configured. Click Back to reconfigure one or more settings. If
you click Cancel, all settings are returned to the previous or default values.
STEP 27 If they are correct, click Submit. Your WAP setup settings are saved and a confirmation
window appears.
STEP 28 Click Finish. The Login window appears to log in to the AP using the changed password.

Getting Started
Getting Started
Cisco Small Business WAP371 Wireless Access Point Administration Guide 6
1
Getting Started
To simplify device configuration through quick navigation, the Getting Started page provides
links for performing common tasks. The Getting Started page is the default window every time
you log into the web-based AP configuration utility.
Links on the Getting Started Page
Category Link Name (on the Page) Linked Page
Initial Setup Run Setup Wizard Using the Access Point
Setup Wizard
Configure Radio Settings Radio
Configure Wireless Network Settings Networks
Configure LAN Settings LAN
Configure Single Point Setup Single Point Setup
Device Status System Summary System Summary
Wireless Status Network Interfaces
Quick Access Change Account Password User Accounts
Upgrade Device Firmware Manage Firmware
Backup/Restore Configuration Download/Backup
Configuration File

Getting Started
Window Navigation
Cisco Small Business WAP371 Wireless Access Point Administration Guide 7
1
Window Navigation
This section describes the features of the web-based AP configuration utility.
Configuration Utility Header
The Configuration Utility header contains standard information and appears at the top on
every page. It provides these buttons:
Navigation Pane / Main Menu
A navigation pane, or main menu, is located on the left side of each page. The navigation pane
is a list of the top-level features of the WAP devices. If a main menu item is preceded by an
arrow, select to expand and display the submenu of each group. You can then select on the
desired submenu item to open the associated page.
Buttons
Button Name Description
(User) The account name (Administrator or Guest) of the user logged into
the AP. The factory default user name is cisco.
Log Out Click to log out of the web-based AP configuration utility.
About Click to show the AP type and version number.
Help Click to show the online help. The online help is designed to be
viewed with browsers using UTF-8 encoding. If the online help
shows errant characters, verify that the encoding settings on your
browser are set to UTF-8.

Getting Started
Window Navigation
Cisco Small Business WAP371 Wireless Access Point Administration Guide 8
1
Management Buttons
The table below describes the commonly used buttons that appear on various pages in the
system.
Management Buttons
Button Name Description
Add Adds a new entry to the table or database.
Cancel Cancels the changes made to the page.
Clear All Clears all entries in the log table.
Delete Deletes an entry in a table. Select an entry first.
Edit Edits or modifies an existing entry. Select an entry first.
Refresh Redisplays the current page with the latest data.
Save Saves the settings or configuration.
Update Updates the new information to the startup configuration.

Getting Started
Window Navigation
Cisco Small Business WAP371 Wireless Access Point Administration Guide 9
1

2
Cisco Small Business WAP371 Wireless Access Point Administration Guide 10
Status and Statistics
This chapter describes how to display status and statistics and contains these topics:
•SystemSummary
• Network Interfaces
• Traffic Statistics
• WorkGroup Bridge Transmit/Receive
• Associated Clients
• TSPEC Client Associations
• TSPEC Status and Statistics
• TSPEC AP Statistics
• Radio Statistics
• Email Alert Status
•Log
System Summary
The System Summary page shows basic information such as the hardware model description,
software version, and the time that has elapsed since the last reboot.
To view system information, select Status and Statistics > System Summary in the navigation
pane. You can also select System Summary under Device Status on the Getting Started page.
The System Summary page shows this information:
•PID VID—The WAP hardware model and version.
•Serial Number—The serial number of the Cisco WAP device.

Status and Statistics
System Summary
Cisco Small Business WAP371 Wireless Access Point Administration Guide 11
2
•Base MAC Address—The WAP MAC address.
•Firmware Version (Active Image)—The firmware version number of the active image.
•Firmware MD5 Checksum (Active Image)—The checksum for the active image.
•Firmware Version (Non-active)—The firmware version number of the backup image.
•Firmware MD5 Checksum (Non-active)—The checksum for the backup image.
•Host Name—A name assigned to the device.
•System Uptime—The time that has elapsed since the last reboot.
•System Time—The current system time.
•Power Source—The system may be powered by a power adapter, or may be receiving
power-over-Ethernet from PoE power-sourcing equipment (PSE).
The TCP/UDP Service table shows basic information about protocols and services operating
on the WAP.
•Service—The name of the service, if available.
•Protocol—The underlying transport protocol that the service uses (TCP or UDP).
•Local IP Address—The IP address, if any, of a remote device that is connected to this
service on the WAP device. All indicates that any IP address on the device can use this
service.
•Local Port—The port number for the service.
•Remote IP Address—The IP address of a remote host, if any, that is using this service.
All indicates that the service is available to all remote hosts that access the system.
•Remote Port—The port number of any remote device communicating with this service.
•Connection State—The state of the service. For UDP, only connections in the Active or
Established states appear in the table. The TCP states are:
-Listening—The service is listening for connection requests.
-Active—A connection session is established and packets are being transmitted and
received.
-Established—A connection session is established between the WAP device and a
server or client, depending on the role of each device with respect to this protocol.
-Time Wait—The closing sequence has been initiated and the WAP is waiting for a
system-defined timeout period (typically 60 seconds) before closing the
connection.

Status and Statistics
Network Interfaces
Cisco Small Business WAP371 Wireless Access Point Administration Guide 12
2
You can click Refresh to refresh the screen and show the most current information.
Network Interfaces
Use the Network Interfaces page to show configuration and status information about the wired
and wireless interfaces. To show the Network Interfaces page, select Status and Statistics >
Network Interface in the navigation pane.
The Network Interfaces page shows this information:
•LAN Status—These settings apply to the internal interface. The information indicates
whether or not Green Ethernet mode is enabled.
To change any of these settings, click the Edit link. After you click Edit, you are
redirected to the VLAN and IPv4 Address Settings page. See VLAN and IPv4 Address
Settings for descriptions of these fields.
•Radio Status—These settings include the Wireless Radio mode (Enabled or Disabled),
the MAC address associated with both the radio interfaces, the 802.11 mode (a/b/g/n/
ac), the channel used by the interface, and the operational bandwidth.
To change the wireless settings, click the Edit link. After you click Edit, you are
redirected to the Radio page. See Radio for descriptions of these fields.
•Interface Status—This table lists status information for each Virtual Access Point
(VAP) and on each Wireless Distribution System (WDS) interface. WLAN0 or
WLAN1 precedes the VAP interface ID to indicate the associated radio interface.
WLAN0 represents radio 1 and WLAN1 represents radio 2.
If the VAP has been configured, the table lists the SSID, the administrative status (up
or down), the MAC address of the radio interface, the VLAN ID, the name of any
associated scheduler profile, and the current state (active or inactive). The state
indicates whether the VAP is exchanging data with a client.
You can click Refresh to refresh the screen and show the most current information.

Status and Statistics
Traffic Statistics
Cisco Small Business WAP371 Wireless Access Point Administration Guide 13
2
Traffic Statistics
Use the Traffic Statistics page to view basic information about the WAP. It also provides a
real-time display of transmit and receive statistics for the Ethernet interface, the Virtual Access
Points (VAPs), and any WDS interfaces. All transmit and receive statistics reflect the totals
since the WAP was last started. If you reboot the WAP, these figures indicate transmit and
receive totals since the reboot.
To show the Traffic Statistics page, select Status and Statistics > Traffic Statistics in the
navigation pane.
The Traffic Statistics page shows summary data and statistics for traffic in each direction.
•Network Interface—Name of the Ethernet interface and each VAP and WDS interface.
WLAN0 and WLAN1 precede the VAP interface name to indicate the radio interface
(WLAN0 represents radio 1 and WLAN1 represents radio 2).
•Total Packets—The total packets sent (in Transmit table) or received (in Received
table) by this WAP device.
•Total Bytes—The total bytes sent (in Transmit table) or received (in Received table) by
this WAP device.
•Total Dropped Packets—The total number of dropped packets sent (in Transmit table)
or received (in Received table) by this WAP device.
•Total Dropped Bytes—The total number of dropped bytes sent (in Transmit table) or
received (in Received table) by this WAP device.
•Errors—The total number of errors related to sending and receiving data on this WAP
device.
You can click Refresh to refresh the screen and show the most current information.
WorkGroup Bridge Transmit/Receive
The WorkGroup Bridge Transmit/Receive page shows packet and byte counts for traffic
between stations on a WorkGroup Bridge. For information on configuring WorkGroup
Bridges, see WorkGroup Bridge.
To show the WorkGroup Bridge Transmit/Receive page, select Status and Statistics >
WorkGroup Bridge in the navigation pane.
Each network interface that is configured as a WorkGroup Bridge interface shows these fields:

Status and Statistics
Associated Clients
Cisco Small Business WAP371 Wireless Access Point Administration Guide 14
2
•Network Interface—Name of the Ethernet or VAP interface. WLAN0 represents radio
1 and WLAN1 represents radio 2.
•Status and Statistics—Whether the interface is disconnected or is administratively
configured as up or down.
•VLAN ID—Virtual LAN (VLAN) ID. You can use VLANs to establish multiple
internal and guest networks on the same WAP device. The VLAN ID is set on the VAP
tab.
•Name (SSID)—Wireless network name. Also known as the SSID, this alphanumeric
key uniquely identifies a wireless local area network. The SSID is set on the VAP tab.
Additional information appears for the transmit and receive direction for each WorkGroup
Bridge interface:
•Total Packets—The total number of packets bridged between the wired clients in the
WorkGroup Bridge and the wireless network.
•Total Bytes—The total number of bytes bridged between the wired clients in the
WorkGroup Bridge and the wireless network.
You can click Refresh to refresh the screen and show the most current information.
Associated Clients
You can use the Associated Clients page to view the client stations associated with a particular
access point.
To show the Associated Clients page, select Status and Statistics > Associated Clients in the
navigation pane.
The associated stations are shown along with information about packet traffic transmitted and
received for each station.
•Total Number of Associated Clients—The total number of clients currently associated
with the AP.
•Network Interface—The VAP the client is associated with. WLAN0 and WLAN1
precede the VAP interface name to indicate the radio interface (WLAN0 represents
radio 1 and WLAN1 represents radio 2).
•Station—The MAC address of the associated wireless client.
•Status—The Authenticated and Associated Status shows the underlying IEEE 802.11
authentication and association status, which is present no matter which type of security

Status and Statistics
TSPEC Client Associations
Cisco Small Business WAP371 Wireless Access Point Administration Guide 15
2
the client uses to connect to the WAP device. This status does not show IEEE 802.1X
authentication or association status.
These are some points to keep in mind with regard to this field:
-If the WAP device security mode is None or Static WEP, the authentication and
association status of clients appears as expected; that is, if a client shows as
authenticated to the WAP device, it is able to transmit and receive data. (The reason
why is that Static WEP uses only IEEE 802.11 authentication.)
-If the WAP device uses IEEE 802.1X or WPA security, it is possible for a client
association to appear as authenticated (through IEEE 802.11 security) although it is
not actually authenticated through the second layer of security.
•From Station/To Station—For the From Station, the counters indicate the packets or
bytes transmitted by the wireless client. For the To Station, the counters indicate the
number of packets and bytes transmitted from the WAP device to the wireless client.
-Packets—Number of packets received (transmitted) from the wireless client.
-Bytes—Number of bytes received (transmitted) from the wireless client.
-Drop Packets—Number of packets dropped after being received (transmitted).
-Drop Bytes—Number of bytes that dropped after being received (transmitted).
-TS Violate Packets (From Station)—Number of packets sent from a client STA to
the WAP device in excess of its active Traffic Stream (TS) uplink bandwidth, or for
an access category requiring admission control to which the client STA has not
been admitted.
-TS Violate Packets (To Station)—Number of packets sent from the WAP device to
a client STA in excess of its active TS downlink bandwidth, or for an access
category requiring admission control to which the client STA has not been
admitted.
•Up Time—The amount of time the client has been associated with the WAP device.
You can click Refresh to refresh the screen and display the most current information.
TSPEC Client Associations
The TSPEC Client Associations page provides real-time information about the TSPEC client
data transmitted and received by this access point. The tables on the TSPEC Client
Associations page show voice and video packets transmitted and received since the
association started, along with status information.

Status and Statistics
TSPEC Client Associations
Cisco Small Business WAP371 Wireless Access Point Administration Guide 16
2
A TSPEC is a traffic specification that is sent from a QoS-capable wireless client to a WAP
device requesting a certain amount of network access for the Traffic Stream (TS) it represents.
A traffic stream is a collection of data packets identified by the wireless client as belonging to
a particular user priority. An example of a voice traffic stream is a Wi-Fi CERTIFIED
telephone handset that marks its codec-generated data packets as voice priority traffic. An
example of a video traffic stream is a video player application on a wireless laptop that
prioritizes a video conference feed from a corporate server.
To view TSPEC client association statistics, select Status and Statistics > TSPEC Client
Associations in the navigation pane.
The TSPEC Client Associations page shows this information:
Status and Statistics:
•Network Interface—Radio interface used by the client. WLAN0 represents radio 1 and
WLAN1 represents radio 2.
•SSID—Service set identifier associated with this TS client.
•Station—Client station MAC address.
•TS Identifier—TSPEC Traffic Session Identifier (range 0 to 7).
•Access Category—TS Access Category (voice or video).
•Direction—Traffic direction for this TS. Direction can be one of these options:
-uplink—From client to device.
-downlink—From device to client.
-bidirectional
•User Priority—User Priority (UP) for this TS. The UP is sent with each packet in the
UP portion of the IP header. Typical values are as follows:
-6 or 7 for voice
-4 or 5 for video
The value may differ depending on other priority traffic sessions.
•Medium Time—Time that the TS traffic occupies the transmission medium.
•Excess Usage Events—Number of times that the client has exceeded the medium time
established for its TSPEC. Minor, infrequent violations are ignored.
•VAP MAC Address—Virtual Access Point MAC address.
Statistics: