Cisco WAP571 Instruction Manual

Cisco WAP571 Wireless-AC/N Premium Dual Radio Access
Point with PoE
Cisco WAP571E Wireless-AC/N Premium Dual Radio Out-
door Access Point
ADMINISTRATION
GUIDE

Cisco WAP571/E Administration Guide 3
Contents
Chapter 1: Getting Started 9
Starting the Web-Based Configuration Utility 9
Logging Out 10
Using the Access Point Setup Wizard 10
Getting Started 13
Window Navigation 14
Chapter 2: Status and Statistics 17
System Summary 18
Network Interfaces 19
Traffic Statistics 21
Wireless Multicast Forwarding Statistics 22
WorkGroup Bridge Transmit/Receive 24
Associated Clients 24
TSPEC Client Associations 26
TSPEC Status and Statistics 28
TSPEC AP Statistics 30
Radio Statistics 30
Email Alert Status 32
Log 32
Chapter 3: Administration 33
System Settings 34
User Accounts 34
Adding a User 35
Changing a User Password 35
Time Settings 36
Log Settings 38
Configuring the Persistent Log 38
Remote Log Server 39

Cisco WAP571/E Administration Guide 4
Contents
Email Alert 40
Email Alert Examples 42
LED Display 43
HTTP/HTTPS Service 44
Configuring HTTP and HTTPS Services 44
Managing SSL Certificates 45
Management Access Control 46
Manage Firmware 47
Swapping the Firmware Image 47
TFTP Upgrade 48
HTTP Upgrade 49
Download/Backup Configuration File 49
Backing Up a Configuration File 50
Downloading a Configuration File 51
Configuration Files Properties 52
Copy/Save Configuration 52
Reboot 53
Discovery—Bonjour 54
Packet Capture 54
Local Packet Capture 56
Remote Packet Capture 58
Packet Capture File Download 61
Support Information 61
Spanning Tree Settings 62
Chapter 4: LAN 63
Port Settings 63
VLAN Configuration 64
IPv4 Setting 65
IPv6 Setting 66

Cisco WAP571/E Administration Guide 5
Contents
IPv6 Tunnel 68
LLDP 69
Chapter 5: Wireless 71
Radio 71
Rogue AP Detection 80
Viewing the Rogue AP List 80
Creating and Saving a Trusted AP List 83
Importing a Trusted AP List 83
Networks 84
SSID Naming Conventions 84
VLAN IDs 85
Configuring VAPs 85
Configuring Security Settings 88
Wireless Multicast Forwarding 96
Scheduler 97
Adding Scheduler Profiles 98
Configuring Scheduler Rules 98
Scope of Scheduler Rules 99
Scheduler Association 100
MAC Filtering 101
Configuring a MAC Filter List Locally on the WAP Device 101
Configuring MAC Authentication on the RADIUS Server 102
Bridge 102
WEP on WDS Links 105
WPA/PSK on WDS Links 105
Workgroup Bridge 106
Quality of Service 108

Cisco WAP571/E Administration Guide 6
Contents
Chapter 6: Spectrum Analyzer 113
Chapter 7: System Security 115
RADIUS Server 115
802.1X Supplicant 117
Password Complexity 119
WPA-PSK Complexity 120
Chapter 8: Client Quality of Service 121
Client QoS Global Settings 121
Class Map 122
Adding a Class Map 127
Policy Map 129
Client QoS Association 131
QoS Status 132
Chapter 9: ACL 133
ACL Rule 133
ACL Association 142
ACL Status 143
144
Chapter 10: SNMP 145
SNMP Overview 145
General SNMP Settings 146
Views 148
Groups 149
Users 151
Targets 153

Cisco WAP571/E Administration Guide 7
Contents
Chapter 11: Captive Portal 155
Global Configuration 155
Local Groups/Users 157
Local Groups 157
Local Users 158
Instance Configuration 159
Instance Association 162
Web Portal Customization 163
Uploading and Deleting Images 166
Authenticated Clients 167
Chapter 12: Single Point Setup 169
Single Point Setup Overview 169
Managing Single Point Setup Across Access Points 170
Single Point Setup Negotiation 171
Operation of a Device Dropped From a Single Point Setup 171
Configuration Parameters Propagated and Not Propagated to Single Point
Setup Access Points 172
Access Points 174
Sessions 177
Channel Management 179
Viewing Channel Assignments and Setting Locks 180
Configuring Advanced Settings 181
Wireless Neighborhood 182
Viewing Details for a Single Point Setup Member 184
Cluster Firmware Upgrade 184
Appendix A: Deauthentication Message Reason Codes 187
Deauthentication Reason Code Table 187
Appendix B: Where to Go From Here 189

Cisco WAP571/E Administration Guide 8
Contents

1
Cisco WAP571/E Administration Guide 9
Getting Started
This section provides an introduction to the Wireless Access Point (WAP) devices
web-based configuration utility, and includes these topics:
•Starting the Web-Based Configuration Utility
•Using the Access Point Setup Wizard
•Getting Started
•Window Navigation
Starting the Web-Based Configuration Utility
This section describes system requirements and how to navigate the web-based
configuration utility.
Supported Browsers
•Internet Explorer 7.0 or later
•Chrome 5.0 or later
•Firefox 3.0 or later
•Safari 3.0 or later
Browser Restrictions
•If you are using Internet Explorer 6, you cannot directly use an IPv6 address
to access the Access Point. You can, however, use the Domain Name
System (DNS) server to create a domain name that contains the IPv6
address, and then use that domain name in the address bar in place of the
IPv6 address.
•When using Internet Explorer 8, you can configure security settings from
Internet Explorer. Select Tools > Internet Options and then select the
Security tab. Select Local Intranet and select Sites. Select Advanced and

Getting Started
Using the Access Point Setup Wizard
Cisco WAP571/E Administration Guide 10
1
then select Add. Add the intranet address of the Access Point (http://<ip-
address>) to the local intranet zone. The IP address can also be specified
as the subnet IP address, so that all addresses in the subnet are added to
the local intranet zone.
•If you have multiple IPv6 interfaces on your management station, use the
IPv6 global address instead of the IPv6 local address to access the Access
Point from your browser.
Logging Out
By default, the web-based AP configuration utility logs out after 10 minutes of
inactivity. See HTTP/HTTPS Service for instructions on changing the default
timeout period.
To log out, click Logout in the top right corner of the web-based AP configuration
utility.
Using the Access Point Setup Wizard
The first time that you log into the Access Point (or after it has been reset to the
factory default settings), the Access Point Setup Wizard appears to help you
perform initial configurations. Follow these steps to complete the wizard:
You must log in again after changing your password.
STEP 1 Click Next on the Welcome page of the Wizard. The Configure Device - IP
Address window appears.
STEP 2 Click Dynamic IP Address (DHCP) if you want the WAP device to receive an IP
address from a DHCP server. You can also select Static IP Address to configure
the IP Address manually. For a description of these fields, see IPv4 Setting.
STEP 3 Click Next. The Single Point Setup-Set a Cluster window appears. For a
description of Single Point Setup, see Single Point Setup Overview.
STEP 4 To create a new Single Point Setup of WAP devices, select Create a New Cluster
and specify a New Cluster Name. When you configure your devices with the
same cluster name and enable Single Point Setup mode on other WAP devices,
they automatically join the group.

Getting Started
Using the Access Point Setup Wizard
Cisco WAP571/E Administration Guide 11
1
If you already have a cluster on your network, you can add this device to it by
clicking Join an Existing Cluster, and then entering the Existing Cluster Name.
If you do not want this device to participate in a Single Point Setup at this time,
click Do not Enable Single Point Setup.
(Optional) You can enter text in the AP Location field to note the physical location
of the WAP device.
STEP 5 Click Next. The Configure Device - Set System Date and Time window appears.
STEP 6 Select your time zone, and then set the system time manually or set up the WAP
device to get its time from an NTP server. For a description of these options, see
Time Settings.
NOTE There is an arrow next to System Time to set time from current computer if
you want to set the time and date of your computer.
STEP 7 Click Next. The Enable Security - Set Password window appears.
STEP 8 Enter a New Password and enter it again in the Confirm Password text box. For
more information about passwords, see User Accounts.
NOTE You can uncheck the Password Complexity box if you want to disable the
password security rules. However, we strongly recommend keeping the password
security rules enabled.
STEP 9 Click Next. The Enable Security - Name Your Wireless Network window appears
for the Radio 1 interface.
NOTE For this window and the following two windows (Wireless Security and
VLAN ID), you configure these settings for the Radio 1 interface first. Then the
windows reappear to allow you to configure these settings for Radio 2.
STEP 10 Enter a Network Name. This name serves as the SSID for the default wireless
network.
STEP 11 Click Next. The Enable Security - Secure Your Wireless Network window appears.
STEP 12 Choose a security encryption type and enter a security key. For a description of
these options, see System Security.
STEP 13 Click Next. The Wizard displays the Enable Security- Assign the VLAN ID For Your
Wireless Network window.
STEP 14 Enter a VLAN ID for traffic received on the wireless network.

Getting Started
Using the Access Point Setup Wizard
Cisco WAP571/E Administration Guide 12
1
You should assign a different VLAN ID from the default (1) to wireless traffic, in
order to segregate it from management traffic on VLAN 1.
STEP 15 Click Next.
STEP 16 For the WAP571/E device, the Network Name, Wireless Security, and VLAN ID
pages show to enable configuring Radio 2. When finished with configuring Radio
2, click Next.
The Wizard displays the Enable Captive Portal - Create Your Guest Network
window.
STEP 17 Select whether or not to set up an authentication method for guests on your
network, and click Next.
If you click No, skip to STEP 25.
If you click Yes, the Wizard displays the Enable Captive Portal - Name Your Guest
Network window.
STEP 18 Specify a Guest Network Name for Radio 1. For the WAP571/E device, select
whether the guest network uses Radio 1 or Radio 2.
STEP 19 Click Next. The Wizard displays the Enable Captive Portal - Secure Your Guest
Network window.
STEP 20 Choose a security encryption type for the guest network and enter a security key.
For a description of these options, see System Security.
STEP 21 Click Next. The Wizard displays the Enable Captive Portal - Assign the VLAN ID
window.
STEP 22 Specify a VLAN ID for the guest network. The guest network VLAN ID should be
different from the management VLAN ID.
STEP 23 Click Next. The Wizard displays the Enable Captive Portal - Enable Redirect URL
window.
STEP 24 Select Enable Redirect URL and specify a fully-qualified domain name or IP
address in the Redirect URL field (including http://). If specified, guest network
users are redirected to the specified URL after authenticating.
STEP 25 Click Next. The Wizard displays the Summary - Confirm Your Settings window.
STEP 26 Review the settings that you configured. Click Back to reconfigure one or more
settings. If you click Cancel, all settings are returned to the previous or default
values.

Getting Started
Getting Started
Cisco WAP571/E Administration Guide 13
1
STEP 27 If they are correct, click Submit. Your WAP setup settings are saved and a
confirmation window appears.
STEP 28 Click Finish. The Login window appears to log in to the AP using the changed
password.
Getting Started
To simplify device configuration through quick navigation, the Getting Started
page provides links for performing common tasks. The Getting Started page is the
default window every time you log into the web-based AP configuration utility.
Links on the Getting Started Page
Category Link Name (on the Page) Linked Page
Initial Setup Run Setup Wizard Using the Access
Point Setup Wizard
Configure Radio Settings Radio
Configure Wireless Network Settings Networks
Configure LAN Settings LAN
Configure Single Point Setup Single Point Setup
Overview
Device
Status
System Summary System Summary
Wireless Status Network Interfaces
Quick
Access
Change Account Password User Accounts
Upgrade Device Firmware Manage Firmware
Backup/Restore Configuration Download/Backup
Configuration File

Getting Started
Window Navigation
Cisco WAP571/E Administration Guide 14
1
Window Navigation
Use the navigation to move around the web-based utility.
Configuration Utility HeaderThe Configuration Utility header contains standard
information and appears at the top on every page. The header provides these
buttons:
Navigation Pane/Main Menu
A navigation pane, or main menu, is located on the left side of each page. The
navigation pane is a list of the top-level features of the WAP devices. If a main
menu item is preceded by an arrow, select to expand and display the submenu of
each group. You can then select the desired submenu item to open the associated
page.
Button Name Description
(User) The account name (Administrator or Guest) of the user
logged into the AP. The factory default user name is cisco.
Log Out Click to log out of the web-based AP configuration utility.
Language Hover the mouse pointer over the button, and select your
language.
About Click to show the AP type and version number.
Help Click to show the online help. The online help is designed
to be viewed with browsers using UTF-8 encoding. If the
online help shows errant characters, verify that the
encoding settings on your browser are set to UTF-8.

Getting Started
Window Navigation
Cisco WAP571/E Administration Guide 15
1
Management ButtonsThe table describes the commonly-used buttons that
appear on various pages in the system.
Button Name Description
Add Adds a new entry to the table or database.
Cancel Cancels the changes made to the page.
Clear All Clears all entries in the log table.
About Click to show the AP type and version number.
Delete Deletes an entry in a table. Select an entry first.
Edit Edits or modifies an existing entry. Select an entry first.
Refresh Redisplays the current page with the latest data.
Save Saves the settings or configuration.
Update Updates the new information to the startup
configuration.

Getting Started
Window Navigation
Cisco WAP571/E Administration Guide 16
1

2
Cisco WAP571/E Administration Guide 17
Status and Statistics
This section describes how to display status and statistics and contains these
topics:
•System Summary
•Network Interfaces
•Traffic Statistics
•Wireless Multicast Forwarding Statistics
•WorkGroup Bridge Transmit/Receive
•Associated Clients
•TSPEC Client Associations
•TSPEC Status and Statistics
•TSPEC AP Statistics
•Radio Statistics
•Email Alert Status
•Log

Status and Statistics
System Summary
Cisco WAP571/E Administration Guide 18
2
System Summary
The System Summary page shows basic information such as the hardware model
description, software version, and the time that has elapsed since the last reboot.
To view system information, select Status and Statistics > System Summary. You
can also select System Summary under Device Status on the Getting Started
page.
The System Summary page shows this information:
•PID VID—The WAP hardware model and version.
•Serial Number—The serial number of the Cisco WAP device.
•Base MAC Address—The WAP MAC address.
•Firmware Version (Active Image)—The firmware version number of the
active image.
•Firmware MD5 Checksum (Active Image)—The checksum for the active
image.
•Firmware Version (Non-active)—The firmware version number of the
backup image.
•Firmware MD5 Checksum (Non-active)—The checksum for the backup
image.
•Host Name—A name assigned to the device.
•System Uptime—The time that has elapsed since the last reboot.
•System Time—The current system time.
•Power Source—The system is receiving power-over-Ethernet from PoE
power-sourcing equipment (PSE).
The TCP/UDP Service table shows basic information about protocols and
services operating on the WAP.
•Service—The name of the service, if available.
•Protocol—The underlying transport protocol that the service uses (TCP or
UDP).
•Local IP Address—The IP address, if any, of a remote device that is
connected to this service on the WAP device. All indicates that any IP
address on the device can use this service.

Status and Statistics
Network Interfaces
Cisco WAP571/E Administration Guide 19
2
•Local Port—The port number for the service.
•Remote IP Address—The IP address of a remote host, if any, that is using
this service. All indicates that the service is available to all remote hosts that
access the system.
•Remote Port—The port number of any remote device communicating with
this service.
•Connection State—The state of the service. For UDP, only connections in
the Active or Established states appear in the table. The TCP states are:
-Listening—The service is listening for connection requests.
-Active—A connection session is established and packets are being
transmitted and received.
-Established—A connection session is established between the WAP
device and a server or client, depending on the role of each device with
respect to this protocol.
-Time Wait—The closing sequence has been initiated and the WAP is
waiting for a system-defined timeout period (typically 60 seconds)
before closing the connection.
You can click Refresh to refresh the screen and show the most current information.
Network Interfaces
The Network Interfaces page shows the configuration and status information
about the wired and wireless interfaces. To view network interface information,
select Status and Statistics > Network Interfaces.
The following information is displayed:
•LAN Status—Displays information for LAN interface, including:
-MAC Address—The MAC address of the WAP device.
-IP Address—The IP address of the WAP device.
-Subnet Mask—The subnet mask of the WAP device.
-Default Gateway—The default gateway of the WAP device.
-Domain Name Server-1—The IP address of the domain name server 1
used by the WAP device.

Status and Statistics
Network Interfaces
Cisco WAP571/E Administration Guide 20
2
-Domain Name Server-2—The IP address of the domain name server 2
used by the WAP device.
-IPv6 Address—The IPv6 address of the WAP device.
-IPv6 Autoconfigured Global Address—The IP v6 auto-configured
global address.
-IPv6 Link Local Address—The IPv6 link local address of the WAP
device.
-Default IPv6 Gateway—The default IPv6 gateway of the WAP device.
-IPv6-DNS-1—The IPv6 address of the IPv6 DNS server 1 used by the
WAP device.
-IPv6-DNS-2—The IPv6 address of the IPv6 DNS server 2 used by the
WAP device.
These settings apply to the internal interface. Click the Edit link to change any of
these settings. You will be redirected to the IPv4 Setting page.
•Port Status—Displays the status for LAN interfaces.
•Interfaces—Number of the Ethernet interface.
-Link Status—Status of the Ethernet interface.
-Port Speed—Speed of the Ethernet interface.
-Duplex Mode—Duplex mode of the Ethernet interface.
-Green Ethernet Status—The status of the Ether interface.
Click the Edit link to change any of these settings. You will be redirected to the
Port Settings page.
•VLAN Status—Displays information for all existing VLANs, including:
-VLAN ID—Identifier of the VLAN.
-Description—Description of the VLAN.
-Eth—The interface is a tagged or untagged member of the VLAN
Click the Edit link to change any of these settings. You will be redirected to the
VLAN Configuration page.
•Radio Status—Displays information for the wireless radio interfaces,
including: