D-Link DWL-3500AP User manual

Configuration Guide
ProductModel: DWS-3000 Series, DWL-3500AP/8500AP
Version1.5
Unified Wired & Wireless Access System

Table of Contents
1. Scenario 1 - Basic L2 Edge Setup: 1 WS + 2 APs ..................................................... 4
1.1. Configure AP Network Settings ......................................................................... 5
1.2. Configure the DHCP Server............................................................................... 6
1.2.1. Global DHCP Configuration....................................................................... 6
1.2.2. Pool Configuration...................................................................................... 7
1.3. ACL Configuration............................................................................................. 7
1.4. Wireless Configuration....................................................................................... 9
1.5. Device Connections.......................................................................................... 10
1.6. Save Configuration ........................................................................................... 11
1.7. Verify the Configuration................................................................................... 12
1.8. Feature Tests..................................................................................................... 12
1.8.1. L2 Start Roaming Test.............................................................................. 12
1.8.2. Auto channel adjustment after associating with AP2............................... 12
1.8.3. Rogue AP Detection ................................................................................. 14
1.8.4. Power Adjustment..................................................................................... 15
1.8.5. Load Balancing......................................................................................... 16
1.9. Switch and AP Cleanup.................................................................................... 16
2. Scenario 2 – L2/L3 Edge: 1 WS + 1 AP + 1 Remote AP......................................... 18
2.1. Configuring LAN Settings................................................................................ 19
2.1.1. Create VLANs .......................................................................................... 19
2.1.2. Configure VLAN Routing ........................................................................ 22
2.1.3. Enable Global Routing.............................................................................. 24
2.1.4. Configure Static Routing .......................................................................... 24
2.1.5. Configure the Loopback Interface ............................................................ 24
2.1.6. DHCP Server ............................................................................................ 25
2.1.7. ACL Configuration................................................................................... 26
2.2. Configuring WLAN Settings............................................................................ 29
2.3. Save Configuration ........................................................................................... 32
2.4. Device Connections.......................................................................................... 32
2.5. Verifying the Configuration.............................................................................. 32
3. Scenario 3 – L3 Overlay: 1 WS + 2 AP.................................................................... 35
2.6. Configuring LAN Settings................................................................................ 36
2.6.1. Configure the VLANs............................................................................... 36
2.6.2. Configure VLAN Routing ........................................................................ 37
2.6.3. Configure Static Routing .......................................................................... 38
2.6.4. DHCP Server ............................................................................................ 39
3.1.6 Setting the MTU Size.................................................................................... 39
3.2 Configuring WLAN Settings............................................................................ 40
3.2.1 Configure the Basic Settings..................................................................... 41
3.2.2 Apply the AP Profile................................................................................. 42
3.3 Save Configuration........................................................................................... 42
3.4 Device Connections.......................................................................................... 42
3.5 Verifying the Configuration.............................................................................. 43
3.6 Testing the L3 Roaming Feature....................................................................... 43

3.7 Logs & Traps .................................................................................................... 43
3.8 Syslog Configuration........................................................................................ 45
3.9 Debug............................................................................................................ 45
4. Scenario 4 – L3 Edge: 2 Switches + 2 APs .............................................................. 47
4.2 WS1 & WS2 LAN Configuration..................................................................... 48
4.2.1 DHCP........................................................................................................ 48
4.2.2 Configure default routes on WS1, WS2, and L3 device........................... 49
4.2.3 Set the MTU Size...................................................................................... 49
4.3 Configure WLAN Settings ............................................................................... 49
4.3.1 WPA2 Configuration................................................................................ 49
4.3.2 Configure Discovery................................................................................. 49
4.3.3 Connections............................................................................................... 49
4.4 Configure the RADIUS Server......................................................................... 49
4.5 Verifying the Configuration.............................................................................. 50
4.6 WLAN Visualization........................................................................................ 50

1. Scenario 1 - Basic L2 Edge Setup: 1 WS + 2 APs
The diagram in this scenario shows a very basic L2 edge network configuration with one
wireless switch and two access points. All devices are in the same L2 domain.
The objectives in this setup are as follows:
•Set up the minimum configuration for multiple APs
•Configure an AP with a static IP
•Configure an ACL to prevent wireless clients from accessing the WS1
management interface.
•Configure DHCP on the wireless switch for wireless client address assignment.
•Understand some of the D-LINK Unified Access Point features.
An overview of the configuration steps needed for Wireless Switch and APs are as follows:
1. Disable DHCP on the APs and assign a static IP address to AP2.
2. Configure the WS1 DHCP server & address pool for Guest Network clients.
3. Configure an ACL to restrict access from clients on the Guest Network.
4. Attach the APs to WS1.
5. Validate the failed APs to add them to the Valid AP database.
6. Save the configuration.
7. Perform tests.
WS1
AP1
AP2
Seamless Roaming
10.90.90.90/8
CL1
10.90.90.91/8
10.90.90.92/8
SSID:
Guest Network
SSID:
Guest Network

The table below gives the IP addresses used in this scenario. The following steps will guide you
through the configuration of the Wireless Switch and the Access Point.
Device Subnet
Wireless Switch 10.90.90.90/8
AP1 10.90.90.91/8
AP2 10.90.90.92/8
Client Address Pool 10.90.91.1 – 10.90.91.254
To begin the Wireless Switch configuration, connect to port 12 (or any other unused port) from a
PC that is on the same subnet and launch the web browser using this IP address, 10.90.90.90. The
Wireless Switches and the APs will be connected after completing the entire configuration.
NOTE: Do not power down the switch before saving configuration.
1.1. Configure AP Network Settings
DHCP is enabled by default on the APs. However, for this scenario the APs use static IP
addresses. For AP1, you can use the default static IP address of 10.90.90.91, but you
must access the AP CLI to disable DHCP (otherwise, the AP would receive an address
from the switch DHCP server, which you configure in section 1.2. For AP2, you must
access the CLI to disable DHCP and to set a new static IP address so that it does not use
the same IP address as AP1.
To access and configure AP1 and AP2 by using the access point CLI, use the following
steps (Note: you will only have CLI access to the APs prior to them becoming managed
by the Wireless Switch. Once they reach managed state, the switch will disable CLI
access to the APs such that a user cannot modify the configuration of the AP while in
managed mode since in this mode the switch provides configuration information to the
AP. It is possible to place a managed AP in “debug” mode in order to temporarily allow
CLI access to the AP for configuration changes).
1. Physically connect a PC in the 10.0.0.0 subnet to AP1.
2. Telnet to the AP by using the default IP address of 10.90.90.91.
3. Enter the following command to disable DHCP:
set management dhcp-status down
4. Enter the command “save-running” to save the current AP configuration.
5. Physically connect a PC in the 10.0.0.0 subnet to AP2.
6. Telnet to the AP by using the default IP address of 10.90.90.91.
7. Enter the following command to change the IP address:
set management static-ip 10.90.90.92
8. Telnet to the AP again by using the IP address of 10.90.90.92 since your initial
session will be dropped upon changing the address.
9. Enter the following command to disable DHCP:
set management dhcp-status down
10. Enter the command “save-running” to save the current AP configuration.
11. Enter the command “Exit” to logout the AP.

1.2. Configure the DHCP Server
The wireless switch can function as a DHCP server to assign addresses to wireless (or
wired) clients that connect to each AP. To configure the DHCP Server, you must
configure global settings and the address pool for the clients.
For this scenario, wireless clients will be assigned addresses in the range of 10.90.91.1/8 –
10.90.91.254/8. By limiting the range of addresses, you can then configure an ACL to limit the
network access of all clients that have addresses within this range and still maintain additional
addresses in this space for static configuration for clients or servers.
Since these addresses are on the 10.0.0.0 network, you must exclude all addresses that are not in
the range.
1.2.1. Global DHCP Configuration
Use the following procedures to configure the global DHCP settings.
1. Select the LAN tab from the navigation panel and access Administration ÆDHCP
Server ÆGlobal Configuration.
2. Enable the Admin Mode
3. Add the excluded addresses as following:
a. 10.0.0.0 through 10.90.91.0
b. 10.90.92.0 through 10.255.255.255
GuestPool Excluded Addresses Subnet Mask
10.90.91.1 – 10.90.91.254 10.0.0.1 - 10.90.91.0
10.90.92.0 – 10.255.255.255 255.0.0.0

1.2.2. Pool Configuration
This section describes how to configure the address pool for the wireless clients.
1. Select Pool Configuration in the Navigation tree.
2. Select create and specify the following settings:
a. Pool Name – GuestPool
b. Type of Binding - Dynamic
c. Network Number – 10.0.0.0
d. Network Mask - 255.0.0.0
e. Days - 1 day
f. Hours - 0
g. Minutes - 0
h. Default Router Addresses – 10.90.90.90
1.3. ACL Configuration
The ACL in this scenario prevents wireless clients from accessing the web management
interface of the switch. All other types of traffic is allowed.
1. From the LAN menu, navigate to the Access Control Lists > IP ACL > Access
Profile Settings page.
2. From the IP ACL field, select Create New Extended ACL from the drop-down
menu.
3. Enter 100 in the ACL ID field, then click Submit.
4. From the Rule Configuration page, enter 1 as the Rule ID, Deny as the Action, and
False for Match Every, then click Submit.
5. The screen refreshes with additional fields. Click the Configure button associated
with the appropriate fields and enter the following criteria to deny HTTP traffic from
clients on the Guest Network to the Switch and APs:

•Protocol Keyword: IP
•Source IP Address: 10.90.91.1
•Source IP Mask: 0.0.0.255 (This is a wildcard mask)
•Destination IP Address: 10.90.90.1
•Destination IP Mask: 0.0.0.255
•Destination L4 Port: http
6. Create a new rule, enter 2 as the Rule ID, Permit as the Action, and True for Match
Every, then click Submit. The reason for this second rule is that an ACL has an
implicit “deny all” rule at the end. ACL rules are checked in order and the action of
the first to match the flow is taken. If no match occurs, the packet will be dropped.
Rule 1
Next, you must attach the ACL to port 0/1 and port 0/13 (the physical ports to which the
APs will be connected) so that the rules are applied to the appropriate wireless client
traffic that goes through the APs connected to the switch.
1. From the ACL ÆInterface Configuration page,
2. Select port 0/1 from the Slot/Port drop-down menu.
3. Select IP ACL as the ACL Type.
4. Enter 1 as the sequence number, and click Submit.
5. Repeat the steps to associate ACL 100 with port 0/13.

1.4. Wireless Configuration
You configure and monitor all wireless settings from the WLAN tab on the navigation panel.
Since the deployment is an L2 Edge and there are no subnet boundaries to cross, the switch can
use the network management IP address for the wireless functions (Note: the wireless switch
component uses an IP address to manage the APs and peer-switches. In a L2 environment like
this scenario no inter-subnet routing is required. If however the scenario involves a L3
environment where wireless components including APs and peer-switches cross subnet
boundaries, a routing interface must be used, such as a loopback interface).
It is important to set the correct country code on the switch so that the APs operate in the
correct regulatory domain.
1. To configure wireless features, select the WLAN tab from the left pane and traverse
down the navigation tree to Administration ÆBasic Setup.
2. Select the Global tab in the right pane and make sure Wireless Switch Mode is
enabled
3. Select the appropriate country code then click the Submit to submit the request.
Note: This scenario uses the default AP profile configuration, so you do not need to configure
any AAA/RADIUS, Radio, or SSID settings.
Note: The IP address on the Wireless Global Configuration page is the default management IP
address of the switch (10.90.90.90).

1.5. Device Connections
At this point, all the devices are ready to be connected. After the switch discovers the APs, they
will appear on the Failed list because the MAC addresses of the APs are not configured in the
Valid AP database (i.e. the switch has not been configured to accept any valid APs).
1. Connect AP1 to port 1 of the switch
2. Connect AP2 to port 13 of the switch
3. Wait about 60 seconds and click Monitoring ÆAccess Points ÆAuthentication
Failed Access Points.
4. Select the APs to be managed and click Manage to add them to the valid AP database.
5. To verify the status of APs, click Monitoring ÆAccess Point ÆManaged Access
Points.
6. To view the local Valid AP database, click Administration ÆBasic Setup, then click
the Valid AP tab.
Note: The APs get into Failed Access Point list in about 60 seconds. After you select APs to
be managed, the APs enter to fully managed state in about 60 seconds.

1.6. Save Configuration
To save the switch configuration, select Save Changes from the tool bar.

1.7. Verify the Configuration
1. From a wireless client, verify that you can see the Guest Network SSID.
2. Using a wireless client, connect to the Guest Network.
3. Check the IP address that the switch DHCP server assigned.
4. Try pinging from a client on the Guest Network to the switch or AP IP address. The
ping should pass. Try web browsing to the switch IP address. The browse should fail
because of the ACL.
1.8. Feature Tests
This section has some recommend tests you can perform to demonstrate some of the
Unified Access System features. Note that the images in this section show IP address and
other configuration information that is different than the configuration used in Scenario 1.
These images are provide for reference and are not intended to be an exact match of what
you see on your switch.
1.8.1. L2 Start Roaming Test
Try roaming between the two APs (you can simulate this by disconnecting an AP from
the switch port that you are currently associated with). Check the associated client
statistics to see which AP the client associates with.
1.8.2. Auto channel adjustment after associating with AP2
To check the current operating channel and to see if any channel adjustment is required, select the
WLAN tab from the navigation panel and traverse down to Monitoring ÆAccess Points Æ
Managed Access Points.
When an AP is powered up, the Initial Channel Selection (ICS) algorithm is used to select the
best operating channel. The algorithm scans all the available channels (based on the country
code) by counting the number of packets received on each channel and selects the channel with
the lowest packet count.
A second algorithm, Auto Channel Adjustment (ACA) is used to periodically evaluate the
operating channel. The radio must be configured for Auto Channel Adjustment. This can be done
by selecting the Automatic Channel check box in the Radio tab of the Basic Setup page. By
default this parameter is enabled.
Note: Any changes made to the profile configuration must be explicitly applied to the AP. To
apply the profile, navigate to Administration ÆAdvanced Configuration ÆAP Profiles,
select the profile to apply, and click Apply. This will temporarily disable the radios as the new
configuration is applied to the access points that use the profile. In other words, you can make
and submit one or many changes to an AP profile however these configuration modifications will
not be applied to the AP until you manually apply the profile or an AP comes online into
managed state after the profile changes are submitted.

The Channel adjustment algorithm may be triggered periodically or manually.
To manually adjust the channel plan, use the following steps:
1. Select the WLAN tab from the navigation panel and navigate to Administration ÆAP
Management ÆRF Management.
2. Choose the 802.11 b/g and select the Manual Channel Plan tab and then the Start
button to start the process. Use the Refresh button to check the results of the channel
plan.
3. Apply the suggested channel plan by clicking on “Apply” button.
Note: Before manually triggering the adjustment, the Channel Plan History Depth must be set
to 0 or 1. This can be done by changing the Channel Plan History Depth in the Configuration
tab of the RF Management. By default this parameter is set to 5.

You may also manually change the operational channel from the Administration ÆAP
Management ÆAdvanced page. Select the appropriate channel of the AP radio and change it to
the desired channel on the next screen.
1.8.3. Rogue AP Detection
To check the rogue AP list, select the WLAN tab from the navigation panel and navigate to
Monitoring ÆAccess Points ÆRogue/RF Scan Access Points.

1.8.4. Power Adjustment
To check power level, select the WLAN tab from the navigation panel and click Monitoring Æ
Access Points ÆManaged Access Points. Select Radio Details tab to check the power level.
The Automatic Power Adjustment algorithm works by setting the initial power of the AP to the
value specified in the AP profile. The power is then periodically adjusted to a level based on
presence or absence of packet transmission errors. The power is changed in increments of 10%.
Automatic adjustment can be done by selecting the Automatic Power in the Radio tab of the
Basic Setup. By default this parameter is enabled. The algorithm may be triggered by a periodic
timer or manually.
Note: The algorithm never reduces the AP power below the initial power setting as specified in
the profile and since the default power level in the default profile is 100 percent, the power would
never be reduced unless this value is first changed.
The power adjustment may be manually triggered by selecting the WLAN tab from the
navigation panel and traversing down to Administration ÆAP Management ÆRF
Management. Select the Manual Power Adjustments tab and then the Start button to start the
process (click the Apply button to apply new power adjustment)
You may change the power of the AP radio by selecting the Radio tab of the Basic Setup and
changing the Initial Power to the desired setting and click on submit.
Note: Any changes to the radio setting must be applied to the AP. To do this, click
Administration ÆAdvanced Configuration ÆAP Profiles. Select the profile to apply, then
click Apply to update all APs that use the selected profile.

1.8.4.1. Self Healing Cell Recovery
When a Managed AP is powered down, the power of its neighboring AP(s) managed by the same
switch is immediately increased by 20%. Power Adjustment Mode should be Interval to see an
increase in power of neighboring AP. By default, Initial Power is 100%, so decrease power of
APs below 80% or less to see 20% increase before powering down one AP. The power level can
be verified in the Radio detail on the Monitoring ÆAccess Points ÆAll Access Points page.
Note: A maximum of 3 neighboring APs are adjusted.
1.8.5. Load Balancing
The Wireless Switch performs load balancing on a per radio basis by tracking the wireless
bandwidth utilization. The maximum bandwidth utilization is configured in the Radio tab of the
Basic Setup. If the utilization reaches the configured threshold then new client associations are
rejected. The default bandwidth utilization threshold is 60%. The WLAN Utilization may be
monitored in the Radio Details tab of Monitoring ÆAccess Points ÆManaged Access Points.
1.9. Switch and AP Cleanup
You will not need any of the settings you configured in this scenario for the other three
scenarios, so it is a good idea to reset the switch and the APs to the factory defaults.
To reset the switch configuration, click the Tools menu and select Reset Configuration.

To reset the AP configuration, you will need to telnet into the AP CLI and use the
“factory-reset” command. As mentioned earlier, you can place the AP into “debug”
mode from the switch if the AP is currently managed to gain access to the UI.

2. Scenario 2 – L2/L3 Edge: 1 WS + 1 AP + 1 Remote AP
The diagram in this section shows a L2/L3 edge/overlay setup. In this scenario, a wireless switch
acts as an L3 device. Although the two APs are directly connected to the switch, they are in
different subnets. Both the APs are managed by the D-LINK Wireless Switch (WS1). Since the
wireless switch supports VLAN routing, L2 paths can be established between the AP switch ports
although they are on different IP subnets such that L3 Tunneling is not required.
This scenario has the following objectives:
•Understand how to implement a real plug & play deployment.
•Configure VLAN routing interfaces to simulate a L3 network with multiple
subnets.
•Create an ACL to block IP traffic between clients on different SSIDs.
•Assign IP addresses of APs & wireless clients through the WS DHCP server.
•Configure multiple SSIDs with different VLANs.
•Enable wireless encryption.
An overview of the configuration steps needed to complete this scenario is as follows:
1. Configure VLANs
2. Configure VLAN routing interfaces
3. Enable routing
4. Create loopback interface for WLAN functions
5. Set up DHCP server and address pools for VLANs
6. Configure ACL
7. Configure the AP profile, including new SSIDs and security
8. Add VLANs to L2 discovery list
9. Attach, discover, and validate APs
10. Save configuration
WS1
AP1
AP2
Seamless Roaming
Network: 10.90.90.90/8
Loopback: 192.168.10.254
CL1
192.168.20.x
192.168.30.x
SSID:
D-LINK-NET1: VLAN 100
D-LINK-NET2: VLAN 200
Guest Network
Port 0/1
VLAN 20
Port 0/13
VLAN 30
SSID:
D-LINK-NET1: VLAN 100
D-LINK-NET2: VLAN 200
Guest Network

To begin the Wireless Switch configuration, connect to the port 12 from a PC on the 10.0.0.0
network and launch the web browser using the default IP address: 10.90.90.90/8. You connect the
APs after you complete the entire switch configuration.
The IP address information for this scenario is as follows:
Device IP Address
Wireless Switch Management Interface 10.90.90.0/8
Wireless Switch Loopback Interface 192.168.10.254
AP1 192.168.20.x/24
AP2 192.168.30.x/24
Wireless Clients on D-LINK-NET1 192.168.100.x/24
Wireless Clients on D-LINK-NET2 192.168.200.x/24
2.1. Configuring LAN Settings
All of the features you configure in this section are within the LAN tab on the D-LINK
Wireless Switch.
In this scenario, the switch is a L3 device with a total of four VLAN routing interfaces. Each
connected AP is in a different subnet, so you need to configure two separate VLAN routing
interfaces and configure an IP address for each interface. Each AP has three different VAPs
enabled, and each VAP uses a different SSID and VLAN. You create an ACL to block IP traffic
between clients on VAP1 and clients on VAP2, so you also need to configure VLAN routing
interfaces for the two VAPs. The third VAP is the Guest Network, which is not used in this
scenario.
When wireless clients connect to the AP, all traffic from the client is tagged with the VLAN ID
associated with the SSID that the client uses to connect. You must configure the VLAN
information on the switch so that client traffic is accepted on the ports. (Note: if the VLAN ID of
the SSID Network is equal to the untagged-VLAN configured on the AP, which by default is 1,
traffic on that Network will be untagged when injected into the network. A Radius server could
also be used to assign per-client VLAN assignement).
2.1.1. Create VLANs
AP1 is connected to port 0/1, and AP2 is connected to port 0/13. The summary information for
the VLAN configuration is as follows:
VLAN ID VLAN Name Include Ports IP Address
VLAN 20 (Interface 4/1) AP1 Port 0/1 192.168.20.254
VLAN 30 (Interface 4/2) AP2 Port 0/13 192.168.30.254
VLAN 100 (Interface 4/3) D-LINK-NET1 Ports 0/1 and 0/13 192.168.100.254
VLAN 200 (Interface 4/4) D-LINK-NET2 Ports 0/1 and 0/13 192.168.200.254
Also, the default VLAN (PVID) for port 0/1 is 20, and the default VLAN for port 0/13 is 20.
Use the following steps to create and configure each VLAN. Repeat the steps to configure all four
VLANs. Refer to the table for information about what value to configure for each VLAN.

1. From the LAN tab on the switch Web interface, click L2 Features ÆVLAN ÆVLAN
Configuration.
2. Select Create from VLAN ID and Name pull down menu.
3. Enter the VLAN ID.
4. Enter VLAN Name.
5. On the Slot/Port row for the port to include in the VLAN, select Include from the
Participation drop-down menu.
6. For VLAN 100 and VLAN 200, select Tagging from the drop-down menu for port 0/1
and 0/13.
7. Click Submit.
8. Repeat for each of the VLANs in the above table.
Configure the Port VLAN ID for ports 0/1 and 0/13.
1. From the LAN tab on the switch Web interface, click L2 Features ÆVLAN ÆPort
Configuration.
2. Select port 0/1 from the Slot/Port drop-down menu.
3. Enter 20 in the Port VLAN ID field.
4. Click Submit.
5. Select port 0/13 from the Slot/Port drop-down menu.
6. Enter 30 in the Port VLAN ID field.
7. Click Submit.