D-Link DWL-3500AP User manual

Configuration Guide
Product Model:
DWS
-
3000 Series, DWL
-
3500AP/8500AP
Version
2.0
Unified Wired & Wireless Access System

Table of Contents
1. Scenario 1 -Basic L2 Edge Setup: 1 WS + 2 APs......................................................3
1.1. Configure AP Network Settings .........................................................................4
1.2. Configure the DHCP Server ...............................................................................5
1.2.1. Global DHCP Configuration.......................................................................5
1.2.2. Pool Configuration......................................................................................6
1.3. ACL Configuration.............................................................................................7
1.4. Wireless Configuration.......................................................................................9
1.5. Device Connections .......................................................................................... 10
1.6. Save Configuration ........................................................................................... 11
1.7. Verify the Configuration................................................................................... 12
1.8. Feature Tests..................................................................................................... 12
1.8.1. L2 Start Roaming Test.............................................................................. 12
1.8.2. Auto channel adjustment after associating with AP2 ............................... 12
1.8.3. Rogue AP Detection.................................................................................. 14
1.8.4. Power Adjustment..................................................................................... 15
1.8.5. Load Balancing ......................................................................................... 17
1.9. Switch and AP Cleanup .................................................................................... 17
2. Scenario 2 –L2/L3 Edge: 1 WS + 1 AP + 1 Remote AP ......................................... 18
2.1. Configuring LAN Settings................................................................................ 19
2.1.1. Create VLANs........................................................................................... 19
2.1.2. Configure VLAN Routing ........................................................................ 22
2.1.3. Enable Global Routing.............................................................................. 24
2.1.4. Configure Static Routing .......................................................................... 24
2.1.5. Configure the Loopback Interface ............................................................ 24
2.1.6. DHCP Server............................................................................................. 25
2.1.7. ACL Configuration................................................................................... 26
2.2. Configuring WLAN Settings ............................................................................ 29
2.3. Save Configuration ........................................................................................... 32
2.4. Device Connections .......................................................................................... 32
2.5. Verifying the Configuration.............................................................................. 32

1. Scenario 1 -Basic L2 Edge Setup: 1 WS + 2 APs
The diagram in this scenario shows a very basic L2 edge network configuration with one
wireless switch and two access points. All devices are in the same L2 domain.
The objectives in this setup are as follows:
•Set up the minimum configuration for multiple APs
•Configure an AP with a static IP
•Configure an ACL to prevent wireless clients from accessing the WS1
management interface.
•Configure DHCP on the wireless switch for wireless client address assignment.
•Understand some of the D-LINK Unified Access Point features.
An overview of the configuration steps needed for Wireless Switch and APs are as
follows:
1. Disable DHCP on the APs and assign a static IP address to AP2.
2. Configure the WS1 DHCP server & address pool for Guest Network clients.
3. Configure an ACL to restrict access from clients on the Guest Network.
4. Attach the APs to WS1.
5. Validate the APs byadding them to the Valid AP database.
6. Save the configuration.
7. Perform tests.
WS1
AP1
AP2
Seamless Roaming
10.90.90.90/8
CL1
10.90.90.91/8
10.90.90.92/8
SSID:
Guest Network
SSID:
Guest Network

The table below gives the IP addresses used in this scenario. The following steps will
guide you through the configuration of the Wireless Switch and the Access Point.
Device Subnet
Wireless Switch 10.90.90.90/8 (default)
AP1 10.90.90.91/8 (default)
AP2 10.90.90.92/8
Client Address Pool 10.90.91.1 –10.90.91.254
To begin the Wireless Switch configuration, connect to port 12 (or any other unused port)
from a PC that is on the same subnet (10.0.0.0/8) and launchthe web browser using this
IP address, 10.90.90.90. The Wireless Switches and the APs will be connected after
completing the entire configuration.
NOTE:Do not power down the switch before saving configuration.
1.1. Configure AP Network Settings
DHCP client is enabled by default on the APs. However, for this scenario the APs use
static IP addresses. For AP1, you can use the default static IP address of 10.90.90.91, but
you must access the AP CLI to disable DHCP (otherwise, the AP would receive an
address from the switch DHCP server, which you configure in section 1.2. For AP2, you
must access the CLI to disable DHCP and to set a new static IP address so that it does not
use the same IP address as AP1.
To access and configure AP1 and AP2 by using the access point CLI, use the following
steps (Note: you will only have CLI access to the APs prior to them becoming managed
by the Wireless Switch. Once they reach managed state, the switch will disable CLI
access to the APs such that a user cannot modify the configuration of the AP while in
managed mode since in this mode the switch provides configuration information to the
AP. It is possible to place a managed AP in “debug” mode in order to temporarily allow
CLI access to the AP for configuration changes).
1. Physically connect a PC in the 10.0.0.0 subnet to AP1.
2. Telnet to the AP by using the default IP address of 10.90.90.91. Use the default
username/password of admin/admin.
3. Enter the following command to disable DHCP:
set management dhcp-status down
4. Enter the command “save-running” to save the current AP configuration.
5. Physically connect a PC in the 10.0.0.0 subnet to AP2.
6. Telnet to the AP by using the default IP address of 10.90.90.91.
7. Enter the following command to change the IP address:
set management static-ip 10.90.90.92
8. Telnet to the AP again by using the IP address of 10.90.90.92 since your initial
session will be dropped upon changing the address.
9. Enter the following command to disable DHCP:
set management dhcp-status down

10. Enter the command “save-running” to save the current AP configuration.
11. Enter the command “Exit”to logout the AP.
1.2. Configure the DHCP Server
The wireless switch can function as a DHCP server to assign addresses to wireless (or
wired) clients that connect to each AP. To configure the DHCP Server, you must
configure global settings and the address pool for the clients.
For this scenario, wireless clients will be assigned addresses in the range of
10.90.91.1/8 –10.90.91.254/8. By limiting the range of addresses, you can then configure
an ACL to limit the network access of all clients that have addresses within this range and
still maintain additional addresses in this space for static configuration for clients or
servers.
Since these addresses are on the 10.0.0.0 network, you must exclude all addresses that are
not in the range.
1.2.1. Global DHCP Configuration
Use the following procedures to configure the global DHCP settings.
1. Select the LAN tab from the navigation panel and access Administration àDHCP
Server àGlobal Configuration.
2. Enable the Admin Mode
3. Add the excluded addresses as following:
a. 10.0.0.0through 10.90.91.0
b. 10.90.92.0 through 10.255.255.255
Guest
Pool
Excluded Addresses
Subnet Mask
10.90.91.1 –10.90.91.254
10.0.0.1 -10.90.91.0
10.90.92.0 –10.255.255.255 255.0.0.0

1.2.2. Pool Configuration
This section describes how to configure the address pool for the wireless clients.
1. Select Pool Configuration in the Navigation tree.
2. Select create and specify the following settings:
a. Pool Name –GuestPool
b. Type of Binding -Dynamic
c. Network Number –10.0.0.0
d. Network Mask-255.0.0.0
e. Days -1 day
f. Hours -0
g. Minutes -0
h. Default Router Addresses –10.90.90.90

1.3. ACL Configuration
The ACL in this scenario prevents wireless clients from accessing the web management
interface of the switch. All other typesof traffic is allowed.
1. From the LAN menu, navigate to the Access Control Lists > IP ACL > Access
Profile Settings page.
2. From the IP ACL field, select Create New Extended ACLfrom the drop-down
menu.
3. Enter 100 in the ACL ID field, then click Submit.
4. From the Rule Configurationpage, enter 1 as the Rule ID, Deny as the Action, and
False for Match Every, then click Submit.
5. The screen refreshes with additional fields. Click the Configure button associated
with the appropriate fields and enter the following criteria to deny HTTP traffic from
clients on the Guest Network to the Switch and APs:
•Protocol Keyword: IP
•Source IP Address: 10.90.91.1
•Source IP Mask: 0.0.0.255 (This is a wildcard mask)
•Destination IP Address: 10.90.90.1
•Destination IP Mask: 0.0.0.255
•DestinationL4 Port:http
6. Create a new rule, enter 2 as the Rule ID, Permit as the Action, and True for Match
Every, then click Submit.The reason for this second rule is that an ACL has an
implicit “deny all” rule at the end. ACL rules are checked in order and the action of
the first to match the flow is taken. If no match occurs, the packet will be dropped.

Rule 1
Next, you must attach the ACL to port 0/1 and port 0/13 (the physical ports to which the
APs will be connected) so that the rules are applied to the appropriate wireless client
traffic that goes through the APs connected to the switch.
1. From the ACL àInterface Configurationpage,
2. Select port 0/1 from the Slot/Port drop-down menu.
3. Select IP ACL as the ACL Type.
4. Enter 1 as the sequence number, and click Submit.
5. Repeat the steps to associate ACL 100 with port 0/13.

1.4. Wireless Configuration
You configure and monitor all wireless settings from the WLAN tab on the navigation
panel. Since the deployment is an L2 Edge and there are no subnet boundaries to cross,
the switch can use the network management IP address for the wireless functions (Note:
the wireless switch component uses anIP address to manage the APs and peer-switches.
In a L2 environment like this scenario no inter-subnet routing is required. If however
the scenario involves a L3 environment where wireless components including APs and
peer-switches cross subnet boundaries, a routing interface must be used, such as a
loopback interface).
It is important to set the correct country code on the switch so that the APs operate in
the correct regulatory domain.
1. To configure wireless features, select the WLAN tab from the left pane and
traverse down the navigation tree to Administration àBasic Setup.
2. Select the Global tab in the right pane and make sure Wireless Switch Mode is
enabled
3. Select the appropriate country code then click the Submit to submit the request.
Note: This scenario uses the default AP profile configuration, so you do not need to
configure any AAA/RADIUS, Radio, or SSID settings.
Note:The IP address on the Wireless Global Configuration page is the default
management IP address of the switch (10.90.90.90). This address is “chosen” by the
system for use by the Wireless component for communications with the APs and Peer
Switches. If a loopback interface is available, this will be selected first.

1.5. Device Connections
At this point, all the devices are readyto be connected. After the switch discovers the
APs, they will appear on the Failed list because the MAC addresses of the APs are not
configured in the Valid AP database (i.e. the switch has not been configured to accept
any valid APs).
1. Connect AP1 to port 1 of the switch
2. Connect AP2 to port 13 of the switch
3. Wait about 60 seconds and click Monitoring àAccess Pointsà
Authentication Failed Access Points.
4. Select the APs to be managed and click Manage to add them to the valid AP
database.
5. To verify the status of APs, click Monitoring àAccess Point àManaged
Access Points.
6. To view the local Valid AP database, click Administration àBasic Setup, then
click the Valid AP tab.
Note: The APs get into Failed Access Point list in about 60 seconds. After you select APs
to be managed, the APs enter to fully managed state in about 60 seconds.

1.6. Save Configuration
To save the switch configuration, select Save Changes from the tool bar.

1.7. Verify the Configuration
1. From a wireless client, verify that you can see the Guest Network SSID.
2. Using a wireless client, connect to the Guest Network.
3. Check the IP address that the switch DHCP server assigned.
4. Try pinging from a client on the Guest Network to the switch or AP IP address. The
ping should pass.Try web browsing to the switch IP address. The browse should fail
because of the ACL.
1.8. Feature Tests
This section has some recommend tests you can perform to demonstrate some of the
Unified Access System features. Note that the images in this section show IP address and
other configuration information that is different than the configuration used in Scenario 1.
These images are provide for reference and are not intended to be an exact match of what
you see on your switch.
1.8.1. L2 Start Roaming Test
Try roaming between the two APs (you can simulate this by disconnecting an AP from
the switch port that you are currently associated withassuming you are utilizing PoE to
power the AP).Check the associated client statistics to see which AP the client
associates with and to observe that the client has roamed to be associated with the other
AP. If you start a Ping between the client and the WS, you will also observe minimal
packet loss during a roam.
1.8.2. Auto channel adjustment after associating with AP2
To check the current operating channel and to see if any channel adjustment is required,
select the WLAN tab from the navigation panel and traverse down to Monitoring à
Access PointsàManaged Access Points.
When an AP is powered up, the Initial Channel Selection (ICS) algorithm is used to
select the best operating channel. The algorithm scans all the available channels (based
on the country code) by counting the number of packets received on each channel and
selects the channel with the lowest packet count.
A second algorithm, Auto Channel Adjustment (ACA) is used to periodically evaluate
the operating channel. The radio must be configured for Auto Channel Adjustment. This
can be done by selecting the Automatic Channel check box in the Radio tabof the
Basic Setup page. By default this parameter is enabled.
Note: Any changes made to the profile configuration must be explicitly applied to the AP.
To apply the profile, navigate to Administration àAdvanced Configuration àAP
Profiles, select the profile to apply, and click Apply. This will temporarily disable the
radios as the new configuration is applied to the access points that use the profile. In
other words, you can make and submit one or many changes to an AP profile however
these configuration modifications will not be applied to the AP until you manually apply

the profile or an AP comes online into managed state after the profile changes are
submitted.
The Channel adjustment algorithm may be triggered periodically or manually.
To manually adjust the channel plan, use the following steps:
1. Select the WLAN tab from the navigation panel and navigate to Administration
àAP Management àRF Management.
2. Choose the 802.11 b/g and select the Manual Channel Plantab and then the
Start button to start the process. Use the Refreshbutton to check the results of
the channel plan.
3. Apply the suggested channel plan by clicking on “Apply” button.
Note: Before manually triggering the adjustment, the Channel Plan History Depthmust
be set to 0 or 1. This can be done by changing the Channel Plan History Depth in the
Configuration tab of the RF Management. By default this parameter is set to 5.

You may also manually change the operational channel from the Administration àAP
Management àAdvancedpage. Select the appropriate channel of the AP radio and
change it to the desired channel on the next screen.
1.8.3. Rogue AP Detection
To check the rogue AP list, select the WLAN tab from the navigation panel and navigate
to Monitoring àAccess PointsàRogue/RF Scan Access Points.

1.8.4. Power Adjustment
To check power level, select the WLAN tab from the navigation panel and click
Monitoring àAccess PointsàManaged Access Points. Select Radio Details tab to
check the power level.
The Automatic Power Adjustment algorithm works by setting the initial power of the AP
to the value specified in the AP profile. The power is then periodically adjusted to a level
based on presence or absence of packet transmission errors. The power is changed in
increments of 10%. Automatic adjustment can be done by selecting the Automatic
Power in the Radio tab of the Basic Setup. By default this parameter is enabled. The
algorithm may be triggered by a periodic timer or manually.
Note: The algorithm never reduces the AP power below the initial power setting as
specified in the profile and since the default power level in the default profile is 100
percent, the power would never be reduced unless this value is first changed.

The power adjustment may be manually triggered by selecting the WLAN tab from the
navigation panel and traversing down to Administration àAP Management àRF
Management. Select the Manual Power Adjustments tab and then the Start button to
start the process (click the Apply button to apply new power adjustment)
You may change the power of the AP radio by selecting the Radio tabof the Basic
Setup and changing the Initial Powerto the desired setting and click on submit.
Note: Any changes to the radio setting must be applied to the AP. To do this, click
Administration àAdvanced Configuration àAP Profiles. Select the profile to apply,
then click Apply to update all APs that use the selected profile.
1.8.4.1. Self Healing Cell Recovery
When a Managed AP is powered down, the power of its neighboring AP(s) managed by
the same switch is immediately increased by 20%. Power Adjustment Mode should be
Interval to see an increase in power of neighboring AP. By default, Initial Poweris
100%, so decrease power of APs below 80% or less to see 20% increase before powering
down one AP. The power level can be verified in the Radio detail on the Monitoring
àAccess PointsàManagedAccess Points page.
Note: A maximum of 3 neighboring APs are adjusted.

1.8.5. Load Balancing
The Wireless Switch performs load balancing on a per radio basis by tracking the
wireless bandwidth utilization. The maximum bandwidth utilization is configured in the
Radio tab of the Basic Setup. If the utilization reaches the configured threshold then new
client associations are rejected. The default bandwidth utilization threshold is 60%. The
WLAN Utilization may be monitored in the Radio Details tab of Monitoring àAccess
Points àManaged Access Points.
1.9. Switch and AP Cleanup
You will not need any of the settings you configured in this scenario for the other three
scenarios, so it is a good idea to reset the switch and the APs to the factory defaults.
To reset the switch configuration, click the Tools menu and select Reset Configuration.
To reset the AP configuration, you will need to telnet into the AP CLI and use the
“factory-reset” command. As mentioned earlier, you can place the AP into “debug”
mode from the switch if the AP is currently managed to gain access to the UI.

2. Scenario 2–L2/L3 Edge: 1 WS + 1 AP + 1 Remote AP
The diagram in this section shows a L2/L3 edge/overlay setup. In this scenario, a wireless switch
acts as an L3 device. Although the two APs are directly connected to the switch, they are in
different subnets. Both the APs are managed by theD-LINK Wireless Switch (WS1). Since the
wireless switch supports VLAN routing, L2 paths can be established between the AP switch ports
although they are on different IP subnets such that L3 Tunneling is not required.
This scenario has the following objectives:
•Understand how to implement a real plug & play deployment.
•Configure VLAN routing interfaces to simulate a L3 network with multiple
subnets.
•Create an ACL to block IP traffic between clients on different SSIDs.
•Assign IP addresses of APs & wireless clients through the WS DHCP server.
•Configure multiple SSIDs with different VLANs.
•Enable wireless encryption.
An overview of the configuration steps needed to complete this scenario is as follows:
1. Configure VLANs
2. Configure VLAN routing interfaces
3. Enable routing
4. Create loopback interface for WLAN functions
5. Set up DHCP server and address pools for VLANs
6. Configure ACL
7. Configure the AP profile, including new SSIDs and security
8. Add VLANs to L2 discovery list
9. Attach, discover,and validate APs
10. Save configuration
WS1
AP1
AP2
Seamless Roaming
Network: 10.90.90.90/8
Loopback: 192.168.10.254
CL1
192.168.
2
0.x
192.168.
3
0.x
SSID:
D-LINK-NET1: VLAN 100
D-LINK-NET2: VLAN 200
Guest Network
Port 0/1
VLAN 20
Port 0/13
VLAN 30
SSID:
D-LINK-NET1: VLAN 100
D-LINK-NET2: VLAN 200
Guest Network

To begin the Wireless Switch configuration, connect to port 12 from a PC on the 10.0.0.0
network and launchthe web browser using the default IP address: 10.90.90.90/8.You connect the
APs after you complete the entire switch configuration.
The IP address information for this scenario is as follows:
Device IP Address
Wireless Switch Management Interface 10.90.90.0/8
Wireless Switch Loopback Interface 192.168.10.254/32
AP1 192.168.20.x/24
AP2 192.168.30.x/24
Wireless Clients on D-LINK-NET1 192.168.100.x/24
Wireless Clients on D-LINK-NET2 192.168.200.x/24
2.1. Configuring LAN Settings
All of the features you configure in this section are within the LAN tab on the D-LINK
Wireless Switch.
In this scenario, the switch is a L3 device with a total of four VLAN routing interfaces. Each
connected AP is in a different subnet, so you need to configure two separate VLAN routing
interfaces and configure an IP address for each interface. Each AP has three different VAPs
enabled, and each VAP uses a different SSID and VLAN. You create an ACL to block IP traffic
between clients on VAP1 and clients on VAP2, so you also need to configure VLAN routing
interfaces for the two VAPs. The third VAP is the Guest Network, which is not used in this
scenario.
When wireless clients connect to the AP, all traffic from the client is tagged with the VLAN ID
associated with the SSID that the client uses to connect. You must configure the VLAN
information on the switch so that client traffic is accepted on the ports. (Note: if the VLAN ID of
the SSID Network is equal to the untagged-VLAN configured on the AP, which by default is 1,
traffic on that Network will be untagged when injected into the network. A Radius server could
also be used to assign per-client VLAN assignement).
2.1.1. Create VLANs
AP1 is connected to port 0/1, and AP2 is connected to port 0/13. The summary information for
the VLAN configuration is as follows:
VLAN ID VLAN Name Include Ports IP Address
VLAN 20 (Interface 4/1)AP1Port 0/1 192.168.20.254
VLAN 30 (Interface 4/2)AP2 Port 0/13 192.168.30.254
VLAN 100 (Interface 4/3)D-LINK-NET1 Ports 0/1 and 0/13 192.168.100.254
VLAN 200 (Interface 4/4)D-LINK-NET2 Ports 0/1and 0/13 192.168.200.254
Also, the default VLAN (PVID) for port 0/1 is 20, and the default VLAN for port 0/13 is 30.
Use the following steps to create and configure each VLAN. Repeat the steps to configure all four
VLANs. Refer to the table for information about what value to configure for each VLAN.

1. From the LAN tab on the switch Web interface, click L2 FeaturesàVLANàVLAN
Configuration.
2. Select Create from VLAN ID and Name pull down menu.
3. Enter the VLAN ID.
4. Enter VLAN Name .
5. On the Slot/Port row for the port to include in the VLAN, select Include from the
Participation drop-down menu.
6. For VLAN 100 and VLAN 200, select Tagging from the drop-down menu for port 0/1
and 0/13. This configuration tells the switch to add an 802.1Q VLAN Tag to the packets
that egress the port on those VLANs. This is so that the AP knows which Network (or
SSID) to forward the traffic on.
7. Click Submit.
8. Repeat for each of the VLANs in the above table.
Configure the Port VLAN ID for ports 0/1 and 0/13.
1. From the LAN tab on the switch Web interface, click L2 FeaturesàVLANàPort
Configuration.
2. Select port 0/1 from the Slot/Port drop-down menu.
3. Enter 20 in the Port VLAN ID field.
4. Click Submit.
5. Select port 0/13 from the Slot/Port drop-down menu.
6. Enter 30 in the Port VLAN ID field.
7. Click Submit.