Dell PowerConnect W-Airwave User manual

Dell PowerConnect W
Airwave 7.1
Best Practices Document

Table of Contents
Overview ..................................................................................................................................................................................... 4
Prerequisites for Integrating Dell PowerConnect W Infrastructure ......................................................................4
Known and Recently Resolved Issues ..........................................................................................................................5
Dell Feature Implementation Schedule for AWMS ....................................................................................................5
Configure AWMS to Optimally Manage Dell PowerConnect Infrastructure (Global) ............................................................. 6
Creating an Dell PowerConnect Specific Policy (Group) in AWMS ........................................................................................ 8
Basic Monitoring Configuration .....................................................................................................................................8
Configuration ......................................................................................................................................................................9
Discovering Dell Infrastructure ............................................................................................................................................... 10
AWMS and Dell PowerConnect Integration Strategies ......................................................................................................... 12
WMS Offload Utilizing AWMS GUI ..............................................................................................................................14
Define AWMS as Trap Host using Dell PowerConnect ArubaOS CLI..................................................................15
Understanding WMS Offload Impact on Dell Infrastructure..................................................................................19
Dell-Specific Capabilities within AWMS................................................................................................................................. 21
Dell PowerConnect Traps for RADIUS Auth & IDS Tracking .................................................................................21
Remote AP & Wired Networking Monitoring ............................................................................................................21
View Controller License Information ...........................................................................................................................22
6.4 - Device Classification..............................................................................................................................................22
Appendix A - Dell PowerConnect ArubaOS & AWMS CLI Commands.................................................................................. 25
Restart WMS on Local Controllers Utilizing Dell PowerConnect ArubaOS CLI ................................................27
Appendix B –WMS Offload Details........................................................................................................................................ 29
State Correlation Process..............................................................................................................................................29
Appendix C –Converting from MMS to Dell PowerConnect W AWMS ............................................................................... 31
Migrating Floor Plans from RF Plan to AWMS ..........................................................................................................34
Appendix D –Increasing Location Accuracy ........................................................................................................................ 35

Overview
This document provides best practices for leveraging the Dell PowerConnect W AirWave Wireless
Management Suite (AWMS) to monitor and manage your Dell PowerConnect infrastructure. The Dell
PowerConnect W infrastructure provides a wealth of functionality (firewall, VPN, remote AP, IDS, IPS,
and ARM) as well as an abundance of statistical information. Follow the simple guidelines in this
document to garner the full benefit of the Dell PowerConnect W infrastructure.
Minimum Requirements
Dell PowerConnect W AWMS version 7.0 or higher
Dell PowerConnect 5.0 or higher or ArubaOS 3.x or higher
Understanding Dell Topology
Here is a typical Master-Local deployment.
Note: There should never be a Local controller managed by an AWMS server whose Master
controller is also not under management.
Prerequisites for Integrating Dell PowerConnect W Infrastructure
You will need the following information to monitor and manage your Dell PowerConnect W
infrastructure.
SNMP community string (monitoring & discovery)
Telnet/SSH credentials (configuration only)
“enable” password (configuration only)
Figure 1 Typical Dell PowerConnect W Deployment

Note: Without proper Telnet/SSH credentials AWMS will not be able to acquire license and serial
information from controllers.
SNMPv3 credentials are required for wms offload.
Username
Auth password
Privacy password
Auth protocol
Known and Recently Resolved Issues
AWMS
Impact
Description
Resolution
7.x
AP-105s report noise floor at 20 dBm worse than
actual. AMP utilizes noise floor to calculate
client signal quality. Poor signal quality can
reduce location accuracy.
VisualRF adds 20 dBm to client signal in
order to increase location accuracy.
AMP will show very low signal for all
client associated with AP-105s.
7.x
The 651 controllers do not provide signal quality
and BW for clients associated to the internal AP.
7.x
wms offload does not work for APs on tagged
ports. This cause client tracking issues in AMP
7.x
Because of telnet service contention AMP
device auditing fails and causes mismatches on
Dell PowerConnect W controllers
7.1 will provide a more efficient method
to fetching controller settings.
Dell Feature Implementation Schedule for AWMS
Feature
AWMS Implementation
Ability filter User Session by Dell PowerConnect ArubaOS roles
7.0
AOS 5.0 support
7.0
RAP white list management for RN 3.1
7.0
Added support for rogue containment
7.0
Added support for configuring controller specific overrides
7.0
Client dot11counter status
7.0

Configure AWMS to Optimally Manage Dell PowerConnect
Infrastructure (Global)
AMP Setup General Page (Rate Limiting)
There are several SNMP tuning parameters which must be configured in order for AWMS to properly
monitor Dell PowerConnect infrastructure.
Figure 2 SNMP Rate Limiting
Navigate to AMP Setup > General page
Locate the Performance Tuning section
Enable SNMP Rate Limiting for Monitored Devices
Note : Enabling the SNMP Rate Limiting for Monitored Devices option above adds a small delay between each SNMP Get
request, thus the actual polling intervals will be longer than what is configured in Section 3. For example a 10 minute polling
interval will result in an actual 12 minute polling interval..
Click Save.
Device Setup Communication Page (Credential & Timing)
Credentials
AWMS requires several credentials to properly interface with Dell infrastructure. The Discover process
detailed in Section 3 requires proper global credential configuration.
Navigate to Device > Setup Communication page
Locate the Default Credentials section
Click on the Dell link

Figure 3 Credential Setup
Required Fields for Discovery
Enter SNMP Community String
Note: Be sure to note the community string, because it must match the SNMP Trap community
string which is configured later in this document.
Required Fields for Configurations and Basic Monitoring
Enter Telnet/SSH Username
Enter Telnet/SSH Password
Enter “enable” Password
Additional Required Fields for wms Offload
Enter SNMPv3 Username
Enter Auth Password
Enter Privacy Password
Note : Auth and Privacy passwords must match; because the wms offload command only accepts a
single password that is leveraged for both options

Creating an Dell PowerConnect Specific Policy (Group) in
AWMS
It is prudent to establish an Dell PowerConnect Group within AWMS. During the discovery process
you will move new discovered controllers into this group.
Basic Monitoring Configuration
Navigate to the Groups>List page
Click Add.
Enter a Name that represents the Dell PowerConnect W infrastructure from a security,
geographical, or departmental perspective and click Add.
You will be redirected to Group > Basic page for the Group you just created. On this page you will
need to tweak a few Dell-specific settings.
Find the SNMP Polling Periods section of the page
Change Override Poll Period for Other Services to “Yes”
Ensure User Data Polling Period is set to “10 minutes” Do not configure this interval lower
than “5 minutes”
Figure 5 Group Polling Configuration
Note : Enabling the SNMP Rate Limiting for Monitored Devices option above adds a small delay between each SNMP
Get request, thus the actual polling interval is 12 minutes for 10 minute polling interval.
Change Device-to-Device Link Polling Period to “30 minutes”
Change Rogue AP and Device Location Data Polling Period to “30 minutes”.
Find the Dell PowerConnect W section of the page
Configure the proper SNMP version for monitoring the Dell PowerConnect W
infrastructure. The other options in this section are addressed later in this document or in
the Dell PowerConnect W Configuration Guide.
Click Save and Apply.
Figure 6 Group SNMP Version for Monitoring

Note : You should reference the Dell PowerConnect W Configuration Guide for additional information on Policy
configuration.
Configuration
Reference the Dell PowerConnect ArubaOS Configuration Guide located on Home > Documentation
page for detailed instructions.

Discovering Dell Infrastructure
AWMS utilizes Dell’s topology to efficiently discover downstream infrastructure.
Prerequisites for discovery
Section 2 - credentials
Section 3 –creating Dell PowerConnect policies (Groups)
Summarized procedure for discovery and managing Dell
Infrastructure
Discover Master controllers
Manage Master controllers which automatically discovers Local controllers affiliated with the
Master controller
Manage Local controllers which automatically discovers Thin APs affiliated to the Local controllers
Manage Thin APs
Note : Always add one Controller and its affiliated Thin APs into management or monitoring mode in a serial fashion,
one at a time. Adding new devices is a very CPU intensive process for AWMS and can quickly overwhelm all of the
processing power of the server if hundreds of Thin APs are added (migrated from New to Managed or Monitoring)
simultaneously.
Master Controller Discovery
Scan networks containing Dell PowerConnect W Master controllers from Device > Discover page.
This will use your Global Credentials configured in the previous section.
- or -
Manually enter the Master controller on the Device > Add page.
Select the controller type and click “Add” button
Enter IP Address
Required Fields for Discovery
Enter SNMP Community String
Note : Be sure to note the community string, because it must match the SNMP Trap community string which is
configured later in this document.
Required Fields for Configurations and Basic Monitoring
Enter Telnet/SSH Username
Enter Telnet/SSH Password
Enter “enable” Password
Additional Required Fields for WMS Offload

Enter SNMPv3 Username
Enter Auth Password
Enter Privacy Password
Note : Auth and Privacy passwords must match; because the wms offload command only accepts a single password
that is leveraged for both options.
In AWMS 7.0 and later AWMS automatically configures the Auth Protocol to SHA.
Warning : Be sure to note the community string, because it must match the SNMP Trap community string which is
configured later in this document.
Assign controller to a Group & Folder
Ensure “Monitor Only” option is selected
Click the “Add” button
Navigate to APs/Devices > New page
Select the Dell PowerConnect W Master controller
Ensure “Monitor Only” option is selected
Click the “Add” button
Figure 7 Add New Controller
Local Controller Discovery
Local controllers are discovered via the Master controller. After waiting for the Thin AP Polling
Period or executing a “Poll Now”, the Local controllers will appear on the APs//Devices > New
page. “Poll Now” button is located on the Device > Monitoring page.
Add the Local controller to Group defined above. Within AWMS Local controllers can be split
away from the Master controller’s Group.
Thin AP Discovery
Thin APs are discovered via the Local controller. After waiting for the Thin AP Polling Period or
executing a “Poll Now”, thin APs will appear on the APs/Devices > New page. “Poll Now” button
is located on the Device > Monitoring page.
Add the Thin APs to the Group defined above. Within AMWS thin APs can be split away from
the controller’s Group. You can split thin APs into multiple Groups if required.

AWMS and Dell PowerConnect Integration Strategies
Integration Goals
All Masters Architecture
Master Local Architecture
Rogue & Client Info
enable stats
Rogue containment only
ssh access to controllers
ssh access to controllers
Rogue & Client containment
wms offload
wms offload
Reduce Master Controller Load
wms offload
debuging off
IDS & Auth Tracking
Define AWMS as trap host
Define AWMS as trap host
Track Tag Location
enable RTLS
wms offload
enable RTLS
wms offload
Key Integration Points
IDS Tracking does not require “wms offoad”in an All Master or Master Local environment
IDS Tracking does require enable stats in a Master Local environment
“wms offload”will hide the Security Summary tab on Master Controller’s web interface
“wms offload”encompasses “enable stats” or “enable stats” is a subset of “wms offload”
Unless you “enable stats” on the Local Controllers in a Master Local environment, the Local
Controllers do not populate their MIBs with any information about clients or rogue devices
discovered/associated with their APs. Instead the information is sent upstream to Master
Controller.
Example Use Cases
Example of When to Use Enable Stats
Customer wants to pilot AMWS and doesn’t want to make major configuration changes to their
infrastructure or manage configuration from AWMS. Enable Stats still pushes a small subset of
commands to the controllers via SSH.
Examples of When to Use WMS Offload
Customer has older Aruba Networks infrastructure in Master Local environment and their Master
controller is fully taxed. Offloading WMS will increase the capacity of the Master Controller by
offloading statistic gathering requirements and device classification coordination to AWMS.
Customer is replacing MMS with AWMS and already had WMS offloaded for performance
reasons.
Customer wants to use AWMS to distribute client and rogue device classification amongst
multiple Master controllers in a Master Local environment or in an all Masters environment
Examples of When to Use RTLS
A Hospital wants to achieve very precise location accuracy (5 -15 feet) for their medical devices
which are associating to the WLAN.
A customer wants to locate items utilizing WiFi Tags.

Note : RTLS could negatively impact your AWMS server’s performance
Example to Define AWMS as Trap Host
Customer wants to track IDS events within the AWMS UI.
Customer is in the process of converting their older 3rd Party WLAN devices to Dell PowerConnect
W devices and wants a unified IDS dashboard for all WLAN infrastructure.
Customer wants to relate Auth failures to a client device, AP, Group of APs, and controller.
AWMS provides this unique correlation capability.
Prerequisites for Integration
If you have not discovered the Dell infrastructure or configured credentials, proceed to Sections 3 and 4
of this document.
Enable Stats Utilizing AWMS GUI
To enable stats on the Aruba controllers:
Navigate to Groups>Basic page
Locate the Dell PowerConnect W section
Disable Offload Dell PowerConnect WMS Database
Click Save and Apply.
Figure 8 Enable Stats
Navigate to AMP Setup > General page
Locate Configuration Options section
Enable Allow WMS Offload Configuration in Monitor-Only Mode
Click Save.
Figure 9 WMS Offload Configuration Options (enable stats)

This will push a set of commands via SSH to all Dell PowerConnect local Controllers. AWMS must
have read/write access to the controllers in order to push these commands. See Device Setup
Communication Section below for help configuring your device credentials.
Note : This process will not reboot your controllers
Warning : If you don’t follow the above steps local controllers will not be configured to populate statistics. This
decreases AWMS’ capability to trend client signal information and to properly locate devices. See Appendix A on how
to utilize the Dell PowerConnect W AirWave CLI to enable stats on Dell PowerConnect W infrastructure.
Note : If your credentials are invalid or the changes are not applied to the controller, error messages will display on the
controller’s Device > Monitoring page under the Recent Events section. If the change fail, AWMS does not audit these
setting (display mismatches) and you will need to apply to the controller by hand, see Appendix A for detailed
instructions.
Commands Pushed by AWMS during Enable Stats
(Do not enter these commands)
configure terminal
no mobility-manager <Active WMS IP Address>
wms
general collect-stats enable
stats-update-interval 120
show wms general
write mem
WMS Offload Utilizing AWMS GUI
To Offload WMS on the Dell PowerConnect W controllers:
Navigate to Groups>Basic page
Locate the Dell PowerConnect W section
Enable Offload Dell PowerConnect W WMS Database
Locate the Configuration section
Enable or Disable Allow WMS Offload Configuration in Monitor-Only Mode
Click Save and Apply
Figure 10 Offload WMS

This will push a set of commands via SSH to all Dell PowerConnect W Master Controllers. If the
controller does not have an SNMPv3 user that matches AWMS’database it will automatically create a
new SNMPv3 user. AWMS must have read/write access to the controllers in order to push these
commands.
Note : This process will not reboot your controllers. See Appendix A on how to utilize the Dell PowerConnect W CLI to
enable stats or wms offload.
Warning : The SNMPv3 user’s Auth Password and Privacy Password must be the same
Note : Auth Protocol must be configured to SHA. Privacy Protocol must be configured to DES
Commands Pushed by AWMS during WMS Offload
(Do not enter these commands)
configure terminal
mobility-manager <AWMS IP> user <AWMS SNMPv3 User Name> <AWMS Auth/Priv
PW>
stats-update-interval 120
write mem
Note : When you use Dell PowerConnect W AWMS 7.0 with Dell PowerConnect W , Dell PowerConnect W AWMS
AWMS will configure SNMPv2 traps with the mobile manager command.
Other Processes for wms offload
AWMS will issue an SNMPGet on table (wlsxSysExtHostname) to complete the offload process
(OID=.1.3.6.1.4.1.14823.2.2.1.2.1.2.0.)
Define AWMS as Trap Host using Dell PowerConnect ArubaOS CLI
To ensure the AWMS server is defined a trap host, SSH into each controller (Master and Local, enter
“enable” mode, and issue the following commands:
(Controller-Name) # configure terminal
Enter Configuration commands, one per line. End with CNTL/Z
(Controller-Name) (config) # snmp-server host <AWMS IP ADDR> version 2c <SNMP
community string of conroller>
Note : Ensure the SNMP community matches what was configured in Section 2
(Controller-Name) (config) # snmp-server trap source <CONTROLLER’S IP>
(Controller-Name) (config) # write mem
Saving Configuration...
Saved Configuration

Warning : Do not configure the SNMP version to v3, because AWMS does not support SNMPv3 traps/informs.
Dell PowerConnect ArubaOS Traps utilized by AWMS
Auth Traps Utilized by AWMS
wlsxNUserAuthenticationFailed
wlsxUserAuthenticationFailed (AMP does not use this trap)
wlsxNAuthServerReqTimedOut
IDS Traps Utilized by AWMS
wlsxSignatureMatchAP
wlsxSignatureMatchSta
wlsxSignAPNetstumbler
wlsxSignStaNetstumbler
wlsxSignAPAsleap
wlsxSignStaAsleap
wlsxSignAPAirjack
wlsxSignStaAirjack
wlsxSignAPNullProbeResp
wlsxSignStaNullProbeResp
wlsxSignAPDeauthBcast
wlsxSignStaDeauthBcastwlsxChannelFrameErrorRateExceeded
wlsxChannelFrameFragmentationRateExceeded
wlsxChannelFrameRetryRateExceeded
wlsxNIpSpoofingDetected
wlsxStaImpersonation
wlsxReservedChannelViolation
wlsxValidSSIDViolation
wlsxStaPolicyViolation
wlsxRepeatWEPIVViolation
wlsxWeakWEPIVViolation
wlsxFrameRetryRateExceeded
wlsxFrameReceiveErrorRateExceeded
wlsxFrameFragmentationRateExceeded
wlsxFrameBandWidthRateExceeded
wlsxFrameLowSpeedRateExceeded
wlsxFrameNonUnicastRateExceeded
wlsxChannelRateAnomaly
wlsxNodeRateAnomalyAP
wlsxNodeRateAnomalySta
wlsxEAPRateAnomaly
wlsxSignalAnomaly
wlsxSequenceNumberAnomalyAP

wlsxSequenceNumberAnomalySta
wlsxApFloodAttack
wlsxInvalidMacOUIAP
wlsxInvalidMacOUISta
wlsxStaRepeatWEPIVViolation
wlsxStaWeakWEPIVViolation
wlsxStaAssociatedToUnsecureAP
wlsxStaUnAssociatedFromUnsecureAP
wlsxAPImpersonation
wlsxDisconnectStationAttackAP
wlsxDisconnectStationAttackSta
Diagnostic Steps to Ensure IDS & Auth Traps Display in AWMS
Validate your Dell PowerConnect ArubaOS configuration by exiting the “configure terminal” mode
and issue the following command:
(Controller-Name) # show snmp trap-list
If any of the traps below don’t show as enabled enter configure terminal mode and issue the
following command:
(Controller-Name) (config) # snmp-server trap enable <TRAPS FROM LIST ABOVE>
Note : See Appendix A for the full command that can be copied and pasted directly into the Dell PowerConnect W CLI.
(Controller-Name) (config) # write mem
Saving Configuration...
Saved Configuration
Ensure the source IP of the traps match the IP that AWMS utilizes to manage the controller.
Navigate to Device > Monitoring page to validate the IP address.
Verify that there is a SNMPv2 community string that matches the SNMP Trap community string
on the controller.
(Controller-Name) # #show snmp community
SNMP COMMUNITIES
----------------
COMMUNITY ACCESS VERSION
--------- ------ -------
public READ_ONLY V1, V2c
(Controller-Name) # #show snmp trap-host
Figure 11 Verify IP Address on Device > Monitoring Page

SNMP TRAP HOSTS
---------------
HOST VERSION SECURITY NAME PORT TYPE TIMEOUT RETRY
---- ------- ------------- ---- ---- ------- -----
10.2.32.4 SNMPv2c public 162 Trap N/A N/A
Verify firewall port 162 (default) is open between AWMS and the controller.
Validate traps are making it into AWMS by issuing the following commands from AWMS
command line.
[root@AWMS ~]# qlog enable snmp_traps
[root@AWMS ~]# tail –f /var/log/amp_diag/snmp_traps
1241627740.392536 handle_trap|2009-05-06 09:35:40 UDP: [10.2.32.65]-
>[10.51.5.118]:-32737 sends trap: DISMAN-EVENT-MIB::sysUpTimeInstance =
Timeticks: (127227800) 14 days, 17:24:38.00 SNMPv2-MIB::snmpTrapOID.0 = OID:
SNMPv2-SMI::enterprises.14823.2.3.1.11.1.2.1106 SNMPv2-
SMI::enterprises.14823.2.3.1.11.1.1.60 = Hex-STRING: 07 D9 05 06 09 16 0F 00
2D 08 00 SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.5.0 = Hex-STRING: 00
1A 1E 6F 82 D0 SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.6.0 = STRING:
"aruba-ap"SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.1.0 = Hex-STRING: 00 1A
1E C0 2B 32 SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.56.0 = INTEGER: 2
SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.17.0 = STRING: "aruba-124-
c0:2b:32" SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.18.0 = INTEGER: 11
SNMPv2-SMI::enterprises.14823.2.3.1.11.1.1.58.0 = STRING:
"http://10.51.5.118/screens/wmsi/reports.html?mode=ap&bssid=00:1a:1e:6f:82:d
0"
Note : You will see many IDS and Auth Traps from this command. AWMS only processes a small subset of these Traps
which display within AWMS UI. The Traps that AWMS does process are listed above.
Ensure you disable qlogging after testing as it could negatively impact AWMS performance if let turned
on.
[root@AWMS ~]# qlog enable snmp_traps

Understanding WMS Offload Impact on Dell Infrastructure
When offloading WMS it is important to understand what functionality is migrated to AWMS and
what functionality is deprecated.
The following Tabs and sections are deprecated after offload wms
Plan Tab - where floor plans are stored and heatmaps are generated. Prior to offloading wms ensure
that you have exported floor plans from the Dell PowerConnect ArubaOS and imported into
AWMS. All functionality within the Plan Tab is incorporated with the VisaulRF module in
AWMS.
Report Tab –All reports are incorporate within AWMS.
Events Tab –the majority of functionality within this Tab is incorporate within AWMS Reports
and Alerts sections with the exception of:
Interference Detected
Rogue AP
Station Failed
Suspected Rogue AP
One important area to note is the Security Summary display disappears after offloading WMS. The
data is still being processed by the Master Controller, but the summary information is not available.
AWMS does provide ability to view some of this information in detail and summary form.
WLAN Attack Summary
DOS Attacks –no summary data available in AWMS
Impersonation Attacks –no summary data available in AWMS
Signature Pattern Matches –partial summary data available on Home and RAPIDS > Overview
pages
Figure 12 Security Summary on Master Controller

Policy Violations –no summary data available in AWMS
Unauthorized Devices Detected –no summary data available in AWMS
Rogue AP Classification Summary
Rogue APs Detected –summary data available on RAPIDS > Overview page
Rogue APs Disabled –no summary data available in AWMS
Suspected Rogue APs –partial data is available in AWMS on each AP’s Device > Management
page
Interfering APs Detected –partial data is available in AWMS on each AP’s Device > Management
page
Known Interfering APs –partial data is available in AWMS on each AP’s Device > Management
page
Router Summary
Routers Detected –no summary data available in AWMS
Client Classification Summary
Valid Clients –summary data available on all pages in the dashboard
Interfering clients –no summary data available in AWMS
Disabled Clients –no summary data available in AWMS
See “Device Classification” for more information on Security, IDS, WIPS, WIDS, classification, and
RAPIDS.