Siemens SIMATIC NET SCALANCE WLC711 User manual

SCALANCE WLC711
___________________
___________________
___________________
___________________
___________________
___________________
___________________
___________________
SIMATIC NET
Industrial Wireless LAN
SCALANCE WLC711
Getting Started
04/2016
C7900
0-G8976-C269-07
Preface
Security recommendations
1
Description
2
Getting started
3
Basic configuration with the
wizard
4
Managing access points
5
Configuring specific use
cases with the wizard
6
Optional configuration
7

Siemens AG
Division Process Industries and Drives
Postfach 48 48
90026 NÜRNBERG
GERMANY
Document order number: C79000-G8976-C269-06
Ⓟ
11/2016 Subject to change
Copyright © Siemens AG 2011 - 2016.
All rights reserved
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by
personnel qualified
for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.

SCALANCE WLC711
Getting Started, 04/2016, C79000-G8976-C269-07 3
Preface
Introduction
By using the Industrial Wireless LAN controller SCALANCE WLC711 along with controller-
based access points, it is possible to set up a single wireless infrastructure for the entire
company. This achieves a high degree of flexibility since mobile subscribers (for example a
laptop) move both in the office and in the automation network and can change over
seamlessly between these networks (roaming). This means that data can be accessed from
anywhere in the company over wireless.
Thanks to the use of a centralized security mechanism for each user group, data is protected
from unauthorized access and manipulation.
The controller-based access points SCALANCE W78xC support the WLAN standards IEEE
802.11a/b/g ad 802.11n and are connected to the IWLAN controller SCALANCE WLC via
gigabit Ethernet. The same applies to the access points SCALANCE W786C, with which a
connection via fiber-optic is possible depending on the version. The controller-based access
points SCALANCE W786-2HPW support the WLAN standards IEEE 802.11a/b/g and are
connected to the IWLAN controller SCALANCE WLC via fast Ethernet or fiber-optic cable.
One requirement for operation is always the use of the IWLAN controller SCALANCE WLC
which makes the group configuration of access points possible. This allows a widespread
IWLAN infrastructure to be represented clearly. The central management with the IWLAN
controller also allows the recording of disruptions, monitoring and documentation of
statistics.
Who is this document intended for?
The Getting Started is intended for system administrators who want to configure the wireless
LAN controller SCALANCE Industrial Wireless LAN controller WLC711 and the access
points with the Web Based Management (WBM) of the SCALANCE Industrial Wireless LAN
controller and access points.
Purpose of this document
This document provides you with a general overview of the functions of the WBM
SCALANCE Industrial Wireless LAN controller and access points. The Getting Started will
quickly help you to learn about configuring the devices.
We recommend that you read the Getting Started not selectively but rather from front to
back. You will get to know the important components that can help you during configuration.
Validity of this document
This document is valid for the SCALANCE IWLAN controller WLC711 and the controller-
based SCALANCE W78xC access points as of firmware version V 9.21.

Preface
SCALANCE WLC711
4Getting Started, 04/2016, C79000-G8976-C269-07
SIMATIC NET glossary
Explanations of many of the specialist terms used in this documentation can be found in the
SIMATIC NET glossary.
You will find the SIMATIC NET glossary here:
●SIMATIC NET Manual Collection or product DVD
The DVD ships with certain SIMATIC NET products.
●On the Internet under the following address:
50305045 (https://support.industry.siemens.com/cs/ww/en/view/50305045)
Security messages
Note
Siemens offers IT security mechanisms for its automation and drive product portfolio in order
to support the safe operation of the plant/machine. Our products are also continuously
developed further with regard to IT security. We therefore recommend that
you regularly
check for updates of our products and that you only use the latest versions. You will find
information in:
http://www.siemens.com/industrialsecurity. (http://www.siemens.com/industrialsecurity.)
Here, you can register for a product
-specific newsletter.
For the safe operation of a plant/machine, however, it is also necessary to integrate the
automation components into an overall IT security concept for the entire plant/machine,
whic
h corresponds to the state-of-the-art IT technology. You will find information on this in:
https://support.industry.siemens.com (https://support.industry.siemens.com/cs/de/en/)
Products from
other manufacturers that are being used must also be taken into account.

SCALANCE WLC711
Getting Started, 04/2016, C79000-G8976-C269-07 5
Table of contents
Preface ................................................................................................................................................... 3
1 Security recommendations...................................................................................................................... 7
1.1 General information ..................................................................................................................7
1.2 Security recommendations .......................................................................................................8
2 Description............................................................................................................................................ 13
2.1 General ...................................................................................................................................13
2.2 Requirement for configuration ................................................................................................15
2.3 LED display.............................................................................................................................16
3 Getting started ...................................................................................................................................... 17
3.1 Sequence................................................................................................................................17
3.2 Logon ......................................................................................................................................19
3.3 Shutting down and turning off .................................................................................................21
4 Basic configuration with the wizard........................................................................................................ 23
4.1 Procedure - "Basic Installation Wizard" page .........................................................................25
4.2 Procedure - "Management" page ...........................................................................................28
5 Managing access points........................................................................................................................ 35
5.1 Commissioning access points ................................................................................................35
5.2 Registering access points.......................................................................................................39
5.3 Configuring access points.......................................................................................................45
5.3.1 Single configuration ................................................................................................................45
5.3.2 Multiple configuration..............................................................................................................58
6 Configuring specific use cases with the wizard ...................................................................................... 61
6.1 Use case: Bridged at WLC .....................................................................................................61
6.2 Use case: Bridged at AP.........................................................................................................70
7 Optional configuration ........................................................................................................................... 79
7.1 Expanding the number of manageable access points............................................................79
7.2 Access using the Command Line Interface (CLI) ...................................................................82
7.3 Data backup............................................................................................................................84
7.4 Using reports...........................................................................................................................87
7.5 Using policies..........................................................................................................................89
7.6 Authentication via RADIUS server..........................................................................................91
7.7 User configuration...................................................................................................................94

Table of contents
SCALANCE WLC711
6Getting Started, 04/2016, C79000-G8976-C269-07
Index .................................................................................................................................................... 97

SCALANCE WLC711
Getting Started, 04/2016, C79000-G8976-C269-07 7
Security recommendations
1
1.1
General information
Note
Note the information in the SCALANCE WLC711 user guide and the compact operating
instructions SCALANCE WLC711.
Notes on secure network design
To protect your network from attacks, note the following points:
●
Use WPA2/ WPA2-PSK with AES
To prevent misuse of a password, use only WPA2/AES. WPA2/ WPA2-PSK with AES
provides the highest security.
●
Protect your network against man-in-the-middle attacks
To protect your network from man-in-the-middle attacks, a network topology is
recommended, that makes it more difficult for an attacker to tap into the communications
path between two end devices.
–You can, for example, protect WLAN devices by arranging so that the management
port is accessible only via a separate management VLAN.
–You can also install a separate HTTPS certificate on a WLAN client / access point.
The HTTPS certificate checks the identity of the device and controls the encrypted
data exchange. You can install the HTTPS certificate via HTTP.
●
Use SNMPv3
SNMPv3 provides you with highest possible security when accessing the WLAN devices
via SNMP.

Security recommendations
1.2 Security recommendations
SCALANCE WLC711
8Getting Started, 04/2016, C79000-G8976-C269-07
1.2
Security recommendations
To prevent unauthorized access, note the following security recommendations.
General
●You should make regular checks to make sure that the device meets these
recommendations and/or other security guidelines.
●Evaluate your plant as a whole in terms of security. Use a cell protection concept with
suitable products.
●When confidential zones are used, the internal and external network are disconnected, an
attacker cannot access the data from the outside.
●Operate the device only within a protected network area.
●Use additional devices with VPN functionality (e.g. SCALANCE S) to encrypt and
authenticate communication from and to the devices.
●For data transfer via a non-secure network, use an encrypted VPN tunnel (IPsec) by
using additional devices with VPN functionality (e.g. SCALANCE S).
●For operation of the device in a non-secure infrastructure no product liability will be
accepted.
●Separate connections correctly (WBM. Telnet, SSH etc.).
Physical access
●Restrict physical access to the device to qualified personnel.
●Lock unused physical ports on the device. Unused ports can be used to gain forbidden
access to the plant.
Software (security functions)
●Keep the software up to date. Check regularly for security updates of the product.
You will find information on this on the Internet pages "Industrial Security
(http://www.siemens.com/industrialsecurity".
●Inform yourself regularly about security advisories and bulletins published by Siemens
ProductCERT (http://www.siemens.com/cert/en/cert-security-advisories.htm).
●Only activate protocols that you really require to use the device.
●Use the security functions such as address translation with NAT (Network Address
Translation) or NAPT (Network Address Port Translation) to protect receiving ports from
access by third parties.
●Restrict access to the device with a firewall or rules in an access control list (ACL -
Access Control List).
●If RADIUS authentication is via remote access, make sure that the communication is
within the secured network area or is via a secure channel.
●The option of VLAN structuring provides good protection against DoS attacks and
unauthorized access. Check whether this is practical or useful in your environment.

Security recommendations
1.2 Security recommendations
SCALANCE WLC711
Getting Started, 04/2016, C79000-G8976-C269-07 9
●Enable logging functions. Use the central logging function to log changes and access
attempts centrally. Check the logging information regularly.
●Configure a Syslog server to forward all logs to a central location.
●Use WPA2/ WPA2-PSK with AES to protect the WLAN.
Passwords
●Define rules for the use of devices and assignment of passwords.
●Regularly update passwords and keys to increase security.
●Change all default passwords for users before you operate the device.
●Only use passwords with a high password strength. Avoid weak passwords for example
password1, 123456789, abcdefgh.
●Make sure that all passwords are protected and inaccessible to unauthorized personnel.
●Do not use the same password for different users and systems or after it has expired.
Keys and certificates
This section deals with the security keys and certificates you require to set up HTTPS (
HyperText Transfer Protocol Secured Socket Layer).
●We strongly recommend that you create your own HTTPS certificates and make them
available.
There are preset certificates and keys on the device. The preset and automatically
created HTTPS certificates are self-signed.
We recommend that you use HTTPS certificates signed either by a reliable external or by
an internal certification authority. The HTTPS certificate checks the identity of the device
and controls the encrypted data exchange. You can install the HTTPS certificate via the
WBM (System > Load and Save).
●Handle user-defined private keys with great caution if you use user-defined SSH or SSL
keys.
●Use the certification authority including key revocation and management to sign the
certificates.
●Verify certificates and fingerprints on the server and client to avoid "man in the middle"
attacks.
●We recommend that you use certificates with a key length of 2048 bits.
●Change keys and certificates immediately, if there is a suspicion of compromise.

Security recommendations
1.2 Security recommendations
SCALANCE WLC711
10 Getting Started, 04/2016, C79000-G8976-C269-07
Secure/non-secure protocols
●Avoid and disable non-secure protocols, for example Telnet and TFTP. For historical
reasons, these protocols are still available, however not intended for secure applications.
Use non-secure protocols on the device with caution.
●The following protocols provide secure alternatives:
–SNMPv1/v2 → SNMPv3
Check whether use of SNMPv1 is necessary. SNMPv1 is classified as non-secure.
Use the option of preventing write access. The product provides you with suitable
setting options.
If SNMP is enabled, change the community names. If no unrestricted access is
necessary, restrict access with SNMP.
Use SNMPv3 in conjunction with passwords.
–HTTP → HTTPS
–SNTP → NTP
●Use secure protocols when access to the device is not prevented by physical protection
measures.
●To prevent unauthorized access to the device or network, take suitable protective
measures against non-secure protocols.
●If you require non-secure protocols and services, operate the device only within a
protected network area.
●Restrict the services and protocols available to the outside to a minimum.

Security recommendations
1.2 Security recommendations
SCALANCE WLC711
Getting Started, 04/2016, C79000-G8976-C269-07 11
Port list
The following table provides an overview of the ports through which the IWLAN
controller/access point communicate. Ports may need to be opened for correct working in the
network. Keep this in mind when configuring a firewall.
Component
Protocol
Soruce
Port
Destina-
tion Port
Service
Remark
Require
Firewall
to open
Source
Destination
(TCP/UDP)
Ports for AP/Controller Communication
Controller Access Point UDP Any 13910 WASSP
Management and Data Tunnel
between AP and Controller
Yes
Access Point Controller UDP Any 13910 WASSP
Management and Data Tunnel
between AP and Controller
Yes
Controller Access Point UDP 4500 Any Secured
WASSP
Management Tunnel between
AP and Controller
Optional
Access Point Controller UDP Any 4500 Secured
WASSP
Management Tunnel between
AP and Controller
Optional
Access Point
Controller
UDP
Any
13907
WASSP
AP Registration to Controller
Yes
Access Point Controller UDP Any 67 DHCP
Server
If Controller is DHCP Server
for AP
Optional
Access Point
Controller
UDP
Any
427
SLP
AP Registration to Controller
Optional
Controller
Access Point
TCP/UDP
Any
69
TFTP
AP image transfer
Yes
1
Access Point
Controller
TCP/UDP
Any
69
TFTP
AP image transfer
Yes
1
Controller
Access Point
TCP/UDP
Any
22
SCP
AP traces
Yes
Any Access Point TCP Any 2002,
2003
RCAPD AP Real Capture (if enabled) Optional
Any
Access Point
TCP/UDP
Any
22
SSH
Remote AP login (if enabled)
Optional
Ports for Controller Management
Any Controller TCP/UDP Any 22 SSH Controller CLI access Yes
Any
Controller
TCP/UDP
Any
5825
HTTPS
Controller GUI access
Yes
Any
Controller
TCP/UDP
Any
161
SNMP
Controller SNMP access
Yes
Any Controller TCP/UDP Any 162 SNMP
Trap
Controller SNMP access Yes
Ports for Inter Controller Mobility and Availability
Controller Controller UDP Any 13911 WASSP Mobility and Availability Tun-
nel
Yes
Controller
Controller
TCP
Any
427
SLP
SLP Directory
Yes
Controller
Controller
TCP
Any
20506
Langley
Remote Langley Secure
Yes
Controller
Controller
TCP
Any
60606
Mobility
VN MGR
Yes
Controller
Controller
TCP
Any
123
NTP
Availability time sync
Yes
Controller DHCP Server UDP Any 67 SLP Asking DHCP Server for SLP
DA
Yes
DHCP Server Controller UDP Any 68 SLP Response from DHCP Server
for SLP DA request
Yes

Security recommendations
1.2 Security recommendations
SCALANCE WLC711
12 Getting Started, 04/2016, C79000-G8976-C269-07
Component
Protocol
Soruce
Port
Destina-
tion Port
Service
Remark
Require
Firewall
to open
Source
Destination
(TCP/UDP)
Core Back-End Communication
Controller DNServer UDP Any 53 DNS If using DNS Optional
Controller Syslog Server UDP Any 514 Syslog If Controller logs to external
syslog server
Optional
Controller RADIUS
Server
UDP Any 1812 RADIUS
Authenti-
cation
and
Authori-
zation
If using RADIUS AAA Optional
Controller RADIUS
Server
UDP Any 1813 RADIUS
Account-
ing
If enabled RADIUS account-
ing
Optional
Dynamic Au-
thorization
Client (typically
NAC)
Controller UDP Any 3799 Dynamic
Authori-
zation
Server
(DAS)
Request from Dynamic Au-
thorization Client to discon-
nect a specific client
Optional
Controller AeroScout
Server
UDP 1144 12092 Location-
Based
Service
Proxy
(lbs)
AeroScout Location-Based
Service
Optional
AeroScout
Server
Controller UDP 12092 1144 Location-
Based
Service
Proxy
(lbs)
AeroScout Location-Based
Service
Optional
Controller Check Point UDP Any 18187 Check-
point
Logging to Check Point Serv-
er
Optional
1
TFTP uses port 69 only when the secure control tunnel is NOT enabled between the AP and controller. If the secure
control tunnel is enabled TFTP exchanges take place within the secure tunnel and port 69 is not used

SCALANCE WLC711
Getting Started, 04/2016, C79000-G8976-C269-07 13
Description
2
2.1
General
Information
Siemens Customer Support
If you have questions or problems, contact Siemens Customer Support at the following
address:
●https://support.industry.siemens.com
Related information can be found on the accompanying SIMATIC NET IWLAN CD:
●BAK W78xC
●BAK W786-2HPW
●SCALANCE W-700 configuration manual
Which access points can be used?
To achieve an optimum WLAN, the following SCALANCE wireless LAN access points are
ideal:
●SCALANCE wireless LAN W78xC access points
●SCALANCE Wireless LAN access points W788C-2 RJ-45
●SCALANCE Wireless LAN access points W788C-2 M12
●SCALANCE Wireless LAN access points W788C-2 M12 EEC
●SCALANCE Wireless LAN access points W786-2HPW
Note
Detection of W788C-2 M12 EEC devices
During detection of devices, the devices of the
W788C-2 M12 EEC variant are shown as
W788C
-2 M12
How is data transferred?
To transfer the data, the SCALANCE WLC711 has the following RJ-45 Ethernet connectors:
●Management port: "admin" interface. The configuration data is transferred at this port at
10/100/1000 Mbps.
●Data port: "esa0" interface. At this port, the data is transferred at 10/100/1000 Mbps.
You will find further information in the compact operating instructions SCALANCE WLC711.

Description
2.1 General
SCALANCE WLC711
14 Getting Started, 04/2016, C79000-G8976-C269-07
Where is the configuration data stored?
Your configuration data is stored directly on the WLC. It is, however, possible to store this
data as a backup and to transfer it to other WLCs. How to create backups is explained in the
SCALANCE WLC711 User Guide.
What can the WBM do?
All access points connected to a WLC are centrally monitored and managed to achieve
better administrative control. When necessary, each AP can be configured, enabled or
disabled separately. APs can be managed using the WLC. Alarms, traps and reporting
statistics are generated and can be evaluated by the network manager. The APs also send
data about performance, security and use to the WLC that can then be put together in
detailed reports.
With the WBM, you have the following options:
●Central configuration, administration and monitoring of several access points by the
SCALANCE Industrial Wireless LAN controller.
●Configuration of filter functions.
●Making the settings:
–Bridge traffic locally at WLC.
The data coming from the access points is forwarded centrally via the WLC.
–Bridge traffic locally at AP:
The data coming from the access points us forwarded directly by the access points to
the wired network.

Description
2.2 Requirement for configuration
SCALANCE WLC711
Getting Started, 04/2016, C79000-G8976-C269-07 15
2.2
Requirement for configuration
To be able to configure the SCALANCE Industrial Wireless LAN controller and the access
points with the WBM, the following conditions must be met:
●Correct connection of the hardware.
●A correct connection between the management port of the SCALANCE WLC711 and a
PC.
You will find information about setting up in the compact operating instructions SCALANCE
WLC711.

Description
2.3 LED display
SCALANCE WLC711
16 Getting Started, 04/2016, C79000-G8976-C269-07
2.3
LED display
Introduction
This section contains information explaining how the LED displays work. This means you
can make sure that the wireless LAN controller has started up completely.
LED display
Status displays
LED
Meaning
LED
Description
PWR Power supply OFF
GREEN
Standby mode
Supply voltage is applied.
L1 - - -
L2 Battery display flashing RED
RED
Battery low (remaining life less than 1 month).
Battery empty.
L3 RUN/STOP Flashing
YELLOW
flashing GREEN
System is starting up.
System running.
The L2 and L3 LEDs each flash at 1 second intervals.
If the L2 and L3 LEDs flash yellow together at an interval of 2 seconds, an upgrade or the
import of a configuration following an upgrade is being performed.

SCALANCE WLC711
Getting Started, 04/2016, C79000-G8976-C269-07 17
Getting started
3
3.1
Sequence
Below you will find an overview of the best way to configure access points.
Step 1 - Prior to configuration
Decide which WLAN service you want to use. The following are available:
●
Data
This WLAN service is recommended if your WLAN is used mainly for normal data traffic,
for example intranet. This WLAN service can be suitable for PROFINET IO if WLAN
clients move within the range of one access point (no roaming of WLAN clients between
several access points). Possible topologies for the WLAN service are as follows:
–Bridge at AP (requirement for PNIO)
–Bridge at WLC
–Routed
Note
PNIO
For complex plants requiring PROFINET IO communication, stand
-alone access
points with iPCF support are recommended.
●
Voice
This WLAN service is recommended if your WLAN is used mainly for voice and video
communication, for example VoIP.
Possible topologies for this WLAN type are as follows:
–Bridged at WLC
–Routed
●
Captive portal
With this WLAN service, you can set up a WLAN specifically for guests.
Step 2 - Setting up the network
Make sure that the external servers such as DHCP and RADIUS are available and
adequately configured. Make sure that the data port between the Industrial Ethernet switch
(IE Switch) and WLC and the IE switch and APs have the identical subnet configuration.

Getting started
3.1 Sequence
SCALANCE WLC711
18 Getting Started, 04/2016, C79000-G8976-C269-07
Step 3 - Installing hardware
Install the SCALANCE Industrial Wireless LAN controller and the access points. You will find
further information in the compact operating instructions SCALANCE WLC711.

Getting started
3.2 Logon
SCALANCE WLC711
Getting Started, 04/2016, C79000-G8976-C269-07 19
3.2
Logon
Prerequisite
To log on with the WBM, a connection must exist between the management port ("admin"
interface) of the WLC and the configuration PC.
Calling up the logon page
To call up the logon page, open a Web browser and enter the default IP address
https://192.168.10.1:5825 in the address line.
Note
Display of a security message
If a security message is displayed in the Web browser, confirm this to continue the download
of the Web page. The secu
rity message results from the pre-installed, self-signed certificate.
It is possible to install your own certificate. You will find more detailed information in the
SCALANCE WLC711 user guide.
This default IP address can be changed using the WBM. The logon page of the WBM
SCALANCE Industrial Wireless LAN controller and access points opens:
Figure 3-1 Logon page

Getting started
3.2 Logon
SCALANCE WLC711
20 Getting Started, 04/2016, C79000-G8976-C269-07
Initial logon
Default user data is set in the factory. When you log on the first time, follow the steps below:
1. Enter the user name admin in the "User Name" input box.
2. Enter the password abc123 in the "Password" input box.
3. Click the "Login" button. The page for basic configuration with the wizard opens.
When you have completed the basic configuration the start page of the WBM SCALANCE
Industrial Wireless LAN controller and access points is displayed immediately after a new
logon.
Access protection of the system - changing passwords
We recommend that you protect the system from unauthorized access. To do this, change
the factory-set default administrator password. The procedure is described during basic
configuration with the wizard.
Entering the wrong user name or password
If you enter an unconfigured user name or an incorrect password, an error message is
displayed.