Table Of Contents
Cisco IOS Commands for Access Points
and Bridgesaccounting (SSID configuration mode)
authentication (local server configuration mode)
authentication network-eap (SSID configuration mode)
authentication open (SSID configuration mode)
authentication shared (SSID configuration mode)
bridge-group block-unknown-source
bridge-group spanning-disabled
bridge-group subscriber-loop-control
clear dot11 aaa authentication mac-authen filter-cache
dot11 aaa authentication attributes service-type login-only
dot11 aaa authentication mac-authen filter-cache
exception crashinfo buffersize
group (local server configuration mode)
guest-mode (SSID configuration mode)
information-element ssidl (SSID configuration mode)
infrastructure-ssid (SSID configuration mode)
match (class-map configuration)
max-associations (SSID configuration mode)
nas (local server configuration mode)
radius local-server pac-generate
show dot11 aaa authentication mac-authen filter-cache
show dot11 statistics client-traffic
show interfaces dot11radio aaa
show interfaces dot11radio statistics
show radius local-server statistics
snmp-server enable traps envmon temperature
user (local server configuration mode)
vlan (SSID configuration mode)
wlccp wds aaa authentication mac-authen filter-cache
Cisco IOS Commands for Access Points
and Bridges
This chapter lists and describes Cisco IOS commands in Cisco IOS Release 12.3(2)XT that you use to configure and manage your access point, bridge, and wireless LAN. The commands are listed alphabetically. Refer to Appendix A, "List of Supported Cisco IOS Commands," for a complete list of Cisco IOS commands supported by access points and bridges.
accounting (SSID configuration mode)
Use the accounting SSID configuration mode command to enable RADIUS accounting for the radio interface (for the specified SSID). Use the no form of the command to disable accounting.
[no] accounting list-name
Syntax Description
Defaults
This command has no defaults.
Command Modes
SSID configuration interface
Command History
Usage Guidelines
You create accounting lists using the aaa accounting command. These lists indirectly reference the server where the accounting information is stored.
Examples
This example shows how to enable RADIUS accounting and set the RADIUS server name:
AP(config-if-ssid)# accounting radius1This example shows how to disable RADIUS accounting:
AP(config-if-ssid)# no accountingRelated Commands
antenna
Use the antenna configuration interface command to configure the radio receive or transmit antenna settings. Use the no form of this command to reset the receive antenna to defaults.
[no] antenna {receive | transmit {diversity | left | right}}
Syntax Description
Defaults
The default antenna configuration is diversity.
Command Modes
Configuration interface
Command History
Examples
This example shows how to specify the right receive antenna option:
AP(config-if)# antenna receive rightThis example shows how to set the receive antenna option to defaults:
AP(config-if)# no antenna receiveRelated Commands
Configures the radio power level
show running-config
Displays the current access point operating configuration
authentication (local server configuration mode)
Use the authentication local server configuration command to specify the authentication types that are allowed on the local authenticator. By default, a local authenticator access point performs LEAP, EAP-FAST, and MAC-based authentication for up to 50 client devices. You use the no form of the authentication command to limit the local authenticator to one or more authentication types.
[no] authentication [eapfast] [leap] [mac]
Note
This command is not supported on bridges.
Syntax Description
Defaults
By default, a local authenticator access point performs LEAP, EAP-FAST, and MAC-based authentication. To limit the local authenticator to one or two authentication types, use the no form of the command to disable unwanted authentication types.
Command Modes
Local server configuration mode
Command History
Examples
This example shows how to limit the local authenticator to perform only LEAP authentications for client devices:
AP(config-radsrv)# no authentication eapfastAP(config-radsrv)# no authentication macRelated Commands
authentication client
Use the authentication client configuration interface command to configure a LEAP username and password that the access point uses when authenticating to the network as a repeater.
authentication client username username password password
Syntax Description
Defaults
This command has no defaults.
Command Modes
SSID configuration interface
Command History
Examples
This example shows how to configure the LEAP username and password that the repeater uses to authenticate to the network:
AP(config-if-ssid)# authentication client username ap-north password buckeyeRelated Commands
Specifies the SSID and enters the SSID configuration mode
show running-config
Displays the current access point operating configuration
authentication key-management
Use the authentication key-management SSID configuration mode command to configure the radio interface (for the specified SSID) to support authenticated key management. Cisco Centralized Key Management (CCKM) and Wi-Fi Protected Access (WPA) are the key management types supported on the access point.
authentication key-management { [wpa] [cckm] } [ optional ]
Note
Syntax Description
Defaults
This command has no defaults.
Command Modes
SSID configuration interface
Command History
12.2(11)JA
This command was introduced.
12.2(13)JA
This command was modified to allow you to enable both WPA and CCKM for an SSID.
Usage Guidelines
Use this command to enable authenticated key management for client devices.
•
•
•
•
Examples
This example shows how to enable both WPA and CCKM for an SSID:
AP(config-if-ssid)# authentication key-management wpa cckmRelated Commands
Specifies a cipher suite
Specifies the SSID and enters SSID configuration mode
Specifies a pre-shared key for an SSID
authentication network-eap (SSID configuration mode)
Use the authentication network-eap SSID configuration mode command to configure the radio interface (for the specified SSID) to support network-EAP authentication with optional MAC address authentication. Use the no form of the command to disable network-eap authentication for the SSID.
[no] authentication
network-eap list-name
[mac-address list-name]
Note
Syntax Description
list-name
Specifies the list name for EAP authentication
mac-address list-name
Specifies the list name for MAC authentication
Defaults
This command has no defaults.
Command Modes
SSID configuration interface
Command History
Usage Guidelines
Use this command to authenticate clients using the network EAP method, with optional MAC address screening. You define list names for MAC addresses and EAP using the aaa authentication login command. These lists define the authentication methods activated when a user logs in and indirectly identify the location where the authentication information is stored.
Examples
This example shows how to set the authentication to open for devices on a specified address list:
AP(config-if-ssid)# authentication network-eap list1This example shows how to reset the authentication to default values:
AP(config-if-ssid)# no authentication network-eapRelated Commands
authentication open (SSID configuration mode)
Use the authentication open SSID configuration mode command to configure the radio interface (for the specified SSID) to support open authentication and optionally MAC address authentication or EAP authentication. Use the no form of the command to disable open authentication for the SSID.
[no] authentication open
[mac-address list-name [alternate] ]
[eap list-name]
Note
Syntax Description
Defaults
This command has no defaults.
Command Modes
SSID configuration interface
Command History
Usage Guidelines
Use this command to authenticate clients using the open method, with optional MAC address or EAP screenings. If you use the alternate keyword, the client must pass either the MAC address or EAP authentication. Otherwise, the client must pass both authentications. You define list names for MAC addresses and EAP using the aaa authentication login command. These lists define the authentication methods activated when a user logs in and indirectly identify the location where the authentication information is stored.
Examples
This example shows how to enable open authentication with MAC address restrictions:
AP(config-if-ssid)# authentication open mac-address mac-list1This example shows how to disable open authentication for the SSID:
AP(config-if-ssid)# no authentication openRelated Commands
Specifies shared key authentication
Specifies network EAP authentication
Specifies the SSID and enters the SSID configuration mode
authentication shared (SSID configuration mode)
Use the authentication shared SSID configuration mode command to configure the radio interface (for the specified SSID) to support shared authentication with optional MAC address authentication and EAP authentication. Use the no form of the command to disable shared authentication for the SSID.
[no] authentication shared
[mac-address list-name]
[eap list-name]
Note
Syntax Description
mac-address list-name
Specifies the list name for MAC authentication
eap list-name
Specifies the list name for EAP authentication
Defaults
This command has no defaults.
Command Modes
SSID configuration interface
Command History
Usage Guidelines
Use this command to authenticate clients using the shared method, with optional MAC address or EAP screenings. You define list names for MAC addresses and EAP using the aaa authentication login command. These lists define the authentication methods activated when a user logs in and indirectly identify the location where the authentication information is stored.
Examples
This example shows how to set the authentication to shared for devices on a MAC address list:
AP(config-if-ssid)# authentication shared mac-address mac-list1This example shows how to reset the authentication to default values:
AP(config-if-ssid)# no authentication sharedRelated Commands
beacon
Use the beacon configuration interface command to specify how often the beacon contains a Delivery Traffic Indicator Message (DTIM). Use the no form of this command to reset the beacon interval to defaults.
[no] beacon {period Kms | dtim-period count}
Syntax Description
Defaults
The default period is 100.
The default dtim-period is 2.
Command Modes
Configuration interface
Command History
Usage Guidelines
Clients normally wake up each time a beacon is sent to check for pending packets. Longer beacon periods let the client sleep longer and preserve power. Shorter beacon periods reduce the delay in receiving packets.
Controlling the DTIM period has a similar power-saving result. Increasing the DTIM period count lets clients sleep longer, but delays the delivery of multicast packets. Because multicast packets are buffered, large DTIM period counts can cause a buffer overflow.
Examples
This example shows how to specify a beacon period of 15 Kms (15.36 milliseconds):
AP(config-if)# beacon period 15This example shows how to set the beacon parameter to defaults:
AP(config-if)# no beaconRelated Commands
boot buffersize
To modify the buffer size used to load configuration files, use the boot buffersize global configuration command. Use the no form of the command to return to the default setting.
[ no ] boot buffersize bytes
Syntax Description
Defaults
The default buffer size for loading configuration files is 32 KB.
Command Modes
Global configuration
Command History
Usage Guidelines
Increase the boot buffer size if your configuration file size exceeds 512 KB.
Examples
This example shows how to set the buffer size to 512 KB:
AP(config)# boot buffersize 524288boot ios-break
Use the boot ios-break global configuration command to enable an access point or bridge to be reset using a send break Telnet command.
After you enter the boot ios-break command, you can connect to the access point console port and press Ctrl-] to bring up the Telnet prompt. At the Telnet prompt, enter send break. The access point reboots and reloads the image.
[ no ] boot ios-break
Syntax Description
This command has no arguments or keywords.
Defaults
This command is disabled by default.
Command Modes
Global configuration
Command History
Examples
This example shows how to enable an access point or bridge to be reset using a send break Telnet command:
AP(config)# boot ios-breakboot upgrade
Use the boot upgrade global interface command to configure access points and bridges to automatically load a configuration and use DHCP options to upgrade system software.
When your access point renews its IP address with a DHCP request, it uses the details configured on the DHCP server to download a specified configuration file from a TFTP server. If a boot system command is part of the configuration file and the unit's current software version is different, the access point or bridge image is automatically upgraded to the version in the configuration. The access point or bridge reloads and executes the new image.
[ no ] boot upgrade
Syntax Description
This command has no arguments or keywords.
Defaults
This command is enabled by default.
Command Modes
Global configuration
Command History
Examples
This example shows how to prevent an access point or bridge from automatically loading a configuration and upgrading system software:
AP(config)# no boot upgradebridge aging-time
Use the bridge aging-time global configuration command to configure the length of time that a dynamic entry can remain in the bridge table from the time the entry is created or last updated.
bridge group aging-time seconds
Note
Syntax Description
Defaults
The default aging time is 300 seconds.
Command Modes
Global configuration
Command History
Examples
This example shows how to configure the aging time for bridge group 1:
bridge(config)# bridge 1 aging-time 500Related Commands
bridge forward-time
Use the bridge forward-time global configuration command to configure the forward delay interval on the bridge.
bridge group aging-time seconds
Note
Syntax Description
Defaults
The default forward time is 30 seconds.
Command Modes
Global configuration
Command History
Examples
This example shows how to configure the forward time for bridge group 2:
bridge(config)# bridge 2 forward-time 60Related Commands
bridge hello-time
Use the bridge hello-time global configuration command to configure the interval between hello bridge protocol data units (BPDUs).
bridge group hello-time seconds
Note
Syntax Description
Defaults
The default hello time is 2 seconds.
Command Modes
Global configuration
Command History
Examples
This example shows how to configure the hello time for bridge group 1:
bridge(config)# bridge 1 hello-time 15Related Commands
bridge max-age
Use the bridge max-age global configuration command to configure the interval that the bridge waits to hear BPDUs from the spanning tree root. If the bridge does not hear BPDUs from the spanning tree root within this specified interval, it assumes that the network has changed and recomputes the spanning-tree topology.
bridge group max-age seconds
Note
Syntax Description
group
Specifies the bridge group
seconds
Specifies the max-age interval in seconds (enter a value between 10 and 200 seconds)
Defaults
The default max-age is 15 seconds.
Command Modes
Global configuration
Command History
Examples
This example shows how to configure the max age for bridge group 1:
bridge(config)# bridge 1 max-age 20Related Commands
bridge priority
Use the bridge priority global configuration command to configure the spanning tree priority for the bridge. STP uses the bridge priority to select the spanning tree root. The lower the priority, the more likely it is that the bridge will become the spanning tree root.
The radio and Ethernet interfaces and the native VLAN on the bridge are assigned to bridge group 1 by default. When you enable STP and assign a priority on bridge group 1, STP is enabled on the radio and Ethernet interfaces and on the primary VLAN, and those interfaces adopt the priority assigned to bridge group 1. You can create bridge groups for sub-interfaces and assign different STP settings to those bridge groups.
bridge group priority priority
Note
Syntax Description
group
Specifies the bridge group to be configured
priority
Specifies the STP priority for the bridge
Defaults
The default bridge priority is 32768.
Command Modes
Global configuration
Command History
Examples
This example shows how to configure the priority for the bridge:
bridge(config-if)# bridge 1 priority 900Related Commands
bridge protocol ieee
Use the bridge number protocol ieee global configuration command to enable Spanning Tree Protocol (STP) on the bridge. STP is enabled for all interfaces assigned to the bridge group that you specify in the command.
The radio and Ethernet interfaces and the native VLAN on the bridge are assigned to bridge group 1 by default. When you enable STP and assign a priority on bridge group 1, STP is enabled on the radio and Ethernet interfaces and on the primary VLAN, and those interfaces adopt the priority assigned to bridge group 1. You can create bridge groups for sub-interfaces and assign different STP settings to those bridge groups.
bridge number protocol ieee [ suspend ]
Note
Syntax Description
number
Specifies the bridge group for which STP is enabled
suspend
Suspends STP on the bridge until you re-enable it.
Defaults
STP is disabled by default.
Command Modes
Global configuration
Command History
Examples
This example shows how to enable STP for bridge group 1:
bridge(config)# bridge 1 protocol ieeeRelated Commands
bridge-group block-unknown-source
Use the bridge-group block-unknown-source configuration interface command to block traffic from unknown MAC addresses on a specific interface. Use the no form of the command to disable unknown source blocking on a specific interface.
For STP to function properly, block-unknown-source must be disabled for interfaces participating in STP.
bridge-group group block-unknown-source
Syntax Description
Defaults
When you enable STP on an interface, block unknown source is disabled by default.
Command Modes
Configuration interface
Command History
Examples
This example shows how to disable block unknown source for bridge group 2:
bridge(config-if)# no bridge-group 2 block-unknown-sourceRelated Commands
bridge-group path-cost
Use the bridge-group path-cost configuration interface command to configure the path cost for the bridge Ethernet and radio interfaces. Spanning Tree Protocol (STP) uses the path cost to calculate the shortest distance from the bridge to the spanning tree root.
bridge-group group path-cost cost
Note
Syntax Description
Defaults
The default path cost for the Ethernet interface is 19, and the default path cost for the radio interface is 33.
Command Modes
Configuration interface
Command History
Examples
This example shows how to configure the path cost for bridge group 2:
bridge(config-if)# bridge-group 2 path-cost 25Related Commands
bridge-group port-protected
Use the bridge-group port-protected configuration interface command to enable protected port for public secure mode configuration. In Cisco IOS software, there is no exchange of unicast, broadcast, or multicast traffic between protected ports.
bridge-group bridge-group
port-protectedSyntax Description
Defaults
This command has no defaults.
Command Modes
Configuration interface
Command History
Examples
This example shows how to enable protected port for bridge group 71:
AP(config-if)# bridge-group 71 port-protectedRelated Commands
bridge-group priority
Use the bridge-group priority configuration interface command to configure the spanning tree priority for the bridge Ethernet and radio interfaces. Spanning Tree Protocol (STP) uses the interface priority to select the root interface on the bridge.
The radio and Ethernet interfaces and the native VLAN on the bridge are assigned to bridge group 1 by default. When you enable STP and assign a priority on bridge group 1, STP is enabled on the radio and Ethernet interfaces and on the primary VLAN, and those interfaces adopt the priority assigned to bridge group 1. You can create bridge groups for sub-interfaces and assign different STP settings to those bridge groups.
bridge-group group priority priority
Syntax Description
group
Specifies the bridge group to be configured
priority
Specifies the STP priority for the bridge group
Defaults
The default priority for both the Ethernet and radio interfaces is 128.
Command Modes
Configuration interface
Command History
Examples
This example shows how to configure the priority for an interface on bridge group 2:
bridge(config-if)# bridge-group 2 priority 150Related Commands
bridge-group spanning-disabled
Use the bridge-group spanning-disabled configuration interface command to disable Spanning Tree Protocol (STP) on a specific interface. Use the no form of the command to enable STP on a specific interface.
For STP to function properly, spanning-disabled must be disabled for interfaces participating in STP.
bridge-group group spanning-disabled
Syntax Description
Defaults
STP is disabled by default.
Command Modes
Configuration interface
Command History
Examples
This example shows how to disable STP for bridge group 2:
bridge(config-if)# bridge-group 2 spanning-disabledRelated Commands
bridge-group subscriber-loop-control
Use the bridge-group subscriber-loop-control configuration interface command to enable loop control on virtual circuits associated with a bridge group. Use the no form of the command to disable loop control on virtual circuits associated with a bridge group.
For Spanning Tree Protocol (STP) to function properly, subscriber-loop-control must be disabled for interfaces participating in STP.
bridge-group group subscriber-loop-control
Syntax Description
Defaults
When you enable STP for an interface, subscriber loop control is disabled by default.
Command Modes
Configuration interface
Command History
Examples
This example shows how to disable subscriber loop control for bridge group 2:
bridge(config-if)# no bridge-group 2 subscriber-loop-controlRelated Commands
bridge-group unicast-flooding
Use the bridge-group unicast-flooding configuration interface command to enable unicast flooding for a specific interface. Use the no form of the command to disable unicast flooding for a specific interface.
bridge-group group unicast-flooding
Syntax Description
Defaults
Unicast flooding is disabled by default.
Command Modes
Configuration interface
Command History
Examples
This example shows how to configure unicast flooding for bridge group 2:
bridge(config-if)# bridge-group 2 unicast-floodingRelated Commands
broadcast-key
Use the broadcast-key configuration interface command to configure the time interval between rotations of the broadcast encryption key used for clients. Use the no form of the command to disable broadcast key rotation.
[no] broadcast-key
[vlan vlan-id]
[change secs]
[ membership-termination ]
[ capability-change ]
Note
Note
Syntax Description
Defaults
This command has no defaults.
Command Modes
Configuration interface
Command History
Examples
This example shows how to configure vlan10 to support broadcast key encryption with a 5-minute key rotation interval:
AP(config-if)# broadcast-key vlan 10 change 300This example shows how to disable broadcast key rotation:
AP(config-if)# no broadcast-keycca
Use the cca configuration interface command to configure the clear channel assessment (CCA) noise floor level for the bridge radio. The value you enter is used as an absolute value of dBm.
cca number
Note
Syntax Description
number
Specifies the radio noise floor in dBm. Enter a number from -60 to 0. Zero configures the radio to use a received validate frame as the CCA indication.
Defaults
The default CCA level is -62 dBm.
Command Modes
Configuration interface
Command History
Examples
This example shows how to configure the CCA level for the bridge radio:
bridge(config-if)# cca 50channel
Use the channel configuration interface command to set the radio channel frequency. Use the no form of this command to reset the channel frequency to defaults.
[no] channel {number | frequency | least-congested}
Syntax Description
number
Specifies a channel number. For a list of channels for the 2.4-GHz radio, see Table 2-1. For a list of channels for the 5-GHz radio, see Table 2-2.
Note
frequency
Specifies the center frequency for the radio channel. For a list of center frequencies for the 2.4-GHz access point radio, see Table 2-1. For a list of center frequencies for the 5-GHz access point radio, see Table 2-2. For a list of center frequencies for the 5-GHz bridge radio, see Table 2-3.
Note
least-congested
Enables or disables the scanning for a least busy radio channel to communicate with the client adapter
Note
Note
Defaults
The default channel is least-congested.
Command Modes
Configuration interface
Command History
Examples
This example shows how to set the access point radio to channel 10 with a center frequency of 2457.
AP(config-if)# channel 2457This example shows how to set the access point to scan for the least-congested radio channel.
AP(config-if)# channel least-congestedThis example shows how to set the frequency to the default setting:
AP(config-if)# no channelRelated Commands
show controllers dot11radio
Displays the radio controller information and status
class-map
Use the class-map global configuration command to create a class map to be used for matching packets to the class whose name you specify and to enter class-map configuration mode. Use the no form of this command to delete an existing class map and return to global configuration mode.
[no] class-map name
Syntax Description
Defaults
This command has no defaults, and there is not a default class map.
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to specify the name of the class for which you want to create or modify class-map match criteria and to enter class-map configuration mode. In this mode, you can enter one match command to configure the match criterion for this class.
The class-map command and its subcommands are used to define packet classification, marking, and aggregate policing as part of a globally named service policy applied on a per-interface basis.
After you are in quality of service (QoS) class-map configuration mode, these configuration commands are available:
•
•
•
•
•
Only one match criterion per class map is supported. For example, when defining a class map, only one match command can be issued.
Because only one match command per class map is supported, the match-all and match-any keywords function the same.
Only one access control list (ACL) can be configured in a class map. The ACL can have multiple access control entries (ACEs).
Examples
This example shows how to configure the class map called class1. class1 has one match criterion, which is an access list called 103.
AP(config)# access-list 103 permit any any dscp 10AP(config)# class-map class1AP(config-cmap)# match access-group 103AP(config-cmap)# exitThis example shows how to delete the class map class1:
AP(config)# no class-map class1You can verify your settings by entering the show class-map privileged EXEC command.
Related Commands
clear dot11 aaa authentication mac-authen filter-cache
Use the clear dot11 aaa authentication mac-authen filter-cache privileged EXEC command to clear entries from the MAC authentication cache.
clear dot11 aaa authentication mac-authen filter-cache [address]
Syntax Description
Defaults
This command has no defaults.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to clear a specific MAC address from the MAC authentication cache:
ap# clear dot11 aaa authentication mac-authen filter-cache 7643.798a.87b2Related Commands
Enable MAC authentication caching on the access point.
Display MAC addresses in the MAC authentication cache.
clear dot11 cckm-statistics
Use the clear dot11 cckm-statistics privileged EXEC command to reset CCKM statistics.
clear dot11 cckm-statistics
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default setting.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to clear CCKM statistics:
AP# clear dot11 cckm-statisticsRelated Commands
clear dot11 client
Use the clear dot11 client privileged EXEC command to deauthenticate a radio client with a specified MAC address. The client must be directly associated with the access point, not a repeater.
clear dot11 client {mac-address}
Syntax Description
Defaults
This command has no defaults.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to deauthenticate a specific radio client:
AP# clear dot11 client 0040.9645.2196You can verify that the client was deauthenticated by entering the following privileged EXEC command:
AP# show dot11 associations 0040.9645.2196Related Commands
Displays the radio association table or optionally displays association statistics or association information about repeaters or clients
clear dot11 hold-list
Use the clear dot11 hold-list privileged EXEC command to reset the MAC, LEAP, and EAP authentications hold list.
clear dot11 hold-list
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default setting.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to clear the hold-off list of MAC authentications:
AP# clear dot11 hold-listclear dot11 statistics
Use the clear dot11 statistics privileged EXEC command to reset statistic information for a specific radio interface or for a particular client with a specified MAC address.
clear dot11 statistics
{interface | mac-address}Syntax Description
interface
Specifies a radio interface number
mac-address
Specifies a client MAC address (in xxxx.xxxx.xxxx format)
Defaults
This command has no default setting.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to clear radio statistics for radio interface 0:
AP# clear dot11 statistics dot11radio 0This example shows how to clear radio statistics for the client radio with a MAC address of 0040.9631.81cf:
AP# clear dot11 statistics 0040.9631.81cfYou can verify that the radio interface statistics are reset by entering the following privileged EXEC command:
AP# show dot11 associations statisticsRelated Commands
Displays client traffic statistics
Displays radio interface information
Displays radio interface statistics
clear iapp rogue-ap-list
Use the clear iapp rogue-ap-list privileged EXEC command to clear the list of IAPP rogue access points.
clear iapp rogue-ap-list
Note
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default setting.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to clear the IAPP rogue access point list:
AP# clear iapp rogue-ap-listYou can verify that the rogue AP list was deleted by entering the show iapp rogue-ap-list privileged EXEC command.
Related Commands
clear iapp statistics
Use the clear iapp statistics privileged EXEC command to clear all the IAPP statistics.
clear iapp statistics
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default setting.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to clear the IAPP statistics:
AP# clear iapp statisticsYou can verify that the IAPP statistics were cleared by entering the following privileged EXEC command:
AP# show iapp statisticsRelated Commands
clear wlccp wds
Use the clear wlccp wds privileged EXEC command to clear WDS statistics and to remove devices from the WDS database.
clear wlccp wds {[ap [mac-address]] | [mn [mac-address]] | statistics |
aaa authentication mac-authen filter-cache [mac-address]}Syntax Description
Defaults
This command has no default setting.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to remove an access point from the WDS database:
AP# clear wlccp wds ap 1572.342d.97f4Related Commands
Displays information on devices participating in Cisco Centralized Key Management (CCKM)
Enables MAC authentication caching on the access point
concatenation
Use the concatenation configuration interface command to enable packet concatenation on the bridge radio. Using concatenation, the bridge combines multiple packets into one packet to reduce packet overhead and overall latency, and to increase transmission efficiency.
concatenation [ bytes ]
Note
Syntax Description
bytes
(Optional) Specifies a maximum size for concatenated packets in bytes. Enter a value from 1600 to 4000.
Defaults
Concatenation is enabled by default, and the default maximum concatenated packet size is 3500.
Command Modes
Configuration interface
Command History
Examples
This example shows how to configure concatenation on the bridge radio:
bridge(config-if)# concatenation 4000countermeasure tkip hold-time
Use the countermeasure tkip hold-time configuration interface command to configure a TKIP MIC failure holdtime. If the access point detects two MIC failures within 60 seconds, it blocks all the TKIP clients on that interface for the holdtime period.
countermeasure tkip hold-time seconds
Syntax Description
seconds
Specifies the length of the TKIP holdtime in seconds (if the holdtime is 0, TKIP MIC failure hold is disabled)
Defaults
TKIP holdtime is enabled by default, and the default holdtime is 60 seconds.
Command Modes
Configuration interface
Command History
Examples
This example shows how to configure the TKIP holdtime on the access point radio:
ap(config-if)# countermeasure tkip hold-time 120debug dot11
Use the debug dot11 privileged EXEC command to begin debugging of radio functions. Use the no form of this command to stop the debug operation.
[no] debug dot11
{events | packets | forwarding | mgmt | network-map | syslog | virtual-interface}Syntax Description
Defaults
Debugging is not enabled.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to begin debugging of all radio-related events:
AP# debug dot11 eventsThis example shows how to begin debugging of radio packets:
AP# debug dot11 packetsThis example shows how to begin debugging of the radio system log:
AP# debug dot11 syslogThis example shows how to stop debugging of all radio related events:
AP# no debug dot11 eventsRelated Commands
show debugging
Displays all debug settings and the debug packet headers
Displays configuration and status information for the radio interface
debug dot11 aaa
Use the debug dot11 aaa privileged EXEC command to activate debugging of dot11 authentication, authorization, and accounting (AAA) operations. Use the no form of this command to stop the debug operation.
[no] debug dot11 aaa
{accounting | authenticator | dispatcher | manager }Syntax Description
Defaults
Debugging is not enabled.
Command Modes
Privileged EXEC
Command History
12.2(4)JA
This command was introduced.
12.2(15)JA
This command was modified to include the accounting, authenticator, dispatcher, and manager debugging options.
Examples
This example shows how to begin debugging of dot11 AAA accounting packets:
AP# debug dot11 aaa accountingRelated Commands
show debugging
Displays all debug settings
Optionally displays all radio clients
debug dot11 dot11radio
Use the debug dot11 dot11radio privileged EXEC command to turn on radio debug options. These options include run RF monitor mode and trace frames received or transmitted on the radio interface. Use the no form of this command to stop the debug operation.
[no] debug dot11 dot11radio interface-number {accept-radio-firmware |
monitor {ack | address | beacon | crc | lines | plcp | print | probe | store} |
print { hex | if | iv | lines | mic | plcp | printf | raw | shortadr } |
radio_debug flag-value | stop-on-failure |
trace {off | print | store}}Syntax Description
Defaults
Debugging is not enabled.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to enable packet printing with MAC addresses in short form:
AP# debug dot11 dot11radio 0 print shortadrThis example shows how to begin monitoring of all packets with CRC errors:
AP# debug dot11 dot11radio 0 monitor crcThis example shows how to stop monitoring of packets with CRC errors:
AP# no debug dot11 dot11radio 0 monitor crcRelated Commands
show debugging
Displays all debug settings and the debug packet headers
Displays configuration and status information for the radio interface
Displays radio interface statistics
debug iapp
Use the debug iapp privileged EXEC command to begin debugging of IAPP operations. Use the no form of this command to stop the debug operation.
[no] debug iapp
{packets | event | error}Syntax Description
packets
Displays IAPP packets sent and received by the access point. Link test packets are not displayed
event
Displays significant IAPP events
error
Displays IAPP software and protocol errors
Defaults
This command has no default setting.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to begin debugging of IAPP packets:
AP# debug iapp packetThis example shows how to begin debugging of IAPP events:
AP# debug iapp eventsThis example shows how to begin debugging of IAPP errors:
AP# debug iapp errorsRelated Commands
debug radius local-server
Use the debug radius local-server privileged EXEC mode command to control the display of debug messages for the local authenticator.
debug radius local-server {client | eapfast | error | packets }
Syntax Description
Defaults
Debugging is not enabled.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to begin debugging for local authenticator errors:
AP# debug radius local-server errorRelated Commands
Enables the access point as a local authenticator
show debugging
Displays all debug settings and the debug packet headers
debug wlccp ap
Use the debug wlccp ap privileged EXEC command to enable debugging for devices that interact with the access point that provides wireless domain services (WDS).
debug wlccp ap {mn | wds-discovery | state | rm [statistics | context | packet]}
Note
Syntax Description
Defaults
Debugging is not enabled.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to begin debugging for LEAP-enabled client devices participating in Cisco Centralized Key Management (CCKM):
AP# debug wlccp ap mnRelated Commands
show debugging
Displays all debug settings and the debug packet headers
Displays WLCCP information
debug wlccp packet
Use the debug wlccp packet privileged EXEC command to activate display of packets to and from the access point that provides wireless domain services (WDS).
debug wlccp packet
Note
Syntax Description
This command has no arguments or keywords.
Defaults
Debugging is not enabled.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to activate display of packets to and from the WDS access point:
AP# debug wlccp packetRelated Commands
show debugging
Displays all debug settings and the debug packet headers
Displays WLCCP information
debug wlccp rmlib
Use the debug wlccp rmlib privileged EXEC command to activate display of radio management library functions on the access point that provides wireless domain services (WDS).
debug wlccp rmlib
Note
Syntax Description
This command has no arguments or keywords.
Defaults
Debugging is not enabled.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to activate display of radio management library functions on the access point that provides WDS:
AP# debug wlccp rmlibRelated Commands
show debugging
Displays all debug settings and the debug packet headers
Displays WLCCP information
debug wlccp wds
Use the debug wlccp wds privileged EXEC command to activate display of wireless domain services (WDS) debug messages.
debug wlccp wds
aggregator [packet]
authenticator {all | dispatcher | mac-authen | process | rxdata | state-machine | txdata}
nm [packet | loopback]
state
statistics
Note
Syntax Description
Defaults
Debugging is not enabled.
Command Modes
Privileged EXEC
Command History
12.2(11)JA
This command was first introduced.
12.2(13)JA
This command was modified to include the aggregator and nm options.
Examples
This example shows how to begin debugging for LEAP-enabled client devices participating in Cisco Centralized Key Management (CCKM):
AP# debug wlccp ap mnRelated Commands
show debugging
Displays all debug settings and the debug packet headers
Displays WLCCP information
distance
Use the distance configuration interface command to specify the distance from a root bridge to the non-root bridge or bridges with which it communicates. The distance setting adjusts the bridge's timeout values to account for the time required for radio signals to travel from bridge to bridge. If more than one non-root bridge communicates with the root bridge, enter the distance from the root bridge to the non-root bridge that is farthest away. You do not need to adjust this setting on non-root bridges.
distance kilometers
Note
Syntax Description
Defaults
In installation mode, the default distance setting is 99 km. In all other modes, such as root and non-root, the default distance setting is 0 km.
Command Modes
Configuration interface
Command History
Examples
This example shows how to configure the distance setting for the root bridge radio:
bridge(config-if)# distance 40dot11 association mac-list
To specify a MAC address access list used for dot11 association use the dot11 association mac-list command.
dot11 association mac-list number
Syntax Description
Defaults
No MAC address access list is assigned.
Examples
This example shows the creation of a MAC address access list used to filter one client with a MAC address of 0000.1234.5678.AP(config)# access-list 700 deny 0000.1234.5678 0000.0000.0000 AP(config)# dot11 association mac-list 700Related Commands
dot11 aaa authentication attributes service-type login-only
Use the dot11 aaa authentication attributes service-type login-only global configuration command to set the service-type attribute in reauthentication requests to login-only. By default, the access point sends reauthentication requests to the server with the service-type attribute set to authenticate-only. However, some Microsoft IAS servers do not support the authenticate-only service-type attribute. Changing the service-type attribute to login-only ensures that Microsoft IAS servers recognize reauthentication requests from the access point.
dot11 aaa authentication attributes service-type login-only
Syntax Description
This command has no arguments or keywords.
Defaults
The default service-type attribute in reauthentication requests is set to authenticate-only. This command sets the service-type attribute in reauthentication requests to login-only.
Command Modes
Global configuration
Command History
Related Commands
Selects the format for MAC addresses in Called-Station-ID (CSID) and Calling-Station-ID attributes
dot11 aaa authentication mac-authen filter-cache
Use the dot11 aaa authentication mac-authen filter-cache global configuration command to enable MAC authentication caching on the access point. MAC authentication caching reduces overhead because the access point authenticates devices in its MAC-address cache without sending the request to your authentication server. When a client device completes MAC authentication to your authentication server, the access point adds the client's MAC address to the cache.
dot11 aaa authentication mac-authen filter-cache [timeout seconds]
Syntax Description
Defaults
MAC authentication caching is disabled by default. When you enable it, the default timeout value is 1800 (30 minutes).
Command Modes
Global configuration
Command History
Examples
This example shows how to configure MAC authentication caching with a one-hour timeout:
ap(config)# dot11 aaa authentication mac-authen filter-cache timeout 3600Related Commands
Clear MAC addresses from the MAC authentication cache.
Display MAC addresses in the MAC authentication cache.
dot11 aaa csid
Use the dot11 aaa csid global configuration command to select the format for MAC addresses in Called-Station-ID (CSID) and Calling-Station-ID attributes in RADIUS packets.
dot11 aaa csid { default | ietf | unformatted }
Syntax Description
Defaults
The default CSID format looks like this example:
0007.85b3.5f4aCommand Modes
Global configuration
Command History
Usage Guidelines
You can also use the wlccp wds aaa csid command to select the CSID format.
Related Commands
Begin debugging of dot11 authentication, authorization, and accounting (AAA) operations
dot11 activity-timeout
Use the dot11 activity-timeout global configuration command to configure the number of seconds that the access point tracks an inactive device (the number depends on its device class). The access point applies the unknown device class to all non-Cisco Aironet devices.
dot11 activity-timeout { [ client-station | repeater | bridge | workgroup-bridge | unknown ] [ default <1 - 100000> ] [ maximum <1 - 100000> ] }
Syntax Description
Defaults
Table 2-4 lists the default activity timeouts for each device class. All values are in seconds.
Table 2-4 Default Activity Timeouts
unknown
60
client-station
1800
repeater
28800
bridge
28800
workgroup-bridge
28800
Command Modes
Global configuration
Command History
Examples
This example shows how to configure default and maximum activity timeouts for all device classes:
AP(config)# dot11 activity-timeout default 5000 maximum 24000Usage Guidelines
To set an activity timeout for all device types, set a default or maximum timeout without specifying a device class (for example, enter dot11 activity-timeout default 5000). The access point applies the timeout to all device types that are not already configured with a timeout.
Related Commands
dot11 adjacent-ap age-timeout
Use the dot11 adjacent-ap age-timeout global configuration command to specify the number of hours an inactive entry remains in the list of adjacent access points.
dot11 adjacent-ap age-timeout hours
Note
Syntax Description
Defaults
The default age-timeout is 24 hours.
Command Modes
Global configuration
Command History
Examples
This example shows how to configure the timeout setting for inactive entries in the adjacent access point list:
AP# dot11 adjacent-ap age-timeout 12Related Commands
dot11 antenna-alignment
Use the dot11 antenna-alignment privileged EXEC command to activate the antenna-alignment tool for an radio interface. Use this tool to test and align the access point antenna with another remote antenna.
dot11 interface-number antenna-alignment [timeout]
Syntax Description
interface-number
Specifies the radio interface number (The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.)
timeout
Specifies the duration of the alignment test, in seconds
Defaults
The default alignment timeout is 5 seconds.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
During the antenna alignment test, the radio disassociates from its parent, probes adjacent access points, and records the MAC address and signal strength of responses it receives. After the timeout, the radio reassociates with its parent. Clients connected to the access point through its parent lose their connection for the duration of the test; clients connected to a repeater maintain their connection and can abort the test using the escape sequence (Ctrl key and ^ key).
You display the last 10 results using the show dot11 antenna-alignment command, which lists the MAC address and signal level for the access points that responded to the probe.
Examples
This example shows how to start the antenna-alignment test for radio interface 0:
AP# dot11 dot11radio 0 antenna-alignmentRelated Commands
dot11 arp-cache
Use the dot11 arp-cache global configuration command to enable client ARP caching on the access point. ARP caching on the access point reduces the traffic on your wireless LAN and increases client battery life by stopping ARP requests for client devices at the access point. Instead of forwarding ARP requests to client devices, the access point responds to requests on behalf of associated client devices and drops ARP requests that are not directed to clients associated to the access point. When ARP caching is optional, the access point responds on behalf of clients with IP addresses known to the access point but forwards through its radio port any ARP requests addressed to unknown clients. When the access point knows all the IP addresses for associated clients, it drops any ARP requests not directed to its clients. In its beacon, the access point includes an information element to alert client devices that they can safely ignore broadcast messages to increase battery life.
[no] dot11 arp-cache [optional]
Syntax Description
Defaults
ARP caching is disabled by default.
Command Modes
Global configuration
Command History
Examples
This example shows how to enable ARP caching:
AP(config)# dot11 arp-cachedot11 carrier busy
Use the dot11 carrier busy privileged exec command to display levels of radio activity on each channel.
dot11 interface-number carrier busy
Syntax Description
interface-number
Specifies the radio interface number (The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.)
Defaults
This command has no defaults.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
During the carrier busy test, the access point or bridge drops all associations with wireless networking devices for about 4 seconds while it conducts the carrier test and then displays the test results.
You can re-display the carrier busy results using the show dot11 carrier busy command.
Examples
This example shows how to run the carrier busy test for radio interface 0:
AP# dot11 d0 carrier busyThis example shows the carrier busy test results:
Frequency Carrier Busy %--------- --------------5180 05200 25220 275240 55260 15280 05300 35320 2Related Commands
dot11 extension aironet
Use the dot11 extension aironet configuration interface command to enable or disable Cisco Aironet extensions to the IEEE 802.11b standard. Use the no form of this command to disable the Cisco Aironet extensions.
[no] dot11 extension aironet
Note
Syntax Description
This command has no arguments or keywords.
Defaults
Cisco Aironet extensions are enabled by default.
Command Modes
Configuration interface
Command History
Usage Guidelines
The Cisco Aironet extensions help clients choose the best access point. You must enable these extensions to use advanced features such as Cisco MIC and key hashing. Disable these extensions for non-Cisco clients that misinterpret the extensions.
Examples
This example shows how to enable Cisco Aironet extensions for the radio interface:
AP(config-if)# dot11 extension aironetThis example shows how to disable Cisco Aironet extensions for the radio interface:
AP(config-if)# no dot11 extension aironetRelated Commands
dot11 holdoff-time
Use the dot11 holdoff-time global configuration command to specify the hold-off time for EAP and MAC address authentication. The holdoff time is invoked when a client fails three login attempts or fails to respond to three authentication requests from the access point. Use the no form of the command to reset the parameter to defaults.
[no] dot11 holdoff-time seconds
Syntax Description
Defaults
The default holdoff time is 0 (disabled).
Command Modes
Global configuration
Command History
Examples
This example shows how to specify a 2-minute hold-off time:
AP(config)# dot11 holdoff-time 120This example shows how reset the hold-off time to defaults:
AP(config)# dot11 no holdoff-timeRelated Commands
dot11 igmp snooping-helper
Use the dot11 igmp snooping-helper global configuration command to begin sending IGMP Query requests when a new client associates with the access point. Use the no form of this command to disable the IGMP Query requests.
[no] dot11 igmp snooping-helper
Syntax Description
This command has no arguments or keywords.
Defaults
IGMP Query requests are disabled.
Command Modes
Global configuration
Command History
Examples
This example shows how to enable IGMP Query requests:
AP(config)# dot11 igmp snooping-helperThis example shows how to stop or disable the IGMP Query requests:
AP(config)# no dot11 igmp snooping-helper
dot11 linktest
Use the dot11 linktest privileged EXEC command to test a radio link between the access point and a client device.
dot11 interface-number linktest
[target mac-address]
[count packet-number]
[interval sec]
[packet-size size]
[rate value]Syntax Description
Defaults
The default target for a root access point is the first client. The default target for a repeater is its parent access point.
The default count specifies that test runs once.
The default interval is 5 seconds.
The default packet-size is 512 bytes.
The default rate is the automatic rate-shifting algorithm.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The link test verifies the radio link between the access point and a client device by sending the client a series of special packets, which the client returns to the access point.
Note
The client adds information to the packets that quantify how well it received the request. Results are displayed as a table of packet statistics, quality, and signal-level information.
If you specify an interval, the test repeats continuously separated by the specified number of seconds. To abort the test, type the escape sequence (Ctrl key and ^ key). Without an interval, the test runs once.
Examples
This example shows how to initiate a radio link test to send 10 packets to client MAC address 0040963181CF on radio interface 0:
AP# dot11 dot11radio 0 linktest target 0040.9631.81CF count 10This example shows how to initiate a radio link test to send 100 packets of 500 bytes to client MAC address 0040963181CF on radio interface 0:
AP# dot11 dot11radio 0 linktest target 0040.9631.81CF packet-size 500 count 100Related Commands
Displays the radio statistics
Displays the radio association table
Displays the radio network map
dot11 location isocc
Use the dot11 location isocc privileged EXEC command to configure location identifiers that the access point sends with all RADIUS authentication and accounting requests.
dot11 location isocc ISO-country-code cc country-code ac area-code
Syntax Description
Defaults
This command has no defaults.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
You can find a list of ISO and ITU country and area codes at the ISO and ITU websites. Cisco IOS software does not check the validity of the country and area codes that you enter with this command.
Examples
This example shows how to configure the ISO and ITU location codes on the access point:
ap# dot11 location isocc us cc 1 ac 408This example shows how the access point adds the SSID used by the client device and how it formats the location-ID string:
isocc=us,cc=1,ac=408,network=ACMEWISP_NewarkAirportRelated Commands
dot11 meter
Use the dot11 meter privileged EXEC command to measure the performance of packet forwarding. To display the results, use the show dot11 statistics metered-traffic command.
dot11 interface-number meter
Syntax Description
interface-number
Specifies the radio interface number. The 2.4-GHz radio is radio 0. The 5-GHz radio is radio 1.
Defaults
This command has no defaults.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to activate the meter tool for radio interface 0:
AP# dot11 dot11radio 0 meterRelated Commands
dot11 network-map
Use the dot11 network-map global configuration command to enable the radio network map feature. When enabled, the access point broadcasts a IAPP GenInfo Request every collection interval. This request solicits information from all Cisco access points in the same Layer 2 domain. Upon receiving a GetInfo Request, the access point sends a unicast IAPP GenInfo Response back to the requester. The access point uses these IAPP GenInfo Responses to build a network-map.
dot11 network-map [collect-interval]
Syntax Description
Defaults
The default collect interval is 5 seconds.
Command Modes
Global configuration
Command History
Examples
This example shows how to generate a radio network map with a collection interval of 30 seconds:
AP(config)# dot11 network-map 30You can verify the network map by using the show dot11 network-map EXEC command.
Related Commands
dot11 phone
Use the dot11 phone global configuration command to enable or disable IEEE 802.11 compliance phone support. Use the no form of this command to disable the IEEE 802.11 phone.
[no] dot11 phone
Note
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no defaults.
Command Modes
Global configuration
Command History
Usage Guidelines
Enabling IEEE 802.11 compliance phone support adds information to the access point beacons and probe responses. This information helps some 802.11 phones make intelligent choices about the access point to which they should associate. Some phones do not associate with an access point without this additional information.
Examples
This example shows how to enable IEEE 802.11 phone support:
AP(config)# dot11 phoneThis example shows how to stop or disable the IEEE 802.11 phone support:
AP(config)# no dot11 phone
dot11 priority_map avvid
Use the dot11 priority_map avvid global configuration command to enable or disable Cisco AVVID (Architecture for Voice, Video and Integrated Data) priority mapping. AVVID priority mapping maps Ethernet packets tagged as class of service 5 to class of service 6. This feature enables the access point to apply the correct priority to voice packets for compatibility with Cisco AVVID networks. Use the no form of this command to disable AVVID priority mapping.
[no] dot11 priority_map avvid
Note
Syntax Description
This command has no arguments or keywords.
Defaults
AVVID priority mapping is enabled by default.
Command Modes
Global configuration
Command History
Examples
This example shows how to stop or disable AVVID priority mapping:
AP(config)# no dot11 priority_map avvid
This example shows how to enable AVVID priority mapping:
AP(config)# dot11 priority_map avvidRelated Commands
Creates a class map to be used for matching packets to the class whose name you specify
show class-map
Displays quality of service (QoS) class maps
dot11 ssid
Use the dot11 ssid global configuration command to create a global SSID. The SSID is inactive until you use the ssid configuration interface command to assign the SSID to a specific radio interface.
dot11 ssid ssid
In Cisco IOS Release 12.3(2)JA, you can configure SSIDs globally or for a specific radio interface. When you use the dot11 ssid global configuration command to create an SSID, you can use the ssid configuration interface command to assign the SSID to a specific interface.
When an SSID has been created in global configuration mode, the ssid configuration interface command attaches the SSID to the interface but does not enter ssid configuration mode. However, if the SSID has not been created in global configuration mode, the ssid command puts the CLI into SSID configuration mode for the new SSID.
Note
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no defaults.
Command Modes
Global configuration
Command History
Examples
This example shows how to:
•
•
•
•
•
AP# configure terminalAP(config)# dot11 ssid batmanAP(config-ssid)# accounting accounting-method-listAP(config-ssid)# max-associations 15AP(config-ssid)# vlan 3762AP(config-ssid)# exitAP(config)# interface dot11radio 0AP(config-if)# ssid batmanRelated Commands
dot11 update-group-key
Use the dot11 update-group-key privileged EXEC command to trigger an update of the WPA group key. When you enter the command, the access point distributes a new WPA group key to authenticated client devices.
dot11 interface-number update-group-key [vlan vlan-id]
Syntax Description
interface-number
Specifies the radio interface number (the 2.4-GHz radio is radio 0; the 5-GHz radio is radio 1)
vlan-id
Specifies the VLAN on which the access point sends out the group key update
Defaults
This command has no defaults.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to trigger a group key update on VLAN 2:
AP# dot11 dot11radio 0 group-key-update vlan 2Related Commands
Configures the radio interface (for a specified SSID) to support authenticated key management
dot11 vlan-name
Use the dot11 vlan-name global configuration command to assign a name to a VLAN in addition to its numerical ID.
dot11 vlan-name name vlan vlan-id
Syntax Description
name
Specifies a name to assign to a VLAN ID. The name can contain up to 32 ASCII characters.
vlan-id
Specifies the VLAN ID to which the name is assigned.
Defaults
This command has no default setting.
Command Modes
Global configuration
Command History
Usage Guidelines
Keep these guidelines in mind when using VLAN names:
•
Note
•
•
Examples
This example shows how to assign a name to a VLAN:
AP(config)# dot11 vlan-name chicago vlan 121You can view VLAN name and ID pairs by using the show dot11 vlan-name EXEC command.
Related Commands
dot1x reauth-period
Use the dot1x reauth-period configuration interface command to configure the dot1x client- reauthentication period. The no form of the command disables reauthentication.
[no] dot1x reauth-period {1-65555 | server}
Syntax Description
Defaults
The default is disabled.
Command Modes
Configuration interface
Command History
Examples
This example shows how to configure a 2-minute dot1x client-reauthentication period:
AP(config-if)# dot1x reauth-period 120Related Commands
eapfast authority
Use the eapfast authority command to configure an EAP-FAST authority ID (AID) for a local authenticator access point. The EAP-FAST AID identifies the server that authenticates the EAP-FAST client. The local authenticator sends its AID to an authenticating client, and the client checks its database for a matching AID. If the client does not recognize the AID, it requests a new Protected Access Credential (PAC).
[no] eapfast authority {id identifier | info string}
Syntax Description
Defaults
The default AID is LOCAL RADIUS SER.
Command Modes
Configuration mode for local authenticators
Command History
Examples
This example shows how to configure an AID for the local authenticator access point:
AP(config-radsrv)#eapfast authority id ap1200This example shows how to configure an information string for the AID:
AP(config-radsrv)#eapfast authority id AP1200 A+G NorthRelated Commands
eapfast pac expiry
Use the eapfast pac expiry global configuration command to set the Protected Access Credential (PAC) expiration time and grace period for a group of EAP-FAST clients associated to a local authenticator access point.
[no] eapfast pac expiry days [grace days]
Syntax Description
Defaults
The default is infinite days for both the expiration time and the grace period.
Command Modes
Client group configuration mode for local authenticators
Command History
Examples
In this example, PACs for the user group clerks expire in 10 days with a grace period of two days:
AP(config)#radius-server localAP(config-radsrv)#group clerksAP(config-radsrv-group)#eapfast pac expiry 10 grace 2Related Commands
eapfast server-key
Use the eapfast server-key command to configure EAP-FAST server keys. The local authenticator uses server keys to encrypt Protected Access Credential (PAC) files that it generates and to decrypt PACs when it is authenticating clients. The server maintains two keys, a primary key and a secondary key, and uses the primary key to encrypt PACs. Periodically, the local authenticator switches keys, making the primary key the secondary and using the secondary key as the primary. If you do not configure server keys, the local authenticator generates keys automatically.
When the local authenticator receives a client PAC, it attempts to decrypt the PAC with the primary key. If decryption fails with the primary key, the authenticator attempts to decrypt the PAC with the secondary key. If decryption fails with the secondary key, the authenticator rejects the PAC as invalid.
[no] eapfast server-key {primary {auto-generate | [0 | 7] key} |
secondary [0 | 7] key}Syntax Description
Defaults
By default, the local authenticator generates server keys automatically.
Command Modes
Configuration mode for local authenticators
Command History
Examples
This example shows how to configure a primary server key for the local authenticator access point:
AP(config-radsrv)#eapfast server-key primary 0 2468This example shows how to configure a secondary server key:
AP(config-radsrv)#eapfast server-key secondary 0 9753Related Commands
encryption key
Use the encryption key configuration interface command to define a WEP key used for data encryption on the wireless LAN or on a specific virtual LAN (VLAN). Use the no form of the command to remove a specific encryption key.
Note
[no] encryption
[vlan vlan-id ]
key 1-4
size {40bit | 128Bit}
encryption-key
[transmit-key]Syntax Description
vlan vlan-id
Specifies the VLAN number (1 to 4095)
key 1-4
Specifies the number of the key (1 to 4) that is being configured. (A total of four encryption keys can be configured for each VLAN.)
Note
size 40bit
Specifies a 40-bit encryption key
size 128bit
Specifies a 128-bit encryption key
encryption-key
Specifies the value of the encryption key:
•
•
transmit-key
Specifies the key for encrypting transmit data from the access point. Key slot 1 is the default key slot.
Defaults
This command has no defaults.
Command Modes
Configuration interface
Command History
Usage Guidelines
Using security features such as authenticated key management can limit WEP key configurations. Table 2-5 lists WEP key restrictions based on your security configuration.
Examples
This example shows how to configure a 40-bit encryption key with a value of 11aa33bb55 as
WEP key 1 used on VLAN number 1:AP(config-if)# encryption vlan 1 key 1 size 40bit 11aa33bb55 transmit-keyThis example shows how to remove WEP key 1 on VLAN 1:
AP(config-if)# no encryption vlan 1 key 1Related Commands
encryption mode ciphers
Use the encryption mode ciphers configuration interface command to enable a cipher suite. Cipher suites are sets of encryption algorithms that, like WEP, protect radio communication on your wireless LAN. You must use a cipher suite to enable Wi-Fi Protected Access (WPA) or Cisco Centralized Key Management (CCKM).
Because cipher suites provide the protection of WEP while also allowing use of authenticated key management, Cisco recommends that you enable WEP by using the encryption mode ciphers command in the CLI or by using the cipher drop-down menu in the web-browser interface. Cipher suites that contain TKIP provide the best security for your wireless LAN, and cipher suites that contain only WEP are the least secure.
Note
encryption [vlan vlan] mode ciphers
{[aes-ccm | ckip | cmic | ckip-cmic | tkip]}
{[wep128 | wep40]}Syntax Description
vlan vlan
(Optional) Specifies the VLAN number
aes-ccm
Specifies that AES-CCMP is included in the cipher suite.
ckip1
Specifies that ckip is included in the cipher suite.
cmic1
Specifies that cmic is included in the cipher suite.
ckip-cmic1
Specifies that both ckip and cmic are included in the cipher suite.
tkip
Specifies that TKIP is included in the cipher suite.
Note
wep128
Specifies that 128-bit WEP is included in the cipher suite.
wep40
Specifies that 40-bit WEP is included in the cipher suite.
1 You must enable Aironet extensions to use this option in the cipher suite.
Defaults
This command has no defaults.
Command Modes
Configuration interface
Command History
12.2(4)JA
This command was introduced.
12.2(15)JA
This command was modified to include support for AES-CCMP.
Usage Guidelines
If you configure your access point to use WPA or CCKM authenticated key management, you must select a cipher suite compatible with the authenticated key management type. Table 2-6 lists the cipher suites that are compatible with WPA and CCKM.
Note
Refer to the Cisco IOS Software Configuration Guide for Cisco Aironet Access Points for a complete description of WPA and CCKM and instructions for configuring authenticated key management.
Examples
This example sets up a cipher suite for VLAN 22 that enables CKIP, CMIC, and 128-bit WEP.
ap(config-if)# encryption vlan 22 mode ciphers ckip-cmic wep128Related Commands
Configures the access point for WEP encryption
Configures the client authentication type for an SSID, including WPA and CCKM authenticated key management
encryption mode wep
Use the encryption mode wep configuration interface command to enable a specific encryption type that is used to communicate on the wireless LAN or on a specific VLAN. When encryption is enabled, all client devices on the wireless LAN or on a VLAN must support the specified encryption methods to communicate with the access point. Use the no form of the command to disable the encryption features on a specific VLAN.
Note
[no] encryption [vlan vlan-id ] mode wep
{mandatory | optional}
{key-hash | mic [key-hash] }Syntax Description
Defaults
This command has no defaults.
Command Modes
Configuration interface
Command History
Examples
This example shows how to specify that encryption key hashing must be used on VLAN number 1:
AP(config-if)# encryption vlan 1 mode wep mandatory key-hashThis example shows how to disable mandatory encryption on VLAN 1:
AP(config-if)# no encryption vlan 1 mode wep mandatoryRelated Commands
exception crashinfo buffersize
To change the size of the buffer used for crashinfo files, use the exception crashinfo buffersize command in global configuration mode. To revert to the default buffersize, use the no form of this command.
exception crashinfo buffersize kilobytes
no exception crashinfo buffersize kilobytes
Syntax Description
kilobytes
Sets the size of the buffersize to the specified value within the range of 32 to 100 kilobytes. The default is 32 KB.
Defaults
Crashinfo buffer is 32 KB.
Command Modes
Global config
Command History
Usage Guidelines
The crashinfo file saves information that helps Cisco technical support representatives to debug problems that caused the Cisco IOS image to fail (crash). The access point writes the crash information to the console at the time of the failure, and the file is created the next time you boot the Cisco IOS image after the failure (instead of while the system is failing).Examples
This example sets the crashinfo buffer to 100 KB:
ap(config)# exception crashinfo buffersize 100Related Commands
Enables the creation of a diagnostic file at the time of unexpected system shutdowns.
exception crashinfo file
To enable the creation of a diagnostic file at the time of unexpected system shutdowns, use the exception crashinfo file command in global configuration mode. To disable the creation of crashinfo files, use the no form of this command.
exception crashinfo file device:filename
no exception crashinfo file device:filename
Syntax Description
device:filename
Specifies the flash device and file name to be used for storing the diagnostic information. The colon is required.
Defaults
Creation of crashinfo files is disabled by default.
Command Modes
Global config
Command History
Usage Guidelines
The crashinfo file saves information that helps Cisco technical support representatives to debug problems that caused the Cisco IOS image to fail (crash). The access point writes the crash information to the console at the time of the failure, and the file is created the next time you boot the Cisco IOS image after the failure (instead of while the system is failing). The filename will be filename_yyyymmdd-hhmmss, where y is year, m is month, d is date, h is hour, and s is seconds.Examples
In this example, the access point creates a crashinfo file called crashdata in the default flash memory device if a system crash occurs:
ap(config)# exception crashinfo file flash:crashinfoRelated Commands
fragment-threshold
Use the fragment-threshold configuration interface command to set the size at which packets are fragmented. Use the no form of the command to reset the parameter to defaults.
[no] fragment-threshold 256-2346
Syntax Description
Defaults
The default threshold is 2346 bytes
Command Modes
Configuration interface
Command History
Examples
This example shows how to set the packet fragment threshold size to 1800 bytes:
AP(config-if)# fragment-threshold 1800This example shows how to reset the packet fragment threshold size to defaults:
AP(config-if)# no fragment-thresholdRelated Commands
group (local server configuration mode)
Use the group local server configuration mode command to enter user group configuration mode and configure a user group to which you can assign shared settings. In user group configuration mode you can specify settings for the user group such as VLAN and SSID.
group group
Note
Syntax Description
Defaults
This command has no defaults.
Command Modes
Local server configuration mode
Command History
Examples
This example shows how to create a user group on the local authenticator:
AP(config-radsrv)# group hoosiersRelated Commands
guest-mode (SSID configuration mode)
Use the guest-mode SSID configuration mode command to configure the radio interface (for the specified SSID) to support guest mode. Use the no form of the command to disable the guest mode.
[no] guest-mode
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no defaults.
Command Modes
SSID configuration interface
Command History
Usage Guidelines
The access point can have one guest-mode SSID or none at all. The guest-mode SSID is used in beacon frames and response frames to probe requests that specify the empty or wildcard SSID. If no guest-mode SSID exists, the beacon contains no SSID and probe requests with the wildcard SSID are ignored. Disabling the guest mode makes the networks slightly more secure. Enabling the guest mode helps clients that passively scan (do not transmit) associate with the access point. It also allows clients configured without a SSID to associate.
Examples
This example shows how to set the wireless LAN for the specified SSID into guest mode:
AP(config-if-ssid)# guest-modeThis example shows how to reset the guest-mode parameter to default values:
AP(config-if-ssid)# no guest-modeRelated Commands
Specifies the SSID and enters the SSID configuration mode
show running-config
Displays the current access point operating configuration
iapp standby mac-address
Use the iapp standby mac-address global configuration command to configure an access point to be in standby mode and specify the monitored access point's MAC address. Use the no form of this command to disable the access point standby mode.
[no] iapp standby mac-address mac-address
Note
Syntax Description
Defaults
This command has no default setting.
Command Modes
Global configuration
Command History
Examples
This example shows how to place the access point in standby mode and indicate the MAC address of the active access point:
AP(config)# iapp standby mac-address 0040.9631.81cfThis example shows how to stop or disable the standby mode:
AP(config)# no iapp standby mac-address 0040.9631.81cf
Related CommandsYou can verify your settings by entering the show class-map privileged EXEC command.
iapp standby poll-frequency
Use the iapp standby poll-frequency global configuration command to configure the standby mode polling interval. Use the no form of this command to clear the access point standby mode poll frequency.
[no] iapp standby poll-frequency sec [mac-address]
Note
Syntax Description
sec
Specifies the standby mode poll frequency in seconds
mac-address
Specifies the MAC address of an access point
Defaults
When you enable hot standby, the default poll frequency is 2 seconds.
Command Modes
Global configuration
Command History
Examples
This example shows how to specify the standby mode poll frequency of 5 minutes:
AP(config)# iapp standby poll-frequency 300This example shows how to stop or disable the standby mode:
AP(config)# no iapp standby mac-address 0040.9631.81cf
Related CommandsYou can verify your settings by entering the show class-map privileged EXEC command.
iapp standby primary-shutdown
Use the iapp standby primary-shutdown global configuration command to disable the radio interfaces on the monitored access point when the standby access point becomes active. The standby access point sends a Dumb Device Protocol (DDP) message to disable the radios of the monitored access point when it detects a failure (for example, if the standby unit cannot associate to the monitored access point, or if the standby unit detects a link test failure on any of the monitored interfaces).
[no] iapp standby primary-shutdown
Note
Note
Syntax Description
This command has no arguments or keywords.
Defaults
This feature is disabled by default.
Command Modes
Global configuration
Command History
Examples
This example shows how to enable the primary shutdown feature on a standby access point:
AP(config)# iapp standby primary-shutdownRelated CommandsYou can verify your settings by entering the show class-map privileged EXEC command.
iapp standby timeout
Use the iapp standby timeout global configuration command to configure the standby mode polling timeout value. Use the no form of this command to clear the standby mode polling timeout value.
[no] iapp standby timeout sec
Syntax Description
Defaults
When you enable hot standby, the default standby timeout is 20 seconds.
Command Modes
Global configuration
Command History
Examples
This example shows how to specify the standby mode polling timeout of 1 minute:
AP(config)# iapp standby timeout 60This example shows how to clear the standby mode timeout value:
AP(config)# no iapp standby timeout
Related CommandsYou can verify your settings by entering the show class-map privileged EXEC command.
information-element ssidl (SSID configuration mode)
Use the information-element ssidl SSID configuration command to designate an SSID for inclusion in an SSIDL information element (IE) that the access point includes in beacons. When you designate an SSID to be included in an SSIDL IE, client devices detect that the SSID is available, and they also detect the security settings required to associate using that SSID.
[no] information-element ssidl {[advertisement] [wps]}
Syntax Description
advertisement
Includes the SSID name and capabilities in the access point SSIDL IE.
wps
Sets the WPS capability flag in the SSIDL IE.
Defaults
By default, the access point does not include SSIDL IEs in beacons.
Command Modes
SSID configuration mode
Command History
Examples
This example shows how to designate an SSID for inclusion in the WPS IE:
AP(config-if-ssid)# information-element ssidl advertisement wpsRelated Commands
infrastructure-client
Use the infrastructure-client configuration interface command to configure a virtual interface for a workgroup bridge client. Use the no form of the command to disable the workgroup bridge client virtual interface.
[no] infrastructure-client
Note
Syntax Description
This command has no arguments or keywords.
Defaults
The default is infrastructure client disabled.
Command Modes
Configuration interface
Command History
Usage Guidelines
Enable the infrastructure client feature to increase the reliability of multicast messages to workgroup bridges. When enabled, the access point sends directed packets containing the multicasts, which are retried if necessary, to the associated workgroup bridge. Enable only when necessary because it can greatly increase the load on the radio cell.
Examples
This example shows how to configure a virtual interface for a workgroup bridge client.
AP(config-if)# infrastructure-clientThis example shows how to specify that a workgroup bridge client virtual interface is not supported.
AP(config-if)# no infrastructure-clientRelated Commands
show running-config
Displays information on the current running access point configuration
infrastructure-ssid (SSID configuration mode)
Use the infrastructure-ssid command in SSID configuration mode to reserve this SSID for infrastructure associations, such as those from one access point or bridge to another. Use the no form of the command to revert to a normal non-infrastructure SSID.
[ no ] infrastructure-ssid [ optional ]
Syntax Description
optional
Specifies that both infrastructure and mobile client devices are allowed to associate using the SSID
Defaults
This command has no defaults.
Command Modes
SSID configuration interface
Command History
Usage Guidelines
This command controls the SSID that access points and bridges use when associating with one another. A root access point only allows a repeater access point to associate using the infrastructure SSID, and a root bridge only allows a non-root bridge to associate using the infrastructure SSID. Repeater access points and non-root bridges use this SSID to associate with root devices. Configure authentication types and VLANs for an SSID to control the security of access points and bridges.
Examples
This example shows how to reserve the specified SSID for infrastructure associations on the wireless LAN:
AP(config-if-ssid)# infrastructure-ssidThis example shows how to restore the SSID to non-infrastructure associations:
AP(config-if-ssid)# no infrastructure-ssidRelated Commands
interface dot11radio
Use the interface dot11radio global configuration command to place access point into the radio configuration mode.
interface dot11radio interface-number
Syntax Description
interface-number
Specifies the radio interface number (The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.)
Defaults
The default radio interface number is 0.
Command Modes
Global configuration
Command History
Examples
This example shows how to place the access point into the radio configuration mode:
AP# interface dot11radio 0Related Commands
ip redirection
Use the ip redirection SSID configuration mode command to enable IP redirection for an SSID. When you configure IP redirection for an SSID, the access point redirects packets sent from client devices associated to that SSID to a specific IP address. IP redirection is used mainly on wireless LANs serving handheld devices that use a central software application and are statically configured to communicate with a specific IP address.
You can redirect all packets from client devices associated using an SSID or redirect only packets directed to specific TCP or UDP ports (as defined in an access control list). When you configure the access point to redirect only packets addressed to specific ports, the access point redirects those packets from clients using the SSID and drops all other packets from clients using the SSID.
Note
[no] ip redirection {host ip-address [access-group {access-list-number | access-list-name} in]}
Syntax Description
Defaults
IP redirection is disabled by default.
Command Modes
SSID configuration mode
Command History
Examples
This example shows how to configure IP redirection for an SSID without applying an ACL. The access point redirects all packets that it receives from client devices associated to the SSID zorro:
AP# configure terminalAP(config)# interface dot11radio 0AP(config-if)# ssid zorroAP(config-if-ssid)# ip redirection host 10.91.104.91AP(config-if-ssid-redirect)# endThis example shows how to configure IP redirection only for packets sent to the specific TCP and UDP ports specified in an ACL. When the access point receives packets from client devices associated using the SSID robin, it redirects packets sent to the specified ports and discards all other packets:AP# configure terminalAP(config)# interface dot11radio 0AP(config-if)# ssid zorroAP(config-if-ssid)# ip redirection host 10.91.104.91 access-group redirect-acl inAP(config-if-ssid)# endRelated Commands
l2-filter bridge-group-acl
Use the l2-filter bridge-group-acl configuration interface command to apply a Layer 2 ACL filter to the bridge group incoming and outgoing packets between the access point and the host (upper layer). Use the no form of the command to disable the Layer 2 ACL filter.
[no] l2-filter bridge-group-acl
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no defaults.
Command Modes
Configuration interface
Command History
Examples
This example shows how to apply a Layer 2 ACL filter to the bridge group packets:
AP(config-if)# l2-filter bridge-group-aclThis example shows how to activate a Layer 2 ACL filter:AP(config-if)# no l2-filter bridge-group-aclRelated Commands
led flash
Use the led flash privileged EXEC command to start or stop the blinking of the LED indicators on the access point for a specified number of seconds. Without arguments, this command blinks the LEDs continuously.
led flash [seconds | disable]
Syntax Description
seconds
Specifies the number of seconds (1 to 3600) that the LEDs blink
disable
Stops the blinking of the LEDs
Defaults
The default is continuous blinking of the LEDs.
Command Modes
Privileged EXEC
Command History
Examples
This example shows how to blink the access point LEDs for 30 seconds:
AP# led flash 30This example shows how to stop the blinking of the access point LEDs:AP# led flash disableRelated Commands
logging buffered
Use the logging buffered global configuration command to begin logging of messages to an internal buffer. Use the no form of this command to stop logging messages.
[no] logging buffered [size] [severity]
Syntax Description
Defaults
This command has no defaults.
Command Modes
Global configuration
Command History
Examples
This example shows how to begin logging severity 3 messages to an internal 5000-byte buffer:
AP(config)# logging buffered 5000 3This example shows how to stop the message logging:
AP(config)# no logging buffered
Related Commands
show logging
Displays recent logging event headers or complete events
clear logging
Clears logging status count and the trace buffer
logging snmp-trap
Use the logging snmp-trap global configuration command to specify the severity level of syslog messages for which the access point sends SNMP traps.
[no] logging snmp-trap severity
Syntax Description
Defaults
This command has no defaults.
Command Modes
Global configuration
Command History
Usage Guidelines
For the logging snmp-trap command to operate correctly, you must also configure these global configuration commands on the access point:
AP(config)# logging history severity AP(config)# snmp-server enable traps AP(config)# snmp-server host address syslogExamples
This example shows how to configure the access point to send SNMP traps for all severity levels:
AP(config)# logging snmp-trap 0 7This example shows how to configure the access point to send SNMP traps only for warning messages:
AP(config)# logging snmp-trap warningsRelated Commands
match (class-map configuration)
Use the match class-map configuration command to define the match criteria to classify traffic. Use the no form of this command to remove the match criteria.
[no] match {access-group acl-index-or-name |
ip [dscp dscp-list | precedence precedence-list] |
vlan vlan-id}Syntax Description
Note
Defaults
This command has no defaults.
Command Modes
Class-map configuration
Command History
Usage Guidelines
Use the class-map global configuration command to enter the class-map configuration mode. The match command in the class-map configuration mode is used to specify which fields in the incoming packets are examined to classify the packets. Only the IP access group or the MAC access group matching to the Ether Type/Len are supported.
You can use the match ip dscp dscp-list command only in a policy map that is attached to an egress interface.
Only one match command per class map is supported.
For the match ip dscp dscp-list or the match ip precedence ip-precedence-list command, you can enter a mnemonic name for a commonly used value. For example, you can enter the match ip dscp af11 command, which is the same as entering the match ip dscp 10 command. You can enter the match ip precedence critical command, which is the same as entering the match ip precedence 5 command. For a list of supported mnemonics, enter the match ip dscp ? or the match ip precedence ? command to see the command-line help strings.
Examples
This example shows how to create a class map called class2, which matches all the incoming traffic with DSCP values of 10, 11, and 12:
AP(config)# class-map class2AP(config-cmap)# match ip dscp 10 11 12AP(config-cmap)# exitThis example shows how to create a class map called class3, which matches all the incoming traffic with IP-precedence values of 5, 6, and 7:
AP(config)# class-map class3AP(config-cmap)# match ip precedence 5 6 7AP(config-cmap)# exitThis example shows how to delete the IP-precedence match criteria and to classify traffic by vlan:
AP(config)# class-map class2AP(config-cmap)# match ip precedence 5 6 7AP(config-cmap)# no match ip precedenceAP(config-cmap)# match vlan 2AP(config-cmap)# exitYou can verify your settings by entering the show class-map privileged EXEC command.
Related Commands
Creates a class map to be used for matching packets to the class whose name you specify
show class-map
Displays quality of service (QoS) class maps
max-associations (SSID configuration mode)
Use the max-associations SSID configuration mode command to configure the maximun number of associations supported by the radio interface (for the specified SSID). Use the no form of the command to reset the parameter to the default value.
[no] max-associations value
Syntax Description
Defaults
This default maximum is 255.
Command Modes
SSID configuration interface
Command History
Examples
This example shows how to set the maximum number of associations to 5 on the wireless LAN for the specified SSID:
AP(config-if-ssid)# max-associations 5This example shows how to reset the maximum number of associations to the default value:
AP(config-if-ssid)# no max-associationsRelated Commands
