Cisco Aironet Workgroup Bridge FAQ

Introduction

This document provides information on the most common questions asked about Cisco Aironet Workgroup Bridges.

Q. What is a Workgroup Bridge?

A. A Workgroup Bridge (WGB) is a small stand-alone unit that can provide a wireless infrastructure connection for Ethernet-enabled devices. Devices that do not have a wireless client adapter in order to connect to the wireless network can be connected to the WGB through the Ethernet port. The WGB associates to the root AP through the wireless interface. In this way, wired clients get access to the wireless network. The WGB connects to a hub through a standard Ethernet port that uses a 10-Base-T connector.

Q. Where can I download the latest software?

A. Cisco Aironet equipment operates best when all the components are loaded with the most current version of the software. You can download the latest software and drivers at the Cisco Wireless Software Center.

Q. How do I upgrade the software on a Workgroup Bridge?

A. The procedure can vary according to the firmware version to which you upgrade as well as the WGB model in which upgrading is done. Complete these steps explained in Upgrading Bridge Firmware in order to upgrade a 350 series WGB with its latest firmware version 8.89. Refer to the appropriate procedures explained within the Release notes of different firmware versions for all other vxworks firmware versions.

Q. How can I manage the Workgroup Bridge?

A. A 340 series WorkGroup Bridge does not have a console connector to configure. In such cases, configure the Workgroup Bridge with one of these methods.

• Install the IP Setup Utility (IPSU) on your PC, then launch IPSU and configure an IP address and Service Set Identifier (SSID) on the Workgroup Bridge. IPSU is available at Cisco Downloads ( registered customers only) .

• By default, the SSID of the Workgroup Bridge is tsunami, and it tries to acquire an IP address over the wireless link through DHCP. Wired Equivalent Privacy (WEP) is off by default. If an IP address is already configured, you might make a Telnet connection or browse to that IP address. These default settings apply to a 350 series WGB that run the firmware version 8.89.

• You can also reset the WGB to factory defaults, with the use of a paper clip on the small reset hole, and then use the default address 192.168.200.1 in order to access it if DHCP fails.

Q. Can wireless clients associate to the Workgroup Bridge?

A. No, the Workgroup Bridge is itself a wireless client. It is used in order to attach wired clients to the wireless backbone.

Q. How do I save the configurations on WorkGroup Bridge?

A. There is no explicit method or command to save your configuration changes. Changes you make are automatically saved to nonvolatile Flash memory each time you set or modify a parameter. This ensures the configuration is maintained during power failures or intentional power outages. Most configuration settings become effective as soon as the command is executed. Those that do not immediately become effective are noted in the command information.

Q. Can Workgroup Bridges work with other IEEE 802.11b devices?

A. No, the Workgroup Bridge works only with other Cisco equipment. It only communicates to a Cisco AP or Cisco Bridge. It does not communicate with any other Cisco Aironet wireless networking devices, not even other WGBs, or devices other vendors manufacture . It uses Aironet Extensions, which are for all practical purposes proprietary beacons, in order to function with Cisco APs. It is a Cisco specific device.

Q. With which devices can a Workgroup Bridge associate?

• Workgroup Bridge to Access Point (AP)

• Workgroup Bridge to Bridge (in AP mode)

• Workgroup Bridge to Base Station (in AP mode)

• Workgroup Bridge to AP in repeater mode, if the repeater is associated with a root AP

Q. At what frequency does a Workgroup Bridge communicate?

A. Workgroup Bridges transmit and receive on one of 11 channels within the 2.4 GHz frequency. This frequency is public. Refer to Radio Characteristics for more information on the radio specifications.

Q. How do I secure the data across the radio link of a Workgroup Bridge?

A. Enable Wired Equivalent Privacy (WEP) to encrypt the payload of packets sent across a radio link.

With the software version (8.8) you can add the Workgroup Bridge as a Light Extensible Authentication Protocol (LEAP) client. The Workgroup Bridge authenticates to an Access Control Server (ACS). Refer to Using the Configuration Menu from the Product Configuration Guide for more information.

Q. What EAP authentication types can the WGB use when talking to the upstream AP?

A. All AP IOS WGBs can use LEAP, EAP-FAST or EAP-TLS to authenticate to the upstream AP. PEAP support should not be necessary for the AP1130 and AP1240 because EAP-FAST can support PEAP as a EAP-FAST inner EAP type. The only reason that lack of PEAP is an issue is if their AAA server only supports PEAP and not EAP-FAST or EAP-TLS. But in that scenario, they can use the local authenticator with EAP-FAST.

Q. What is a Wired Equivalent Privacy (WEP) key?

A. A WEP key is a user-defined string of characters used to encrypt and decrypt data.

Q. What is the typical range for a Workgroup Bridge?

A. The typical range depends on many factors, such as the data rate (bandwidth) desired, the antenna type and antenna cable length, and the device that receives the transmission. In an optimal installation, range can be up to 300 feet (90 meters).

Q. What is the speed of the Ethernet port of the Workgroup Bridge?

A. The Ethernet port of the bridge supports 10 Mbps over a 10baseT RJ-45 connector, and only half-duplex is supported.

Q. What are possible sources of interference for the radio frequency link of the Workgroup Bridge?

A. Interference can come from a number of sources, such as 2.4 GHz cordless phones, improperly shielded microwave ovens, and wireless equipment manufactured by other companies. Police radar, electrical motors, and metal parts of machinery that move can cause interference as well. Refer to Troubleshooting Problems Affecting Radio Frequency Communication for more information.

Q. How do I set the Workgroup Bridge back to its factory default settings?

A. There are several options available in order to reset a 350 series WGB back to its factory default setting.

If you are telnetting into the WGB, enter the command Telnet and then the IP address of WGB. Choose the Diagnostics option from the VxWorks Main Menu. From Diagnostics, choose Defaults. The Defaults option returns the bridge configuration to its default factory settings. The bridge erases the currently saved configuration and executes a restart command.

Choose the Reset option of the Diagnostics menu in order to reset only selected portions. There are three entry options:

• ident_save—all parts of the configuration except the IP address are defaulted.

• radio_default—only the radio configuration is defaulted.

• filter_default—only the filter information is defaulted.

You can also reset the WGB to factory defaults, with the use of a paper clip on the small reset hole, and then use the default address 192.168.200.1 if DHCP fails in order to access it.

You can also use the Web GUI in order to reset the 350 series WGB to factory default. Open your web browser and type in the IP address of WGB in the Address field. From the WGB main page, choose to Allow config changes. Then click on Diagnostics.

The resultant page provides you with a number of items and the corresponding value column in order to reset your WGB to factory default settings. Among these items, choose Return to default configuration in order to reset the WGB to factory defaults.

Choose any of the three values ident_save:, radio_default:, filter_default: that correspond to the item "Default parts of the configuration" in order to reset only selected portions.

Q. What security features does a Workgroup Bridge (WGB) support?

A. The latest WGB firmware on a WGB device supports:

• 40-bit and 128-bit Wired Equivalent Privacy (WEP)

• Key Hashing

• Message Integrity Check (MIC)

• 802.1x Protocol Draft 10

All access point (AP) IOS WGBs (APs that act as a WGB) support Lightweight Extensible Authentication Protocol (LEAP), EAP-Flexible Authentication via Secure Tunneling (EAP-FAST) or EAP-Transport Layer Security (EAP-TLS) to authenticate to the upstream AP. Protected EAP (PEAP) support should not be necessary for the P1130 and AP1240 because EAP-FAST can support PEAP as an EAP-FAST inner EAP type. The only reason that lack of PEAP could be an issue is if their AAA server only supports PEAP and not EAP-FAST or EAP-TLS. But in that scenario, they could use the local authenticator with EAP-FAST. They also support Wi-Fi Protected Access (WPA).

Q. How many devices can the Workgroup Bridge support?

A. The Workgroup Bridge supports up to eight MAC addresses on the wired Ethernet segment. But, when a 1200 series access point works as a Workgroup Bridge, it can handle up to 254 clients on the Ethernet side, while it presumes that no other wireless clients are associated to the root bridge/AP to which this AP in WGB mode is associated.

But, keep in mind that when the AP acts in a WGB mode, the AP takes on the association at the client level, which means it is not a true bridge. So it is always advisable to limit the users to a small or reasonable number.

Q. What are some typical applications for a Workgroup Bridge?

• Hotels with a wireless backbone that provide connectivity to wired guests

• Printers with built-in Ethernet adapters that connect to a wireless backbone

• Stretching wireless infrastructure to wired-only clients

• Wireless-ready classrooms that accommodate wired-only student laptops

Q. Can a Workgroup Bridge be used in an outdoor (building-to-building) scenario, as a bridge?

A. Yes. Remember that the Workgroup Bridge is treated like a wireless client. It cannot associate to another Workgroup Bridge. Distance is limited to about one mile under ideal circumstances (line of sight, antennas, and so forth) when it connects to an AP.

Q. What Autonomous IOS APs can act as a WGB?

A. The AP1100, AP1130, AP200, AP1240, and BR1310 all support WGB mode of operation. The AP350 and the BR1400 do not support WGB.

Q. Do LWAPP APs support WGB?

A. WGB functionality is only implemented on autonomous IOS APs, not on LWAPP APs.

Q. What are the default settings for a WGB (350 series)?

• Radio Network Name—tsunami

• WEP Encryption Key—3031323334353637383930313233

• Network Type—Infrastructure

• Data Rate—Auto

• Encryption—Enabled

• Authentication Type—Open

• Encryption—128-bit Encryption

• Association—Mixed Cells Allowed

Q. Can an AP 340 be converted to a WGB?

A. No. AP340s do not have any supported functionality in order to allow them to serve as a WGB.

Q. Can a 340 WGB be converted to a bridge or AP?

A. No. The 340 WGB cannot be converted to an AP or bridge. The 340 WGB runs VxWorks, and new Cisco IOS products (such as the br1310) have adapted the WGB, root/non-root bridge, and AP functionality.

Q. What is the default IP address of a WGB?

A. Once the WGB is restored back to factory defaults, it assigns itself an IP address of 192.168.200.1.

Q. Is it required that the PC IPSU installed should be on the same subnet as the Bridge in order to assign an IP address to a WGB via IPSU?

A. No, since IPSU uses IP multicast, it can set the bridge IP address and SSID when the computer that runs IPSU is on a different subnet than the bridge.

Q. What is meant by Bridge Loop? What are the possible causes for a Bridge Loop to occur?

A. If the Workgroup Bridge is connected to the wired LAN and communicates with an access point on the same LAN, a network problem known as a bridge loop can occur. Disconnect the Workgroup Bridge from the wired LAN immediately after you configure it in order to avoid a bridge loop. A bridge loop can also occur if two or more workgroup bridges are connected to the same remote hub. Always connect only one workgroup bridge to a remote hub in order to prevent this bridge loop.

Q. What is the use of Staleout time setting?

A. The Workgroup Bridge management system includes a wired LAN staleout time setting on the Configuration > Ethernet page. Use this setting in order to control the number of seconds that the Workgroup Bridge continues to track a device in its association table when the device is inactive. Enter a value between 5 and 1000 seconds. Five minutes equals 300 seconds; ten minutes equals 600 seconds.

If the same devices are always connected to the Workgroup Bridge, enter 5 for the staleout time setting. If the devices connected to the Workgroup Bridge change frequently, enter 300 (equal to five minutes) for the staleout time setting. If you disconnect the Ethernet cable from the workgroup bridge and reconnect it, the Workgroup Bridge removes all devices from its association table and relearns them, regardless of the staleout time setting.

Q. What are the antenna options in a 350 series WGB?

A. The bridge comes with two possible antenna configurations: one captured antenna or two reverse-TNC antenna connectors to which the user can attach one or two antennas.

Q. What is the power specification for a WGB350?

A. The power in DC for WGB 350 is +5 Volts and 1.25 Amperes. Actual current drawn is 600 milli Amperes. The maximum and the minimum range is 5 volts or really close like 4.8-5.2 Volts DC.

Also, a 350 series WGB does not support inline power. It supports only the direct power. Use a power adaptor, in order to power up, which directly terminates into the WGB350 power port at the rear panel of the WGB. The power adaptor model is 100-120V~1.0A/50-60 Hz and the output is +5V to 1.25A.

Q. I am unable to access Workgroup Bridges associated with access point. Why?

A. When a Workgroup Bridge (WGB34x or WGB352) is associated to an access point, you cannot access the WGB console menus or ping the WGB from a station on the wired LAN connected to the Ethernet port of the access point. But, you can access the WGB from any client device connected to the WGB Ethernet port and from any client device associated to the access point that is associated to the WGB. Radio traffic between the access point and the WGB is not affected.

Q. What are the different modulation types supported in a 350 WGB?

A. The different Modulation types supported on a 350 WGB are:

• DBPSK @1 Mbps

  Differential Binary Phase Shift Keying (DBPSK) Modulation technique is used by IEEE 802.11-compliant wireless LANs for transmission at 1 Mbps.

• DQPSK @ 2 Mbps

  Differential Quadrature Phase Shift Keying (DQPSK) Modulation technique is used by IEEE 802.11-compliant wireless LANs for transmission at 2 Mbps.

• CCK @ 5.5 and 11 Mbps

  Complementary Code Keying (CCK) Modulation technique is used by IEEE 802.11-compliant wireless LANs for transmission at 5.5 and 11 Mbps.

Q. What is the typical range covered by a 350 series WGB?

A. It varies based on the indoor/outdoor usage and the data rate used.

Indoor:

• 130 ft (40m) @ 11 Mbps

• 350 ft (107m) @ 1 Mbps

Outdoor:

• 800 ft (244m) @ 11 Mbps

• 2000 ft (610m) @ 1 Mbps

Q. What are the Remote configuration options supported in WGB?

A. Use any of these options in order to configure WGB from a remote location:

• Telnet

• HTTP

• FTP

• TFTP

• SNMP

Q. I have my AP1200 act as WGB. Can I have my two Antennas on my AP to work in WGB mode?

A. If your access point has two radios, either the 2.4-GHz radio or the 5-GHz radio can function in Workgroup Bridge mode. When you configure one radio interface as a Workgroup Bridge, the other radio interface is automatically disabled.

Q. How do I configure my AP acting as WGB to dynamically switch between parent access points based on signal reception?

A. Use this command in order to configure the Workgroup Bridge as a mobile station:

ap(config)#mobile station

When you enable this setting, the Workgroup Bridge scans for a new parent association when it encounters a poor Received Signal Strength Indicator (RSSI), excessive radio interference, or a high frame-loss percentage. With the use of these criteria, a Workgroup Bridge configured as a mobile station searches for a new parent association and roams to a new parent before it loses its current association. When the mobile station setting is disabled, the default setting, the Workgroup Bridge does not search for a new association until it loses its current association.

Refer to the Configuring a Workgroup Bridge for Roaming section for more information.

Q. What is the maximum number of Access Points a WGB can be configured in order to attempt association?

A. You can enter MAC addresses for up to four parent access points. The Workgroup Bridge attempts to associate to MAC address 1 first. If that access point does not respond, the Workgroup Bridge tries the next access point in its parent list and so forth. But, keep in mind that at a time a WGB can be associated with only one AP. This list of MAC addresses only denotes the maximum number of APs to which a WGB can sequentially send its association request and attempt to associate.

Q. How does an AP treats a WGB by default? Is it possible to change this default status?

A. An AP treats a WGB by default as a Client Device. Use the infrastructure-client command as the radio interface configuration command in order to configure access points and bridges to treat Workgroup Bridges as infrastructure devices. The treatment of a Workgroup Bridge as an infrastructure device means that the access point reliably delivers multicast packets, which includes Address Resolution Protocol (ARP) packets, to the Workgroup Bridge. The configuration of access points and bridges to treat a Workgroup Bridge as a client device allows more Workgroup Bridges to associate to the same access point but at the same time, this does not ensure reliable delivery of Multicast packets. With reduced reliability, the access point cannot confirm whether multicast packets reach the intended Workgroup Bridge, so Workgroup Bridges at the edge of the coverage area of the access point might lose IP connectivity.

Q. How many WGB can associate to a single AP?

A. When the AP treats WGB as a client device, which occurs by default, the minimum 20 WGB can associate to an AP.

Q. What do the LEDs on the top of the Workgroup Bridge mean?

A. Refer to Checking the Top Panel Indicators.

Q. What type of Ethernet cable do I need to use in order to connect my end device to the Workgroup Bridge?

A. The type of cable depends on the type of device to which you connect. The Ethernet port on the Workgroup Bridge is not internally crossed, so use the same guidelines you would with any other end device: straight-through cable to a hub or switch, crossover cable to another end device.

PC --> [Crossover Cable] --> Workgroup Bridge 

Hub --> [Straight-through Cable] --> Workgroup Bridge 

Q. How can I tell if my Workgroup Bridge is associated?

A. There are three different methods you can use in order to tell whether your Workgroup Bridge is associated:

1. Check the system LED on the top panel. If it is solid green, the Workgroup Bridge is associated.

2. Make a Telnet connection to your Workgroup Bridge. Choose Main > Association > Display from the menu.

3. Check the association table of your Access Point (AP) or your bridge in AP mode in order to see if the Workgroup Bridge shows up under Repeaters.

Q. Does a WGB support Fast Secure Roaming?

A. A Workgroup Bridge device does not support Fast Secure Roaming. This is because Fast Secure Roaming requires CCKM support, which is not available in a WGB device, whereas, a 1300 series Wireless Bridge that acts in WGB mode supports Fast Secure Roaming.

Q. Does a WGB support multiple VLANs in it?

A. No. A Cisco WGB device does not support multiple VLANs in it. A 1100 AP, however, that acts in WGB mode can support multiple VLANs in it but with these restrictions:

• The VLANs must be assigned on both the root AP and WGB sides.

• The WGB must be connected to a dot1Q-capable switch.

• The Infrastructure SSID must be mapped to the native VLAN on root and the WGB.

  Note: The WGB associates on the Infrastructure SSID.

With this configuration, it is possible to associate WGB (WGB BVI interface) as a Native VLAN and have wired clients configured behind a dot1q switch associated to different (non-Native) VLANs.

Q. Is VLAN trunking supported through the Workgroup Bridge?

A. The role of a Workgroup Bridge is to extend the Wireless backbone to a wired client. When you use a WGB, wired clients cannot be in multiple VLANs. A root/non-root bridging construction is used for the extension of the wired network to another site over wireless.. Root/non-root bridges can handle multiple VLANs.

WGBs do support VLANs when they operate in infrastructure mode. The problem is that infrastructure mode is configured on the root AP (interface command infrastructure-client). As infrastructure client is not available in LWAPP, VLANs are not supported on WGBs when WGBs associate to LWAPP APs.

Q. Is there a comparable solution for the Workgroup Bridge available in a Lightweight Access Point Protocol (LWAPP) environment?

A. Cisco Aironet autonomous access points that operate in WGB mode can now associate to Cisco Aironet Lightweight Access Points (except Cisco Airespace AP1000 Series Access Points) to provide an 802.11 wireless connection to wired devices. The WGB is supported only in client mode and not in infrastructure mode and must run Cisco IOS Software Release 12.4(3g)JA or later (on 32-MB access points) or Cisco IOS Software Release 12.3(8)JEB or later (on 16-MB access points). WGB functionality is not supported for use with hybrid REAP.

Related Information

• Cisco Wireless LAN Technology Support
• Cisco Wireless Products Documentation
• Release Notes for Cisco Aironet 350 Series Workgroup Bridges Running Firmware Release 8.89
• Cisco Aironet 350 Series Workgroup Bridge Quick Start Guide
• Cisco Aironet 350 Series Workgroup Bridge Hardware Installation Guide
• Configuring Repeater and Standby Access Points and Workgroup Bridge Mode for 1300 series Wireless Bridge
• Configuring Repeater and Standby Access Points and Workgroup Bridge Mode for Cisco Aironet Access Points
• Technical Support & Documentation - Cisco Systems