-
null
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This chapter contains these sections:
Mesh networking employs Cisco Aironet 1500 Series outdoor mesh access points and indoor mesh access points (Cisco Aironet 1040, 1130, 1140, 1240, 1250, 1260, series access points) along with the Cisco Wireless LAN Controller, and Cisco Wireless Control System (WCS) to provide scalable, central management, and mobility between indoor and outdoor deployments. Control and Provisioning of Wireless Access Points (CAPWAP) protocol manages the connection of mesh access points to the network.
End-to-end security within the mesh network is supported by employing Advanced Encryption Standard (AES) encryption between the wireless mesh access points and Wi-Fi Protected Access 2 (WPA2) clients. This document also outlines radio frequency (RF) components to consider when designing an outdoor network.
Controller software release 7.0.116.0 and later releases support these Cisco Aironet mesh access points:
Note AP1130 and AP1240 must be converted to operate as indoor mesh access points. See the “Converting Indoor Access Points to Mesh Access Points” section.
In the 7.0.98.0 release, indoor mesh is available on dual band Cisco Aironet 1130 and 1240 series access points. In the 7.0.116.0 release, indoor mesh is also available on dual band 11n access points (Cisco Aironet 1040, 1140, 1250, 1260, 3500 and 3600 series access points). Indoor mesh is not supported with 802.11b/g only access points because 5 GHz is required for mesh backhaul access.
Physical installation and initial configuration of the mesh access points |
Cisco Aironet 1520 Series Outdoor Mesh Access Point Hardware Installation Guide http://www.cisco.com/en/US/products/ps8368/tsd_products_support_series_home.html |
Converting indoor access points to operate as mesh access points |
“Converting Indoor Access Points to Mesh Access Points” section |
More information about Cisco Aironet 1550 series outdoor mesh access points |
http://www.cisco.com/en/US/docs/wireless/technology/mesh/7.0MR1/design/guide/MeshAP_70MR1.html |
Mesh feature summary, important notes, and software upgrade steps to migrate from 4.1.19x.xx mesh releases to controller release 7.0.116.0 |
Release Notes for Cisco Wireless LAN controllers and Lightweight Access Points for Release 7.0.116.0 http://www.cisco.com/en/US/products/ps6366/prod_release_notes_list.html |
Access points within a mesh network operate as either a Root Access Point (RAP) or a Mesh Access Point (MAP).
RAPs have wired connections to their controller, and MAPs have wireless connections to their controller.
MAPs communicate among themselves and back to the RAP using wireless connections over the 802.11a radio backhaul. MAPs use the Cisco Adaptive Wireless Path Protocol (AWPP) to determine the best path through the other mesh access points to the controller.
All the possible paths between the MAPs and RAPs form the wireless mesh network. Figure 10-1 shows the relationship between RAPs and MAPs in a mesh network.
Figure 10-1 Simple Mesh Network Hierarchy
Wireless mesh networks can simultaneously carry two different traffic types: wireless LAN client traffic and MAP Ethernet port traffic.
Wireless LAN client traffic terminates on the controller, and the Ethernet traffic terminates on the Ethernet ports of the mesh access points.
Access to the wireless LAN mesh for mesh access points is managed by the following:
Membership to the wireless LAN mesh network for mesh access points is controlled by the bridge group names (BGNs). Mesh access points can be placed in similar bridge groups to manage membership or provide network segmentation. See the “Configuring Antenna Gain (GUI)” section.
With the 7.0.116.0 release, indoor mesh is also available on 802.11n access points (Cisco Aironet 1040, 1140, 1250, 1260, 3500, and 3600 series access points).
With the 7.0 release, indoor mesh is available on Cisco Aironet 1130 and 1240 series access points.
Enterprise 11n mesh is an enhancement added to the CUWN feature to work with the 802.11n access points. Enterprise 11n mesh features are compatible with non-802.11n mesh but adds higher backhaul and client access speeds. The 802.11n indoor access points are two-radio Wi-Fi infrastructure devices for select indoor deployments. One radio can be used for local (client) access for the access point and the other radio can be configured for wireless backhaul. The backhaul is supported only on the 5-GHz radio. Enterprise 11n mesh supports P2P, P2MP, and mesh types of architectures.
You have a choice of ordering indoor access points directly into the bridge mode, so that these access points can be used directly as mesh access points. If you have these access points in a local mode (nonmesh), then you have to connect these access points to the controller and change the AP mode to the bridge mode (mesh). This scenario can become cumbersome particularly if the volume of the access points being deployed is large and if the access points are already deployed in the local mode for a traditional nonmesh wireless coverage.
The Cisco indoor mesh access points are equipped with the following two simultaneously operating radios:
The 5-GHz radio supports the 5.15 GHz, 5.25 GHz, 5.47 GHz, and 5.8 GHz bands.
Cisco outdoor mesh access points comprise of the Cisco Aironet 1500 series access points. The 1500 series includes 1552 11n outdoor mesh access points, 1522 dual-radio mesh access points, and 1524 multi-radio mesh access points. There are two models of the 1524, which are the following:
Note In the 6.0 release, the AP1524SB access point was launched in A, C and N domains. In the 7.0 release, the AP1524SB access point is launched also in -E, -M, -K, -S, and -T domains.
Cisco 1500 series mesh access points are the core components of the wireless mesh deployment. AP1500s are configured by both the controller (GUI and CLI) and Cisco WCS. Communication between outdoor mesh access points (MAPs and RAPs) is over the 802.11a/n radio backhaul. Client traffic is generally transmitted over the 802.11b/g/n radio (802.11a/n can also be configured to accept client traffic), and public safety traffic (AP1524PS only) is transmitted over the 4.9-GHz radio.
The mesh access point can also operate as a relay node for other access points not directly connected to a wired network. Intelligent wireless routing is provided by the Adaptive Wireless Path Protocol (AWPP). This Cisco protocol enables each mesh access point to identify its neighbors and intelligently choose the optimal path to the wired network by calculating the cost of each path in terms of the signal strength and the number of hops required to get to a controller.
AP1500s are manufactured in two different configurations: cable and noncable.
Uplinks support includes Gigabit Ethernet (1000BASE-T) and a small form-factor (SFP) slot that can be plugged for a fiber or cable modem interface. Both single mode and multimode SFPs up to 1000BASE-BX are supported. The cable modem can be DOCSIS 2.0 or DOCSIS/EuroDOCSIS 3.0 depending upon the type of mesh access point.
AP1500s are available in a hazardous location hardware enclosure. When configured, the AP1500 complies with safety standards for Class I, Division 2, Zone 2 hazardous locations.
Note See the Cisco Aironet 1520 Series Lightweight Outdoor Access Point Ordering Guide for power, mounting, antenna, and regulatory support by model: http://www.cisco.com/en/US/prod/collateral/wireless/ps5679/ps8368/product_data_sheet0900aecd8066a157.html
Mesh access points support multiple deployment modes, including the following:
In a Cisco wireless outdoor mesh network, multiple mesh access points comprise a network that provides secure, scalable outdoor wireless LAN. Figure 10-2 shows an example of a simple mesh network deployment composed of mesh access point (MAPs and RAPs), controllers, and Cisco WCS.
The three RAPs are connected to the wired network at each location and are located on the building roof. All the downstream access points operate as MAPs and communicate using wireless links (not shown).
Both MAPs and RAPs can provide WLAN client access; however, the location of RAPs are often not suitable for providing client access. All the three access points in Figure 10-2 are located on the building roofs and are functioning as RAPs. These RAPs are connected to the network at each location.
Some of the buildings have onsite controllers to terminate CAPWAP sessions from the mesh access points but it is not a mandatory requirement because CAPWAP sessions can be back hauled to a controller over a wide-area network (WAN).
Note For more details on CAPWAP, see the “Architecture Overview” section.
Figure 10-2 Wireless Mesh Deployment
In a Cisco wireless backhaul network, traffic can be bridged between MAPs and RAPs. Outdoor Mesh AP and indoor AP converted to MAP mode are supported if CAPWAP over CAPWAP using ethernet bridging is supported. Both, local and flexconnect modes are support in MAP using ethernet bridging. This traffic can be from wired devices that are being bridged by the wireless mesh or CAPWAP traffic from the mesh access points. This traffic is always AES encrypted when it crosses a wireless mesh link such as a wireless backhaul (see Figure 10-3).
AES encryption is established as part of the mesh access point neighbor relationship with other mesh access points. The encryption keys used between mesh access points are derived during the EAP authentication process.
Only 5 GHz backhaul is possible on all mesh access points except 1522 in which either 2.4 or 5 GHz radio can be configured as a backhaul radio (see the “Configuring Advanced Features” section).
You can configure the backhaul on mesh access points to accept client traffic over its 802.11a radio. This feature is identified as Backhaul Client Access in the controller GUI (Monitor > Wireless). When this feature is disabled, backhaul traffic is transmitted only over the 802.11a or 802.11a/n radio and client association is allowed only over the 802.11b/g or 802.11b/g/n radio. For more information about the configuration, see the “Configuring Advanced Features” section.
In the point-to-multipoint bridging scenario, a RAP acting as a root bridge connects multiple MAPs as nonroot bridges with their associated wired LANs. By default, this feature is disabled for all MAPs. If Ethernet bridging is used, you must enable it on the controller for the respective MAP and for the RAP. Figure 10-4 shows a simple deployment with one RAP and two MAPs, but this configuration is fundamentally a wireless mesh with no WLAN clients. Client access can still be provided with Ethernet bridging enabled, although if bridging between buildings, MAP coverage from a high rooftop might not be suitable for client access.
Figure 10-4 Point-to-Multipoint Bridging Example
In a point-to-point bridging scenario, a 1500 Series Mesh AP can be used to extend a remote network by using the backhaul radio to bridge two segments of a switched network (see Figure 10-5). This is fundamentally a wireless mesh network with one MAP and no WLAN clients. Just as in point-to-multipoint networks, client access can still be provided with Ethernet bridging enabled, although if bridging between buildings, MAP coverage from a high rooftop might not be suitable for client access.
If you intend to use an Ethernet bridged application, we recommend that you enable the bridging feature on the RAP and on all MAPs in that segment. You must verify that any attached switches to the Ethernet ports of your MAPs are not using VLAN Trunking Protocol (VTP). VTP can reconfigure the trunked VLANs across your mesh and possibly cause a loss in connection for your RAP to its primary WLC. An incorrect configuration can take down your mesh deployment.
Figure 10-5 Point-to-Point Bridging Example
For security reasons the Ethernet port on the MAPs is disabled by default. It can be enabled only by configuring Ethernet Bridging on the Root and the respective MAPs (see Figure 10-6).
Ethernet bridging has to be enabled for the following two scenarios:
1. When you want to use the mesh nodes as bridges.
2. When you want to connect Ethernet devices such as a video camera on the MAP using its Ethernet port.
Figure 10-6 Wireless > All APs > Details
Ensure that you enable Ethernet bridging for every parent mesh AP taking the path from the mesh AP in question to the controller. For example, if you enable Ethernet bridging on MAP2 in Hop 2, then you must also enable Ethernet bridging on MAP1 (parent MAP), and on the RAP connecting to the controller.
Range Parameters have to be configured for longer links under the Wireless > Mesh tab. Optimum distance (in feet) should exist between the root access point (RAP) and the farthest mesh access point (MAP). Range from the RAP bridge to the MAP bridge has to be mentioned in feet.
Figure 10-7 Configuring Range Parameters
The following global parameter applies to all mesh access points when they join the controller and all existing mesh access points in the network:
config mesh range range-in-feet
Information similar to the following:
Note APs reboot after you specify the range.
To estimate the range, you can use range calculators that are available at:
This section contains the following sections:
CAPWAP is the provisioning and control protocol used by the controller to manage access points (mesh and nonmesh) in the network. This protocol replaces LWAPP in controller software 5.2 or later releases.
The Cisco Adaptive Wireless Path Protocol (AWPP) is designed specifically for wireless mesh networking. The path decisions of AWPP are based on the link quality and the number of hops.
Ease of deployment, fast convergence, and minimal resource consumption are also key components of AWPP.
The goal of AWPP is to find the best path back to a RAP for each MAP that is part of the RAP’s bridge group. To do this, the MAP actively solicits for neighbor MAPs. During the solicitation, the MAP learns all of the available neighbors back to a RAP, determines which neighbor offers the best path, and then synchronizes with that neighbor.
Relationships among access points with the mesh network are labeled as parent, child, or neighbor (see Figure 10-8) as follows:
Figure 10-8 Parent, Child, and Neighbor Access Points
Each outdoor wireless mesh deployment is unique, and each environment has its own challenges with available locations, obstructions, and available network infrastructure. Design requirements driven by expected users, traffic, and availability needs are also major design criteria. This section describes important design considerations and provides an example of a wireless mesh design.
The following are a few system characteristics to consider when you design and build a wireless mesh network. Some of these characteristics apply to the backhaul network design and others to the CAPWAP controller design.
Backhaul is used to create only the wireless connection between the access points. The backhaul interface by default is 802.11a or 802.11a/n depending upon the access point. The rate selection is important for effective use of the available RF spectrum. The rate can also affect the throughput of client devices, and throughput is an important metric used by industry publications to evaluate vendor devices.
Dynamic Rate Adaptation (DRA) introduces a process to estimate optimal transmission rate for packet transmissions. It is important to select rates correctly. If the rate is too high, packet transmissions fail resulting in communication failure. If the rate is too low, the available channel bandwidth is not used, resulting in inferior products, and the potential for catastrophic network congestion and collapse.
Data rates also affect the RF coverage and network performance. Lower data rates, for example 6 Mbps, can extend farther from the access point than can higher data rates, for example 300 Mbps. As a result, the data rate affects cell coverage and consequently the number of access points required. Different data rates are achieved by sending a more redundant signal on the wireless link, allowing data to be easily recovered from noise. The number of symbols sent out for a packet at the 1-Mbps data rate is higher than the number of symbols used for the same packet at 11 Mbps. Therefore, sending data at the lower bit rates takes more time than sending the equivalent data at a higher bit rate, resulting in reduced throughput.
A lower bit rate might allow a greater distance between MAPs, but there are likely to be gaps in the WLAN client coverage, and the capacity of the backhaul network is reduced. An increased bit rate for the backhaul network either requires more MAPs or results in a reduced SNR between MAPs, limiting mesh reliability and interconnection. For more information about configuring wireless backhaul data rate, see the “Configuring Wireless Backhaul Data Rate” section.
Note The data rate can be set on the backhaul on a per AP basis. It is not a global command.
The required minimum Link SNR for backhaul links per data rate is shown in Table 10-1 .
Table 10-2 summarizes the calculation by data rate.
– Minimum SNR refers to an ideal state of noninterference, nonnoise, and a system packet error rate (PER) of no more than 10 percent.
– Typical fade margin is approximately 9 to 10 dB.
LinkSNR = Minimum SNR - MRC + Fade Margin (9 dB)
If you consider only 802.11n rates, Table 10-4 shows Link SNR requirements with AP1552 for 2.4 and 5 GHz.
Note With two spatial streams, the MRC gain is halved, that is the MRC gain is reduced by 3 dB. This is because the system has 10 log (3/2 SS) instead of 10 log (3/1 SS). If there were to have been 3 SS with 3 RX, then the MRC gain would have been zero.
The number of hops is recommended to be limited to three or four primarily to maintain sufficient backhaul throughput, because each mesh access point uses the same radio for transmission and reception of backhaul traffic, which means that throughput is approximately halved over every hop. For example, the maximum throughput for 24 Mbps is approximately 14 Mbps for the first hop, 9 Mbps for the second hop, and 4 Mbps for the third hop.
There is no current software limitation on how many MAPs per RAP you can configure. However, it is suggested that you limit the number to 20 MAPs per RAP.
– The number of controllers per mobility group is limited to 72.
Many networks still support a mix of 802.11a/g and 802.11n clients. Because 802.11a/g clients (legacy clients) operate at lower data rates, the older clients can reduce the capacity of the entire network. Cisco ClientLink can help solve problems related to adoption of 802.11n in mixed-client networks by ensuring that 802.11a/g clients operate at the best possible rates, especially when they are near cell boundaries.
Advanced signal processing has been added to the Wi-Fi chipset. Multiple transmit antennas are used to focus transmissions in the direction of the 802.11a/g client, increasing the downlink signal-to-noise ratio and the data rate over range, thereby reducing coverage holes and enhancing the overall system performance. This technology learns the optimum way to combine the signal received from a client and then uses this information to send packets in an optimum way back to the client. This technique is also referred to as MIMO (multiple-input multiple-output) beamforming, transmit beamforming, or cophasing, and it is the only enterprise-class and service provider-class solution in the market that does not require expensive antenna arrays.
The 802.11n systems take advantage of multipath by sending multiple radio signals simultaneously. Each of these signals, called a spatial stream, is sent from its own antenna using its own transmitter. Because there is some space between these antennas, each signal follows a slightly different path to the receiver, a situation called spatial diversity. The receiver has multiple antennas as well, each with its own radio that independently decodes the arriving signals, and each signal is combined with signals from the other receiver radios which results in multiple data streams receiving at the same time. This enables a higher throughput than previous 802.11a/g systems, but requires an 802.11n capable client to decipher the signal. Therefore, both AP and client need to support this capability. Due to the complexity of issues, in the first generation of mainstream 802.11n chipsets, neither the AP nor client chipsets implemented 802.11n transmit beamforming. Therefore, the 802.11n standard transmit beamforming will be available eventually, but not until the next generation of chipsets take hold in the market.
For the current generation of 802.11n APs, while the second transmit path was being well utilized for 802.11n clients (to implement spatial diversity), it was not being fully used for 802.11a/g clients. For 802.11 a/g clients, some of the capabilities of the extra transmit path was lying idle. In addition, for many networks, the performance of the installed 802.11 a/g client base would be a limiting factor on the network.
Cisco ClientLink uses advanced signal processing techniques and multiple transmit paths to optimize the signal received by 802.11a/g clients in the downlink direction without requiring feedback. Because no special feedback is required, Cisco ClientLink works with all existing 802.11a/g clients.
Cisco ClientLink technology effectively enables the access point to optimize the SNR exactly at the position where the client is placed. Cisco ClientLink provides a gain of almost 4 dB in the downlink direction. Improved SNR yields many benefits, such as a reduced number of retries and higher data rates. For example, a client at the edge of the cell that might previously have been capable of receiving packets at 12 Mbps could now receive them at 36 Mbps. Typical measurements of downlink performance with Cisco ClientLink show as much as 65 percent greater throughput for 802.11a/g clients. By allowing the Wi-Fi system to operate at higher data rates and with fewer retries, Cisco ClientLink increases the overall capacity of the system, which means an efficient use of spectrum resources.
Cisco ClientLink in the 1552 access points is based on Cisco ClientLink capability available in AP3500s. Therefore, the access point has the ability to beamform well to nearby clients and to update beamforming information on 802.11ACKs. Even if there is no dedicated uplink traffic, the Cisco ClientLink works well, which is beneficial to both TCP and UDP traffic streams. There are no RSSI watermarks, which the client has to cross to take advantage of this beamforming with Cisco 802.11n access points.
Cisco ClientLink can beamform to 15 clients at a time. Therefore, the host must select the best 15 if the number of legacy clients exceeds 15 per radio. AP1552 has two radios, which means that up to 30 clients can be beamformed in time domain.
Although ClientLink is applied to legacy OFDM portions of packets, which refers to 11a/g rates (not 11b) for both indoor and outdoor 802.11n access points, there is one difference between ClientLink for indoor 11n and ClientLink for outdoor 11n. For indoor 11n access points, the SW limits the affected rates to 24, 36, 48, and 54 Mbps. To avoid clients sticking to a far away AP in an indoor environment. SW also does not allow ClientLink to work for those rates for 11n clients because the throughput gain is so minimal. However, there is a demonstrable gain for pure legacy clients. For outdoor 11n access points, three more additional legacy data rates lower than 24 Mbps have been added. ClientLink for outdoors is applicable to legacy data rates of 9, 12, 18, 24, 36, 48, and 54 Mbps.
Note From the 7.2 release onwards, it is not possible to configure ClientLink (beamforming) using the controller GUI.
Step 1 Disable the 802.11a or 802.11b/g network by entering this command:
config { 802.11a | 802.11b } disable network
Step 2 Reenable the network by entering this command:
config { 802.11a | 802.11b } enable network
Step 3 Save your changes by entering this command:
– To find a client in the AP rbf table, enter the show interface dot110 command.
– To show that ClientLink is enabled on a radio, enter the show controllers | inc Beam command.
The following items affect the number of controllers required in a mesh network:
The wired network that connects the RAP and controllers can affect the total number of access points supported in the network. If this network allows the controllers to be equally available to all access points without any impact on WLAN performance, the access points can be evenly distributed across all controllers for maximum efficiency. If this is not the case, and controllers are grouped into various clusters or PoPs, the overall number of access points and coverage are reduced.
For example, you can have 72 Cisco 4400 Series Controllers in a mobility group, and each Cisco 4400 Series Controller supports 100 local access points, which gives a total number of 7200 possible access points per mobility group.
For clarity, nonmesh access points are referred to as local access points in this document.
Local AP Support (nonmesh)1
|
||
---|---|---|
Note The Wireless LAN Controller modules NM and NME now support mesh 1520 series access points from Wireless LAN Controller (WLC) software release 5.2 and later releases.
Note Mesh is fully supported on Cisco 5508 Controllers. The Base License (LIC-CT508-Base) is sufficient for indoor and outdoor APs (AP152X). The WPlus License (LIC-WPLUS-SW) is merged with the base license. The WPlus License is not required for indoor mesh APs.
Mesh APs (MAPs/RAPs) are counted as full APs on Cisco 5508 Controllers.
With other controller platforms, MAPs are counted as half APs.
Data Plane Transport Layer Security (DTLS) is not supported on mesh access points.
This section assumes that the controller is already active in the network and is operating in Layer 3 mode. Controller ports that the mesh access points connect to should be untagged.
Ensure that you do the following:
1. Add the MAC address of the mesh access point to the controller’s MAC filter. See the “Adding MAC Addresses of Mesh Access Points to the MAC Filter” section.
2. Define the role (RAP or MAP) for the mesh access point. See the “Defining Mesh Access Point Role” section.
Note CAPWAP supports only layer3 mode and it does not support layer2 mode.
3. Configure a primary, secondary, and tertiary controller for each mesh access point. See the “Configuring Multiple Controllers Using DHCP 43 and DHCP 60” section.
4. Configure a backup controller. See the Configuring Backup Controllers.
5. Configure external authentication of MAC addresses using an external RADIUS server. See the “Configuring External Authentication and Authorization Using a RADIUS Server” section.
6. Configure global mesh parameters. See the “Configuring Global Mesh Parameters” section.
7. Configure universal client access. Configuring universal client access is part of the Configuring Advanced Features section. See the “Universal Client Access” section.
8. Configure local mesh parameters. See the “Configuring Local Mesh Parameters” section.
9. Configure mobility groups (if desired) and assign controllers. See Chapter 12, Configuring Mobility Groups.
You must enter the radio MAC address for all mesh access points that you want to use in the mesh network into the appropriate controller. A controller only responds to discovery requests from outdoor radios that appear in its authorization list. MAC filtering is enabled by default on the controller, so only the MAC addresses need to be configured. If the access point has an SSC and has been added to the AP Authorization List, then the MAC address of the AP does not need to be added to the MAC Filtering List.
You can add the mesh access point using either the GUI or the CLI.
Note You can also download the list of mesh access point MAC addresses and push them to the controller using Cisco WCS. See the Cisco Wireless Control System Configuration Guide, Release 7.0.172.0: http://www.cisco.com/en/US/docs/wireless/wcs/7.0MR1/configuration/guide/WCS70MR1.html
Step 1 Choose Security > AAA > MAC Filtering . The MAC Filtering page appears.
Figure 10-9 MAC Filtering Page
Step 2 Click New . The MAC Filters > New page appears.
Step 3 Enter the radio MAC address of the mesh access point.
Note For 1500 series outdoor mesh access points, specify the BVI MAC address of the mesh access point into the controller as a MAC filter. For indoor mesh access points, enter the Ethernet MAC. If the required MAC address does not appear on the exterior of the mesh access point, enter the following command at the access point console to display the BVI and Ethernet MAC addresses: sh int | i Hardware.
Step 4 From the Profile Name drop-down list, choose Any WLAN .
Step 5 In the Description field, specify a description of the mesh access point. The text that you enter identifies the mesh access point on the controller.
Note You might want to include an abbreviation of its name and the last few digits of the MAC address, such as ap1522:62:39:10. You can also note details on its location such as roof top, pole top, or its cross streets.
Step 6 From the Interface Name drop-down list, choose the controller interface to which the mesh access point is to connect.
Step 7 Click Apply to commit your changes. The mesh access point now appears in the list of MAC filters on the MAC Filtering page.
Step 8 Click Save Configuration to save your changes.
Step 9 Repeat this procedure to add the MAC addresses of additional mesh access points to the list.
Step 1 To add the MAC address of the mesh access point to the controller filter list, enter this command:
config macfilter add ap_mac wlan_id interface [ description ]
A value of zero (0) for the wlan_id parameter specifies any WLAN, and a value of zero (0) for the interface parameter specifies none. You can enter up to 32 characters for the optional description parameter.
Step 2 To save your changes, enter this command:
By default, AP1500s are shipped with a radio role set to MAP. You must reconfigure a mesh access point to act as a RAP.
Step 1 Click Wireless to open the All APs page.
Step 2 Click the name of an access point. The All APs > Details (General) page appears.
Figure 10-10 All APs > Details for (Mesh) Page
Step 4 Choose RootAP or MeshAP from the AP Role drop-down list.
Step 5 Click Apply to commit your changes and to cause the access point to reboot.
Step 1 Enter configuration mode at the Cisco IOS CLI.
Step 2 Create the DHCP pool, including the necessary parameters such as the default router and name server. The commands used to create a DHCP pool are as follows:
Step 3 Add the option 60 line using the following syntax:
For the VCI string, use one of the values below. The quotation marks must be included.
Step 4 Add the option 43 line using the following syntax:
The hex string is assembled by concatenating the TLV values as follows:
Type is always f1(hex); Length is the number of controller management IP addresses times 4 in hex; Value is the IP address of the controller listed sequentially in hex.
For example, suppose that there are two controllers with management interface IP addresses 10.126.126.2 and 10.127.127.2. The type is f1(hex) . The length is 2 * 4 = 8 = 08 (hex) . The IP addresses translate to 0a7e7e02 and 0a7f7f02. Assembling the string then yields f1080a7e7e020a7f7f02 .
The resulting Cisco IOS command added to the DHCP scope is as follows:
A single controller at a centralized location can act as a backup for mesh access points when they lose connectivity with the primary controller in the local region. Centralized and regional controllers need not be in the same mobility group. Using the controller GUI or CLI, you can specify the IP addresses of the backup controllers, which allows the mesh access points to fail over to controllers outside of the mobility group.
You can also configure primary and secondary backup controllers (which are used if primary, secondary, or tertiary controllers are not specified or are not responsive) for all access points connected to the controller as well as various timers, including the heartbeat timer and discovery request timers.
Step 1 Choose Wireless > Access Points > Global Configuration to open the Global Configuration page.
Figure 10-11 Global Configuration Page
Note The fast heartbeat timer is not supported on mesh access points.
Step 2 In the AP Primary Discovery Timeout field, enter a value between 30 and 3600 seconds (inclusive) to configure the access point primary discovery request timer. The default value is 120 seconds.
Step 3 If you want to specify a primary backup controller for all access points, specify the IP address of the primary backup controller in the Back-up Primary Controller IP Address field and the name of the controller in the Back-up Primary Controller Name field.
Note The default value for the IP address is 0.0.0.0, which disables the primary backup controller.
Step 4 If you want to specify a secondary backup controller for all access points, specify the IP address of the secondary backup controller in the Back-up Secondary Controller IP Address field and the name of the controller in the Back-up Secondary Controller Name field.
Note The default value for the IP address is 0.0.0.0, which disables the secondary backup controller.
Step 5 Click Apply to commit your changes.
Step 6 If you want to configure primary, secondary, and tertiary backup controllers for a specific point, follow these steps:
a. Choose Access Points > All APs to open the All APs page.
b. Click the name of the access point for which you want to configure primary, secondary, and tertiary backup controllers.
c. Click the High Availability tab.
Figure 10-12 All APs > Details for (High Availability) Page
d. If desired, specify the name and IP address of the primary backup controller for this access point in the Primary Controller fields.
Note Specifying an IP address for the backup controller is optional in this step and the next two steps. If the backup controller is outside the mobility group to which the mesh access point is connected (the primary controller), then you need to provide the IP address of the primary, secondary, or tertiary controller, respectively. The controller name and IP address must belong to the same primary, secondary, or tertiary controller. Otherwise, the mesh access point cannot join the backup controller.
e. If desired, specify the name and IP address of the secondary backup controller for this mesh access point in the Secondary Controller fields.
f. If desired, specify the name and IP address of the tertiary backup controller for this mesh access point in the Tertiary Controller fields.
g. No change is required to the AP Failover Priority value. The default value for mesh access points is critical and it cannot be modified.
h. Click Apply to commit your changes.
Step 7 Click Save Configuration to save your changes.
Step 1 To configure a primary controller for a specific mesh access point, enter this command:
config ap primary-base controller_name Cisco_AP [ controller_ip_address ]
Note The controller_ip_address parameter in this command and the next two commands is optional. If the backup controller is outside the mobility group to which the mesh access point is connected (the primary controller), then you need to provide the IP address of the primary, secondary, or tertiary controller, respectively. In each command, the controller_name and controller_ip_address must belong to the same primary, secondary, or tertiary controller. Otherwise, the mesh access point cannot join the backup controller.
Step 2 To configure a secondary controller for a specific mesh access point, enter this command:
config ap secondary-base controller_name Cisco_AP [ controller_ip_address ]
Step 3 To configure a tertiary controller for a specific mesh access point, enter this command:
config ap tertiary-base controller_name Cisco_AP [ controller_ip_address ]
Step 4 To configure a primary backup controller for all mesh access points, enter this command:
config advanced backup-controller primary backup_controller_name backup_controller_ip_address
Step 5 To configure a secondary backup controller for all mesh access points, enter this command:
config advanced backup-controller secondary backup_controller_name backup_controller_ip_address
Note To delete a primary or secondary backup controller entry, enter 0.0.0.0 for the controller IP address.
Step 6 To configure the mesh access point primary discovery request timer, enter this command:
config advanced timers ap-primary-discovery-timeout interval
where interval is a value between 30 and 3600 seconds. The default value is 120 seconds.
Step 7 To configure the mesh access point discovery timer, enter this command:
config advanced timers ap-discovery-timeout interval
where interval is a value between 1 and 10 seconds (inclusive). The default value is 10 seconds.
Step 8 To configure the 802.11 authentication response timer, enter this command:
config advanced timers auth-timeout interval
where interval is a value between 10 and 600 seconds (inclusive). The default value is 10 seconds.
Step 9 To save your changes, enter this command:
Step 10 To view a mesh access point’s configuration, enter these commands:
Information similar to the following appears for the show ap config general Cisco_AP command:
Information similar to the following appears for the show advanced backup-controller command:
Information similar to the following appears for the show advanced timers command:
Information similar to the following appears for the show mesh config command:
External authorization and authentication of mesh access points using a RADIUS server such as Cisco ACS (4.1 and later) is supported in release 5.2 and later releases. The RADIUS server must support the client authentication type of EAP-FAST with certificates.
Before you employ external authentication within the mesh network, ensure that you make these changes:
Note If mesh access points connect to a controller using a Fast Ethernet or Gigabit Ethernet interface, only MAC authorization is required.
Note This feature also supports local EAP and PSK authentication on the controller.
Step 1 Download the CA certificates for Cisco Root CA 2048 from the following locations:
Step 2 Install the certificates as follows:
a. From the CiscoSecure ACS main menu, click System Configuration > ACS Certificate Setup > ACS Certification Authority Setup .
b. In the CA certificate file box, type the CA certificate location (path and name). For example: C:\Certs\crca2048.cer .
Step 3 Configure the external RADIUS servers to trust the CA certificate as follows:
a. From the CiscoSecure ACS main menu, choose System Configuration > ACS Certificate Setup > Edit Certificate Trust List . The Edit Certificate Trust List appears.
b. Select the check box next to the Cisco Root CA 2048 (Cisco Systems) certificate name.
d. To restart ACS, choose System Configuration > Service Control , and then click Restart .
Note For additional configuration details on Cisco ACS servers, see the following:
Add MAC addresses of mesh access point that are authorized and authenticated by external RADIUS servers to the user list of that server prior to enabling RADIUS authentication for a mesh access point.
For remote authorization and authentication, EAP-FAST uses the manufacturer’s certificate (CERT) to authenticate the child mesh access point. Additionally, this manufacturer certificate-based identity serves as the username for the mesh access point in user validation.
For Cisco IOS-based mesh access points, in addition to adding the MAC address to the user list, you need to enter the platform_name_string–MAC_address string to the user list (for example, c1240-001122334455). The controller first sends the MAC address as the username; if this first attempt fails, then the controller sends the platform_name_string–MAC_address string as the username.
Example: RADIUS Server Username Entry
For each mesh access point, two entries must be added to the RADIUS server, the platform_name_string-MAC_address string, then a hyphen delimited MAC Address. For example:
Note The platform AP1552 uses a platform name of c1520.
Step 1 Choose Wireless > Mesh . The Mesh page appears.
Step 2 In the security section, choose the EAP option from the Security Mode drop-down list.
Step 3 Select the Enabled check boxes for the External MAC Filter Authorization and Force External Authentication options.
Step 5 Click Save Configuration .
Step 1 config mesh security eap
Step 2 config macfilter mac-delimiter colon
Step 3 config mesh security rad-mac-filter enable
Step 4 config mesh radius-server index enable
Step 5 config mesh security force-ext-auth enable (Optional)
To view security statistics for mesh access points using the CLI, enter this command:
show mesh security-stats Cisco_AP
Use this command to display packet error statistics and a count of failures, timeouts, and association and authentication successes as well as reassociations and reauthentications for the specified access point and its child.
This section provides instructions to configure the mesh access point to establish a connection with the controller including:
You can configure the necessary mesh parameters using either the GUI or the CLI. All parameters are applied globally.
Step 1 Choose Wireless > Mesh .
Step 2 Modify the mesh parameters as appropriate.
The optimum distance (in feet) that should exist between the root access point (RAP) and the mesh access point (MAP). This global parameter applies to all mesh access points when they join the controller and all existing mesh access points in the network. Note After this feature is enabled, all mesh access points reboot. |
|
When you enable this feature, IDS reports are generated for all traffic on the client access only and not on the backhaul. When you disable this feature, no IDS reports are generated, which preserves bandwidth on the backhaul. You have to use the following command to enable or disable it on the mesh APs: config mesh ids-state { enable | disable } Note 2.4GHz IDS is activated with the global IDS settings on the controller. |
|
Note This parameter applies to mesh access points with two or more radios (1552, 1524SB, 1522, 1240, 1130, and 11n indoor mesh APs) excluding the 1524PS. When Universal Client Access is enabled, it allows wireless client association over the backhaul radio. Generally, backhaul radio is a 5-GHz radio for most of the mesh access points except for 1522 where backhaul can be 2.4 GHz. This means that a backhaul radio can carry both backhaul traffic and client traffic. When Universal Client Access is disabled, only backhaul traffic is sent over the backhaul radio and client association is only over the second radio(s). Note After this feature is enabled, all mesh access points reboot. |
|
This feature determines how a mesh access point handles VLAN tags for Ethernet bridged traffic. Note See the “Configuring Advanced Features” section for overview and additional configuration details. If VLAN Transparent is enabled, then VLAN tags are not handled and packets are bridged as untagged packets. Note No configuration of Ethernet ports is required when VLAN transparent is enabled. The Ethernet port passes both tagged and untagged frames without interpreting the frames. If VLAN Transparent is disabled, then all packets are handled according to the VLAN configuration on the port (trunk, access, or normal mode). Note If the Ethernet port is set to Trunk mode, Ethernet VLAN tagging must be configured. See “Enabling Ethernet Bridging (GUI)” section. Note For an overview of normal, access, and trunk Ethernet port use, see “Ethernet Port Notes” section. Note To use VLAN tagging, you must uncheck the VLAN Transparent check box. Note VLAN Transparent is enabled as a default to ensure a smooth software upgrade from 4.1.192.xxM releases to release 5.2. Release 4.1.192.xxM does not support VLAN tagging (see Figure 10-14). |
|
Defines the security mode for mesh access points: Pre-Shared Key (PSK) or Extensible Authentication Protocol (EAP). Note EAP must be selected if external MAC filter authorization using a RADIUS server is configured. Note Local EAP or PSK authentication is performed within the controller if the External MAC Filter Authorization parameter is disabled (check box unchecked). |
|
MAC filtering uses the local MAC filter on the controller by default. When external MAC filter authorization is enabled, if the MAC address is not found in the local MAC filter, then the MAC address in the external RADIUS server is used. This protects your network against rogue mesh access points by preventing mesh access points that are not defined on the external server from joining. Before employing external authentication within the mesh network, the following configuration is required:
– For remote authorization and authentication, EAP-FAST uses the manufacturer’s certificate (CERT) to authenticate the child mesh access point. Additionally, this manufacturer certificate-based identity serves as the username for the mesh access point in user validation. – For IOS-based mesh access points (1130, 1240, 1522, 1524), the platform name of the mesh access point is located in front of its Ethernet address within the certificate; therefore, their username for external RADIUS servers is platform_name_string – Ethernet MAC address such as c1520-001122334455 . Note When this capability is not enabled, by default, the controller authorizes and authenticates mesh access points using the MAC address filter. |
|
When enabled along with EAP and External MAC Filter Authorization parameters, external authorization and authentication of mesh access points is done by default by an external RADIUS server (such as Cisco 4.1 and later). The RADIUS server overrides local authentication of the MAC address by the controller which is the default. |
Step 3 Click Apply to commit your changes.
Step 4 Click Save Configuration to save your changes.
Note See the “Configuring Global Mesh Parameters (GUI)” section for descriptions, valid ranges, and default values of the parameters used in the CLI commands.
Step 1 To specify the maximum range (in feet) of all mesh access points in the network, enter this command:
To see the current range, enter the show mesh range command.
Step 2 To enable or disable IDS reports for all traffic on the backhaul, enter this command:
config mesh ids-state { enable | disable }
Step 3 To specify the rate (in Mbps) at which data is shared between access points on the backhaul interface, enter this command:
config ap bhrate { rate | auto } Cisco_AP
Step 4 To enable or disable client association on the primary backhaul (802.11a) of a mesh access point, enter these commands:
config mesh client-access { enable | disable }
config ap wlan { enable | disable } 802.11a Cisco_AP
config ap wlan { add | delete } 802.11a wlan_id Cisco_AP
Step 5 To enable or disable VLAN transparent, enter this command:
config mesh ethernet-bridging VLAN-transparent { enable | disable }
Step 6 To define a security mode for the mesh access point, enter one of the following commands:
a. To provide local authentication of the mesh access point by the controller, enter this command:
config mesh security { eap | psk }
b. To store the MAC address filter in an external RADIUS server for authentication instead of the controller (local), enter these commands:
config macfilter mac-delimiter colon
config mesh security rad-mac-filter enable
config mesh radius-server index enable
c. To provide external authentication on a RADIUS server and define a local MAC filter on the controller, enter these commands:
config macfilter mac-delimiter colon
config mesh security rad-mac-filter enable
config mesh radius-server index enable
config mesh security force-ext-auth enable
d. To provide external authentication on a RADIUS server using a MAC username (such as c1520-123456 ) on the RADIUS server, enter these commands:
config macfilter mac-delimiter colon
config mesh security rad-mac-filter enable
config mesh radius-server index enable
config mesh security force-ext-auth enable
Step 7 To save your changes, enter this command:
When Universal Client Access is disabled, only backhaul traffic is sent over the backhaul radio and client association is only over the second radio(s).
After configuring global mesh parameters, you must configure the following local mesh parameters for these specific features if in use in your network:
Backhaul is used to create only the wireless connection between the access points. The backhaul interface by default is 802.11a or 802.11a/n depending upon the access point. The rate selection is important for effective use of the available RF spectrum. The rate can also affect the throughput of client devices, and throughput is an important metric used by industry publications to evaluate vendor devices.
Dynamic Rate Adaptation (DRA) introduces a process to estimate optimal transmission rate for packet transmissions. It is important to select rates correctly. If the rate is too high, packet transmissions fail resulting in communication failure. If the rate is too low, the available channel bandwidth is not used, resulting in inferior products, and the potential for catastrophic network congestion and collapse.
Data rates also affect the RF coverage and network performance. Lower data rates, for example 6 Mbps, can extend farther from the access point than can higher data rates, for example 300 Mbps. As a result, the data rate affects cell coverage and consequently the number of access points required. Different data rates are achieved by sending a more redundant signal on the wireless link, allowing data to be easily recovered from noise. The number of symbols sent out for a packet at the 1-Mbps data rate is higher than the number of symbols used for the same packet at 11 Mbps. Therefore, sending data at the lower bit rates takes more time than sending the equivalent data at a higher bit rate, resulting in reduced throughput.
In the controller release 5.2, the default data rate for the mesh 5-GHz backhaul is 24 Mbps. It remains the same with 6.0 and 7.0 controller releases.
With the 6.0 controller release, mesh backhaul can be configured for ‘Auto’ data rate. Once configured, the access point picks the highest rate where the next higher rate cannot be used because of conditions not being suitable for that rate and not because of conditions that affect all rates. That is, once configured, each link is free to settle down to the best possible rate for its link quality.
We recommend that you configure the mesh backhaul to Auto.
For example, if mesh backhaul chose 48 Mbps, then this decision is taken after ensuring that we cannot use 54 Mbps as there is not enough SNR for 54 and not because some just turned the microwave oven on which affects all rates.
A lower bit rate might allow a greater distance between MAPs, but there are likely to be gaps in the WLAN client coverage, and the capacity of the backhaul network is reduced. An increased bit rate for the backhaul network either requires more MAPs or results in a reduced SNR between MAPs, limiting mesh reliability and interconnection.
Figure 10-15 shows the RAP using the "auto" backhaul data rate, and it is currently using 54 Mbps with its child MAP.
Figure 10-15 Bridge Rate Set to Auto
Note The data rate can be set on the backhaul on a per-AP basis. It is not a global command.
Use these commands to obtain information about backhaul:
config ap bhrate backhaul-rate ap-name
Note Preconfigured data rates for each AP (RAP=18 Mbps, MAP1=36 Mbps) are preserved after the upgrade to 6.0 or later software releases.
Before you upgrade to the 6.0 release, if you have the backhaul data rate configured to any data rate, then the configuration is preserved.
This example shows how to configure a backhaul rate of 36000 Kbps on a RAP:
Backhaul capacity and throughput depends upon the type of the AP, that is, if it is 802.11a/n or only 802.11a, number of backhaul radios it has, and so on.
In AP1524 SB, Slot 2 in the 5-GHz radio in the RAP is used to extend the backhaul in the downlink direction, whereas Slot 2 in the 5-GHz radio in the MAP is used for backhaul in the uplink. We recommend using a directional antenna with the Slot 2 radio. MAPs extend Slot 1 radio in the downlink direction with Omni or directional antenna also providing client access. Client access can be provided on the Slot 2 radio from the 7.0 release onwards.
AP1524SB provides you with better throughput, and throughput rarely degrades after the first hop. The performance of AP1524SB is better than AP1522 and AP1524PS because these APs have only a single radio for the backhaul uplink and downlink (see Figure 10-16 , Figure 10-17 , Figure 10-18 , and Figure 10-19 ).
Figure 10-16 1524SB TCP Downstream Rate Auto
Figure 10-17 1522 TCP 54 Mbps Downstream
Note With DRA, each hop uses the best possible data rate for the backhaul. The data rate can be changed on a per-AP basis.
Figure 10-18 1524SB TCP Downstream Rate Auto
Figure 10-19 1524 TCP Downstream (24 Mbps)
Note Using 1552 802.11n provides you higher throughput and more capacity. It offers a very fat backhaul pipe to start with from the RAP.
Figure 10-20 AP1552 Backhaul Throughput
For security reasons, the Ethernet port on all MAPs is disabled by default. It can be enabled only by configuring Ethernet bridging on the root and its respective MAP.
Note Exceptions are allowed for a few protocols even though Ethernet bridging is disabled. For example, the following protocols are allowed:
– Spanning Tree Protocol (STP)
– Address Resolution Protocol (ARP)
– Control And Provisioning of Wireless Access Points (CAPWAP)
– Bootstrap Protocol (BOOTP) packets
Due to the exceptions and to prevent loop issues, we recommend that you do not connect two MAPs to each other over their Ethernet ports, unless they are configured as trunk ports on different native VLANs, and each is connected to a similarly configured switch.
Ethernet bridging has to be enabled for two scenarios:
1. When you want to use the mesh nodes as bridges. (See Figure 10-21.)
Note You do not need to configure VLAN tagging to use Ethernet bridging for point-to-point and point-to-multipoint bridging deployments.
2. When you want to connect any Ethernet device such as a video camera on the MAP using its Ethernet port. This is the first step to enable VLAN tagging.
Figure 10-21 Point-to-Multipoint Bridging
Step 1 Choose Wireless > All APs .
Step 2 Click the AP name link of the mesh access point on which you want to enable Ethernet bridging.
Step 3 At the details page click the Mesh tab.
Figure 10-22 All APs > Details for (Mesh) Page
Step 4 Select either RootAP or MeshAP from the AP Role drop-down list, if not already selected.
Step 5 Select the Ethernet Bridging check box to enable Ethernet bridging or deselect it to disable this feature.
Step 6 Click Apply to commit your changes. An Ethernet Bridging section appears at the bottom of the page listing each of the Ethernet ports of the mesh access point.
Step 7 Ensure that you enable Ethernet bridging for every parent mesh AP taking the path from the mesh AP in question to the controller. For example, if you enable Ethernet bridging on MAP2 in Hop 2, then you must also enable Ethernet bridging on MAP1 (parent MAP), and on the RAP connecting to the controller.
Bridge group names (BGNs) control the association of mesh access points. BGNs can logically group radios to avoid two networks on the same channel from communicating with each other. The setting is also useful if you have more than one RAP in your network in the same sector (area). BGN is a string of 10 characters maximum.
A BGN of NULL VALUE is assigned by default by manufacturing. Although not visible to you, it allows a mesh access point to join the network prior to your assignment of your network-specific BGN.
If you have two RAPs in your network in the same sector (for more capacity), we recommend that you configure the two RAPs with the same BGN, but on different channels.
config ap bridgegroupname set bridge-group-name
Infomation similar to the following appears:
The mesh access point reboots after a BGN configuration.
show ap config general AP_Name
Information similar to the following is displayed.
Step 1 Click Wireless > Access Points > AP Name . The details page for the selected mesh access point appears.
Step 2 Click the Mesh tab. Details for the mesh access point including the BGN appears.
A public safety band (4.9 GHz) is supported on the AP1522 and AP1524PS.
Figure 10-24 AP 1524PS Diagram Showing Radio Placement
– In Japan, 4.9 GHz is enabled by default as 4.9 GHz is unlicensed.
– For client access on the 4.9-GHz band on the AP1522, you have to enable the feature universal client access .
The 4.9-GHz subband radio on the AP1524PS supports public safety channels within the 5-MHz (channels 1 to 10), 10-MHz (channels 11 to 19), and 20-MHz (channels 20 to 26) bandwidths.
Note • Those AP1522s with serial numbers prior to FTX1150XXXX do not support 5 and 10 MHz channels on the 4.9-GHz radio; however, a 20-MHz channel is supported.
When you attempt to enable the 4.9-GHz band, you get a warning that the band is a licensed band in most parts of the world.
Figure 10-25 Public Safety Warning During Configuration
Wireless > Access Points > 802.11a radio > Configure (from the Antenna drop-down list)
Cisco AP1522 and AP1524PS can interoperate with the Cisco 3200 on the public safety channel (4.9-GHz) as well as the 2.4-GHz access and 5.8-GHz backhaul.
The Cisco 3200 creates an in-vehicle network in which devices such as PCs, surveillance cameras, digital video recorders, printers, PDAs, and scanners can share wireless networks such as cellular or WLAN based services back to the main infrastructure. This feature allows data collected from in-vehicle deployments such as a police cars to be integrated into the overall wireless infrastructure.
This section provides configuration guidelines and step-by-step instructions for configuring interoperability between the Cisco 3200 and the AP1522 and the AP1524PS.
For specific interoperability details between series 1130, 1240, and 1520 (1522, 1524PS) mesh access points and Cisco 3200 see the table below.
1552, 15222 |
|
– Channels 20 (4950 GHz) through 26 (4980 GHz) and subband channels 1 through 19 (5 and 10 MHz) are used for Cisco 3200 interoperability. This configuration change is made on the controller. No changes are made to the mesh access point configuration.
– Channel assignments are only made to the RAP. Updates to the MAP are propagated by the RAP.
The default channel width for Cisco 3200s is 5 MHz. You must either change the channel width to 10 or 20 MHz to enable WGBs to associate with the AP1522 and AP1524PS or change the channel on the AP1522 or AP1524PS to a channel in the 5-MHz band (channels 1 to 10) or 10-MHz band (channels 11 to 19).
Step 1 To enable the backhaul for client access, choose Wireless > Mesh to access the Mesh page.
Step 2 Select the Backhaul Client Access Enabled check box to allow wireless client association over the 802.11a radio. Click Apply .
Note You are prompted with a message to allow reboot of all the mesh access points to enable Backhaul Client Access on a network. Click OK.
Step 3 To assign the channel to use for the backhaul (channels 20 through 26), click Wireless > Access Points > Radio and select 802.11a/n from the Radio subheading. A summary page for all 802.11a radios appears.
Step 4 At the Antenna drop-down list for the appropriate RAP, select Configure . The Configure page appears.
Figure 10-26 Wireless > Access Points > Radio > 802.11 a/n > Configure Page
Step 5 At the RF Channel Assignment section, choose the WLC Controlled option for the Assignment Method option and choose any channel between 1 and 26.
Step 6 Click Apply to commit your changes.
Step 7 Click Save Configuration to save your changes.
Step 1 To enable client access mode on the AP1522, enter this command:
config mesh client-access enable
Step 2 To enable the public safety on a global basis, enter this command:
config mesh public-safety enable all
Step 3 To enable the public safety channels, enter these commands:
a. On the AP1522, enter these commands:
config 802.11a disable Cisco_MAP
config 802.11a channel ap Cisco_MAP channel number
config 802.11a enable Cisco_MAP
b. On the AP1524PS, enter these commands:
config 802.11–a49 disable Cisco_MAP
config 802.11–a49 channel ap Cisco_MAP channel number
config 802.11–a49 enable Cisco_MAP
Note Enter the config 802.11–a58 enable Cisco_MAP command to enable a 5.8-GHz radio.
Note For both the AP1522 and AP1524PS, channel number is equal to any value 1 to 26.
Step 4 To save your changes, enter this command:
Step 5 To verify your configuration, enter these commands:
show ap config 802.11a summary (1522 only)
show ap config 802.11–a49 summary (1524PS only)
Note Enter the show config 802.11-a58 summary command to display configuration details for a 5.8-GHz radio.
The backhaul channel (802.11a/n) can be configured on a RAP. MAPs tune to the RAP channel. The local access can be configured independently for MAP.
Step 1 Choose Wireless > Access Points > 802.11a/n .
The Access Points > 802.11a/n Radios page appears.
Figure 10-27 Access Points > 802.11a/n Radios Page
Note In Figure 10-27, radio slots are displayed for each radio. For an AP1524SB, the 802.11a radio will display for slots 1 and 2 that operate in the 5-GHz band. For an AP1524PS, the 802.11a radio will display for slots 1 and 2, operating in the 5-GHz and 4.9-GHz bands respectively.
Step 2 From the Antenna drop-down list for the 802.11a/n radio, choose configure . The Configure page appears.
Note For the 1524SB, choose the Antenna drop-down list for a RAP with a radio role of downlink.
Figure 10-28 802.11a/n Cisco APs > Configure Page
Step 3 Assign a channel (assignment methods of AP Controlled and WLC Controlled) for the radio.
Note When you assign a channel to the AP1524SB, choose the WLC Controlled assignment method, and select one of the supported channels for the 5-GHz band.
Step 4 Assign Tx power levels (AP Controlled and WLC Controlled) for the radio.
There are five selectable power levels for the 802.11a backhaul for AP1500s.
Note The default Tx power level on the backhaul is the highest power level (Level 1).
Note Radio Resource Management (RRM) is OFF (disabled) by default. RRM cannot be turned ON (enabled) for the backhaul.
Step 5 Click Apply when power and channel assignment are complete.
Step 6 From the 802.11a/n Radios page, verify that channel assignments were made correctly.
Figure 10-29 Channel Assignment
Step 1 To configure the backhaul channel on the radio in slot 2 of the RAP, enter this command:
config slot 2 channel ap Cisco_RAPSB channel
The available channels for the 5.8-GHz band are 149, 153, 157, 161, and 165.
Step 2 To configure the transmit power level on the radio in slot 2 of the RAP, enter this command:
config slot 2 txPower ap Cisco_RAPSB power
Valid values are 1 through 5; the default value is 1.
Step 3 To display the configurations on the mesh access points, enter these commands:
Information similar to the following appears:
Information similar to the following appears:
Information similar to the following appears:
You must configure the antenna gain for the mesh access point to match that of the antenna installed using the controller GUI or controller CLI.
Step 1 Choose Wireless > Access Points > Radio > 802.11a/n to open the 802.11a/n Radios page.
Step 2 For the mesh access point antenna you want to configure, hover the mouse over the blue arrow (far right) to display antenna options. Choose Configure .
Note Only external antennas have configurable gain settings.
Figure 10-30 802.11a/n Radios Page
Step 3 In the Antenna Parameters section, enter the antenna gain.
The gain is entered in 0.5 dBm units. For example, 2.5 dBm = 5.
Note The entered gain value must match that value specified by the vendor for that antenna.
Figure 10-31 802.11 a/n Cisco APs > Configure Page
Step 4 Click Apply and Save Configuration to save the changes.
Enter this command to configure the antenna gain for the 802.11a backhaul radio using the controller CLI:
config 802.11a antenna extAntGain antenna_gain AP_name
where gain is entered in 0.5-dBm units (for example, 2.5 dBm =5).
This feature is applicable to mesh APs with two 5-GHz radios, such as 1524SB (serial backhaul).
The backhaul channel deselection feature helps you to restrict the set of channels available to be assigned for the serial backhaul MAPs and RAPs. Because 1524SB MAP channels are automatically assigned, this feature helps in regulating the set of channels that get assigned to mesh access points. For example, if you do not want channel 165 to get assigned to any of the 1524SB mesh access points, you need to remove channel 165 from the DCA list and enable this feature.
When you remove certain channels from the DCA list and enable the mesh backhaul dca-channel command, those channels will not be assigned to any serial backhaul access points in any scenario. Even if a radar is detected on all channels within the DCA list channels, the radio will be shut down rather than moved to channels outside it. A trap message is sent to the WCS, and the message is displayed showing that the radio has been shut down because of DFS. You will not be able to assign channels to the serial backhaul RAP outside of the DCA list with the config mesh backhaul dca-channels enable command enabled. However, this is not case for the APs with one 5-GHz radio such as 1552, 1522, and 1524PS APs. For these APs, you can assign any channel outside of the DCA list for a RAP, and the controller/AP can also select a channel outside of the DCA list if no radar-free channel is available from the list.
This feature is best suited in an interoperability scenario with indoor mesh access points or workgroup bridges that support a channel set that is different from outdoor access points. For example, channel 165 is supported by outdoor access points but not by indoor access points in the -A domain. By enabling the backhaul channel deselection feature, you can restrict the channel assignment to only those channels that are common to both indoor and outdoor access points.
Note Channel deselection is applicable to 7.0 and later releases.
In some scenarios, there may be two linear tracks or roads for mobility side by side. Because channel selection of MAPs happens automatically, there can be a hop at a channel, which is not available on the autonomous side, or the channel has to be skipped when the same or adjacent channel is selected in a neighborhood access point that belongs to a different linear chain.
Step 1 Choose Controller > Wireless > 802.11a/n > RRM > DCA .
The Dynamic Channel Assignment Algorithm page appears.
Step 2 Select one or more channels to include in the DCA list.
The channels included in the DCA list will not be assigned to the access points associated to this controller during automatic channel assignment.
Step 3 Choose Wireless > Mesh .
Step 4 Select the Mesh DCA Channels check box to enable the backhaul channel deselection using the DCA list. This option is applicable for serial backhaul access points.
Step 5 After you enable the backhaul deselection option, choose Wireless > Access Points > Radios > 802.11a/n to configure the channel for the RAP downlink radio.
Step 6 From the list of access points, click on the Antenna drop-down list for a RAP and choose Configure .
Step 7 In the RF Backhaul Channel assignment section, choose Custom .
Step 8 Select a channel for the RAP downlink radio from the drop-down list, which appears when you choose Custom .
Step 9 Click Apply to apply and save the backhaul channel deselection configuration changes.
Step 1 To review the channel list already configured in the DCA list, enter this command:
Information similar to the following appears:
Step 2 To add a channel to the DCA list, enter the config advanced 802.11a channel add channel number command, where channel number is the channel number that you want to add to the DCA list.
You can also delete a channel from the DCA list by entering the config advanced 802.11a channel delete channel number command, where channel number is the channel number that you want to delete from the DCA list.
Before you add or delete a channel to or from the DCA list, ensure that the 802.11a network is disabled.
config 802.11a disable network
You cannot directly delete a channel from the DCA list if it is assigned to any 1524 RAP. To delete a channel assigned to a RAP, you must first change the channel assigned to the RAP and then enter the config advanced 802.11a channel delete channel number command from the controller.
The following is a sample output of the add channel and delete channel commands:
Step 3 After a suitable DCA list has been created, enter the config mesh backhaul dca-channels enable command to enable the backhaul channel deselection feature for mesh access points.
You can enter the config mesh backhaul dca-channels disable command if you want to disable the backhaul channel deselection feature for mesh access points.
It is not required that you disable 802.11a network to enable or disable this feature.
Information similar to the following appears:
Step 4 To check the current status of the backhaul channel deselection feature, enter the show mesh config command.
Information similar to the following appears:
Step 5 Enter the config slot slot number channel ap ap-name channel number command to assign a particular channel to the 1524 RAP downlink radio.
Slot 2 of the 1524 RAP acts as a downlink radio. If backhaul channel deselection is enabled, you can assign only those channels that are available in the DCA list the access point.
The following is a sample output:
Using the controller GUI, follow these steps to specify the channels that the dynamic channel assignment (DCA) algorithm considers when selecting the channels to be used for RRM scanning. This functionality is helpful when you know that the clients do not support certain channels because they are legacy devices or they have certain regulatory restrictions.
Note The steps outlined in this section are only relevant to mesh networks.
Step 1 To disable the 802.11a/n or 802.11b/g/n network, follow these steps:
a. Choose Wireless > 802.11a/n or 802.11b/g/n > Network to open the 802.11a (or 802.11b/g) Global Parameters page.
b. Deselect the 802.11a (or 802.11b/g ) Network Status check box.
c. Click Apply to commit your changes.
Step 2 Choose Wireless > 802.11a/n or 802.11b/g/n > RRM > DCA to open the 802.11a (or 802.11b/g) > RRM > Dynamic Channel Assignment (DCA) page.
Figure 10-32 802.11a > RRM > Dynamic Channel Assignment (DCA) Page
Step 3 Choose one of the following options from the Channel Assignment Method drop-down list to specify the controller’s DCA mode:
Note The controller does not evaluate and update the channel assignment immediately after you click Invoke Channel Update Once. It waits for the next interval to elapse.
Step 4 From the Interval drop-down list, choose one of the following options to specify how often the DCA algorithm is allowed to run: 10 minutes, 1 hour, 2 hours, 3 hours, 4 hours, 6 hours, 8 hours, 12 hours, or 24 hours. The default value is 10 minutes.
Step 5 From the AnchorTime drop-down list, choose a number to specify the time of day when the DCA algorithm is to start. The options are numbers between 0 and 23 (inclusive) representing the hour of the day from 12:00 a.m. to 11:00 p.m.
Step 6 Select the Avoid Foreign AP Interference check box to cause the controller’s RRM algorithms to consider 802.11 traffic from foreign access points (those access points not included in your wireless network) when assigning channels to lightweight access points, or deselect it to disable this feature. For example, RRM may adjust the channel assignment to have access points avoid channels close to foreign access points. The default value is checked.
Step 7 Select the Avoid Cisco AP Load check box to cause the controller’s RRM algorithms to consider 802.11 traffic from Cisco lightweight access points in your wireless network when assigning channels, or deselect it to disable this feature. For example, RRM can assign better reuse patterns to access points that carry a heavier traffic load. The default value is deselected.
Step 8 Select the Avoid Non-802.11a (802.11b) Noise check box to cause the controller’s RRM algorithms to consider noise (non-802.11 traffic) in the channel when assigning channels to lightweight access points, or deselect it to disable this feature. For example, RRM may have access points avoid channels with significant interference from nonaccess point sources, such as microwave ovens. The default value is checked.
Step 9 From the DCA Channel Sensitivity drop-down list, choose one of the following options to specify how sensitive the DCA algorithm is to environmental changes such as signal, load, noise, and interference when determining whether to change channels:
The default value is Medium . The DCA sensitivity thresholds vary by radio band, as noted in Table 10-9 .
Step 10 For 802.11a/n networks only, choose one of the following Channel Width options to specify the channel bandwidth supported for all 802.11n radios in the 5-GHz band:
Note To override the globally configured DCA channel width setting, you can statically configure an access point’s radio for 20-MHz mode on the 802.11a/n Cisco APs > Configure page. If you ever change the static RF channel assignment method to WLC Controlled on the access point radio, the global DCA configuration overrides the channel width configuration that the access point was previously using.
This page also shows the following nonconfigurable channel parameter settings:
Step 11 In the DCA Channel List section, the DCA Channels field shows the channels that are currently selected. To choose a channel, select its check box in the Select column. To exclude a channel, deselect its check box.
Range:
802.11a—36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161, 165, 190, 196
802.11b/g—1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11
Default:
802.11a—36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161
802.11b/g—1, 6, 11
Note These extended UNII-2 channels in the 802.11a band do not appear in the channel list: 100, 104, 108, 112, 116, 132, 136, and 140. If you have Cisco Aironet 1500 series mesh access points in the -E regulatory domain, you must include these channels in the DCA channel list before you start operation. If you are upgrading from a previous release, verify that these channels are included in the DCA channel list. To include these channels in the channel list, select the Extended UNII-2 Channels check box.
Step 12 If you are using AP1500s in your network, you must set the 4.9-GHz channels in the 802.11a band on which they are to operate. The 4.9-GHz band is for public safety client access traffic only. To choose a 4.9-GHz channel, select its check box in the Select column. To exclude a channel, deselect its check box.
Range:
802.11a—1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26
Step 13 Click Apply to commit your changes.
Step 14 To reenable the 802.11a or 802.11b/g network, follow these steps:
a. Click Wireless > 802.11a/n or 802.11b/g/n > Network to open the 802.11a (or 802.11b/g) Global Parameters page.
b. Select the 802.11a (or 802.11b/g ) Network Status check box.
c. Click Apply to commit your changes.
Step 15 Click Save Configuration to save your changes.
To see why the DCA algorithm changed channels, click Monitor and then View All under Most Recent Traps. The trap provides the MAC address of the radio that changed channels, the previous channel and the new channel, the reason why the change occurred, the energy before and after the change, the noise before and after the change, and the interference before and after the change.
This section includes the following topics:
Until the 7.0 release, mesh used the 5-GHz radio for backhaul, and the 2.4-GHz radio was used only for client access. The reasons for using only the 5-GHz radio for backhaul are as follows:
However, under certain conditions, such as dense foliage areas, you might have needed to use the 2.4-GHz band for a backhaul because it has better penetration.
With the 7.0.116.0 release, you can configure an entire mesh network to use a single backhaul that can be either 5 GHz or 2.4 GHz.
When you specify only the RAP name as an argument to the command, the whole mesh sector changes to 2.4 GHz or 5 GHz backhaul. The warning messages indicate the change in backhaul, whether it is from 2.4 GHz to 5 GHz or vice versa.
Note The 2.4-GHz backhaul cannot be configured using the controller user interface, but only through the CLI.
Step 1 To change the backhaul, enter this command:
A message similar to the following appears:
Note When you change the 5-GHz backhaul to local client access, the 5-GHz client access frequencies on all the APs are the same, because the backhaul frequency is ported on these 5-GHz radios for client access. You need to configure these channels for a better frequency planning.
Step 1 To change the backhaul, enter the following command:
A message similar to the following appears:
Note You cannot configure the 2.4-GHz backhaul using the controller GUI, but you can configure the 2.4-GHz backhaul using the CLI.
To verify the current backhaul in use, enter the command:
Note For a 5-GHz backhaul, dynamic frequency selection (DFS) occurs only on 5 GHz and not on 2.4 GHz. The mechanism, which differs for RAP and MAP, is called a coordinated change mechanism.
When 5 GHz is converted to client access from the backhaul or 2.4 GHz is being used as backhaul, DFS works similar to how it works for a local mode AP. DFS is detected on a 5-GHz client access, and the request is sent to the controller for a new channel. Mesh adjacency is not affected for the 2.4-GHz backhaul.
Note Universal client access is available on the 2.4-GHz backhaul.
When Universal Client Access is enabled, it allows wireless client association over the backhaul radio. Generally, backhaul radio is a 5-GHz radio for most of the mesh access points except for 1522 where backhaul can be 2.4 GHz. This means that a backhaul radio can carry both backhaul traffic and client traffic.
When Universal Client Access is disabled, only backhaul traffic is sent over the backhaul radio and client association is only over the second radio(s).
Note Universal Client Access is disabled by default.
After this feature is enabled, all mesh access points reboot.
This feature is applicable to mesh access points with two or more radios (1552, 1524SB, 1522, Indoor APs in mesh mode) excluding the 1524PS.
You will be prompted that the AP will reboot if you enable Universal Client Access.
Figure 10-33 Configuring Universal Client Access Using the GUI
Use the following command to enable Universal Client Access:
With universal client access, you can have client access on the backhaul 802.11a radios in addition to the backhaul functionality. This feature is applicable to mesh access points with two or more radios (1552, 1524SB, 1522, Indoor APs in mesh mode) excluding the 1524PS.
The dual 5-GHz Universal Client Access feature is intended for the serial backhaul access point platform, which has three radio slots. The radio in slot 0 operates in the 2.4-GHz band and is used for client access. The radios in slot 1 and slot 2 operate in the 5-GHz band and are primarily used for backhaul. However, with the Universal Client Access feature, clients were allowed to associate over the slot 1 radio. But slot 2 radio was used only for backhaul. With the 7.0 release, client access over the slot 2 radio is allowed with this Dual 5-GHz Universal Access feature.
By default, client access is disabled over both the backhaul radios. Follow the guidelines to enable or disable client access on the radio slots that constitute 5-GHz radios, irrespective of the radios being used as downlinks or uplinks:
The two 802.11a backhaul radios use the same MAC address. There may be instances where a WLAN maps to the same BSSID on more than one slot. Client access on the slot 2 radio is referred to as Extended Universal Access (EUA) in this document.
You can configure Extended Universal Access using one of the following methods:
Step 1 Choose Controller > Wireless > Mesh .
The Controller GUI when Backhaul Client Access is disabled page appears.
Figure 10-34 Advanced Controller Settings for Mesh Page
Step 2 Select the Backhaul Client Access check box to display the Extended Backhaul Client Access check box.
Step 3 Select the Extended Backhaul Client Access check box and click Apply .
Figure 10-35 Advanced Controller Settings for Mesh Page
After EUA is enabled, 802.11a radios are displayed.
Figure 10-36 802.11a Radios after EUA is Enabled
Slot 2 in the 5-GHz radio in the RAPSB (serial backhaul) that is used to extend the backhaul in the DOWNLINK direction is displayed as DOWNLINK ACCESS, where slot 1 in the 5-GHz radio in the RAPSB that is used for client access is displayed as ACCESS. Slot 2 in the 5-GHz radio in the MAPSB that is used for the UPLINK is displayed as UPLINK ACCESS, and slot 1 in the MAPSB is used for the DOWNLINK ACCESS with an omnidirectional antenna that also provides the client access.
Create WLAN on the WLC with the appropriate SSID mapped to the correct interface (VLAN). After you create a WLAN, it is applied to all the radios by default. If you want to enable client access only on 802.11a radios, choose only the appropriate radio policy from the list.
Figure 10-37 Radio Policy Selection
A message similar to the following appears:
A message similar to the following appears:
config mesh client-access disable
A message similar to the following appears:
It is possible to enable client access only on slot 1 and not on slot 2 by entering this command:
Step 1 Choose Controllers > Controller IP Address > Mesh > Mesh Settings .
The WCS Mesh page when Backhaul Client Access is disabled.
Figure 10-38 Mesh Settings Page
Step 2 Select the Client Access on Backhaul Link check box to display the Extended Backhaul Client Access check box.
Step 3 Select the Extended Backhaul Client Access check box and click Apply . A message appears indicating the possible results of enabling the Extended Backhaul Client Access.
Ethernet VLAN tagging allows specific application traffic to be segmented within a wireless mesh network and then forwarded (bridged) to a wired LAN (access mode) or bridged to another wireless mesh network (trunk mode).
A typical public safety access application that uses Ethernet VLAN tagging is the placement of video surveillance cameras at various outdoor locations within a city. Each of these video cameras has a wired connection to a MAP. The video of all these cameras is then streamed across the wireless backhaul to a central command station on a wired network.
Figure 10-39 Ethernet VLAN Tagging
Ethernet VLAN tagging allows Ethernet ports to be configured as normal, access, or trunk in both indoor and outdoor implementations:
Note When VLAN Transparent is disabled, the default Ethernet port mode is normal. VLAN Transparent must be disabled for VLAN tagging to operate and to allow configuration of Ethernet ports. To disable VLAN Transparent, which is a global parameter, see the “Configuring Global Mesh Parameters” section.
Use the normal mode in applications when only a single VLAN is in use or there is no need to segment traffic in the network across multiple VLANs.
Use the access mode for applications in which information is collected from devices connected to the MAP, such as cameras or PCs, and then forwarded to the RAP. The RAP then applies tags and forwards traffic to a switch on the wired network.
Ethernet VLAN tagging operates on Ethernet ports that are not used as backhauls.
Note In the controller releases prior to 7.2, the Root Access Point (RAP) native VLAN is forwarded out of Mesh Access Point (MAP) Ethernet ports with Mesh Ethernet Bridging and VLAN Transparent enabled.
In the 7.2 and later controller releases, the Root Access Point (RAP) native VLAN is not forwarded out of Mesh Access Point (MAP) Ethernet ports with Mesh Ethernet Bridging and VLAN Transparent enabled.
This change in behavior increases reliability and minimizes the possibility of forwarding loops on Mesh Backhauls.
Figure 10-40 Wireless > Mesh Page
– On AP1500s, three of the four ports can be used as secondary Ethernet interfaces: port 0-PoE in, port 1-PoE out, and port 3- fiber. Port 2 - cable cannot be configured as a secondary Ethernet interface.
– In Ethernet VLAN tagging, port 0-PoE in on the RAP is used to connect to the trunk port of the switch of the wired network. Port 1-PoE out on the MAP is used to connect to external devices such as video cameras.
Figure 10-41 Warning Message Displays for Backhaul Configuration Attempts
– This includes the RAP uplink Ethernet port. The required configuration occurs automatically using a registration mechanism.
– Any configuration changes to an 802.11a Ethernet link acting as a backhaul are ignored and a warning results. When the Ethernet link no longer functions as a backhaul, the modified configuration is applied.
– The trunk port on the switch and the RAP trunk port must match.
– The RAP must always connect to the native VLAN ID 1 on a switch. The RAP’s primary Ethernet interface is by default the native VLAN of 1.
– The switch port in the wired network that is attached to the RAP (port 0–PoE in) must be configured to accept tagged packets on its trunk port. The RAP forwards all tagged packets received from the mesh network to the wired network.
– No VLANs, other than those destined for the mesh sector, should be configured on the switch trunk port.
To support a VLAN on a mesh access point, all the uplink mesh access points must also support the same VLAN to allow segregation of traffic that belongs to different VLANs. The activity by which a mesh access point communicates its requirements for a VLAN and gets response from a parent is known as VLAN registration.
Note VLAN registration occurs automatically. No user intervention is required.
VLAN registration is summarized below:
1. Whenever an Ethernet port on a mesh access point is configured with a VLAN, the port requests its parent to support that VLAN.
2. If the parent is able to support the request, it creates a bridge group for the VLAN and propagates the request to its parent. This propagation continues until the RAP is reached.
3. When the request reaches the RAP, it checks whether it is able to support the VLAN request. If yes, the RAP creates a bridge group and a subinterface on its uplink Ethernet interface to support the VLAN request.
4. If the mesh access point is not able to support the VLAN request by its child, at any point, the mesh access point replies with a negative response. This response is propagated to downstream mesh access points until the mesh access point that requested the VLAN is reached.
5. Upon receiving negative response from its parent, the requesting mesh access point defers the configuration of the VLAN. However, the configuration is stored for future attempts. Given the dynamic nature of mesh, another parent and its uplink mesh access points might be able to support it in the case of roaming or a CAPWAP reconnect.
You must enable Ethernet bridging before you can configure VLAN tagging. See the Configuring Ethernet Bridging.
Step 1 After enabling Ethernet bridging, choose Wireless > All APs .
Step 2 Click the AP name link of the mesh access point on which you want to enable VLAN tagging.
Step 3 On the details page, select the Mesh tab.
Figure 10-42 All APs > Details for (Mesh) Page
Step 4 Select the Ethernet Bridging check box to enable the feature and click Apply .
An Ethernet Bridging section appears at the bottom of the page listing each of the four Ethernet ports of the mesh access point.
a. Choose access from the mode drop-down list.
b. Enter a VLAN ID. The VLAN ID can be any value between 1 and 4095.
Note VLAN ID 1 is not reserved as the default VLAN.
Note A maximum of 16 VLANs are supported across all of a RAP’s subordinate MAP.
a. From the mode drop-down list, choose trunk . (See Figure 10-44.)
b. Specify a native VLAN ID for incoming traffic. The native VLAN ID can be any value between 1 and 4095. Do not assign any value assigned to a user-VLAN (access).
A trunk VLAN ID field and a summary of configured VLANs appears at the bottom of the screen. The trunk VLAN ID field is for outgoing packets.
d. Specify a trunk VLAN ID for outgoing packets:
If forwarding untagged packets, do not change the default trunk VLAN ID value of zero. (MAP-to-MAP bridging, campus environment)
If forwarding tagged packets, enter a VLAN ID (1 to 4095) that is not already assigned. (RAP to switch on wired network).
e. Click Add to add the trunk VLAN ID to the allowed VLAN list. The newly added VLAN displays under the Configured VLANs section on the page.
Note To remove a VLAN from the list, select the Remove option from the arrow drop-down list to the right of the desired VLAN.
Figure 10-44 All APs > AP > VLAN Mappings Page
Step 6 Click Save Configuration to save your changes.
To configure a MAP access port, enter this command:
config ap ethernet 1 mode access enable AP1500-MAP 50
where AP1500-MAP is the variable AP_name and 50 is the variable access_vlan ID
To configure a RAP or MAP trunk port, enter this command:
config ap ethernet 0 mode trunk enable AP1500-MAP 60
where AP1500-MAP is the variable AP_name and 60 is the variable native_vlan ID
To add a VLAN to the VLAN allowed list of the native VLAN, enter this command:
config ap ethernet 0 mode trunk add AP1500-MAP3 65
where AP1500-MAP 3 is the variable AP_name and 65 is the variable VLAN ID
To view VLAN configuration details for Ethernet interfaces on a specific mesh access point ( AP Name ) or all mesh access points ( summary ), enter one of these commands:
To see if VLAN transparent mode is enabled or disabled, enter the following command:
A workgroup bridge (WGB) is a small standalone unit that can provide a wireless infrastructure connection for Ethernet-enabled devices. Devices that do not have a wireless client adapter to connect to the wireless network can be connected to the WGB through the Ethernet port. The WGB is associated with the root AP through the wireless interface, which means that wired clients get access to the wireless network.
A WGB is used to connect wired networks over a single wireless segment by informing the mesh access point of all the clients that the WGB has on its wired segment via IAPP messages. The data packets for WGB clients contain an additional MAC address in the 802.11 header (4 MAC headers, versus the normal 3 MAC data headers). The additional MAC in the header is the address of the WGB itself. This additional MAC address is used to route the packet to and from the clients.
WGB association is supported on all radios of every mesh access point.
In the current architecture, while an autonomous AP functions as a workgroup bridge, only one radio interface is used for controller connectivity, Ethernet interface for wired client connectivity, and other radio interface for wireless client connectivity. dot11radio 1 (5 GHz) can be used to connect to a controller (using the mesh infrastructure) and Ethernet interface for wired clients. dot11radio 0 (2.4 GHz) can be used for wireless client connectivity. Depending on the requirement, dot11radio 1 or dot11radio 0 can be used for client association or controller connectivity.
With the 7.0 release, a wireless client on the second radio of the WGB is not dissociated by the WGB upon losing its uplink to a wireless infrastructure or in a roaming scenario.
With two radios, one radio can be used for client access and the other radio can be used for accessing the access points. Having two independent radios performing two independent functions provides you better control and lowers the latency. Also, wireless clients on the second radio for the WGB do not get disassociated by the WGB when an uplink is lost or in a roaming scenario. One radio has to be configured as a Root AP (radio role) and the second radio has to be configured as a WGB (radio role).
Note If one radio is configured as a WGB, then the second radio cannot be a WGB or a repeater.
The following features are not supported for use with a WGB:
A workgroup bridge (WGB) is used to connect wired networks over a single wireless segment by informing the mesh access point of all the clients that the WGB has on its wired segment via IAPP messages. In addition to the IAPP control messages, the data packets for WGB clients contain an extra MAC address in the 802.11 header (4 MAC headers, versus the normal 3 MAC data headers). The extra MAC in the header is the address of the workgroup bridge itself. This extra MAC address is used to route the packet to and from the clients.
WGB association is supported on both the 2.4-GHz (802.11b/g) and 5-GHz (802.11a) radios on the AP1522, and the 2.4-GHz (802.11b) and 4.9-GHz (public safety) radios on the AP1524PS;
Supported platforms are autonomous WGBs AP1130, AP 1140, AP1240, AP1310, and the Cisco 3200 Mobile Router (hereafter referred to as Cisco 3200) which are configured as WGBs can associate with a mesh access point. See the “Cisco Workgroup Bridges” section in Chapter 7 of the Cisco Wireless LAN Controller Configuration Guide, Release 7.0.116.0 for configuration steps at http://www.cisco.com/en/US/products/ps6366/products_installation_and_configuration_guides_list.html
The supported WGB modes and capacities are as follows:
Note If your mesh access point has two radios, you can only configure workgroup bridge mode on one of the radios. We recommend that you disable the second radio. Workgroup bridge mode is not supported on access points with three radios such as the AP1524SB.
– Figure 10-46 displays WPA security settings for WGB (controller GUI).
– Figure 10-47 displays WPA-2 security settings for WGB (controller GUI).
Figure 10-46 WPA Security Settings for a WGB
Figure 10-47 WPA-2 Security Settings for a WGB
To view the status of a WGB client, follow these steps:
Step 1 Choose Monitor > Clients to open the client summary page .
Step 2 On the client summary page, click on the MAC address of the client or search for the client using its MAC address.
Step 3 In the page that appears, note that the client type is identified as a WGB (far right).
Figure 10-48 Clients are Identified as a WGB
Step 4 Click on the MAC address of the client to view configuration details:
Figure 10-49 Monitor > Clients > Detail Page (Wireless WGB Client)
Figure 10-50 Monitor > Clients > Detail Page (Wired WGB Client)
We recommend that you configure radio 0 (2.4 GHz) as a Root (one of the mode of operations for Autonomous AP) and radio 1 (5 GHz) as a WGB.
When you configure from the CLI, the following are mandatory:
Note A native VLAN is always mapped to bridge group 1 by default. For other VLANs, the bridge group number matches the VLAN number; for example, for VLAN 46, the bridge group is 46.
In the following example, one SSID (WGBTEST) is used in both radios, and the SSID is the infrastructure SSID mapped to NATIVE VLAN 51. All radio interfaces are mapped to bridge group -1.
You can also use the GUI of an autonomous AP for configuration. From the GUI, subinterfaces are automatically created after the VLAN is defined.
Figure 10-51 SSID Configuration Page
Both the WGB association to the controller and the wireless client association to WGB can be verified by entering the show dot11 associations client command in autonomous AP.
From the controller, choose Monitor > Clients . The WGB and the wireless/wired client behind the WGB are updated and the wireless/wired client are shown as the WGB client, as shown in Figure 10-52, Figure 10-53, and Figure 10-54.
Figure 10-52 Updated WGB Clients
Figure 10-53 Updated WGB Clients
Figure 10-54 Updated WGB Clients
Figure 10-55 shows the link test results.
Figure 10-55 Link Test Results
A link test can also be run from the controller CLI using this command:
Link tests from the controller are only limited to the WGB, and they cannot be run beyond the WGB from the controller to a wired or wireless client connected to the WGB. You can run link tests for the wireless client connected to the WGB from the WGB itself using the following command:
You can also use the following commands to know the summary of WGBs and clients associated associated with a Cisco lightweight access point:
High-speed roaming of Cisco Compatible Extension (CX), version 4 (v4) clients is supported at speeds up to 70 miles per hour in outdoor mesh deployments of AP1522s and AP1524s. An example application might be maintaining communication with a terminal in an emergency vehicle as it moves within a mesh public network.
Three Cisco CX v4 Layer 2 client roaming enhancements are supported:
Note Client roaming is enabled by default.
For more information, see the Enterprise Mobility Design Guide at http://www.cisco.com/en/US/docs/solutions/Enterprise/Mobility/emob41dg/eMob4.1.pdf
When you enable this setting, the WGB scans for a new parent association when it encounters a poor Received Signal Strength Indicator (RSSI), excessive radio interference, or a high frame-loss percentage. Using these criteria, a WGB configured as a mobile station searches for a new parent association and roams to a new parent before it loses its current association. When the mobile station setting is disabled (the default setting), a WGB does not search for a new association until it loses its current association.
This command invokes scanning to all or specified channels. There is no limitation on the maximum number of channels that can be configured. The maximum number of channels that can be configured is restricted only by the number of channels that a radio can support. When executed, the WGB scans only this limited channel set. This limited channel feature also affects the known channel list that the WGB receives from the access point to which it is currently associated. Channels are added to the known channel list only if they are also part of the limited channel set.
This example shows how to configure a roaming configuration:
Use the no mobile station scan command to restore scanning to all the channels.
Table 10-10 identifies mesh access points and their respective frequency bands that support WGB.
If a wireless client is not associated with a WGB, use the following steps to troubleshoot the problem:
1. Verify the client configuration and ensure that the client configuration is correct.
2. Check the show bridge command output in autonomous AP, and confirm that the AP is reading the client MAC address from the right interface.
3. Confirm that the subinterfaces corresponding to specific VLANs in different interfaces are mapped to the same bridge group.
4. If required, clear the bridge entry using the clear bridge command (this command will remove all wired and wireless clients associated in a WGB and make them associate again).
5. Check the show dot11 association command output and confirm that the WGB is associated with the controller.
6. Ensure that the WGB has not exceeded its 20-client limitation.
In a normal scenario, if the show bridge and show dot11 association command outputs are as expected, wireless client association should be successful.
You can configure call admission control (CAC) and QoS on the controller to manage voice and video quality on the mesh network.
The indoor mesh access points are 802.11e capable, and QoS is supported on the local 2.4-GHz access radio and the 5-GHz backhaul radio. CAC is supported on the backhaul and the CCXv4 clients (which provides CAC between the mesh access point and the client).
Note Voice is supported only on indoor mesh networks. Voice is supported on a best-effort basis in the outdoors in a mesh network.
CAC enables a mesh access point to maintain controlled quality of service (QoS) when the wireless LAN is experiencing congestion. The Wi-Fi Multimedia (WMM) protocol deployed in CCXv3 ensures sufficient QoS as long as the wireless LAN is not congested. However, to maintain QoS under differing network loads, CAC in CCXv4 or later is required.
Note CAC is supported in Cisco Compatible Extensions (CCX) v4 or later. See Chapter 6 of the Cisco Wireless LAN Controller Configuration Guide, Release 7.0 at http://www.cisco.com/en/US/docs/wireless/controller/7.0/configuration/guide/c70sol.html
Two types of CAC are available for access points: bandwidth-based CAC and load-based CAC. All calls on a mesh network are bandwidth-based, so mesh access points use only bandwidth-based CAC.
Bandwidth-based, or static CAC enables the client to specify how much bandwidth or shared medium time is required to accept a new call. Each access point determines whether it is capable of accommodating a particular call by looking at the bandwidth available and compares it against the bandwidth required for the call. If there is not enough bandwidth available to maintain the maximum allowed number of calls with acceptable quality, the mesh access point rejects the call.
Cisco supports 802.11e on the local access and on the backhaul. Mesh access points prioritize user traffic based on classification, and therefore all user traffic is treated on a best-effort basis.
Resources available to users of the mesh vary, according to the location within the mesh, and a configuration that provides a bandwidth limitation in one point of the network can result in an oversubscription in other parts of the network.
Similarly, limiting clients on their percentage of RF is not suitable for mesh clients. The limiting resource is not the client WLAN, but the resources available on the mesh backhaul.
Similar to wired Ethernet networks, 802.11 WLANs employ Carrier Sense Multiple Access (CSMA), but instead of using collision detection (CD), WLANs use collision avoidance (CA), which means that instead of each station trying to transmit as soon as the medium is free, WLAN devices will use a collision avoidance mechanism to prevent multiple stations from transmitting at the same time.
The collision avoidance mechanism uses two values called CWmin and CWmax. CW stands for contention window . The CW determines what additional amount of time an endpoint should wait, after the interframe space (IFS), to attend to transmit a packet. Enhanced distributed coordination function (EDCF) is a model that allows end devices that have delay-sensitive multimedia traffic to modify their CWmin and CWmax values to allow for statically greater (and more frequent) access to the medium.
Cisco access points support EDCF-like QoS. This provides up to eight queues for QoS.
These queues can be allocated in several different ways, as follows:
AP1500s, with Cisco controllers, provide a minimal integrated services capability at the controller, in which client streams have maximum bandwidth limits, and a more robust differentiated services (diffServ) capability based on the IP DSCP values and QoS WLAN overrides.
When the queue capacity has been reached, additional frames are dropped (tail drop).
Several encapsulations are used by the mesh system. These encapsulations include CAPWAP control and data between the controller and RAP, over the mesh backhaul, and between the mesh access point and its client(s). The encapsulation of bridging traffic (noncontroller traffic from a LAN) over the backhaul is the same as the encapsulation of CAPWAP data.
There are two encapsulations between the controller and the RAP. The first is for CAPWAP control, and the second is for CAPWAP data. In the control instance, CAPWAP is used as a container for control information and directives. In the instance of CAPWAP data, the entire packet, including the Ethernet and IP headers, is sent in the CAPWAP container.
For the backhaul, there is only one type of encapsulation, encapsulating MESH traffic. However, two types of traffic are encapsulated: bridging traffic and CAPWAP control and data traffic. Both types of traffic are encapsulated in a proprietary mesh header.
In the case of bridging traffic, the entire packet Ethernet frame is encapsulated in the mesh header (see Figure 10-57).
All backhaul frames are treated identically, regardless of whether they are MAP to MAP, RAP to MAP, or MAP to RAP.
Figure 10-57 Encapsulating Mesh Traffic
The mesh access point uses a high speed CPU to process ingress frames, Ethernet, and wireless on a first-come, first-serve basis. These frames are queued for transmission to the appropriate output device, either Ethernet or wireless. Egress frames can be destined for either the 802.11 client network, the 802.11 backhaul network, or Ethernet.
AP1500s support four FIFOs for wireless client transmissions. These FIFOs correspond to the 802.11e platinum, gold, silver, and bronze queues, and obey the 802.11e transmission rules for those queues. The FIFOs have a user configurable queue depth.
The backhaul (frames destined for another outdoor mesh access point) uses four FIFOs, although user traffic is limited to gold, silver, and bronze. The platinum queue is used exclusively for CAPWAP control traffic and voice, and has been reworked from the standard 802.11e parameters for CWmin, CWmax, and so on, to provide more robust transmission but higher latencies.
The 802.11e parameters for CWmin, CWmax, and so on, for the gold queue have been reworked to provide lower latency at the expense of slightly higher error rate and aggressiveness. The purpose of these changes is to provide a channel that is more conducive to video applications.
Frames that are destined for Ethernet are queued as FIFO, up to the maximum available transmit buffer pool (256 frames). There is support for a Layer 3 IP Differentiated Services Code Point (DSCP), so marking of the packets is there as well.
In the controller to RAP path for the data traffic, the outer DSCP value is set to the DSCP value of the incoming IP frame. If the interface is in tagged mode, the controller sets the 802.1Q VLAN ID and derives the 802.1p UP (outer) from 802.1p UP incoming and the WLAN default priority ceiling. Frames with VLAN ID 0 are not tagged.
Figure 10-58 Controller to RAP Path
For CAPWAP control traffic the IP DSCP value is set to 46, and the 802.1p user priority is set to 7. Prior to transmission of a wireless frame over the backhaul, regardless of node pairing (RAP/MAP) or direction, the DSCP value in the outer header is used to determine a backhaul priority. The following sections describe the mapping between the four backhaul queues the mesh access point uses and the DSCP values shown in Backhaul Path QoS (see Table 10-11 ).
Note The platinum backhaul queue is reserved for CAPWAP control traffic, IP control traffic, and voice packets. DHCP, DNS, and ARP requests are also transmitted at the platinum QoS level. The mesh software inspects each frame to determine whether it is a CAPWAP control or IP control frame in order to protect the platinum queue from use by non-CAPWAP applications.
For a MAP to the client path, there are two different procedures, depending on whether the client is a WMM client or a normal client. If the client is a WMM client, the DSCP value in the outer frame is examined, and the 802.11e priority queue is used (see Table 10-12 ).
If the client is not a WMM client, the WLAN override (as configured at the controller) determines the 802.11e queue (bronze, gold, platinum, or silver), on which the packet is transmitted.
For a client of a mesh access point, there are modifications made to incoming client frames in preparation for transmission on the mesh backhaul or Ethernet. For WMM clients, a MAP illustrates the way in which the outer DSCP value is set from an incoming WMM client frame (see Figure 10-59).
The minimum value of the incoming 802.11e user priority and the WLAN override priority is translated using the information listed in Table 10-13 to determine the DSCP value of the IP frame. For example, if the incoming frame has as its value a priority indicating the gold priority, but the WLAN is configured for the silver priority, the minimum priority of silver is used to determine the DSCP value.
If there is no incoming WMM priority, the default WLAN priority is used to generate the DSCP value in the outer header. If the frame is an originated CAPWAP control frame, the DSCP value of 46 is placed in the outer header.
With the 5.2 code enhancements, DSCP information is preserved in an AWPP header.
All wired client traffic is restricted to a maximum 802.1p UP value of 5, except DHCP/DNS and ARP packets, which go through the platinum queue.
The non-WMM wireless client traffic gets the default QoS priority of its WLAN. The WMM wireless client traffic may have a maximum 802.11e value of 6, but it must be below the QoS profile configured for its WLAN. If admission control is configured, WMM clients must use TSPEC signaling and get admitted by CAC.
The CAPWAPP data traffic carries wireless client traffic and has the same priority and treatment as wireless client traffic.
Now that the DSCP value is determined, the rules described earlier for the backhaul path from the RAP to the MAP are used to further determine the backhaul queue on which the frame is transmitted. Frames transmitted from the RAP to the controller are not tagged. The outer DSCP values are left intact, as they were first constructed.
Bridging services are treated a little differently from regular controller-based services. There is no outer DSCP value in bridging packets because they are not CAPWAP encapsulated. Therefore, the DSCP value in the IP header as it was received by the mesh access point is used to index into the table as described in the path from the mesh access point to the mesh access point (backhaul).
Packets received from a station on a LAN are not modified in any way. There is no override value for the LAN priority. Therefore, the LAN must be properly secured in bridging mode. The only protection offered to the mesh backhaul is that non-CAPWAP control frames that map to the platinum queue are demoted to the gold queue.
Packets are transmitted to the LAN precisely as they are received on the Ethernet ingress at entry to the mesh.
The only way to integrate QoS between Ethernet ports on AP1500 and 802.11a is by tagging Ethernet packets with DSCP. AP1500s take the Ethernet packet with DSCP and places it in the appropriate 802.11e queue.
AP1500s do not tag DSCP itself:
Ethernet devices, such as video cameras, should have the capability to mark the bits with DSCP value to take advantage of QoS.
Note QoS only is relevant when there is congestion on the network.
– Coverage hole of 2 to 10 percent
– Cell coverage overlap of 15 to 20 percent
– Voice needs RSSI and SNR values that are at least 15 dB higher than data requirements
– RSSI of -67 dBm for all data rates should be the goal for 11b/g/n and 11a/n
– SNR should be 25 dB for the data rate used by client to connect to the AP
– Packet error rate (PER) should be configured for a value of one percent or less
– Channel with the lowest utilization (CU) must be used
– Enable dynamic target power control (DTPC).
– Disable all data rates less than 11 Mbps.
– Load-based CAC must be disabled.
– Enable admission control (ACM) for CCXv4 or v5 clients that have WMM enabled. Otherwise, bandwidth-based CAC does not operate properly.
– Set the maximum RF bandwidth to 50 percent.
– Set the reserved roaming bandwidth to 6 percent.
– Enable traffic stream metrics.
– Set the EDCA profile for the interface as voice optimized.
– Create a voice profile and select 802.1Q as the wired QoS protocol type.
– Select a QoS of platinum for voice and gold for video on the backhaul.
– Select allowed as the WMM policy.
– Select CCKM for authorization ( auth ) key management ( mgmt ) if you want to support fast roaming. See the “Client Roaming” section.
Table 10-14 shows the actual calls in a clean, ideal environment.
Table 10-15 shows the actual calls in a clean, ideal environment.
While making a call, observe the MOS score of the call on the 7921 phone (see Table 10-16 ). A MOS score between 3.5 and 4 is acceptable.
Use the commands in this section to view details on voice and video calls on the mesh network:
Note See Figure 10-60 when using the CLI commands and viewing their output.
Figure 10-60 Mesh Network Example
Information similar to the following appears:
show mesh cac bwused { voice | video } AP_name
Information similar to the following appears:
Note The bars (|) to the left of the AP Name field indicate the number of hops that the MAP is from its RAP.
Note When the radio type is the same, the backhaul bandwidth utilization (bw used/max) at each hop is identical. For example, mesh access points map1, map2, map3, and rap1 are all on the same radio backhaul (802.11a) and are using the same bandwidth (3048). All of the calls are in the same interference domain. A call placed anywhere in that domain affects the others.
Information similar to the following appears:
Note Each call received by a mesh access point radio causes the appropriate calls summary column to increment by one. For example, if a call is received on the 802.11b/g radio on map2, then a value of one is added to the existing value in that radio’s calls column. In this case, the new call is the only active call on the 802.11b/g radio of map2. If one call is active when a new call is received, the resulting value is two.
show mesh cac callpath AP_name
Information similar to the following appears:
Note The calls column for each mesh access point radio in a call path increments by one. For example, for a call that initiates at map2 (show mesh cac call path SB_MAP2) and terminates at rap1 by way of map1, one call is added to the map2 802.11b/g and 802.11a radio calls column, one call to the map1 802.11a backhaul radio calls column, and one call to the rap1 802.11a backhaul radio calls column.
show mesh cac rejected AP_name
Information similar to the following appears:
Note If a call is rejected at the map2 802.11b/g radio, its calls column increments by one.
Information similar to the following appears:
Overflows—The total number of packets dropped due to queue overflow.
Peak Length—The peak number of packets waiting in the queue during the defined statistics time interval.
Average Length—The average number of packets waiting in the queue during the defined statistics time interval.
You can use the controller CLI to configure three mesh multicast modes to manage video camera broadcasts on all mesh access points. When enabled, these modes reduce unnecessary multicast transmissions within the mesh network and conserve backhaul bandwidth.
Mesh multicast modes determine how bridging-enabled access points MAP and RAP send multicasts among Ethernet LANs within a mesh network. Mesh multicast modes manage non-CAPWAP multicast traffic only. CAPWAP multicast traffic is governed by a different mechanism.
The three mesh multicast modes are as follows:
Note When an HSRP configuration is in operation on a mesh network, we recommend the In-Out multicast mode be configured.
– In-out mode is the default mode.
– If multicast packets are received at a MAP over Ethernet, they are sent to the RAP; however, they are not sent to other MAP over Ethernet, and the MAP to MAP packets are filtered out of the multicast.
– If multicast packets are received at a RAP over Ethernet, they are sent to all the MAPs and their respective Ethernet networks. When the in-out mode is in operation, it is important to properly partition your network to ensure that a multicast sent by one RAP is not received by another RAP on the same Ethernet segment and then sent back into the network.
Note If 802.11b clients need to receive CAPWAP multicasts, then multicast must be enabled globally on the controller as well as on the mesh network (using the config network multicast global enable CLI command). If multicast does not need to extend to 802.11b clients beyond the mesh network, the global multicast parameter should be disabled (using the config network multicast global disable command).
To enable multicast mode on the mesh network to receive multicasts from beyond the mesh networks, enter these commands:
config network multicast global enable
config mesh multicast { regular | in | in-out }
To enable multicast mode only the mesh network (multicasts do not need to extend to 802.11b clients beyond the mesh network), enter these commands:
config network multicast global disable
config mesh multicast { regular | in | in-out }
Note Multicast for mesh networks cannot be enabled using the controller GUI.
IGMP snooping delivers improved RF usage through selective multicast forwarding and optimizes packet forwarding in voice and video applications.
A mesh access point transmits multicast packets only if a client is associated with the mesh access point that is subscribed to the multicast group. So, when IGMP snooping is enabled, only that multicast traffic relevant to given hosts is forwarded.
To enable IGMP snooping on the controller, enter this command:
configure network multicast igmp snooping enable
A client sends an IGMP join that travels through the mesh access point to the controller. The controller intercepts the join and creates a table entry for the client in the multicast group. The controller then proxies the IGMP join through the upstream switch or router.
You can query the status of the IGMP groups on a router by entering this command:
For Layer 3 roaming, an IGMP query is sent to the client’s WLAN. The controller modifies the client’s response before forwarding and changes the source IP address to the controller’s dynamic interface IP address.
The network hears the controller’s request for the multicast group and forwards the multicast to the new controller.
For more information about video, see the following:
Until the 7.0 release, mesh APs supported only the Manufactured Installed Certificate (MIC) to authenticate and get authenticated by controllers to join the controller. You might have had to have your own public key infrastructure (PKI) to control CAs, to define policies, to define validity periods, to define restrictions and usages on the certificates that are generated, and get these certificates installed on the APs and controllers. After these customer-generated or locally significant certificates (LSCs) are present on the APs and controllers, the devices start using these LSCs, to join, authenticate, and derive a session key. Cisco supported normal APs from the 5.2 release and later releases and extended the support for mesh APs as well from the 7.0 release.
With the 7.0.116.0 release, the following functionality has been added:
Mesh APs try to join a controller with an LSC until its lonely timer expires and the AP reboots. The lonely timer is set for 40 minutes. After the reboot, the AP tries to join a controller with an MIC. If the AP is again not able to join a controller with an MIC in 40 minutes, the AP reboots and then tries to join a controller with an LSC.
Note An LSC in mesh APs is not deleted. An LSC is deleted in mesh APs only when the LSC is disabled on the controller, which causes the APs to reboot.
CAPWAP APs use LSC for DTLS setup during a JOIN irrespective of the AP mode. Mesh APs also use the certificate for mesh security, which involves a dot1x authentication with the controller (or an external AAA server), through the parent AP. After the mesh APs are provisioned with an LSC, they need to use the LSC for this purpose because MIC will not be read in.
Mesh APs use a statically configured dot1x profile to authenticate.
This profile is hardcoded to use "cisco" as the certificate issuer. This profile needs to be made configurable so that vendor certificates can be used for mesh authentication (enter the config local-auth eap-profile cert-issuer vendor "prfMaP1500LlEAuth93" command).
You must enter the config mesh lsc enable/disable command to enable or disable an LSC for mesh APs. This command will cause all the mesh APs to reboot.
Note An LSC on mesh is open for very specific Oil and Gas customers with the 7.0 release. Initially, it is a hidden feature. The config mesh lsc enable/disable is a hidden command. Also, the config local-auth eap-profile cert-issuer vendor "prfMaP1500LlEAuth93" command is a normal command, but the "prfMaP1500LlEAuth93" profile is a hidden profile, and is not stored on the controller and is lost after the controller reboot.
LSC-provisioned APs have both LSC and MIC certificates, but the LSC certificate will be the default one. The verification process consists of the following two steps:
1. The controller sends the AP the MIC device certificate, which the AP verifies with the MIC CA.
2. The AP sends the LSC device certificate to the controller, which the controller verifies with the LSC CA.
Step 1 Enable LSC and provision the LSC CA certificate in the controller.
config local-auth eap-profile cert-issuer vendor prfMaP1500LlEAuth93
Step 3 Turn on the feature by entering this command:
config mesh lsc { enable | disable }
Step 4 Install the CA and ID cert on the controller (or any other authentication server) from the same certificate server.
Step 5 Connect the mesh AP through Ethernet and provision for an LSC certificate.
Step 6 Let the mesh AP get a certificate and join the controller using the LSC certificate. See Figure 10-61 and Figure 10-62.
Figure 10-61 Local Significant Certificate
Figure 10-62 AP Policy Configuration
The following commands are related to LSCs:
– enable —To enable an LSC on the system.
– disable —To disable an LSC on the system. Use this keyword to remove the LSC device certificate and send a message to an AP, to do the same and disable an LSC, so that subsequent joins could be made using the MIC/SSC. The removal of the LSC CA cert on the WLC should be done explicitly by using the CLI to accommodate any AP that has not transitioned back to the MIC/SSC.
This command configures the URL to the CA server for getting the certificates. The URL contains either the domain name or the IP address, port number (typically=80), and the CGI-PATH. The following format is an example:
Only one CA server is allowed to be configured. The CA server has to be configured to provision an LSC.
This command deletes the CA server configured on the WLC.
This command adds or deletes the LSC CA certificate into/from the WLC's CA certificate database as follows:
– add —Queries the configured CA server for a CA certificate using the SSCEP getca operation, and gets into the WLC and installs it permanently into the WLC database. If installed, this CA certificate is used to validate the incoming LSC device certificate from the AP.
– delete —Deletes the LSC CA certificate from the WLC database.
This command configures the parameters for the device certificate that will be created and installed on the controller and the AP.
All of these strings have 64 bytes, except for the Country that has a maximum of 3 bytes. The Common Name will be autogenerated using its Ethernet MAC address. This should be given prior to the creation of the controller device certificate request.
The above parameters are sent as an LWAPP payload to the AP, so that the AP can use these parameters to generate the certReq. The CN is autogenerated on the AP using the current MIC/SSC "Cxxxx-MacAddr" format, where xxxx is the product number.
The keysize and validity configurations have defaults. Therefore, it is not mandatory to configure them.
1. The keysize can be from 360 to 2048 (the default is 2048 bits).
2. The validity period can be configured from 1 to 20 years (the default is 10 years).
This command enables or disables the provisioning of the LSCs on the APs if the APs just joined using the SSC/MIC. If enabled, all APs that join and do not have the LSC will get provisioned.
If disabled, no more automatic provisioning will be done. This command does not affect the APs, which already have LSCs in them.
This command is recommended when the CA server is a Cisco IOS CA server. The WLC can use the RA to encrypt the certificate requests and make communication more secure. RA certificates are not currently supported by other external CA servers, such as MSFT.
– add —Queries the configured CA server for an RA certificate using the SCEP operation and installs it into the WLC Database. This keyword is used to get the certReq signed by the CA.
– delete —Deletes the LSC RA certificate from the WLC database.
After getting the LSC, an AP tries to join the WLC. Before the AP tries to join the WLC, this command must be executed on the WLC console. Execution of this command is mandatory. By default, the config auth-list ap-policy lsc command is in the disabled state, and in the disabled state, the APs are not allowed to join the WLC using the LSC.
After getting the MIC, an AP tries to join the WLC. Before the AP tries to join the WLC, this command must be executed on the WLC console. Execution of this command is mandatory. By default, the config auth-list ap-policy mic command is in the enabled state. If an AP cannot join because of the enabled state, this log message in the WLC side is displayed: LSC/MIC AP is not allowed to join by config.
The following are the WLC show commands:
This command displays the LSC certificates installed on the WLC. It would be the CA certificate, device certificate, and optionally, an RA certificate if the RA certificate has also been installed. It also indicates if an LSC is enabled or not.
This command displays the status of the provisioning of the AP, whether it is enabled or disabled, and whether a provision list is present or not.
This command displays the list of MAC addresses present in the AP provisioning lists.
Although the settings are not directly related to the feature, it may help you in achieving the desired behavior with respect to APs provisioned with an LSC.
Figure 10-63 shows three possible cases for mesh AP MAC authorization and EAP.
Figure 10-63 Possible Cases for Mesh AP MAC Authorization and EAP
Add the MAC address of RAP/MAP to the controller MAC filter list.
Enter the following command on the WLC:
Check only the external MAC filter authorization on the GUI page and follow these guidelines:
– Do not add the MAC address of the RAP/MAP to the controller MAC filter list.
– Configure the external radius server details on the WLC.
– Enter the config macfilter mac-delimiter colon command configuration on the WLC.
– Add the MAC address of the RAP/MAP in the external radius server in the following format:
User name: 11:22:33:44:55:66 Password : 11:22:33:44:55:66
Configure the external radius server details on the WLC and apply the following configuration on the controller:
Add the user ID and password on the AAA server in the ( <platform name string>-<Ethernet mac address hex string> ) format for EAP Authentication.
If it is a Cisco IOS AP, it should be in the following format:
username: c1240-112233445566 and password: c1240-112233445566 for 1240 platform APs
username: c1520-112233445566 and password: c1520-112233445566 for 1520 platform APs
For 1510 VxWorks-based AP, it should be in the following format:
When a 1524SB AP is switched on, either slot 1 or slot 2 can be used for an uplink depending on the strength of the signal. AWPP treats both slots equally. For a MAP, slot 2 is the preferred (biased) uplink slot, that is, the slot that is used to connect to the parent AP. Slot 1 is the preferred downlink slot. When both radio slots are available for use and if slot 1 is used for an uplink backhaul, a 15-minute timer is started. At the end of 15 minutes, the AP scans for a channel in slot 2 so that slot 2 might be used for an uplink backhaul again. This process is called slot bias.
We recommend that you use a directional antenna on slot 2 for a proper linear functionality. We also recommend that you ensure that slot 2 is selected for a strong uplink. However, there may be some scenarios where directional antennas are used on both the backhaul radios for mobility. When the AP is powered on, the parent can be selected in either direction. If slot 1 is selected, the AP should not go to the scanning mode after 15 minutes, that is, you should disable the slot bias.
You can use the config mesh slot-bias disable to disable slot bias so that the APs can be stable on slot 1.
To disable slot bias, enter this command:
Note The slot bias is enabled by default.
a. Enable debugging on the AP by entering this command in the controller:
You can configure a preferred parent for a MAP. This feature gives more control to you and enables you to enforce a linear topology in a mesh environment. You can skip AWPP and force a parent to go to a preferred parent.
Note Slot bias and preferred parent selection features are independent of each other. However, with the preferred parent configured, the connection is made to the parent using slot 1 or slot 2, whichever the AP sees first. If slot 1 is selected for the uplink in a MAP, then slot bias occurs. We recommend that you disable slot bias if you already know that slot 1 is going to be selected.
To configure a preferred parent, enter this command:
Note When you configure a preferred parent, ensure that you specify the MAC address of the actual mesh neighbor for the desired parent. This MAC address is the base radio MAC address that has the letter f as the final character. For example, if the base radio MAC address is 00:24:13:0f:92:00, then you must specify 00:24:13:0f:92:0f as the preferred parent. This is the actual MAC address that is used for mesh neighbor relationships.
This example shows how to configure the preferred parent for the MAP1SB access point, where 00:24:13:0f:92:00 is the preferred parent’s MAC address:
These commands are related to preferred parent selection:
This example shows how to get the configuration information for the MAP1SB access point, where 00:24:13:0f:92:00 is the MAC address of the preferred parent:
In addition to hidden node interference, co-channel interference can also impact performance. Co-channel interference occurs when adjacent radios on the same channel interfere with the performance of the local mesh network. This interference takes the form of collisions or excessive deferrals by CSMA. In both cases, performance of the mesh network is degraded. With appropriate channel management, co-channel interference on the wireless mesh network can be minimized.
This section describes how to use the controller GUI or CLI to view mesh statistics for specific mesh access points.
Note You can modify the Statistics Timer interval setting on the All APs > Details page of the controller GUI.
Step 1 Choose Wireless > Access Points > All APs to open the All APs page.
Step 2 To view statistics for a specific mesh access point, hover the mouse over the blue drop-down arrow for the desired mesh access point and choose Statistics . The All APs > AP Name > Statistics page for the selected mesh access point appears.
Figure 10-65 All APs > Access Point Name > Statistics Page
This page shows the role of the mesh access point in the mesh network, the name of the bridge group to which the mesh access point belongs, the backhaul interface on which the access point operates, and the number of the physical switch port. It also displays a variety of mesh statistics for this mesh access point.
Use these commands to view mesh statistics for a specific mesh access point using the controller CLI:
show mesh security-stats AP_name
Information similar to the following appears:
Information similar to the following appears:
Overflows—The total number of packets dropped due to queue overflow.
Peak Length—The peak number of packets waiting in the queue during the defined statistics time interval.
Average Length—The average number of packets waiting in the queue during the defined statistics time interval.
This section describes how to use the controller GUI or CLI to view neighbor statistics for a selected mesh access point. It also describes how to run a link test between the selected mesh access point and its parent.
Step 1 Choose Wireless > Access Points > All APs to open the All APs page.
Step 2 To view neighbor statistics for a specific mesh access point, hover the mouse over the blue drop-down arrow for the desired mesh access point and choose Neighbor Information . The All APs > Access Point Name > Neighbor Info page for the selected mesh access point appears.
Figure 10-67 All APs > Access Point Name > Neighbor Info Page
This page lists the parent, children, and neighbors of the mesh access point. It provides each mesh access point’s name and radio MAC address.
Step 3 To perform a link test between the mesh access point and its parent or children, follow these steps:
a. Hover the mouse over the blue drop-down arrow of the parent or desired child and choose LinkTest . A pop-up window appears.
b. Click Submit to start the link test. The link test results appear on the Mesh > LinkTest Results page.
Figure 10-69 Mesh > LinkTest Results Page
c. Click Back to return to the All APs > Access Point Name > Neighbor Info page.
Step 4 To view the details for any of the mesh access points on this page, follow these steps:
a. Hover the mouse over the blue drop-down arrow for the desired mesh access point and choose Details . The All APs > Access Point Name > Link Details > Neighbor Name page appears.
Figure 10-70 All APs > Access Point Name > Link Details > Neighbor Name page
b. Click Back to return to the All APs > Access Point Name > Neighbor Info page.
Step 5 To view statistics for any of the mesh access points on this page, follow these steps:
a. Hover the mouse over the blue drop-down arrow for the desired mesh access point and choose Stats . The All APs > Access Point Name > Mesh Neighbor Stats page appears.
Figure 10-71 All APs > Access Point Name > Mesh Neighbor Stats Page
b. Click Back to return to the All APs > Access Point Name > Neighbor Info page.
Use these commands to view neighbor statistics for a specific mesh access point using the controller CLI.
show mesh neigh { detail | summary } AP_Name
Information similar to the following appears when you request a summary display:
Information similar to the following appears:
Information similar to the following appears:
Packet error rate percentage = 1 – (number of successfully transmitted packets/number of total packets transmitted).
Step 1 Convert the autonomous access point (k9w7 image) to a lightweight access point.
For information about this process, see this URL: http://cisco-images.cisco.com/en/US/docs/wireless/access_point/conversion/lwapp/upgrade/guide/lwapnote.html.
Step 2 Convert the lightweight access point to either a mesh access point (MAP) or root access point (RAP) as follows:
Note Indoor mesh access points (1130 and 1240) can function as either a RAP or a MAP. By default, all are configured as MAPs.
config ap mode bridge Cisco_AP
config ap role rootAP Cisco_AP
The mesh access point reloads and is configured to operate as a RAP.
Cisco 1130 and 1240 series indoor mesh access points can function as either RAPs or MAPs.
Step 1 Choose Wireless > Access Points > All APs to open the All APs page.
Step 2 Click the name of the 1130 or 1240 series access point that you want to change.
Step 4 From the AP Role drop-down list, choose MeshAP or RootAP to specify this access point as a MAP or RAP, respectively.
Step 5 Click Apply to commit your changes. The access point reboots.
Step 6 Click Save Configuration to save your changes.
Note We recommend that you use a Fast Ethernet connection between the MAP and controller when changing from a MAP to RAP.
Note After a RAP-to-MAP conversion, the MAP’s connection to the controller is a wireless backhaul rather than a Fast Ethernet connection. You must ensure that the Fast Ethernet connection of the RAP being converted is disconnected before the MAP starts up so that the MAP can join over the air.
Note We recommend that your power source for MAPs is either a power supply or power injector. We do not recommend that you use PoE as a power source for MAPs.
Step 1 Change the role of an indoor access point from MAP to RAP or from RAP to MAP by entering this command:
config ap role { rootAP | meshAP } Cisco_AP
The access point reboots after you change the role.
Step 2 Save your changes by entering this command:
The access point reboots after you enter the conversion commands in the controller CLI or perform the steps on the controller or the Cisco WCS.
Note We recommend that you use a Fast Ethernet connection to the controller for the conversion from a mesh (bridge) to nonmesh (local) access point. If the backhaul is a radio, after the conversion, you must enable Ethernet and then reload the access image.
Note When a root access point is converted back to a lightweight access point, all of its subordinate mesh access points lose connectivity to the controller. A mesh access point is unable to service its clients until the mesh access point is able to connect to a different root access point in the vicinity. Likewise, clients might connect to a different mesh access point in the vicinity to maintain connectivity to the network.
a. Choose Wireless and click on the AP Name link for the 1130 or 1240 indoor access point you want to convert.
b. At the General Properties panel, choose Local from the AP Mode drop-down list.
c. Click Apply to apply changes.
d. Click Save Configuration to save your changes.
a. Choose Configure > Access Points and click on the AP Name link for the 1130 or 1240 indoor access point you want to convert.
b. At the General Properties panel, choose Local as the AP Mode (left side).
Outdoor access points (1522, 1524PS) can interoperate with the Cisco 3200 Series Mobile Access Router (MAR) on the public safety channel (4.9 GHz) as well as the 2.4-GHz access and 5-GHz backhaul.
The Cisco 3200 creates an in-vehicle network in which devices such as PCs, surveillance cameras, digital video recorders, printers, PDAs, and scanners can share wireless networks such as cellular or WLAN- based services back to the main infrastructure. Data that is collected from in-vehicle deployments, such as a police car can be integrated into the overall wireless infrastructure. For specific interoperability details between series 1130, 1240, and 1520 mesh access points and series 3200 mobile access routers, see Table 10-18 .
15228 |
|
1130, 1240 configured as indoor mesh access points with universal access |
– Channels 20 (4950 GHz) through 26 (4980 GHz) and sub-band channels 1 through 19 (5 and 10 MHz) are used for MAR interoperability. This configuration change is made on the controller. No changes are made to the access point configuration.
– Channel assignments are made only to the RAP. Updates to the MAP are propagated by the RAP.
The default channel width for MAR 3200s is 5 MHz. You must do one of the following:
– When using the controller CLI, you must disable the 802.11a radio prior to configuring its channels. You reenable the radio after the channels are configured.
– When using the GUI, enabling and disabling the 802.11a radio for channel configuration is not required.
– Cisco MAR 3200s can scan channels within but not across the 5-, 10-, or 20-MHz bands.
Step 1 Enable the backhaul for client access by choosing Wireless > Mesh to open the Mesh page.
Step 2 Select the Backhaul Client Access check box to allow wireless client association over the 802.11a radio.
Step 3 Click Apply to commit your changes.
Step 4 When prompted to allow a reboot of all the mesh access points on the network, click OK .
Step 5 Choose Wireless > Access Points > Radios > 802.11a/n to open the 802.11a/n Radios page.
Step 6 Hover your cursor over the blue drop-down arrow for the appropriate RAP and choose Configure . The 802.11a/n (4.9 GHz) > Configure page appears.
Figure 10-72 802.11 a/n (4.9GHz) > Configure Page
Step 7 Under the RF Channel Assignment section, choose the WLC Controlled option for Assignment Method and choose a channel between 1 and 26.
Step 8 Click Apply to commit your changes.
Step 9 Click Save Configuration to save your changes.
Step 1 Enable client access mode on the 1522 and 1524PS mesh access points by entering this command:
config mesh client-access enable
Step 2 Enable public safety on a global basis by entering this command:
config mesh public-safety enable all
Step 3 Enable the public safety channels by entering these commands:
config 802.11a disable Cisco_MAP
config 802.11a channel ap Cisco_MAP channel_number
config 802.11a enable Cisco_MAP
config 802.11–a49 disable Cisco_MAP
config 802.11–a49 channel ap Cisco_MAP channel_number
config 802.11–a49 enable Cisco_MAP
Note Enter the config 802.11–a58 enable Cisco_MAP command to enable a 5-GHz radio.
Note For both the 1522 and 1524PS mesh access points, valid values for the channel number is 1 through 26.
Step 4 Save your changes by entering this command:
Step 5 Verify your configuration by entering these commands:
show ap config 802.11a summary (for 1522 access points only)
show ap config 802.11–a49 summary (for 1524PS access points only)
Note Enter the show config 802.11-a58 summary command to view configuration details for a 5-GHz radio.