Second Edition V2.4.0 (January 2005)

Transcription

1 CLI Reference Guide

2 Second Edition V2.4.0 (January 2005) Colubris is a registered trademark of Colubris Networks Inc. Microsoft, Windows, Windows 2000, Windows NT, Windows XP, Internet Explorer, and the Windows logo are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other names mentioned herein are trademarks or registered trademarks of their respective owners. Changes are periodically made to the information herein; these changes will be incorporated into new editions of the document. Copyright Colubris Networks Inc. All rights reserved, including those to reproduce this document or parts thereof in any form without permission in writing from Colubris Networks, Inc. Colubris Networks Inc. 200 West Street (Suite 3) Waltham, MA 02451, USA

3 Table of Contents Table of Contents Chapter 1 Introduction 5 Getting started...6 Configuration settings...6 Connecting to the CLI...6 Command tree...6 Strings...6 Sample session...7 Syntax conventions...8 Chapter 2 CLI commands 9 View context...10 enable...10 quit...10 Enable context...11 arp...11 arping...11 config...11 curl...11 nslookup...11 ping...11 ps...12 quit...12 rcapture...12 show logging...12 top...12 traceroute...12 Config context...13 interface...13 show config...13 end...13 factory settings...13 reboot device...13 username...13 admin authentication radius...13 world-mode dot11 country code...14 clock timezone...14 ntp server...14 clock summer-time...14 ip http port...14 ip https port...14 web access downstream...14 web access wireless...15 web access upstream...15 web admin kickout...15 web allow...15 snmp-server trap web-login...15 snmp-server trap web-fail...15 ntp server...16 clock...16 logging...16 logging filter...16 logging prefix...16 logging facility...16 snmp-server...17 snmp-server port...17 snmp-server version...17 snmp-server readonly...17 snmp-server readwrite...17 snmp-server location...17 snmp-server contact...17 snmp-server chassis-id...18 snmp-server trap...18 snmp-server authentication trap...18 snmp-server trap community...18 snmp-server host...18 snmp-server trap port...18 snmp-server access downstream...19 snmp-server access wireless...19 snmp-server access upstream...19 snmp-server allow...19 snmp-server heartbeat...19 snmp-server heartbeat period...19 snmp-server trap snmp-fail...20 firmware-update automatic...20 firmware-update weekday...20 firmware-update time...20 firmware-update uri...20 access-controller restrict...20 access-controller restrict location...21 service-sensor...21 service-sensor...21 service-sensor retry...21 service-sensor timeout...21 ip name-server cache...22 ip name-server dynamic...22 ip name-server...22 wireless-scan...22 wireless-scan url...22 wireless-scan period...22 location-aware...23 location-aware group...23 location-aware secret...23 radius-server profile...23 Upstream interface context...24 speed...24 duplex...24 end...24 Downstream interface context...25 speed...25 duplex...25 end...25 vlan...25 vlan-management filter...25 IP interface context...26 ip address mode...26 ip address...26 ip default-gateway...26 ip address dhcp client-id...26 end...26 pppoe mtu...27 pppoe mru...27 pppoe auto-reconnect...27 pppoe unnumbered...27 pppoe client user...27 Wireless context...29 distance...29 dot rts threshold...29 ssid...30 end...30 active...30 transmit power...30 bandwidth...31 bandwidth max...31 wireless link...31 dynamic key...31 dynamic key interval...31 wep key size...31 SSID context...32 ssid name...32 guest-mode

4 Table of Contents max-association...32 vlan...32 transmit key...32 encryption key encryption key format...33 authentication server radius...33 authentication server access controller...33 wpa-psk...33 mac-filter...33 mac-filters local...34 mac-filters mode...34 mac-filters remote...34 mac-filters radius...34 ip filters...34 add ip filter...34 delete ip filter...34 public forwarding...35 qos...35 security...36 end...36 Wireless links context...37 wireless link name...37 active...37 speed...37 security...37 security wep...37 remote mac...37 end...37 RADIUS context...38 radius-server name...38 radius-server accounting port...38 radius-server authentication port...38 radius-server authentication method...38 radius-server nasid...38 radius-server timeout...38 radius-server key...39 radius-server host...39 end

5 Chapter 1: Introduction Chapter 1 Introduction The Colubris Networks command line interface provides comprehensive control of all access point features and functions, enabling you to configure your access points remotely without using a web browser or SNMP console. This chapter explain how to start and use the CLI.

6 Chapter Introduction Chapter 1 Getting started Configuration settings Configuration settings for the CLI are controlled via the management tool. The following settings are available: Setting Page Enable/disable support for the CLI. Set the login username and password. The CLI uses the same password settings as defined for the management tool administrator. Set the port that CLI will be active on. The CLI is active on the secure web server port. By default, this is set to 443. Management > CLI Management > Management tool Management > Management tool Connecting to the CLI Start an SSH session with the access point. You will be prompted to login. Specify the appropriate username and password. CLI starts, placing you in the VIEW context. Command tree The CLI commands are grouped into several contexts according to function. To access the commands in each context, you must switch to that context. View Enable Config RADIUS Upstream interface Downstream interface IP interface Wireless SSID Wireless links RADIUS Strings When specifying a string value that contains spaces, the string must be enclosed in quotes. Strings that do not contain For example: ssid Colubris Networks ssid ColubrisNetworks

7 Chapter Introduction Chapter 1 Sample session This example illustrates how to login to the command line interface and set the wireless port to support a on channel 60 with medium distance between access points. This example assumes that the access point is at its default address and that access to the CLI has been enabled. Connect to the CLI and login prompt:~$ ssh -l admin Password: CN320 V. 2.3-rc (C) 2004 Colubris Networks Inc. Switch to the config context CLI> enable CLI# config Switch to the wireless context CLI(config)# interface wireless Enable a support on channel 60 CLI(config-if-wlan)# dot11 a 60 Set distance between access points to medium CLI(config-if-wlan)# distance medium Move up the tree and then quit CLI(config-if-wlan)# end CLI(config)# end CLI# quit

8 Chapter Introduction Chapter 1 Syntax conventions This manual uses the following formatting conventions.. Example web allow <ip address>/<mask> <ip_address> ip name-server <primary> [<secondary>] speed (auto ) Network Network > Ports Description Monospaced text is used to present the syntax of the CLI commands. Items in italics and enclosed between < and > are parameters that you must supply a value for. Items enclosed in square brackets are optional. You can either include them or not. Do not type the brackets. Several items separated by a vertical line and enclosed in parenthesis means make a choice. Only one of the items can be specified in the command. When referring to the management tool web interface, items in bold type identify menu commands or input fields. They are presented exactly as they appear on screen. When referring to the management tool web interface, submenus are indicated using the > sign. The example refers to the Ports submenu, which is found under the Network menu

9 Chapter 2: CLI commands Chapter 2 CLI commands This chapter lists all the commands that make up the CLI and describes how they are used.

10 View context This is the root of the command tree. enable enable Switches to the enable context. quit quit Quit the CLI

11 Enable context This context provides access to various IP utilities. arp arp [-evn] [-H <type>] [-i if]?- [<hostname>] arp [-v] [-i if] - d <hostname> [pub] arp [-v] [-H <type>] [-i if] -s <hostname> <hw_addr> [temp] arp [-v] [-H <type>] [-i if] -s <hostname> <hw_addr> [<netmask> <nm>] <pub> arp [-v] [-H <type>] [-i if] -Ds <hostname> ifa [<netmask> <nm>] <pub> Displays and modifies the Internet-to-Ethernet address translation tables used by the address resolution protocol. Refer to Linux man pages for a complete description of this command and its options. arping arping [ -AbDfhqUV] [ -c <count>] [ -w <deadline>] [ -s <source>] -I <interface> <destination> Pings a destination on a device interface by ARP packets. Refer to Linux man pages for a complete description of this command and its options. config config Switches to the config context. curl Refer to curl documentation for a complete description of this command and its options. Use the curl command to get/send files to/from the Colubris product. nslookup nslookup [ -option... ] [ <host-to-find> - [< server> ]] Queries DNS servers for information on hosts or domains. Refer to Linux man pages for a complete description of this command and its options. ping <host> [-c <count>] [-s <length>] [-q] Determines if the specified remote IP address is active. Refer to Linux man pages for a complete description of this command and its options. <-c host> The IP address or DNS name of the host to ping. <-c count> Number of pings. <-s length> Length of the ping datagram. <-q> Quiet mode. No output

12 ps Refer to Linux documentation for a complete description of this command and its options. Displays all running processes. quit quit Exit the enable context. rcapture Refer to Linux documentation for a complete description of this command and its options. Sends port capture to an FTP server. show logging show logging Displays the system log. top Refer to Linux documentation for a complete description of this command and its options. Displays all running processes. traceroute traceroute [-n] [-r] [-v] [-m <max_ttl>] [-p <port#>] [-q <nqueries>] [-s <src_addr>] [-t <tos>] [-w <wait>] <host> [<data size>] Show the hosts that are traversed to reach the specified IP address. Refer to Linux documentation for a complete description of this command and its options

13 Config context This is the root context for all configuration commands. interface interface (ip ethernet <name> wireless) Switches to the specified interface context. Name can be either upstream or downstream. show config show config Generates a list of CLI commands that can be used to define the currently loaded configuration. end end Exits the configuration context. factory settings factory settings Resets the system configuration to factory default settings. reboot device reboot device Restarts the system. username username <user> <password> Changes the current administrator username and password. <user> New administrator username. <password> New administrator password. admin authentication radius admin authentication radius <name> Sets the RADIUS profile to use for authentication of administrator logins. no admin authentication radius Sets the authentication of administrator logins to occur using the locally defined username and password. <name> RADIUS profile name

14 world-mode dot11 country code world-mode dot11 country code <code> Specifies the country the Colubris product is operating in. <code> An ISO3166 three-letter country code. clock timezone clock timezone <gmtdiff> Sets the time zone the Colubris product is operating in. <gmtdiff> ntp server Offset from GMT as follows: +-HOUR:MIN. For example, Eastern Standard time is -5:00. ntp server Enable this option to have the Colubris product periodically contact a network time server to update its internal clock. no ntp server Disables the use of a network time server. clock summer-time clock summer-time Enables support for daylight savings time. no clock summer-time Disables support for daylight savings time. ip http port ip http port <number> Sets the port number to use for HTTP access to the Colubris product. <number> Port number. Range: Description HTTP connections made to this port are met with a warning and the browser is redirected to the secure web server port. By default. this parameter is set to port 80. ip https port ip https port <number> Sets the port number used for HTTPS access to the Colubris product. <number> Port number. Range: web access downstream web access downstream Enables access to the management tool via the downstream port

15 no web access downstream Blocks access to the management tool via the downstream port. web access wireless web access wireless Enables access to the management tool via the wireless port. no web access wireless Blocks access to the management tool via the wireless port. web access upstream web access upstream Enables access to the management tool via the upstream port. no web access upstream Blocks access to the management tool via the upstream port. web admin kickout web admin kickout Enables a new administrator login to terminates an existing administrator session. no web admin kickout Stops new administrator from logging in until an existing administrator logs out. web allow web allow <ip address>/<mask> Adds an address to the list of hosts that can access the management tool. no web allow <ip address>/<mask> Removes the specified address from the list of hosts that can access the management tool. <address> IP address. </mask> Subnet mask in CIDR format. Specifies the number of bits in the mask. snmp-server trap web-login snmp-server trap web-login Send a trap each time an administrator login is accepted. no snmp-server trap web-login Do not send a trap each time an administrator login is accepted. snmp-server trap web-fail snmp-server trap web-fail Send a trap each time an administrator login is refused. no snmp-server trap web-fail Do not send a trap each time an administrator login is refused

16 ntp server ntp server <index> <host> Add a network time server. no ntp server <index> Remove a network time server. <index> <host> clock Index of the time server in the list. Up to 20 time servers are supported. Time servers are checked in the order they appear in the list. DNS name or IP address of the time server. clock <time> <date> Sets the system time and date. <time> Time as hh:mm:ss. For example: 15:44:00. <date> Date as dd/mm/yyyy. For example: 17/10/2004 logging logging <ip address> Sets the syslog server to send log entries to. no logging Disables sending of log entries to a syslog server. <address> IP address of the syslog server. logging filter logging filter (debug info notice warning error critical alert emergency) Sets the type of messages that will be recorded in the log. Message levels in order of priority are: debug, info, notice, warning, error, critical, alert, emergency. Each message level includes all those below it. For example, if you select notice, then warning, error, critical, alert, and emergency are included. logging prefix logging prefix <string> Sets the prefix that will be prepended to all syslog messages. no logging prefix Removes the prefix that is prepended to all syslog messages. logging facility logging facility <facility> Sets the facility that is used when logging messages to a syslog server

17 no logging facility Removes the facility that is used when logging messages to a syslog server. <facility> Available facilities are: local0 - local7. snmp-server snmp-server Enables the SNMP agent. no snmp-server Disables the SNMP agent. snmp-server port snmp-server port <port number> Sets the port the Colubris product will use to respond to SNMP requests. <port number> SNMP port number. Range snmp-server version snmp-server version (1 2c) Sets the SNMP version. snmp-server readonly snmp-server readonly <community> Sets the read-only community string. no snmp-server readonly Deletes the read-only community string. snmp-server readwrite snmp-server readwrite <community> Sets the read-write community string. no snmp-server readwrite Deletes the read-write community string. snmp-server location snmp-server location <name> Specifies the location where the Colubris product is installed. no snmp-server location Deletes location information. <name> Location where the Colubris product is installed. snmp-server contact snmp-server contact < > Specifies contact information

18 no snmp-server contact Deletes contact information. < > address. snmp-server chassis-id snmp-server chassis-id <name> Specifies a name to identify the Colubris product. By default, this is set to the serial number of the Colubris product. no snmp-server chassis-id Deletes the system name. snmp-server trap snmp-server trap Enables support for SNMP traps. no snmp-server trap Disables support for SNMP traps. snmp-server authentication trap snmp-server authentication trap Sends a trap each time an SNMP request fails to supply the correct community name. no snmp-server authentication trap Disables sending a trap each time an SNMP request fails to supply the correct community name. snmp-server trap community snmp-server trap community <str> Sets the password required by the remote host that will receive the trap. no snmp-server trap community Deletes the password required by the remote host that will receive the trap. snmp-server host snmp-server host <ip address> Sets the IP address or domain name of the host that the Colubris product will send traps to. snmp-server trap port snmp-server trap port <port number> Specifies the port that the Colubris product will send traps on. By default, port 162 is used <port number> SNMP port number. Range

19 snmp-server access downstream snmp-server access downstream Enables SNMP access on the downstream port. no snmp-server access downstream Blocks SNMP access on the downstream port. snmp-server access wireless snmp-server access wireless Enables SNMP access on the wireless port. no snmp-server access wireless Blocks SNMP access on the wireless port. snmp-server access upstream snmp-server access upstream Enables SNMP access on the upstream port. no snmp-server access upstream Blocks SNMP access on the upstream port. snmp-server allow snmp-server allow <ip address>/<mask> Adds a host to the list of IP address from which access to the SNMP interface is permitted. no snmp-server allow <ip address>/<mask> Removes a host from the list of IP address from which access to the SNMP interface is permitted. <address> IP address. </mask> Subnet mask in CIDR format. Specifies the number of bits in the mask. snmp-server heartbeat snmp-server heartbeat Enables sending of heartbeat traps at regular intervals. no snmp-server heartbeat Disables sending of heartbeat traps at regular intervals. snmp-server heartbeat period snmp-server heartbeat period <seconds> Sets the interval between sending heartbeat traps. <seconds> Heartbeat interval in seconds

20 snmp-server trap snmp-fail snmp-server trap snmp-fail Send a trap each time an SNMP request fails to supply the correct community name. no snmp-server trap snmp-fail Do not send a trap each time an SNMP request fails to supply the correct community name. firmware-update automatic firmware-update automatic Enables scheduled firmware upgrades. no firmware-update automatic Disables scheduled firmware upgrade. The Colubris product can automatically retrieve and install firmware from a local or remote URL at preset times. By placing Colubris product firmware on a web or ftp server, you can automate the update process for multiple units. When the update process is triggered the Colubris product retrieves the first 2K of the firmware file to determine if it is different from the active version. If different, the entire firmware file is then downloaded and installed. (Different means older or newer. This enables you to return to a previous firmware version if required). Configuration settings are preserved during the update unless stated otherwise in the release notes for the firmware. However, all active connections will be terminated. Customers will have to log in again after the Colubris product restarts firmware-update weekday firmware-update weekday (everyday monday tuesday wednesday thursday friday saturday sunday) Sets the day when the scheduled firmware upgrade will take place. firmware-update time firmware-update time <time> Sets the time of day the scheduled firmware upgrade will take place. <time> Time as hh:mm. For example: 15:44. firmware-update uri firmware-update uri <uri> Sets the URI where the Colubris product will retrieve new firmware. no firmware-update uri Clears the firmware URI. access-controller restrict access-controller restrict Enables the security filters which only allow traffic to flow between the Colubris product and the access controller

21 no access-controller restrict Do not limit traffic flow between the Colubris product and the access-controller. This prevents wireless customers from accessing resources on the backbone LAN that interconnects the Colubris product and the access controller. access-controller restrict location access-controller restrict location (gateway mac <mac address> Identifies the access controller the Colubris product will communicate with. gateway Use the default gateway as the access controller. mac Use the specified MAC address as the gateway. <mac address> MAC address. Specify 6 pairs of hexadecimal numbers separated by colons, with the values a to f in lowercase. For example: 00:03:52:0a:0f:01 service-sensor service-sensor Enables the service sensor. The service sensor polls a target device at present intervals. If the device does not respond, the radio is shut off. no service-sensor Disables the service sensor. service-sensor service-sensor (gateway address <address>) Sets the target device the service sensor will poll. This can be the default gateway or a specific IP address. gateway The service sensor will poll the default gateway. address The service sensor will poll another device. <address> IP address of the other device. For example: service-sensor retry service-sensor retry <retires> Specify how many retries the service sensor will attempt when polling the target device. When the retry limit is reached, the radio on the Colubris product is turned off. <retires> Number of retires. Range: service-sensor timeout service-sensor timeout <seconds> Sets how long the service sensor will wait for a response to a poll before timing out. <seconds> Length of timeout. Range: 1-10 seconds

22 ip name-server cache ip name-server cache Enables the DNS cache. no ip name-server cache Disables the DNS cache. Once a host name has been successfully resolved to an IP address by a remote DNS server, it is stored in the cache. This speeds up network performance, as the remote DNS server now does not have to be queried for subsequent requests for this host. The entry stays in the cache until: an error occurs when connecting to the remote host the time to live (TTL) of the DNS request expires the Colubris product is restarted. ip name-server dynamic ip name-server dynamic Enables dynamic assignement of DNS servers. no ip name-server dynamic Disables dynamic DNS assignment. ip name-server ip name-server <primary>[<secondary>] Sets the primary and secondary DNS servers overriding dynamically assigned ones. <primary> IP address of the primary DNS server. <secondary> IP address of the secondary DNS server. wireless-scan wireless-scan Enables wireless neighborhood scanning. no wireless-scan Disable wireless neighborhood scanning. wireless-scan url wireless-scan url <location> Sets the URL of the file that contains a list of all authorized access points. no wireless-scan url Deletes the URL of the file that contains a list of all authorized access points. wireless-scan period wireless-scan period <seconds> Specifies the interval between wireless neighborhood scans. <seconds> Scanning interval. Range: seconds

23 location-aware location-aware Enables the location aware feature. no location-aware Disables the location aware feature. location-aware group location-aware group <name> Sets a group name for the access point. This name is used to identify customer logins via the Called-Station-ID. You can assign the same group name to more than one access point. location-aware secret location-aware secret <secret> Sets the shared secret used to communicate with the access controller. The access controller will only accept authentication/location-aware information from Colubris Networks satellites that have a matching shared secret to its own. radius-server profile radius-server profile <name> Creates a new RADIUS profile or switches to the RADIUS context with the specified profile name. no radius-server profile <name> Deletes the specified RADIUS profile

24 Upstream interface context This context provides commands for configuring the upstream port. speed speed (auto ) Sets the speed of the upstream port. auto Lets the Colubris product automatically set port speed based on the type of equipment it is connected to. 100 Forces the port to operate at 100 mbps. 10 Forces the port to operate at 10 mbps. duplex duplex (auto half full) Sets the duplex mode on the upstream port. auto half full end end Exits the upstream inteface context. Lets the Colubris product automatically set duplex mode based on the type of equipment it is connected to. Forces the port to operate in half duplex mode. Forces the port to operate in full duplex mode

25 Downstream interface context This context provides commands for configuring the downstream port. speed speed (auto ) Sets the speed of the downstream port. auto Lets the Colubris product automatically set port speed based on the type of equipment it is connected to. 100 Forces the port to operate at 100 mbps. 10 Forces the port to operate at 10 mbps. duplex duplex (auto half full) Sets the duplex mode on the downstream port. auto half full end Lets the Colubris product automatically set duplex mode based on the type of equipment it is connected to. Forces the port to operate in half duplex mode. Forces the port to operate in full duplex mode. end Exits the downstream interface context. vlan vlan <id> Sets the default VLAN ID. Range: no vlan Deletes the default VLAN ID. vlan-management filter vlan-management filter Restricts the default VLAN to carry management traffic only. no vlan-management filter Does not restrict the default VLAN to carry management traffic only. Management traffic includes: all traffic that is exchanged by the Colubris product and the access controller all communications with RADIUS servers HTTPS sessions to the management tool SNMP traffic

26 IP interface context This context provides commands for configuring various IP-networking related settings. ip address mode ip address mode (dhcp pppoe static) Sets the IP addressing mode for the upstream port. dhcp pppoe static ip address Dynamic host configuration protocol. The DHCP server will automatically assign an address to the Colubris product, which functions as a DHCP client. Point-to-point protocol over Ethernet. The PPPoE server will automatically assign an IP address to the Colubris product. You need to supply a username and password so the Colubris product can log on. This option enables you to manually assign an IP address to the Colubris product. ip address <ip address>/<mask> Sets a static IP address for the port. <address> IP address. </mask> Subnet mask in CIDR format. Specifies the number of bits in the mask. ip default-gateway ip default-gateway <ip address> Sets the IP address of the default gateway. no ip default-gateway Deletes the default gateway IP address. <address> IP address. ip address dhcp client-id ip address dhcp client-id <id> Specifies an ID to identify the Colubris product to the DHCP server. This parameter is not required by all ISPs. no ip address dhcp client-id Deletes the DHCP client id. end end Exits the IP interafce context

27 pppoe mtu pppoe mtu <bytes> Specifies the maximum transmit unit. Changes to this parameter should only be made according to the recommendations of your ISP. Incorrectly setting this parameter can reduce the throughput of your Internet connection. <bytes> pppoe mru Maximum size (in bytes) of a PPPoE packet when transmitting. Range: bytes. pppoe mru <bytes> Specifies the maximum receive unit. Changes to this parameter should only be made according to the recommendations of your ISP. Incorrectly setting this parameter can reduce the throughput of your Internet connection. <bytes> pppoe auto-reconnect Maximum size (in bytes) of a PPPoE packet when receiving. Range: bytes. pppoe auto-reconnect The Colubris product will automatically attempt to reconnect if the connection is lost. no pppoe auto-reconnect The Colubris product will not automatically attempt to reconnect if the connection is lost. pppoe unnumbered pppoe unnumbered Enable unnumbered mode. no pppoe unnumbered Disable unnumbered mode. This feature is useful when the Colubris product is connected to the Internet and NAT is not being used. Instead of assigning two IP addresses to the Colubris product, one to the Internet port and one to the LAN port, both ports can share a single IP address. This is especially useful when a limited number of IP addresses are available to you. pppoe client user pppoe client user <username> <password> Sets the PPPoE username and password. no pppoe client user Deletes the PPPoE username. <username> The username assigned to you by your ISP. The Colubris product will use this username to log on to your ISP when establishing a PPPoE connection

28 <password> The password assigned to you by your ISP. The Colubris product will use this username to log on to your ISP when establishing a PPPoE connection

29 Wireless context This context provides commands for configuring the wireless network. distance distance (small medium large) Sets the distance between access points. Use this parameter to adjust the receiver sensitivity of the Colubris product. This parameter should only be changed if: you have more than one wireless access point installed in your location you are experiencing throughput problems In all other cases, use the default setting of Large. If you have installed multiple Colubris products, reducing the receiver sensitivity of the Colubris product from its maximum will help to reduce the amount of crosstalk between the wireless stations to better support roaming clients. By reducing the receiver sensitivity, client stations will be more likely to connect with the nearest access point. dot11 dot11 <mode> <frequency> Sets the wireless mode and the frequency the Colubris product will operate at. <mode> <frequency> rts threshold rts threshold <value> Sets the RTS threshold. no rts threshold Deletes the RTS threshold value. Sets the transmission speed and frequency band. The available options are determined by the wireless card installed in the Colubris product, and may include: a: Selects a providing 54 Mbps in the 5 GHz frequency band. b: Selects b providing 11 Mbps in the 2.4 GHz frequency band. g: Selects g providing 54 Mbps in the 2.4 GHz frequency band. bg: Selects b g providing 11 and 54 Mbps in the 2.4 GHz frequency band. Sets the operating frequency by specifying a number in GHz or by specifying a channel number. The frequencies that are available are determined by the radio installed in the Colubris product and the regulations that apply in your country. For optimum performance when operating in b or g modes, choose a frequency that differs from other wireless access points operating in neighboring cells by at least 25 MHz. If operating in a mode, all channels are non-overlapping

30 < value> Threshold value in the range 128 and Description Use this parameter to control collisions on the link that can reduce throughput. If the Status Wireless page on the management tool shows increasing values for Tx multiple retry frames or Tx single retry frames, you should adjust this value until the errors clear up. Start with a value of 1024 and then decrease to 512 until errors are reduced or eliminated. Using a small value for RTS threshold can affect throughput. If a packet is larger than the threshold, the Colubris product will hold it and issue a request to send (RTS) message to the client station. Only when the client station replies with a clear to send (CTS) message will the Colubris product send the packet. Packets smaller than the threshold are transmitted without this handshake. ssid ssid <name> Creates a WLAN profile or switches to the existing SSID context with the specified name. no ssid <name> Deletes an existing WLAN profile. name end end Exits the wireless context. active Name of an existing or new WLAN profile enclosed in quotes. For example: ssid "PrivateNetwork" active Activates the access point functionality which enables wireless client stations to connect. no active Disables the access point functionality. transmit power transmit power <db> Sets the maximum transmission power of the wireless radio. <db> Power is specified in steps of 1dBm. The maximum setting is 18 dbm. Note: The actual transmit power used may less than the value specified. The Colubris product determines the power to used based on the settings you made for regulatory domain, wireless mode, and operating frequency

31 bandwidth bandwidth Enables bandwidth control. no bandwidth Disables bandwidth control. bandwidth max bandwidth max <rate> Set the maximum data rate on the wireless port in kbps. <rate> Maximum data rate. Range: kbps. wireless link wireless link <number> Switches to the wireless link context.. <number> dynamic key Number of the wireless link to configure. Up to six wireless links are supported. dynamic key Enables dynamic key support for 802.1x and WPA. no dynamic key Disables dynamic key support for 802.1x and WPA. dynamic key interval dynamic key interval (5m 10m 15m 30m 1h 2h 4h 8h 12h) Specifies how often (in minutes or hours) that the group (broadcast) key is changed for 802.1x and WPA. wep key size wep key size (64 128) Sets the level of encryption (in bits) that the Colubris product will provide for 802.1x

32 SSID context This context provides commands for configuring WLAN profiles. By default one profile exists with the name "Colubris Networks". This is the default profile and cannot be deleted. ssid name ssid name <name> Changes the profile name. guest-mode guest-mode Enables the broadcast of the wireless network name (SSID) on this profile. no guest-mode Disables the broadcast of the wireless network name (SSID) on this profile. max-association max-association <stations> Sets the maximum number of clients stations that can associate with this profile. <stations> Number of client stations. Range: vlan vlan <id> Assigns a VLAN ID to this profile. no vlan Deletes the VLAN ID for this profile. <id> VLAN ID. Range: transmit key transmit key <key number> Sets the key the Colubris product will use to encrypt transmitted data. All four keys are used to decrypt received data. <key number> Transmit key number. Range: 1-4. encryption key 1 encryption key <key><value> Sets WEP key. no encryption key <key> Deletes WEP key

33 <key> <value> WEP key number. Range: 1-4. Keys 2 to 4 are only supported on the first WLAN profile. Key value. The number of characters you specify for a key determines the level of encryption the Colubris product will provide. For 40-bit encryption, specify 5 ASCII characters or 10 HEX digits. For 128-bit encryption, specify 13 ASCII characters or 26 HEX digits. encryption key format encryption key format (hex ascii) Specify the WEP key format. hex Hex keys should only include the following digits: 0-9, a-f, A-F ascii ASCII keys are much weaker than carefully chosen hex keys. You can include ASCII characters between 32 and 126, inclusive, in the key. However, note that not all client stations support nonalphanumeric characters such as spaces, punctuation, or special symbols in the key. authentication server radius authentication server radius <name> Sets the RADIUS profile to use for 802.1x or WPA authentication. no authentication server authentication server access controller authentication server access controller Use the access controller to authenticate 802.1x or WPA logins. wpa-psk wpa-psk <key> Sets the WPA preshared key. no wpa-psk Deletes the WPA preshared key. password Specify a key that is between 8 and 64 ASCII characters in length. It is recommended that the preshared key be at least 20 characters long, and be a mix of letters and numbers. Description The Colubris product uses the key you specify to generate the TKIP keys that encrypt the wireless data stream. Since this is a static key, it is not as secure as using dynamically generated keys. mac-filter mac-filter <address> Adds an address to the local MAC filter list. no mac-filter <address> Remove the specified address from the local MAC filter list

34 <address> MAC address. Specify 6 pairs of hexadecimal numbers separated by colons, with the values a to f in lowercase. For example: 00:03:52:0a:0f:01 mac-filters local mac-filters local Sets MAC-based authentication to use the local MAC filter list. no mac-filters local MAC-based authentication will not use the local MAC filter list. mac-filters mode mac-filters mode (allow block) Sets the MAC filter list to either allow or block access for all addresses. mac-filters remote mac-filters remote Sets MAC-based authentication to use a RADIUS profile. no mac-filters remote MAC-based authentication will not use a RADIUS profile. mac-filters radius mac-filters radius <radiusname> Specifies the name of the RADIUS profile to use for MAC-based authentication. ip filters ip filters Activates the IP filter which enables you to block wireless-to-wired LAN traffic on this profile based on its destination address. no ip filters Disables the IP filter for this profile. add ip filter add ip filter <ip address>/<mask> Adds an IP filter to the list of destination addresses that traffic will be accepted for. All other traffic will be blocked. If the list is empty, then all wireless-to-wired LAN traffic is permitted. <address> IP address. </mask> Subnet mask in CIDR format. Specifies the number of bits in the mask. delete ip filter delete ip filter <ip address>/<mask> Deletes the specified address from the IP filter list

35 If the list is empty, then all wireless-to-wired LAN traffic is permitted. <address> </mask> IP address. Subnet mask in CIDR format. Specifies the number of bits in the mask. public forwarding public forwarding Enables support for traffic exchange between wireless client stations. no public forwarding Blocks traffic exchange between wireless client stations. qos qos (default wme vap0 vap1 vap2 vap3 diffsrv tos) Sets the QoS level for this profile. no qos Disables QoS for this profile. default (SVP) wme Spectralink Voice Protocol is an open standard for the prioritization of voice traffic on wireless and wired LANs. Traffic from WME or 802.1p client stations is classified based on the VLAN priority field present within the VLAN header. When this mechanism is selected, the Colubris product will advertise WME capabilities, enabling WME clients to associate and take advantage of them. This setting has no effect on legacy clients. Note: To support 802.1p, the wireless profile must have a VLAN assigned to it, which means that client station traffic is forwarded onto the LAN port only. vap0, vap1, vap2, vap3allows a specific priority level to be specified for all traffic on a WLAN profile. This enables client stations without a QoS mechanism to set traffic priority by connecting to the appropriate SSID. If you enable this priority mechanism, it takes precedence regardless of the priority mechanism supported by associated client stations. For example, if you set SSID-based low priority for a WLAN profile, all devices that connect to the profile have their traffic set at this priority diffsrv Differential services is a method for defining IP traffic priority on a per-hop basis. The Differential Service bits are defined in RFC2474 and are composed of the six most significant bits of the IP TOS field. These bits define the class selector code points which the Colubris product maps to the appropriate traffic queue. tos The IP TOS (type of service) field can be used to mark prioritization or special handling for IP packets. Description Four traffic queues are provided based on the WME standard. In order of priority, these queues are: 1: Voice traffic 2: Video traffic 3: Best effort data traffic

36 4: Background data traffic Each QoS priority mechanism maps traffic to one of the four traffic queues. Client stations that do not support the QoS mechanism for the profile they are connected to are always assigned to queue 3. Important: Traffic delivery is based on strict priority (per the WME standard). Therefore, if excessive traffic is present on queues 1 or 2, it will reduce the flow of traffic on queues 3 and 4. security security (none wep 802.1x [wep] wpa (psk radius) ) Sets the current wireless security policy. none wep No wireless security. This option enables support for wireless users with WEP client software x This option enables support for wireless users with 802.1x client software. The CNx supports 802.1x client software that uses EAP- TLS, EAP-TTLS, EAP-SIM, and PEAP. wep Enables the use of dynamic WEP keys for all 802.1x sessions. Dynamic key rotation occurs on key 1, which is the broadcast key. Key 0 is the pairwise key. It is automatically generated by the Colubris product. wpa This option enables support for wireless users with WPA client software. psk Enables support for a preshared key: radius The Colubris product obtains the MPPE key from the RADIUS server. This is a dynamic key that changes each time the user logs in and is authenticated. The MPPE key is used to generate the TKIP keys that encrypt the wireless data stream. end end Exits the SSID context

37 Wireless links context This context provides commands for configuring wireless links (bridges). wireless link name wireless link name <name> Renames the current wireless link active active Activates the wireless link. no active Deactivates the wireless link. speed speed (auto ) Sets the speed of the wireless link in Mbps. security security Enables wireless security. no security Disables wireless security. security wep security wep <key> Sets the WEP key. no security wep Deletes the WEP key. remote mac remote mac <address> Sets the MAC address of the remote access point. no remote mac Deletes the MAC address of the remote access point. <address> end end Returns to the previous context. MAC address. Specify 6 pairs of hexadecimal numbers separated by colons, with the values a to f in lowercase. For example: 00:03:52:0a:0f: