Colubris Networks Configuration Guide

Transcription

1 Colubris Networks Configuration Guide

2 Release 4.1 (February 2006) Copyright 2006 Colubris Networks, Inc. All rights reserved, including those to reproduce this document or parts thereof in any form without written permission from Colubris Networks, Inc. Colubris is a registered trademark, and the Colubris Networks logo, the tag line The Intelligent Wireless Networking Choice, InReach, InMotion, InCharge, and TriPlane are trademarks of Colubris Networks, Inc., in the United States and other countries. All other product and brand names are the service marks, trademarks, registered trademarks, or registered service marks of their respective owners. Changes are periodically made to the information herein; these changes will be incorporated into new editions of the document. You can download the most up-to-date product information from the Colubris Networks website. Go to and on the homepage at left select Support > Product Registration. Colubris Networks, Inc. 200 West Street Ste 300 Waltham, Massachusetts UNITED STATES Phone: Fax: Sales Information sales@colubris.com Customer Support support@colubris.com Training training@colubris.com

3 Contents Contents Chapter 1 Introduction 5 About this guide...6 Software compatibility matrix...8 Typographical conventions...9 Warnings, cautions, and notes...10 Related documents...11 Chapter 2 Management 13 In this chapter...14 Management Tool overview...15 Management station...15 Administrator account...15 Security...15 Validating administrator logins using a RADIUS server...16 Remote management...17 How it works...17 Configuration road map...18 Chapter 3 Public access deployment 21 In this chapter...22 Scenario 1a: Hotspot with Internet access (local mode)...23 How it works...23 Configuration road map...24 Scenario 1b: Hotspot with custom interface (local mode)...26 How it works...26 Configuration road map...27 Scenario 1c: Hotspot with satellites and roaming (local mode)...29 How it works...29 Configuration road map...30 Scenario 1d: Hotspot with layer 2 security (local mode)...32 How it works...32 Configuration road map...33 Scenario 2a: Hotspot with Internet access (AAA server)...35 How it works...35 Configuration road map...36 Scenario 2b: Hotspot with custom interface (AAA server)...39 How it works...39 Configuration road map...40 Scenario 2c: Hotspot with satellites and roaming (AAA server)...42 How it works...42 Configuration road map...43 Scenario 2d: Hotspot with layer 2 security (AAA server)...45 How it works...45 Configuration road map...46 Scenario 2e: Using dual radios to support A+B+G traffic...49 How it works...49 Configuration road map...49 Scenario 3: Shared hotspot for public and private traffic...50 How it works...50 Configuration road map...51 Scenario 4: Delivering custom HTML pages using VLANs (AAA server)...54 How it works...54 Configuration road map...55 Scenario 5: Custom HTML pages on each MAP (local mode)...59 How it works...59 Configuration road map...60 Chapter 4 Enterprise deployment 63 In this chapter...64 Scenario 1: Adding secure wireless networking...65 How it works...65 Configuration road map...65 Scenario 2a: Integrating wireless networking with authentication...67 How it works...67 Configuration road map...67 Scenario 2b: Using multiple wireless profiles and QoS...69 How it works...69 Configuration road map...70 Scenario 2c: Supporting wireless phones...71 How it works...71 Configure the VSC...72 Scenario 3: Adding wireless networking to a segmented network...73 How it works...73 Configuration road map...74 Scenario 4: Roaming across different subnets (single MSC)...77 How it works...77 Configuration road map...78 Scenario 5: Roaming across different subnets (multiple MSCs)...80 How it works...80 Configuration road map...81 Scenario 6: Access-controlled VSCs and roaming...83 How it works...83 Configuration road map...85 Chapter 5 WDS scenarios 91 In this chapter...92 Wireless bridging considerations...93 Single or dual radios?...93 Using 802.1a for WDS...93 Scenario 1: Using RF extension to expand a wired network...94 How it works...94 Configuration road map...95 Scenario 2: Deploying a point-to-point wireless link...98 How it works...98 Configuration road map single radio...99 Configuration road map dual radios Scenario 3: Setting up multi-hop wireless links How it works Configuration road map Chapter 6 More from Colubris 109 Colubris.com For registered customers For Annual Maintenance Support Program customers Information by telephone and

4 Contents

5 Chapter 1: Introduction Chapter 1 Introduction In this chapter you can find an explanation of the conventions used in this guide and an overview of its contents. For information on using different software revisions in your Colubris subnetwork, see the Software compatibility matrix on page 8.

6 Chapter Introduction Chapter 1 About this guide This guide contains a number of detailed scenarios for using Colubris Networks MultiService Access Points (MAPs) and MultiService Controllers (MSCs) in a wide range of applications. Although detailed configuration steps are provided with each scenario, the guide does not cover the basic procedures for operating and configuring Colubris Networks devices. This information can be found in the Administrator s Guide for each device (For a list see page 11.) You should be familiar with this information before attempting to use the scenarios in this guide. The scenarios are grouped according to functionality as follows: Chapter 2: Management Scenario/Topic See page Management Tool overview 15 Validating administrator logins using a RADIUS server 16 Remote management 17 Chapter 3: Public access deployment Scenario/Topic See page Scenario 1a: Hotspot with Internet access (local mode) 23 Scenario 1b: Hotspot with custom interface (local mode) 26 Scenario 1c: Hotspot with satellites and roaming (local mode) 29 Scenario 1d: Hotspot with layer 2 security (local mode) 32 Scenario 2a: Hotspot with Internet access (AAA server) 35 Scenario 2b: Hotspot with custom interface (AAA server) 39 Scenario 2c: Hotspot with satellites and roaming (AAA server) 42 Scenario 2d: Hotspot with layer 2 security (AAA server) 45 Scenario 2e: Using dual radios to support A+B+G traffic 49 Scenario 3: Shared hotspot for public and private traffic 50 Scenario 4: Delivering custom HTML pages using VLANs (AAA server) 54 Scenario 5: Custom HTML pages on each MAP (local mode)

7 Chapter Introduction Chapter 1 Chapter 4: Enterprise deployment Scenario/Topic See page Scenario 1: Adding secure wireless networking 65 Scenario 2a: Integrating wireless networking with authentication 67 Scenario 2b: Using multiple wireless profiles and QoS 69 Scenario 2c: Supporting wireless phones 71 Scenario 3: Adding wireless networking to a segmented network 73 Scenario 4: Roaming across different subnets (single MSC) 77 Scenario 5: Roaming across different subnets (multiple MSCs) 80 Scenario 6: Access-controlled VSCs and roaming 83 Chapter 5: WDS scenarios Scenario/Topic See page Wireless bridging considerations 93 Scenario 1: Using RF extension to expand a wired network 94 Scenario 2: Deploying a point-to-point wireless link 98 Scenario 3: Setting up multi-hop wireless links

8 Chapter Introduction Chapter 1 Software compatibility matrix As part of the Colubris Intelligent MultiService System (CIMS), InCharge MultiService Controllers (MSCs) and MGW-3500 MultiService Gateways must be configured with compatible InReach MultiService Access Points and Colubris Networks wireless client bridges. Following is a software release compatibility matrix that shows you which software versions can be mixed in your CIMS. In general, MSCs and MGWs support access point products that are at the same software release or one software release behind. Note: If you upgrade your Colubris Networks access controller products to the release, all managed access points must be at either or 3.1.x. Stand-alone access points can run any firmware version. However, Colubris strongly recommends that you deploy the same firmware release for all access points in your network. Supported software version on Colubris access controllers MSC-3200 d MSC-3300 e MGW-3500 MSC-5200 Supported software version on Colubris access points and client bridges WAP-200 MAP-320 a MAP-330 b MAP-330 Sensor c WCB-200 c 2.4.x Not supported 2.4.x 2.4.x N/A N/A 3.1.x 3.1.x 3.1.x, 2.4.x 3.1.x, 2.4.x N/A N/A 4.1.x 4.1.x, 3.1.x 4.1.x, 3.1.x 4.1.x, 3.1.x N/A N/A MSC-5500 MSC-5200/MSC-5500 plus COS Services Pack f 3.1.x 3.1.x 3.1.x, 2.4.x 3.1.x, 2.4.x N/A N/A 4.1.x 4.1.x, 3.1.x 4.1.x, 3.1.x 4.1.x, 3.1.x N/A N/A 4.1.x N/A 4.1 only 4.1 only N/A N/A a. Includes product variants MAP-320R and MAP-320S. b. Includes ruggedized product variant MAP-330R. c. MAP-330 Sensors and WCB-200 wireless client bridges do not interact with an MSC or MGW and can be used in these networks at any supported software version. d. Includes ruggedized product variant MSC-3200R. e. Includes ruggedized product variant MSC-3300R. f. In order to use the mobility services features in including both Layer 2 fast and secure authentication and Layer 3 mobility you must upgrade associated MAPs to the release

9 Chapter Introduction Chapter 1 Typographical conventions The following table gives the typographical conventions used in Colubris Networks technical documentation. Example Network > Ports ip_address use-access-list=usename ssl-certificate=url [ %s ] Description When referring to the Management Tool web interface, items in bold identify menu commands or input fields. Submenus are indicated by the > sign. The example refers to the Ports submenu, which is found under the Network menu. Items in italics identify parameters for which you must supply a value. Monospaced text identifies command-line output, program listings, or commands that you enter into configuration files or profiles. Square brackets identify optional arguments. That is, you can decide whether to enter the argument. Do not enter the brackets. [ ONE TWO ] A vertical line indicates mutually-exclusive choices. That is, you can specify only one item. { ONE TWO } Curly brackets group required arguments. Note: The Management Tool web interface is an element management system that is distinct from the Colubris Networks InCharge network management system, CNMS

10 Chapter Introduction Chapter 1 Warnings, cautions, and notes The following table explains some of the special symbols used in Colubris Networks technical documentation. Lead Warning! Caution! Note: Description Warnings provide information that you must follow to avoid risk of physical injury. Cautions provide information that you must follow to avoid damage to the hardware or software components of the system. Notes provide important information about a procedure or topic

11 Chapter Introduction Chapter 1 Related documents The following documents provide additional information. You can find instructions on how to download additional documentation on the copyright page. Document Provides you with... Quickstart Guides Administrator Guides Public Access Administrator Guide Engineering Release Notes Hardware and startup information for the Colubris Networks devices mentioned in this guide. Hardware and configuration information for the Colubris Networks devices mentioned in this guide. Detailed discussions on configuring the public access interface provided by MSC devices. Specific information about the latest release of Colubris Networks firmware, including the newest features, fixes, and known issues

12 Chapter Introduction Chapter

13 Chapter 2: Management Chapter 2 Management In this chapter you can find scenarios that illustrate strategies for managing one or more devices across various network topologies.

14 Chapter Management Chapter 2 In this chapter This chapter contains the following topics. Scenario/Topic See page Management Tool overview 15 Validating administrator logins using a RADIUS server 16 Remote management

15 Chapter Management Chapter 2 Management Tool overview The Management Tool is a Web-based interface to the MAP/MSC that provides easy access to all configuration functions. Note: The Management Tool web interface is an element management system that is distinct from the Colubris Networks InCharge network management system. Management station Management station refers to the computer that an administrator uses to connect to the Management Tool. To act as a management station, a computer must Have a JavaScript-enabled Web browser installed; that is, Netscape 7.01 or higher, or Internet Explorer 6.0 or higher, including all updates Be able to establish an IP connection with the MAP/MSC, either through the wireless port or LAN ports Administrator account Administrator password Access to the Management Tool is protected by a username and password. The factory default setting for both is admin. Colubris Networks recommends that you change both on the Management tool configuration page, which you can access by selecting Management > Management tool. Caution! If you forget the administrator password, the only way to gain access to the Management Tool is to reset the MAP/MSC to factory default settings. Account policy To maintain the integrity of configuration settings, only one administrator can be connected to the Management Tool at a given time. To prevent the Management Tool from being locked up by an idle administrator, two mechanisms are in place: If a administrator s connection to the Management Tool remains idle for more than ten minutes, the MAP/MSC automatically logs the administrator out. If a second administrator connects to the Management Tool and logs in with the correct username and password, the first administrator s session is terminated. (Default setting) If required, you can disable this mechanism on the Management tool configuration page, which you can access by selecting Management > Management tool. Security The Management Tool is protected by the following security features: HTTPS: Communications between the management station and the MAP/MSC occurs through HTTPS. Before logging on to the Management Tool, administrators must accept a Colubris Networks certificate. You can replace this certificate with your own. Port blocking: Access to the Management Tool can be explicitly enabled or disabled for a variety of interfaces depending on the type of unit. Available options may include: wireless port, LAN port, Internet port, VLAN, GRE, or WDS

16 Chapter Management Chapter 2 Validating administrator logins using a RADIUS server You can use a RADIUS server to authenticate logins to the Management Tool. One advantage of this method is that it enables you to create several administrator accounts, each with its own username and password. Caution! Ensure that the RADIUS profile you select is configured and that the administrator account is defined on a functioning RADIUS server. If not, you will not be able to log back into the MAP because the administrator password cannot be authenticated. Use the following steps to configure RADIUS authentication. 1. Create a RADIUS profile to use for administrator authentication: Select Security > RADIUS. Click Add New Profile. Define settings for the RADIUS server that you want to use to validate administrator logins. Click Save. 2. Specify this RADIUS profile for administrator authentication: Select Management > Management tool. Under Administrator authentication Authenticate via, select the RADIUS profile that you created in the first step. Under Username, enter the login name for the administrator. Default is admin. Under Current password, enter the administrator password. Default is admin. Under New password, enter the new administrator password. New passwords must be at least six characters long and contain at least four different characters. Under Confirm new password, retype the new administrator password. As a precaution, you can enable the Try local account if RADIUS is unreachable feature to allow access if the RAIDUS server is down. Click the Test button to verify that authentication is working. Click Save

17 Chapter Management Chapter 2 Remote management This scenario shows you how to set up an MSC to provide remote management of the MAPs connected to it. How it works When a MAP is installed behind an MSC, enabling remote access to its management tool requires configuration settings to be defined on the MSC and the RADIUS server. This section explains how to configure remote management for the following two topologies: Topology A Topology B RADIUS server 20.1 Management station RADIUS server 20.2 VPN server VPN tunnel Management station (address in VPN tunnel) 30.3 (address in VPN tunnel) Router MSC 10.1 M S C MSC M S C 30.2 (address in VPN tunnel) MAP 1.3 MAP 1.2 MAP 1.3 MAP PUBLIC WL AN PUBLIC WL AN PUBLIC WL AN PUBLIC WL AN A B A B

18 Chapter Management Chapter 2 Configuration road map On the management station To reach the management tool on the MAPs, the management station must specify the following addresses in its web browser: Topology A To reach MAP A: To reach MAP B: Topology B To reach MAP A: To reach MAP B: Static NAT mappings are used on the MSC to direct traffic to the proper MAP. MAC address authentication enables the MAPs to log into the public access network. Access list definitions allow traffic to be sent from the MSCs to the management stations. Configure the MSCs Create static NAT mappings To direct management traffic to the proper MAP, you need to create static NAT mappings (on the Network > NAT page) to redirect HTTPS traffic to the new ports you defined on the MAPs. Map traffic on port 5002 to IP address and port 443. Map traffic on port 5003 to IP address and port 443. Configure the RADIUS server Create an MSC profile Create a RADIUS profile for the MSC as follows: MAC address authentication For the MAP to communicate with the management station, it must log into the public access network provided by the MSC. To accomplish this, add a MAC address attribute to the MSC s RADIUS profile for each MAP. This attribute enables the access controller to authenticate devices (such as the MAPs) based on their MAC address. For example: mac-address=address[,username[,password]] Replace address and username with the MAC address of the MAP. Replace password with the same password that the MSC uses to communicate with the RADIUS server

19 Chapter Management Chapter 2 A note about security Access list In both topology A and B it makes sense to protect access to the RADIUS server and management station. This is required because once logged in, public access customers gain access to all resources connected to the MSCs Internet port. An access list definition can be used to block all traffic to , for topology A, and , for topology B. However, to enable the MAPs and the management station to communicate, an additional access list definition must be created as follows: Topology A: Create an access list that permits HTTPS traffic to address This is the IP address of the management station. For example: access-list=320,accept,tcp, ,443 Topology B: The list should permit HTTPS traffic to address This is the IP address of the management station inside the VPN tunnel. access-list=320,accept,tcp, ,443 Create a MAP profile Define a RADIUS profile for each MAP. The profile should activate the access list that was defined in the MSC s RADIUS profile. For example: use-access-list=320 Create a user account for each MSC Define a RADIUS user account for each MSC. Define a unique username and password for each device

20 Chapter Management Chapter

21 Chapter 3: Public access deployment Chapter 3 Public access deployment In this chapter you can find sample deployment strategies for common public access scenarios. These scenarios can give you a good idea about how to approach your installation.

22 Chapter Public access deployment Chapter 3 In this chapter This chapter contains the following scenarios. Scenario/Topic See page Scenario 1a: Hotspot with Internet access (local mode) 23 Scenario 1b: Hotspot with custom interface (local mode) 26 Scenario 1c: Hotspot with satellites and roaming (local mode) 29 Scenario 1d: Hotspot with layer 2 security (local mode) 32 Scenario 2a: Hotspot with Internet access (AAA server) 35 Scenario 2b: Hotspot with custom interface (AAA server) 39 Scenario 2c: Hotspot with satellites and roaming (AAA server) 42 Scenario 2d: Hotspot with layer 2 security (AAA server) 45 Scenario 2e: Using dual radios to support A+B+G traffic 49 Scenario 3: Shared hotspot for public and private traffic 50 Scenario 4: Delivering custom HTML pages using VLANs (AAA server) 54 Scenario 5: Custom HTML pages on each MAP (local mode)

23 LAN port Internet port Chapter Public access deployment Chapter 3 Scenario 1a: Hotspot with Internet access (local mode) This installation shows you how to quickly deploy and test the MSC without installing a RADIUS server. Instead, customer authentication is handled locally on the MSC. How it works In this scenario a single MSC (with radio) is installed to provide a wireless network and access to the Internet. The MSC is connected to the Internet by way of a broadband modem, and the Internet connection is protected by the MSC s firewall and NAT features (which are enabled by default) LAN MSC 1.4 PUBLIC WL AN A local area network is connected to the MSC s LAN port to support wired customers. The MSC acts as the DHCP server on both the wireless and wired networks which are bridged together on subnet The MSC is operating in local mode, which means that: Customer authentication is handled locally by the MSC and accounts are created on the MSC for each customer. There is no support for accounting. A RADIUS server is not required to activate the public access interface. Instead, the default public access interface resident on the MSC is used by customers to login and manage their sessions

24 Chapter Public access deployment Chapter 3 Configuration road map Install the MSC 1. Install the MSC as described in its Quickstart guide. 2. Connect the Internet port to a broadband modem and then restart the modem. 3. Connect the LAN port to the local area network. 4. Start the management tool. Configure the wireless network By default the MSC is configured to: automatically choose the best operating channel (frequency) support b/g clients create a wireless network named Colubris Networks There is no need to change these settings for this scenario. Note: By default, one radio on the MSC-3300 is used to provide the wireless network and the other is placed into Monitor mode. Configure the Internet connection 1. Select Network > Ports > Internet port. 2. Select the addressing option supported by your ISP and click Configure. 3. Define all settings as required by your ISP. Define the list of users 1. Select Security > Users. 2. Add usernames and passwords for all users/customers. Test the public access interface To test your installation, use a wireless client station to log onto the public access interface. (For this to work, the MSC must be configured as the client s default gateway. This is done by default if the wireless client is using DHCP.) 1. Start the client station s web browser and enter the IP address (or domain name) of a web site on the Internet. 2. The MSC should intercept the URL and display the Login page. (Depending on the type of certificate that is installed on the MSC, you may see a security warning first.)

25 Chapter Public access deployment Chapter 3 3. Specify a valid customer name and password to login. 4. The Session page will open. 5. Next, you are automatically redirected to the web site you originally requested

26 LAN port Internet port Chapter Public access deployment Chapter 3 Scenario 1b: Hotspot with custom interface (local mode) This scenario adds custom settings to the default public access interface used in Scenario 1a. This installation illustrates how to customize the operation of the public access interface while running in local mode. How it works In this scenario, a web server is used to store custom pages for the public access interface. The MSC loads these pages each time it is restarted. There are two ways to deploy this scenario. Topology 1 In this version, the web server is located on the Internet. Web server LAN MSC 1.4 PUBLIC WL AN

27 LAN port Internet port Chapter Public access deployment Chapter 3 Topology 2 In this version the web server is located on local LAN B. Instead of being directly connected to the Internet, the MSC is also connected to local LAN B which provides a router/firewall to handle the connection to the Internet Web server 5.1 Router Firewall LAN A LAN B MSC 1.4 PUBLIC WL AN In this scenario, the web server is also the DHCP server for LAN B, operating on subnet The MSC s Internet port is set to operate as a DHCP client. Configuration road map Important: Start with the configuration defined in Scenario 1a. Configure the Internet port (Topology 2 only) 1. Select Network > Ports > Internet port. 2. Select DHCP Client and click Save. Customize the login page and logo 1. Create a folder called newpages on the web server. 2. Create a file called logo.gif that contains your logo and place it in the newpages folder (recommended size less than 20K). This same image file is shared by all pages. 3. Download the current QuickSetup.zip file from the Colubris Support website. (Go to and on the home page at left select Support > Product Registration.)

28 Chapter Public access deployment Chapter 3 4. Copy the following files from the current QuickSetup.zip file and place them in the newpages folder. login.html transport.html session.html fail.html 5. Edit login.html to meet the requirements of your site, keeping the following restrictions in mind: Do not alter the ID tags <!-- Colubris --> & <!-- Custom --> located at the top of the page. Do not alter any JavaScript code. 6. Open the Security > Local config page and define the following attributes: login-page=web_server_url/newpages/login.html transport-page=web_server_url/newpages/transport.html session-page=web_server_url/newpages/session.html fail-page=web_server_url/newpages/fail.html logo=web_server_url/newpages/logo.gif Test the public access interface To test your installation, use a wireless client station to log onto the public access interface. (For this to work, the MSC must be configured as the client s default gateway. This is done by default if the wireless client is using DHCP.) 1. Start the client station s web browser and enter the IP address (or domain name) of a web site on the Internet. 2. The MSC should intercept the URL and display the modified Login page. (Depending on the type of certificate that is installed on the MSC, you may see a security warning first.) 3. To login, specify a valid customer name and password. The Session page should open. 4. Next, you are automatically redirected to the web site you originally requested

29 LAN port Internet port Chapter Public access deployment Chapter 3 Scenario 1c: Hotspot with satellites and roaming (local mode) This scenario adds multiple MAPs to extend the wireless network in Scenario 1b. MAP devices can be used to extend the reach of the public access network created by an InMotion MultiService Controller (MSC). How it works In this scenario several MAP devices are connected to an MSC by way of a backbone LAN to provide multiple wireless cells for large physical location. Customers can log into the public access network at any location and can roam between access points without losing their connection. By default, each MAP is configured as a DHCP client and obtains its address from the MSC, which by default is configured as the DHCP server. Customer authentication is handled locally by the MSC, and accounts are created on the MSC for each customer. There is no support for accounting. Note: This scenario can also be created using an MSC with no radio, in which case wireless cells are only provided by the MAP devices. When using non-radio MSC units, the DHCP server option must be enabled manually on the MSC. The following diagrams illustrate how the two topologies described in Scenario 1b can be modified to support satellites and roaming. In both cases the configuration procedure is the same. Topology 1 Web server LAN MAP 1.9 MAP 1.8 MSC 1.1 PUBLIC WL AN PUBLIC WL AN 1.4 PUBLIC WL AN

30 LAN port Internet port Chapter Public access deployment Chapter 3 Topology Web server Router Firewall LAN A LAN B MAP 1.9 MAP 1.8 MSC PUBLIC WL AN PUBLIC WL AN 1.4 PUBLIC WL AN Configuration road map Important: Start with the configuration defined in Scenario 1a. Install the MAPs 1. Install the MAPs as described in the appropriate quickstart guide. 2. Before you connect each unit to the LAN, start the Management Tool and configure each unit as described in the sections that follow. Configure the wireless network By default the MAPs are configured to: support b/g clients automatically choose the best operating channel (frequency) create a wireless network named Colubris Networks There is no need to change these settings for this scenario. Note: All wireless networks must have the same name in order to support roaming. Set the shared secret on the MSC 1. Select Security > Authentication > Advanced Settings. 2. In the Access controller shared secret box, set Shared secret and Confirm shared secret to a unique string. For example: xr2t56. This password will be used by the MAPs to connect to the MSC when they send authentication requests. 3. Click Save

31 Chapter Public access deployment Chapter 3 Configure the connection to the MSC on the MAPs Each MAP will use the services of the MSC to authenticate customer logins. Do the following on each MAP. 1. Select VSC > Profiles. 2. Click the Colubris Networks profile to edit it. 3. In the General box, select the Use Colubris access controller check box. 4. Click Save. 5. Select Security > Access controller 6. Set the Access controller shared secret to match the secret set on the MSC. 7. Click Save. Note: By default the MAP is set up to use the default gateway assigned by DHCP as the access controller. Do not change this setting

32 LAN port Internet port Chapter Public access deployment Chapter 3 Scenario 1d: Hotspot with layer 2 security (local mode) This scenario adds support for WEP and WPA clients to scenario 1c. Enabling support for WEP and WPA helps to protect wireless transmissions against eavesdropping. How it works This scenario creates three virtual service communities (VSCs) on each device. Each VSC provides support for a different security option: WEP, WPA (with preshared key), and none. To connect with the wireless network, customers must select the SSID of the VSC that matches the option that they want to use. Roaming is supported, since the same VSCs are defined on all access points. The following diagrams illustrate how the two topologies described in Scenario 1c can be modified to support layer 2 security. In both cases the configuration procedure is the same. Topology Web server LAN SSID None MAP SSID WEP 1.5 SSID WPA SSID None MAP SSID WEP 1.4 SSID WPA SSID None MSC 1.1 SSID WPA SSID WEP

33 LAN port Internet port Chapter Public access deployment Chapter 3 Topology Web server Router Firewall LAN A LAN B SSID None MAP SSID WEP 1.5 SSID WPA SSID None MAP SSID WEP 1.4 SSID WPA SSID None MSC SSID WPA SSID WEP Configuration road map Important: Start with the configuration defined in Scenario 1c. Create VSCs on the MAPs Use the following steps to create three virtual service communities on all MAPs. 1. Select VSC > Profiles. 2. On the Virtual Service Communities page, click the Colubris Networks profile to edit it. 3. On the Add/Edit Virtual Service Community page: Under General, enter the Name as None. Under General, select the Use Colubris access controller check box. Under Virtual AP, enter the WLAN name (SSID) as None. Click Save. 4. On the Virtual Service Communities page, click Add new profile. 5. On the Add/Edit Virtual Service Community page: Under General, enter the Name as WEP. Under General, enable the Use Colubris access controller check box. Under Virtual AP, enter the WLAN name (SSID) as WEP. Under Wireless protection: Select the checkbox and choose WEP. For Key, specify 13 ASCII characters as the key. Click Save. 6. On the Virtual Service Communities page, click Add new profile

34 Chapter Public access deployment Chapter 3 7. On the Add/Edit Virtual Service Community page: Under General, enter the Name as WPA. Under General, select the Use Colubris access controller check box. Under Virtual AP, enter the WLAN name (SSID) as WPA. Under Wireless protection: Select the checkbox and leave the default setting of WPA. For Mode, select WPA or WPA2. For Key source, select Preshared key. For Key and Confirm key, set a unique key value. Click Save. Create VSCs on the MSC Use the following steps to create virtual service communities on the MSC that match each VSC you configured on the MAPs: 1. Select VSC > Profiles. 2. On the Virtual Service Communities page, click the Colubris Networks profile to edit it. 3. On the Add/Edit Virtual Service Community page: Under General, enter the Name as None. Under Virtual AP, enter the WLAN name (SSID) as None. Click Save. 4. On the Virtual Service Communities page, click Add new profile. 5. On the Add/Edit Virtual Service Community page: Under General, enter the Name as WEP. Under Virtual AP, enter the WLAN name (SSID) as WEP. Under Wireless protection: Select the checkbox and choose WEP. For Key, specify the same 13 ASCII characters you defined on the MAPs. Click Save. 6. On the Virtual Service Communities page, click Add new profile. 7. On the Add/Edit Virtual Service Community page: Under General, enter the Name as WPA. Under Virtual AP, enter the WLAN name (SSID) as WPA. Under Wireless protection: Select the checkbox and leave the default setting of WPA. For Mode, select WPA or WPA2. For Key source, select Preshared key. For Key and Confirm key, set the same unique key value you defined on the MAPs. Click Save

35 LAN port Internet port Chapter Public access deployment Chapter 3 Scenario 2a: Hotspot with Internet access (AAA server) This installation shows you how to create a public access network using an AAA (authentication, administration, accounting) RADIUS server to handle customer authentication. How it works In this scenario a single MSC is installed to provide a wireless network and access to the Internet. A local area network is connected to the MSC s LAN port to support wired customers. The MSC acts as the DHCP server on both the wireless and wired networks which are bridged together on subnet A RADIUS server (either local or remote) provides services for customer authentication and accounting. There are two ways to deploy this scenario as illustrated by topology 1 and topology 2 in the sections that follow. Topology 1 In this version, the NOC is located at a remote site and is accessed through the Internet. The MSC is connected to the Internet by way of a broadband modem, and the Internet connection is protected by the MSC s firewall and NAT features. The MSC connects to the VPN server at the NOC using its PPTP client. This provides a secure link through which data can be transferred. RADIUS server VPN server VPN tunnel myvpn.com LAN MSC 1.4 PUBLIC WL AN

36 LAN port Internet port Chapter Public access deployment Chapter 3 Topology 2 In this version the RADIUS server is located on local LAN B. Instead of being directly connected to the Internet, the MSC is also connected to local LAN B which provides a router/firewall to handle the connection to the Internet RADIUS server 5.1 Router Firewall LAN A LAN B MSC 1.4 PUBLIC WL AN Configuration road map On the RADIUS server Define RADIUS accounts for all customers that will use the public access network. Install the MSC 1. Install the MSC as described in its Quickstart guide. 2. If setting up Topology 1, connect the Internet port to a broadband modem and then restart the modem. If setting up Topology 2, connect the Internet port to LAN B. 3. Connect the LAN port to the local area network. 4. Start the management tool. Configure the wireless network By default the MSC is configured to: support b/g clients automatically choose the best operating channel (frequency) create a wireless network named Colubris Networks There is no need to change these settings for this scenario. Note: By default one radio on the MSC-3300 is used to provide the wireless network and the other is placed into Monitor mode

37 Chapter Public access deployment Chapter 3 Configure the Internet port 1. Select Network > Ports > Internet port. 2. Select the proper addressing option: For topology 1, select the option supported by your ISP (Topology 1) and click Configure. Define all settings as required. For topology 2, select DHCP client and click Save. Create a VPN connection (Topology 1 only) 1. Select Security > PPTP client. 2. Under Connection, set the PPTP server address to the address of the VPN server (in this example, myvpn.com. 3. Under Account, set Username and Password as required by the VPN server. 4. Click Save. Create a RADIUS profile 1. Select Security > RADIUS. 2. Click Add New Profile. 3. In the Profile name box, assign RADIUS Profile 1 to the new profile. 4. In the Settings box, use the defaults except for Authentication method which must match the method supported by the RADIUS server. 5. In the Primary RADIUS server box, specify the address of the RADIUS server and the secret the MSC will use. Enable RADIUS authentication of customers 1. Select VSC > Profiles. 2. On the Virtual Service Communities page, click the Colubris Networks profile to edit it. 3. On the Add/Edit Virtual Service Community page: Under HTML-based user logins,: Clear the Local authentication checkbox. Select the RADIUS authentication checkbox. For RADIUS profile, select RADIUS Profile 1. Select the RADIUS accounting checkbox. Click Save