A client access process involves three steps: active/passive scanning surrounding wireless services, authentication, and association, as shown in Figure 1.

Figure 1 Establishing a client access

Scanning

Wireless clients can get the surrounding wireless network information in two ways, active scanning and passive scanning. With active scanning, a wireless client actively sends probe requests during scanning, and receives probe responses. With passive scanning, a wireless client listens to Beacon frames sent by surrounding APs.

A wireless client usually uses both passive scanning and active scanning to get information about surrounding wireless networks.

1. Active scanning

When a wireless client operates, it periodically searches for (that is, scans) surrounding wireless networks. Active scanning falls into two modes according to whether a specified SSID is carried in a probe request.

· Mode 1—A client sends a probe request without any SSID on supported channels to scan wireless networks. APs that receive the probe request frame send a probe response frame. The client associates with the AP with the strongest signal.

Figure 2 Active scanning (no SSID in the probe request)

· Mode 2—When a wireless client is configured to access a specific wireless network or has already been connected to a wireless network, the client periodically sends a probe request carrying the specified SSID. When an AP that can provide the wireless service with the specified SSID receives the probe request, it sends a probe response. This active scanning mode enables a client to access a specified wireless network. The active scanning process is as shown in Figure 3.

Figure 3 Active scanning (the probe request carries the specified SSID AP 1)

2. Passive scanning

Passive scanning is used by clients to discover surrounding wireless networks through listening to the beacon frames periodically sent by an AP. All APs providing wireless services periodically send beacons frames, so that wireless clients can listen to beacon frames on the supported channels to get information about surrounding wireless networks. Passive scanning is used by a client when it wants to save battery power. Typically, VoIP clients adopt the passive scanning mode. The passive scanning process is as shown in Figure 4.

Figure 4 Passive scanning

Authentication

To secure wireless links, the wireless clients must be authenticated before accessing an AP. 802.11 links define two authentication mechanisms: open system authentication and shared key authentication.

· Open system authentication

Open system authentication is the default authentication algorithm. This is the simplest of the available authentication algorithms. Essentially it is a null authentication algorithm. Any client that requests authentication with this algorithm can become authenticated. Open system authentication is not required to be successful as an AP may decline to authenticate the client. Open system authentication involves a two-step authentication process. In the first step, the wireless client sends a request for authentication. In the second step, the AP returns the result to the client.

Figure 5 Open system authentication process

· Shared key authentication

Figure 6 shows a shared key authentication process. The two parties have the same shared key configured.

a. The client sends an authentication request to the AP.

b. The AP randomly generates a challenge and sends it to the client.

c. The client uses the shared key to encrypt the challenge and sends it to the AP.

d. The AP uses the shared key to encrypt the challenge and compares the result with that received from the client. If they are identical, the client passes the authentication. If not, the authentication fails.

Figure 6 Shared key authentication process

Association

A client that wants to access a wireless network via an AP must be associated with that AP. Once the client chooses a compatible network with a specified SSID and authenticates to an AP, it sends an association request frame to the AP. The AP sends an association response to the client and adds the client's information in its database. At a time, a client can associate with only one AP. An association process is always initiated by the client, but not by the AP.

WLAN data security

Compared with wired networks, WLAN networks are more susceptible to attacks because all WLAN devices share the same medium and thus every device can receive data from any other sending device. If no security service is provided, plain-text data is transmitted over the WLAN.

To secure data transmission, 802.11 protocols provide some encryption methods to ensure that devices without the right key cannot read encrypted data.

1. WEP encryption

Wired Equivalent Privacy (WEP) was developed to protect data exchanged among authorized users in a wireless LAN from casual eavesdropping. WEP uses RC4 encryption (a stream encryption algorithm) for confidentiality. WEP encryption falls into static and dynamic encryption according to how a WEP key is generated.

· Static WEP encryption

With Static WEP encryption, all clients using the same SSID must use the same encryption key. If the encryption key is deciphered or lost, attackers will get all encrypted data. In addition, periodical manual key update brings great management workload.

· Dynamic WEP encryption

Dynamic WEP encryption is a great improvement over static WEP encryption. With dynamic WEP encryption, WEP keys are negotiated between client and server through the 802.1X protocol so that each client is assigned a different WEP key, which can be updated periodically to further improve unicast frame transmission security.

Although WEP encryption increases the difficulty of network interception and session hijacking, it still has weaknesses due to limitations of RC4 encryption algorithm and static key configuration.

2. TKIP encryption

Temporal key integrity Protocol (TKIP) and WEP both use the RC4 algorithm, but TKIP has many advantages over WEP, and provides more secure protection for WLAN as follows:

¡ First, TKIP provides longer IVs to enhance encryption security. Compared with WEP encryption, TKIP encryption uses 128–bit RC4 encryption algorithm, and increases the length of IVs from 24 bits to 48 bits.

¡ Second, TKIP allows for dynamic key negotiation to avoid static key configuration. TKIP replaces a single static key with a base key generated by an authentication server. TKIP dynamic keys cannot be easily deciphered.

¡ Third, TKIP offers Message Integrity Check (MIC) and countermeasures. If a packet fails the MIC, the data may be tampered, and the system may be attacked. If two packets fail the MIC in a certain period, the AP automatically takes countermeasures. It will not provide services in a certain period to prevent attacks.

3. CCMP encryption

CTR with CBC-MAC protocol (CCMP) is based on the CCM of the AES encryption algorithm. CCM combines CTR for confidentiality and CBC-MAC for authentication and integrity. CCM protects the integrity of both the MPDU Data field and selected portions of the IEEE 802.11 MPDU header. The AES block algorithm in CCMP uses a 128-bit key and a 128-bit block size. Similarly, CCMP contains a dynamic key negotiation and management method, so that each wireless client can dynamically negotiate a key suite, which can be updated periodically to further enhance the security of the CCMP encryption mechanism. During the encryption process, CCMP uses a 48-bit packet number (PN) to ensure that each encrypted packet uses a different PN, thus improving the security to a certain extent.

Client access authentication

1. PSK authentication

To implement PSK authentication, the client and the authenticator must have the same shared key configured. Otherwise, the client cannot pass pre-shared key (PSK) authentication.

2. 802.1X authentication

As a port-based access control protocol, 802.1X authenticates and controls accessing devices at the port level. A device connected to an 802.1X-enabled port of a WLAN access control device can access the resources on the WLAN only after passing authentication.

The administrators of access devices can select to use RADIUS or local authentication to cooperate with 802.1X for authenticating users. For more information about remote/local 802.1X authentication, see "802.1X configuration."

3. MAC authentication

MAC authentication provides a way for authenticating users based on ports and MAC addresses. You can configure permitted MAC address lists to filter MAC addresses of clients. However, the efficiency will be reduced when the number of clients increases. Therefore, MAC authentication is applicable to environments without high security requirements, for example, SOHO and small offices.

MAC authentication falls into two modes:

¡ Local MAC authentication—When this authentication mode is adopted, you need to configure a permitted MAC address list on the device. If the MAC address of a client is not in the list, its access request will be denied.

Figure 7 Local MAC authentication

¡ Remote MAC authentication—Remote Authentication Dial-In User Service (RADIUS) based MAC authentication. If the device finds that the current client is an unknown client, it sends an unsolicited authentication request to the RADIUS server. After the client passes the authentication, the client can access the WLAN network and the corresponding authorized information.

Figure 8 Remote MAC authentication

When a RADIUS server is used for MAC authentication, you can specify a domain for each wireless service, and thus send MAC authentication information of different SSIDs to different remote RADIUS servers.

802.11n

As the next generation wireless LAN technology, 802.11n supports both 2.4GHz and 5GHz bands. It provides higher throughput to customers by using the following methods:

1. Increasing bandwidth: 802.11n can bond two adjacent 20-MHz channels together to form a 40-MHz channel. During data forwarding, the two 20-MHz channels can work separately with one acting as the primary channel and the other acting as the secondary channel or work together as a 40-MHz channel. This provides a simple way of doubling the data rate.

2. Improving channel utilization through the following ways:

¡ 802.11n introduces the A-MPDU frame format. By using only one PHY header, each A-MPDU can accommodate multiple Message Protocol Data Units (MPDUs) which have their PHY headers removed. This reduces the overhead in transmission and the number of ACK frames to be used, and thus improves network throughput.

¡ Similar with MPDU aggregation, multiple MAC Service Data Units (MSDU) can be aggregated into a single A-MSDU. This reduces the MAC header overhead and thus improves MAC layer forwarding efficiency.

¡ To improve physical layer performance, 802.11n introduces the short GI function, which shortens the GI interval of 800 us in 802.11a/g to 400 us. This can increase the data rate by 10 percent.

Configuring access service

Recommended configuration procedure

Step	Remarks
1. Creating a WLAN service	Required.
2. Configuring wireless service ¡ Configuring clear type wireless service ¡ Configuring crypto type wireless service	Required. Use either approach. Complete the security settings as needed.
3. Enabling a wireless service	Required.
4. Binding an AP radio to a wireless service	Required.
5. Enabling a radio	Optional.
6. Displaying the detailed information of a wireless service	Optional.

Creating a WLAN service

1. Select Wireless Service > Access Service from the navigation tree.

Figure 9 Configuring access service

2. Click Add.

Figure 10 Creating a wireless service

3. Configure the wireless service as described in Table 1.

4. Click Apply.

Table 1 Configuration items

Item	Description
Wireless Service Name	Set the Service Set Identifier (SSID), a case-sensitive string of 1 to 32 characters, which can include letters, digits, underlines, and spaces. An SSID should be as unique as possible. For security, the company name should not be contained in the SSID. Meanwhile, it is not recommended to use a long random string as the SSID, because a long random string only adds payload to the header field, without any improvement to wireless security.
Wireless Service Type	Select the wireless service type: · clear—Indicates the SSID will not be encrypted. · crypto—Indicates the SSID will be encrypted.

Item

Description

Wireless Service Name

Set the Service Set Identifier (SSID), a case-sensitive string of 1 to 32 characters, which can include letters, digits, underlines, and spaces.

An SSID should be as unique as possible. For security, the company name should not be contained in the SSID. Meanwhile, it is not recommended to use a long random string as the SSID, because a long random string only adds payload to the header field, without any improvement to wireless security.

Wireless Service Type

Select the wireless service type:

· clear—Indicates the SSID will not be encrypted.

· crypto—Indicates the SSID will be encrypted.

Configuring clear type wireless service

Configuring basic settings for a clear type wireless service

NOTE:

Before configuring a clear-type wireless service, disable it first and then click the corresponding icon.

1. Select Wireless Service > Access Service from the navigation tree.

2. Click the icon corresponding to the target clear type wireless service to enter the page for configuring wireless service.

Figure 11 Configuring clear type wireless service

3. Configure basic settings for the clear type wireless service as described in Table 2.

4. Click Apply.

Table 2 Configuration items

Item	Description
Wireless Service	Display the selected Service Set Identifier (SSID).
VLAN (Untagged)	Enter the ID of the VLAN whose packets are to be sent untagged. VLAN (Untagged) indicates that the port sends the traffic of the VLAN with the VLAN tag removed.
Default VLAN	Set the default VLAN of a port. By default, the default VLAN of all ports is VLAN 1. After you set the new default VLAN, VLAN 1 is the ID of the VLAN whose packets are to be sent untagged.
Delete VLAN	Remove the IDs of the VLANs whose packets are to be sent untagged and tagged.
SSID HIDE	· Enable—Disable the advertisement of the SSID in beacon frames. · Disable—Enable the advertisement of the SSID in beacon frames. By default, the SSID is advertised in beacon frames. IMPORTANT: · If the advertising of the SSID in beacon frames is disabled, the SSID must be configured for the clients to associate with the AP. · Disabling the advertising of the SSID in beacon frames does little good to wireless security. Allowing the advertising of the SSID in beacon frames enables a client to discover an AP more easily.

Configuring advanced settings for the clear type wireless service

1. Select Wireless Service > Access Service from the navigation tree.

2. Click the icon corresponding to the target clear type wireless service to enter the page for configuring advanced settings for a clear type wireless service.

Figure 12 Advanced settings for the clear type wireless service

3. Configure advanced settings for the clear type wireless service as described in Table 3.

4. Click Apply.

Table 3 Configuration items

Item	Description
Local Forwarding	Local forwarding enables an AP to forward data frames between clients. In a centralized WLAN architecture, an AP transparently transmits data frames to an AC for processing. With the increase of clients, the forwarding load of the AC increases either. With local forwarding enabled, an AP, rather the AC forwards client data, greatly reducing the load of the AC. · Enable—If local forwarding is enabled, data frames from an associated station will be forwarded by the AP itself. · Disable—If local forwarding is disabled, data frames from an associated station will be handled by the AC.
Local Forwarding VLAN	Clients using the same SSID may belong to different VLANs. You can configure a local forwarding VLAN when configuring a local forwarding policy.
Client Max Users	Maximum number of clients of an SSID to be associated with the same radio of the AP. IMPORTANT: When the number of clients of an SSID to be associated with the same radio of the AP reaches the maximum, the SSID is automatically hidden.
Management Right	Web interface management right of online clients. · Disable—Disable the web interface management right of online clients. · Enable—Enable the web interface management right of online clients.
MAC VLAN	· Enable—Enable the MAC VLAN feature for the wireless service. · Disable—Disable the MAC VLAN feature for the wireless service. IMPORTANT: Before binding an AP radio to a VLAN, a step of enabling AP-based access VLAN recognition, enable the MAC VLAN feature first.
Fast Association	· Enable—Enable fast association. · Disable—Disable fast association. By default, fast association is disabled. When fast association is enabled, the device does not perform band navigation and load balancing calculations for associated clients.

Configuring security settings for a clear type wireless service

1. Select Wireless Service > Access Service from the navigation tree.

2. Click the icon corresponding to the target clear type wireless service to enter the page for configuring security settings for the clear type wireless service.

Figure 13 Security settings for the clear-type wireless service

3. Configure security settings for the clear type wireless service as described in Table 4.

4. Click Apply.

Table 4 Configuration items

Item	Description
Authentication Type	For the clear type wireless service, you can select Open-System only.
Port Mode	· mac-authentication—Perform MAC address authentication on users. · mac-else-userlogin-secure—This mode is the combination of the mac-authentication and userlogin-secure modes, with MAC authentication having a higher priority. Upon receiving a non-802.1X frame, a port in this mode performs only MAC authentication; upon receiving an 802.1X frame, the port performs MAC authentication and then, if MAC authentication fails, 802.1X authentication. · mac-else-userlogin-secure-ext—This mode is similar to the mac-else-userlogin-secure mode, except that it supports multiple 802.1X and MAC authentication users on the port. · userlogin-secure—In this mode, MAC-based 802.1X authentication is performed for users; multiple 802.1X authenticated users can access the port, but only one user can be online. · userlogin-secure-or-mac—This mode is the combination of the userlogin-secure and mac-authentication modes, with 802.1X authentication having a higher priority. For a wireless user, 802.1X authentication is performed first. If 802.1X authentication fails, MAC authentication is performed. · userlogin-secure-or-mac-ext—This mode is similar to the userlogin-secure-or-mac mode, except that it supports multiple 802.1X and MAC authentication users on the port. · userlogin-secure-ext—In this mode, a port performs 802.1X authentication on users in macbased mode and supports multiple 802.1X users. TIP: There are multiple security modes. To remember them easily, follow these rules to understand part of the port security mode names: · userLogin indicates port-based 802.1X authentication. · mac indicates MAC address authentication. · The authentication mode before Else is used preferentially. If the authentication fails, the authentication after Else may be used depending on the protocol type of the packets to be authenticated. · The authentication mode before Or and that after Or have the same priority. The device determines the authentication mode according to the protocol type of the packets to be authenticated. For wireless users, the 802.1X authentication mode is used preferentially. · userLogin together with Secure indicates MAC-based 802.1X authentication. · A security mode with Ext allows multiple 802.1X users to pass the authentication. A security mode without Ext allows only one 802.1X user to pass the authentication.
Max User	Maximum number of users that can be connected to the network through a specific port.

a. Configure mac-authentication

Figure 14 mac-authentication port security configuration page

Table 5 Configuration items

Item	Description
Port Mode	mac-authentication—MAC-based authentication is performed on access users. Select Wireless Service > Access Service from the navigation tree, click MAC Authentication List, and enter the MAC address of the client.
Max User	Control the maximum number of users allowed to access the network through the port.
MAC Authentication	Select MAC Authentication.
Domain	Select an existing domain from the list. The default domain is system. To create a domain, select Authentication > AAA from the navigation tree, click the Domain Setup tab, and enter a new domain name in the Domain Name field. · The selected domain name applies to only the current wireless service, and all clients accessing the wireless service use this domain for authentication, authorization, and accounting. · Do not delete a domain name in use. Otherwise, the clients that access the wireless service will be logged out.

b. Configure userlogin-secure/userlogin-secure-ext

Figure 15 userlogin-secure/userlogin-secure-ext port security configuration page (userlogin-secure is taken for example)

Table 6 Configuration items

Item	Description
Port Mode	· userlogin-secure—Perform MAC-based 802.1X authentication for access users. In this mode, multiple 802.1X authenticated users can access the port, but only one user can be online. · userlogin-secure-ext—Perform MAC-based 802.1X authentication for access users. In this mode, the port supports multiple 802.1X users.
Max User	Control the maximum number of users allowed to access the network through the port.
Mandatory Domain	Select an existing domain from the list. The default domain is system. To create a domain, select Authentication > AAA from the navigation tree, click the Domain Setup tab, and enter a new domain name in the Domain Name field. · The selected domain name applies to only the current wireless service, and all clients accessing the wireless service use this domain for authentication, authorization, and accounting. · Do not delete a domain name in use. Otherwise, the clients that access the wireless service will be logged out.
Authentication Method	· EAP—Use the Extensible Authentication Protocol (EAP). With EAP authentication, the authenticator encapsulates 802.1X user information in the EAP attributes of RADIUS packets and sends the packets to the RADIUS server for authentication; it does not need to repackage the EAP packets into standard RADIUS packets for authentication. · CHAP—Use the Challenge Handshake Authentication Protocol (CHAP). By default, CHAP is used. CHAP transmits usernames in simple text and passwords in cipher text over the network. Therefore this method is safer. · PAP—Use the Password Authentication Protocol (PAP). PAP transmits passwords in plain text.
Handshake	· Enable—Enable the online user handshake function so that the device can periodically send handshake messages to a user to check whether the user is online. By default, the function is enabled. · Disable—Disable the online user handshake function.
Multicast Trigger	· Enable—Enable the multicast trigger function of 802.1X to send multicast trigger messages to the clients periodically for initiating authentication. By default, the multicast trigger function is enabled. · Disable—Disable the 802.1X multicast trigger function. IMPORTANT: For a WLAN, the clients can actively initiate authentication, or the AP can discover users and trigger authentication. Therefore, the ports do not need to send 802.1X multicast trigger messages for initiating authentication periodically. H3C recommends that you disable the multicast trigger function in a WLAN because the multicast trigger messages consume bandwidth.

c. Configure the other four port security modes

Figure 16 Port security configuration page for the other four security modes (mac-else-userlogin-secure is taken for example)

Table 7 Configuration items

Item	Description
Port Mode	· mac-else-userlogin-secure—This mode is the combination of the mac-authentication and userlogin-secure modes, with MAC authentication having a higher priority. Upon receiving a non-802.1X frame, a port in this mode performs only MAC authentication; upon receiving an 802.1X frame, the port performs MAC authentication and then, if MAC authentication fails, 802.1X authentication. · mac-else-userlogin-secure-ext—This mode is similar to the mac-else-userlogin-secure mode, except that it supports multiple 802.1X and MAC authentication users on the port. · userlogin-secure-or-mac—This mode is the combination of the userlogin-secure and mac-authentication modes, with 802.1X authentication having a higher priority. For a wireless user, 802.1X authentication is performed first. If 802.1X authentication fails, MAC authentication is performed. · userlogin-secure-or-mac-ext—This mode is similar to the userlogin-secure-or-mac mode, except that it supports multiple 802.1X and MAC authentication users on the port. Select Wireless Service > Access Service from the navigation tree, click MAC Authentication List, and enter the MAC address of the client.
Max User	Control the maximum number of users allowed to access the network through the port.
Mandatory Domain	Select an existing domain from the list. After a mandatory domain is configured, all 802.1X users accessing the port are forced to use the mandatory domain for authentication, authorization, and accounting. The default domain is system. To create a domain, select Authentication > AAA from the navigation tree, click the Domain Setup tab, and enter a new domain name in the Domain Name field.
Authentication Method	· EAP—Use the Extensible Authentication Protocol (EAP). With EAP authentication, the authenticator encapsulates 802.1X user information in the EAP attributes of RADIUS packets and sends the packets to the RADIUS server for authentication; it does not need to repackage the EAP packets into standard RADIUS packets for authentication. · CHAP—Use the Challenge Handshake Authentication Protocol (CHAP). By default, CHAP is used. CHAP transmits usernames in simple text and passwords in cipher text over the network. Therefore this method is safer. · PAP—Use the Password Authentication Protocol (PAP). PAP transmits passwords in plain text.
Handshake	· Enable—Enable the online user handshake function so that the device can periodically send handshake messages to a user to check whether the user is online. By default, the function is enabled. · Disable—Disable the online user handshake function.
Multicast Trigger	· Enable—Enable the multicast trigger function of 802.1X to send multicast trigger messages to the clients periodically for initiating authentication. By default, the multicast trigger function is enabled. · Disable—Disable the 802.1X multicast trigger function. IMPORTANT: For a WLAN, the clients can actively initiate authentication, or the AP can discover users and trigger authentication. Therefore, the ports do not need to send 802.1X multicast trigger messages periodically for initiating authentication. You are recommended to disable the multicast trigger function in a WLAN because the multicast trigger messages consume bandwidth.
MAC Authentication	Select MAC Authentication.
Domain	Select an existing domain from the list. The default domain is system. To create a domain, select Authentication > AAA from the navigation tree, click the Domain Setup tab, and enter a new domain name in the Domain Name field. · The selected domain name applies to only the current wireless service, and all clients accessing the wireless service use this domain for authentication, authorization, and accounting. · Do not delete a domain name in use. Otherwise, the clients that access the wireless service will be logged out.

Configuring crypto type wireless service

Configuring basic settings for a crypto type wireless service

1. Select Wireless Service > Access Service from the navigation tree.

2. Click the icon corresponding to the target crypto type wireless service to enter the page for configuring wireless service.

Figure 17 Crypto type wireless service

3. Configure basic settings for the crypto type wireless service as described in Table 2.

4. Click Apply.

Configuring advanced settings for a crypto type wireless service

1. Select Wireless Service > Access Service from the navigation tree.

2. Click the icon corresponding to the target crypto type wireless service to enter the page for configuring wireless service.

Figure 18 Advanced settings for the crypto type wireless service

3. Configure advanced settings for the crypto type wireless service as described in Table 8.

4. Click Apply.

Table 8 Configuration items

Item	Description
Local Forwarding	Local forwarding enables an AP to forward data frames between clients. In a centralized WLAN architecture, an AP transparently transmits data frames to an AC for processing. With the increase of clients, the forwarding load of the AC increases either. With local forwarding enabled, an AP, rather the AC, forwards client data, greatly reducing the load of the AC. · Enable—If local forwarding is enabled, data frames from an associated station will be forwarded by the AP itself. · Disable—If local forwarding is disabled, data frames from an associated station will be handled by the AC.
Local Forwarding VLAN	Clients using the same SSID may belong to different VLANs. You can configure a local forwarding VLAN when configuring a local forwarding policy.
Client Max Users	Maximum number of clients of an SSID to be associated with the same radio of the AP. IMPORTANT: When the number of clients of an SSID to be associated with the same radio of the AP reaches the maximum, the SSID is automatically hidden.
PTK Life Time	Set the pairwise transient key (PTK) lifetime. A PTK is generated through a four-way handshake.
TKIP CM Time	Set the TKIP countermeasure time. By default, the TKIP countermeasure time is 0 seconds, that is, the TKIP countermeasure policy is disabled. Message integrity check (MIC) is designed to avoid hacker tampering. It uses the Michael algorithm and is extremely secure. When failures occur to MIC, the data may have been tampered, and the system may be under attack. With the countermeasure policy enabled, if more than two MIC failures occur within the specified time, the TKIP associations are disassociated and no new associations are allowed within the TKIP countermeasure time.
Management Right	Web interface management right of online clients. · Disable—Disable the web interface management right of online clients. · Enable—Enable the web interface management right of online clients.
MAC VLAN	· Enable—Enable the MAC VLAN feature for the wireless service. · Disable—Disable the MAC VLAN feature for the wireless service. IMPORTANT: Before you bind an AP radio to a VLAN, a step of enabling AP-based access VLAN recognition, enable the MAC VLAN feature first.
Fast Association	· Enable—Enable fast association. · Disable—Disable fast association. By default, fast association is disabled. When fast association is enabled, the device does not perform band navigation and load balancing calculations for associated clients.
GTK Rekey Method	An AC generates a group transient key (GTK) and sends the GTK to a client during the authentication process between an AP and the client through group key handshake/the 4-way handshake. The client uses the GTK to decrypt broadcast and multicast packets. · If Time is selected, the GTK will be refreshed after a specified period of time. · If Packet is selected, the GTK will be refreshed after a specified number of packets are transmitted. By default, the GTK rekeying method is time-based, and the interval is 86400 seconds.
GTK User Down Status	Enable refreshing the GTK when some client goes offline. By default, the GTK is not refreshed when a client goes off-line.

Configuring security settings for a crypto type wireless service

1. Select Wireless Service > Access Service from the navigation tree.

2. Click the icon corresponding to the target crypto type wireless service to enter the page for configuring crypto type wireless service.

Figure 19 Security settings for the crypto type wireless service

3. Configure security settings for the crypto type wireless service as described in Table 9.

4. Click Apply.

Table 9 Configuration items

Item	Description
Authentication Type	· Open-System—No authentication. With this authentication mode enabled, all the clients will pass the authentication. · Shared-Key—The two parties need to have the same shared key configured for this authentication mode. You can select this option only when WEP encryption mode is used. · Open-System and Shared-Key—It indicates that you can select both open-system and shared-key authentication. IMPORTANT: WEP encryption can be used together with open system and shared-key authentication. · Open system authentication—When this authentication mode is used, a WEP key is used for encryption only. If the two parities do not use the same key, a wireless link can still be established, but all data will be discarded. · Shared-key authentication—When this authentication mode is used, a WEP key is used for both authentication and encryption. If the two parties do not use the same key, the client cannot pass the authentication, and thus cannot access the wireless network.
Cipher Suite	Encryption mechanisms supported by the wireless service, which can be: · AES-CCMP—Encryption mechanism based on the AES encryption algorithm. · TKIP—Encryption mechanism based on the RC4 algorithm and dynamic key management. · AES-CCMP and TKIP—It indicates that you can select both CCMP and TKIP encryption.
Security IE	Wireless service type (IE information carried in the beacon or probe response frame): · WPA—Wi-Fi Protected Access. · RSN—An RSN is a security network that allows only the creation of robust security network associations (RSNAs). It provides greater protection than WEP and WPA. · WPA and RSN—It indicates that you can select both WPA and RSN..
Encryption
Provide Key Automatically	· Enable—A WEP key is dynamically assigned. · Disable—A static WEP key is used. By default, a static WEP key is used. When you enable this function, the WEP option is automatically set to wep104. IMPORTANT: · This function must be used together with 802.1X authentication. · With dynamic WEP encryption configured, the WEP key used to encrypt unicast frames is negotiated between client and server. If the WEP default key is configured, the WEP default key is used to encrypt multicast frames. If not, the device randomly generates a multicast WEP key.
WEP	· wep40—Indicates the WEP40 key option. · wep104—Indicates the WEP104 key option. · wep128—Indicates the WEP128 key option.
Key ID	· 1—Key index 1. · 2—Key index 2. · 3—Key index 3. · 4—Key index 4. There are 4 static keys in WEP. The key index can be 1, 2, 3 or 4. The key corresponding to the specified key index will be used for encrypting and decrypting broadcast and multicast frames.
Key Length	Key length. · For wep40, the key is a string of 5 alphanumeric characters or a 10-digit hexadecimal number. · For wep104, the key is a string of 13 alphanumeric characters or a 26-digit hexadecimal number. · For wep128, the key is a string of 16 alphanumeric characters or a 32-digit hexadecimal number.
WEP Key	Configure the WEP key.
Port Security	See Table 4. Parameters such as authentication type and encryption type determine the port mode. For more information, see Table 12. After you select the Cipher Suite option, the following three port security modes are added: · mac and psk—MAC-based authentication must be performed on access users first. If MAC-based authentication succeeds, an access user has to use the pre-configured PSK to negotiate with the device. Access to the port is allowed only after the negotiation succeeds. · psk—An access user must use the pre-shared key (PSK) that is pre-configured to negotiate with the device. The access to the port is allowed only after the negotiation succeeds. · userlogin-secure-ext—Perform MAC-based 802.1X authentication for access users. In this mode, the port supports multiple 802.1X users.

a. Configure mac and psk

Figure 20 mac and psk port security configuration page

Table 10 Configuration items

Item	Description
Port Mode	mac and psk: MAC-based authentication must be performed on access users first. If MAC-based authentication succeeds, an access user has to use the pre-configured PSK to negotiate with the device. Access to the port is allowed only after the negotiation succeeds. Select Wireless Service > Access Service from the navigation tree, click MAC Authentication List, and enter the MAC address of the client.
Max User	Control the maximum number of users allowed to access the network through the port.
MAC Authentication	Select MAC Authentication.
Domain	Select an existing domain from the list. The default domain is system. To create a domain, select Authentication > AAA from the navigation tree, click the Domain Setup tab, and enter a new domain name in the Domain Name field. · The selected domain name applies to only the current wireless service, and all clients accessing the wireless service use this domain for authentication, authorization, and accounting. · Do not delete a domain name in use. Otherwise, the clients that access the wireless service will be logged out.
Pre-shared Key	· pass-phrase—Enter a PSK in the form of a character string. You must enter a string that can be displayed and is of 8 to 63 characters. · raw-key—Enter a PSK in the form of a hexadecimal number. You must enter a valid 64-bit hexadecimal number.

b. Configure psk

Figure 21 psk port security configuration page

Table 11 Configuration items

Item	Description
Port Mode	psk—An access user must use the pre-shared key (PSK) that is pre-configured to negotiate with the device. The access to the port is allowed only after the negotiation succeeds.
Max User	Control the maximum number of users allowed to access the network through the port.
Pre-shared Key	· pass-phrase—Enter a PSK in the form of a character string. You must enter a string that can be displayed and is of 8 to 63 characters. · raw-key—Enter a PSK in the form of a hexadecimal number. You must enter a valid 64-bit hexadecimal number.

c. Configure userlogin-secure-ext

Perform the configurations as shown in Configure userlogin-secure/userlogin-secure-ext.

Security parameter dependencies

For a clear-type wireless service or crypto-type wireless service, the security parameter dependencies are as shown in Table 12.

Table 12 Security parameter dependencies

Service type	Authentication mode	Encryption type	Security IE	WEP encryption/key ID	Port mode
Clear	Open-System	Unavailable	Unavailable	Unavailable	· mac-authentication · mac-else-userlogin-secure · mac-else-userlogin-secure-ext · userlogin-secure · userlogin-secure-ext · userlogin-secure-or-mac · userlogin-secure-or-mac-ext
Crypto	Open-System	Selected	Required	WEP encryption is available The key ID can be 2, 3, or 4.	· mac and psk · psk · userlogin-secure-ext
	Open-System	Unselected	Unavailable	WEP encryption is required The key ID can be 1, 2, or 3.	· mac-authentication · userlogin-secure · userlogin-secure-ext
	Shared-Key	Unavailable	Unavailable	WEP encryption is required The key ID can be 1, 2, 3 or 4.	mac-authentication
	Open-System and Shared-Key	Selected	Required	WEP encryption is required The key ID can be 1, 2, 3 or 4.	· mac and psk · psk · userlogin-secure-ext
	Open-System and Shared-Key	Unselected	Unavailable	WEP encryption is required The key ID can be 1, 2, 3 or 4.	· mac-authentication · userlogin-secure · userlogin-secure-ext

Enabling a wireless service

1. Select Wireless Service > Access Service from the navigation tree.

Figure 22 Enabling a wireless service

2. Select the wireless service to be bound.

3. Click Enable.

Binding an AP radio to a wireless service

1. Select Wireless Service > Access Service from the navigation tree.

2. Click the icon corresponding to the target wireless service to enter the page for binding an AP radio to a wireless service.

Figure 23 Binding an AP radio to a wireless service

3. Select the AP radio to be bound.

4. Click Bind.

A configuration progress dialog box appears.

5. After the configuration process is complete, click Close.

Binding an AP radio to a VLAN

Traffic of different services is identified by SSIDs. Locations are identified by APs. Users at different locations access different services. For a user roaming between different APs, you can provide services for the user based on its access AP. The detailed requirements are as follows:

· Users with the same SSID but accessing through different APs can be assigned to different VLANs based on their configurations.

· A roaming user always belongs to the same VLAN.

· For a user roaming between ACs, if the local AC does not have a VLAN-interface, the user needs to use an HA in the AC group for forwarding packets to avoid packet loss.

Figure 24 Schematic diagram for WLAN support for AP-based access VLAN recognition

As shown in Figure 24, Client 1 goes online through AP 1 and belongs to VLAN 3. When Client 1 roams within an AC or between ACs, Client 1 always belongs to VLAN 3. When Client 1 roams between ACs, if FA, that is, AC 2, has VLAN-interface 3, AC 2 forwards packets from Client 1. Otherwise, packets from Client 1 are sent to HA (AC 1) through the data tunnel and then HA forwards these packets.

Client 2 goes online through AP 4 and belongs to VLAN 2. That is, a client going online through a different AP is assigned to a different VLAN.

1. Select Wireless Service > Access Service from the navigation tree.

2. Click the icon corresponding to the target wireless service to enter the AP radio setup page, as shown in Figure 23.

3. Select the box corresponding to the AP radio mode to be bound.

4. Enter the VLAN to be bound in the Binding VLAN field.

5. Click Bind.

Enabling a radio

1. Select Radio > Radio from the navigation tree.

Figure 25 Enabling 802.11n radio

2. Select the box of the target radio.

3. Click Enable.

A configuration progress dialog box appears.

4. After the configuration process is complete, click Close.

Displaying the detailed information of a wireless service

Displaying the detailed information of a clear-type wireless service

1. Select Wireless Service > Access Service from the navigation tree.

2. Click the specified clear-type wireless service to see its detailed information.

Figure 26 Displaying the detailed information of a clear-type wireless service

Table 13 Field description

Field	Description
Service Template Number	Current service template number.
SSID	Service set identifier.
Binding Interface	Name of the WLAN-ESS interface bound with the service template.
Service Template Type	Service template type.
Authentication Method	Type of authentication used. A clear-type wireless service can use only Open System authentication.
SSID-hide	· Disable—Indicates that SSID advertisement is enabled. · Enable—Indicates that SSID advertisement is disabled, that is, the AP does not advertise the SSID in the beacon frames.
Bridge Mode	Forwarding mode, which can be: · Local Forwarding—Use the local forwarding mode. · Remote Forwarding—Use the remote forwarding mode, that is, uses the AC to forward data.
Service Template Status	Service template status, which can be: · Enable—Indicates that the wireless service is enabled. · Disable—Indicates that the wireless service is disabled.
Maximum clients per BSS	Maximum number of associated clients per BSS.

Displaying the detailed information of a crypto-type wireless service

1. Select Wireless Service > Access Service from the navigation tree.

2. Click a crypto-type wireless service to see its detailed information.

Figure 27 Displaying the detailed information of a crypto-type wireless service

Table 14 Field description

Field	Description
Service Template Number	Current service template number.
SSID	Service set identifier.
Binding Interface	Name of WLAN-ESS the interface bound with the service template.
Service Template Type	Service template type.
Security IE	Security IE, which can be WPA or WPA2.
Authentication Method	Type of authentication used, which can be Open System or Shared Key.
SSID-hide	· Disable—Indicates that SSID advertisement is enabled. · Enable—Indicates that SSID advertisement is disabled, that is, the AP does not advertise the SSID in the beacon frames.
Cipher Suite	Cipher suite, which can be CCMP, TKIP, or WEP40/WEP104/WEP128.
WEP Key Index	WEP key index for encryption or de-encryption frames.
WEP Key Mode	WEP key mode: · HEX—WEP key in hexadecimal format. · ASCII—WEP key in the format of string.
WEP Key	WEP key.
TKIP Countermeasure Time(s)	TKIP MIC failure holdtime, in seconds.
PTK Life Time(s)	PTK lifetime in seconds.
GTK Rekey	GTK rekey configured.
GTK Rekey Method	GTK rekey method configured, which can be: · Time-based, which displays the GTK rekey time in seconds. · Packet-based, which displays the number of packets.
GTK Rekey Time	Time for GTK rekey in seconds.
Bridge Mode	Forwarding mode, which can be: · Local Forwarding—Use the local forwarding mode. · Remote Forwarding—Use the remote forwarding mode, that is, uses the AC to forward data.
Service Template Status	Service template status, which can be: · Enable—Indicates that the wireless service is enabled. · Disable—Indicates that the wireless service is disabled.
Maximum clients per BSS	Maximum number of associated clients per BSS.

Wireless service configuration example

Network requirements

As shown in Figure 28, an AP is required to enable employees to access the internal resources at any time. More specifically:

· An AC and the AP (serial ID 210235A29G007C000020) is connected through a Layer 2 switch.

· The AP provides clear type wireless access service with SSID service1.

· 802.11n (2.4GHz) radio mode is adopted.

Figure 28 Network diagram

Configuring the AC

1. Create an AP:

a. Select AP > AP Setup from the navigation tree.

b. Click Add.

c. On the page that appears, set the AP name to ap, select the AP model WA2620-AGN, select the serial ID manual, and enter the serial ID of the AP.

d. Click Apply.

Figure 29 Creating an AP

2. Configure a wireless service:

a. Select Wireless Service > Access Service from the navigation tree.

b. Click Add.

c. On the page that appears, set the service name to service1 and select the wireless service type clear.

d. Click Apply.

Figure 30 Creating a wireless service

3. Enable the wireless service:

a. Select Wireless Service > Access Service from the navigation tree.

b. On the page that appears, select the service1 box and click Enable.

Figure 31 Enabling wireless service

4. Bind an AP radio to a wireless service:

a. Select Wireless Service > Access Service from the navigation tree.

b. Click the icon corresponding to the wireless service service1.

c. On the page that appears, select the box before ap with radio type 802.11n(2.4GHz).

d. Click Bind.

Figure 32 Binding an AP radio

5. Enable 802.11n(2.4GHz) radio

a. Select Radio > Radio from the navigation tree.

b. Select the box before ap with the radio mode 802.11n(2.4GHz).

c. Click Enable.

Figure 33 Enabling 802.11n(2.4GHz) radio

Verifying the configuration

· The client can successfully associate with the AP and access the WLAN network.

· You can view the online clients on the page that you enter by selecting Summary > Client from the navigation tree.

Figure 34 Viewing the online clients

Configuration guidelines

Select a correct district code.