User manual D-LINK DWS-1008

[. . . ] DWS-1008 User's Manual Table of Contents Table of Contents Product Contents System Requirements Introduction Hardware Overview Features Installation Overview Getting Started Installation Configuration CLI Quickstart Command Accessing the CLI Configuration Overview Configuring for Authenticating Users Configuring APs for Wireless Users Configuring a Service Profile Configuring AAA For Administrative and Local Access Overview of AAA Access Types of Administrative Access First-Time Configuration via the Console Customizing AAA with Globs and Groups Configuring and Managing Ports and VLANs Setting the Port Type Displaying Port Statistics Configuring and Managing VLANs Managing the Layer 2 Forwarding Database Configuring the Aging Timeout Period Port and VLAN Configuration Scenario Configuring and Managing IP Interfaces and Services MTU Support Configuring and Managing IP Interfaces Configuring and Managing IP Routes Managing the Management Services Managing SSH Managing Telnet Configuring and Managing DNS Configuring and Managing Aliases Configuring and Managing Time Parameters Configuring and Managing NTP Managing the ARP Table 1 1 2 3 4 5 7 8 11 12 17 18 28 29 37 52 53 54 54 56 63 63 69 73 78 81 81 86 86 86 90 93 94 97 99 101 102 105 107 D-Link Systems, Inc. I DWS-1008 User's Manual Logging In to a Remote Device Tracing a Route IP Interfaces and Services Configuration Scenario Configuring SNMP Enabling SNMP Versions Setting SNMP Security Configuring a Notification Profile Configuring a Notification Target Enabling the SNMP Service Displaying SNMP Information Configuring DWL-8220AP Access Points Overview Service Profiles Radio Profiles Configuring Access Points Specifying the Country of Operation Configuring AP Port Parameters Configuring Security Configuring a Service Profile Configuring Radio-Specific Parameters Assigning a Radio Profile and Enabling Radios Disabling or Reenabling Radios Displaying AP Configuration Information Configuring User Encryption Configuring WPA Configuring RSN Configuring WEP Encryption Configuration Scenarios Configuring RF Auto-Tuning RF AutoTuning Overview Changing RF AutoTuning Settings Displaying RF AutoTuning Settings Wi-Fi Multimedia How WMM Works in MSS Disabling or Reenabling WMM Displaying WMM Information Configuring and Managing Spanning Tree Protocol Enabling the Spanning Tree Protocol Changing Standard Spanning Tree Parameters Configuring and Managing STP Fast Convergence Features Displaying Spanning Tree Information Spanning Tree Configuration Scenario 109 110 111 115 116 120 121 125 127 128 130 130 139 143 146 146 152 156 159 166 168 168 170 176 178 185 188 190 197 197 203 205 208 208 209 209 211 211 211 216 219 223 D-Link Systems, Inc. II DWS-1008 User's Manual Configuring and Managing IGMP Snooping Disabling or Reenabling IGMP Snooping Disabling or Reenabling Proxy Reporting Enabling the Pseudo-Querier Changing IGMP Timers Enabling Router Solicitation Configuring Static Multicast Ports Displaying Multicast Information Configuring and Managing Security ACLs About Security Access Control Lists Creating and Committing a Security ACL Mapping Security ACLs Modifying a Security ACL Using ACLs to Change CoS Enabling Prioritization for Legacy Voice over IP Security ACL Configuration Scenario Managing Keys and Certificates Why Use Keys and Certificates?About Keys and Certificates Creating Keys and Certificates Displaying Certificate and Key Information Key and Certificate Configuration Scenarios Configuring AAA for Network Users About AAA for Network Users AAA Tools for Network Users Configuring 802. 1X Authentication Configuring Authentication and Authorization by MAC Address Configuring Last-Resort Access Configuring AAA for Users of Third-Party APs Assigning Authorization Attributes Overriding or Adding Attributes Locally with a Location Policy Configuring Accounting for Wireless Network Users Displaying the AAA Configuration Avoiding AAA Problems in Configuration Order Configuring a Mobility Profile Network User Configuration Scenarios Configuring Communication with RADIUS RADIUS Overview Before You Begin Configuring RADIUS Servers Configuring RADIUS Server Groups RADIUS and Server Group Configuration Scenario 225 225 225 225 226 227 228 228 232 232 234 242 245 249 251 253 255 255 256 259 263 264 270 270 275 280 285 289 290 294 303 306 309 310 312 313 320 320 320 320 323 326 D-Link Systems, Inc. III DWS-1008 User's Manual Managing 802. 1X Managing 802. 1X on Wired Authentication Ports Managing 802. 1X Encryption Keys Managing 802. 1X Client Reauthentication Managing Other Timers Displaying 802. 1X Information Managing Sessions About the Session Manager Displaying and Clearing Administrative Sessions Displaying and Clearing Network Sessions Rogue Detection and Countermeasures About Rogues and RF Detection Summary of Rogue Detection Features Configuring Rogue Detection Lists Enabling Countermeasures Disabling or Reenabling Active Scan Enabling AP Signatures Disabling or Reenabling Logging of Rogues Enabling Rogue and Countermeasures Notifications IDS and DoS Alerts Displaying RF Detection Information Managing System Files About System Files Working with Files Managing Configuration Files Backing Up and Restoring the System Appendix A - Troubleshooting Fixing Common Setup Problems Recovering the System Password Configuring and Managing the System Log Running Traces Using Show Commands Remotely Monitoring Traffic Capturing System Information for Technical Support Appendix B - Supported RADIUS Attribites Supported Standard and Extended Attributes Appendix C - DHCP Server How the MSS DHCP Server Works Configuring the DHCP Server Displaying DHCP Server Information Appendix D - Glossary Appendix E - Technical Specifications Appendix F - Warranty Appendix G - Registration 328 328 329 332 334 335 338 338 338 340 345 345 348 350 355 355 356 356 356 356 362 366 366 368 372 376 378 378 380 380 387 391 392 399 400 400 405 406 406 407 409 441 444 449 D-Link Systems, Inc. IV DWS-1008 User's Manual Product Contents Product Contents DWS-1008 8-Port Wireless Switch Power Supply Serial Cable for Connection to Console Rack-Mount Brackets (2) Rubber Feet (4) Screws (6) Install Guide Manual and Reference Guide on CD System Requirements An existing 10/100 Ethernet network DWL-8220AP Access Point(s) Warning: Installation must be performed by qualified service personnel only. Please follow all warning notices and instructions marked on the product or included in the documentation. The manufacturer is not responsible for any radio or TV interference caused by unauthorized modifications to this equipment. [. . . ] For example, to commit acl-99, type the following command: DWS-1008# commit security acl acl-99 success: change accepted. To commit all the security ACLs in the edit buffer, type the following command: DWS-1008# commit security acl all success: change accepted. Viewing Security ACL Information To determine whether a security ACL is committed, you can check the edit buffer and the committed ACLs. After you commit an ACL, MSS removes it from the edit buffer. To display ACLs, use the following command: show security acl [editbuffer] Use the editbuffer option to display the ACLs that you have not yet committed to nonvolatile storage. To display the ACLs that are already committed, omit the option. ACLs are not available until you commit them. (To commit an ACL, use the commit security acl command. See Com. ) Viewing the Edit Buffer The edit buffer enables you to view the security ACLs you create before committing them to the configuration. To view a summary of the ACLs in the edit buffer, type the following command: DWS-1008# show security acl editbuffer ACL edit-buffer table ACL Type Status --------------------------------------------------------acl-99 IP Not committed acl-blue IP Not committed acl-violet IP Not committed D-Link Systems, Inc. DWS-1008 User's Manual Configuring and Managing Security ACLs Viewing Committed Security ACLs To view a summary of the committed security ACLs in the configuration, type the following command: DWS-1008# show security acl ACL table ACL Type Class Mapping ----------------------------------------------acl-2 IP Static acl-3 IP Static acl-4 IP Static Viewing Security ACL Details You can display the contents of one or all security ACLs that are committed. To display the contents of all committed security ACLs, type the following command: DWS-1008# show security acl info all ACL information for all set security acl ip acl-999 (hits #2 0) ---------------------------------------------------1. deny IP source IP 192. 168. 0. 1 0. 0. 0. 0 destination IP any 2. permit IP source IP 192. 168. 0. 2 0. 0. 0. 0 destination IP any enable-hits set security acl ip acl-2 (hits #1 0) ---------------------------------------------------1. permit L4 Protocol 115 source IP 192. 168. 1. 11 0. 0. 0. 0 destination IP 192. 168. 1. 15 0. 0. 0. 0 precedence 0 tos 0 enable-hits You can also view a specific security ACL. For example, to view acl-2, type the following command: DWS-1008# show security acl info acl-2 ACL information for acl-2 set security acl ip acl-2 (hits #1 0) ---------------------------------------------------1. permit L4 Protocol 115 source IP 192. 168. 1. 11 0. 0. 0. 0 destination IP 192. 168. 1. 15 0. 0. 0. 0 precedence 0 tos 0 enable-hits D-Link Systems, Inc. 0 DWS-1008 User's Manual Configuring and Managing Security ACLs Displaying Security ACL Hits Once you map an ACL, you can view the number of packets it has filtered, if you included the keyword hits. Type the following command: DWS-1008# show security acl hits ACL hit-counters Index Counter ACL-name ------------------------------------------10 acl-2 20 acl-999 5 916 acl-123 To sample the number of hits the security ACLs generate, you must specify the number of seconds between samples. For example, to sample the hits generated every 180 seconds, type the following commands: DWS-1008# hit-sample-rate 180 DWS-1008# show security acl hits ACL hit-counters Index Counter ACL-name ------------------------------------------1 31986 acl-red 20 acl-green Clearing Security ACLs The clear security acl command removes the ACL from the edit buffer only. To clear a security ACL, enter a specific ACL name, or enter all to delete all security ACLs. To remove the security ACL from the running configuration and nonvolatile storage, you must also use the commit security acl command. For example, the following command deletes acl-99 from the edit buffer: DWS-1008# clear security acl acl-99 To clear acl-99 from the configuration, type the following command: DWS-1008# commit security acl acl-99 success: change accepted D-Link Systems, Inc. DWS-1008 User's Manual Configuring and Managing Security ACLs Mapping Security ACLs User-based security ACLs are mapped to an IEEE 802. 1X authenticated session during the AAA process. You can specify that one of the authorization attributes returned during authentication is a named security ACL. The switch maps the named ACL automatically to the user's authenticated session. [. . . ] THE SOLE REMEDY FOR A BREACH OF THE FOREGOING LIMITED WARRANTY IS REPAIR, REPLACEMENT OR REFUND OF THE DEFECTIVE OR NON-CONFORMING PRODUCT. THE MAXIMUM LIABILITY OF D-LINK UNDER THIS WARRANTY IS LIMITED TO THE PURCHASE PRICE OF THE PRODUCT COVERED BY THE WARRANTY. THE FOREGOING EXPRESS WRITTEN WARRANTIES AND REMEDIES ARE EXCLUSIVE AND ARE IN LIEU OF ANY OTHER WARRANTIES OR REMEDIES, EXPRESS, IMPLIED OR STATUTORY. Governing Law: This Limited Warranty shall be governed by the laws of the State of California. Some states do not allow exclusion or limitation of incidental or consequential damages, or limitations on how long an implied warranty lasts, so the foregoing limitations and exclusions may not apply. [. . . ]