In our next section we will talk about Cisco wireless infrastructure
let's start with the access point types and connecting to Cisco access point as Cisco wireless network
can consist of autonomously access points or light the way to access points that are coupled with one
or more wireless LAN controllers.
As you can see in the screen we have an autonomous API in here and we have the lightweight HP in here.
The autonomous AP is connected to a switched network wire at wrinkling and this lightweight AP is connected
to a switch lan mostly with an access link but lightweight AP is communicating with the wireless controller
also as you can see in here with cap wrap.
Okay.
After this brief information let's talk about in some more detail about these two types and autonomous
a access point is a standalone device and nothing else is needed to forward to Ethernet frames from
a wired we lend to a wireless LAN and vice versa.
In effect the AP maps each wheel then to a wireless LAN and the assess the autonomous AP has a single
wired Ethernet interface as shown in the left portion of fear and as I showed you.
Which means that multiple villains must be brought to it over at CERN Klink a lightweight AP also has
a single wide Internet interface.
However it must be paired with a wireless controller to be fully functional.
Why do we Lance that terminate at the wireless controller can be mapped to wireless local area network
that emerge at the access point even though multiple villains are being extended from the wireless controller
to the access point they are all carried over and they kept that tunnel between the two.
That means the access point needs only an access link to connect to the network infrastructure and terminate
its end of the tunnel.
As shown in the right portion of the figure.
So if you want to configure and manage Cisco access points you can connect to a serial console cable
from your P.C. to the console port of the access point once the access point is operational and has
an IP address.
You can also use 10 that or SSA to connect to it CLIA over the wired network autonomous APIs support
browser beach browser based management sessions via ETP and Asian shitty as you can manage the light
weight a piece from a browser session to the wireless controller
okay.
But how are we going to access to the Cisco wireless controller to connect to and configure Cisco wireless
controller.
You will need to open a web browser to the wireless controllers management to address with either ATP
or H2 G.P.S..
This can be done only after the wireless controller has an initial configuration and management IP address
assigned to its management interface.
The web based G UI provides an effective way to monitor configure and troubleshoot a wireless network.
You can also connect to Cisco wireless controller with an SSD each session where you can use it CLIA
to monitor configure and debug activity both the web based G U and the S.L. I require management users
to log in.
Users can be authenticated against an internal list of local user names or against an authentication
authorization and accounting through Apple a server such as tax plus or radius.
When you first open a web browser to the management address you will see the initial Logan's screen.
Once you click the logging button you can see in here once you click this button and then you enter
your credentials as you are prompted for them
when you successfully log in the wireless controller will display and monitoring dashboard similar to
the one you can see in the figure.
Guys you will not be able to make any configuration change here.
You must click on the advanced link a you can see it here to make some configuration changes.
And even here you can see some network summary and total wireless network counts how many access points
you have.
How many active clients do you have and some rogue IP information and interfere.
Is here also once you click the advanced button this will bring up the full wireless control or G you
I as shown in the figure you can select categories of functions from among in here.
You can also see that monitor wireless LAN controller wireless security management commands help and
feedback saw at the vertical list of functions at the left side of the screen and will change accordingly.
Once you select one of these options you can expand the list to entries if needed and select one to
work on the main screen area will display all of relevant fields and options.
You can edit as you make a configuration change.
So how we can connect to Cisco wireless control or let's talk in detail about this one.
So guys connecting a Cisco wireless LAN controller to the network is not quite as straight forward because
it has several different types of connections.
Control of ports are physical connections made to an external wired or switched network whereas interfaces
are logical connections made internally within the controller.
You can connect several different types of controller ports to your network.
As you can see in the screen so you can see here we have service part.
This port is used for out of pain management system recovery and initial built functions always come
next to a switch port in Access mode and we have also distribution ports in here then these ports are
used for all normal access point and management traffic and usually connect to a switch port in trying
so here is mostly trying.
And here is the access parts.
And we have also console port in here you can see that.
And this port is used for out bands of management system recovery and initial boot functions.
And we also have the redundancy port and that is used to connect to a pier controller for high availability
so let's go ahead with connecting to Cisco wireless controller through its distribution system ports.
A controller can connect to multiple villains on the switch network.
Internally the controller must somehow map those wide valence to actual and logical wireless networks
for example.
Guys.
So let's suppose that we land 10 is set aside for wireless users in the engineering division of the
company that we land must be connected to a unique wireless local area network that exists on air controller
and its associated access point the wireless local area network must then be extended to every client
that associates with the service set identifier and SS I.D. engineering.
So Cisco wireless controllers provide the necessary connectivity through internal logical interfaces
which must be configured with an IP address subnet mask default gateway and AD D.
Hey the HBP server each interface is then assigned to a physical port and we land I.D. You can't think
of an interface as Layer three termination of real long guys.
So Cisco controller support following interface types that you can see in screen also.
And the first one is the dynamic interface dynamic interface is used to connect to a villain to a violence
local area network.
You can see in here.
We also have the management interface.
You can see also in here and management the interface is used for normal management traffic such as
ready as user authentication web based and SSA sessions as an MP.
A.P. and so on the management the interface is also used to terminate kep tunnels between the controller
and it has access point.
And also we have the redundancy management interface and this is the management the IP address of a
redundant wireless controller.
That is part of our high availability pair of controllers the active wireless controller uses the management
the interface address while this thing by wireless controller uses the redundancy management address.
And we have also in here the service part interface and this interface is bound to the service port
and the used for out of bond management.
Also we also have the virtual interface and IP address facing wireless clients.
When controller is relaying climbed the H.S. peer requests performing client work authentication and
supporting client mobility and we also have the virtual interface which is the IP address facing wireless
clients when the controller is relaying client ACP requests performing client web authentication and
supporting client mobility
so let's talk about the configuring our wireless local area network and wireless local area network
controller and an access point work in concert to provide network connectivity to wireless clients from
a wireless perspective.
The AP advertises a service said identifier which is known as SSI I.D. for declined to join from a wide
perspective the controller connects to a virtual lan villain through one of its dynamic interfaces and
to complete the path between the SS I.D. and the villain as illustrated in the screen.
You must first define a wireless local area network on the controller
so let's go step by step how we can call for your local wireless local area network if your need wireless
local area network will use a security scheme that requires a radio server such as WPA WPA to enterprise
or WPA 3 enterprise you will need to define the server first guys and a unit to select.
You can see in here security triple A and the authentication and you need to click new
once you click the name you will go to the screen that you can create a new server.
And next you need to enter servers IP address firstly.
OK.
And shared scripts key and the port number if you already had two other radio servers configured the
server at two.
That 30 will be index number three as you can see in here.
Be sure to set these server status to enabled so that the controller can begin using it at the bottom
of the page.
Also guys you can see the type of user that will be authenticated with the server you can check the
network user to authenticate wireless clients or management to authenticate wireless administrators
that will access the controls management functions.
Then you need to click apply button in here to save your configuration.
The next step is creating a dynamic interface a dynamic interface is used to connect the controller
to every LAN on the wired network.
As I explained you before when you create a wireless LAN you will bind the dynamic interface to our
wireless network to create a new dynamic interface.
You navigate the controller and the interfaces and you just click the new button to define the new interface.
Then you enter and name as you can see in here the name is engineering and you just defined the villain
idea which is defined one hundred four days.
Example
next you need to enter the IP address subnet mask and Gateway address for the interface.
Okay.
You can see in here and they are all defined and also you should define primary and secondary DCP server
addresses that the controller will use when it relays the ACP requests from clients that are bound to
that interface.
And here is the DCP information defined as you can see in here.
Okay.
As a summary it is defined as an IP address with one hundred and ten and with a net mask with 255 255
255 that zero and Gateway is one hundred.
That that that that one and we have to DTP service and they are one that 17 and one that 18 once we
accomplish here we just can click apply to save our configuration.
Okay.
After creating the dynamic interface then step three is creating a new wireless local area network.
You can display a list of the currently defined wireless local area networks by selecting wireless local
area networks from the top menu bar in feed your abode.
The controller does not have any wireless local area networks defined already.
You can't create a new wireless local area network by selecting create new from the drop down menu and
then clicking the Go button.
OK next enter a descriptive name as the profile name and the SSA I.D. text string.
You can see all these definitions on the figure below and the profile name and SS I.D. are identical
and they are both set the engineering as you can see in here and this is just to keep things straight
forward.
The idea number is used as an index into the list of wireless local area networks that are defined on
the controller didn't next page will allow you to edit for categories of parameters corresponding to
the tops across the top.
As shown in the figure you can control whether the wireless local area network is enabled or disabled
with the status check box in here you can see the checkbox regarding the status.
And even though the general page shows a specific security policy word for the wireless local area network
you can make changes in a later step through these security tap and under read your policy you can see
that one here select the type of the radio that will offer the wireless local area network and by default
the wireless local area network will be offered on all radios that are joint with the controller and
next unit to select which of the controllers dynamic interfaces will be bumped to the wireless local
area network you can see in here we are binding the engineering right.
Okay.
The drop down list contains all the interfaces names that are available and a new engineering violence
local network will be bound to the engineering interface that we already created on our previous step
and finally use the broadcast to access ideas.
There is a box in here that you can check so I use the broadcast SSI the checkbox to select whether
a piece should broadcast the SSI Dean name in beacons they transmit broadcasting SSI I.D. is usually
more convenient for users because their devices can learn and displayed the SSI I.D. names automatically.
In fact most devices actually need the SS I.D. in the big beacons to understand and that the AP is still
available for that SS I.D. hiding the SS I.D. name by not broadcasting it.
I mean does not really provide any worthwhile security.
Instead it just prevents user devices from discovering an SS I.D. and trying to use it as a default
network.
And also lets go ahead with the security tab.
That is the 2nd tab and this is the place that you can configure the security sector settings as you
select a security type.
Be sure to remember which choices are types that have been deprecated or proven to be weak and avoid
them if possible further down the screen you can select which specific WPA wpa 2 and WPA 3 methods to
support on the wireless local area network.
You can select more than one if you need to support different types of wireless clients that require
several security methods and also in the screen.
WPA plus wpa 2 has been selected from the pull down menu then only wpa 2 and i e s and corruption have
been selected WPA and tiki T.K. IP have been avoided because they are legacy and deprecated methods
under the authentication key management section.
You can select the authentication methods the villain wireless local area network will use only appreciate.
Key has been selected in the figure so the wireless local area network will only WPA to personal with
the appreciate key authentication and the venue switch to the true police service tap.
You will have an option to define different radio servers for authentication will be used for W lan
authentication.
And here you can see that a 3 different ready servers are defined already and by default a controller
will contact a radio server from its management interface and you can overwrite this behavior by checking
the box next to radius so overwrite interface so that the controller sources reduce requests from the.
Dynamic interface that is associated with the W LAN and here is that option you can see.
The option in here OK.
OK.
Once you add change to the a curious a we can define some cure as parameters for our wireless local
area networks so you can simply select the cures tab to configure quality of service settings for the
wireless local area network as shown in the figure by default the controller will consider all frames
in the wireless local area network to be normal data to be handled in a best effort manner.
I mean you can't set the cure as drew up the menu to classify a classify all frames in one of the following
ways and they are platinum was gold video silver best effort and the bronze background finally you can
select the advanced tab to configure a variety of advanced wireless local area network settings as you
can see in the figure you can enable functions such as coverage hole detection peer to peer blocking
client exclusion client load limits and so on and so on.
Although most of the advanced settings are beyond the scope of the CCMA objectives you should be aware
of a few defaults that might affect your wireless clients so the first thing is here by default client
sessions with the wireless local area network are limited to one thousand and eight hundred seconds
which equals to 30 minutes.
Once the session time expires a client will be required to re authenticate this setting is controlled
by the enabled session time out checkbox and the timeout failed.
The controller maintains a set of security policies that are used to detect potentially malicious violence
clients as well.
If a client exhibits as certain behavior the controller can exclude it from the wireless local area
network for a period of time by default.
Again all clients are subject to the policies configured on their security wireless protection policies
and client exclusion block policies.
These policies include the excessive 810 to that eleven association failures eight hundred and two that
eleven authentication failures and 800 words and two that one ex authentication failures web authentication
failures and sorry and IP addresses theft or reuse or offending clients will be automatically excluded
or blocked for six seconds as a deterrent to attacks on the wireless network and finally when you are
satisfied with the settings in each of the wireless local area network configuration taps you can click
the play button in the upper right corner of the wireless local area network edit screen the wireless
local area network will be created and edit the controller configuration and in here you can see we
created any wireless local network and will an I.D. is w lan I.D. one type is wireless local area network
our profile name and they w lan SSI is set to engineering and admits that this is already enabled and
here is the security policies.