Cisco IOS Configuration Guide for Autonomous Cisco Aironet Access Points Cisco IOS Releases 15.3(3)JE and Later First Published: May 22, 2017 Cisco Systems, Inc. www.cisco.com Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco website at www.cisco.com/go/offices. Text Part Number: THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. Cisco IOS Configuration Guide for Autonomous Cisco Aironet Access Points © 2017 Cisco Systems, Inc. All rights reserved. CONTENTS 1 Preface xix Audience i-xix Purpose i-xix Configuration Procedures and Examples i-xix Organization i-xx Conventions i-xxi Related Documentation i-xxii CHAPTER 1 Overview of Access Point Features 1-1 Radios in Access Points 1-1 New Features and Commands in a Release 1-2 Management Options 1-2 Roaming Client Devices 1-2 Network Configuration Examples 1-2 Root Access Point 1-3 Repeater Access Point 1-3 Bridges 1-4 Workgroup Bridge 1-5 Central Unit in an All-Wireless Network 1-6 CHAPTER 2 Using the Web-Browser Interface 2-1 Using the Web-Browser Interface for the First Time 2-2 Using the Management Pages in the Web-Browser Interface 2-2 Using Action Buttons 2-3 Character Restrictions in Entry Fields 2-4 Enabling HTTPS for Secure Browsing 2-5 Deleting an HTTPS Certificate 2-7 Using Online User Guides 2-7 Disabling the Web-Browser Interface 2-7 Cisco IOS Software Configuration Guide for Cisco Aironet Access Points 1 Contents CHAPTER 3 Using the Command-Line Interface 3-1 Cisco IOS Command Modes 3-2 Getting Help 3-3 Abbreviating Commands 3-3 Using the no and Default Forms of Commands 3-4 Understanding CLI Messages 3-4 Using Command History 3-4 Changing the Command History Buffer Size 3-5 Recalling Commands 3-5 Disabling the Command History Feature 3-5 Using Editing Features 3-6 Enabling and Disabling Editing Features 3-6 Editing Commands Through Keystrokes 3-6 Editing Command Lines that Wrap 3-7 Searching and Filtering Output of show and more Commands 3-8 Accessing the CLI 3-9 Opening the CLI with Telnet 3-9 Opening the CLI with Secure Shell 3-9 CHAPTER 4 Configuring the Access Point for the First Time 4-1 Before You Start 4-1 Resetting the Device to Default Settings 4-1 Resetting to Default Settings Using the MODE Button 4-2 Resetting to Default Settings Using the GUI 4-2 Resetting to Default Settings Using the CLI 4-2 Logging into the Access Point 4-3 Obtaining and Assigning an IP Address 4-4 Default IP Address Behavior 4-4 Connecting to an Access Point Locally 4-5 Connecting to the 1550 Series Access Point Locally 4-5 Default Radio Settings 4-6 Assigning Basic Settings 4-6 Default Settings on the Easy Setup Page 4-10 Understanding the Security Settings 4-11 Using VLANs 4-11 Security Types for an SSID 4-12 Limitations of Security Settings 4-14 Cisco IOS Software Configuration Guide for Cisco Aironet Access Points 2 Contents CLI Configuration Examples 4-15 Configuring System Power Settings Access Points 4-21 Using the AC Power Adapter 4-21 Using a Switch Capable of IEEE 802.3af Power Negotiation 4-21 Using a Switch That Does Not Support IEEE 802.3af Power Negotiation 4-22 Using a Power Injector 4-22 dot11 extension power native Command 4-22 Support for 802.11ac 4-22 Channel Widths for 802.11ac 4-22 Power Management for 802.11ac 4-23 Assigning an IP Address Using the CLI 4-24 Using a Telnet Session to Access the CLI 4-24 Configuring the 802.1X Supplicant 4-24 Creating a Credentials Profile 4-25 Applying the Credentials to an Interface or SSID 4-26 Applying the Credentials Profile to the Wired Port 4-26 Applying the Credentials Profile to an SSID Used For the Uplink 4-26 Creating and Applying EAP Method Profiles 4-27 Configuring IPv6 4-27 Configuring DHCPv6 address 4-29 IPv6 Neighbor Discovery 4-29 Configuring IPv6 Access Lists 4-31 RADIUS Configuration 4-31 IPv6 WDS Support 4-31 CDPv6 Support: 4-32 RA filtering 4-33 Automatic Configuring of the Access Point 4-33 Enabling Autoconfig 4-33 Prepare a Configuration Information File 4-33 Enable environmental variables 4-34 Schedule the Configuration Information File Download 4-34 Enabling Autoconfig via a Boot File 4-35 Checking the Autoconfig Status 4-35 Debugging Autoconfig 4-36 CHAPTER 5 Administrating the Access Point 5-1 Disabling the Mode Button 5-2 Preventing Unauthorized Access to Your Access Point 5-3 Cisco IOS Software Configuration Guide for Cisco Aironet Access Points 3 Contents Protecting Access to Privileged EXEC Commands 5-3 Default Password and Privilege Level Configuration 5-4 Setting or Changing a Static Enable Password 5-4 Protecting Enable and Enable Secret Passwords with Encryption 5-6 Configuring Username and Password Pairs 5-7 Configuring Multiple Privilege Levels 5-8 Setting the Privilege Level for a Command 5-9 Logging Into and Exiting a Privilege Level 5-9 Configuring Easy Setup 5-10 Configuring Spectrum Expert Mode 5-11 Controlling Access Point Access with RADIUS 5-12 Default RADIUS Configuration 5-12 Configuring RADIUS Login Authentication 5-12 Defining AAA Server Groups 5-14 Configuring RADIUS Authorization for User Privileged Access and Network Services 5-16 Displaying the RADIUS Configuration 5-17 Controlling Access Point Access with TACACS+ 5-17 Default TACACS+ Configuration 5-17 Configuring TACACS+ Login Authentication 5-17 Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 5-19 Displaying the TACACS+ Configuration 5-19 Configuring Ethernet Speed and Duplex Settings 5-20 Configuring the Access Point for Wireless Network Management 5-20 Configuring the Access Point for Local Authentication and Authorization 5-21 Configuring the Authentication Cache and Profile 5-22 Configuring the Access Point to Provide DHCP Service 5-24 Setting up the DHCP Server 5-24 Monitoring and Maintaining the DHCP Server Access Point 5-26 Show Commands 5-26 Clear Commands 5-26 Debug Command 5-27 Configuring the Access Point for Secure Shell 5-27 Understanding SSH 5-27 Configuring SSH 5-27 Support for Secure Copy Protocol 5-28 Configuring Client ARP Caching 5-28 Understanding Client ARP Caching 5-28 Optional ARP Caching 5-29 Cisco IOS Software Configuration Guide for Cisco Aironet Access Points 4 Contents Configuring ARP Caching 5-29 Managing the System Time and Date 5-29 Understanding Simple Network Time Protocol 5-30 Configuring SNTP 5-30 Configuring Time and Date Manually 5-30 Setting the System Clock 5-31 Displaying the Time and Date Configuration 5-32 Configuring the Time Zone 5-32 Configuring Summer Time (Daylight Saving Time) 5-33 Defining HTTP Access 5-35 Configuring a System Name and Prompt 5-35 Default System Name and Prompt Configuration 5-35 Configuring a System Name 5-36 Understanding DNS 5-36 Default DNS Configuration 5-37 Setting Up DNS 5-37 Displaying the DNS Configuration 5-38 Creating a Banner 5-38 Default Banner Configuration 5-38 Configuring a Message-of-the-Day Login Banner 5-38 Configuring a Login Banner 5-40 Upgrading Autonomous Cisco Aironet Access Points to Lightweight Mode 5-41 CHAPTER 6 Configuring Radio Settings 6-1 Enabling the Radio Interface 6-2 Configuring the Role in Radio Network 6-3 Universal Workgroup Bridge Mode 6-6 Point-to-point and Multi Point