Wireless Distribution System
Wireless Distribution System
Wireless Distribution System
11
Understanding WDS, page 11-2 Understanding Fast Secure Roaming, page 11-3 Understanding Radio Management, page 11-4 Configuring WDS and Fast Secure Roaming, page 11-4 Using Debug Messages, page 11-13
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide OL-1033-01
11-1
Understanding WDS
The following sections describe WDS even though the access point/bridge cannot be configured as a WDS server even when it is configured as an access point. However, when configured as an access point, the access point/bridge can use a WDS server and can act as a WDS authenticator (client). When you configure an access point to provide WDS, other access points (such as your access point/bridge if it is configured as an access point) on your wireless LAN use the WDS access point to provide fast, secure roaming for client devices and to participate in radio management. Fast, secure roaming provides rapid reauthentication when a client device roams from one access point to another, preventing delays in voice and other time-sensitive applications. Access points participating in radio management forward information about the radio environment (such as possible rogue access points and client associations and disassociations) to the WDS access point. The WDS access point aggregates the information and forwards it to a wireless LAN solution engine (WLSE) device on your network.
Advertises its WDS capability and participates in electing the best WDS access point for your wireless LAN. When you configure your wireless LAN for WDS, you set up one access point as the main WDS access point candidate and one or more additional access points as backup WDS access point candidates. Authenticates all access points in the subnet and establishes a secure communication channel with each of them. Collects radio data from access points in the subnet, aggregates the data, and forwards it to the WLSE device on your network. Registers all client devices in the subnet, establishes session keys for them, and caches their security credentials. When a client roams to another access point, the WDS access point forwards the clients security credentials to the new access point.
Discover and track the current WDS access point and relay WDS advertisements to the wireless LAN. Authenticate with the WDS access point and establish a secure communication channel to the WDS access point. Register associated client devices with the WDS access point. Report radio data to the WDS access point.
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide
11-2
OL-1033-01
Chapter 11
Configuring WDS, Fast Secure Roaming, and Radio Management Understanding Fast Secure Roaming
Wired LAN
Client device 1. Authentication request 2. Identity request 3. Username (relay to client) 5. Authentication response (relay to client) 7. Authentication challenge (relay to client) 9. Successful authentication
RADIUS Server
(relay to server) 4. Authentication challenge (relay to server) 6. Authentication success (relay to server) 8. Authentication response (relay to server)
65583
When you configure your wireless LAN for fast, secure roaming, however, LEAP-enabled client devices roam from one access point to another without involving the main server. Using Cisco Centralized Key Management (CCKM), an access point configured to provide Wireless Domain Services (WDS) takes the place of the RADIUS server and authenticates the client so quickly that there is no perceptible delay in voice or other time-sensitive applications. Figure 11-2 shows client authentication using CCKM.
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide OL-1033-01
11-3
Figure 11-2 Client Reassociation Using CCKM and a WDS Access Point
Wired LAN
Access point
Authentication server
88964
The WDS access point maintains a cache of credentials for CCKM-capable client devices on your wireless LAN. When a CCKM-capable client roams from one access point to another, the client sends a reassociation request to the new access point, and the new access point relays the request to the WDS access point. The WDS access point forwards the clients credentials to the new access point, and the new access point sends the reassociation response to the client. Only two packets pass between the client and the new access point, greatly shortening the reassociation time. The client also uses the reassociation response to generate the unicast key.
Guidelines for WDS, page 11-5 Requirements for WDS and Fast Secure Roaming, page 11-5 Configuring the Access Point/Bridge to use the WDS Access Point, page 11-5 Configuring the Access Point/Bridge to use the WDS Access Point, page 11-5 Configuring the Authentication Server to Support Fast Secure Roaming, page 11-7
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide
11-4
OL-1033-01
Chapter 11
Configuring WDS, Fast Secure Roaming, and Radio Management Configuring WDS and Fast Secure Roaming
Viewing WDS Information, page 11-12 Using Debug Messages, page 11-13
You cannot configure your access point/bridge as a WDS access point. However, when you configure your access point/bridge as an access point, you can also configure it to use the WDS access point. Repeater access points do not support WDS.
At least one access point available to be configured as the WDS access point An authentication server (or an access point configured as a local authenticator) Cisco Aironet client devices running Cisco client firmware version 5.20.17 or later
Browse to the Wireless Services Summary page. Click AP to browse to the Wireless Services AP page. Figure 11-3 shows the Wireless Services AP page.
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide OL-1033-01
11-5
Step 3 Step 4
In the Participate in SWAN Infrastructure field, click Enabled. Choose one of the following options in the WDS Discovery field:
a. b.
Auto DiscoveryThe access point/bridge finds the WDS access point automatically. Specified DiscoveryThe access point/bridge discovers the WDS access point based on the IP address you enter.
Step 5 Step 6
In the Username field, enter a username for the access point/bridge. This username must match the username that you create for the access point/bridge on your authentication server. In the Password field, enter a password for the access point/bridge, and enter the password again in the Confirm Password field. This password must match the password that you create for the access point/bridge on your authentication server. In the L3 Mobility Service via IP/GRE Tunnel, enter the value of the GRE Tunnel MTU. Click Apply.
Step 7 Step 8
Once you complete the configuration, the access point/bridge interacts with the WDS and automatically performs these steps:
Discovers and tracks the current WDS access point and relays WDS advertisements to the wireless LAN. Authenticates with the WDS access point and establishes a secure communication channel to the WDS access point. Registers associated client devices with the WDS access point.
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide
11-6
OL-1033-01
Chapter 11
Configuring WDS, Fast Secure Roaming, and Radio Management Configuring WDS and Fast Secure Roaming
In this example, the access point/bridge is enabled to interact with the WDS access point, and it authenticates to your authentication server using APWestWing as its username and wes7win8 as its password. You must configure the same username and password pair when you set up the access point as a client on your authentication server. For complete descriptions of the commands used in this example, consult the Cisco IOS Command Reference for Cisco Aironet Access Points and Bridges.
Log into Cisco Secure ACS and click Network Configuration to browse to the Network Configuration page. You must use the Network Configuration page to create an entry for the WDS access point. Figure 11-4 shows the Network Configuration page.
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide OL-1033-01
11-7
Step 2
Click Add Entry under the AAA Clients table. The Add AAA Client page appears. Figure 11-5 shows the Add AAA Client page.
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide
11-8
OL-1033-01
Chapter 11
Configuring WDS, Fast Secure Roaming, and Radio Management Configuring WDS and Fast Secure Roaming
In the AAA Client Hostname field, enter the name of the WDS access point. In the AAA Client IP Address field, enter the IP address of the WDS access point. In the Key field, enter exactly the same password that is configured on the WDS access point. From the Authenticate Using drop-down menu, select RADIUS (Cisco Aironet). Click Submit. Repeat Step 2 through Step 7 for each WDS access point candidate. Click User Setup to browse to the User Setup page. You must use the User Setup page to create entries for the access points that use the WDS access point. Figure 11-6 shows the User Setup page.
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide OL-1033-01
11-9
Enter the name of the access point in the User field. Click Add/Edit. Scroll down to the User Setup box. Figure 11-7 shows the User Setup box.
Figure 11-7 ACS User Setup Box
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide
11-10
OL-1033-01
Chapter 11
Configuring WDS, Fast Secure Roaming, and Radio Management Configuring WDS and Fast Secure Roaming
Select CiscoSecure Database from the Password Authentication drop-down menu. In the Password and Confirm Password fields, enter exactly the same password that you entered on the access point on the Wireless Services AP page. Click Submit. Repeat Step 10 through Step 15 for each access point that uses the WDS access point. Browse to the System Configuration page, click Service Control, and restart ACS to apply your entries. Figure 11-8 shows the System Configuration page.
Figure 11-8 ACS System Configuration Page
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide OL-1033-01
11-11
show wlccp wds { ap | mn } On the WDS access point only, use this command to display [ detail ] [ mac-addr mac-address ] cached information about access points and client devices.
apUse this option to display access points participating in CCKM. The command displays each access points MAC address, IP address, state (authenticating, authenticated, or registered), and lifetime (seconds remaining before the access point must reauthenticate). Use the mac-addr option to display information about a specific access point. mnUse this option to display cached information about client devices, also called mobile nodes. The command displays each clients MAC address, IP address, the access point to which the client is associated (cur-AP), and state (authenticating, authenticated, or registered). Use the detail option to display the clients lifetime (seconds remaining before the client must reauthenticate), SSID, and VLAN ID. Use the mac-addr option to display information about a specific client device.
If you only enter show wlccp wds, the command displays the access points IP address, MAC address, priority, and interface state (administratively standalone, active, backup, or candidate). If the state is backup, the command also displays the current WDS access points IP address, MAC address, and priority.
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide
11-12
OL-1033-01
Chapter 11
Configuring WDS, Fast Secure Roaming, and Radio Management Configuring WDS and Fast Secure Roaming
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide OL-1033-01
11-13
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Software Configuration Guide
11-14
OL-1033-01