How to Guide - Wireless Network Solutions
How to Guide - Wireless Network Solutions
How to Guide - Wireless Network Solutions
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
WiNG 5.2.2 MeshConnex tm<br />
<strong>How</strong> To<br />
April 2012<br />
Revision V2.2<br />
MOTOROLA, MOTO, MOTOROLA SOLUTIONS and the Stylized M Logo are trademarks or registered<br />
trademarks of Mo<strong>to</strong>rola Trademark Holdings, LLC and are used under license. All other trademarks are<br />
the property of their respective owners.<br />
© 2012 Mo<strong>to</strong>rola <strong>Solutions</strong>, Inc. All Rights Reserved.
1. Table Of Contents<br />
1. Table Of Contents .................................................................................................................. 2<br />
2. Preface ................................................................................................................................. 3<br />
2.1.1 <strong>How</strong> <strong>to</strong> <strong>Guide</strong> Pre-Requisites: ................................................................................... 3<br />
2.1.2 Product and Technical Requirements: ........................................................................ 3<br />
2.1.3 What is Meshing & MeshConnex ............................................................................ 4<br />
2.1.4 MeshConnex (MCX) Terminology ............................................................................ 4<br />
3. MeshConnex and VLANs ...................................................................................................... 6<br />
3.1 Non Tunneled VLANs ...................................................................................................... 6<br />
3.2 Tunneled VLANs ............................................................................................................. 6<br />
3.3 Hybrid / Tunneled and Non Tunneled ............................................................................... 7<br />
3.4 Note on MCX Control VLAN ............................................................................................. 7<br />
4. Configuring MeshConnex ..................................................................................................... 7<br />
4.1 Configuring MeshConnex / Non Tunneled VLANs ............................................................. 8<br />
4.1.1 Configure a MeshConnex Policy .............................................................................. 8<br />
4.1.2 Profile Configuration...............................................................................................12<br />
4.1.3 Profile Configuration...............................................................................................18<br />
4.2 Smart-RF policy configuration and assignment ..................................................................18<br />
4.3 Adding Profiles ..............................................................................................................22<br />
4.4 Configuring MeshConnex / Tunneled VLANs ..................................................................26<br />
4.4.1 Configure a MeshConnex Policy .............................................................................26<br />
4.4.2 Profile Configurations .............................................................................................28<br />
4.5 Configuring MeshConnex / Tunneled & Non Tunneled ....................................................41<br />
4.5.1 Configure a MeshConnex Policy .............................................................................41<br />
4.5.2 Profile Configurations .............................................................................................42<br />
5. RFS 6000 Running-Configuration ............................................................................................46<br />
5.1 Non Tunneled ...............................................................................................................46<br />
5.2 Tunneled ......................................................................................................................50<br />
5.3 Tunneled / Non Tunneled ...............................................................................................55
2. Preface<br />
This HOW TO guide is designed <strong>to</strong> aid the configuration of MeshConnex within the WiNG 5<br />
architecture and supported devices and controllers and should be used as a <strong>to</strong>ol <strong>to</strong> understand<br />
configuration parameters <strong>to</strong> allow supported devices <strong>to</strong> mesh successfully using Mesh Connex. This<br />
document does not represent any form of network design criteria nor operation considerations for<br />
mesh networking. The guide is focused on configuring Mesh Connex with the use of a WiNG 5.2.2<br />
controlled management appliance (RFS Controller). MeshConnex can be configured using a Stand-<br />
Alone AP, or Virtual Controller. Neither of these modes is covered in this guide.<br />
2.1.1 <strong>How</strong> <strong>to</strong> <strong>Guide</strong> Pre-Requisites:<br />
Before using this guide it is important that the following pre-requisites are completed at minimum;<br />
- Training and certification on WiNG Architecture http://support.symbol.com.<br />
- You should have a working knowledge of WiNG 5.x profiles and Device Over-Ride Features<br />
- Have a Windows 2008 server Enterprise or Existing LAN infrastructure for client data<br />
transactions<br />
- Your network and devices should be upgraded <strong>to</strong> WiNG 5.2.2 firmware. This HOW TO guide<br />
does not cover upgrading of devices <strong>to</strong> the appropriate firmware revision. Product<br />
requirements and support are detailed below.<br />
- The reader has read the appropriate WiNG documentation for the release and at minimum,<br />
Release Notes, Mo<strong>to</strong>rola RFS Series <strong>Wireless</strong> LAN Controllers - WiNG System Reference<br />
<strong>Guide</strong>.<br />
Registered users may download the latest software and firmware from the Mo<strong>to</strong>rola<br />
Technical Support Site http://support.symbol.com.<br />
2.1.2 Product and Technical Requirements:<br />
NOTE :WiNG 5.2.2 is only supported on the following platforms<br />
- AP 71XX platforms – AP 7131 / AP 7161<br />
- RFS 4000, 6000, 7000 Controllers<br />
Prior <strong>to</strong> attempting the configuration steps below at minimum you should have the following<br />
working network <strong>to</strong> attempt this configuration:<br />
- 2 or more AP71XX 802.11n Access Points installed, configured and running WiNG 5.2.2.<br />
- Optional RFS Switch installed and running WiNG 5.2.2. as per the above supported platforms<br />
- One (or more) wireless workstations/device(s) for testing operation.<br />
The equipment and devices utilized for this guide were based on the following Mo<strong>to</strong>rola hardware<br />
and software versions:<br />
<br />
RFS-6000<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 3
(2) AP7161 and (1) 7131 Access Point<br />
WiNG 5.2.2 Firmware<br />
2.1.3 What is Meshing & MeshConnex<br />
When <strong>Wireless</strong> Access Points (AP’s) are “meshed,” they turn in<strong>to</strong> a powerful, interconnected<br />
network that can blanket a coverage area that has no wired access such as a parking lot, industrial<br />
facility or even an entire city with wireless broadband access. Mesh-enabled access points not only<br />
deliver WiFi <strong>to</strong> users, they also act as router/repeaters for other access points in the network. The<br />
result is a self-forming, self-healing wireless cloud that reduces the cost of backhaul, deployment<br />
and system engineering.<br />
WiNG v5.2.2 delivers key enhancements focusing on the integration of Mo<strong>to</strong>rola’s patented<br />
MeshConnex Routing Engine in<strong>to</strong> the WiNG architecture. The MeshConnex Routing Engine<br />
provides efficient routing, low hop latency, low routing overhead, high-speed handoffs and proven<br />
scalability. MeshConnex uses Mo<strong>to</strong>rola’s patented Layer 2 routing technology <strong>to</strong> find and establish<br />
throughput-optimized connections. MeshConnex compliments the existing MiNT based hop<br />
meshing which is an alternative meshing option. In addition ORLA, the Opportunistic Radio Link<br />
Adaptation, is a new rate control selection method introduced in WiNG5.2.2, which is an improved<br />
element of rate selection for AP7161 outdoor deployments. The guide will talk <strong>to</strong> how <strong>to</strong> enable<br />
this rate selection algorithm when configuring devices.<br />
2.1.4 MeshConnex (MCX) Terminology<br />
When using MCX (MeshConnex ) The APs in an (MCX) mesh are called nodes. A node with a wired<br />
connection back <strong>to</strong> the network is called a root node. The function of the MCX software is <strong>to</strong><br />
determine the shortest path from a node, <strong>to</strong> a root node and passing packets along the path, which<br />
is the link(s) being utilized <strong>to</strong> allow communications between two nodes /or mesh points. Paths are<br />
dynamically created in MCX. The path <strong>to</strong> the root is selected by the MCX algorithm based on path<br />
metrics which are dictated by device <strong>to</strong>pology and RF environment. A sample diagram showing this<br />
concept is shown in figure below.<br />
The Opportunistic Radio Link Adaptation (ORLA) algorithm is a key decision-making element<br />
designed <strong>to</strong> select data rates that will provide the best throughput. Instead of using local conditions<br />
<strong>to</strong> decide whether a data rate is acceptable or not, ORLA is designed <strong>to</strong> proactively probe other<br />
rates <strong>to</strong> determine if greater throughput is available. If these other rates do provide improved<br />
throughput, ORLA intelligently adjusts its selection tables <strong>to</strong> favor higher performance. ORLA<br />
provides improvements both on the client side of a mesh network as well as in the backhaul<br />
capabilities.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 4
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 5
3. MeshConnex and VLANs<br />
Before configuring MeshConnex routing it is important <strong>to</strong> understand the different configuration<br />
options possible when working with VLANs. Each option will require slightly different configurations.<br />
3.1 Non Tunneled VLANs<br />
With this option, WLAN traffic and Ethernet traffic from a meshed AP is forwarded via MeshConnex.<br />
Traffic is not tunneled over MINT. VLANs must be added <strong>to</strong> the Allowed VLAN filter in the<br />
MeshConnex Policy. It is not necessary <strong>to</strong> define any VLANs in the node’s bridge VLANs settings unless<br />
other bridging functions are required.<br />
3.2 Tunneled VLANs<br />
With this option VLANs will be created and the bridging mode set <strong>to</strong> tunnel.<br />
The user also has the option <strong>to</strong> tunnel the WLAN separately (the user would not create a separate<br />
bridge VLAN for the WLAN since it is tunneled directly).<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 6
3.3 Hybrid / Tunneled and Non Tunneled<br />
With this option one of the WLANs is configured with a VLAN that is marked tunnel. The other WLAN<br />
and the Ethernet traffic are not tunneled. It is important <strong>to</strong> note that the tunneled WLAN VLAN should<br />
NOT be included in the allowed VLAN list.<br />
3.4 Note on MCX Control VLAN<br />
Note that MeshConnex utilizes a control VLAN. This VLAN is used <strong>to</strong> isolate MCX messaging<br />
over the wire between Root nodes. This VLAN is MCX specific and is not <strong>to</strong> be confused with<br />
any other control VLAN. The MCX control VLAN is configured in the Mesh Connex Policy. As<br />
described in the Tunneled VLAN example the MCX control VLAN must not be tunneled.<br />
<strong>How</strong>ever when using a Non tunneled VLAN setup the MCX VLAN can also be used for data.<br />
4. Configuring MeshConnex<br />
This is a 3 step process. There is an additional 4th step for au<strong>to</strong> assignment of channels for the radios in<br />
mesh.<br />
1. Configure a mesh point (node).<br />
2. Create profiles for AP71xx device types – (AP7131 and AP7161). In the section below we<br />
describe creating 2 profiles, one profile for devices <strong>to</strong> be configured as ROOT nodes (wired<br />
Access Points) and one more profile for Non Root nodes.<br />
3. Au<strong>to</strong> assign the above configured profiles for new AP71XX devices plugged in<strong>to</strong> the network. Or<br />
manually assign these profiles <strong>to</strong> the respective APs.<br />
4. If the user intends <strong>to</strong> use au<strong>to</strong>matic channel assignment (smart channel assignment) in the mesh<br />
then additional configuration is required. A Smart RF policy would need <strong>to</strong> be created and<br />
assigned <strong>to</strong> the RF Domain.<br />
Note: In the configuration steps below perform a “commit and save” after each configuration change<br />
unless otherwise noted.<br />
Note: Once all of the configuration steps below have been completed on the RFSx000 controller;<br />
connect all of the APs <strong>to</strong> the Ethernet switch. The controller will then configure the APs once they are<br />
adopted by the controller. Once configurations have been pushed <strong>to</strong> all APs, disconnect the Ethernet<br />
cables of all non-root nodes.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 7
4.1 Configuring MeshConnex / Non Tunneled VLANs<br />
4.1.1 Configure a MeshConnex Policy<br />
1. Access the GUI of the RFS x000 controller (https://) and click on:<br />
Configuration<strong>Wireless</strong>MeshConnex Policy.<br />
2. Click on the “Add” but<strong>to</strong>n at the bot<strong>to</strong>m right which will take you <strong>to</strong> the MeshConnex policy<br />
configuration page. On this page configure the following items:<br />
a. Configure the Mesh Point Name.<br />
b. Configure the Mesh ID. (This value is sent out in beacons which identify the Mesh Point).<br />
c. Mesh Point status should be set <strong>to</strong>: “Enabled”<br />
d. Use the Beacon Format drop-down menu <strong>to</strong> select “mesh-point” or “access-point”.<br />
Select “mesh-point” for new installations. Select “access-point” <strong>to</strong> support compatibility<br />
with legacy mesh devices like the Mo<strong>to</strong>Mesh DUO.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 8
e. Leave the setting “is Root” unchecked.<br />
f. Set the control VLAN <strong>to</strong> “VLAN 1” for the purpose of this example.<br />
g. The allowed VLAN list should contain all VLANs that you wish <strong>to</strong> allow on the Mesh link<br />
(in this example all VLANs are available 1-4094).<br />
h. Set the “Neighbor Idle Timeout” value <strong>to</strong> 1 minute<br />
i. Provide description as required. (Optional)<br />
Note: Make sure the Neighbor Idle Timeout is set <strong>to</strong> 1 minute. In the CLI this is referred <strong>to</strong><br />
as the neighbor inactivity-timeout.<br />
<br />
Click on OK <strong>to</strong> continue the configuration process. The “Security” and “Radio Rates”<br />
tabs should now be available.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 9
3. Click on the “Security” tab for MeshConnex security settings.<br />
<br />
<br />
By default the “Security Mode” configuration parameter is set <strong>to</strong> “None”<br />
Set this <strong>to</strong> PSK so traffic on the Mesh Links will be encrypted.<br />
Note: In Release 5.2.2 there is an open issue with PSK security which can cause secure<br />
links <strong>to</strong> not form correctly stranding devices. This bug has been fixed and will be<br />
available in a subsequent maintenance release. It is recommended that PSK not be used<br />
until the maintenance release is available.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 10
Once PSK is selected, you can configure the Pre-Shared key.<br />
Keep the Unicast and Broadcast key rotation interval at their default values.<br />
Click on OK and exit this configuration page.<br />
<br />
The configured parameters can be verified from the Policy page.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 11
4.1.2 Profile Configuration<br />
Profiles will be configured for your Root APs and Non-Root APs. A Root AP is an AP which has its GE1<br />
interface connected <strong>to</strong> the LAN (core network). In this first configuration example there is only one<br />
difference between the Root and Non-Root profiles (in the Non Root Profile the “is Root” option will not<br />
be selected under Mesh Point settings. Note that Mesh Point settings is a different configuration item<br />
from the MeshConnex Policy).<br />
1. Click on ConfigurationProfiles. Select <strong>to</strong> “Add” a new profile<br />
<br />
<br />
Configure a profile name that we intend <strong>to</strong> use for Root APs.<br />
Set the AP type <strong>to</strong> AP71XX<br />
2. Click on OK <strong>to</strong> active the other tabs on the page.<br />
3. Click on InterfaceRadios and select the 5 GHz radio.<br />
4. Under Radio Settings, set the Channel <strong>to</strong> a static channel (in this example 149+ was chosen).<br />
5. Select the Radio Placement.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 12
NOTE: Set the “rate selection method” as opportunistic. This is the recommended setting for outdoor<br />
deployments. The recommendation is based on the outdoor tests carried out proving opportunistic<br />
rate selection performing better in outdoor environments over standard rate selection. Also note that<br />
“Dynamic Chain Selection” is checked. Dynamic chain selection is useful when communicating with<br />
devices that don not interoperate well with 802.11n radios. The majority of 802.11abg radios do not<br />
require this <strong>to</strong> be selected.<br />
6. Click on OK.<br />
7. Select the WLAN/Mesh Mapping tab.<br />
8. Map the Mesh Point configured, <strong>to</strong> the radio. Click on OK and ext this change.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 13
9. Select Mesh Point from the profile configuration page and click on “Add”.<br />
10. Set the MeshConnex policy <strong>to</strong> the earlier configured policy name.<br />
11. Set “Is Root” <strong>to</strong> true. Click OK.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 14
12. Repeat the above steps <strong>to</strong> configure the Profile for the Non Root.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 15
Note: This example does not include adding a WLAN. <strong>How</strong>ever if the user decided <strong>to</strong> add a WLAN <strong>to</strong> this Non<br />
Tunneled VLAN setup the WLAN should be set <strong>to</strong> have its configured VLAN bridging mode set <strong>to</strong> “local”. Also,<br />
the VLAN assigned <strong>to</strong> the WLAN should be included in the Mesh Connex Policy’s “Allowed VLANs” list. This Non<br />
Tunneled VLAN example has the Allowed VLANs list set <strong>to</strong> 1-4094 thus any VLAN assigned <strong>to</strong> a WLAN would flow<br />
through the mesh.<br />
NOTE: The “Is Root” option should be set <strong>to</strong> None.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 16
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 17
4.1.3 Profile Configuration<br />
An additional recommended step for the Non-Root AP profile is the configuration of misconfiguration<br />
recovery time. This configuration is currently available from CLI in WiNG 5.2.2.<br />
This configuration would delay the rejection of the newest configuration push from the controller which<br />
might have caused the loss of adopting.<br />
The additional delay added is <strong>to</strong> handle cases when the new configuration from the controller causes<br />
the root AP <strong>to</strong> move from current operation channel <strong>to</strong> other channels resulting in mesh link going down<br />
and in turn non-root APs losing adoption. This delay is <strong>to</strong> accommodate the time needed for the nonroot<br />
AP <strong>to</strong> scan all the channels, and find the best root node and start operation on the new channel and<br />
then establish the mesh link re- adopt <strong>to</strong> the switch. (For countries that use DFS, the scan time is also<br />
fac<strong>to</strong>red in for the configured value). If the AP fails <strong>to</strong> find a suitable root node within this time then this<br />
new config is a misconfiguration and the device would reject the latest config.<br />
For outdoor APs running V5.2.2.0 it is recommended that the misconfiguration-recovery-time be<br />
disabled. This can be accomplished by setting the value <strong>to</strong> 0. Update the non root ap71xx profiles on<br />
the controller <strong>to</strong> include this change.<br />
Using an appropriate console terminal and or connection <strong>to</strong> your device log on <strong>to</strong> the CLI and follow<br />
these steps:<br />
rfs6000-xxxxxx>enable<br />
rfs6000-xxxxxx #configure terminal<br />
Enter configuration commands, one per line. End with CNTL/Z.<br />
rfs6000-xxxxxx (config)#profile ap71xx Non-Root AP71xx<br />
rfs6000-xxxxxx (config-profile-Non-Root-AP71xx)#misconfiguration-recovery-time 0<br />
rfs6000-xxxxxx (config-profile-Non-Root-AP71xx)#<br />
4.2 Smart-RF policy configuration and assignment<br />
If you intend <strong>to</strong> use Channel type as “Smart”, you have <strong>to</strong> configure a Smart RF policy first. Then you<br />
need <strong>to</strong> apply this policy <strong>to</strong> the RF Domain configured in your device profiles. Once configured and<br />
applied nodes will scan for the best available channels. Root nodes will pick the cleanest channel in the<br />
channel list (configured in your smart-rf policy). Non-root APs will also scan the channels in the<br />
channel-list <strong>to</strong> find the best Root AP.<br />
Notes on Smart RF:<br />
Smart channel assignment is done only if the channel configuration for a radio is set <strong>to</strong> smart<br />
and a smart-rf policy is applied <strong>to</strong> the rf-domain of the radios.<br />
Set the channel-list in the smart-rf policy <strong>to</strong> specific channels you want the APs in the mesh <strong>to</strong><br />
operate. The smaller the number of channels in the channel-list the shorter the time an AP takes<br />
<strong>to</strong> converge <strong>to</strong> an operating channel.<br />
Also note if there are any DFS channels in the channel list. If a root node selects a DFS channel<br />
then non-root nodes may take several minutes <strong>to</strong> lock on <strong>to</strong> same channel as root (once an AP<br />
moves <strong>to</strong> a DFS channel it must wait and observe the CAC time before transmitting on this<br />
channel). This time may take up <strong>to</strong> 20 <strong>to</strong> 30 minutes depending on the CAC time of the DFS<br />
channel.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 18
1. Select the Smart RF Policy tab from Configuration <strong>Wireless</strong><br />
2. Click on “Add” <strong>to</strong> take you <strong>to</strong> the Smart RF configuration page.<br />
- Configure the Smart RF policy name.<br />
- Enable the policy by clicking the check box.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 19
3. Click OK <strong>to</strong> confirm this configuration.<br />
4. The other parameters can be left <strong>to</strong> their default values unless and until they require <strong>to</strong> be<br />
changed.<br />
5. “Exit’ this configuration page.<br />
6. Select or configure a new RF Domain from Configuration RF Domains<br />
- Map the configured Smart RF Policy in<strong>to</strong> the same.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 20
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 21
4.3 Adding Profiles<br />
1. Connect the AP that will be used as a root node <strong>to</strong> the wired network.<br />
2. Go <strong>to</strong> InterfaceConfigurationDevices<br />
3. After the AP is adopted click edit.<br />
4. Under Profile select the Root profile previously created and click OK.<br />
5. Repeat these steps for all of the Root nodes.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 22
After the Root Profile has been applied <strong>to</strong> all of the Root nodes the process is repeated on the Non Root<br />
nodes using the Non Root profile.<br />
6. Connect the Non Root AP that will be used as a root node <strong>to</strong> the wired network.<br />
7. Go <strong>to</strong> InterfaceConfigurationDevices<br />
8. After the AP is adopted click edit.<br />
1. Under Profile select the Non Root profile previously created and click OK.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 23
Important: Make sure that after commiting your profile that a save is performed. Verify that the save<br />
has been performed by either the CLI (show startup-config) or viewing the startup configuration from<br />
the Operations tab in the RFS GUI. After the Non Root profile is applied (commit / save) remove the<br />
wired connection <strong>to</strong> the Non Root AP. Failure <strong>to</strong> remove the wired connection could result in a<br />
bridging loop.<br />
2. Repeat these steps for all Non Root nodes<br />
In this example network we have (1) Root node and (2) Non Root Nodes.<br />
Under <strong>to</strong> StatisticsMesh Point for the Root node we see both our Non Root nodes in the Path table.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 24
Reminder<br />
In this example Non Tunneled VLANs were used.<br />
In our MeshConnex Policy we configured the Mesh Point <strong>to</strong> pass all VLANs 1-4094 in the Allowed<br />
VLANs box.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 25
4.4 Configuring MeshConnex / Tunneled VLANs<br />
In the next example MeshConnex will be configured <strong>to</strong> support Tunneled VLANs. The previously<br />
configured Policy and Profiles will be edited.<br />
This example will use the following VLAN configuration:<br />
Device Management<br />
10.0.4.0/26 - VLAN 4<br />
WLAN<br />
10.0.20.0/26 - VLAN 20<br />
Non Root GE1 Ethernet<br />
10.0.30.0/26 - VLAN 30<br />
Note: The RFS6000 and each AP71xx node has already been configured with virtual interface VLAN 4. A<br />
DHCP server has also been configured on the RFS6000 <strong>to</strong> support these VLANs.<br />
4.4.1 Configure a MeshConnex Policy<br />
1. Access the GUI of the device (https://) and click on<br />
Configuration<strong>Wireless</strong>MeshConnex Policy and edit the MeshConnex Policy.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 26
2. Make sure the Allowed VLANs box is empty.<br />
3. Neighbor Idle Timeout should be 1 minute<br />
4. Click OK.<br />
Note: In this example the control VLAN utilized by Mesh is set for VLAN 1. Make sure that the data<br />
VLANs used are not the same as the control VLAN. In this example our data VLANs are 20 and 30.<br />
Thus for Release 5.2.2 do not make the Control VLAN the same as any configured tunneled VLAN.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 27
4.4.2 Profile Configurations<br />
In the next several steps the previously created profiles will be edited.<br />
4.4.2.1 Configure Bridge VLANs<br />
First edit the RFS switch profile.<br />
1. In the default-rfs6000 profile select Bridge VLAN and click Add.<br />
2. Add VLAN 4 and set the bridge mode <strong>to</strong> tunnel. Click OK.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 28
3. Next add VLAN 20 and set the bridging mode <strong>to</strong> tunnel. Click OK.<br />
4. Add VLAN 30 and set the bridging mode <strong>to</strong> tunnel. Click OK.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 29
You should now see all three VLANs in the default-rfs6000 profile. Commit/Save.<br />
5. Edit the Non Root 71xx profile Click on Bridge VLAN and click Add.<br />
Repeat the process and add VLANs 4, 20, and 30.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 30
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 31
You should now see all three VLANs added in the AP71xx Non Root profile. Commit/Save.<br />
6. Edit the Root AP71xx profile Click on Bridge VLAN and click Add.<br />
Repeat the process and add VLANs 4, 20, and 30.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 32
You should now see all three VLANs added in the AP71xx Root profile. Commit/Save.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 33
4.4.2.2 Configure WLAN<br />
Create a WLAN with PSK security and configure it <strong>to</strong> use VLAN 20.<br />
1. Click Configuration<strong>Wireless</strong> and select <strong>Wireless</strong> LANs. Click Add.<br />
2. Add a WLAN name (e.g. Test). Set the bridging mode <strong>to</strong> Local (it will be tunneled since it will be<br />
configured with a bridge VLAN that is set <strong>to</strong> tunneled). Set the VLAN <strong>to</strong> 20.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 34
3. Click Security.<br />
4. Select PSK, WPA2-CCMP, and configure a Pre-Shared Key.<br />
In this example we will be adding this WLAN <strong>to</strong> our Non Root nodes.<br />
5. Edit the Non Root 71xx profile. Select ConfigurationProfilesNon Root 71xx and click edit.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 35
6. Select InterfaceRadios. Select radio1 and click edit.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 36
7. Under WLAN Mapping / Mesh Mapping add WLAN test <strong>to</strong> the radio.<br />
8. Commit / Save.<br />
Now any wireless station connecting <strong>to</strong> WLAN Test will be using VLAN 20.<br />
4.4.2.3 Configure Non Root Ethernet ports <strong>to</strong> use VLAN 30<br />
Next edit the Non Root Profile and configure the GE1 interface <strong>to</strong> use VLAN 30. In this<br />
example we are not going <strong>to</strong> trunk VLAN 30 since the devices connected <strong>to</strong> VLAN 30 will not<br />
be VLAN aware.<br />
1. Edit the Non Root 71xx profile. Select ConfigurationProfilesNon Root 71xx and click edit.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 37
2. Select InterfaceEthernet PortsGE1 and click edit.<br />
3. Change the Native VLAN <strong>to</strong> 30. Click ok.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 38
You should now see VLAN 30 on GE1. Commit/Save.<br />
Now any device connected <strong>to</strong> GE1 on any Non Root node will use VLAN 30 e.g. a lap<strong>to</strong>p connected<br />
would receive an IP address from the DHCP pool on 10.0.30.0/26.<br />
Below is a screenshot of the DHCP Server Policy on the RFS6000.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 39
Reminder<br />
In this example Non Tunneled VLANs were used.<br />
In our MeshConnex Policy we removed all VLANs from the Allowed VLANs box.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 40
4.5 Configuring MeshConnex / Tunneled & Non Tunneled<br />
In this example the existing MeshConnex Policy and device profiles will be edited <strong>to</strong> tunnel the WLAN<br />
VLAN 20 and configure VLAN 4 and 30 <strong>to</strong> pass straight <strong>to</strong> MCX.<br />
Note: Since we will be editing the previous configured profiles which include bridge VLANs we will<br />
make all of the required changes first. After all of the changes have been made a commit/save will be<br />
performed.<br />
4.5.1 Configure a MeshConnex Policy<br />
1. Access the GUI of the device (https://) and click on<br />
Configuration<strong>Wireless</strong>MeshConnex Policy and edit the MeshConnex Policy.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 41
2. Add VLAN 4 and VLAN 30 <strong>to</strong> the allowed VLAN list. Click OK.<br />
4.5.2 Profile Configurations<br />
1. Edit the default-rfs6000 profile. Click on <strong>Network</strong>Bridge VLAN. Delete VLAN 4 and VLAN 30.<br />
Click Exit.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 42
2. Edit the Non Root 71xx profile. Click on <strong>Network</strong>Bridge VLAN. Delete VLAN 4 and VLAN 30.<br />
Click Exit.<br />
3. Edit the Root AP71xx profile. Click on <strong>Network</strong>Bridge VLAN. Delete VLAN 4 and VLAN 30.<br />
Click Exit.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 43
4. Edit WLAN test. Click on Configuration<strong>Wireless</strong><strong>Wireless</strong> LANs. Change the Bridging Mode<br />
<strong>to</strong> tunnel. Click OK.<br />
Click commit / save.<br />
Reminder<br />
In this example a combination of Tunneled and Non Tunneled VLANs were used.<br />
In our MeshConnex Policy we configured the Mesh Point <strong>to</strong> pass VLAN 4 and VLAN 30 in the Allowed<br />
VLANs box.<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 44
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 45
5. RFS 6000 Running-Configuration<br />
5.1 Non Tunneled<br />
!<br />
! Configuration of RFS6000 version 5.2.2.0-073R<br />
!<br />
!<br />
version 2.1<br />
!<br />
!<br />
ip access-list BROADCAST-MULTICAST-CONTROL<br />
permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"<br />
permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"<br />
deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"<br />
deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"<br />
deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"<br />
permit ip any any rule-precedence 100 rule-description "permit all IP traffic"<br />
!<br />
mac access-list PERMIT-ARP-AND-IPv4<br />
permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"<br />
permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"<br />
!<br />
firewall-policy default<br />
no ip dos tcp-sequence-past-window<br />
!<br />
firewall-policy no_firewall<br />
no ip dos smurf<br />
no ip dos twinge<br />
no ip dos invalid-pro<strong>to</strong>col<br />
no ip dos router-advt<br />
no ip dos router-solicit<br />
no ip dos option-route<br />
no ip dos ascend<br />
no ip dos chargen<br />
no ip dos fraggle<br />
no ip dos snork<br />
no ip dos ftp-bounce<br />
no ip dos tcp-intercept<br />
no ip dos broadcast-multicast-icmp<br />
no ip dos land<br />
no ip dos tcp-xmas-scan<br />
no ip dos tcp-null-scan<br />
no ip dos winnuke<br />
no ip dos tcp-fin-scan<br />
no ip dos udp-short-hdr<br />
no ip dos tcp-post-syn<br />
no ip dos tcphdrfrag<br />
no ip dos ip-ttl-zero<br />
no ip dos ipspoof<br />
no ip dos tcp-bad-sequence<br />
no ip dos tcp-sequence-past-window<br />
no firewall enable<br />
!<br />
!<br />
mint-policy global-default<br />
!<br />
meshpoint-qos-policy default<br />
!<br />
wlan-qos-policy default<br />
qos trust dscp<br />
qos trust wmm<br />
!<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 46
adio-qos-policy default<br />
!<br />
wlan Test<br />
ssid Test<br />
vlan 20<br />
bridging-mode local<br />
encryption-type ccmp<br />
authentication-type none<br />
wpa-wpa2 psk 0 symbol@123<br />
!<br />
ap300 default-ap300<br />
interface radio1<br />
interface radio2<br />
!<br />
meshpoint Mesh-Connex<br />
meshid Mesh<br />
beacon-format mesh-point<br />
control-vlan 1<br />
allowed-vlans 1-4094<br />
neighbor inactivity-timeout 60<br />
security-mode psk<br />
wpa2 psk 0 symbol@123<br />
no root<br />
!<br />
smart-rf-policy Smart\ RF<br />
!<br />
dhcp-server-policy Telemetry<br />
dhcp-pool WLAN<br />
network 10.0.20.0/26<br />
address range 10.0.20.10 10.0.20.62<br />
domain-name cqe.mesh.net<br />
default-router 10.0.20.1<br />
dns-server 10.0.2.4<br />
dhcp-pool Ethernet<br />
network 10.0.30.0/26<br />
address range 10.0.30.10 10.0.30.62<br />
domain-name cqe.mesh.net<br />
default-router 10.0.30.1<br />
dns-server 10.0.2.4<br />
dhcp-pool Devices<br />
network 10.0.4.0/26<br />
address range 10.0.4.10 10.0.4.62<br />
domain-name cqe.mesh.net<br />
default-router 10.0.4.1<br />
dns-server 10.0.2.4<br />
!<br />
!<br />
management-policy default<br />
telnet<br />
http server<br />
https server<br />
ssh<br />
user admin password 1 e44b419340d0b973a154eddb646a572b59170594ee7112e3758e5e044a76dd35 role superuser access all<br />
user opera<strong>to</strong>r password 1 c1b5ac3b680b9f622eed6a6a9b482a998f81b67c190d6e15eacf2503b85a5a9e role moni<strong>to</strong>r access all<br />
no snmp-server manager v2<br />
snmp-server community public ro<br />
snmp-server community private rw<br />
snmp-server user snmpopera<strong>to</strong>r v3 encrypted des auth md5 0 opera<strong>to</strong>r<br />
snmp-server user snmptrap v3 encrypted des auth md5 0 mo<strong>to</strong>rola<br />
snmp-server user snmpmanager v3 encrypted des auth md5 0 mo<strong>to</strong>rola<br />
idle-session-timeout 0<br />
!<br />
profile rfs6000 default-rfs6000<br />
ip name-server 10.0.2.4<br />
ip domain-name cqe.mesh.net<br />
au<strong>to</strong>install configuration<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 47
au<strong>to</strong>install firmware<br />
cryp<strong>to</strong> isakmp policy default<br />
cryp<strong>to</strong> ipsec transform-set default esp-aes-256 esp-sha-hmac<br />
interface me1<br />
ip address 10.1.1.100/24<br />
interface up1<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge1<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
no power<br />
interface ge2<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge3<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge4<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge5<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge6<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge7<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge8<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface vlan1<br />
ip address dhcp<br />
interface wwan1<br />
use dhcp-server-policy Telemetry<br />
use firewall-policy default<br />
service pm sys-restart<br />
!<br />
profile ap71xx Non\ Root\ 71xx<br />
no au<strong>to</strong>install configuration<br />
no au<strong>to</strong>install firmware<br />
interface radio1<br />
wlan Test bss 1 primary<br />
interface radio2<br />
channel 149+<br />
rate-selection opportunistic<br />
placement outdoor<br />
meshpoint Mesh-Connex bss 1<br />
interface radio3<br />
interface ge1<br />
switchport mode access<br />
switchport access vlan 30<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 48
interface ge2<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface vlan4<br />
ip address dhcp<br />
interface wwan1<br />
use firewall-policy default<br />
service pm sys-restart<br />
meshpoint-device Mesh-Connex<br />
name Mesh-Connex<br />
!<br />
profile ap71xx Root\ AP71xx<br />
no au<strong>to</strong>install configuration<br />
no au<strong>to</strong>install firmware<br />
interface radio1<br />
interface radio2<br />
channel 149+<br />
rate-selection opportunistic<br />
placement outdoor<br />
meshpoint Mesh-Connex bss 1<br />
interface radio3<br />
interface ge1<br />
switchport mode trunk<br />
switchport trunk native vlan 1<br />
no switchport trunk native tagged<br />
switchport trunk allowed vlan 1,4,20,30<br />
ip arp trust<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge2<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface vlan4<br />
ip address dhcp<br />
interface wwan1<br />
use firewall-policy default<br />
service pm sys-restart<br />
meshpoint-device Mesh-Connex<br />
name Mesh-Connex<br />
root<br />
!<br />
rf-domain default<br />
timezone America/New_York<br />
country-code us<br />
use smart-rf-policy Smart\ RF<br />
!<br />
rfs6000 5C-0E-8B-18-F5-7A<br />
use profile default-rfs6000<br />
use rf-domain default<br />
hostname rfs6000-18F57A<br />
license AP<br />
ip default-gateway 10.0.4.1<br />
interface ge1<br />
switchport mode trunk<br />
switchport trunk native vlan 1<br />
no switchport trunk native tagged<br />
switchport trunk allowed vlan 1-4094<br />
ip arp trust<br />
interface vlan4<br />
ip address 10.0.4.3/26<br />
no ip dhcp client request options all<br />
interface vlan30<br />
ip address 10.0.30.2/26<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 49
use dhcp-server-policy Telemetry<br />
use firewall-policy no_firewall<br />
!<br />
ap71xx 00-15-70-C7-93-58<br />
use profile Non\ Root\ 71xx<br />
use rf-domain default<br />
hostname ap7161-C79358<br />
!<br />
ap71xx 00-15-70-E5-A7-F8<br />
use profile Root\ AP71xx<br />
use rf-domain default<br />
hostname AP7161-Root-49:20<br />
!<br />
ap71xx 00-23-68-0B-FA-FC<br />
use profile Non\ Root\ 71xx<br />
use rf-domain default<br />
hostname ap7131-0BFAFC<br />
!<br />
!<br />
end<br />
rfs6000-18F57A#<br />
5.2 Tunneled<br />
!<br />
! Configuration of RFS6000 version 5.2.2.0-073R<br />
!<br />
!<br />
version 2.1<br />
!<br />
!<br />
ip access-list BROADCAST-MULTICAST-CONTROL<br />
permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"<br />
permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"<br />
deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"<br />
deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"<br />
deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"<br />
permit ip any any rule-precedence 100 rule-description "permit all IP traffic"<br />
!<br />
mac access-list PERMIT-ARP-AND-IPv4<br />
permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"<br />
permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"<br />
!<br />
firewall-policy default<br />
no ip dos tcp-sequence-past-window<br />
!<br />
firewall-policy no_firewall<br />
no ip dos smurf<br />
no ip dos twinge<br />
no ip dos invalid-pro<strong>to</strong>col<br />
no ip dos router-advt<br />
no ip dos router-solicit<br />
no ip dos option-route<br />
no ip dos ascend<br />
no ip dos chargen<br />
no ip dos fraggle<br />
no ip dos snork<br />
no ip dos ftp-bounce<br />
no ip dos tcp-intercept<br />
no ip dos broadcast-multicast-icmp<br />
no ip dos land<br />
no ip dos tcp-xmas-scan<br />
no ip dos tcp-null-scan<br />
no ip dos winnuke<br />
no ip dos tcp-fin-scan<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 50
no ip dos udp-short-hdr<br />
no ip dos tcp-post-syn<br />
no ip dos tcphdrfrag<br />
no ip dos ip-ttl-zero<br />
no ip dos ipspoof<br />
no ip dos tcp-bad-sequence<br />
no ip dos tcp-sequence-past-window<br />
no firewall enable<br />
!<br />
!<br />
mint-policy global-default<br />
!<br />
meshpoint-qos-policy default<br />
!<br />
wlan-qos-policy default<br />
qos trust dscp<br />
qos trust wmm<br />
!<br />
radio-qos-policy default<br />
!<br />
wlan Test<br />
ssid Test<br />
vlan 20<br />
bridging-mode local<br />
encryption-type ccmp<br />
authentication-type none<br />
wpa-wpa2 psk 0 symbol@123<br />
!<br />
ap300 default-ap300<br />
interface radio1<br />
interface radio2<br />
!<br />
meshpoint Mesh-Connex<br />
meshid Mesh<br />
beacon-format mesh-point<br />
control-vlan 1<br />
neighbor inactivity-timeout 60<br />
security-mode psk<br />
wpa2 psk 0 symbol@123<br />
no root<br />
!<br />
smart-rf-policy Smart\ RF<br />
!<br />
dhcp-server-policy Telemetry<br />
dhcp-pool WLAN<br />
network 10.0.20.0/26<br />
address range 10.0.20.10 10.0.20.62<br />
domain-name cqe.mesh.net<br />
default-router 10.0.20.1<br />
dns-server 10.0.2.4<br />
dhcp-pool Ethernet<br />
network 10.0.30.0/26<br />
address range 10.0.30.10 10.0.30.62<br />
domain-name cqe.mesh.net<br />
default-router 10.0.30.1<br />
dns-server 10.0.2.4<br />
dhcp-pool Devices<br />
network 10.0.4.0/26<br />
address range 10.0.4.10 10.0.4.62<br />
domain-name cqe.mesh.net<br />
default-router 10.0.4.1<br />
dns-server 10.0.2.4<br />
!<br />
!<br />
management-policy default<br />
telnet<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 51
http server<br />
https server<br />
ssh<br />
user admin password 1 e44b419340d0b973a154eddb646a572b59170594ee7112e3758e5e044a76dd35 role superuser access all<br />
user opera<strong>to</strong>r password 1 c1b5ac3b680b9f622eed6a6a9b482a998f81b67c190d6e15eacf2503b85a5a9e role moni<strong>to</strong>r access all<br />
no snmp-server manager v2<br />
snmp-server community public ro<br />
snmp-server community private rw<br />
snmp-server user snmpopera<strong>to</strong>r v3 encrypted des auth md5 0 opera<strong>to</strong>r<br />
snmp-server user snmptrap v3 encrypted des auth md5 0 mo<strong>to</strong>rola<br />
snmp-server user snmpmanager v3 encrypted des auth md5 0 mo<strong>to</strong>rola<br />
idle-session-timeout 0<br />
!<br />
profile rfs6000 default-rfs6000<br />
bridge vlan 4<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
bridge vlan 20<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
bridge vlan 30<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
ip name-server 10.0.2.4<br />
ip domain-name cqe.mesh.net<br />
au<strong>to</strong>install configuration<br />
au<strong>to</strong>install firmware<br />
cryp<strong>to</strong> isakmp policy default<br />
cryp<strong>to</strong> ipsec transform-set default esp-aes-256 esp-sha-hmac<br />
interface me1<br />
ip address 10.1.1.100/24<br />
interface up1<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge1<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
no power<br />
interface ge2<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge3<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge4<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge5<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge6<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge7<br />
ip dhcp trust<br />
qos trust dscp<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 52
qos trust 802.1p<br />
interface ge8<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface vlan1<br />
ip address dhcp<br />
interface wwan1<br />
use dhcp-server-policy Telemetry<br />
use firewall-policy default<br />
service pm sys-restart<br />
!<br />
profile ap71xx Non\ Root\ 71xx<br />
bridge vlan 4<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
bridge vlan 20<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
bridge vlan 30<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
no au<strong>to</strong>install configuration<br />
no au<strong>to</strong>install firmware<br />
interface radio1<br />
wlan Test bss 1 primary<br />
interface radio2<br />
channel 149+<br />
rate-selection opportunistic<br />
placement outdoor<br />
meshpoint Mesh-Connex bss 1<br />
interface radio3<br />
interface ge1<br />
switchport mode access<br />
switchport access vlan 30<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge2<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface vlan4<br />
ip address dhcp<br />
interface wwan1<br />
use firewall-policy default<br />
service pm sys-restart<br />
meshpoint-device Mesh-Connex<br />
name Mesh-Connex<br />
!<br />
profile ap71xx Root\ AP71xx<br />
bridge vlan 4<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
bridge vlan 20<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
bridge vlan 30<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 53
no au<strong>to</strong>install configuration<br />
no au<strong>to</strong>install firmware<br />
interface radio1<br />
interface radio2<br />
channel 149+<br />
rate-selection opportunistic<br />
placement outdoor<br />
meshpoint Mesh-Connex bss 1<br />
interface radio3<br />
interface ge1<br />
switchport mode trunk<br />
switchport trunk native vlan 1<br />
no switchport trunk native tagged<br />
switchport trunk allowed vlan 1,4,20,30<br />
ip arp trust<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge2<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface vlan4<br />
ip address dhcp<br />
interface wwan1<br />
use firewall-policy default<br />
service pm sys-restart<br />
meshpoint-device Mesh-Connex<br />
name Mesh-Connex<br />
root<br />
!<br />
rf-domain default<br />
timezone America/New_York<br />
country-code us<br />
use smart-rf-policy Smart\ RF<br />
!<br />
rfs6000 5C-0E-8B-18-F5-7A<br />
use profile default-rfs6000<br />
use rf-domain default<br />
hostname rfs6000-18F57A<br />
license AP 96a945bf56a7eba8a410d4594797fecd2c4f7b55dd6d11179921fc5f1912f4a4d4482e94b9ee0d26<br />
ip default-gateway 10.0.4.1<br />
interface ge1<br />
switchport mode trunk<br />
switchport trunk native vlan 1<br />
no switchport trunk native tagged<br />
switchport trunk allowed vlan 1-4094<br />
ip arp trust<br />
interface vlan4<br />
ip address 10.0.4.3/26<br />
no ip dhcp client request options all<br />
interface vlan30<br />
ip address 10.0.30.2/26<br />
use dhcp-server-policy Telemetry<br />
use firewall-policy no_firewall<br />
!<br />
ap71xx 00-15-70-C7-93-58<br />
use profile Non\ Root\ 71xx<br />
use rf-domain default<br />
hostname ap7161-C79358<br />
!<br />
ap71xx 00-15-70-E5-A7-F8<br />
use profile Root\ AP71xx<br />
use rf-domain default<br />
hostname AP7161-Root-49:20<br />
!<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 54
ap71xx 00-23-68-0B-FA-FC<br />
use profile Non\ Root\ 71xx<br />
use rf-domain default<br />
hostname ap7131-0BFAFC<br />
!<br />
!<br />
end<br />
rfs6000-18F57A#<br />
5.3 Tunneled / Non Tunneled<br />
!<br />
! Configuration of RFS6000 version 5.2.2.0-073R<br />
!<br />
!<br />
version 2.1<br />
!<br />
!<br />
ip access-list BROADCAST-MULTICAST-CONTROL<br />
permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"<br />
permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"<br />
deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"<br />
deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"<br />
deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"<br />
permit ip any any rule-precedence 100 rule-description "permit all IP traffic"<br />
!<br />
mac access-list PERMIT-ARP-AND-IPv4<br />
permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"<br />
permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"<br />
!<br />
firewall-policy default<br />
no ip dos tcp-sequence-past-window<br />
!<br />
firewall-policy no_firewall<br />
no ip dos smurf<br />
no ip dos twinge<br />
no ip dos invalid-pro<strong>to</strong>col<br />
no ip dos router-advt<br />
no ip dos router-solicit<br />
no ip dos option-route<br />
no ip dos ascend<br />
no ip dos chargen<br />
no ip dos fraggle<br />
no ip dos snork<br />
no ip dos ftp-bounce<br />
no ip dos tcp-intercept<br />
no ip dos broadcast-multicast-icmp<br />
no ip dos land<br />
no ip dos tcp-xmas-scan<br />
no ip dos tcp-null-scan<br />
no ip dos winnuke<br />
no ip dos tcp-fin-scan<br />
no ip dos udp-short-hdr<br />
no ip dos tcp-post-syn<br />
no ip dos tcphdrfrag<br />
no ip dos ip-ttl-zero<br />
no ip dos ipspoof<br />
no ip dos tcp-bad-sequence<br />
no ip dos tcp-sequence-past-window<br />
no firewall enable<br />
!<br />
!<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 55
mint-policy global-default<br />
!<br />
meshpoint-qos-policy default<br />
!<br />
wlan-qos-policy default<br />
qos trust dscp<br />
qos trust wmm<br />
!<br />
radio-qos-policy default<br />
!<br />
wlan Test<br />
ssid Test<br />
vlan 20<br />
bridging-mode tunnel<br />
encryption-type ccmp<br />
authentication-type none<br />
wpa-wpa2 psk 0 symbol@123<br />
!<br />
ap300 default-ap300<br />
interface radio1<br />
interface radio2<br />
!<br />
meshpoint Mesh-Connex<br />
meshid Mesh<br />
beacon-format mesh-point<br />
control-vlan 1<br />
allowed-vlans 4,30<br />
neighbor inactivity-timeout 60<br />
security-mode psk<br />
wpa2 psk 0 symbol@123<br />
no root<br />
!<br />
smart-rf-policy Smart\ RF<br />
!<br />
dhcp-server-policy Telemetry<br />
dhcp-pool WLAN<br />
network 10.0.20.0/26<br />
address range 10.0.20.10 10.0.20.62<br />
domain-name cqe.mesh.net<br />
default-router 10.0.20.1<br />
dns-server 10.0.2.4<br />
dhcp-pool Ethernet<br />
network 10.0.30.0/26<br />
address range 10.0.30.10 10.0.30.62<br />
domain-name cqe.mesh.net<br />
default-router 10.0.30.1<br />
dns-server 10.0.2.4<br />
dhcp-pool Devices<br />
network 10.0.4.0/26<br />
address range 10.0.4.10 10.0.4.62<br />
domain-name cqe.mesh.net<br />
default-router 10.0.4.1<br />
dns-server 10.0.2.4<br />
!<br />
!<br />
management-policy default<br />
telnet<br />
http server<br />
https server<br />
ssh<br />
user admin password 1 e44b419340d0b973a154eddb646a572b59170594ee7112e3758e5e044a76dd35 role superuser access all<br />
user opera<strong>to</strong>r password 1 c1b5ac3b680b9f622eed6a6a9b482a998f81b67c190d6e15eacf2503b85a5a9e role moni<strong>to</strong>r access all<br />
no snmp-server manager v2<br />
snmp-server community public ro<br />
snmp-server community private rw<br />
snmp-server user snmpopera<strong>to</strong>r v3 encrypted des auth md5 0 opera<strong>to</strong>r<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 56
snmp-server user snmptrap v3 encrypted des auth md5 0 mo<strong>to</strong>rola<br />
snmp-server user snmpmanager v3 encrypted des auth md5 0 mo<strong>to</strong>rola<br />
idle-session-timeout 0<br />
!<br />
profile rfs6000 default-rfs6000<br />
bridge vlan 20<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
ip name-server 10.0.2.4<br />
ip domain-name cqe.mesh.net<br />
au<strong>to</strong>install configuration<br />
au<strong>to</strong>install firmware<br />
cryp<strong>to</strong> isakmp policy default<br />
cryp<strong>to</strong> ipsec transform-set default esp-aes-256 esp-sha-hmac<br />
interface me1<br />
ip address 10.1.1.100/24<br />
interface up1<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge1<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
no power<br />
interface ge2<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge3<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge4<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge5<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge6<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge7<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge8<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface vlan1<br />
ip address dhcp<br />
interface wwan1<br />
use dhcp-server-policy Telemetry<br />
use firewall-policy default<br />
service pm sys-restart<br />
!<br />
profile ap71xx Non\ Root\ 71xx<br />
bridge vlan 20<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 57
no au<strong>to</strong>install configuration<br />
no au<strong>to</strong>install firmware<br />
interface radio1<br />
wlan Test bss 1 primary<br />
interface radio2<br />
channel 149+<br />
rate-selection opportunistic<br />
placement outdoor<br />
meshpoint Mesh-Connex bss 1<br />
interface radio3<br />
interface ge1<br />
switchport mode access<br />
switchport access vlan 30<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge2<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface vlan4<br />
ip address dhcp<br />
interface wwan1<br />
use firewall-policy default<br />
service pm sys-restart<br />
meshpoint-device Mesh-Connex<br />
name Mesh-Connex<br />
!<br />
profile ap71xx Root\ AP71xx<br />
bridge vlan 20<br />
bridging-mode tunnel<br />
ip igmp snooping<br />
ip igmp snooping querier<br />
no au<strong>to</strong>install configuration<br />
no au<strong>to</strong>install firmware<br />
interface radio1<br />
interface radio2<br />
channel 149+<br />
rate-selection opportunistic<br />
placement outdoor<br />
meshpoint Mesh-Connex bss 1<br />
interface radio3<br />
interface ge1<br />
switchport mode trunk<br />
switchport trunk native vlan 1<br />
no switchport trunk native tagged<br />
switchport trunk allowed vlan 1,4,20,30<br />
ip arp trust<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface ge2<br />
ip dhcp trust<br />
qos trust dscp<br />
qos trust 802.1p<br />
interface vlan4<br />
ip address dhcp<br />
interface wwan1<br />
use firewall-policy default<br />
service pm sys-restart<br />
meshpoint-device Mesh-Connex<br />
name Mesh-Connex<br />
root<br />
!<br />
rf-domain default<br />
timezone America/New_York<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 58
country-code us<br />
use smart-rf-policy Smart\ RF<br />
!<br />
rfs6000 5C-0E-8B-18-F5-7A<br />
use profile default-rfs6000<br />
use rf-domain default<br />
hostname rfs6000-18F57A<br />
license AP<br />
ip default-gateway 10.0.4.1<br />
interface ge1<br />
switchport mode trunk<br />
switchport trunk native vlan 1<br />
no switchport trunk native tagged<br />
switchport trunk allowed vlan 1-4094<br />
ip arp trust<br />
interface vlan4<br />
ip address 10.0.4.3/26<br />
no ip dhcp client request options all<br />
interface vlan30<br />
ip address 10.0.30.2/26<br />
use dhcp-server-policy Telemetry<br />
use firewall-policy no_firewall<br />
!<br />
ap71xx 00-15-70-C7-93-58<br />
use profile Non\ Root\ 71xx<br />
use rf-domain default<br />
hostname ap7161-C79358<br />
!<br />
ap71xx 00-15-70-E5-A7-F8<br />
use profile Root\ AP71xx<br />
use rf-domain default<br />
hostname AP7161-Root-49:20<br />
!<br />
ap71xx 00-23-68-0B-FA-FC<br />
use profile Non\ Root\ 71xx<br />
use rf-domain default<br />
hostname ap7131-0BFAFC<br />
!<br />
!<br />
end<br />
Mo<strong>to</strong>rola <strong>Solutions</strong> Mo<strong>to</strong>rola <strong>Solutions</strong> <strong>How</strong> To – WiNG 5.2.2 MeshConnex 59