1. DL manuals
  2. 3Com
  3. Switch
  4. 3CRWX120695A
  5. Command Reference Manual

3Com 3CRWX120695A Command Reference Manual

Manual is about: Wireless LAN Mobility System Wireless LAN Switch and Controller

Summary of 3CRWX120695A

  • Page 1

    Http://www.3com.Com/ part no. 10015086 published april 2006 wireless lan mobility system wireless lan switch and controller command reference wx4400 3crwx440095a wx1200 3crwx120695a wxr100 3crwxr10095a.

  • Page 2

    3com corporation 350 campus drive marlborough, ma usa 01752-3064 copyright © 2006, 3com corporation. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without writt...

  • Page 3: Ontents

    C ontents a bout t his g uide conventions 19 documentation 20 documentation comments 21 1 u sing the c ommand -l ine i nterface overview 23 cli conventions 24 command prompts 24 syntax notation 24 text entry conventions and allowed characters 25 mac address notation 25 ip address and mask notation 2...

  • Page 4

    3 s ystem s ervice c ommands commands by usage 37 clear banner motd 38 clear history 39 clear prompt 39 clear system 40 display banner motd 41 display base-information 41 display license 42 display load 43 display system 43 help 46 history 47 quickstart 48 set auto-config 48 set banner motd 51 set c...

  • Page 5: Vlan C

    Display port-group 70 display port poe 71 display port preference 72 display port status 73 display port media-type 75 monitor port counters 76 reset port 81 set dap 81 set port 83 set port-group 84 set port media-type 85 set port name 86 set port negotiation 86 set port poe 87 set port preference 8...

  • Page 6: Ip S

    Set vlan name 116 set vlan port 117 set vlan tunnel-affinity 118 6 q uality of s ervice c ommands commands by usage 119 clear qos 120 set qos cos-to-dscp-map 121 set qos dscp-to-cos-map 122 display qos 123 display qos dscp-table 124 7 ip s ervices c ommands commands by usage 125 clear interface 127 ...

  • Page 7

    Display ip telnet 148 display ntp 149 display snmp community 151 display snmp counters 152 display snmp notify profile 152 display snmp notify target 152 display snmp status 153 display snmp usm 154 display summertime 154 display timedate 155 display timezone 155 ping 156 set arp 158 set arp agingti...

  • Page 8: Aaa C

    Snmpv2c with traps 184 snmpv1 with traps 184 set snmp protocol 186 set snmp security 187 set snmp usm 188 set summertime 191 set system ip-address 192 set timedate 193 set timezone 194 telnet 195 traceroute 197 8 aaa c ommands commands by usage 201 clear accounting 203 clear authentication admin 204...

  • Page 12: Stp C

    Set service-profile rsn-ie 383 set service-profile shared-key-auth 384 set service-profile ssid-name 384 set service-profile ssid-type 385 set service-profile tkip-mc-time 386 set service-profile web-portal-form 387 set service-profile wep active-multicast-index 388 set service-profile wep active-un...

  • Page 13: Igmp S

    13 igmp s nooping c ommands commands by usage 421 clear igmp statistics 422 display igmp 422 display igmp mrouter 426 display igmp querier 427 display igmp receiver-table 429 display igmp statistics 431 set igmp 433 set igmp lmqi 434 set igmp mrouter 435 set igmp mrsol 436 set igmp mrsol mrsi 436 se...

  • Page 14: Radius

    15 c ryptography c ommands commands by usage 469 crypto ca-certificate 470 crypto certificate 471 crypto generate key 473 crypto generate request 474 crypto generate self-signed 476 crypto otp 478 crypto pkcs12 479 display crypto ca-certificate 481 display crypto certificate 482 display crypto key s...

  • Page 15: Rf D

    Clear dot1x reauth-period 503 clear dot1x timeout auth-server 504 clear dot1x timeout supplicant 504 clear dot1x tx-period 505 display dot1x 505 set dot1x authcontrol 508 set dot1x bonded-period 509 set dot1x key-tx 510 set dot1x max-req 511 set dot1x port-control 512 set dot1x quiet-period 513 set ...

  • Page 16

    Display rfdetect countermeasures 541 display rfdetect counters 542 display rfdetect data 544 display rfdetect ignore 546 display rfdetect mobility-domain 546 display rfdetect ssid-list 550 display rfdetect vendor-list 551 display rfdetect visible 552 set rfdetect active-scan 554 set rfdetect attack-...

  • Page 17

    Set boot backup-configuration 585 set boot configuration-file 586 set boot partition 587 21 t race c ommands commands by usage 589 clear log trace 590 clear trace 590 display trace 591 save trace 592 set trace authentication 592 set trace authorization 593 set trace dot1x 594 set trace sm 595 22 s n...

  • Page 18

    24 b oot p rompt c ommands boot prompt commands by usage 619 autoboot 620 boot 621 change 623 create 624 delete 625 dhcp 626 diag 627 dir 627 display 628 fver 630 help 631 ls 632 next 633 reset 634 test 635 version 636 a o btaining s upport for your p roduct register your product 637 purchase value-...

  • Page 19: Bout

    Conventions 19 a bout t his g uide this command reference explains mobility system software (mss™) command line interface (cli) that you enter on a 3com wxr100 or wx1200 wireless switch or wx4400 wireless lan controller to configure and manage the mobility system™ wireless lan (wlan). Read this refe...

  • Page 20

    20 a bout t his g uide this manual uses the following text and syntax conventions: documentation the mss documentation set includes the following documents. Wireless lan switch manager (3wxm) release notes these notes provide information about the system software release, including new features and ...

  • Page 21

    Documentation comments 21 wireless lan switch manager reference manual this manual shows you how to plan, configure, deploy, and manage a mobility system wireless lan (wlan) using the 3com wireless lan switch manager (3wxm). Wireless lan switch manager user’s guide this manual shows you how to plan,...

  • Page 22

    22 a bout t his g uide please note that we can only respond to comments and questions about 3com product documentation at this e-mail address. Questions related to technical support or sales should be directed in the first instance to your network supplier..

  • Page 23: Sing

    1 u sing the c ommand -l ine i nterface this chapter discusses the 3com wireless switch manager (3wxm) command-line interface (cli). Described are: cli conventions (see “cli conventions” on page 24) editing on the command line (see “command-line editing” on page 29) using the cli help feature (see “...

  • Page 24

    24 c hapter 1: u sing the c ommand -l ine i nterface cli conventions be aware of the following mss cli conventions for command entry: “command prompts” on page 24 “syntax notation” on page 24 “text entry conventions and allowed characters” on page 25 “user globs, mac address globs, and vlan globs” o...

  • Page 26

    26 c hapter 1: u sing the c ommand -l ine i nterface ip address and mask notation mss displays ip addresses in dotted decimal notation — for example, 192.168.1.111. Mss makes use of both subnet masks and wildcard masks. Subnet masks unless otherwise noted, use classless interdomain routing (cidr) fo...

  • Page 27

    Cli conventions 27 table 3 gives examples of user globs. Mac address globs a media access control (mac) address glob is a similar method for matching some authentication, authorization, and accounting (aaa) and forwarding database (fdb) commands to one or more 6-byte mac addresses. In a mac address ...

  • Page 28

    28 c hapter 1: u sing the c ommand -l ine i nterface vlan globs a vlan glob is a method for matching one of a set of local rules on an wireless lan switch, known as the location policy, to one or more users. Mss compares the vlan glob, which can optionally contain wildcard characters, against the vl...

  • Page 29

    Command-line editing 29 a hyphen-separated range of port numbers, with no spaces. For example: wx1200# reset port 1-3 any combination of single numbers, lists, and ranges. Hyphens take precedence over commas. For example: wx1200# display port status 1-3,6 virtual lan identification the names of virt...

  • Page 30

    30 c hapter 1: u sing the c ommand -l ine i nterface history buffer the history buffer stores the last 63 commands you entered during a terminal session. You can use the up arrow and down arrow keys to select a command that you want to repeat from the history buffer. Tabs the mss cli uses the tab ke...

  • Page 31

    Using cli help 31 using cli help the cli provides online help. To see the full range of commands available at your access level, type the help command. For example: wx1200# help commands: ------------------------------------------------------------------------- clear clear, use 'clear help' for more...

  • Page 32

    32 c hapter 1: u sing the c ommand -l ine i nterface to see all the variations, type one of the commands followed by a question mark (?). For example: wx1200# display ip ? Alias display ip aliases dns display dns status https display ip https route display ip route table telnet display ip telnet to ...

  • Page 33: Ccess

    2 a ccess c ommands this chapter describes access commands used to control access to the mobility software system (mss) command-line interface (cli). Commands by usage this chapter presents access services commands alphabetically. Use table 5 to located commands in this chapter based on their use. D...

  • Page 34

    34 c hapter 2: a ccess c ommands enable places the cli session in enabled mode, which provides access to all commands required for configuring and monitoring the system. Syntax — enable access — all. History — introduced in mss version 3.0. Usage — mss displays a password prompt to challenge you wit...

  • Page 35

    Set enablepass 35 set enablepass sets the password that provides enabled access (for configuration and monitoring) to the wx switch. Syntax — set enablepass defaults — none. Access — enabled. History — introduced in mss version 3.0. Usage — after typing the set enablepass command, press enter. If yo...

  • Page 36

    36 c hapter 2: a ccess c ommands.

  • Page 37: Ystem

    3 s ystem s ervice c ommands use system services commands to configure and monitor system information for a wx switch. Commands by usage this chapter presents system service commands alphabetically. Use table 6 to locate commands in this chapter based on their use. Table 6 system services commands b...

  • Page 38

    38 c hapter 3: s ystem s ervice c ommands clear banner motd deletes the message-of-the-day (motd) banner that is displayed before the login prompt for each cli session on the wireless lan switch. Syntax — clear banner motd defaults — none. Access — enabled. History — introduced in mss version 3.0. E...

  • Page 39

    Clear history 39 clear history deletes the command history buffer for the current cli session. Syntax — clear history defaults — none. Access — all. History — introduced in mss version 3.0. Examples — to clear the history buffer, type the following command: wx4400# clear history success: command buf...

  • Page 41

    Display banner motd 41 display banner motd shows the banner that was configured with the set banner motd command. Syntax — display banner motd defaults — none. Access — enabled. History — introduced in mss version 3.0. Examples — to show the banner with the message of the day, type the following com...

  • Page 42

    42 c hapter 3: s ystem s ervice c ommands see also display boot on page 573 display config on page 574 display license on page 42 display system on page 43 display version on page 576 display license displays information about the license currently installed on the wx switch. Syntax — display licens...

  • Page 43

    Display load 43 display load displays cpu usage on a wx switch. Syntax — display load defaults — none. Access — enabled. History — introduced in mss version 4.1. Examples — to display the cpu load recorded from the time the wx switch was booted, as well as from the previous time the display load com...

  • Page 44

    44 c hapter 3: s ystem s ervice c ommands examples — to show system information, type the following command: wx4400# display system =============================================================================== product name: wx4400 system name: wx-bldg3 system countrycode: us system location: first...

  • Page 45

    Display system 45 system idle timeout number of seconds mss allows a cli management session (console, telnet, or ssh) to remain idle before terminating the session. (the system idle timeout can be configured using the set system idle-timeout command.) system mac wx switch’s media access control (mac...

  • Page 46

    46 c hapter 3: s ystem s ervice c ommands see also clear system on page 40 set system contact on page 55 set system countrycode on page 56 set system idle-timeout on page 58 set system location on page 59 set system name on page 60 help displays a list of commands that can be used to configure and m...

  • Page 47

    History 47 crypto crypto, use 'crypto help' for more information delete delete url dir show list of files on flash device disable disable privileged mode display display, use 'display help' for more information exit exit from the admin session help show this help screen history show contents of hist...

  • Page 48

    48 c hapter 3: s ystem s ervice c ommands see also clear history on page 39 quickstart runs a script that interactively helps you configure a new switch. (for more information, see the “cli quickstart command” section of the “wx setup methods” chapter in the wireless lan switch and controller config...

  • Page 49

    Set auto-config 49 when the 3wxm server in the corporate network receives the configuration request, the server looks in the currently open network plan for a switch configuration with the same model and serial number as the one in the configuration request. If the network plan contains a configurat...

  • Page 50

    50 c hapter 3: s ystem s ervice c ommands examples — the following commands stage a wx switch to use the auto-config option. The network where the switch is installed has a dhcp server, so the switch is configured to use the mss dhcp client to obtain an ip address, default gateway address, dns domai...

  • Page 51

    Set banner motd 51 see also crypto generate key on page 473 crypto generate self-signed on page 476 save config on page 584 set interface dhcp-client on page 161 set vlan port on page 117 set banner motd configures the banner string that is displayed before the beginning of each login prompt for eac...

  • Page 52

    52 c hapter 3: s ystem s ervice c ommands examples — to create a banner that says update meeting at 3 p.M., type the following command: wx4400# set banner motd ^update meeting at 3 p.M.^ success: change accepted. See also clear banner motd on page 38 display banner motd on page 41 set confirm enable...

  • Page 53

    Set length 53 set length defines the number of lines of cli output to display between paging prompts. Mss displays the set number of lines and waits for you to press any key to display another set, or type q to quit the display. Syntax — set length number-of-lines number-of-lines — number of lines o...

  • Page 54

    54 c hapter 3: s ystem s ervice c ommands usage — the license key is shipped with the switch. To obtain the activation key, access the 3com web site. Each license and activation key pair allows the switch to actively manage an additional 24 maps. You can install up to three upgrade license and activ...

  • Page 55

    Set system contact 55 usage — when you first log in for the initial configuration of the wx switch, the cli provides a wx1200> or wx4400> prompt, depending on your model. After you become enabled by typing enable and giving a suitable password, the wx1200# or wx4400# prompt is displayed. If you use ...

  • Page 56

    56 c hapter 3: s ystem s ervice c ommands see also clear system on page 40 display system on page 43 set system location on page 59 set system name on page 60 set system countrycode defines the country-specific ieee 802.11 regulations to enforce on the wx switch. Syntax — set system countrycode code...

  • Page 57

    Set system countrycode 57 defaults — the factory default country code is none. Access — enabled. History — introduced in mss version 3.0. Usage — you must set the system county code to a valid value before using any set ap commands to configure a map. Japan jp liechtenstein li luxembourg lu malaysia...

  • Page 58

    58 c hapter 3: s ystem s ervice c ommands examples — to set the country code to canada, type the following command: wx1200# set system country code ca success: change accepted. See also display config on page 574 set system idle-timeout specifies the maximum number of seconds a cli management sessio...

  • Page 59

    Set system ip-address 59 set system ip-address sets the system ip address so that it can be used by various services in the wx switch. Caution: any currently configured mobility domain operations cease if you change the ip address. If you change the address, you must reset the mobility domain. Synta...

  • Page 60

    60 c hapter 3: s ystem s ervice c ommands to view the system location string, type the display system command. Examples — to store the location of the wx switch in the wx’s configuration, type the following command: wx4400# set system location first-floor-bldg3 success: change accepted. See also cle...

  • Page 61

    Set system name 61 see also clear system on page 40 display system on page 43 set prompt on page 54 set system contact on page 55 set system location on page 59.

  • Page 62

    62 c hapter 3: s ystem s ervice c ommands.

  • Page 63: Ort

    4 p ort c ommands use port commands to configure and manage individual ports and load-sharing port groups. Commands by usage this chapter presents port commands alphabetically. Use table 9 to locate commands in this chapter based on their use. Table 9 port commands by usage type command port type se...

  • Page 64

    64 c hapter 4: p ort c ommands clear dap removes a distributed map. Caution: when you clear a distributed map, mss ends user sessions that are using the map. Syntax — clear dap dap-num dap-num — number of the distributed map(s) you want to remove. Defaults — none. Access — enabled. History — introdu...

  • Page 65

    Clear port counters 65 clear port counters clears port statistics counters and resets them to 0. Syntax — clear port counters defaults — none. Access — enabled. History — introduced in mss version 3.0. Examples — the following command clears all port statistics counters and resets them to 0: wx4400#...

  • Page 66

    66 c hapter 4: p ort c ommands clear port media-type disables the copper interface and reenables the fiber interface on an wx4400 gigabit ethernet port. Syntax — clear port media-type port-list port-list— list of physical ports. Mss disables the copper interface and reenables the fiber interface on ...

  • Page 67

    Clear port preference 67 examples — the following command clears the names of ports 1 through 3: wx4400# clear port 1-3 name see also display port status on page 73 set port name on page 86 clear port preference resets a gigabit ethernet port on a wx4400 to use the gbic (fiber) interface for the act...

  • Page 68

    68 c hapter 4: p ort c ommands clear port type removes all configuration settings from a port and resets the port as a network port. Caution: when you clear a port, mss ends user sessions that are using the port. Syntax — clear port type port-list port-list — list of physical ports. Mss resets and r...

  • Page 69

    Display port counters 69 examples — the following command clears port 5: wx1200# clear port type 5 this may disrupt currently authenticated users. Are you sure? (y/n) [n]y success: change accepted. See also set port type ap on page 91 set port type wired-auth on page 94 display port counters display...

  • Page 70

    70 c hapter 4: p ort c ommands examples — the following command shows octet statistics for port 3: wx1200> display port counters octets port 3 port status rx octets tx octets ============================================================================= 3 up 27965420 34886544 this command’s output ha...

  • Page 71

    Display port poe 71 see also clear port-group on page 65 set port-group on page 84 display port poe displays status information for ports on which power over ethernet (poe) is enabled. Syntax — display port poe [port-list] port-list — list of physical ports. If you do not specify a port list, poe in...

  • Page 72

    72 c hapter 4: p ort c ommands see also set port poe on page 87 display port preference displays the interface preferences set on wx4400 gigabit ethernet ports. Syntax — display port preference [port-list] port-list — list of physical ports. Mss displays the preference for all the specified ports. D...

  • Page 73

    Display port status 73 port preference =========================================================== 1 gbic 2 rj45 3 gbic 4 gbic table 13 describes the fields in this display. See also clear port preference on page 67 set port preference on page 88 display port status displays configuration and status...

  • Page 74

    74 c hapter 4: p ort c ommands examples — the following command displays information for all ports on a wx1200 switch: wx1200# display port status port name admin oper config actual type media =============================================================================== 1 1 up up auto 100/full net...

  • Page 75

    Display port media-type 75 see also clear port type on page 68 set port on page 83 set port name on page 86 set port negotiation on page 86 set port speed on page 89 set port type ap on page 91 set port type wired-auth on page 94 display port media-type displays the enabled interface types on a wx44...

  • Page 76

    76 c hapter 4: p ort c ommands =========================================================== 1 gbic 2 rj45 3 gbic 4 gbic table describes the fields in this display. See also clear port media-type on page 66 set port media-type on page 85 monitor port counters displays and continually updates port stat...

  • Page 77

    Monitor port counters 77 defaults — all types of statistics are displayed for all ports. Mss refreshes the statistics every 5 seconds. This interval cannot be configured. Statistics types are displayed in the following order by default: octets packets receive errors transmit errors collisions receiv...

  • Page 78

    78 c hapter 4: p ort c ommands examples — the following command starts the port statistics monitor beginning with octet statistics (the default): wx4400# monitor port counters as soon as you press enter, mss clears the window and displays statistics at the top of the window. Port status rx octets tx...

  • Page 79

    Monitor port counters 79 packets rx unicast number of unicast packets received. This number does not include packets that contain errors. Rx nonunicast number of broadcast and multicast packets received. This number does not include packets that contain errors. Tx unicast number of unicast packets t...

  • Page 80

    80 c hapter 4: p ort c ommands see also display port counters on page 69 collisions single coll total number of frames transmitted that experienced one collision before 64 bytes of the frame were transmitted on the network. Multiple coll total number of frames transmitted that experienced more than ...

  • Page 81

    Reset port 81 reset port resets a port by toggling its link state and power over ethernet (poe) state. Syntax — reset port port-list port-list — list of physical ports. Mss resets all the specified ports. Defaults — none. Access — enabled. History — introduced in mss version 3.0. Usage — the reset c...

  • Page 82

    82 c hapter 4: p ort c ommands dap-num — number for the distributed map. The range of valid connection numbers depends on the wx switch model: for a wx4400, you can specify a number from 1 to 256. For a wx1200, you can specify a number from 1 to 30. Serial-id serial-id — map access point serial id. ...

  • Page 85

    Set port media-type 85 see also clear port-group on page 65 display port-group on page 70 set port media-type disables the fiber interface and enables the copper interface on an wx4400 gigabit ethernet port. Syntax — set port media-type port-list rj45 port-list —list of physical ports. Mss sets the ...

  • Page 86

    86 c hapter 4: p ort c ommands set port name assigns a name to a port. After naming a port, you can use the port name or number in other cli commands. Syntax — set port port name name port — number of a physical port. You can specify only one port. Name name — alphanumeric string of up to 16 charact...

  • Page 87

    Set port poe 87 access — enabled. History — introduced in mss version 3.0. Usage — wx1200 10/100 ethernet ports support half-duplex and full-duplex operation. Examples — the following command disables autonegotiation on ports 3 and 5: wx1200# set port negotiation 3,5 disable the following command en...

  • Page 88

    88 c hapter 4: p ort c ommands examples — the following command disables poe on ports 4 and 5, which are connected to a map access point: wx1200# set port poe 4,5 disable if you are enabling power on these ports, they must be connected only to approved poe devices with the correct wiring. Do you wis...

  • Page 89

    Set port speed 89 examples — the following command sets the preference of port 2 on a wx4400 to rj-45 (copper): wx4400# set port preference 2 rj45 see also clear port preference on page 67 display port preference on page 72 set port speed changes the speed of a port. Syntax — set port speed port-lis...

  • Page 91

    Set port type ap 91 set port type ap configures an wx switch port for a map access point. Caution: when you set the port type for map use, you must specify the poe state (enable or disable) of the port. Use the wx switch’s poe to power 3com map access points only. If you enable poe on a port connect...

  • Page 92

    92 c hapter 4: p ort c ommands map access point models ap2750, mp-241, and mp-341 have a single radio that can be configured for 802.11a or 802.11b/g. Other map models have two radios. On two-radio models, one radio is always 802.11a. The other radio is 802.11b/g, but can be configured for 802.11b o...

  • Page 93

    Set port type ap 93 this command does not apply to any gigabit ethernet ports or to ports 7 and 8 on the wx1200 switch. To manage a map access point on a switch model that does not have 10/100 ethernet ports, use the set dap command to configure a distributed map connection on the switch. Examples —...

  • Page 95

    Set port type wired-auth 95 defaults — the default tag-list is null (no tag values). The default number of sessions is 1. The default fallthru authentication type is none. Access — enabled. History—introduced in mss version 3.0. Option for webaaa fallthru authentication type changed from web-auth to...

  • Page 96

    96 c hapter 4: p ort c ommands the 802.1x specification prohibits networking devices from forwarding pae group address packets, because this would make it possible for multiple authenticators to acquire the same client. For non-802.1x clients, who use mac authentication, webaaa, or last-resort authe...

  • Page 97: Vlan C

    5 vlan c ommands use virtual lan (vlan) commands to configure and manage parameters for individual port vlans on network ports, and to display information about clients roaming within a mobility domain. Commands by usage this chapter presents vlan commands alphabetically. Use table 20 to locate comm...

  • Page 99

    Clear security 12-restrict 99 the following command clears all dynamic forwarding database entries that match all vlans: wx4400# clear fdb dynamic success: change accepted. The following command clears all dynamic forwarding database entries that match ports 3 and 5: wx4400# clear fdb port 3,5 succe...

  • Page 100

    100 c hapter 5: vlan c ommands examples — the following command removes mac address aa:bb:cc:dd:ee:ff from the list of addresses to which clients in vlan abc_air are allowed to send traffic at layer 2: wx4400# clear security 12-restrict vlan abc_air permit-mac aa:bb:cc:dd:ee:ff success: change accep...

  • Page 101

    Clear vlan 101 clear vlan removes physical or virtual ports from a vlan or removes a vlan entirely. Caution: when you remove a vlan, mss completely removes the vlan from the configuration and also removes all configuration information that uses the vlan. If you want to remove only a specific port fr...

  • Page 102

    102 c hapter 5: vlan c ommands the following command completely removes vlan marigold: wx4400# clear vlan marigold this may disrupt user connectivity. Do you wish to continue? (y/n) [n]y success: change accepted. See also set vlan port on page 117 display vlan config on page 111 display fdb displays...

  • Page 103

    Display fdb 103 access — all. History —introduced in mss version 3.0. Usage — to display the entire forwarding database, enter the display fdb command without options. To display only a portion of the database, use optional parameters to specify the types of entries you want to display. Examples — t...

  • Page 104

    104 c hapter 5: vlan c ommands see also clear fdb on page 98 set fdb on page 113 display fdb agingtime displays the aging timeout period for forwarding database entries. Syntax — display fdb agingtime [vlan vlan-id] vlan vlan-id — vlan name or number. If you do not specify a vlan, the aging timeout ...

  • Page 106

    106 c hapter 5: vlan c ommands display roaming station shows a list of the stations roaming to the wireless lan switch through a vlan tunnel. Syntax — display roaming station [vlan vlan-id] [peer ip-addr ] vlan vlan-id — output is restricted to stations using this vlan. Peer ip-addr — output is rest...

  • Page 107

    Display roaming station 107 see also display roaming vlan on page 108 state state of the session: setup — station is attempting to roam to this wx switch. This switch has asked the wx from which the station is roaming for the station’s session information and is waiting for a reply. Up — mss has est...

  • Page 108

    108 c hapter 5: vlan c ommands display roaming vlan shows all vlans in the mobility domain, the wx switches servicing the vlans, and their tunnel affinity values configured on each switch for the vlans. Syntax — display roaming vlan defaults — none. Access — enabled. History —introduced in mss versi...

  • Page 110

    110 c hapter 5: vlan c ommands see also clear security 12-restrict on page 99 clear security 12-restrict counters on page 100 set security l2-restrict on page 114 display tunnel shows the tunnels from the wireless lan switch where you type the command. Syntax — display tunnel defaults — none. Access...

  • Page 111

    Display vlan config 111 see also display vlan config on page 111 display vlan config shows vlan information. Syntax — display vlan config [vlan-id] vlan-id — vlan name or number. If you do not specify a vlan, information for all vlans is displayed. Defaults — none. Access — all. History —introduced ...

  • Page 112

    112 c hapter 5: vlan c ommands table 26 describes the fields in this display. See also clear security 12-restrict on page 99 set security l2-restrict on page 114 set vlan port on page 117 set vlan tunnel-affinity on page 118 table 26 output for display vlan config field description vlan vlan number....

  • Page 114

    114 c hapter 5: vlan c ommands see also clear fdb on page 98 display fdb on page 102 set fdb agingtime changes the aging timeout period for dynamic entries in the forwarding database. Syntax — set fdb agingtime vlan-id age seconds vlan-id — vlan name or number. The timeout period change applies only...

  • Page 116

    116 c hapter 5: vlan c ommands set vlan name creates a vlan and assigns a number and name to it. Syntax — set vlan vlan-num name name vlan-num — vlan number. You can specify a number from 2 through 4093. Name — string up to 16 alphabetic characters long. Defaults — vlan 1 is named default by default...

  • Page 117

    Set vlan port 117 set vlan port assigns one or more network ports to a vlan. You also can add a virtual port to each network port by adding a tag value to the network port. Syntax — set vlan vlan-id port port-list [tag tag-value] vlan-id — vlan name or number. Port port-list — list of physical ports...

  • Page 118

    118 c hapter 5: vlan c ommands set vlan tunnel-affinity changes a wireless lan switch’s preferability within a mobility domain for tunneling user traffic for a vlan. When a user roams to a wx switch that is not a member of the user’s vlan, the wx can forward the user traffic by tunneling to another ...

  • Page 119: Uality

    6 q uality of s ervice c ommands use quality of service (qos) commands to configure packet prioritization in mss. Packet prioritization ensures that wx switches and map access points give preferential treatment to high-priority traffic such as voice and video. (to override the prioritization for spe...

  • Page 120

    120 c hapter 6: q uality of s ervice c ommands clear qos resets the switch’s mapping of differentiated services code point (dscp) values to internal qos values. The switch’s internal qos map ensures that prioritized traffic remains prioritized while transiting through the wx switch. A wx switch uses...

  • Page 121

    Set qos cos-to-dscp-map 121 set qos cos-to-dscp-map changes the value to which mss maps an internal qos value when marking outbound packets. Syntax — set qos cos-to-dscp-map level dscp dscp-value level — internal cos value. You can specify a number from 0 to 7. Dscp dscp-value — dscp value. You can ...

  • Page 122

    122 c hapter 6: q uality of s ervice c ommands set qos dscp-to-cos-map changes the internal qos value to which mss maps a packet’s dscp value when classifying inbound packets. Syntax — set qos dscp-to-cos-map dscp-range cos level dscp-range — you can specify the values as decimal numbers. Valid deci...

  • Page 123

    Display qos 123 display qos displays the switch’s qos settings. Syntax — display qos [default] default — displays the default mappings. Defaults — none. Access — enabled. History —introduced in mss version 4.1. Examples — the following command displays the default qos settings: wx1200# display qos d...

  • Page 124

    124 c hapter 6: q uality of s ervice c ommands display qos dscp-table displays a table that maps differentiated services code point (dscp) values to their equivalent combinations of ip precedence values and ip tos values. Syntax — display qos dscp-table defaults — none. Access — enabled. History —in...

  • Page 125: Ip S

    7 ip s ervices c ommands use ip services commands to configure and manage ip interfaces, management services, the domain name service (dns), network time protocol (ntp), and aliases, and to ping a host or trace a route. Commands by usage this chapter presents ip services commands alphabetically. Use...

  • Page 126

    126 c hapter 7: ip s ervices c ommands https management set ip https server on page 167 display ip https on page 145 dns set ip dns on page 164 set ip dns domain on page 165 set ip dns server on page 166 display ip dns on page 144 clear ip dns domain on page 129 clear ip dns server on page 129 ip al...

  • Page 127

    Clear interface 127 clear interface removes an ip interface. Syntax — clear interface vlan-id ip vlan-id — vlan name or number defaults — none. Access — enabled. History — introduced in mss version 3.0. Usage — if the interface you want to remove is configured as the system ip address, removing the ...

  • Page 128

    128 c hapter 7: ip s ervices c ommands topology reporting for dual-homed map access points default source ip address used in unsolicited communications such as aaa accounting reports and snmp traps examples — the following command removes the ip interface configured on vlan mauve: wx1200# clear inte...

  • Page 129

    Clear ip dns domain 129 clear ip dns domain removes the default dns domain name. Syntax — clear ip dns domain defaults — none. Access — enabled. History — introduced in mss version 3.0. Examples — the following command removes the default dns domain name from a wx switch: wx1200# clear ip dns domain...

  • Page 131

    Clear ip telnet 131 clear ip telnet resets the telnet server’s tcp port number to its default value. A wx switch listens for telnet management traffic on the telnet server port. Syntax — clear ip telnet defaults — the default telnet port number is 23. Access — enabled. History — introduced in mss ve...

  • Page 132

    132 c hapter 7: ip s ervices c ommands examples — the following command removes ntp server 192.168.40.240 from a wx switch configuration: wx4400# clear ntp server 192.168.40.240 success: change accepted. See also clear ntp update-interval on page 132 display ntp on page 149 set ntp on page 173 set n...

  • Page 133

    Clear snmp community 133 clear snmp community clears an snmp community string. Syntax — clear snmp community name comm-string comm-string — name of the snmp community you want to clear. Defaults — none. Access — enabled. History —introduced in mss version 4.0. Examples — the following command clears...

  • Page 134

    134 c hapter 7: ip s ervices c ommands see also set snmp notify profile on page 177 display snmp notify profile on page 152 clear snmp notify target clears an snmp notification target. Syntax — clear snmp notify target target-num target-num — id of the target. Defaults — none. Access — enabled. Hist...

  • Page 135

    Clear summertime 135 examples — the following command clears snmpv3 user snmpmgr1: wx1200# clear snmp usm snmpmgr1 success: change accepted. See also set snmp usm on page 188 display snmp usm on page 154 clear summertime clears the summertime setting from a wireless lan switch. Syntax — clear summer...

  • Page 136

    136 c hapter 7: ip s ervices c ommands clear system ip-address clears the system ip address. Caution: clearing the system ip address disrupts the system tasks that use the address. Syntax — clear system ip-address defaults — none. Access — enabled. History — introduced in mss version 3.0. Usage — cl...

  • Page 137

    Display arp 137 history — introduced in mss version 3.0. Examples — to return the wx switch’s real-time clock to utc, type the following command: wx4400# clear timezone success: change accepted. See also clear summertime on page 135 set summertime on page 191 set timedate on page 193 set timezone on...

  • Page 138

    138 c hapter 7: ip s ervices c ommands table 29 describes the fields in this display. See also set arp on page 158 set arp agingtime on page 159 display dhcp-client displays dhcp client information for all vlans. Syntax — display dhcp-client defaults — none. Access — all. History — introduced in mss...

  • Page 139

    Display dhcp-client 139 examples — the following command displays dhcp client information: wx1200# display dhcp-client interface: corpvlan(4) configuration status: enabled dhcp state: if_up lease allocation: 65535 seconds lease remaining: 65532 seconds ip address: 10.3.1.110 subnet mask: 255.255.255...

  • Page 140

    140 c hapter 7: ip s ervices c ommands display dhcp-server displays mss dhcp server information. Syntax — display dhcp-server [interface vlan-id] [verbose] interface vlan-id — displays the ip addresses leased by the specified vlan. Verbose — displays configuration and status information for the mss ...

  • Page 141

    Display dhcp-server 141 default gateway: 10.10.20.1 dns servers: 10.10.20.4 10.10.20.5 dns domain name: mycorp.Com table 31 and table 32 describe the fields in these displays. Table 31 output for display dhcp-server field description vlan vlan number name vlan name address ip address leased by the s...

  • Page 142

    142 c hapter 7: ip s ervices c ommands see also set interface dhcp-server on page 162 display interface shows the ip interfaces configured on the wireless lan switch. Syntax — display interface [vlan-id] vlan-id — vlan name or number. Defaults — if you do not specify a vlan id, interfaces for all vl...

  • Page 143

    Display ip alias 143 see also clear interface on page 127 set interface on page 160 set interface dhcp-client on page 161 display ip alias shows the ip aliases configured on the wireless lan switch. Syntax — display ip alias [name] name — alias string. Defaults — if you do not specify an alias name,...

  • Page 144

    144 c hapter 7: ip s ervices c ommands table 34 describes the fields in this display. See also clear ip alias on page 128 set ip alias on page 164 display ip dns shows the dns servers the wireless lan switch is configured to use. Syntax — display ip dns defaults — none. Access — all. History —introd...

  • Page 145

    Display ip https 145 see also clear ip dns domain on page 129 clear ip dns server on page 129 set ip dns on page 164 set ip dns domain on page 165 set ip dns server on page 166 display ip https shows information about the https management port. Syntax — display ip https defaults — none. Access — all...

  • Page 146

    146 c hapter 7: ip s ervices c ommands see also clear ip telnet on page 131 display ip telnet on page 148 set ip https server on page 167 set ip telnet on page 171 set ip telnet server on page 172 display ip route shows the ip route table. Syntax — display ip route [destination] destination — route ...

  • Page 147

    Display ip route 147 usage — when you add an ip interface to a vlan that is up, mss adds direct and local routes for the interface to the route table. If the vlan is down, mss does not add the routes. If you add an interface to a vlan but the routes for that interface do not appear in the route tabl...

  • Page 148

    148 c hapter 7: ip s ervices c ommands see also clear ip route on page 130 display interface on page 142 display vlan config on page 111 set interface on page 160 set ip route on page 167 display ip telnet shows information about the telnet management port. Syntax — display ip telnet defaults — none...

  • Page 149

    Display ntp 149 examples — the following command shows the status and port number for the telnet management interface to the wx switch: wx4400> display ip telnet server status port ---------------------------------- enabled 23 table 38 describes the fields in this display. See also clear ip telnet o...

  • Page 150

    150 c hapter 7: ip s ervices c ommands examples — to display ntp information for a wx switch, type the following command: wx4400> display ntp ntp client: enabled current update-interval: 20(secs) current time: fri feb 06 2004, 12:02:57 timezone is set to 'pst', offset from utc is -8:0 hours. Summert...

  • Page 151

    Display snmp community 151 see also clear ntp server on page 131 clear summertime on page 135 clear timezone on page 136 display timezone on page 155 set ntp on page 173 set ntp server on page 174 set summertime on page 191 set timezone on page 194 display snmp community displays the configured snmp...

  • Page 152

    152 c hapter 7: ip s ervices c ommands see also clear snmp community on page 133 set snmp community on page 175 display snmp counters displays snmp statistics counters. Syntax — display snmp counters defaults — none. Access — enabled. History —introduced in mss version 4.0. Display snmp notify profi...

  • Page 153

    Display snmp status 153 see also clear snmp notify target on page 134 set snmp notify target on page 181 display snmp status displays snmp version and status information. Syntax — display snmp status defaults — none. Access — enabled. History —introduced in mss version 4.0. See also set snmp communi...

  • Page 154

    154 c hapter 7: ip s ervices c ommands display snmp usm displays information about snmpv3 users. Defaults — none. Access — enabled. History —introduced in mss version 4.0. See also clear snmp usm on page 134 display snmp usm on page 154 display summertime shows a wireless lan switch’s offset from it...

  • Page 155

    Display timedate 155 set timedate on page 193 set timezone on page 194 display timedate shows the date and time of day currently set on a wireless lan switch’s real-time clock. Syntax — display timedate defaults — none. Access — all. History —introduced in mss version 3.0. Examples — to display the ...

  • Page 156

    156 c hapter 7: ip s ervices c ommands examples — to display the offset from utc, type the following command: wx4400# display timezone timezone set to 'pst', offset from utc is -8 hours see also clear summertime on page 135 clear timezone on page 136 display summertime on page 154 display timedate o...

  • Page 157

    Ping 157 because the wx switch adds header information, the icmp packet size is 8 bytes larger than the size you specify. Source-ip ip-addr — ip address, in dotted decimal notation, to use as the source ip address in the ping packets. Source-ip vlan-name — vlan name to use as the ping source. Mss us...

  • Page 159

    Set arp agingtime 159 set arp agingtime changes the aging timeout for dynamic arp entries. Syntax — set arp agingtime seconds seconds — number of seconds an entry can remain unused before mss removes the entry. You can specify from 0 through 1,000,000. To disable aging, specify 0. Defaults — none. A...

  • Page 161

    Set interface dhcp-client 161 see also clear interface on page 127 display interface on page 142 set interface dhcp-client on page 161 set interface dhcp-client configures the dhcp client on a vlan, to allow the vlan to obtain its ip interface from a dhcp server. Syntax — set interface vlan-id ip dh...

  • Page 162

    162 c hapter 7: ip s ervices c ommands see also clear interface on page 127 display dhcp-client on page 138 display interface on page 142 set interface dhcp-server configures the mss dhcp server. Use of the mss dhcp server to allocate client addresses is intended for temporary, demonstration deploym...

  • Page 163

    Set interface status 163 examples — the following command enables the dhcp server on vlan red-vlan to serve addresses from the 192.168.1.5 to 192.168.1.25 range: wx1200# set interface red-vlan ip dhcp-server enable start 192.168.1.5 stop 192.168.1.25 success: change accepted. See also display dhcp-s...

  • Page 164

    164 c hapter 7: ip s ervices c ommands set ip alias configures an alias, which maps a name to an ip address. You can use aliases as shortcuts in cli commands. Syntax — set ip alias name ip-addr name — string of up to 32 alphanumeric characters, with no spaces. Ip-addr — ip address in dotted decimal ...

  • Page 165

    Set ip dns domain 165 see also clear ip dns domain on page 129 clear ip dns server on page 129 display ip dns on page 144 set ip dns domain on page 165 set ip dns server on page 166 set ip dns domain configures a default domain name for dns queries. The wireless lan switch appends the default domain...

  • Page 168

    168 c hapter 7: ip s ervices c ommands ip-addr mask — ip address and subnet mask for the route destination, in dotted decimal notation (for example, 10.10.10.10 255.255.255.0). Ip-addr/mask-length — ip address and subnet mask length in cidr format (for example, 10.10.10.10/24). Gateway — ip address,...

  • Page 169

    Set ip snmp server 169 examples — the following command adds a default route that uses gateway 10.5.4.1 and gives the route a cost of 1: wx4400# set ip route default 10.5.4.1 1 success: change accepted. The following commands add two default routes, and configure mss to always use the route through ...

  • Page 170

    170 c hapter 7: ip s ervices c ommands history — introduced in mss version 3.0. Examples — the following command enables the snmp server on a wx switch: wx4400# set ip snmp server enable success: change accepted. See also set port trap on page 90 set snmp community on page 175 set ip ssh changes the...

  • Page 172

    172 c hapter 7: ip s ervices c ommands history —introduced in mss version 3.0. Examples — the following command changes the telnet port number on a wx switch to 5000: wx4400# set ip telnet 5000 success: change accepted. See also clear ip telnet on page 131 display ip https on page 145 display ip tel...

  • Page 174

    174 c hapter 7: ip s ervices c ommands set ntp server configures a wireless lan switch to use an ntp server. Syntax — set ntp server ip-addr ip-addr — ip address of the ntp server, in dotted decimal notation. Defaults — none. Access — enabled. History —introduced in mss version 3.0. Usage — you can ...

  • Page 175

    Set ntp update-interval 175 set ntp update-interval changes how often mss sends queries to the ntp servers for updates. Syntax — set ntp update-interval seconds seconds — number of seconds between queries. You can specify from 16 through 1,024 seconds. Defaults — the default ntp update interval is 6...

  • Page 176

    176 c hapter 7: ip s ervices c ommands read-notify — allows an snmp management application using the string to get object values on the switch but not to set them. The switch can use the string to send notifications. Notify-only — allows the switch to use the string to send notifications. Read-write...

  • Page 177

    Set snmp notify profile 177 set ip snmp server on page 169 set snmp notify target on page 181 set snmp notify profile on page 177 set snmp protocol on page 186 set snmp security on page 187 set snmp usm on page 188 display snmp community on page 151 set snmp notify profile configures an snmp notific...

  • Page 178

    178 c hapter 7: ip s ervices c ommands autotuneradiopowerchangetraps—generated when the rf auto-tuning feature changes the power setting on a radio. Clientassociationfailuretraps—generated when a client’s attempt to associate with a radio fails. Clientauthorizationsuccesstraps—generated when a clien...

  • Page 179

    Set snmp notify profile 179 mobilitydomainjointraps—generated when the wx switch is initially able to contact a mobility domain seed member, or can contact the seed member after a timeout. Mobilitydomaintimeouttraps—generated when a timeout occurs after a wx switch has unsuccessfully tried to commun...

  • Page 180

    180 c hapter 7: ip s ervices c ommands rfdetectunauthorizedssidtraps—generated when an ssid that is not on the permitted ssid list is detected. All — sends or drops all notifications. Defaults — a default notification profile (named default) is already configured in mss. All notifications in the def...

  • Page 181

    Set snmp notify target 181 wx1200# set snmp notify profile snmpprof_rfdetect send rfdetectspoofedmacaptraps success: change accepted. Wx1200# set snmp notify profile snmpprof_rfdetect send rfdetectspoofedssidaptraps success: change accepted. Wx1200# set snmp notify profile snmpprof_rfdetect send rfd...

  • Page 184

    184 c hapter 7: ip s ervices c ommands ip-addr[:udp-port-number] — ip address of the server. You also can specify the udp port number to send notifications to. Community-string — community string. Profile profile-name — notification profile this snmp user will use to specify the notification types t...

  • Page 185

    Set snmp notify target 185 community-string — community string. Profile profile-name — notification profile this snmp user will use to specify the notification types to send or drop. Defaults — the default udp port number on the target is 162. The default minimum required security level is unsecured...

  • Page 188

    188 c hapter 7: ip s ervices c ommands see also set ip snmp server on page 169 set snmp community on page 175 set snmp notify target on page 181 set snmp notify profile on page 177 set snmp protocol on page 186 set snmp usm on page 188 display snmp status on page 153 set snmp usm creates a usm user ...

  • Page 190

    190 c hapter 7: ip s ervices c ommands if the encryption type is des, 3des, or aes, you can specify a passphrase or a hexadecimal key. To specify a passphrase, use the encrypt-pass-phrase string option. The string can be from 8 to 32 alphanumeric characters long, with no spaces. To specify a key, us...

  • Page 191

    Set summertime 191 set summertime offsets the real-time clock of a wireless lan switch by +1 hour and returns it to standard time for daylight savings time or a similar summertime period that you set. Syntax — set summertime summer-name [start week weekday month hour min end week weekday month hour ...

  • Page 192

    192 c hapter 7: ip s ervices c ommands examples — to enable summertime and set the summertime time zone to pdt (pacific daylight time), type the following command: wx1200# set summertime pdt success: change accepted see also clear summertime on page 135 clear timezone on page 136 display summertime ...

  • Page 193

    Set timedate 193 examples — the following commands configure an ip interface on vlan taupe and configure the interface to be the system ip address: wx4400# set interface taupe ip 10.10.20.20/24 success: set ip address 10.10.20.20 netmask 255.255.255.0 on vlan taupe wx4400# set system ip-address 10.1...

  • Page 194

    194 c hapter 7: ip s ervices c ommands examples — the following command sets the date to march 13, 2003 and time to 11:11:12: wx4400# set timedate date feb 29 2004 time 23:58:00 time now is: sun feb 29 2004, 23:58:02 pst see also clear summertime on page 135 clear timezone on page 136 display summer...

  • Page 195

    Telnet 195 examples — to set the time zone for pacific standard time (pst), type the following command: wx1200# set timezone pst -8 timezone is set to 'pst', offset from utc is -8:0 hours. See also clear summertime on page 135 clear timezone on page 136 display summertime on page 154 display timedat...

  • Page 196

    196 c hapter 7: ip s ervices c ommands examples — in the following example, an administrator establishes a telnet session with another device and enters a command on the remote device: wx4400# telnet 10.10.10.90 session 0 pty tty2.D trying 10.10.10.90... Connected to 10.10.10.90 disconnect character...

  • Page 197

    Traceroute 197 traceroute traces the route to an ip host. Syntax — traceroute host [dnf] [no-dns] [port port-num] [queries num] [size size] [ttl hops] [wait ms] host — ip address, hostname, or alias of the destination host. Specify the ip address in dotted decimal notation. Dnf — sets the do not fra...

  • Page 198

    198 c hapter 7: ip s ervices c ommands examples — the following example traces the route to host server1: wx4400# traceroute server1 traceroute to server1.Example.Com (192.168.22.7), 30 hops max, 38 byte packets 1 engineering-1.Example.Com (192.168.192.206) 2 ms 1 ms 1 ms 2 engineering-2.Example.Com...

  • Page 199

    Traceroute 199 see also ping on page 156 !F fragmentation needed but do not fragment (dnf) bit was set. !S source route failed. !A communication administratively prohibited. ? Unknown error occurred. Table 40 error messages for traceroute (continued) field description.

  • Page 200

    200 c hapter 7: ip s ervices c ommands.

  • Page 201: Aaa C

    8 aaa c ommands use authentication, authorization, and accounting (aaa) commands to provide a secure network connection and a record of user activity. Location policy commands override any virtual lan (vlan) or security acl assignment by aaa or the local wx database to help you control access locall...

  • Page 202

    202 c hapter 8: aaa c ommands local authorization for password users set user on page 258 clear user on page 215 set user attr on page 259 clear user attr on page 216 set usergroup on page 261 clear usergroup on page 217 set user group on page 260 clear user group on page 217 clear usergroup attr on...

  • Page 204

    204 c hapter 8: aaa c ommands clear authentication admin removes an authentication rule for administrative access through telnet or web manager. Syntax — clear authentication admin user-glob user-glob — a single user or set of users. Specify a username, use the double-asterisk wildcard character (**...

  • Page 205

    Clear authentication console 205 clear authentication console removes an authentication rule for administrative access through the console. Syntax — clear authentication console user-glob user-glob — a single user or set of users. Specify a username, use the double-asterisk wildcard character (**) t...

  • Page 209

    Clear authentication proxy 209 clear authentication proxy removes a proxy rule for third-party ap users. Syntax — clear authentication proxy ssid ssid-name user-glob ssid ssid-name — ssid name to which this authentication rule applies. User-glob — user-glob associated with the rule you are removing....

  • Page 210

    210 c hapter 8: aaa c ommands examples — the following command removes webaaa for ssid research and userglob temp*@thiscorp.Com: wx4400# clear authentication web ssid research temp*@thiscorp.Com see also clear authentication admin on page 204 clear authentication console on page 205 clear authentica...

  • Page 211

    Clear mac-user 211 see also display location policy on page 224 set location policy on page 244 clear mac-user removes a user profile from the local database on the wx switch, for a user who is authenticated by a mac address. (to remove a user profile in radius, see the documentation for your radius...

  • Page 212

    212 c hapter 8: aaa c ommands clear mac-user attr removes an authorization attribute from the user profile in the local database on the wx switch, for a user who is authenticated by a mac address. (to remove an authorization attribute in radius, see the documentation for your radius server.) syntax ...

  • Page 213

    Clear mac-usergroup 213 access — enabled. History —introduced in mss version 3.0. Usage — removing a mac user from a mac user group removes the group name from the user’s profile, but does not delete the user group from the local wx database. To remove the group, use clear mac-usergroup. Examples — ...

  • Page 214

    214 c hapter 8: aaa c ommands see also clear mac-usergroup attr on page 214 display aaa on page 219 set mac-usergroup attr on page 254 clear mac-usergroup attr removes an authorization attribute from a mac user group in the local database on the wx switch, for a group of users who are authenticated ...

  • Page 215

    Clear mobility-profile 215 clear mobility-profile removes a mobility profile entirely. Syntax — clear mobility-profile name name — name of an existing mobility profile. Defaults — none. Access — enabled. History —introduced in mss version 3.0. Examples — the following command removes the mobility pr...

  • Page 216

    216 c hapter 8: aaa c ommands examples — the following command deletes the user profile for user nin: wx4400# clear user nin success: change accepted. See also display aaa on page 219 set user on page 258 clear user attr removes an authorization attribute from the user profile in the local database ...

  • Page 217

    Clear user group 217 clear user group removes a user with a password from membership in a user group in the local database on the wx switch. (to remove a user from a user group in radius, see the documentation for your radius server.) syntax — clear user username group username — username of a user ...

  • Page 218

    218 c hapter 8: aaa c ommands defaults — none. Access — enabled. History —introduced in mss version 3.0. Usage — removing a user group from the local wx database does not remove the user profiles of the group’s members from the database. Examples — the following command deletes the cardiology user g...

  • Page 219

    Display aaa 219 examples — the following command removes the members of the user group cardiology from a network access time restriction by deleting the time-of-day attribute from the group: wx4400# clear usergroup cardiology attr time-of-day success: change accepted. See also clear usergroup on pag...

  • Page 220

    220 c hapter 8: aaa c ommands set authentication admin jose sg3 set authentication console * none set authentication mac ssid mycorp * local set authentication dot1x ssid mycorp geetha eap-tls set authentication dot1x ssid mycorp * peap-mschapv2 sg1 sg2 sg3 set authentication dot1x ssid any ** peap-...

  • Page 222

    222 c hapter 8: aaa c ommands set authentication last-resort on page 236 set authentication mac on page 239 set authentication web on page 242 display accounting statistics displays the aaa accounting records for wireless users. The records are stored in the local database on the wx switch. (to disp...

  • Page 224

    224 c hapter 8: aaa c ommands display location policy displays the list of location policy rules that make up the location policy on an wx switch. Syntax — display location policy defaults — none. Access — enabled. History —introduced in mss version 3.0. Examples — the following command displays the...

  • Page 226

    226 c hapter 8: aaa c ommands method1, method2, method3, method4 — at least one of up to four methods that mss uses to process accounting records. Specify one or more of the following methods in priority order. If the first method does not succeed, mss tries the second method, and so on. A method ca...

  • Page 228

    228 c hapter 8: aaa c ommands method1, method2, method3, method4 — at least one of up to four methods that mss uses to process accounting records. Specify one or more of the following methods in priority order. If the first method does not succeed, mss tries the second method, and so on. A method ca...

  • Page 229

    Set authentication admin 229 set authentication admin configures authentication and defines where it is performed for specified users with administrative access through telnet or web manager. Syntax — set authentication admin user-glob method1 [method2] [method3] [method4] user-glob — single user or...

  • Page 230

    230 c hapter 8: aaa c ommands history —introduced in mss version 3.0. The syntax descriptions for the set authentication commands have been separated for clarity. However, the options and behavior for the set authentication admin command are the same as in previous releases. Usage — you can configur...

  • Page 231

    Set authentication console 231 set authentication mac on page 239 set authentication web on page 242 set authentication console configures authentication and defines where it is performed for specified users with administrative access through a console connection. Syntax — set authentication console...

  • Page 232

    232 c hapter 8: aaa c ommands defaults — by default, authentication is deactivated for all console users, and the default authentication method in a console authentication rule is none. Mss requires no username or password, by default. These users can press enter at the prompts for administrative ac...

  • Page 233

    Set authentication dot1x 233 set authentication mac on page 239 set authentication web on page 242 set authentication dot1x configures authentication and defines how and where it is performed for specified wireless or wired authentication clients who use an ieee 802.1x authentication protocol to acc...

  • Page 234

    234 c hapter 8: aaa c ommands provides encryption and integrity checking for the connection cannot be used with radius server authentication (requires user information to be in the switch’s local database) peap-mschapv2 — protected eap (peap) with microsoft challenge handshake authentication protoco...

  • Page 235

    Set authentication dot1x 235 access — enabled. History —introduced in mss version 3.0. Usage — you can configure different authentication methods for different groups of users by “globbing.” (for details, see “user globs” on page 26.) you can configure a rule either for wireless access to an ssid, o...

  • Page 236

    236 c hapter 8: aaa c ommands examples — the following command configures eap-tls authentication in the local wx database for ssid mycorp and 802.1x client geetha: wx4400# set authentication dot1x ssid mycorp geetha eap-tls local success: change accepted. The following command configures peap-ms-cha...

  • Page 237

    Set authentication last-resort 237 method1, method2, method3, method4 — at least one of up to four methods that mss uses to handle authentication. Specify one or more of the following methods in priority order. Mss applies multiple methods in the order you enter them. A method can be one of the foll...

  • Page 238

    238 c hapter 8: aaa c ommands however, if local appears first, followed by a radius server group, mss overrides any failed searches in the local wx database and sends an authentication request to the server group. Mss uses a last-resort authentication rule under the following conditions: the client ...

  • Page 240

    240 c hapter 8: aaa c ommands usage — you can configure different authentication methods for different groups of mac addresses by “globbing.” (for details, see “user globs, mac address globs, and vlan globs” on page 26.) if you specify multiple authentication methods in the set authentication mac co...

  • Page 241

    Set authentication proxy 241 set authentication proxy configures a proxy authentication rule for a third-party ap’s wireless users. Syntax — set authentication proxy ssid ssid-name user-glob radius-server-group ssid ssid-name — ssid name to which this authentication rule applies. User-glob — a singl...

  • Page 242

    242 c hapter 8: aaa c ommands set authentication web configures an authentication rule to allow a user to log in to the network using a web page served by the wx switch. The rule can be activated if the user is not otherwise granted or denied access by 802.1x, or granted access by mac authentication...

  • Page 243

    Set authentication web 243 usage — you can configure different authentication methods for different groups of users by “globbing.” (for details, see “user globs” on page 26.) you can configure a rule either for wireless access to an ssid, or for wired access through a wx switch’s wired authenticatio...

  • Page 244

    244 c hapter 8: aaa c ommands display aaa on page 219 set authentication admin on page 229 set authentication console on page 231 set authentication dot1x on page 233 set authentication last-resort on page 236 set location policy creates and enables a location policy on an wx switch. The location po...

  • Page 245

    Set location policy 245 optionally, you can add the suffix .Out to the name. Condition options — mss takes the action specified by the rule if all conditions in the rule are met. You can specify one or more of the following conditions: ssid operator ssid-name — ssid with which the user is associated...

  • Page 246

    246 c hapter 8: aaa c ommands modify rule-number — replaces the rule in the location policy with the new rule. Specify the number of the existing location policy rule. (to determine the number, use the display location policy command.) port port-list — list of physical port(s) by which to determine ...

  • Page 247

    Set location policy 247 you can optionally add the suffixes .In and .Out to inacl-name and outacl-name so that they match the names of security acls stored in the local wx database. Examples — the following command denies network access to all users at *.Theirfirm.Com, causing them to fail authoriza...

  • Page 248

    248 c hapter 8: aaa c ommands set mac-user configures a user profile in the local database on the wx switch for a user who can be authenticated by a mac address, and optionally adds the user to a mac user group. (to configure a mac user profile in radius, see the documentation for your radius server...

  • Page 249

    Set mac-user attr 249 set mac-user attr assigns an authorization attribute in the local database on the wx switch to a user who is authenticated by a mac address. (to assign authorization attributes through radius, see the documentation for your radius server.) syntax — set mac-user mac-addr attr at...

  • Page 250

    250 c hapter 8: aaa c ommands end-date date and time after which the user is no longer allowed to be on the network. Date and time, in the following format: yy/mm/dd-hh:mm you can use end-date alone or with start-date. You also can use start-date, end-date, or both in conjunction with time-of-day. F...

  • Page 251

    Set mac-user attr 251 service-type type of access the user is requesting. One of the following numbers: 2—framed; for network user access 6—administrative; for administrative access to the wx switch, with authorization to access the enabled (configuration) mode. The user must enter the enable comman...

  • Page 252

    252 c hapter 8: aaa c ommands time-of-day (network access mode only) day(s) and time(s) during which the user is permitted to log into the network. After authorization, the user’s session can last until either the time-of-day range or the session-timeout duration (if set) expires, whichever is short...

  • Page 253

    Set mac-user attr 253 defaults — none. Access — enabled. History —introduced in mss version 3.0. Usage — to change the value of an attribute, enter set mac-user attr with the new value. To delete an attribute, use clear mac-user attr. You can assign attributes to individual mac users and to mac user...

  • Page 254

    254 c hapter 8: aaa c ommands examples — the following command assigns input access control list (acl) acl-03 to filter the packets from a user at mac address 01:02:03:04:05:06: wx4400# set mac-user 01:02:03:04:05:06 attr filter-id acl-03.In success: change accepted. The following command restricts ...

  • Page 255

    Set mobility-profile 255 usage — to change the value of an attribute, enter set mac-usergroup attr with the new value. To delete an attribute, use clear mac-usergroup attr. You can assign attributes to individual mac users and to mac user groups. If attributes are configured for a mac user and also ...

  • Page 256

    256 c hapter 8: aaa c ommands dap-num — list of distributed map connections through which any user assigned this profile is allowed access. The same distributed map can be used in multiple mobility profile port lists. Defaults — no default mobility profile exists on the wx switch. If you do not assi...

  • Page 257

    Set mobility-profile mode 257 the following command adds port 3 to the magnolia mobility profile (which is already assigned to port 2): wx1200# set mobility-profile name magnolia port 3 success: change accepted. See also clear mobility-profile on page 215 display mobility-profile on page 224 set mac...

  • Page 258

    258 c hapter 8: aaa c ommands see also clear mobility-profile on page 215 display mobility-profile on page 224 set mobility-profile on page 255 set user configures a user profile in the local database on the wx switch for a user with a password. (to configure a user profile in radius, see the docume...

  • Page 259

    Set user attr 259 the following command assigns the password chey3nne to the admin user: wx4400# set user admin password chey3nne success: user admin created the following command changes nin’s password from goody to 29jan04: wx4400# set user nin password 29jan04 see also clear user on page 215 disp...

  • Page 260

    260 c hapter 8: aaa c ommands you can assign attributes to individual users and to user groups. If attributes are configured for a user and also for the group the user is in, the attributes assigned to the individual user take precedence for that user. For example, if the start-date attribute config...

  • Page 261

    Set usergroup 261 access — enabled. History —introduced in mss version 3.0. Usage — mss does not require users to belong to user groups. To create a user group, user the command set usergroup. Examples — the following command adds user hosni to the cardiology user group: wx4400# set user hosni group...

  • Page 262

    262 c hapter 8: aaa c ommands you can assign attributes to individual users and to user groups. If attributes are configured for a user and also for the group the user is in, the attributes assigned to the individual user take precedence for that user. For example, if the start-date attribute config...

  • Page 263

    Set web-portal 263 see also clear authentication proxy on page 209 set service-profile auth-fallthru on page 374 set user on page 258.

  • Page 264

    264 c hapter 8: aaa c ommands.

  • Page 265: Obility

    9 m obility d omain c ommands use mobility domain commands to configure and manage mobility domain groups. A mobility domain is a system of wx switches and map access points working together to support a roaming user (client). One wx switch acts as a seed switch, which maintains and distributes a li...

  • Page 266

    266 c hapter 9: m obility d omain c ommands clear mobility-domain clears all mobility domain configuration and information from a wx switch, regardless of whether the wx switch is a seed or a member of a mobility domain. Syntax — clear mobility-domain defaults — none. Access — enabled. History —intr...

  • Page 267

    Display mobility-domain config 267 usage — this command has no effect if the wx switch member is not configured as part of a mobility domain or the current wx switch is not the seed. Examples — the following command clears a mobility domain member with the ip address 192.168.0.1: wx1200# clear mobil...

  • Page 268

    268 c hapter 9: m obility d omain c ommands history —introduced in mss version 3.0. Examples — to display mobility domain status, type the following command: wx4400# display mobility-domain status mobility domain name: pleasanton member state status --------------- ------------- -------------- 192.1...

  • Page 269

    Set mobility-domain member 269 set mobility-domain member on the seed wx switch, adds a member to the list of mobility domain members. If the current wx switch is not configured as a seed, this command is rejected. Syntax — set mobility-domain member ip-addr ip-addr — ip address of the mobility doma...

  • Page 270

    270 c hapter 9: m obility d omain c ommands set mobility-domain mode member seed-ip on a nonseed wx switch, sets the ip address of the seed wx switch. This command is used on a member wx to configure it as a member. If the wx switch is currently part of another mobility domain or using another seed,...

  • Page 271

    Set mobility-domain mode seed domain-name 271 set mobility-domain mode seed domain-name creates a mobility domain by setting the current wx switch as the seed device and naming the mobility domain. Syntax — set mobility-domain mode seed domain-name mob-domain-name mob-domain-name — name of the mobil...

  • Page 272

    272 c hapter 9: m obility d omain c ommands.

  • Page 273: Etwork

    10 n etwork d omain c ommands use network domain commands to configure and manage network domain groups. A network domain is a group of geographically dispersed mobility domains that share information among themselves over a wan link. This shared information allows a user configured on a wx switch i...

  • Page 274

    274 c hapter 10: n etwork d omain c ommands clear network-domain clears all network domain configuration and information from a wx switch, regardless of whether the wx switch is a seed or a member of a network domain. Syntax — clear network-domain defaults — none. Access — enabled. History —introduc...

  • Page 277

    Clear network-domain seed-ip 277 clear network-domain seed-ip removes the specified network domain seed from the wx switch’s configuration. When you enter this command, the network domain tcp connections between the wx switch and the specified network domain seed are closed. Syntax — clear network-d...

  • Page 278

    278 c hapter 10: n etwork d omain c ommands display network-domain displays the status of network domain seeds and members. Syntax — display network-domain defaults — none. Access — enabled. History —introduced in mss 4.1. Examples — to display network domain status, type the following command. The ...

  • Page 279

    Display network-domain 279 table 48 describes the fields in the display. See also clear network-domain on page 274 set network-domain mode member seed-ip on page 280 set network-domain mode seed domain-name on page 282 set network-domain peer on page 281 table 48 radio-specific parameters parameter ...

  • Page 280

    280 c hapter 10: n etwork d omain c ommands set network-domain mode member seed-ip sets the ip address of a network domain seed. This command is used for configuring a wx switch as a member of a network domain. You can specify multiple network domain seeds and configure one as the primary seed. Synt...

  • Page 281

    Set network-domain peer 281 wx1200# set network-domain mode member seed-ip 192.168.9.254 affinity 7 success: change accepted. See also clear network-domain on page 274 display network-domain on page 278 set network-domain peer on a network domain seed, configures one or more wx switches as redundant...

  • Page 282

    282 c hapter 10: n etwork d omain c ommands set network-domain mode seed domain-name creates a network domain by setting the current wx switch as a seed device and naming the network domain. Syntax — set network-domain mode seed domain-name net-domain-name net-domain-name — name of the network domai...

  • Page 283: Anaged

    11 m anaged a ccess p oint c ommands use map access point commands to configure and manage map access points. Be sure to do the following before using the commands: define the country-specific ieee 802.11 regulations on the wx switch. (see set system countrycode on page 56.) install the map access p...

  • Page 285

    Map access point commands by usage 285 set service-profile wpa-ie on page 391 set service-profile rsn-ie on page 383 set service-profile cipher-ccmp on page 377 set service-profile cipher-tkip on page 378 set service-profile cipher-wep104 on page 379 set service-profile cipher-wep40 on page 380 set ...

  • Page 289

    Clear service-profile 289 examples — the following commands disable the radios that are using radio profile rp1 and reset the beaconed-interval parameter to its default value: wx4400# set radio-profile rp1 mode disable wx4400# clear radio-profile rp1 beacon-interval success: change accepted. The fol...

  • Page 290

    290 c hapter 11: m anaged a ccess p oint c ommands examples — the following commands disable the radios that are using radio profile rp6, remove service-profile svcprof6 from rp6, then clear svcprof6 from the configuration. Wx4400# set radio-profile rp6 mode disable wx4400# clear radio-profile rp6 s...

  • Page 292

    292 c hapter 11: m anaged a ccess p oint c ommands name map access point name. Boot-download- enable state of the firmware upgrade option: yes (automatic upgrades are enabled) no (automatic upgrades are disabled) load balancing group names of the map load-balancing groups to which the map access poi...

  • Page 296

    296 c hapter 11: m anaged a ccess p oint c ommands table 52 describes the fields in this display. Table 52 output for display ap counters field description dap distributed map number. Port wx port number (if the map is directly connected to the wx and the wx port is configured as a map access point)...

  • Page 298

    298 c hapter 11: m anaged a ccess p oint c ommands user sessions number of clients currently associated with the radio. Generally, this counter is equal to the number of sessions listed for the radio in display sessions output. However, the counter can differ from the counter in display sessions out...

  • Page 302

    302 c hapter 11: m anaged a ccess p oint c ommands table 54 describes the fields in this display. Table 54 output of display ap etherstats field description rxunicast number of unicast frames received. Rxmulticast number of multicast frames received. Rxbroadcast number of broadcast frames received. ...

  • Page 306

    306 c hapter 11: m anaged a ccess p oint c ommands the following command uses the terse option to display brief information for distributed maps: wx4400# display dap status terse total number of entries: 4 operational: 1, image downloading: 0, unknown: 3, other: 0 flags: o = operational, b = booting...

  • Page 308

    308 c hapter 11: m anaged a ccess p oint c ommands radio 1 type radio 2 type 802.11 type and configuration state of the radio. The configure succeed state indicates that the map has received configuration parameters for the radio and the radio is ready to accept client connections. 802.11b protect i...

  • Page 310

    310 c hapter 11: m anaged a ccess p oint c ommands access — enabled. History —introduced in mss version 3.0. Examples — the following command displays rf attribute information for radio 1 on the directly connected map access point on port 2: wx1200# display auto-tune attributes ap 2 radio 1 auto-tun...

  • Page 311

    Display auto-tune neighbors 311 set radio-profile auto-tune channel-interval on page 351 set radio-profile auto-tune power-backoff- timer on page 352 set radio-profile auto-tune power-config on page 353 set radio-profile auto-tune power-interval on page 354 display auto-tune neighbors displays the o...

  • Page 312

    312 c hapter 11: m anaged a ccess p oint c ommands examples — the following command displays neighbor information for radio 1 on the directly connected map access point on port 2: wx1200# display auto-tune neighbors ap 2 radio 1 total number of entries for port 2 radio 1: 5 channel neighbor bss/mac ...

  • Page 314

    314 c hapter 11: m anaged a ccess p oint c ommands the following command displays connection information specifically for a distributed map with serial id m9de48b6ead00: wx1200# display dap connection serial-id m9de48b6ead00 total number of entries: 1 dap serial id dap ip address wx ip address --- -...

  • Page 315

    Display dap global 315 usage — connections are shown only for the distributed maps that are configured on the wx switch from which you enter the command, and only for the mobility domain the switch is in. To show information only for distributed maps that have active connections, use the display dap...

  • Page 318

    318 c hapter 11: m anaged a ccess p oint c ommands usage — mss contains a default radio profile. 3com recommends that you do not change this profile but instead keep the profile for reference. Examples — the following command shows radio profile information for the default radio profile: wx4400# dis...

  • Page 319

    Display radio-profile 319 long retry limit number of times a radio in the radio profile can send a long unicast frame without receiving an acknowledgment. A long unicast frame is a frame that is equal to or longer than the rts threshold. Long preamble indicates whether an 802.11b radio that uses thi...

  • Page 320

    320 c hapter 11: m anaged a ccess p oint c ommands see also set radio-profile 11g-only on page 347 set radio-profile auto-tune channel-config on page 349 set radio-profile auto-tune channel-holddown on page 350 set radio-profile auto-tune channel-interval on page 351 set radio-profile auto-tune powe...

  • Page 322

    322 c hapter 11: m anaged a ccess p oint c ommands beacon indicates whether the radio sends beacons, to advertise the ssid: no yes auth-fallthru secondary (fallthru) encryption type when a user tries to authenticate but the wx switch managing the radio does not have an authentication rule with a use...

  • Page 323

    Display service-profile 323 see also set service-profile auth-dot1x on page 373 set service-profile auth-fallthru on page 374 set service-profile auth-psk on page 375 set service-profile beacon on page 376 set service-profile cipher-ccmp on page 377 set service-profile cipher-tkip on page 378 set se...

  • Page 324

    324 c hapter 11: m anaged a ccess p oint c ommands set service-profile ssid-name on page 384 set service-profile ssid-type on page 385 set service-profile tkip-mc-time on page 386 set service-profile web-portal-form on page 387 set service-profile wep active-multicast- index on page 388 set service-...

  • Page 325

    Set dap auto 325 set dap auto creates a profile for automatic configuration of distributed maps. Syntax — set dap auto defaults — none. Access — enabled. History —introduced in mss 4.0. Usage — table 65 lists the configurable profile parameters and their defaults. The only parameter that requires co...

  • Page 327

    Set dap auto mode 327 11a — 802.11a 11b — 802.11b 11g — 802.11g defaults — the default radio type for models ap2750, mp-241, and mp-341, and for the 802.11b/g radios in other models is 802.11g in regulatory domains that support 802.11g, or 802.11b in regulatory domains that do not support 802.11g. M...

  • Page 331

    Set dap fingerprint 331 usage — changing the led blink mode does not alter operation of the map access point. Only the behavior of the leds is affected. Examples — the following command enables led blink mode on the map access points connected to ports 3 and 4: wx1200# set ap 3-4 blink enable succes...

  • Page 332

    332 c hapter 11: m anaged a ccess p oint c ommands examples — the following example verifies the fingerprint for distributed map 8: wx4400# set dap 8 fingerprint b4:f9:2a:52:37:58:f4:d0:10:75:43:2f:45:c9:52:c3 success: change accepted. See also set dap security on page 345 set service-profile cipher...

  • Page 336

    336 c hapter 11: m anaged a ccess p oint c ommands dap auto — sets the maximum power for radios configured by the map configuration profile. (see set dap auto on page 325.) radio 1 —radio 1 of the map. Radio 2 —radio 2 of the map. (this option does not apply to single-radio models.) power-level — ma...

  • Page 338

    338 c hapter 11: m anaged a ccess p oint c ommands the interval is 1000 packets. If more than the specified percentage of packets within a group of 1000 packets received by the radio are retransmissions, the radio increases power. When the percentage of retransmissions exceeds the max-retransmission...

  • Page 342

    342 c hapter 11: m anaged a ccess p oint c ommands radio 2 —radio 2 of the map. (this option does not apply to single-radio models.) mode enable —enables a radio. Mode disable —disables a radio. Defaults — map access point radios are disabled by default. Access — enabled. History —introduced in mss ...

  • Page 345

    Set dap security 345 examples — the following command configures the transmit power on the 802.11a radio on the map access point connected to port 5: wx1200# set ap 5 radio 1 tx-power 10 success: change accepted. The following command configures the channel and transmit power on the 802.11b/g radio ...

  • Page 346

    346 c hapter 11: m anaged a ccess p oint c ommands history —introduced in mss 4.0. Usage — this parameter applies to all distributed maps managed by the switch. If you change the setting to required, the switch requires distributed maps to have encryption keys. The switch also requires their fingerp...

  • Page 347

    Set radio-profile 11g-only 347 defaults — automatic firmware upgrades of map access points are enabled by default. Access — enabled. History —introduced in mss version 3.0. Option auto added for configuration of the map configuration profile. Usage — when the feature is enabled on an wx port, a map ...

  • Page 348

    348 c hapter 11: m anaged a ccess p oint c ommands even when association of 802.11b clients is disabled, if an 802.11b/g radio detects a beacon from an 802.11b network, the radio enters protection mode to guard against interference. The set radio-profile 11g-only command does not affect the radio su...

  • Page 349

    Set radio-profile auto-tune channel-config 349 defaults — active scanning is enabled by default. Access — enabled. History —introduced in mss version 4.0. Usage — you can enter this command on any wx switch in the mobility domain. The command takes effect only on that switch. Examples — the followin...

  • Page 350

    350 c hapter 11: m anaged a ccess p oint c ommands rf auto-tuning of channels on 802.11a radios uses only the bottom eight channels in the band (36, 40, 44, 48, 52, 56, 60, and 64). To use a higher channel number, you must disable rf auto-tuning of channels on the radio profile the radio is in, and ...

  • Page 351

    Set radio-profile auto-tune channel-interval 351 usage — the channel holddown applies even if rf anomalies occur that normally cause an immediate channel change. Examples — the following command changes the channel holddown for radios in radio profile rp2 to 600 seconds: wx4400# set radio-profile rp...

  • Page 352

    352 c hapter 11: m anaged a ccess p oint c ommands examples — the following command sets the channel interval for radios in radio profile rp2 to 2700 seconds (45 minutes): wx4400# set radio-profile rp2 auto-tune channel-interval 2700 success: change accepted. See also set radio-profile auto-tune cha...

  • Page 354

    354 c hapter 11: m anaged a ccess p oint c ommands set radio-profile auto-tune power-backoff- timer on page 352 set radio-profile auto-tune power-interval on page 354 set radio-profile auto-tune power-interval sets the interval at which rf auto-tuning decides whether to change the power level on rad...

  • Page 355

    Set radio-profile beacon-interval 355 set radio-profile beacon-interval changes the rate at which each map radio in a radio profile advertises its service set identifier (ssid). Syntax — set radio-profile name beacon-interval interval name — radio profile name. Interval — number of milliseconds (ms)...

  • Page 356

    356 c hapter 11: m anaged a ccess p oint c ommands map radios can also issue countermeasures against interfering devices. An interfering device is not part of the 3com network but also is not a rogue. No client connected to the device has been detected communicating with any network entity listed in...

  • Page 357

    Set radio-profile dtim-interval 357 the following command causes radios managed by radio profile radprof3 to issue countermeasures against devices in the wx switch’s attack list: wx1200# set radio-profile radprof3 countermeasures configured success: change accepted. Note that when you issue this com...

  • Page 358

    358 c hapter 11: m anaged a ccess p oint c ommands see also display radio-profile on page 317 set radio-profile mode on page 362 set radio-profile frag-threshold changes the fragmentation threshold for the map radios in a radio profile. The fragmentation threshold specifies the maximum length a fram...

  • Page 359

    Set radio-profile long-retry 359 set radio-profile long-retry changes the long retry threshold for the map radios in a radio profile. The long retry threshold specifies the number of times a radio can send a long unicast frame without receiving an acknowledgment. A long unicast frame is a frame that...

  • Page 360

    360 c hapter 11: m anaged a ccess p oint c ommands set radio-profile max-rx-lifetime changes the maximum receive threshold for the map radios in a radio profile. The maximum receive threshold specifies the number of milliseconds that a frame received by a radio can remain in buffer memory. Syntax — ...

  • Page 361

    Set radio-profile max-tx-lifetime 361 set radio-profile max-tx-lifetime changes the maximum transmit threshold for the map radios in a radio profile. The maximum transmit threshold specifies the number of milliseconds that a frame scheduled to be transmitted by a radio can remain in buffer memory. S...

  • Page 363

    Set radio-profile mode 363 access — enabled. History —introduced in mss version 3.0. Usage — use the command without any optional parameters to create new profile. If the radio profile does not already exist, mss creates a new radio profile. Use the enable or disable option to enable or disable all ...

  • Page 364

    364 c hapter 11: m anaged a ccess p oint c ommands examples — the following command configures a new radio profile named rp1: wx4400# set radio-profile rp1 success: change accepted. The following command enables the radios that use radio profile rp1: wx4400# set radio-profile rp1 mode enable the fol...

  • Page 365

    Set radio-profile rts-threshold 365 usage — changing the preamble length value affects only the support advertised by the radio. Regardless of the preamble length setting (short or long), an 802.11b/g radio accepts and can generate 802.11b/g frames with either short or long preambles. If a client as...

  • Page 366

    366 c hapter 11: m anaged a ccess p oint c ommands history —introduced in mss version 3.0. Usage — you must disable all radios that are using a radio profile before you can change parameters in the profile. Use the set radio-profile mode command. Examples — the following command changes the rts thre...

  • Page 367

    Set radio-profile service-profile 367 auth-fallthru web-auth uses webaaa for users who do not match an 802.1x or mac authentication rule for the ssid requested by the user. Auth-psk disable does not support using a preshared key (psk) to authenticate wpa clients. Beacon enable sends beacons to adver...

  • Page 368

    368 c hapter 11: m anaged a ccess p oint c ommands access — enabled. History —introduced in mss version 3.0. Usage — you must configure the service profile before you can map it to a radio profile. You can map the same service profile to more than one radio profile. You must disable all radios that ...

  • Page 369

    Set radio-profile short-retry 369 set service-profile cipher-ccmp on page 377 set service-profile cipher-tkip on page 378 set service-profile cipher-wep104 on page 379 set service-profile cipher-wep40 on page 380 set service-profile psk-phrase on page 381 set service-profile psk-raw on page 382 set ...

  • Page 370

    370 c hapter 11: m anaged a ccess p oint c ommands usage — you must disable all radios that are using a radio profile before you can change parameters in the profile. Use the set radio-profile mode command. Examples — the following command changes the short retry threshold for radio profile rp1 to 3...

  • Page 371

    Set service-profile attr 371 if you plan to use svp or another non-wmm type of prioritization, you must configure acls to tag the packets. (see the “enabling prioritization for legacy voice over ip” section in the “configuring and managing security acls” chapter of the wireless lan switch and contro...

  • Page 372

    372 c hapter 11: m anaged a ccess p oint c ommands the ssid default attributes are applied in addition to any attributes supplied for the user by the radius server or the local database. When the same attribute is specified both as an ssid default attribute and through aaa, then the attribute suppli...

  • Page 373

    Set service-profile auth-dot1x 373 see also display service-profile on page 321 display sessions network on page 525 set service-profile auth-dot1x disables or reenables 802.1x authentication of wi-fi protected access (wpa) clients by map radios, when the wpa information element (ie) is enabled in t...

  • Page 374

    374 c hapter 11: m anaged a ccess p oint c ommands see also display service-profile on page 321 set service-profile auth-psk on page 375 set service-profile psk-phrase on page 381 set service-profile wpa-ie on page 391 set service-profile auth-fallthru specifies the authentication type for users who...

  • Page 375

    Set service-profile auth-psk 375 access — enabled. History —introduced in mss version 3.0. Option for webaaa fallthru authentication type changed from web-auth to web-portal in mss version 4.1. Usage — the last-resort fallthru authentication type allows any user to access any ssid managed by the ser...

  • Page 376

    376 c hapter 11: m anaged a ccess p oint c ommands access — enabled. History —introduced in mss version 3.0. Usage — this command affects authentication of wpa clients only. To use psk authentication, you also must configure a passphrase or key. In addition, you must enable the wpa ie. The webaaa fa...

  • Page 377

    Set service-profile cipher-ccmp 377 enable —enables beaconing of the ssid managed by the service profile. Disable —disables beaconing of the ssid managed by the service profile. Defaults — beaconing is enabled by default. Access — enabled. History —introduced in mss version 3.0. Examples — the follo...

  • Page 378

    378 c hapter 11: m anaged a ccess p oint c ommands examples — the following command configures service profile sp2 to use ccmp encryption: wx4400# set service-profile sp2 cipher-ccmp enable success: change accepted. See also set service-profile cipher-tkip on page 378 set service-profile cipher-wep1...

  • Page 379

    Set service-profile cipher-wep104 379 set service-profile tkip-mc-time on page 386 set service-profile wpa-ie on page 391 set service-profile cipher-wep104 enables dynamic wired equivalent privacy (wep) with 104-bit keys, in a service profile. Syntax — set service-profile name cipher-wep104 {enable ...

  • Page 380

    380 c hapter 11: m anaged a ccess p oint c ommands see also set service-profile cipher-ccmp on page 377 set service-profile cipher-tkip on page 378 set service-profile cipher-wep40 on page 380 set service-profile wep key-index on page 390 set service-profile wpa-ie on page 391 set service-profile ci...

  • Page 381

    Set service-profile psk-phrase 381 examples — the following command configures service profile sp2 to use 40-bit wep encryption: wx4400# set service-profile sp2 cipher-wep40 enable success: change accepted. See also set service-profile cipher-ccmp on page 377 set service-profile cipher-tkip on page ...

  • Page 382

    382 c hapter 11: m anaged a ccess p oint c ommands examples — the following command configures service profile sp3 to use passphrase “1234567890123?=+&% the quick brown fox jumps over the lazy sl”: wx4400# set service-profile sp3 psk-phrase "1234567890123 ?=+&% the quick brown fox jumps over the laz...

  • Page 383

    Set service-profile rsn-ie 383 examples — the following command configures service profile sp3 to use a raw psk with psk clients: wx4400# set service-profile sp3 psk-raw c25d3fe4483e867 d1df96eaacdf8b02451fa0836162e758100f5f6b87965e59d success: change accepted. See also set mac-user attr on page 249...

  • Page 384

    384 c hapter 11: m anaged a ccess p oint c ommands set service-profile shared-key-auth enables shared-key authentication, in a service profile. Use this command only if advised to do so by 3com. This command does not enable preshared key (psk) authentication for wi-fi protected access (wpa). To enab...

  • Page 385

    Set service-profile ssid-type 385 access — enabled. History —introduced in mss version 3.0. Support added for blank spaces in the ssid name in mss version 4.0. Examples — the following command applies the name guest to the ssid managed by service profile clear_wlan: wx4400# set service-profile clear...

  • Page 386

    386 c hapter 11: m anaged a ccess p oint c ommands set service-profile tkip-mc-time changes the length of time that map radios use countermeasures if two message integrity code (mic) failures occur within 60 seconds. When countermeasures are in effect, map radios dissociate all tkip and wpa wep clie...

  • Page 387

    Set service-profile web-portal-form 387 set service-profile web-portal-form specifies a custom login page to serve to webaaa users who request the ssid managed by the service profile. Syntax — set service-profile name web-portal-form url name — service profile name. Url — wx subdirectory name and ht...

  • Page 388

    388 c hapter 11: m anaged a ccess p oint c ommands file:corpa-login.Html 637 bytes aug 12 2004, 15:42:26 file:corpa-logo.Jpg 1202 bytes aug 12 2004, 15:57:11 total: 1839 bytes used, 206577 kbytes free wx4400# set service-profile corpa-service web-aaa-form corpa-ssid/ corpa-login.Html success: change...

  • Page 389

    Set service-profile wep active-unicast- index 389 see also set service-profile wep active-unicast- index on page 389 set service-profile wep key-index on page 390 set service-profile wep active-unicast- index specifies the static wired-equivalent privacy (wep) key (one of four) to use for encrypting...

  • Page 390

    390 c hapter 11: m anaged a ccess p oint c ommands set service-profile wep key-index sets the value of one of four static wired-equivalent privacy (wep) keys for static wep encryption. Syntax — set service-profile name wep key-index num key value name — service profile name. Key-index num — wep key ...

  • Page 391

    Set service-profile wpa-ie 391 set service-profile wpa-ie enables the wpa information element (ie) in wireless frames. The wpa ie advertises the wpa authentication methods and cipher suites supported by radios in the radio profile mapped to the service profile. Syntax — set service-profile name wpa-...

  • Page 392

    392 c hapter 11: m anaged a ccess p oint c ommands.

  • Page 393: Stp C

    12 stp c ommands use spanning tree protocol (stp) commands to configure and manage spanning trees on the virtual lans (vlans) configured on a wireless lan switch or controller, to maintain a loop-free network. Stp commands by usage this chapter presents stp commands alphabetically. Use the following...

  • Page 394

    394 c hapter 12: stp c ommands clear spantree portcost resets to the default value the cost of a network port or ports on paths to the stp root bridge in all vlans on a wx switch. Syntax — clear spantree portcost port-list port-list — list of ports. The port cost is reset on the specified ports. Def...

  • Page 395

    Clear spantree portpri 395 clear spantree portpri resets to the default value the priority of a network port or ports for selection as part of the path to the stp root bridge in all vlans on a wireless lan switch or controller. Syntax — clear spantree portpri port-list port-list — list of ports. The...

  • Page 396

    396 c hapter 12: stp c ommands vlan vlan-id — vlan name or number. Mss resets the cost for only the specified vlan. Defaults — none. Access — enabled. History —introduced in mss version 3.0. Usage — mss does not change a port’s cost for vlans other than the one(s) you specify. Examples — the followi...

  • Page 397

    Clear spantree statistics 397 history —introduced in mss version 3.0. Usage — mss does not change a port’s priority for vlans other than the one(s) you specify. Examples — the following command resets the stp priority for port 2 in vlan avocado: wx4400# clear spantree portvlanpri 2 vlan avocado succ...

  • Page 399

    Display spantree 399 table 69 describes the fields in this display. Table 69 output for display spantree field description vlan vlan number. Spanning tree mode in the current software version, the mode is always pvst+, which means per vlan spanning tree+. Spanning tree type in the current software v...

  • Page 400

    400 c hapter 12: stp c ommands see also display spantree blockedports on page 401 display spantree backbonefast indicates whether the stp backbone fast convergence feature is enabled or disabled. Syntax — display spantree backbonefast defaults — none. Access — all. History —introduced in mss version...

  • Page 401

    Display spantree blockedports 401 examples — the following example shows the command output on a wx switch with backbone fast convergence enabled: wx4400# display spantree backbonefast backbonefast is enabled see also set spantree backbonefast on page 411 display spantree blockedports lists informat...

  • Page 402

    402 c hapter 12: stp c ommands display spantree portfast displays stp uplink fast convergence information for all network ports or for one or more network ports. Syntax — display spantree portfast [port-list] port-list — list of ports. If you do not specify any ports, mss displays uplink fast conver...

  • Page 403

    Display spantree portvlancost 403 display spantree portvlancost shows the cost of a port on a path to the stp root bridge, for each of the port’s vlans. Syntax — display spantree portvlancost port-list port-list — list of ports. Defaults — none. Access — all. History —introduced in mss version 3.0. ...

  • Page 404

    404 c hapter 12: stp c ommands usage — the command displays statistics separately for each port. Examples — the following command shows stp statistics for port 1: wx4400# display spantree statistics 1 bpdu related parameters port 1 vlan 1 spanning tree enabled for vlan = 1 port spanning tree enabled...

  • Page 405

    Display spantree statistics 405 topology change timer value 0 hold timer inactive hold timer value 0 delay root port timer inactive delay root port timer value 0 delay root port timer restarted is false vlan based information & statistics spanning tree type ieee spanning tree multicast address 01-00...

  • Page 406

    406 c hapter 12: stp c ommands table 71 output for display spantree statistics field description port port number. Vlan vlan id. Spanning tree enabled for vlan state of the stp feature on the vlan. Port spanning tree state of the stp feature on the port. State stp state of the port: blocking — the p...

  • Page 407

    Display spantree statistics 407 config_pending indicates whether a configured bpdu is to be transmitted on expiration of the hold timer for the port. Port_inconsistency indicates whether the port is in an inconsistent state. Config bpdu’s xmitted number of bpdus transmitted from the port. A number i...

  • Page 408

    408 c hapter 12: stp c ommands hold timer status of the hold timer. This timer ensures that configured bpdus are not transmitted too frequently through any bridge port. Hold timer value current value of the hold timer, in seconds. Delay root port timer status of the delay root port timer, which enab...

  • Page 409

    Display spantree uplinkfast 409 see also clear spantree statistics on page 397 display spantree uplinkfast shows uplink fast convergence information for one vlan or all vlans. Syntax — display spantree uplinkfast [vlan vlan-id] vlan vlan-id — vlan name or number. If you do not specify a vlan, mss di...

  • Page 410

    410 c hapter 12: stp c ommands examples — the following command shows uplink fast convergence information for all vlans: wx4400# display spantree uplinkfast vlan port list ------------------------------------------------------------------------ 1 1(fwd),2,3 table 72 describes the fields in this disp...

  • Page 411

    Set spantree backbonefast 411 examples — the following command enables stp on all vlans configured on a wx switch: wx4400# set spantree enable success: change accepted. The following command disables stp on vlan burgundy: wx4400# set spantree disable vlan burgundy success: change accepted. See also ...

  • Page 412

    412 c hapter 12: stp c ommands see also display spantree backbonefast on page 400 set spantree fwddelay changes the period of time after a topology change that a wx switch which is not the root bridge waits to begin forwarding layer 2 traffic on one or all of its configured vlans. (the root bridge a...

  • Page 413

    Set spantree maxage 413 vlan vlan-id — vlan name or number. Mss changes the interval on only the specified vlan. Defaults — the default hello timer interval is 2 seconds. Access — enabled. History —introduced in mss version 3.0. Examples — the following command changes the hello interval for all vla...

  • Page 414

    414 c hapter 12: stp c ommands examples — the following command changes the maximum acceptable age for root bridge hello packets on all vlans to 15 seconds: wx4400# set spantree maxage 15 all success: change accepted. See also display spantree on page 398 set spantree portcost changes the cost that ...

  • Page 415

    Set spantree portfast 415 access — enabled. History —introduced in mss version 3.0. Usage — this command applies only to the default vlan (vlan 1). To change the cost of a port in another vlan, use the set spantree portvlancost command. Examples — the following command changes the cost on ports 3 an...

  • Page 416

    416 c hapter 12: stp c ommands examples — the following command enables port fast convergence on ports 2, 5, and 7: wx1200# set spantree portfast port 2,4,7 enable success: change accepted. See also display spantree portfast on page 402 set spantree portpri changes the stp priority of a network port...

  • Page 420

    420 c hapter 12: stp c ommands history —introduced in mss version 3.0. Usage — the uplink fast convergence feature is applicable to bridges that are acting as access switches to the network core (distribution layer) but are not in the core themselves. Do not enable the feature on wx switches that ar...

  • Page 421: Igmp S

    13 igmp s nooping c ommands use internet group management protocol (igmp) snooping commands to configure and manage multicast traffic reduction on a wx. Commands by usage this chapter presents igmp snooping commands alphabetically. Use the table 74 to locate commands in this chapter based on their u...

  • Page 422

    422 c hapter 13: igmp s nooping c ommands clear igmp statistics clears igmp statistics counters on one vlan or all vlans on a wireless lan switch and resets them to 0. Syntax — clear igmp statistics [vlan vlan-id] vlan vlan-id — vlan name or number. If you do not specify a vlan, igmp statistics are ...

  • Page 423

    Display igmp 423 router information: port mrouter-ipaddr mrouter-mac type ttl ---- --------------- ----------------- ----- ----- 1 192.28.7.5 00:01:02:03:04:05 dvmrp 17 group port receiver-ip receiver-mac ttl --------------- ---- --------------- ----------------- ----- 224.0.0.2 none none none undef...

  • Page 424

    424 c hapter 13: igmp s nooping c ommands table 75 output for display igmp field description vlan vlan name. Mss displays information separately for each vlan. Igmp is enabled (disabled) igmp state. Proxy reporting proxy reporting state. Mrouter solicitation multicast router solicitation state. Quer...

  • Page 425

    Display igmp 425 ttl number of seconds before this entry ages out if not refreshed. For static multicast router entries, the time-to-live (ttl) value is undef. Static multicast router entries do not age out. Group ip address of a multicast group. The display igmp receiver-table command shows the sam...

  • Page 426

    426 c hapter 13: igmp s nooping c ommands see also display igmp mrouter on page 426 display igmp querier on page 427 display igmp receiver-table on page 429 display igmp statistics on page 431 display igmp mrouter displays the multicast routers in a wx’s subnet, on one vlan or all vlans. Routers are...

  • Page 427

    Display igmp querier 427 see also display igmp mrouter on page 426 set igmp mrouter on page 435 display igmp querier shows information about the active multicast querier, on one vlan or all vlans. Queriers are listed separately for each vlan. Each vlan can have only one querier. Syntax — display igm...

  • Page 428

    428 c hapter 13: igmp s nooping c ommands history — introduced in mss version 3.0. Examples — the following command displays querier information for vlan orange: wx1200# display igmp querier vlan orange querier for vlan orange port querier-ip querier-mac ttl ---- --------------- ----------------- --...

  • Page 429

    Display igmp receiver-table 429 see also set igmp querier on page 441 display igmp receiver-table displays the receivers to which a wx forwards multicast traffic. You can display receivers for all vlans, a single vlan, or a group or groups identified by group address and network mask. Syntax — displ...

  • Page 430

    430 c hapter 13: igmp s nooping c ommands the following command lists all receivers for multicast groups 237.255.255.1 through 237.255.255.255, in all vlans: wx1200# display igmp receiver-table group 237.255.255.0/24 vlan: red session port receiver-ip receiver-mac ttl --------------- ---- ----------...

  • Page 431

    Display igmp statistics 431 display igmp statistics shows igmp statistics. Syntax — display igmp statistics [vlan vlan-id] vlan vlan-id — vlan name or number. If you do not specify a vlan, mss displays igmp statistics for all vlans. Defaults — none. Access — all. History — introduced in mss version ...

  • Page 432

    432 c hapter 13: igmp s nooping c ommands table 79 output of display igmp statistics field description igmp statistics for vlan vlan name. Statistics are listed separately for each vlan. Igmp message type type of igmp message: general-queries — general group membership queries sent by the multicast ...

  • Page 434

    434 c hapter 13: igmp s nooping c ommands set igmp lmqi changes the igmp last member query interval timer on one vlan or all vlans on a wireless lan switch. Syntax — set igmp lmqi tenth-seconds[vlan vlan-id] lmqi tenth-seconds —amount of time (in tenths of a second) that the wx waits for a response ...

  • Page 437

    Set igmp oqi 437 usage — you cannot add map access ports or wired authentication ports as static multicast ports. However, mss can dynamically add these port types to the list of multicast ports based on multicast traffic. Examples — the following example changes the multicast router solicitation in...

  • Page 438

    438 c hapter 13: igmp s nooping c ommands see also set igmp lmqi on page 434 set igmp qi on page 439 set igmp qri on page 440 set igmp querier on page 441 set igmp mrouter on page 435 set igmp rv on page 442 set igmp proxy-report disables or reenables proxy reporting by a wx on one vlan or all vlans...

  • Page 439

    Set igmp qi 439 set igmp qi changes the igmp query interval timer on one vlan or all vlans on a wx. Syntax — set igmp qi seconds[vlan vlan-id] qi seconds — number of seconds that elapse between general queries sent by the wx when the wx switch is the querier for the subnet. You can specify a value f...

  • Page 440

    440 c hapter 13: igmp s nooping c ommands set igmp qri changes the igmp query response interval timer on one vlan or all vlans on a wx. Syntax — set igmp qri tenth-seconds[vlan vlan-id] qri tenth-seconds — amount of time (in tenths of a second) that the wx waits for a receiver to respond to a group-...

  • Page 442

    442 c hapter 13: igmp s nooping c ommands defaults — by default, no ports are static multicast receiver ports. Access — enabled. History — introduced in mss version 3.0. Usage — you cannot add map access ports or wired authentication ports as static multicast ports. However, mss can dynamically add ...

  • Page 443

    Set igmp rv 443 see also set igmp oqi on page 437 set igmp qi on page 439 set igmp qri on page 440

  • Page 444

    444 c hapter 13: igmp s nooping c ommands.

  • Page 445: Ecurity

    14 s ecurity acl c ommands use security acl commands to configure and monitor security access control lists (acls). Security acls filter packets to restrict or permit network usage by certain users or traffic types, and can assign to packets a class of service (cos) to define the priority of treatme...

  • Page 446

    446 c hapter 14: s ecurity acl c ommands clear security acl clears a specified security acl, an access control entry (ace), or all security acls, from the edit buffer. When used with the command commit security acl, clears the ace from the running configuration. Syntax — clear security acl {acl-name...

  • Page 447

    Clear security acl map 447 wx4400# display security acl info all acl information for all set security acl ip acl_133 (hits #1 0) --------------------------------------------------------- 1. Deny ip source ip 192.168.1.6 0.0.0.0 destination ip any set security acl ip acl_134 (hits #3 0) -------------...

  • Page 449

    Commit security acl 449 to clear all physical ports, virtual ports, and vlans on a wx switch of the acls mapped for incoming and outgoing traffic, type the following command: wx4400# clear security acl map all success: change accepted. See also clear security acl on page 446 display security acl map...

  • Page 450

    450 c hapter 14: s ecurity acl c ommands examples — the following commands commit all the security acls in the edit buffer to the configuration, display a summary of the committed acls, and show that the edit buffer has been cleared: wx4400# commit security acl all configuration accepted wx4400# dis...

  • Page 451

    Display security acl hits 451 examples — to display a summary of the committed security acls on a wx switch, type the following command: wx4400# display security acl acl table acl type class mapping ---------------------------- ---- ------ ------- acl_123 ip static port 2 in acl_133 ip static port 4...

  • Page 452

    452 c hapter 14: s ecurity acl c ommands examples — to display the security acl hits on a wx switch, type the following command: wx4400# display security acl hits acl hit-counters index counter acl-name ----- -------------------- -------- 1 0 acl_2 2 0 acl_175 3 916 acl_123 see also set security acl...

  • Page 453

    Display security acl map 453 examples — to display the contents of all security acls committed on a wx switch, type the following command: wx4400# display security acl info acl information for all set security acl ip acl_123 (hits #5 462) --------------------------------------------------------- 1. ...

  • Page 454

    454 c hapter 14: s ecurity acl c ommands access — enabled. History — introduced in mss version 3.0. Examples — the following command displays the port to which security acl acl_111 is mapped: wx4400# display security acl map acl_111 acl acl_111 is mapped to: port 4 in see also clear security acl map...

  • Page 455

    Display security acl resource-usage 455 examples — to display security acl resource usage, type the following command: wx4400# display security acl resource-usage acl resources classifier tree counters ------------------------ number of rules : 2 number of leaf nodes : 1 stored rule count : 2 leaf c...

  • Page 456

    456 c hapter 14: s ecurity acl c ommands table 81 output of display security acl resource-usage field description number of rules number of security aces currently mapped to ports or vlans. Number of leaf nodes number of security acl data entries stored in the rule tree. Stored rule count number of ...

  • Page 457

    Display security acl resource-usage 457 ludef in use number of the lookup definition (ludef) table currently in use for packet handling. Default action pointer memory address used for packet handling, from which default action data is obtained when necessary. L4 global security acl mapping on the wx...

  • Page 458

    458 c hapter 14: s ecurity acl c ommands rollback security acl clears changes made to the security acl edit buffer since it was last saved. The acl is rolled back to its state after the last commit security acl command was entered. All uncommitted acls in the edit buffer are cleared. Syntax — rollba...

  • Page 459

    Set security acl 459 examples — the following commands show the edit buffer before a rollback, clear any changes in the edit buffer to security acl_122, and show the edit buffer after the rollback: wx4400# display security acl info all editbuffer acl edit-buffer information for all set security acl ...

  • Page 461

    Set security acl 461 0 or 3—best effort. Packets are queued in map forwarding queue 3. 4 or 5—video. Packets are queued in map forwarding queue 2. Use cos level 4 or 5 for voice over ip (voip) packets other than spectralink voice priority (svp). 6 or 7—voice. Packets are queued in map forwarding que...

  • Page 462

    462 c hapter 14: s ecurity acl c ommands (for a complete list of tcp and udp port numbers, see www.Iana.Org/assignments/port-numbers .) destination-ip-addr mask — ip address and wildcard mask of the network or host to which the packet is being sent. Specify both address and mask in dotted decimal no...

  • Page 463

    Set security acl 463 before editbuffer-index — inserts the new ace in front of another ace in the security acl. Specify the number of the existing ace in the edit buffer. Index numbers start at 1. (to display the edit buffer, use display security acl editbuffer.) modify editbuffer-index — replaces a...

  • Page 464

    464 c hapter 14: s ecurity acl c ommands the following command adds an ace to acl_123 that denies packets from ip address 192.168.2.11: wx4400# set security acl ip acl_123 deny 192.168.2.11 0.0.0.0 the following command creates acl_125 by defining an ace that denies tcp packets from source ip addres...

  • Page 466

    466 c hapter 14: s ecurity acl c ommands see also clear security acl map on page 447 commit security acl on page 449 set mac-user attr on page 249 set mac-usergroup attr on page 254 set security acl on page 459 set user attr on page 259 set usergroup on page 261 display security acl map on page 453 ...

  • Page 467

    Set security acl hit-sample-rate 467 examples — the first command sets mss to sample acl hits every 15 seconds. The second and third commands display the results. The results show that 916 packets matching security acl_153 were sent since the acl was mapped. Wx4400# set security acl hit-sample-rate ...

  • Page 468

    468 c hapter 14: s ecurity acl c ommands.

  • Page 469: Ryptography

    15 c ryptography c ommands use cryptography commands to configure and manage certificates and public-private key pairs for system authentication. Depending on your network configuration, you must create keys and certificates to authenticate the wx switch to ieee 802.1x wireless clients for which the...

  • Page 471

    Crypto certificate 471 to use this command, you must already have obtained a copy of the certificate authority’s certificate as a pkcs #7 object file. Then do the following: 1 open the pkcs #7 object file with an ascii text editor such as notepad or vi. 2 enter the crypto ca-certificate command on t...

  • Page 472

    472 c hapter 15: c ryptography c ommands pem-formatted certificate — ascii text representation of the pkcs #7 certificate, consisting of up to 5120 characters, that you have obtained from the certificate authority. Defaults — none. Access — enabled. History —introduced in mss version 3.0. Webaaa opt...

  • Page 474

    474 c hapter 15: c ryptography c ommands see also display crypto key ssh on page 483 crypto generate request generates a certificate signing request (csr). This command outputs a pem-formatted pkcs #10 text string that you can cut and paste to another location for delivery to a certificate authority...

  • Page 475

    Crypto generate request 475 email address string — (optional) specify your email address, in up to 80 alphanumeric characters with no spaces. Unstructured name string — (optional) specify any name, in up to 80 alphanumeric characters with no spaces. Defaults — none. Access — enabled. History —introd...

  • Page 476

    476 c hapter 15: c ryptography c ommands hkig9w0baqefaaobjqawgykcgyea1zatpystojhma0qjmwhezppfgq9kbeimjkpg bznfjac780gcztnjpgqnmnokj/4ndknont6ndcd2fbdgbuefgnmngzmykgcv2jiu m32svpseoenmyuidkezqlqol621vh67rm1ktmecm6ucbbroq6xnypihn1gtrrpl/ lhygtwucaweaaaaama0gcsqgsib3dqebbauaa4gbahk5z2kfjbbv/f0b0myc5s7k...

  • Page 477

    Crypto generate self-signed 477 organizational unit string — (optional) specify the name of the organizational unit, in up to 80 alphanumeric characters with no spaces. Common name string — specify a unique name for the wx switch, in up to 80 alphanumeric characters with no spaces. Use a fully quali...

  • Page 479

    Crypto pkcs12 479 history —introduced in mss version 3.0. Webaaa option renamed to web in mss version 4.1. Usage — the password allows the public-private key pair and certificate to be installed together from the same pkcs #12 object file. Mss erases the one-time password after processing the crypto...

  • Page 480

    480 c hapter 15: c ryptography c ommands defaults — the password you enter with the crypto otp command must be the same as the one protecting the pkcs #12 file. Access — enabled. History —introduced in mss version 3.0. Webaaa option renamed to web in mss version 4.1. Usage — to use this command, you...

  • Page 483

    Display crypto key ssh 483 see also crypto generate self-signed on page 476 display crypto ca-certificate on page 481 display crypto key ssh displays ssh authentication key information. This command displays the checksum (also called a fingerprint) of the public ssh authentication key. When you conn...

  • Page 484

    484 c hapter 15: c ryptography c ommands.

  • Page 485: Radius

    16 radius and s erver g roup c ommands use radius commands to set up communication between a wx switch and groups of up to four radius servers for remote authentication, authorization, and accounting (aaa) of administrators and network users. Commands by usage this chapter presents radius commands a...

  • Page 487

    Clear radius client system-ip 487 wx4400# clear radius timeout success: change accepted. See also set radius on page 490 set radius server on page 494 display aaa on page 219 clear radius client system-ip removes the wx switch’s system ip address from use as the permanent source address in radius cl...

  • Page 488

    488 c hapter 16: radius and s erver g roup c ommands clear radius proxy client removes radius proxy client entries for third-party aps. Syntax — clear radius proxy client all defaults — none. Access — enabled. History —introduced in mss 4.0. Examples — the following command clears all radius proxy c...

  • Page 489

    Clear radius server 489 clear radius server removes the named radius server from the wx configuration. Syntax — clear radius server server-name server-name —name of a radius server configured to perform remote aaa services for the wx switch. Defaults — none. Access — enabled. History —introduced in ...

  • Page 490

    490 c hapter 16: radius and s erver g roup c ommands examples — to remove the server group sg-77 type the following command: wx4400# clear server group sg-77 success: change accepted. To disable load balancing in a server group shorebirds, type the following command: wx4400# set server group shorebi...

  • Page 491

    Set radius client system-ip 491 retransmit — 3 (the total number of attempts, including the first attempt) timeout — 5 seconds access — enabled. History —introduced in mss version 3.0. Usage — you can specify only one parameter per command line. Examples — the following commands sets the dead time t...

  • Page 492

    492 c hapter 16: radius and s erver g roup c ommands usage — the wx system ip address must be set before you use this command. Examples — the following command sets the wx system ip address as the address of the radius client: wx4400# set radius client system-ip success: change accepted. See also cl...

  • Page 493

    Set radius proxy port 493 examples — the following command configures a radius proxy entry for a third-party ap radius client at 10.20.20.9, sending radius traffic to the default udp ports 1812 and 1813 on the wx: wx4400# set radius proxy client address 10.20.20.9 key radkey1 success: change accepte...

  • Page 494

    494 c hapter 16: radius and s erver g roup c ommands examples — the following command maps ssid mycorp to packets received on port 3 or 4, using 802.1q tag value 104: wx4400# set radius proxy port 3-4 tag 104 ssid mycorp success: change accepted. See also clear radius proxy port on page 488 set auth...

  • Page 495

    Set radius server 495 key string — password (shared secret key) the wx switch uses to authenticate to the radius server. You must provide the same password that is defined on the radius server. The password can be 1 to 32 characters long, with no spaces or tabs. Author-password password — password u...

  • Page 496

    496 c hapter 16: radius and s erver g roup c ommands examples — to set a radius server named rs42 with ip address 198.162.1.1 to use the default accounting and authorization ports with a timeout interval of 30 seconds, two transmit attempts, 5 minutes of dead time, and a key string of keys4u, type t...

  • Page 497

    Set server group load-balance 497 do not use the same name for a radius server and a radius server group. Examples — to set server group shorebirds with members heron, egret, and sandpiper, type the following command: wx1200# set server group shorebirds members heron egret sandpiper success: change ...

  • Page 498

    498 c hapter 16: radius and s erver g roup c ommands examples — to enable load balancing between the members of server group shorebirds, type the following command: wx1200# set server group shorebirds load-balance enable success: change accepted. To disable load balancing between shorebirds server g...

  • Page 499: 802.1X M

    17 802.1x m anagement c ommands use 802. Ieee x management commands to modify the default settings for ieee 802.1x sessions on an wx switch. For best results, change the settings only if you are aware of a problem with the wx switch’s 802.1x performance. Caution: 802.1x parameter settings are global...

  • Page 500

    500 c hapter 17: 802.1x m anagement c ommands clear dot1x bonded-period resets the bonded auth™ (bonded authentication) period to its default value. The bonded period is the number of seconds mss retains session information for an authenticated machine while waiting for an 802.1x client on the machi...

  • Page 501

    Clear dot1x max-req 501 see also display dot1x on page 505 set dot1x bonded-period on page 509 clear dot1x max-req resets to the default setting the number of extensible authentication protocol (eap) requests that the wx switch retransmits to a supplicant (client). Syntax — clear dot1x max-req defau...

  • Page 502

    502 c hapter 17: 802.1x m anagement c ommands usage — this command is overridden by the set dot1x authcontrol command. The clear dot1x port-control command returns port control to the method configured. This command applies only to wired authentication ports. Examples — type the following command to...

  • Page 503

    Clear dot1x reauth-max 503 clear dot1x reauth-max resets the maximum number of reauthorization attempts to the default setting. Syntax — clear dot1x reauth-max defaults — the default is 2 attempts. Access — enabled. History —introduced in mss version 3.0. Examples — type the following command to res...

  • Page 504

    504 c hapter 17: 802.1x m anagement c ommands clear dot1x timeout auth-server resets to the default setting the number of seconds that must elapse before the wx times out a request to a radius server. Syntax — clear dot1x timeout auth-server defaults — the default is 30 seconds. Access — enabled. Hi...

  • Page 505

    Clear dot1x tx-period 505 clear dot1x tx-period resets to the default setting the number of seconds that must elapse before the wx switch retransmits an eap over lan (eapol) packet. Syntax — clear dot1x tx-period defaults — the default is 5 seconds. Access — enabled. History —introduced in mss versi...

  • Page 506

    506 c hapter 17: 802.1x m anagement c ommands history —introduced in mss version 3.0. Format of 802.1x authentication rule information in display dot1x config output changed in mss version 3.2. The rules are still listed at the top of the display, but more information is shown for each rule. Example...

  • Page 507

    Display dot1x 507 802.1x parameter setting ---------------- ------- supplicant timeout 30 auth-server timeout 30 quiet period 5 transmit period 5 reauthentication period 3600 maximum requests 2 key transmission enabled reauthentication enabled authentication control enabled wep rekey period 1800 wep...

  • Page 509

    Set dot1x bonded-period 509 defaults — by default, authentication control for individual wired authentication is enabled. Access — enabled. History —introduced in mss version 3.0. Usage — this command applies only to wired authentication ports. Examples — to enable per-port 802.1x authentication on ...

  • Page 510

    510 c hapter 17: 802.1x m anagement c ommands usage — normally, the bonded auth period needs to be set only if the network has bonded auth clients that use dynamic wep, or use wep-40 or wep-104 encryption with wpa or rsn. These clients can be affected by the 802.1x reauthentication parameter or the ...

  • Page 511

    Set dot1x max-req 511 examples — type the following command to enable key transmission: wx4400# set dot1x key-tx enable success: dot1x key transmission enabled. See also display dot1x on page 505 set dot1x max-req sets the maximum number of times the wx retransmits an eap request to a supplicant (cl...

  • Page 513

    Set dot1x quiet-period 513 set dot1x quiet-period sets the number of seconds a wx remains quiet and does not respond to a supplicant after a failed authentication. Syntax — set dot1x quiet-period seconds seconds —specify a value between 0 and 65,535. Defaults — the default is 60 seconds. Access — en...

  • Page 514

    514 c hapter 17: 802.1x m anagement c ommands see also display dot1x on page 505 set dot1x reauth-max on page 514 set dot1x reauth-period on page 515 set dot1x reauth-max sets the number of reauthentication attempts that the wx switch makes before the supplicant (client) becomes unauthorized. Syntax...

  • Page 515

    Set dot1x reauth-period 515 set dot1x reauth-period sets the number of seconds that must elapse before the wx switch attempts reauthentication. Syntax — set dot1x reauth-period seconds seconds —specify a value between 60 (1 minute) and 1,641,600 (19 days). Defaults — the default is 3600 seconds (1 h...

  • Page 516

    516 c hapter 17: 802.1x m anagement c ommands see also display dot1x on page 505 clear dot1x timeout auth-server on page 504 set dot1x timeout supplicant sets the number of seconds that must elapse before the wx switch times out an authentication session with a supplicant (client). Syntax — set dot1...

  • Page 517

    Set dot1x wep-rekey 517 examples — type the following command to set the number of seconds before the wx switch retransmits an eapol packet to 300: wx4400# set dot1x tx-period 300 success: dot1x tx-period set to 300. See also display dot1x on page 505 clear dot1x tx-period on page 505 set dot1x wep-...

  • Page 518

    518 c hapter 17: 802.1x m anagement c ommands set dot1x wep-rekey-period sets the interval for rotating the wep broadcast and multicast keys. Syntax — set dot1x wep-rekey-period seconds seconds —specify a value between 30 and 1,641,600 (19 days). Defaults — the default is 1800 seconds (30 minutes). ...

  • Page 519: Ession

    18 s ession m anagement c ommands use session management commands to display and clear administrative and network user sessions. Commands by usage this chapter presents session management commands alphabetically. Use table 88 to locate commands in this chapter based on their use. Clear sessions clea...

  • Page 522

    522 c hapter 18: s ession m anagement c ommands examples — to clear all sessions for mac address 00:01:02:03:04:05, type the following command: wx4400# clear sessions network mac-addr 00:01:02:03:04:05 to clear session 9, type the following command: wx1200# clear sessions network session-id 9 sm apr...

  • Page 523

    Display sessions 523 telnet — displays sessions for all users with administrative access to the wx switch through a telnet connection. Telnet client — displays telnet sessions from the cli to remote devices. Defaults — none. Access — all, except for display sessions telnet client, which has enabled ...

  • Page 524

    524 c hapter 18: s ession m anagement c ommands to view information about telnet client sessions, type the following command: wx4400# display sessions telnet client session server address server port client port ------- -------------- ------------ ----------- 0 192.168.1.81 23 48000 1 10.10.1.22 23 ...

  • Page 525

    Display sessions network 525 display sessions network displays summary or verbose information about all network sessions, or network sessions for a specified username or set of usernames, mac address or set of mac addresses, vlan or set of vlans, or session id. Syntax — display sessions network [use...

  • Page 526

    526 c hapter 18: s ession m anagement c ommands history —introduced in mss version 3.0. Output added to the display network sessions verbose command to indicate the user’s authorization attributes and whether they were supplied through aaa or through configured ssid defaults in a service profile in ...

  • Page 527

    Display sessions network 527 example\singh 12* 10.10.10.30 vlan-eng 3/2 example\havel 13* 10.10.10.40 vlan-eng 1/2 2 sessions match criteria (of 3 total) (table 91 on page 528 describes the summary displays of display sessions network commands.) the following command displays detailed (verbose) sess...

  • Page 528

    528 c hapter 18: s ession m anagement c ommands (table 92 on page 529 describes the additional fields of the verbose output of display sessions network commands.) the following command displays information about network session 27: wx1200# display sessions network session-id 27 global id: sess-27-00...

  • Page 529

    Display sessions network 529 table 92 additional display sessions network verbose output field description client mac mac address of the session user. Gid global session id, a unique session number within a mobility domain. State status of the session: auth, assoc req — client is being associated by...

  • Page 530

    530 c hapter 18: s ession m anagement c ommands table 93 display sessions network session-id output field description global id a unique session identifier within the mobility domain. State status of the session: auth, assoc req — client is being associated by the 802.1x protocol. Auth and assoc — c...

  • Page 531

    Display sessions network 531 see also clear sessions network on page 521 session timeout assigned session timeout in seconds. Authentication method extensible authentication protocol (eap) type used to authenticate the session user, and the ip address of the authentication server. Session statistics...

  • Page 532

    532 c hapter 18: s ession m anagement c ommands.

  • Page 533: Rf D

    19 rf d etection c ommands mss automatically performs rf detection scans on enabled and disabled radios to detect rogue access points. A rogue access point is a bssid (mac address associated with an ssid) that does not belong to a 3com switch and is not a member of the ignore list configured on the ...

  • Page 534

    534 c hapter 19: rf d etection c ommands clear rfdetect attack-list removes a mac address from the attack list. Syntax — clear rfdetect attack-list mac-addr mac-addr — mac address you want to remove from the attack list. Defaults — none. Access — enabled. History —introduced in mss version 4.0. Exam...

  • Page 535

    Clear rfdetect black-list 535 see also clear rfdetect attack-list on page 534 display rfdetect attack-list on page 537 clear rfdetect black-list removes a mac address from the client black list. Syntax — clear rfdetect black-list mac-addr mac-addr — mac address you want to remove from the black list...

  • Page 536

    536 c hapter 19: rf d etection c ommands examples — the following command removes bssid aa:bb:cc:11:22:33 from the ignore list for rf scans: wx1200# clear rfdetect ignore aa:bb:cc:11:22:33 success: aa:bb:cc:11:22:33 is no longer ignored. See also display rfdetect ignore on page 546 set rfdetect igno...

  • Page 538

    538 c hapter 19: rf d etection c ommands examples — the following example shows the attack list on wx switch: wx1200# display rfdetect attack-list total number of entries: 1 attacklist mac port/radio/chan rssi ssid ----------------- ----------------- ------ ------------ 11:22:33:44:55:66 dap 2/1/11 ...

  • Page 539

    Display rfdetect clients 539 display rfdetect clients displays the wireless clients detected by a wx switch. Syntax — display rfdetect clients [mac mac-addr] mac mac-addr — displays detailed information for a specific client. Defaults — none. Access — enabled. History —introduced in mss version 4.0....

  • Page 540

    540 c hapter 19: rf d etection c ommands table 95 display rfdetect clients output field description client mac mac address of the client. Client vendor company that manufactures or sells the client. Ap mac mac address of the radio with which the rogue client is associated. Ap vendor company that man...

  • Page 541

    Display rfdetect countermeasures 541 display rfdetect countermeasures displays the current status of countermeasures against rogues in the mobility domain. Syntax — display rfdetect countermeasures defaults — none. Access — enabled. History —output no longer lists rogues for which countermeasures ha...

  • Page 542

    542 c hapter 19: rf d etection c ommands table 97 describes the fields in this display. See also set radio-profile countermeasures on page 355 display rfdetect counters displays statistics for rogue and intrusion detection system (ids) activity detected by the maps managed by a wx switch. Syntax — d...

  • Page 543

    Display rfdetect counters 543 examples — the following command shows counters for rogue activity detected by a wx switch: wx4400# display rfdetect counters type current total -------------------------------------------------- ------------ ------------ rogue access points 0 0 interfering access point...

  • Page 544

    544 c hapter 19: rf d etection c ommands display rfdetect data displays all the bssids detected by an individual wx switch during an rf detection scan. The data includes bssids transmitted by other 3com radios as well as by third-party access points. Syntax — display rfdetect data defaults — none. A...

  • Page 545

    Display rfdetect data 545 see also display rfdetect mobility-domain on page 546 display rfdetect visible on page 552 table 98 display rfdetect data output field description bssid bssid detected by a map radio on this wx switch. Vendor company that manufactures or sells the rogue device. Type classif...

  • Page 546

    546 c hapter 19: rf d etection c ommands display rfdetect ignore displays the bssids of third-party devices that mss ignores during rf scans. Mss does not generate log messages or traps for the devices in the ignore list. Syntax — display rfdetect ignore defaults — none. Access — enabled. History —i...

  • Page 547

    Display rfdetect mobility-domain 547 usage — this command is valid only on the seed switch of the mobility domain. To display rogue information for an individual switch, use the display rfdetect data command on that switch. Only rogues are listed. To display all devices detected, including 3com radi...

  • Page 548

    548 c hapter 19: rf d etection c ommands bssid: 00:0b:0e:00:7a:8a vendor: 3com ssid: 3com-webaaa type: intfr adhoc: no crypto-types: clear wx-ipaddress: 10.8.121.102 port/radio/ch: 3/1/1 mac: 00:0b:0e:00:0a:6a device-type: interfering adhoc: no crypto-types: clear rssi: -75 ssid: 3com-webaaa wx-ipad...

  • Page 549

    Display rfdetect mobility-domain 549 table 99 display rfdetect mobility-domain output field description bssid mac address of the ssid used by the detected device. Vendor company that manufactures or sells the rogue device. Type classification of the rogue device: rogue—wireless device that is not su...

  • Page 550

    550 c hapter 19: rf d etection c ommands see also display rfdetect data on page 544 display rfdetect visible on page 552 display rfdetect ssid-list displays the entries in the permitted ssid list. Syntax — display rfdetect ssid-list defaults — none. Access — enabled. History —introduced in mss versi...

  • Page 551

    Display rfdetect vendor-list 551 examples — the following example shows the permitted ssid list on wx switch: wx4400# display rfdetect ssid-list total number of entries: 3 ssid ----------------- mycorp corporate guest see also clear rfdetect ssid-list on page 536 set rfdetect ssid-list on page 560 d...

  • Page 552

    552 c hapter 19: rf d etection c ommands display rfdetect visible displays the bssids discovered by a specific 3com radio. The data includes bssids transmitted by other 3com radios as well as by third-party access points. Syntax — display rfdetect visible mac-addr syntax — display rfdetect visible a...

  • Page 553

    Display rfdetect visible 553 ----------------- ------- ----- --- ---- ------ -------------------------------- 00:07:50:d5:cc:91 cisco intfr 6 -60 i----w r27-cisco1200-2 00:07:50:d5:dc:78 cisco intfr 6 -82 i----w r116-cisco1200-2 00:09:b7:7b:8a:54 cisco intfr 2 -54 i----- 00:0a:5e:4b:4a:c0 3com intfr...

  • Page 554

    554 c hapter 19: rf d etection c ommands set rfdetect active-scan disables or reenables active rf detection scanning on a wx switch. When active scanning is enabled, the map radios managed by the switch look for rogue devices by sending probe any requests (probe requests with a null ssid name), to s...

  • Page 555

    Set rfdetect black-list 555 when on-demand countermeasures are enabled (with the set radio-profile countermeasures configured command) only those devices configured in the attack list are subject to countermeasures. In this case, devices found to be rogues by other means, such as policy violations o...

  • Page 556

    556 c hapter 19: rf d etection c ommands examples — the following command adds client mac address 11:22:33:44:55:66 to the black list: wx1200# set rfdetect black-list 11:22:33:44:55:66 success: mac 11:22:33:44:55:66 is now blacklisted. See also set rfdetect black-list on page 555 display rfdetect bl...

  • Page 557

    Set rfdetect countermeasures mac 557 set rfdetect countermeasures mac starts countermeasures against a specific rogue. Syntax — set rfdetect countermeasures mac mac-addr mac-addr —basic service set identifier (bssid) of the rogue. Enter the bssid in mac address format, using a colon between each oct...

  • Page 558

    558 c hapter 19: rf d etection c ommands see also clear rfdetect attack-list on page 534 display rfdetect ignore on page 546 set rf detect countermeasures on page 556 set rfdetect ignore configures a list of known devices to ignore during an rf scan. Mss does not generate log messages or traps for t...

  • Page 559

    Set rfdetect log 559 examples — the following command configures mss to ignore bssid aa:bb:cc:11:22:33 during rf scans: wx1200# set rfdetect ignore aa:bb:cc:11:22:33 success: mac aa:bb:cc:11:22:33 is now ignored. See also clear rfdetect ignore on page 535 display rfdetect ignore on page 546 set rfde...

  • Page 560

    560 c hapter 19: rf d etection c ommands set rfdetect signature enables map signatures. A map signature is a set of bits in a management frame sent by a map that identifies that map to mss. If someone attempts to spoof management packets from a 3com map, mss can detect the spoof attempt. Syntax — se...

  • Page 561

    Set rfdetect vendor-list 561 defaults — the permitted ssid list is empty by default and all ssids are allowed. However, after you add an entry to the list, mss allows traffic only for the ssids that are on the list. Access — enabled. History —introduced in mss version 4.0. Usage — the permitted ssid...

  • Page 562

    562 c hapter 19: rf d etection c ommands defaults — the permitted vendor list is empty by default and all vendors are allowed. However, after you add an entry to the list, mss allows only the devices whose ouis are on the list. Access — enabled. History —introduced in mss version 4.0. Usage — the pe...

  • Page 563: Ile

    20 f ile m anagement c ommands use file management commands to manage system files and to display software and boot information. Commands by usage this chapter presents file management commands alphabetically. Use table 102 to locate commands in this chapter based on their use. Table 102 file manage...

  • Page 565

    Backup 565 the backup command places the boot configuration file into the archive. (the boot configuration file is the configured boot configuration in the display boot command’s output.) if the running configuration contains changes that have not been saved, these changes are not in the boot config...

  • Page 566

    566 c hapter 20: f ile m anagement c ommands clear boot backup-configuration clears the filename specified as the backup configuration file. In the event that mss cannot read the configuration file at boot time, a backup configuration file is not used. Syntax — clear boot backup-configuration defaul...

  • Page 567

    Copy 567 wx4400# reset system force ...... Rebooting ...... See also display config on page 574 reset system on page 582 copy performs the following copy operations: copies a file from a tftp server to nonvolatile storage. Copies a file from nonvolatile storage or temporary storage to a tftp server....

  • Page 568

    568 c hapter 20: f ile m anagement c ommands defaults — none. Access — enabled. History —introduced in mss version 3.0. Usage — the filename and file:filename urls are equivalent. You can use either url to refer to a file in an wx switch’s nonvolatile memory. The tftp://ip-addr/filename url refers t...

  • Page 569

    Delete 569 the following commands rename test-config to new-config by copying it from one name to the other in the same location, then deleting test-config: wx4400# copy test-config new-config wx4400# delete test-config success: file deleted. The following command copies file corpa-login.Html from a...

  • Page 570

    570 c hapter 20: f ile m anagement c ommands examples — the following commands copy file testconfig to a tftp server and delete the file from nonvolatile storage: wx4400# copy testconfig tftp://10.1.1.1/testconfig success: sent 365 bytes in 0.401 seconds [ 910 bytes/sec] wx4400# delete testconfig su...

  • Page 571

    Dir 571 examples — the following command displays the files in the root directory: wx4400# dir =============================================================================== file: filename size created file:configuration 48 kb jul 12 2005, 15:02:32 file:corp2:corp2cnfig 17 kb mar 14 2005, 22:20:04 ...

  • Page 572

    572 c hapter 20: f ile m anagement c ommands the following command limits the output to the contents of the user files area: wx4400# dir file: =============================================================================== file: filename size created file:configuration 48 kb jul 12 2005, 15:02:32 fi...

  • Page 573

    Display boot 573 see also copy on page 567 delete on page 569 display boot displays the system image and configuration filenames used after the last reboot and configured for use after the next reboot. Syntax — display boot defaults — none. Access — access. History —introduced in mss version 3.0. Ne...

  • Page 574

    574 c hapter 20: f ile m anagement c ommands booted configuration: file:configuration product model: wx table 105 describes the fields in the display boot output. See also display version on page 576 reset system on page 582 set boot configuration-file on page 586 display config displays the configu...

  • Page 575

    Display config 575 httpd ip ip-config log mobility-domain ntp portconfig portgroup radio-profile rfdetect service-profile sm snmp snoop spantree system trace vlan vlan-fdb if you do not specify a configuration area, nondefault information for all areas is displayed. All — includes configuration item...

  • Page 576

    576 c hapter 20: f ile m anagement c ommands examples — the following command shows configuration information for vlans: wx4400# display config area vlan # configuration nvgen'd at 2004-5-21 19:36:48 # image 3.0.0 # model wx4400 # last change occurred at 2004-5-21 18:20:50 set vlan 1 port 1 see also...

  • Page 577

    Display version 577 flash: 4.1.0.14 - md0a kernel: 3.0.0#20: fri may 20 17:43:51 pdt 2005 bootloader: 4.10 / 4.1.0 the following command displays additional software build information and map access point information: wx1200# display version details mobility system software, version: 4.1.0 qa 67 cop...

  • Page 578

    578 c hapter 20: f ile m anagement c ommands see also display boot on page 573 load config loads configuration commands from a file and replaces the wx switch’s running configuration with the commands in the loaded file. Caution: this command completely removes the running configuration and replaces...

  • Page 579

    Load config 579 if you do not specify a filename, mss uses the same configuration filename that was used for the previous configuration load. For example, if the wx switch used configuration for the most recent configuration load, mss uses configuration again unless you specify a different filename....

  • Page 581

    Mkdir 581 examples — the following commands create a subdirectory called corp2 and display the root directory to verify the result: wx4400# mkdir corp2 success: change accepted. Wx4400# dir =============================================================================== file: filename size created fi...

  • Page 582

    582 c hapter 20: f ile m anagement c ommands reset system restarts an wx switch and reboots the software. Syntax — reset system [force] force — immediately restarts the system and reboots, without comparing the running configuration to the configuration file. Defaults — none. Access — enabled. Histo...

  • Page 584

    584 c hapter 20: f ile m anagement c ommands see also backup on page 564 rmdir removes a subdirectory from nonvolatile storage. Syntax — rmdir [subdirname] subdirname — subdirectory name. Specify between 1 and 32 alphanumeric characters, with no spaces. Defaults — none. Access — enabled. History —in...

  • Page 585

    Set boot backup-configuration 585 access — enabled. History —introduced in mss version 3.0. Usage — if you do not specify a filename, mss replaces the configuration file loaded during the most recent reboot. To display the filename of the configuration file mss loaded during the most recent reboot, ...

  • Page 586

    586 c hapter 20: f ile m anagement c ommands history —introduced in mss version 4.1. Examples — the following command specifies a file called backup.Cfg as the backup configuration file on the wx switch: wx1200# set boot backup-configuration backup.Cfg success: backup boot config filename set. See a...

  • Page 588

    588 c hapter 20: f ile m anagement c ommands.

  • Page 589: Race

    21 t race c ommands use trace commands to perform diagnostic routines. While mss allows you to run many types of traces, this chapter describes commands for those traces you are most likely to use. For a complete listing of the types of traces mss allows, type the set trace ? Command. Caution: using...

  • Page 590

    590 c hapter 21: t race c ommands clear log trace deletes the log messages stored in the trace buffer. Syntax — clear log trace defaults — none. Access — enabled. History —introduced in mss version 3.0. Examples — to delete the trace log, type the following command: wx4400# clear log trace see also ...

  • Page 591

    Display trace 591 to clear the session manager trace, type the following command: wx4400# clear trace sm success: clear trace sm see also display trace on page 591 set trace authentication on page 592 set trace authorization on page 593 set trace dot1x on page 594 set trace sm on page 595 display tr...

  • Page 592

    592 c hapter 21: t race c ommands save trace saves the accumulated trace data for enabled traces to a file in the wx switch’s nonvolatile storage. Syntax — save trace filename filename —name for the trace file. To save the file in a subdirectory, specify the subdirectory name, then a slash. For exam...

  • Page 593

    Set trace authorization 593 examples — the following command starts a trace for information about user jose’s authentication: wx4400# set trace authentication user jose success: change accepted. See also clear trace on page 590 display trace on page 591 set trace authorization traces authorization i...

  • Page 594

    594 c hapter 21: t race c ommands see also clear trace on page 590 display trace on page 591 set trace dot1x traces 802.1x sessions. Syntax — set trace dot1x [ mac-addr mac-address ] [ port port-num ] [ user username ] [ level level ] mac-addr mac-address — traces a mac address. Specify a mac addres...

  • Page 595

    Set trace sm 595 set trace sm traces session manager activity. Syntax — set trace sm [mac-addr mac-address] [port port-num] [user username] [level level] mac-addr mac-address — traces a mac address. Specify a mac address, using colons to separate the octets (for example, 00:11:22:aa:bb:cc). Port por...

  • Page 596

    596 c hapter 21: t race c ommands.

  • Page 597: Noop

    22 s noop c ommands use snoop commands to monitor wireless traffic, by using a distributed map as a sniffing device. The map copies the sniffed 802.11 packets and sends the copies to an observer, which is typically a protocol analyzer such as ethereal or tethereal. (for more information, including s...

  • Page 598

    598 c hapter 22: s noop c ommands clear snoop deletes a snoop filter. Syntax — clear snoop filter-name filter-name — name of the snoop filter. Defaults — none. Access — enabled. History —introduced in mss version 4.0. Examples — the following command deletes snoop filter snoop1: wx1200# clear snoop ...

  • Page 599

    Set snoop 599 wx1200# clear snoop map snoop2 dap 3 radio 2 success: change accepted. The following command removes all snoop filter mappings from all radios: wx1200# clear snoop map all success: change accepted. See also set snoop map on page 602 display snoop on page 604 display snoop map on page 6...

  • Page 600

    600 c hapter 22: s noop c ommands to match on packets to or from a specific mac address, use the dest-mac or src-mac option. To match on both send and receive traffic for a host address, use the host-mac option. To match on a traffic flow (source and destination mac addresses), use the mac-pair opti...

  • Page 601

    Set snoop 601 the map that is running a snoop filter forwards snooped packets directly to the observer. This is a one-way communication, from the map to the observer. If the observer is not present, the map still sends the snoop packets, which use bandwidth. If the observer is present but is not lis...

  • Page 604

    604 c hapter 22: s noop c ommands display snoop displays the map radio mapping for all snoop filters. Syntax — display snoop defaults — none. Access — enabled. History —introduced in mss version 4.0. Usage — to display the mappings for a specific map radio, use the display snoop map command. Example...

  • Page 605

    Display snoop map 605 examples — the following command shows the snoop filters configured in the examples above: wx1200# display snoop info snoop1: observer 10.10.30.2 snap-length 100 all packets snoop2: observer 10.10.30.3 snap-length 100 frame-type eq data mac-pair (aa:bb:cc:dd:ee:ff, 11:22:33:44:...

  • Page 607

    Display snoop stats 607 table 109 describes the fields in this display. Table 109 display snoop stats output field description filter name of the snoop filter. Dap distributed map containing the radio to which the filter is mapped. Radio radio to which the filter is mapped. Rx match number of packet...

  • Page 608

    608 c hapter 22: s noop c ommands.

  • Page 609: Ystem

    23 s ystem l og c ommands use the system log commands to record information for monitoring and troubleshooting. Mss system logs are based on rfc 3164, which defines the log protocol. Commands by usage this chapter present system log commands alphabetically. Use table 110 to locate commands in this c...

  • Page 610

    610 c hapter 23: s ystem l og c ommands access — enabled. History — introduced in mss version 3.0. Examples — to stop sending system logging messages to a server at 192.168.253.11, type the following command: wx4400# clear log server 192.168.253.11 success: change accepted. Type the following comman...

  • Page 611

    Display log buffer 611 severity severity-level —displays messages at a severity level greater than or equal to the level specified. Specify one of the following: emergency — the wx switch is unusable. Alert — action must be taken immediately. Critical — you must resolve the critical conditions. If t...

  • Page 612

    612 c hapter 23: s ystem l og c ommands see also clear log on page 609 display log config on page 612 display log config displays log configuration information. Syntax — display log config defaults — none. Access — enabled. History — introduced in mss version 3.0. Examples — to display how logging i...

  • Page 614

    614 c hapter 23: s ystem l og c ommands defaults — none. Access — enabled. History — introduced in mss version 3.0. Examples — type the following command to see the facilities for which you can view event messages archived in the buffer: wx4400# display log trace facility ? Select one of: kernel, aa...

  • Page 615

    Set log 615 logging state (enabled or disabled) to override the session defaults for an individual session, type the set log command from within the session and use the current option. Trace — sets log parameters for trace files. Severity severity-level —logs events at a severity level greater than ...

  • Page 616

    616 c hapter 23: s ystem l og c ommands defaults — the following are defaults for the set log commands. Events at the error level and higher are logged to the wx console. Events at the error level and higher are logged to the wx system buffer. Trace logging is enabled, and debug-level output is stor...

  • Page 617

    Set log mark 617 alert critical error warning notice info debug interval interval — interval at which mss generates the mark messages. You can specify from 1 to 2147483647 seconds. Defaults — mark messages are disabled by default. When they are enabled, mss generates a message at the notice level on...

  • Page 618

    618 c hapter 23: s ystem l og c ommands.

  • Page 619: Oot

    24 b oot p rompt c ommands boot prompt commands enable you to perform basic tasks, including booting a system image file, from the boot prompt (boot>). A cli session enters the boot prompt if mss does not boot successfully or you intentionally interrupt the boot process. To interrupt the boot proces...

  • Page 621

    Boot 621 boot loads and executes a system image file. Syntax — boot [bt=type] [dev=device] [fn=filename] [ha=ip-addr] [fl=num] [opt=option] [opt+=option] bt=type — boot type: c — compact flash. Boots using nonvolatile storage or a flash card. N — network. Boots using a tftp server. Dev=device — loca...

  • Page 622

    622 c hapter 24: b oot p rompt c ommands usage — if you use an optional parameter, the parameter setting overrides the setting of the same parameter in the currently active boot profile. However, the boot profile itself is not changed. To display the currently active boot profile, use the display co...

  • Page 623

    Change 623 change changes parameters in the currently active boot profile. (for information about boot profiles, see display on page 628.) syntax — change defaults — the default boot type is c (compact flash). The default filename is default. The default flags setting is 0x00000000 (all flags disabl...

  • Page 624

    624 c hapter 24: b oot p rompt c ommands the following command enters the configuration mode for the currently active boot profile and configures the wx switch (in this example, an wxr100) to boot using a tftp server: boot> change changing the default configuration is not recommended. Are you sure t...

  • Page 625

    Delete 625 usage — a wx switch can have up to four boot profiles. The boot profiles are stored in slots, numbered 0 through 3. When you create a new profile, the system uses the next available slot for the profile. If all four slots already contain profiles and you try to create a fifth profile, the...

  • Page 626

    626 c hapter 24: b oot p rompt c ommands usage — when you type the delete command, the next-lower numbered boot profile becomes the active profile. For example, if the currently active profile is number 3, profile number 2 becomes active after you type delete to delete profile 3. You cannot delete b...

  • Page 627

    Diag 627 examples — the following command displays the current setting of the dhcp option: boot> dhcp dhcp is currently enabled. The following command disables the dhcp option: boot> dhcp dhcp is currently disabled. See also boot on page 621 diag accesses the diagnostic mode. Syntax — diag defaults ...

  • Page 628

    628 c hapter 24: b oot p rompt c ommands defaults — none. Access — boot prompt. History —introduced in mss version 3.0. Usage — to display the system image software versions, use the fver command. This command does not list the boot code versions. To display the boot code versions, use the version c...

  • Page 629

    Display 629 a wx switch can have up to four boot profiles, numbered 0 through 3. Only one boot profile can be active at a time. You can create, change, and delete boot profiles. You also can activate another boot profile in place of the currently active one. Syntax — display defaults — none. Access ...

  • Page 631

    Help 631 defaults — none. Access — boot prompt. History —introduced in mss version 3.0. Usage — to display the image filenames, use the dir command. This command does not list the boot code versions. To display the boot code versions, use the version command. Examples — the following command display...

  • Page 633

    Next 633 examples — to display a list of the commands available at the boot prompt, type the following command: boot> ls ls display a list of all commands and descriptions. Help display help information for each command. Autoboot display the state of, enable, or disable the autoboot option. Boot loa...

  • Page 634

    634 c hapter 24: b oot p rompt c ommands examples — to activate the boot profile in the next slot and display the profile, type the following command: boot> next boot index: 0 boot type: c device: boot1: filename: testcfg flags: 00000000 options: run=nos;boot=0 see also change on page 623 create on ...

  • Page 635

    Test 635 3com wx-4400 bootstrap/bootloader version 3.0.2 release compiled on wed sep 22 09:18:47 pdt 2004 by bootstrap 0 version: 3.1 active bootloader 0 version: 3.0.2 active bootstrap 1 version: 3.1 bootloader 1 version: 3.0.1 wx-4400 board revision: 2. Wx-4400 controller revision: 5. Wxa30001.Rel...

  • Page 636

    636 c hapter 24: b oot p rompt c ommands examples — the following command displays the current setting of the poweron test flag: boot> test the diagnostic execution flag is not set. See also boot on page 621 version displays version information for a wx switch’s hardware and boot code. Syntax — vers...

  • Page 637: Btaining

    A o btaining s upport for your p roduct register your product warranty and other service benefits start from the date of purchase, so it is important to register your product quickly to ensure you get full use of the warranty and other service benefits available to you. Warranty and other service be...

  • Page 638

    638 a ppendix a: o btaining s upport for your p roduct troubleshoot online you will find support tools posted on the 3com web site at http://www.3com.Com/ 3com knowledgebase helps you troubleshoot 3com products. This query-based interactive tool is located at http://knowledgebase.3com.Com and contai...

  • Page 639

    Contact us 639 to send a product directly to 3com for repair, you must first obtain a return authorization number (rma). Products sent to 3com, without authorization numbers clearly marked on the outside of the package, will be returned to the sender unopened, at the sender’s expense. If your produc...

  • Page 640

    640 a ppendix a: o btaining s upport for your p roduct from the following countries, you may use the numbers shown: austria belgium denmark finland france germany hungary ireland israel italy 01 7956 7124 070 700 770 7010 7289 01080 2783 0825 809 622 01805 404 747 06800 12813 1407 3387 1800 945 3794...

  • Page 642

    642 i ndex clear spantree portcost 394 clear spantree portpri 395 clear spantree portvlancost 395 clear spantree portvlanpri 396 clear spantree statistics 397 clear summertime 135 clear system 40 clear system countrycode 40 clear system ip-address 40, 136 clear system location 40 clear system name 4...

  • Page 643

    I ndex 643 display rfdetect countermeasures 541 display rfdetect counters 542 display rfdetect data 544 display rfdetect ignore 546 display rfdetect mobility-domain 546 display rfdetect ssid-list 550 display rfdetect vendor-list 551 display rfdetect visible 552 display roaming station 106 display ro...

  • Page 645

    I ndex 645 set radio-profile frag-threshold 358 set radio-profile long-retry 359 set radio-profile max-rx-lifetime 360 set radio-profile max-tx-lifetime 361 set radio-profile mode 362 set radio-profile preamble-length 364 set radio-profile rts-threshold 365 set radio-profile service-profile 366 set ...

  • Page 646

    646 i ndex set usergroup 261 set usergroup attr 261 set vlan name 116 set vlan port 117 set vlan tunnel-affinity 118 set web-portal 262 t telnet 195 test 635 traceroute 197 v version 636.