Wireless LAN Mobility System
Wireless LAN Switch and Controller
Command Reference
WX4400 3CRWX440095A
WX2200 3CRWX220095A
WX1200 3CRWX120695A
WXR100 3CRWXR10095A
http://www.3Com.com/
Part No. 10015910 Rev AB
Published December 2007
Wireless LAN Mobility System
Wireless LAN Switch and Controller
Command Reference
WX4400 3CRWX440095A
WX2200 3CRWX220095A
WX1200 3CRWX120695A
WXR100 3CRWXR10095A
http://www.3Com.com/
Part No. 10015910 Rev AB
Published December 2007
3Com Corporation 350 Campus Drive Marlborough, MA USA
Copyright ?? 2007, 3Com Corporation. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from 3Com Corporation.
3Com Corporation reserves the right to revise this documentation and to make changes in content from time to time without obligation on the part of 3Com Corporation to provide notification of such revision or change.
3Com Corporation provides this documentation without warranty, term, or condition of any kind, either implied or expressed, including, but not limited to, the implied warranties, terms or conditions of merchantability, satisfactory quality, and fitness for a particular purpose. 3Com may make improvements or changes in the product(s) and/or the program(s) described in this documentation at any time.
If there is any software on removable media described in this documentation, it is furnished under a license agreement included with the product as a separate document, in the hard copy documentation, or on the removable media in a directory file named LICENSE.TXT or !LICENSE.TXT. If you are unable to locate a copy, please contact 3Com and a copy will be provided to you.
UNITED STATES GOVERNMENT LEGEND
If you are a United States government agency, then this documentation and the software described herein are provided to you subject to the following:
All technical data and computer software are commercial in nature and developed solely at private expense. Software is delivered as ???Commercial Computer Software??? as defined in DFARS
Unless otherwise indicated, 3Com registered trademarks are registered in the United States and may or may not be registered in other countries.
3Com is a registered trademark of 3Com Corporation. The 3Com logo is a trademark of 3Com Corporation.
Mobility Domain, Managed Access Point, Mobility Profile, Mobility System, Mobility System Software, MP, MSS, and SentrySweep are trademarks of Trapeze Networks.
Intel and Pentium are registered trademarks of Intel Corporation. Microsoft,
All other company and product names may be trademarks of the respective companies with which they are associated.
ENVIRONMENTAL STATEMENT
It is the policy of 3Com Corporation to be
Establishing environmental performance standards that comply with national legislation and regulations.
Conserving energy, materials and natural resources in all operations.
Reducing the waste generated by all operations. Ensuring that all waste conforms to recognized environmental standards. Maximizing the recyclable and reusable content of all products.
Ensuring that all products can be recycled, reused and disposed of safely.
Ensuring that all products are labelled according to recognized environmental standards.
Improving our environmental record on a continual basis.
End of Life Statement
3Com processes allow for the recovery, reclamation and safe disposal of all
Regulated Materials Statement
3Com products do not contain any hazardous or
Environmental Statement about the Documentation
The documentation for this product is printed on paper that comes from sustainable, managed forests; it is fully biodegradable and recyclable, and is completely
Conventions 23
ABOUT THIS GUIDE
This command reference explains Mobility System Software (MSS???) command line interface (CLI) that you enter on a 3Com WXR100 or WX1200 Wireless Switch or WX4400 or WX2200 Wireless LAN Controller to configure and manage the Mobility System??? wireless LAN (WLAN).
Read this reference if you are a network administrator responsible for managing WXR100, WX1200, WX4400, or WX2200 wireless switches and their Managed Access Points (MAPs) in a network.
If release notes are shipped with your product and the information there differs from the information in this guide, follow the instructions in the release notes.
Most user guides and release notes are available in Adobe Acrobat
Reader Portable Document Format (PDF) or HTML on the 3Com
World Wide Web site:
http://www.3com.com/
24 ABOUT THIS GUIDE
This manual uses the following text and syntax conventions:
Table 2 Text Conventions
Documentation Comments 25
?? Wireless Switch Manager Reference Manual
This manual shows you how to plan, configure, deploy, and manage a
Mobility System wireless LAN (WLAN) using the 3Com Wireless Switch
Manager (3WXM).
?? Wireless Switch Manager User???s Guide
This manual shows you how to plan, configure, deploy, and manage the entire WLAN with the 3WXM tool suite. Read this guide to learn how to plan wireless services, how to configure and deploy 3Com equipment to provide those services, and how to optimize and manage your WLAN.
?? Wireless LAN Switch and Controller Hardware Installation Guide
This guide provides instructions and specifications for installing a WX wireless switch in a Mobility System WLAN.
?? Wireless LAN Switch and Controller Configuration Guide
Example:
??Wireless LAN Switch and Controller Configuration Guide
??Part number
??Page 25
26 ABOUT THIS GUIDE
Please note that we can only respond to comments and questions about 3Com product documentation at this
The wireless LAN switches support two connection modes:
??Administrative access mode, which enables the network administrator to connect to the WX switch and configure the network
??Network access mode, which enables network users to connect through the WX switch to access the network
28 CHAPTER 1: USING THE
CLI Conventions Be aware of the following MSS CLI conventions for command entry:
?????Command Prompts??? on page 28
?????Syntax Notation??? on page 28
?????Text Entry Conventions and Allowed Characters??? on page 29
?????User Globs, MAC Address Globs, and VLAN Globs??? on page 30
?????Virtual LAN Identification??? on page 33
Command Prompts By default, the MSS CLI provides the following prompt for restricted users. The mmmm portion shows the wireless LAN switch model number (for example, 1200).
WXmmmm>
After you become enabled as an administrative user by typing enable and supplying a suitable password, MSS displays the following prompt:
WXmmmm#
For information about changing the CLI prompt on a wireless LAN switch, see ???set prompt??? on page 59.
Syntax Notation The MSS CLI uses standard syntax notation:
??Bold monospace font identifies the command and keywords you must type. For example:
set enablepass
??Italics indicate a placeholder for a value. For example, you replace
clear interface
??Curly brackets ({ }) indicate a mandatory parameter, and square brackets ([ ]) indicate an optional parameter. For example, you must enter dynamic or port and a port list in the following command, but a VLAN ID is optional:
clear fdb {dynamic | port
??A vertical bar (|) separates mutually exclusive options within a list of possibilities. For example, you enter either enable or disable, not both, in the following command:
set port {enable | disable}
30 CHAPTER 1: USING THE
IP Address and Mask MSS displays IP addresses in dotted decimal notation ??? for example, Notation 192.168.1.111. MSS makes use of both subnet masks and wildcard
masks.
Subnet Masks
Unless otherwise noted, use classless interdomain routing (CIDR) format to express subnet masks ??? for example, 192.168.1.112/24. You indicate the subnet mask with a forward slash (/) and specify the number of bits in the mask.
Wildcard Masks
Security access control lists (ACLs) use source and destination IP addresses and wildcard masks to determine whether the wireless LAN switch filters or forwards IP packets. Matching packets are either permitted or denied network access. The ACL checks the bits in IP addresses that correspond to any 0s (zeros) in the mask, but does not check the bits that correspond to 1s (ones) in the mask. You specify the wildcard mask in dotted decimal notation.
For example, the address 10.0.0.0 and mask 0.255.255.255 match all IP addresses that begin with 10 in the first octet.
The ACL mask must be a contiguous set of zeroes starting from the first bit. For example, 0.255.255.255, 0.0.255.255, and 0.0.0.255 are valid ACL masks. However, 0.255.0.255 is not a valid ACL mask.
User Globs, MAC Name ???globbing??? is a way of using a wildcard pattern to expand a single Address Globs, and element into a list of elements that match the pattern. MSS accepts user
VLAN Globs globs, MAC address globs, and VLAN globs. The order in which globs appear in the configuration is important, because once a glob is matched, processing stops on the list of globs.
User Globs
A user glob is shorthand method for matching an authentication, authorization, and accounting (AAA) command to either a single user or a set of users.
A user glob can be up to 80 characters long and cannot contain spaces or tabs. The
Table 3 gives examples of user globs.
Table 3 User Globs
MAC Address Globs
A media access control (MAC) address glob is a similar method for matching some authentication, authorization, and accounting (AAA) and forwarding database (FDB) commands to one or more
00:*
00:01:*
00:01:02:*
00:01:02:03:*
00:01:02:03:04:*
For example, the MAC address glob 02:06:8c* represents all MAC addresses starting with 02:06:8c. Specifying only the first 3 bytes of a MAC address allows you to apply commands to MAC addresses based on an organizationally unique identity (OUI).
32 CHAPTER 1: USING THE
VLAN Globs
A VLAN glob is a method for matching one of a set of local rules on an wireless LAN switch, known as the location policy, to one or more users. MSS compares the VLAN glob, which can optionally contain wildcard characters, against the
To match all VLANs, use the
For example, the VLAN glob bldg4.* matches bldg4.security and bldg4.hr and all other VLAN names with bldg4. at the beginning.
Matching Order for Globs
In general, the order in which you enter AAA commands determines the order in which MSS matches the user, MAC address, or VLAN to a glob. To verify the order, view the output of the display aaa or display config command. MSS checks globs that appear higher in the list before items lower in the list and uses the first successful match.
Port Lists The physical Ethernet ports on a WX switch can be set for connection to MAP access points, authenticated wired users, or the network backbone. You can include a single port or multiple ports in one MSS CLI command by using the appropriate list format.
The ports on a WX switch are numbered 1 through 4 (for the 3Com Wireless LAN Controller WX4400) and 1 through 8 (for the 3Com Wireless Lan Switch WX1200). No port 0 exists on the WX switch. You can include a single port or multiple ports in a command that includes port
??A single port number. For example:
WX1200# set port enable 6
??A
WX1200# display port poe 1,2,4
??A
WX1200# reset port
??Any combination of single numbers, lists, and ranges. Hyphens take precedence over commas. For example:
WX1200# display port status
Virtual LAN The names of virtual LANs (VLANs), which are used in Mobility Domain??? Identification communications, are set by you and can be changed. In contrast, VLAN
ID numbers, which the wireless LAN uses locally, are determined when the VLAN is first configured and cannot be changed. Unless otherwise indicated, you can refer to a VLAN by either its VLAN name or its VLAN number. CLI set and display commands use a VLAN???s name or number to uniquely identify the VLAN within the WX.
Keyboard Shortcuts The following table lists the keyboard shortcuts for entering and editing CLI commands.
Table 4 Keyboard Shortcuts
34 CHAPTER 1: USING THE
Table 4 Keyboard Shortcuts (continued)
History Buffer The history buffer stores the last 63 commands you entered during a terminal session. You can use the Up Arrow and Down Arrow keys to select a command that you want to repeat from the history buffer.
Tabs The MSS CLI uses the Tab key for command completion. You can type the first few characters of a command and press the Tab key to show the command(s) that begin with those characters. For example:
WX1200# display i <Tab>
WX1200# help Commands:
For more information on help, see ???help??? on page 50.
To see a subset of the online help, type the command for which you want more information. For example, to show all the commands that begin with the letter i, type the following command:
36 CHAPTER 1: USING THE
To see all the variations, type one of the commands followed by a question mark (?). For example:
To determine the port on which Telnet is running, type the following command:
Understanding
Command
Descriptions
Each command description in the 3Com Mobility System Software Command Reference contains the following elements:
??A command name, which shows the keywords but not the variables. For example, the following command name appears at the top of a command description and in the index:
set ap name
??A brief description of the command???s functions.
??The full command syntax.
??Any command defaults.
??The command access, which is either enabled or all. All indicates that anyone can access this command. Enabled indicates that you must enter the enable password before entering the command.
??The command history, which identifies the MSS version in which the command was introduced and the version numbers of any subsequent updates.
??Special tips for command usage. These are omitted if the command requires no special usage.
??One or more examples of the command in context, with the appropriate system prompt and response.
??One or more related commands.
This chapter describes access commands used to control access to the
Mobility Software System (MSS)
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command restricts access to the CLI for the current session:
WX1200# disable
WX1200>
See Also
?? enable on page 38
38 CHAPTER 2: ACCESS COMMANDS
WX1200> quit
40 CHAPTER 2: ACCESS COMMANDS
Use system services commands to configure and monitor system information for a WX switch.
42 CHAPTER 3: SYSTEM SERVICE COMMANDS
Table 6 System Services Commands by Usage (continued)
clear banner motd Deletes the
Syntax ??? clear banner motd
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? To clear a banner, type the following command:
WX4400# clear banner motd success: change accepted
As an alternative to clearing the banner, you can overwrite the existing banner with an empty banner by typing the following command:
set banner motd ^^
See Also
See Also
??set prompt on page 59. (For information about default prompts, see ???Command Prompts??? on page 28.)
44 CHAPTER 3: SYSTEM SERVICE COMMANDS
See Also
??set system contact on page 60
??set system countrycode on page 61
??set system
46 CHAPTER 3: SYSTEM SERVICE COMMANDS
The additional ports refers to the number of additional MAPs the switch can boot and actively manage.
See Also
48 CHAPTER 3: SYSTEM SERVICE COMMANDS
Examples ??? To show system information, type the following command:
WX4400# display system
===============================================================================
===============================================================================
===============================================================================
Fan status: fan1 OK fan2 OK fan3 OK
Temperature: temp1 ok temp2 ok temp3 ok
PSU Status: Lower Power Supply DC ok AC ok Upper Power Supply missing
Memory: 97.04/744.03 (13%)
Total Power Over Ethernet : 29.000
===============================================================================
Table 7 describes the fields of display system output.
Table 7 display system output
display system 49
Table 7 display system output (continued)
50 CHAPTER 3: SYSTEM SERVICE COMMANDS
Table 7 display system output (continued)
Access ??? All.
History ??? Introduced in MSS Version 3.0.
Examples ??? Use this command to see a list of available commands. If you have restricted access, you see fewer commands than if you have enabled access. To show a list of CLI commands available at the enabled access level, type the following command at the enabled access level:
WX4400# help Commands:
52 CHAPTER 3: SYSTEM SERVICE COMMANDS
set
When the 3WXM server in the corporate network receives the configuration request, the server looks in the currently open network plan for a switch configuration with the same model and serial number as the one in the configuration request.
??If the network plan contains a configuration with a matching model and serial number, 3WXM sends the configuration to the switch and restarts the switch. The switch boots using the configuration it received from 3WXM.
??If the network plan does not have a configuration with a matching model and serial number, a verification warning appears in 3WXM. The warning lists the switch???s serial number and IP address. The network administrator can upload the switch into the network plan, configure switch parameters, and deploy the configuration to the switch.
To use the
If you want another WX switch model to be able to access a 3WXM server for a configuration, you also must preconfigure the WX with the following information:
??IP address
??Gateway address
??Domain name and DNS server address
You can enable the switch to use the MSS DHCP client to obtain this information from a DHCP server in the local network where the switch will be deployed. Alternatively, you can statically configure the information.
The IP address and DNS information are configured independently. You can configure the combination of settings that work with the network resources available at the deployment site. The following examples show some of the combinations you can configure.
54 CHAPTER 3: SYSTEM SERVICE COMMANDS
Examples ??? The following commands stage a WX switch to use the
1 Configure a VLAN:
2 Enable the DHCP client on VLAN 1:
3 Enable the
4 Save the configuration changes:
See Also
??crypto generate key on page 565
??crypto generate
??set interface
??enable ??? Enables the prompt to acknowledge the MOTD banner.
??disable ??? Disables the prompt to acknowledge the MOTD banner.
???????? Delimiting character that begins and ends the prompt message;
for example, double quotes (???).
??message ??? Up to 32 alphanumeric characters, but not the delimiting character.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage Enable the MOTD prompt, then optionally specify a prompt message.
When a user logs into the WX switch using the CLI, the configured MOTD banner is displayed, followed by the MOTD prompt message (if one is specified). In response, the user has the option of entering y to proceed or any other key to terminate the connection.
Examples ??? To enable the prompt for the MOTD banner, type the following command:
WX# set banner acknowledge enable success: change accepted.
To set Do you agree? as the text to be displayed following the MOTD banner, type the following command:
WX# set banner acknowledge message ???Do you agree???? success: change accepted.
After these commands are entered, when the user logs on, the MOTD banner is displayed, followed by the text Do you agree? If the user enters y, then the login proceeds; if not, then the user is disconnected.
See Also
56 CHAPTER 3: SYSTEM SERVICE COMMANDS
set banner motd Configures the banner string that is displayed before the beginning of each login prompt for each CLI session on the WX switch.
Syntax ??? set banner motd ???text???
????? ??? Delimiting character that begins and ends the message; for
example, double quotes (???).
??text ??? Up to 2000 alphanumeric characters, including tabs and
carriage returns, but not the delimiting character (^). The maximum number of characters is approximately 24 lines by 80 characters.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? Type a delimiting character, then the message, then another delimiting character.
Examples ??? To create a banner that says Meeting @ 4:00 p.m. in
Conference Room #3, type the following command:
WX# set banner motd ???Meeting @ 4:00 p.m. in Conference Room #3???
success: motd changed.
See Also
??set banner acknowledge on page 54
Syntax ??? set length
??
paging prompts. You can specify from 0 to 512. The 0 value disables the paging prompt action entirely.
Defaults ??? MSS displays 24 lines by default.
Access ??? All.
58 CHAPTER 3: SYSTEM SERVICE COMMANDS
History ??? Introduced in MSS Version 3.0.
Usage ??? Use this command if the output of a CLI command is greater than the number of lines allowed by default for a terminal type.
Examples ??? To set the number of lines displayed to 100, type the following command:
WX4400# set length 100
success: screen length for this session set to 100
set licenseInstalls an upgrade license, for managing more MAPs.
Syntax ??? set license
??
with or without the hyphens.
??
the key with or without the hyphens.
Defaults ??? The WX4400 can boot and manage 24 MAPs by default.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? The license key is shipped with the switch. To obtain the activation key, access the 3Com web site. Each license and activation key pair allows the switch to actively manage an additional 24 MAPs. You can install up to three upgrade license and activation key pairs, to actively manage up to 96 MAPs.
Examples ??? To install an upgrade license and activation key, type the following command:
WX4400# set license
set prompt 59
48 ports are enabled
success: license was installed
The additional ports refers to the number of additional MAPs the switch can boot and actively manage.
See Also
Syntax ??? set prompt string
??string ??? Alphanumeric string up to 32 characters long. To include
spaces in the prompt, you must enclose the string in double quotation marks (??????).
Defaults ??? The factory default for the WX switch name is the model number (WX1200 for the 3Com Wireless LAN Switch WX1200, WX4400 for the 3Com Wireless LAN Controller WX4400).
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? When you first log in for the initial configuration of the WX switch, the CLI provides a WX1200> or WX4400> prompt, depending on your model. After you become enabled by typing enable and giving a suitable password, the WX1200# or WX4400# prompt is displayed.
If you use the set system name command to change the default system name, MSS uses that name in the prompt, unless you also change the prompt with set prompt.
Examples ??? The following example sets the prompt from WX4400 to happy_days:
WX4400# set prompt happy_days success: change accepted. happy_days#
See Also
60CHAPTER 3: SYSTEM SERVICE COMMANDS
set system contact Stores a contact name for the WX switch.
Syntax ??? set system contact string
??string ??? Alphanumeric string up to 256 characters long, with no
blank spaces.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
To view the system contact string, type the display system command.
Examples ??? The following command sets the system contact information to tamara@example.com:
WX1200# set system contact tamara@example.com success: change accepted.
See Also
Syntax ??? set system countrycode code
??code ???
switch. You can specify one of the codes listed in Table 8.
Table 8 Country Codes
(continued)
62 CHAPTER 3: SYSTEM SERVICE COMMANDS
Table 8 Country Codes (continued)
(continued)
Table 8 Country Codes (continued)
(continued)
64 CHAPTER 3: SYSTEM SERVICE COMMANDS
Table 8 Country Codes (continued)
Defaults ??? The factory default country code is None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? You must set the system county code to a valid value before using any set ap commands to configure a MAP.
Examples ??? To set the country code to Canada, type the following command:
WX1200# set system country code CA success: change accepted.
See Also
Syntax ??? set system
??seconds ??? Number of seconds a CLI management session can remain
idle before MSS terminates the session. You can specify from 0 to 86400 seconds (one day). If you specify 0, the idle timeout is disabled.
The timeout interval is in
Defaults ??? 3600 seconds (one hour).
Access ??? Enabled.
History ??? Introduced in MSS Version 4.1.
Usage ??? This command applies to all types of CLI management sessions: console, Telnet, and SSH. The timeout change applies to existing sessions only, not to new sessions.
Examples ??? The following command sets the idle timeout to 1800 seconds (one half hour):
WX1200# set system
See Also
66 CHAPTER 3: SYSTEM SERVICE COMMANDS
Syntax ??? set system
??
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command sets the IP address of the WX switch to 192.168.253.1:
WX4400# set system
See Also
set system location 67
set system location Stores location information for the WX switch.
Syntax ??? set system location string
??string ??? Alphanumeric string up to 256 characters long, with no
blank spaces.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? You cannot include spaces in the system location string.
To view the system location string, type the display system command.
Examples ??? To store the location of the WX switch in the WX???s configuration, type the following command:
WX4400# set system location
See Also
68 CHAPTER 3: SYSTEM SERVICE COMMANDS
set system name Changes the name of the WX switch from the default system name and also provides content for the CLI prompt, if you do not specify a prompt.
Syntax ??? set system name string
??string ??? Alphanumeric string up to 256 characters long, with no
blank spaces. Use a unique name for each WX switch.
Defaults ??? By default, the system name and command prompt have the same value. The factory default for both is the model number (WX1200 for the 3Com Wireless LAN Switch WX1200, WX4400 for the 3Com Wireless LAN Controller WX4400).
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? Entering set system name with no string resets the system name to the factory default.
To view the system name string, type the display system command.
Examples ??? The following example sets the system name to a name that identifies the WX switch:
WX4400# set system name
See Also
Use port commands to configure and manage individual ports and
70 CHAPTER 4: PORT COMMANDS
Table 9 Port Commands by Usage (continued)
clear apRemoves a Distributed MAP.
CAUTION: When you clear a Distributed MAP, MSS ends user sessions that are using the MAP.
Syntax ??? clear ap
??
??all ??? Clear all distributed MAPs.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0. Version 6.0 renamed dap to ap.
Examples ??? The following command clears Distributed MAP 1:
WX4400# clear ap 1
This will clear specified AP devices.
Would you like to continue? (y/n) [n]y
See Also
clear port counters Clears port statistics counters and resets them to 0.
Syntax ??? clear port counters
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command clears all port statistics counters and resets them to 0:
WX4400# clear port counters success: cleared port counters
See Also
??display port counters on page 75
??monitor port counters on page 82
Syntax ??? clear
??name name ??? Name of the port group.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command clears port group server1:
WX4400# clear
See Also
72 CHAPTER 4: PORT COMMANDS
clear port mirror 73
Examples ??? The following command clears the names of ports 1 through 3:
WX4400# clear port
See Also
??display port status on page 79
clear port mirror Removes a port mirroring configuration.
Syntax ??? clear port mirror
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 4.2.
Examples ??? The following command clears the port mirroring configuration from the switch:
WX4400# clear port mirror
See Also
??display port mirror on page 77
Syntax ??? clear port preference
??
the specified ports.
Defaults ??? When both the copper and fiber interfaces of a gigabit
Ethernet port are connected, the GBIC (fiber) interface is the active link.
The
Access ??? Enabled.
74 CHAPTER 4: PORT COMMANDS
Syntax ??? clear port type
??
configuration from all the specified ports.
Defaults ??? The cleared port becomes a network port but is not placed in any VLANs.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? Use this command to change a port back to a network port. All configuration settings specific to the port type are removed. For example, if you clear a MAP access point port, all
Table 10 Network port defaults
76CHAPTER 4: PORT COMMANDS
??
packets.
??
packets.
??port
list, MSS shows statistics for all ports.
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 3.0.
Usage ??? You can specify one statistic type with the command.
Examples ??? The following command shows octet statistics for port 3:
=============================================================================
3 Up2796542034886544
This command???s output has the same fields as the monitor port counters command. For descriptions of the fields, see Table 16 on page 84.
See Also
??clear port counters on page 71
??monitor port counters on page 82
display
Syntax ??? display
??name
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 3.0. In Version 4.2 the option all was removed for simplicity. You can display information for all groups by entering the command without specifying a group name.
display port mirror 77
Examples ??? The following command displays the configuration of port group server2:
WX1200# display
Port group: server2 is up
Ports: 5, 7
Table 11 describes the fields in the display
Table 11 Output for display
See Also
display port mirror Displays the port mirroring configuration.
Syntax ??? display port mirror
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 4.2.
Examples ??? The following command displays the port mirroring configuration on the switch:
WX4400# display port mirror
Port 1 is mirrored to port 2
If port mirroring is not configured, the message in the following example is displayed instead:
WX4400# display port mirror
No ports are mirrored
78 CHAPTER 4: PORT COMMANDS
See Also
??display port mirror on page 77
display port poe Displays status information for ports on which Power over Ethernet (PoE) is enabled.
Syntax ??? display port poe
??
PoE information is displayed for all ports.
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command displays PoE information for all ports on a WX1200 switch:
============================================================
Table 12 describes the fields in this display.
Table 12 Output for display port poe
display port status 79
Table 12 Output for display port poe (continued)
this field displays off. For gigabit Ethernet ports, this field displays invalid, because PoE is not supported on gigabit Ethernet ports.
The value overcurrent indicates a PoE problem such as a short in the cable.
See Also
display port status Displays configuration and status information for ports.
Syntax ??? display port status
??
information is displayed for all ports.
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 3.0.
80 CHAPTER 4: PORT COMMANDS
Examples ??? The following command displays information for all ports on a WX1200 switch:
===============================================================================
Table 13 describes the fields in this display.
Table 13 Output for display port status
Table 13 Output for display port status (continued)
See Also ??? display port
??
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 4.0.
Usage ??? This command applies only to the WX4400.
82 CHAPTER 4: PORT COMMANDS
Examples ??? The following command displays the enabled interface types on all four ports of a WX4400 switch:
WX4400# display port
Port Media Type
===========================================================
1 GBIC
2 RJ45
3 GBIC
4 GBIC
Table 14 describes the fields in this display.
Table 14 Output for display port
counters
Syntax ??? monitor port counters
[octets | packets |
?? octets ??? Displays octet statistics first.
?? packets ??? Displays packet statistics first.
??
??
?? collisions ??? Displays collision statistics first.
??
??
packets first.
Defaults ??? All types of statistics are displayed for all ports. MSS refreshes the statistics every 5 seconds. This interval cannot be configured. Statistics types are displayed in the following order by default:
??Octets
??Packets
??Receive errors
??Transmit errors
??Collisions
??Receive Ethernet statistics
??Transmit Ethernet statistics
Access ??? All.
Usage ??? Each type of statistic is displayed separately. Press the Spacebar to cycle through the displays for each type.
If you use an option to specify a statistic type, the display begins with that statistic type. You can use one statistic option with the command.
Use the keys listed in Table 15 to control the monitor display.
Table 15 Key Controls for Monitor Port Counters Display
Field Description
Spacebar Advances to the next statistic type.
cClears the statistics counters for the currently displayed statistics type. The counters begin incrementing again.
84 CHAPTER 4: PORT COMMANDS
For error reporting, the cyclic redundancy check (CRC) errors include misalignment errors. Jumbo packets with valid CRCs are not counted. A short packet can be reported as a short packet, a CRC error, or an overrun. In some circumstances, the transmitted octets counter might increment a small amount for a port with nothing attached.
Examples ??? The following command starts the port statistics monitor beginning with octet statistics (the default):
WX4400# monitor port counters
As soon as you press Enter, MSS clears the window and displays statistics at the top of the window.
Port StatusRx OctetsTx Octets
===============================================================================
...
To cycle the display to the next set of statistics, press the Spacebar. In this example, packet statistics are displayed next:
Port Status Rx Unicast Rx NonUnicast Tx Unicast Tx NonUnicast
===============================================================================
...
Table 16 describes the port statistics displayed by each statistics option.
The Port and Status fields are displayed for each option.
Table 16 Output for monitor port counters
Table 16 Output for monitor port counters (continued)
86 CHAPTER 4: PORT COMMANDS
Table 16 Output for monitor port counters (continued)
See Also
88CHAPTER 4: PORT COMMANDS
??
connection numbers depends on the WX switch model:
??For a WX4400, you can specify a number from 1 to 256.
??For a WX1200, you can specify a number from 1 to 30.
??
listed on the MAP case. To show the serial ID using the CLI, use the display version details command.
?? radiotype 11a | 11b| 11g ??? Radio type:
??11a ??? 802.11a
??11b ??? 802.11b
??11g ??? 802.11g
This option applies only to
Defaults ??? The default values are the same as the defaults for the set port type ap command.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0. New values for model option added in Version 4.1:
??AP3750
??AP2750
??
Version 6.0 renamed the dap command to ap.
Examples ??? The following command configures Distributed MAP 1 for
MAP model AP2750 with
WX4400# set ap 1
The following command removes Distributed MAP 1:
WX4400# clear ap 1
This will clear specified AP devices. Would you like to continue? (y/n) [n]y
set port 89
See Also
??set system countrycode on page 61
Syntax ??? set port {enable | disable}
??enable ??? Enables the specified ports.
??disable ??? Disables the specified ports.
??
specified ports.
Defaults ??? All ports are enabled.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? A port that is administratively disabled cannot send or receive packets. This command does not affect the link state of the port.
Examples ??? The following command disables port 6:
WX1200# set port disable 6 success: set "disable" on port 6
The following command reenables the port:
WX1200# set port enable 6 success: set "enable" on port 6
See Also
90 CHAPTER 4: PORT COMMANDS
or off to disable the group. The group is enabled by default.
Defaults ??? Once configured, a group is enabled by default.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? You can configure up to 8 ports in a port group, in any combination of ports. The port numbers do not need to be contiguous and you can use 10/100 Ethernet ports and gigabit Ethernet ports in the same port group.
After you add a port to a port group, you cannot configure port parameters on the individual port. Instead, change port parameters on the entire group. Specify the group name instead of an individual port name or number in port configuration commands.
To add or remove ports in a group that is already configured, change the mode to off, add or remove the ports, then change the mode to on.
Examples ??? The following command configures a port group named server1 containing ports 1 through 5, and enables the link:
WX1200# set
The following commands disable the link for port group server1, change the list of ports in the group, and reenable the link:
WX1200# set
WX1200# set
set port
See Also
??display
set port
Syntax ??? set port
??
specified ports.
??
Defaults ??? The GBIC (fiber) interface is enabled, and the copper interface is disabled, by default.
Access ??? Enabled.
History ??? Introduced in MSS Version 4.0.
Usage ??? This command applies only to the WX4400.
If you set the port interface to
Examples ??? The following command disables the fiber interface and enables the copper interface on port 2:
WX4400# set port
See Also
set port name 93
Syntax ??? set port port name name
??port ??? Number of a physical port. You can specify only one port.
??name name ??? Alphanumeric string of up to 16 characters, with no
spaces.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? To simplify configuration and avoid confusion between a port???s number and its name, 3Com recommends that you do not use numbers as port names.
Examples ??? The following command sets the name of port 7 to adminpool:
WX1200# set port 7 name adminpool success: change accepted.
See Also
??display port status on page 79
set port negotiation Disables or reenables autonegotiation on gigabit Ethernet or 10/100 Ethernet ports.
Syntax ??? set port negotiation
??
autonegotiation on all the specified ports.
??enable ??? Enables autonegotiation on the specified ports.
??disable ??? Disables autonegotiation on the specified ports.
Defaults ??? Autonegotiation is enabled on all Ethernet ports by default.
94 CHAPTER 4: PORT COMMANDS
set port speed 95
History ??? Introduced in MSS Version 3.0.
Usage ??? This command does not apply to any gigabit Ethernet ports or to ports 7 and 8 on the WX1200 switch.
Examples ??? The following command disables PoE on ports 4 and 5, which are connected to a MAP access point:
WX1200# set port poe 4,5 disable
If you are enabling power on these ports, they must be connected only to approved PoE devices with the correct wiring. Do you wish to continue? (y/n) [n]y
The following command enables PoE on ports 4 and 5:
WX1200# set port poe 4,5 enable
If you are enabling power on these ports, they must be connected only to approved PoE devices with the correct wiring. Do you wish to continue? (y/n) [n]y
See Also
??set port type
Syntax ??? set port speed
??
specified ports.
??10 ??? Sets the port speed of a 10/100 Ethernet port to 10 Mbps and
sets the operating mode to
??100 ??? Sets the port speed of a 10/100 Ethernet port to 100 Mbps
and sets the operating mode to
??1000 ??? Sets the port speed of a gigabit Ethernet port to 1000 Mbps
and sets the operating mode to
??auto ??? Enables a port to detect the speed and operating mode of the
traffic on the link and set itself accordingly.
Defaults ??? All ports are set to auto.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
96 CHAPTER 4: PORT COMMANDS
WX1200# set port trap
set port type ap 97
See Also
??set ip snmp server on page 180
??set snmp community on page 185
set port type ap Configures an WX switch port for a MAP access point.
CAUTION: When you set the port type for MAP use, you must specify the PoE state (enable or disable) of the port. Use the WX switch???s PoE to power 3Com MAP access points only. If you enable PoE on a port connected to another device, physical damage to the device can result.
Before configuring a port as a MAP access point port, you must use the set system countrycode command to set the IEEE 802.11
For a MAP that is indirectly connected to the WX switch through an intermediate Layer 2 or Layer 3 network, use the set ap command to configure a Distributed MAP.
Before changing the port type from ap to
Syntax ??? set port type ap
poe {enable | disable} [radiotype {11a | 11b | 11g}]
??
??model {ap2750 | ap3150 | ap3750| ap7250 | ap8250 | ap8750 |
|
?? poe enable | disable ??? Power over Ethernet (PoE) state.
?? radiotype 11a | 11b | 11g ??? Radio type:
??11a ??? 802.11a
??11b ??? 802.11b
??11g ??? 802.11g
98 CHAPTER 4: PORT COMMANDS
Defaults ??? All WX ports are network ports by default.
MAP access point models AP2750,
The radios in models
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0. New values for model options
AP3750, AP2750 added in Version 4.1. New value for model option
AP3150 added in Version 6.0.
Usage ??? You cannot set a port type if the port is a member of a port VLAN. To remove a port from a VLAN, use the clear vlan command. To reset a port as a network port, use the clear port type command.
When you change port type, MSS applies default settings appropriate for the port type. Table 17 lists the default settings that MSS applies when you set a port???s type to ap.
Table 17 MAP Access Port Defaults
This command does not apply to any gigabit Ethernet ports or to ports 7 and 8 on the WX1200 switch or port 3 on the WX2200 switch.
To manage a MAP access point on a switch model that does not have 10/100 Ethernet ports, use the set ap command to configure a Distributed MAP connection on the switch.
Examples ??? The following command sets ports 1 through 3 and port 5 for MAP access point model AP2750 and enables PoE on the ports:
WX1200# set port type ap
This may affect the power applied on the configured ports. Would you like to continue? (y/n) [n]y
The following command sets ports 1 through 3 and port 5 for MAP access point model AP7250 and enables PoE on the ports:
WX1200# set port type ap
This may affect the power applied on the configured ports. Would you like to continue? (y/n) [n]y
The following command sets ports 1 through 3 and port 5 for MAP access point model AP8250 and enables PoE on the ports:
WX1200# set port type ap
This may affect the power applied on the configured ports. Would you like to continue? (y/n) [n]y
The following command sets ports 1 through 3 and port 5 for MAP access point model AP8750 and enables PoE on the ports:
WX1200# set port type ap
This may affect the power applied on the configured ports. Would you like to continue? (y/n) [n]y
The following command resets port 5 by clearing it:
WX1200# clear port type 5
This may disrupt currently authenticated users. Are you sure? (y/n) [n]y
success: change accepted.
100 CHAPTER 4: PORT COMMANDS
set port type
Usage ??? You cannot set a port???s type if the port is a member of a port VLAN. To remove a port from a VLAN, use the clear vlan command. To reset a port as a network port, use the clear port type command.
When you change port type, MSS applies default settings appropriate for the port type. Table 18 lists the default settings that MSS applies when you set a port???s type to ap.
Table 18 Wired Authentication Port Details
For 802.1X clients, wired authentication works only if the clients are directly attached to the wired authentication port, or are attached through a hub that does not block forwarding of packets from the client to the PAE group address (01:80:c2:00:00:03).
Wired authentication works in accordance with the 802.1X specification, which prohibits a client from sending traffic directly to an authenticator???s MAC address until the client is authenticated. Instead of sending traffic to the authenticator???s MAC address, the client sends packets to the PAE group address.
The 802.1X specification prohibits networking devices from forwarding PAE group address packets, because this would make it possible for multiple authenticators to acquire the same client.
For
102 CHAPTER 4: PORT COMMANDS
Examples ??? The following command sets port 2 for a wired authentication user:
WX1200# set port type
The following command sets port 7 for a wired authentication user and specifies a maximum of three simultaneous user sessions:
WX1200# set port type
See Also
Use virtual LAN (VLAN) commands to configure and manage parameters for individual port VLANs on network ports, and to display information about clients roaming within a mobility domain.
104 CHAPTER 5: VLAN COMMANDS
Table 19 VLAN Commands by Usage (continued)
clear security
History
Usage ??? You can delete forwarding database entries based on entry type, port, or VLAN. A VLAN name or number is required for deleting permanent or static entries.
Examples ??? The following command clears all static forwarding database entries that match VLAN blue:
WX4400# clear fdb static vlan blue success: change accepted.
The following command clears all dynamic forwarding database entries that match all VLANs:
WX4400# clear fdb dynamic success: change accepted.
The following command clears all dynamic forwarding database entries that match ports 3 and 5:
WX4400# clear fdb port 3,5 success: change accepted.
?? all ??? Removes all MAC addresses from the list.
Defaults ??? If you do not specify a list of MAC addresses or all, all addresses are removed.
106 CHAPTER 5: VLAN COMMANDS
clear vlan 107
Syntax ??? clear vlan
??
??port
ports from the VLAN. If you do not specify a list of ports, MSS removes the VLAN entirely.
??tag
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? If you do not specify a
You cannot delete the default VLAN but you can remove ports from it. To remove ports from the default VLAN, use the port
108 CHAPTER 5: VLAN COMMANDS
Examples ??? The following command removes port 1 from VLAN green:
WX4400# clear vlan green port 1
This may disrupt user connectivity. Do you wish to continue? (y/n) [n]y success: change accepted.
The following command removes port 4, which uses tag value 69, from
VLAN red:
WX1200# clear vlan red port 4 tag 69
This may disrupt user connectivity. Do you wish to continue? (y/n) [n]y success: change accepted.
The following command completely removes VLAN marigold:
WX4400# clear vlan marigold
This may disrupt user connectivity. Do you wish to continue? (y/n) [n]y success: change accepted.
See Also
??display vlan config on page 118
clear
Syntax ??? clear
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? A VLAN profile lists the VLANs for which traffic is locally switched by MAPs where the VLAN profile is applied. Use this command to remove individual VLANs from a VLAN profile, or to remove an entire VLAN profile. If you remove all of the entries from a VLAN profile, the VLAN profile itself is removed.
??
??
display fdb 109
If a VLAN profile is changed so that traffic that had been tunneled to an VX switch is now locally switched by MAPs, or
Examples ??? The following command removes the entry for VLAN red from VLAN profile locals:
WX# clear
WX#
The following command removes VLAN profile locals:
WX# clear
WX#
See Also
??display
?? set ap
??set vlan profile on page 127
??display
Syntax ??? display fdb
display fdb {perm | static | dynamic | system | all} [port
??
Specify a MAC address, or use the wildcard character (*) to specify a set of MAC addresses. (For details, see ???MAC Address Globs??? on page 31.)
??vlan
entries.
??perm ??? Displays permanent entries. A permanent entry does not age
out and remains in the database even after a reboot, reset, or power cycle.
??static ??? Displays static entries. A static entry does not age out, but
is removed from the database after a reboot, reset, or power cycle.
110CHAPTER 5: VLAN COMMANDS
??dynamic ??? Displays dynamic entries. A dynamic entry is automatically
removed through aging or after a reboot, reset, or power cycle.
??system ??? Displays system entries. A system entry is added by MSS.
For example, the authentication protocols can add entries for wired and wireless authentication users.
??all ??? Displays all entries in the database, or all the entries that match
a particular port or ports or a particular VLAN.
??port
Defaults ??? None.
Access ??? All.
History
Usage ??? To display the entire forwarding database, enter the display fdb command without options. To display only a portion of the database, use optional parameters to specify the types of entries you want to display.
Examples ??? The following command displays all entries in the forwarding database:
Total Matching FDB Entries Displayed = 3
The top line of the display identifies the characters to distinguish among the entry types.
The following command displays all entries that begin with the MAC address glob 00:
Total Matching FDB Entries Displayed = 2
?? vlan
Defaults ??? None.
Access ??? All.
History
Examples ??? The following command displays the aging timeout period for all VLANs:
WX1200# display fdb agingtime
112 CHAPTER 5: VLAN COMMANDS
VLAN 2 aging time = 600 sec
VLAN 1 aging time = 300 sec
Because the forwarding database aging timeout period can be configured only on an individual VLAN basis, the command lists the aging timeout period for each VLAN separately.
See Also
??set fdb agingtime on page 122
display fdb count Lists the number of entries in the forwarding database.
Syntax ??? display fdb count {perm | static | dynamic}
[vlan
??perm ??? Lists the number of permanent entries. A permanent entry
does not age out and remains in the database even after a reboot, reset, or power cycle.
??static ??? Lists the number of static entries. A static entry does not
age out, but is removed from the database after a reboot, reset, or power cycle.
??dynamic ??? Lists the number of dynamic entries. A dynamic entry is
automatically removed through aging or after a reboot, reset, or power cycle.
??vlan
specified VLAN.
Defaults ??? None.
Access ??? All.
History
The following command lists the number of dynamic entries that the forwarding database contains:
WX1200# display fdb count dynamic
Total Matching Entries = 2
See Also
display roaming station 113
Examples ??? To display all stations roaming to the WX switch, type the following command:
Table 21 describes the fields in the display.
Table 21 Output for display roaming station
114 CHAPTER 5: VLAN COMMANDS
Table 21 Output for display roaming station (continued)
See Also
display roaming vlan 115
display roaming Shows all VLANs in the mobility domain, the WX switches servicing the vlanVLANs, and their tunnel affinity values configured on each switch for the
VLANs.
Syntax ??? display roaming vlan
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command shows the current roaming
VLANs:
Table 22 describes the fields in the display.
Table 22 Output for display roaming vlan
See Also
116 CHAPTER 5: VLAN COMMANDS
Table 23 describes the fields in the display.
Table 23 Output for display security
command.
Syntax ??? display tunnel
Defaults ??? None.
Access ??? Enabled
History
Examples ??? To display all tunnels from a WX switch to other WX switches in the Mobility Domain, type the following command.
Table 24 describes the fields in the display.
Table 24 Output for display tunnel
118 CHAPTER 5: VLAN COMMANDS
Table 24 Output for display tunnel (continued)
See Also
??display vlan config on page 118
Syntax ??? display vlan config
??
information for all VLANs is displayed.
Defaults ??? None.
Access ??? All.
History
Examples ??? The following command displays information for VLAN burgundy:
display vlan config 119
Table 25 describes the fields in this display.
Table 25 Output for display vlan config
See Also
??clear security
120 CHAPTER 5: VLAN COMMANDS
display
Syntax ??? display
??
Defaults ??? If a
Access ??? All.
History ??? Introduced in MSS Version 6.0.
Examples ??? The following command displays the contents of VLAN profile locals:
WX# display
Table 26 describes the fields in the display
Table 26 Output for display
See Also
??clear
set fdb 121
Syntax ??? set fdb {perm | static}
??perm ??? Adds a permanent entry. A permanent entry does not age out
and remains in the database even after a reboot, reset, or power cycle.
??static ??? Adds a static entry. A static entry does not age out, but is
removed from the database after a reboot, reset, or power cycle.
??
separate the octets (for example, 00:11:22:aa:bb:cc).
??port
the entry. A separate entry is added for each port you specify.
??vlan
member. The entry is added only for the specified VLAN.
??tag
can specify a number from 1 through 4095. If you do not specify a tag value, an entry is created for an untagged interface only. If you specify a tag value, an entry is created only for the specified tagged interface.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? You cannot add a multicast or broadcast address as a permanent or static FDB entry.
Examples ??? The following command adds a permanent entry for MAC address 00:11:22:aa:bb:cc on ports 3 and 5 in VLAN blue:
WX1200# set fdb perm 00:11:22:aa:bb:cc port 3,5 vlan blue success: change accepted.
The following command adds a static entry for MAC address 00:2b:3c:4d:5e:6f on port 1 in the default VLAN:
WX4400# set fdb static 00:2b:3c:4d:5e:6f port 1 vlan default success: change accepted.
122 CHAPTER 5: VLAN COMMANDS
See Also
set fdb agingtime Changes the aging timeout period for dynamic entries in the forwarding database.
Syntax ??? set fdb agingtime
??
applies only to entries that match the specified VLAN.
??age seconds ??? Value for the timeout period, in seconds. You can
specify a value from 0 through 1,000,000. If you change the timeout period to 0, aging is disabled.
Defaults ??? The aging timeout period is 300 seconds (5 minutes).
Access ??? Enabled.
History
Examples ??? The following command changes the aging timeout period to 600 seconds for entries that match VLAN orange:
WX4400# set fdb agingtime orange age 600 success: change accepted.
See Also
set security
??
??mode ??? Enables or disables restriction of Layer 2 forwarding.
{enable | disable}
??
Defaults ??? Layer 2 restriction is disabled by default.
Access ??? Enabled.
History
Usage ??? You can specify multiple addresses by listing them on the same command line or by entering multiple commands. To change a MAC address, use the clear security
Restriction of client traffic does not begin until you enable the permitted
MAC list. Use the mode enable option with this command
Examples ??? The following command restricts Layer 2 forwarding of client data in VLAN abc_air to the gateway routers with MAC address aa:bb:cc:dd:ee:ff and 11:22:33:44:55:66:
WX4400# set security
success: change accepted.
See Also
??clear security
124 CHAPTER 5: VLAN COMMANDS
Syntax ??? set vlan
??
4093.
??name ??? String up to 16 alphabetic characters long.
Defaults ??? VLAN 1 is named default by default. No other VLANs have default names.
Access ??? Enabled.
History
Usage ??? You must assign a name to a VLAN (other than the default
VLAN) before you can add ports to the VLAN.
3Com recommends that you do not use the name default. This name is already used for VLAN 1. 3Com also recommends that you do not rename the default VLAN.
You cannot use a number as the first character in a VLAN name. It is recommended that you do not use the same name with different capitalizations for VLANs. For example, do not configure two separate VLANs with the names red and RED.
VLAN names are
Examples ??? The following command assigns the name marigold to
VLAN 3:
WX4400# set vlan 3 name marigold success: change accepted.
See Also
set vlan port 125
See Also
??clear security
126 CHAPTER 5: VLAN COMMANDS
Syntax ??? set vlan
??
??num ??? Preference of this switch for forwarding user traffic for the
VLAN. You can specify a value from 1 through 10. A higher number indicates a greater preference.
Defaults ??? Each VLAN on a WX switch???s network ports has an affinity value of 5 by default.
Access ??? Enabled.
History
Usage ??? Increasing a WX switch???s affinity value increases the WX???s preferability for forwarding user traffic for the VLAN.
If more than one WX switch has the highest affinity value, MSS randomly selects one of the WX switches for the tunnel.
Examples ??? The following command changes the VLAN affinity for
VLAN beige to 10:
WX4400# set vlan beige
See Also
128 CHAPTER 5: VLAN COMMANDS
Use Quality of Service (QoS) commands to configure packet prioritization in MSS. Packet prioritization ensures that WX switches and MAP access points give preferential treatment to
(To override the prioritization for specific traffic, use access controls lists [ACLs] to set the Class of Service [CoS] for the packets. See ???Security ACL Commands??? on page 537.)
130CHAPTER 6: QUALITY OF SERVICE COMMANDS
??Classify inbound packets by mapping their DSCP values to one of eight internal QoS values
??Classify outbound packets by marking their DSCP values based on the switch???s internal QoS values
Syntax ??? clear qos
??
internal QoS value and the DSCP values with which MSS marks outbound packets. QoS values are from 0 to 7.
??
of DSCP values and internal QoS value with which MSS classifies inbound packets.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To reset all mappings to their default values, use the clear qos command without the optional parameters.
Examples ??? The following command resets all QoS mappings:
WX1200# clear qos success: change accepted.
The following command resets the mapping used to classify packets with
DSCP value 44:
WX1200# clear qos
set qos
132 CHAPTER 6: QUALITY OF SERVICE COMMANDS
display qos 133
============================================================
See Also
Use IP services commands to configure and manage IP interfaces, management services, the Domain Name Service (DNS), Network Time Protocol (NTP), aliases, and to ping a host or trace a route.
136 CHAPTER 7: IP SERVICES COMMANDS
Table 28 IP Services Commands by Usage (continued)
clear interface 137
Table 28 IP Services Commands by Usage (continued)
clear interface Removes an IP interface.
Syntax ??? clear interface
??
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? If the interface you want to remove is configured as the system IP address, removing the address can interfere with system tasks using the system IP address, including the following:
??Mobility domain operations
138CHAPTER 7: IP SERVICES COMMANDS
??Topology reporting for
??Default source IP address used in unsolicited communications such as AAA accounting reports and SNMP traps
Examples ??? The following command removes the IP interface configured on VLAN mauve:
WX1200# clear interface mauve ip success: cleared ip on vlan mauve
See Also
??set interface
??display interface on page 152
Syntax ??? clear ip alias name
name ??? Alias name
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command removes the alias server1:
WX1200# clear ip alias server1 success: change accepted.
See Also
clear ip dns domain 139
clear ip dns domain Removes the default DNS domain name.
Syntax ??? clear ip dns domain
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command removes the default DNS domain name from a WX switch:
WX1200# clear ip dns domain
Default DNS domain name cleared.
See Also
??clear ip dns server on page 139
??set ip dns domain on page 175
??set ip dns server on page 176
clear ip dns server Removes a DNS server from a WX switch configuration.
Syntax ??? clear ip dns server
??
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command removes DNS server 10.10.10.69 from a WX configuration:
WX4400# clear ip dns server 10.10.10.69 success: change accepted.
clear ip telnet 141
See Also
??display ip https on page 155
??display ip telnet on page 158
??set ip https server on page 177
??set ip telnet server on page 182
Syntax ??? clear ntp server
??
notation.
??all ??? Removes all NTP servers from the configuration.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
clear snmp community 143
144 CHAPTER 7: IP SERVICES COMMANDS
clear summertime 145
Examples ??? The following command clears SNMPv3 user snmpmgr1:
WX1200# clear snmp usm snmpmgr1 success: change accepted.
See Also
??display snmp usm on page 164
clear summertime Clears the summertime setting from a WX.
Syntax ??? clear summertime
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? To clear the summertime setting from a WX, type the following command:
WX1200# clear summertime success: change accepted.
See Also
??display summertime on page 164
??display timedate on page 165
146 CHAPTER 7: IP SERVICES COMMANDS
display arp 147
Examples ??? To return the WX
WX4400# clear timezone success: change accepted.
See Also
??clear summertime on page 145
??display summertime on page 164
??display timedate on page 165
??display timezone on page 165
Syntax ??? display arp
??
Defaults ??? If you do not specify an IP address, the entire ARP table is displayed.
Usage ??? All.
History
Examples ??? The following command displays ARP entries:
WX4400# display arp
ARP aging time: 1200 seconds
148 CHAPTER 7: IP SERVICES COMMANDS
Table 29 describes the fields in this display.
Table 29 Output for display arp
See Also
??set arp agingtime on page 169
display
Syntax ??? display
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 4.0.
display
Examples ??? The following command displays DHCP client information:
Table 30 describes the fields in this display.
Table 30 Output for display
See Also
150 CHAPTER 7: IP SERVICES COMMANDS
display
Syntax ??? display
??
??
interface
verbose??? Displays configuration and status information for the MSS DHCP server.
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 4.0.
Examples ??? The following command displays the addresses leased by the MSS DHCP server:
The following command displays configuration and status information for each VLAN on which the DHCP server is configured:
WX1200# display
display
Table 31 and Table 32 describe the fields in these displays.
Table 31 Output for display
DHCP server on the subnet. This is the initial state of the MSS DHCP server. The MSS DHCP server remains in this state if another DHCP server is detected.
??
??
??
??
152 CHAPTER 7: IP SERVICES COMMANDS
Table 32 Output for display
See Also
??set interface
display interface Displays the IP interfaces configured on the WX.
Syntax ??? display interface
??
Defaults ??? If you do not specify a VLAN ID, interfaces for all VLANs are displayed.
Usage ??? All.
History
Examples ??? The following command displays all the IP interfaces configured on a WX switch:
Table 33 describes the fields in this display.
display ip alias 153
Table 33 Output for display interface
Access ??? Enabled.
History
Examples ??? The following command displays all the aliases configured on a WX switch:
WX4400# display ip alias
154 CHAPTER 7: IP SERVICES COMMANDS
Table 34 describes the fields in this display.
Table 34 Output for display ip alias
Examples ??? The following command displays the DNS information:
Table 35 describes the fields in this display.
Table 35 Output for display ip dns
FieldDescription
Domain Name Default domain name configured on the WX switch
display ip https 155
Table 35 Output for display ip dns (continued)
Table 36 describes the fields in this display.
156 CHAPTER 7: IP SERVICES COMMANDS
Table 36 Output for display ip https
HTTPS is set to use port TCP port number on which the WX switch listens for
HTTPS connections.
See Also
??display ip telnet on page 158
??set ip https server on page 177
??set ip telnet server on page 182
Syntax ??? display ip route [destination]
??destination ??? Route destination IP address, in dotted decimal
notation.
Defaults ??? None.
Access ??? All.
History
display ip route 157
Usage ??? When you add an IP interface to a VLAN that is up, MSS adds direct and local routes for the interface to the route table. If the VLAN is down, MSS does not add the routes. If you add an interface to a VLAN but the routes for that interface do not appear in the route table, use the display vlan config command to check the VLAN state.
If you add a static route and the route???s state is shown as Down, use the display interface command to verify that the route has an IP interface in the gateway router???s subnet. MSS cannot resolve a static route unless one of the WX switch???s VLANs has an interface in the gateway router???s subnet. If the WX switch has such an interface but the static route is still down, use the display vlan config command to check the state of the VLAN???s ports.
Examples ??? The following command shows all routes in a WX IP route table:
Table 37 describes the fields in this display.
Table 37 Output of display ip route
FieldDescription
Destination/Mask IP address and subnet mask of the route destination.
158 CHAPTER 7: IP SERVICES COMMANDS
Table 37 Output of display ip route (continued)
See Also
??display interface on page 152
??display vlan config on page 118
display ip telnet Shows information about the Telnet management port.
Syntax ??? display ip telnet
Defaults ??? None.
Access ??? All.
History
display ntp 159
Examples ??? The following command shows the status and port number for the Telnet management interface to the WX switch:
WX4400> display ip telnet
Table 38 describes the fields in this display.
Table 38 Output for display ip telnet
Defaults ??? None.
Access ??? All.
History
160 CHAPTER 7: IP SERVICES COMMANDS
Examples ??? To display NTP information for a WX switch, type the following command:
WX4400> display ntp
NTP client: enabled
Current
Current time: Fri Feb 06 2004, 12:02:57
Timezone is set to 'PST', offset from UTC is
Last NTP update: Fri Feb 06 2004, 12:02:46
NTP Server Peer state Local State
192.168.1.5 SYSPEERSYNCED
Table 39 describes the fields in this display.
Table 39 Output for display ntp
Current
display snmp community 161
Table 39 Output for display ntp (continued)
community
Syntax ??? display snmp community
Defaults ??? None.
Access ??? Enabled.
History
162 CHAPTER 7: IP SERVICES COMMANDS
counters
Syntax ??? display snmp counters
Defaults ??? None.
Access ??? Enabled.
History
display snmp notify Displays SNMP notification profiles. profile
Syntax ??? display snmp notify profile
Defaults ??? None.
Access ??? Enabled.
History
See Also
??clear snmp notify profile on page 143
??set snmp notify profile on page 187
display snmp notify Displays SNMP notification targets. target
Syntax ??? display snmp notify target
Defaults ??? None.
Access ??? Enabled.
History
display snmp status 163
See Also
??clear snmp notify target on page 144
??set snmp notify target on page 192
display snmp status Displays SNMP version and status information.
Syntax ??? display snmp status
Defaults ??? None.
Access ??? Enabled.
History
See Also
??set snmp community on page 185
??set snmp notify target on page 192
??set snmp notify profile on page 187
??set snmp protocol on page 197
??set snmp security on page 198
??display snmp community on page 161
??display snmp counters on page 162
??display snmp notify profile on page 162
164 CHAPTER 7: IP SERVICES COMMANDS
Examples ??? To display the summertime setting on a WX, type the following command:
WX1200# display summertime
Recurring : yes, starting at 2:00 am of first Sunday of April and ending at 2:00 am on last Sunday of October.
See Also
??clear summertime on page 145
??display timedate on page 165
display timedate 165
display timedate Shows the date and time of day currently set on a WX
Syntax ??? display timedate
Defaults ??? None.
Access ??? All.
History
Examples ??? To display the time and date set on a WX
WX1200# display timedate
Sun Feb 29 2004, 23:59:02 PST
See Also
??clear summertime on page 145
??display summertime on page 164
??display timezone on page 165
display timezone Displays the time offset for the
Syntax ??? display timezone
Defaults ??? None.
Access ??? All.
History
166 CHAPTER 7: IP SERVICES COMMANDS
ping 167
Because the WX switch adds header information, the ICMP packet size is 8 bytes larger than the size you specify.
??
as the source IP address in the ping packets.
??
uses the IP address configured on the VLAN as the source IP address in the ping packets.
Defaults
??count ??? 5.
??dnf ??? Disabled.
??interval ??? 100 (one tenth of a second)
??size ??? 56.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? To stop a ping command that is in progress, press Ctrl+C.
Examples ??? The following command pings a WX switch that has IP address 10.1.1.1:
See Also
set arp agingtime 169
set arp agingtime Changes the aging timeout for dynamic ARP entries.
Syntax ??? set arp agingtime seconds
??seconds ??? Number of seconds an entry can remain unused before
MSS removes the entry. You can specify from 0 through 1,000,000. To disable aging, specify 0.
Defaults ??? None.
Access ??? Enabled.
History??? Introduced in MSS Version 3.0.
Usage ??? Aging applies only to dynamic entries.
To reset the ARP aging timeout to its default value, use the set arp agingtime 1200 command.
Examples ??? The following command changes the ARP aging timeout to 1800 seconds:
WX1200# set arp agingtime 1800
success: set arp aging time to 1800 seconds
The following command disables ARP aging:
WX1200# set arp agingtime 0
success: set arp aging time to 0 seconds
See Also
170 CHAPTER 7: IP SERVICES COMMANDS
If an interface is already configured on the specified VLAN, this command replaces the interface. If you replace an interface in use as the system IP address, replacing the interface can interfere with system tasks that use the system IP address, including the following:
??Mobility domain operations
??Topology reporting for
??Default source IP address used in unsolicited communications such as AAA accounting reports and SNMP traps
Examples ??? The following command configures IP interface 10.10.10.10/24 on VLAN default:
WX1200# set interface default ip 10.10.10.10/24
success: set ip address 10.10.10.10 netmask 255.255.255.0 on vlan default
The following command configures IP interface 10.10.20.10 255.255.255.0 on VLAN mauve:
WX1200# set interface mauve ip 10.10.20.10 255.255.255.0
success: set ip address 10.10.20.10 netmask 255.255.255.0 on vlan mauve
WX1200# set interface corpvlan ip
172 CHAPTER 7: IP SERVICES COMMANDS
Defaults ??? The DHCP server is enabled by default on a new (unconfigured) WXR100, in order to provide an IP address to the host connected to the WX for access to the Web Quick Start. On all switch models, the DHCP server is enabled and cannot be disabled for directly connected MAPs.
The DHCP server is disabled by default for any other use.
set interface status 173
Access ??? Enabled.
History
Usage ??? By default, all addresses except the host address of the VLAN, the network broadcast address, and the subnet broadcast address are included in the range. If you specify the range, the start address must be lower than the stop address, and all addresses must be in the same subnet. The IP interface of the VLAN must be within the same subnet but is not required to be within the range.
Examples ??? The following command enables the DHCP server on VLAN
WX1200# set interface
success: change accepted.
See Also
??display
??set ip dns domain on page 175
??set ip dns server on page 176
set interface status Administratively disables or reenables an IP interface.
Syntax ??? set interface
??
??up ??? Enables the interface.
??down ??? Disables the interface.
Defaults ??? IP interfaces are enabled by default.
Access ??? Enabled.
History??? Introduced in MSS Version 3.0.
174 CHAPTER 7: IP SERVICES COMMANDS
Examples ??? The following command disables the IP interface on VLAN mauve:
WX4400# set interface mauve status down success: set interface mauve to down
See Also
??display interface on page 152
Syntax ??? set ip alias name
??name ??? String of up to 32 alphanumeric characters, with no spaces.
??
Defaults ??? None.
Access ??? Enabled.
History??? Introduced in MSS Version 3.0.
Examples ??? The following command configures the alias HR1 for IP address 192.168.1.2:
WX4400# set ip alias HR1 192.168.1.2 success: change accepted.
See Also
set ip dns 175
Syntax ??? set ip dns {enable | disable}
??enable ??? Enables DNS.
??disable ??? Disables DNS.
Defaults ??? DNS is disabled by default.
Access ??? Enabled.
History??? Introduced in MSS Version 3.0.
Examples ??? The following command enables DNS on a WX switch:
WX1200# set ip dns enable
Start DNS Client
See Also
??clear ip dns domain on page 139
??clear ip dns server on page 139
??set ip dns domain on page 175
??set ip dns server on page 176
set ip dns domain Configures a default domain name for DNS queries. The WX appends the default domain name to domain names or hostnames you enter in commands.
Syntax ??? set ip dns domain name
??name ??? Domain name of between 1 and 64 alphanumeric characters
with no spaces (for example, example.org).
Defaults ??? None.
Access ??? Enabled.
Usage ??? To override the default domain name when entering a hostname in a CLI command, enter a period at the end of the hostname. For example, if the default domain name is example.com, enter chris. if the fully qualified hostname is chris and not chris.example.com.
176 CHAPTER 7: IP SERVICES COMMANDS
Aliases take precedence over DNS. When you enter a hostname, MSS checks for an alias with that name first, before using DNS to resolve the name.
Examples ??? The following command configures the default domain name example.com:
WX1200# set ip dns domain example.com
Domain name changed
See Also
??clear ip dns domain on page 139
??clear ip dns server on page 139
??set ip dns server on page 176
set ip dns server Specifies a DNS server to use for resolving hostnames you enter in CLI commands.
Syntax ??? set ip dns server
??
notation.
??primary ??? Makes the server the primary server, which MSS always
consults first for resolving DNS queries.
??secondary ??? Makes the server a secondary server. MSS consults a
secondary server only if the primary server does not reply.
Defaults ??? None.
Access ??? Enabled.
Usage ??? You can configure a WX to use one primary DNS server and up to five secondary DNS servers.
Examples ??? The following commands configure a WX to use a primary
DNS server and two secondary DNS servers:
WX1200# set ip dns server 10.10.10.50/24 primary success: change accepted.
WX1200# set ip dns server 10.10.20.69/24 secondary
set ip https server 177
success: change accepted.
WX1200# set ip dns server 10.10.30.69/24 secondary success: change accepted.
See Also
??clear ip dns domain on page 139
??clear ip dns server on page 139
??set ip dns domain on page 175
set ip https server Enables the HTTPS server on a WX. The HTTPS server is required for Web View access to the switch.
CAUTION: If you disable the HTTPS server, Web View access to the WX switch is also disabled.
Syntax ??? set ip https server {enable | disable}
??enable ??? Enables the HTTPS server.
??disable ??? Disables the HTTPS server.
Defaults ??? The HTTPS server is disabled by default.
Access ??? Enabled.
History ??? The default is changed to disabled in 3.1. In addition, the
HTTPS server is no longer required for WebAAA.
Examples ??? The following command enables the HTTPS server on a WX switch:
WX1200# set ip https server enable success: change accepted.
See Also
??display ip https on page 155
178 CHAPTER 7: IP SERVICES COMMANDS
Syntax ??? set ip route {default |
??default ??? Default route. A WX switch uses the default route if an
explicit route is not available for the destination.
Default is an alias for IP address 0.0.0.0/0.
??
destination, in dotted decimal notation (for example, 10.10.10.10 255.255.255.0).
??
format (for example, 10.10.10.10/24).
??gateway ??? IP address, DNS hostname, or alias of the
??metric ??? Cost for using the route. You can specify a value from
0 through 2,147,483,647.
Defaults ??? The HTTPS server is enabled by default.
Access ??? Enabled.
Usage ??? MSS can use a static route only if a direct route in the route table resolves the static route. MSS adds routes with
Before you add a static route, use the display interface command to verify that the WX switch has an IP interface in the same subnet as the route???s
You can configure a maximum of 4 routes per destination. This includes default routes, which have destination 0.0.0.0/0. Each route to a given destination must have a unique gateway address. When the route table contains multiple default or explicit routes to the same destination, MSS uses the route with the lowest cost. If two or more routes to the same destination have the lowest cost, MSS selects the first route in the route table.
set ip route 179
When you add multiple routes to the same destination, MSS groups the routes and orders them from lowest cost at the top of the group to highest cost at the bottom of the group. If you add a new route that has the same destination and cost as a route already in the table, MSS places the new route at the top of the group of routes with the same cost.
Examples ??? The following command adds a default route that uses gateway 10.5.4.1 and gives the route a cost of 1:
WX4400# set ip route default 10.5.4.1 1 success: change accepted.
The following commands add two default routes, and configure MSS to always use the route through 10.2.4.69 when the interface to that gateway router is up:
WX4400# set ip route default 10.2.4.69 1 success: change accepted.
WX4400# set ip route default 10.2.4.17 2 success: change accepted.
The following command adds an explicit route from a WX to any host on the 192.168.4.x subnet through the local router 10.5.4.2, and gives the route a cost of 1:
WX4400# set ip route 192.168.4.0 255.255.255.0 10.5.4.2 1 success: change accepted.
The following command adds another explicit route, using CIDR notation to specify the subnet mask:
WX4400# set ip route 192.168.5.0/24 10.5.5.2 1 success: change accepted.
See Also
180 CHAPTER 7: IP SERVICES COMMANDS
Syntax ??? set ip ssh port
??
Defaults ??? The default SSH port number is 22.
Access ??? Enabled.
History
Examples ??? The following command changes the SSH port number on a WX switch to 6000:
WX4400# set ip ssh port 6000 success: change accepted.
set ip ssh server 181
Syntax ??? set ip telnet
??
182 CHAPTER 7: IP SERVICES COMMANDS
Defaults ??? The default Telnet port number is 23.
Access ??? Enabled.
History
Examples ??? The following command changes the Telnet port number on a WX to 5000:
WX4400# set ip telnet 5000 success: change accepted.
See Also
??display ip https on page 155
??display ip telnet on page 158
??set ip https server on page 177
??set ip telnet server on page 182
set ip telnet server Enables the Telnet server on a WX.
CAUTION: If you disable the Telnet server, Telnet access to the WX is also disabled.
Syntax ??? set ip telnet server {enable | disable}
??enable ??? Enables the Telnet server.
??disable ??? Disables the Telnet server.
Defaults ??? The Telnet server is disabled by default.
Access ??? Enabled.
Usage ??? The maximum number of Telnet sessions supported on a WX is eight. If SSH is also enabled, the WX can have up to eight Telnet or SSH sessions, in any combination, and one console session.
Examples ??? The following command enables the Telnet server on a WX:
WX4400# set ip telnet server enable success: change accepted.
set ntp 183
See Also
??display ip https on page 155
??display ip telnet on page 158
??set ip https server on page 177
Syntax ??? set ntp {enable | disable}
??enable ??? Enables the NTP client.
??disable ??? Disables the NTP client.
Defaults ??? The NTP client is disabled by default.
Access ??? Enabled.
History
Usage ??? If NTP is configured on a system whose current time differs from the NTP server time by more than 10 minutes, convergence of the WX time can take many NTP update intervals. 3Com recommends that you set the time manually to the NTP server time before enabling NTP to avoid a significant delay in convergence.
Examples ??? The following command enables the NTP client:
WX4400# set ntp enable success: NTP Client enabled
See Also
??clear ntp server on page 141
184 CHAPTER 7: IP SERVICES COMMANDS
Syntax ??? set ntp server
??
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? You can configure up to three NTP servers. MSS queries all the servers and selects the best response based on the method described in RFC 1305, Network Time Protocol (Version 3) Specification, Implementation and Analysis.
To use NTP, you also must enable the NTP client with the set ntp command.
Examples ??? The following command configures a WX switch to use
NTP server 192.168.1.5:
WX4400# set ntp server 192.168.1.5
See Also
??clear ntp server on page 141
186CHAPTER 7: IP SERVICES COMMANDS
??
string to get object values on the switch but not to set them. The switch can use the string to send notifications.
??
notifications.
??
string to get and set object values on the switch.
??
using the string to get and set object values on the switch. The switch also can use the string to send notifications.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? SNMP community strings are passed as clear text in SNMPv1 and SNMPv2c. 3Com recommends that you use strings that cannot easily be guessed by unauthorized users. For example, do not use the
If you are using SNMPv3, you can configure SNMPv3 users to use authentication and to encrypt SNMP data.
Examples ??? The following command configures the
WX4400# set snmp community
The following command configures community string switchmgr1 with access level
WX4400# set snmp community name switchmgr1
set snmp notify profile 187
regard to the notifications you specify with
??
??
??
??
??
188CHAPTER 7: IP SERVICES COMMANDS
??
??
??
??
??
??
??
??
??
??
??
??
??
??
??
??
??
??
set snmp notify profile 189
??
??
??
??
??
??
??
??
??
??
??
??
??
??
??
190CHAPTER 7: IP SERVICES COMMANDS
??
??
??
??
??
??
??
??
??
??all ??? Sends or drops all notifications.
Defaults ??? A default notification profile (named default) is already configured on the WX. All notifications in the default profile are dropped by default.
Access ??? Enabled.
History ??? Introduced in MSS Version 4.0.
Examples ??? The following command changes the action in the default notification profile from drop to send for all notification types:
WX1200# set snmp notify profile default send all success: change accepted.
The following commands create notification profile snmpprof_rfdetect, and change the action to send for all RF detection notification types:
set snmp notify profile 191
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectAdhocUserTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectAdhocUserDisappearTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectBlacklistedUserTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectClientViaRogueWiredAPTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectDoSTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectAdhocUserTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectInterferingRogueAPTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectInterferingRogueDisappearTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectRogueAPTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectRogueDisappearTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectSpoofedMacAPTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectSpoofedSsidAPTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectUnAuthorizedAPTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectUnAuthorizedOuiTraps success: change accepted.
WX1200# set snmp notify profile snmpprof_rfdetect send
RFDetectUnAuthorizedSsidTraps success: change accepted.
192 CHAPTER 7: IP SERVICES COMMANDS
set snmp notify target 193
??username ??? USM username. This option is applicable only when the
SNMP version is usm. If the user will send informs rather than traps, you also must specify the
??
{ip | hex
IP address. If the target???s SNMP engine ID is a hexadecimal value, use hex
??profile
will use to specify the notification types to send or drop.
??security ??? Specifies the security level, and is applicable only
{unsecured | when the SNMP version is usm: authenticated | - unsecured ??? Message exchanges are not encrypted} authenticated, nor are they encrypted. This is
the default.
- authenticated ??? Message exchanges are authenticated, but are not encrypted.
- encrypted ??? Message exchanges are authenticated and encrypted.
??retries num ??? Specifies the number of times the MSS SNMP engine
will resend a notification that has not been acknowledged by the target. You can specify from 0 to 3 retries.
??timeout num ??? Specifies the number of seconds MSS waits for
acknowledgement of a notification. You can specify from 1 to 5 seconds.
SNMPv3 with Traps To configure a notification target for traps from SNMPv3, use the following command:
Syntax ??? set snmp notify target
[profile
[security {unsecured | authenticated | encrypted}]
??
does not need to correspond to a value on the target itself. You can specify a number from 1 to 10.
??
specify the UDP port number to send notifications to.
194CHAPTER 7: IP SERVICES COMMANDS
??username ??? USM username. This option is applicable only when the
SNMP version is usm.
??profile
to specify the notification types to send or drop.
??security ??? Specifies the security level, and is applicable only {unsecured | when the SNMP version is usm:
authenticated | - unsecured ??? Message exchanges are not encrypted} authenticated, nor are they encrypted. This is
the default.
- authenticated ??? Message exchanges are authenticated, but are not encrypted.
- encrypted ??? Message exchanges are authenticated and encrypted.
SNMPv2c with To configure a notification target for informs from SNMPv2c, use the Informs following command:
Syntax ??? set snmp notify target
v2c
[timeout num]
??
does not need to correspond to a value on the target itself. You can specify a number from 1 to 10.
??
can specify the UDP port number to send notifications to.
??
??profile
to specify the notification types to send or drop.
??retries num ??? Notification profile this SNMP user will use to specify
the notification types to send or drop.
??timeout num ??? Specifies the number of seconds MSS waits for
acknowledgement of a notification. You can specify from 1 to 5 seconds.
set snmp notify target 195
SNMPv2c with Traps To configure a notification target for traps from SNMPv2c, use the following command:
Syntax ??? set snmp notify target
v2c
[profile
??
does not need to correspond to a value on the target itself. You can specify a number from 1 to 10.
??
can specify the UDP port number to send notifications to.
??
??profile
to specify the notification types to send or drop.
SNMPv1 with Traps To configure a notification target for traps from SNMPv1, use the following command:
Syntax ??? set snmp notify target
v1
??
does not need to correspond to a value on the target itself. You can specify a number from 1 to 10.
??
can specify the UDP port number to send notifications to.
??
??profile
to specify the notification types to send or drop.
Defaults ??? The default UDP port number on the target is 162. The default minimum required security level is unsecured. The default number of retries is 0 and the default timeout is 2 seconds.
Access ??? Enabled.
History ??? Introduced in MSS Version 4.0.
196 CHAPTER 7: IP SERVICES COMMANDS
Usage ??? The inform or trap option specifies whether the MSS SNMP engine expects the target to acknowledge notifications sent to the target by the WX switch. Use inform if you want acknowledgements. Use trap if you do not want acknowledgements. The inform option is applicable to SNMP version v2c or usm only.
Examples ??? The following command configures a notification target for acknowledged notifications:
WX1200# set snmp notify target 1 10.10.40.9 usm inform user securesnmpmgr1
success: change accepted.
This command configures target 1 at IP address 10.10.40.9. The target???s SNMP engine ID is based on its address. The MSS SNMP engine will send notifications based on the default profile, and will require the target to acknowledge receiving them.
The following command configures a notification target for unacknowledged notifications:
WX1200# set snmp notify target 2 10.10.40.10 v1 trap success: change accepted.
See Also
??clear snmp notify target on page 144
??set ip snmp server on page 180
??set snmp community on page 185
??set snmp notify profile on page 187
??set snmp protocol on page 197
set snmp protocol 197
set snmp protocol Enables an SNMP protocol. MSS supports SNMPv1, SNMPv2c, and SNMPv3.
Syntax ??? set snmp protocol {v1 | v2c | usm | all} {enable | disable}
??v1 ??? SNMPv1
??V2c ??? SNMPv2c
??usm ??? SNMPv3 (with the user security model)
??all ??? Enables all supported versions of SNMP.
??enable ??? Enables the specified SNMP version(s).
??disable ??? Disables the specified SNMP version(s).
Defaults ??? All SNMP versions are disabled by default.
Access ??? Enabled.
History
Usage ??? SNMP requires the switch system IP address to be set. SNMP does not work without the system IP address.
You also must enable the SNMP service using the set ip snmp server command.
Examples ??? The following command enables all SNMP versions:
WX1200# set snmp protocol all enable success: change accepted.
See Also
??set ip snmp server on page 180
??set snmp community on page 185
??set snmp notify target on page 192
198 CHAPTER 7: IP SERVICES COMMANDS
set snmp security Sets the minimum level of security MSS requires for SNMP message exchanges.
Syntax ??? set snmp security
{unsecured | authenticated | encrypted |
??unsecured ??? SNMP message exchanges are not secure. This is the
only value supported for SNMPv1 and SNMPv2c.
??authenticated ??? SNMP message exchanges are authenticated but
are not encrypted.
??encrypted ??? SNMP message exchanges are authenticated and
encrypted.
??
authenticated but are not encrypted, and notifications are neither authenticated nor encrypted.
Defaults ??? By default, MSS allows nonsecure (unsecured) SNMP message exchanges.
Access ??? Enabled.
History ??? Introduced in MSS Version 4.0.
Usage ??? SNMPv1 and SNMPv2c do not support authentication or encryption. If you plan to use SNMPv1 or SNMPv2c, leave the minimum level of SNMP security set to unsecured.
Examples ??? The following command sets the minimum level of SNMP security allowed to authentication and encryption:
WX1200# set snmp security encrypted success: change accepted.
See Also
??set ip snmp server on page 180
??set snmp community on page 185
??set snmp notify target on page 192
set snmp usm 199
??local ??? Uses the value computed from the switch???s system IP address.
??access
??
can get (read) object values on the switch but cannot set (write) them.
??
can get object values on the switch but cannot set them. The switch can use the string to send notifications.
200CHAPTER 7: IP SERVICES COMMANDS
??
??
can get and set object values on the switch.
??
the string can get and set object values on the switch. The switch can use the string to send notifications.
??
authenticate communications with the remote SNMP engine. You can specify one of the following:
??
??
??
If the authentication type is md5 or sha, you can specify a passphrase or a hexadecimal key.
??To specify a passphrase, use the
??To specify a key, use the
??
Specifies the encryption type used for SNMP traffic. You can specify one of the following:
??
??
??
??
If the encryption type is des, 3des, or aes, you can specify a passphrase or a hexadecimal key.
??To specify a passphrase, use the
??To specify a key, use the
set snmp usm 201
Defaults ??? No SNMPv3 users are configured by default. When you configure an SNMPv3 user, the default access is
Access ??? Enabled.
History ??? Introduced in MSS Version 4.0.
Examples ??? The following command creates USM user snmpmgr1, associated with the local SNMP engine ID. This user can send traps to notification receivers.
WX#1200 set snmp usm snmpmgr1
The following command creates USM user securesnmpmgr1, which uses SHA authentication and 3DES encryption with passphrases. This user can send informs to the notification receiver that has engine ID 192.168.40.2.
WX4400# set snmp usm securesnmpmgr1
See Also
??set ip snmp server on page 180
??set snmp community on page 185
??set snmp notify target on page 192
??set snmp notify profile on page 187
??set snmp protocol on page 197
202 CHAPTER 7: IP SERVICES COMMANDS
set summertime Offsets the
Syntax ??? set summertime
??
describes the summertime offset. You can use a standard name or any name you like.
??start ??? Start of the time change period.
??week ??? Week of the month to start or end the time change. Valid
values are first, second, third, fourth, or last.
??weekday ??? Day of the week to start or end the time change. Valid
values are sun, mon, tue, wed, thu, fri, and sat.
??month ??? Month of the year to start or end the time change. Valid
values are jan, feb, mar, apr, may, jun, jul, aug, sep, oct, nov, and dec.
??hour ??? Hour to start or end the time change ??? a value between 0
and 23 on the
??min ??? Minute to start or end the time change ??? a value between 0
and 59.
??end ??? End of the time change period.
Defaults ??? If you do not specify a start and end time, the system implements the time change starting at 2:00 a.m. on the first Sunday in April and ending at 2:00 a.m. on the last Sunday in October, according to the North American standard.
Access ??? Enabled.
History
Usage ??? You must first set the time zone with the set timezone command for the offset to work properly without the start and end values.
Configure summertime before you set the time and date. Otherwise, summertime???s adjustment of the time will make the time incorrect, if the date is within the summertime period.
set system
Syntax ??? set system
??
be configured on one of the WX VLANs.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? You must use an address that is configured on one of the WX switch VLANs.
To display the system IP address, use the display system command.
204 CHAPTER 7: IP SERVICES COMMANDS
Examples ??? The following commands configure an IP interface on
VLAN taupe and configure the interface to be the system IP address:
WX4400# set interface taupe ip 10.10.20.20/24
success: set ip address 10.10.20.20 netmask 255.255.255.0 on vlan taupe WX4400# set system
success: change accepted.
See Also
??clear system
Syntax ??? set timedate {date mmm dd yyyy [time hh:mm:ss]}
?? date mmm dd yyyy ??? System date:
??mmm ??? month
??dd ??? day
??yyyy ??? year
??time hh:mm:ss ??? System time, in hours, minutes, and seconds.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? The day of week is automatically calculated from the day that you set. The time displayed by the CLI after you type the command might be slightly later than the time you enter due to the interval between when you press Enter and when the CLI reads and displays the new time and date.
Configure summertime before you set the time and date. Otherwise, the summertime adjustment makes the time incorrect, if the date is within the summertime period.
These values are also used by Network Time Protocol (NTP), if it is enabled.
Syntax ??? set timezone
??
can use a standard name or any name you like.
??- (minus sign) ??? Minus time to indicate hours (and minutes) to be
subtracted from UTC. Otherwise, hours and minutes are added by default.
??hours ??? Number of hours to add or subtract from UTC.
??minutes ??? Number of minutes to add or subtract from UTC.
Defaults ??? If this command is not used, then the default time zone is
UTC.
Access ??? Enabled.
History
206 CHAPTER 7: IP SERVICES COMMANDS
Examples ??? To set the time zone for Pacific Standard Time (PST), type the following command:
WX1200# set timezone PST
Timezone is set to 'PST', offset from UTC is
See Also
??clear summertime on page 145
??display summertime on page 164
??display timedate on page 165
??display timezone on page 165
Syntax ??? telnet
??
??hostname ??? Hostname of the remote device.
??port
remote device listens for Telnet connections.
Defaults ??? MSS attempts to establish Telnet connections with TCP port 23 by default.
Access ??? Enabled.
History
Usage ??? To end a Telnet session from the remote device, press Ctrl+t or type quit or logout in the management session on the remote device. To end a client session from the local WX switch, use the clear sessions telnet client command.
If the configuration of the WX switch from which you enter the telnet command has an ACL that denies Telnet client traffic, the ACL also denies access by the telnet command.
traceroute 207
Examples ??? In the following example, an administrator establishes a Telnet session with another device and enters a command on the remote device:
WX4400# telnet 10.10.10.90
Session 0 pty tty2.d Trying 10.10.10.90...
Connected to 10.10.10.90
Disconnect character is '^t'
Copyright (c) 2004 3Com Corporation. All rights reserved.
When the administrator presses Ctrl+t to end the Telnet connection, the management session returns to the local prompt:
WX1200#
See Also
??display sessions on page 616
Syntax ??? traceroute host [dnf]
??host ??? IP address, hostname, or alias of the destination host. Specify
the IP address in dotted decimal notation.
208CHAPTER 7: IP SERVICES COMMANDS
??dnf ??? Sets the Do Not Fragment bit in the ping packet to prevent the
packet from being fragmented.
??
to the destination host.
??port
probes.
??queries num ??? Number of probes per hop.
??size size ??? Probe packet size in bytes. You can specify from 40
through 1,460.
??ttl hops ??? Maximum number of hops, which can be from 1 through
255.
??wait ms ??? Probe wait in milliseconds. You can specify from 1 through
100,000.
Defaults
??dnf ??? Disabled
??
??port ??? 33434
??queries ??? 3
??size ??? 38
??ttl ??? 30
??wait ??? 5000
Access ??? All.
History
Usage ??? To stop a traceroute command that is in progress, press
Ctrl+C.
Examples ??? The following example traces the route to host server1:
WX4400# traceroute server1
traceroute to server1.example.com (192.168.22.7), 30 hops max, 38 byte packets 1
2
4 server1.example.com (192.168.22.7) 3 ms * 2 ms
traceroute 209
The first row of the display indicates the target host, the maximum number of hops, and the packet size. Each numbered row displays information about one hop. The rows are displayed in the order in which the hops occur, beginning with the hop closest to the WX switch.
The row for a hop lists the total time in milliseconds for each ICMP packet to reach the router or host, plus the time for the ICMP Time Exceeded message to return to the host.
An exclamation point (!) following any of these values indicates that the Port Unreachable message returned by the destination has a maximum hop count of 0 or 1. This can occur if the destination uses the maximum hop count value from the arriving packet as the maximum hop count in its ICMP reply. The reply does not arrive at the source until the destination receives a traceroute packet with a maximum hop count equal to the number of hops between the source and destination.
An asterisk (*) indicates that the timeout period expired before MSS received a Time Exceeded message for the packet.
If Traceroute receives an ICMP error message other than a Time Exceeded or Port Unreachable message, MSS displays one of the error codes described in Table 40 instead of displaying the
Table 40 describes the traceroute error messages.
Table 40 Error messages for traceroute
See Also
210 CHAPTER 7: IP SERVICES COMMANDS
Use authentication, authorization, and accounting (AAA) commands to provide a secure network connection and a record of user activity. Location policy commands override any virtual LAN (VLAN) or security ACL assignment by AAA or the local WX database to help you control access locally.
(Security ACLs are packet filters. For command descriptions, see Chapter 14.)
212 CHAPTER 8: AAA COMMANDS
Table 41 AAA Commands by Usage (continued)
clear accounting 213
Table 41 AAA Commands by Usage (continued)
clear accounting Removes accounting services for specified wireless users with administrative access or network access.
Syntax ??? clear accounting {admin | dot1x}
??admin ??? Users with administrative access to the WX through a
console connection or through a Telnet or Web View connection.
??dot1x ??? Users with network access through the WX. Users with
network access are authorized to use the network through either an IEEE 802.1X method or their media access control (MAC) address.
??
network access.
Specify a username, use the
Defaults ??? None.
Access ??? Enabled.
History
clear authentication console 215
Syntax ??? clear authentication console
??
Specify a username, use the
Defaults ??? None.
Access ??? Enabled.
History
The syntax descriptions for the clear authentication commands are separate for clarity. However, the options and behavior for the clear authentication console command are the same as in previous releases.
Examples ??? The following command clears authentication for administrator Regina:
WX4400# clear authentication console Regina
success: change accepted.
See Also
??clear authentication admin on page 214
216CHAPTER 8: AAA COMMANDS
??clear authentication mac on page 217
??clear authentication proxy on page 218
??set authentication console on page 241
clear authentication Removes an 802.1X authentication rule. dot1x
Syntax ??? clear authentication dot1x {ssid
??ssid
applies.
??wired ??? Clears a rule used for access over a WX
port.
??
access.
Specify a username, use the
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command removes 802.1X authentication for network users with usernames ending in @thiscorp.com who try to access SSID finance:
WX4400# clear authentication dot1x ssid finance *@thiscorp.com
See Also
??clear authentication admin on page 214
??clear authentication console on page 215
clear authentication mac 217
??clear authentication proxy on page 218
??set authentication dot1x on page 243
clear authentication Removes a MAC authentication rule. mac
Syntax ??? clear authentication mac {ssid
??ssid
??wired ??? Clears a rule used for access over a WX
port.
??
address. Specify a MAC address, or use the wildcard (*) character to specify a set of MAC addresses. (For details, see ???MAC Address Globs??? on page 31.)
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command removes a MAC authentication rule for access to SSID thatcorp by MAC addresses beginning with aa:bb:cc:
WX4400# clear authentication mac ssid thatcorp aa:bb:cc:*
See Also
??clear authentication admin on page 214
??clear authentication console on page 215
??clear authentication dot1x on page 216
??clear authentication mac on page 217
218 CHAPTER 8: AAA COMMANDS
clear authentication Removes a proxy rule for
Syntax ??? clear authentication proxy ssid
??ssid
applies.
??
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command removes the proxy rule for SSID mycorp and userglob **:
WX4400# clear authentication proxy ssid mycorp
See Also
??set authentication proxy on page 253
clear authentication Removes a WebAAA rule. web
Syntax ??? clear authentication web {ssid
??
??
ssid
wired ??? Clears a rule used for access over a WX switch???s
???
Defaults ??? None.
Access ??? Enabled.
History
clear location policy 219
Examples ??? The following command removes WebAAA for SSID research and userglob temp*@thiscorp.com:
WX4400# clear authentication web ssid research temp*@thiscorp.com
See Also
??clear authentication admin on page 214
??clear authentication console on page 215
??clear authentication dot1x on page 216
??clear authentication mac on page 217
??clear authentication mac on page 217
??set authentication web on page 254
clear location policy Removes a rule from the location policy on a WX switch.
Syntax ??? clear location policy
??
from the location policy.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To determine the index numbers of location policy rules, use the display location policy command. Removing all the ACEs from the location policy disables this function on the WX switch.
Examples ??? The following command removes location policy rule 4 from an WX switch???s location policy:
WX4400# clear location policy 4 success: clause 4 is removed.
220 CHAPTER 8: AAA COMMANDS
Syntax ??? clear
??
separated by colons (:). You can omit leading zeros.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? Deleting a MAC user???s profile from the database deletes the assignment of any attributes in the profile to the user.
Examples ??? The following command removes the user profile for a user at MAC address 01:02:03:04:05:06:
WX4400# clear
See Also
clear
clear
(To remove an authorization attribute in RADIUS, see the documentation for your RADIUS server.)
Syntax ??? clear
??
separated by colons (:). You can omit leading zeros.
??
user for a particular service or session characteristic. (For a list of authorization attributes, see Table 44 on page 262.)
Syntax ??? clear
??
separated by colons (:). You can omit leading zeros.
Defaults ??? None.
222 CHAPTER 8: AAA COMMANDS
Syntax ??? clear
??
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To remove a user from a MAC user group, use the clear
Examples ??? The following command deletes the MAC user group eastcoasters from the local database:
WX4400# clear
224 CHAPTER 8: AAA COMMANDS
Syntax ??? clear user username
??username ??? Username of a user with a password.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? Deleting the user profile from the database deletes the assignment of any profile attributes to the user.
clear user attr 225
Syntax ??? clear user username attr
??username ??? Username of a user with a password.
??
for a particular service or session characteristic. (For a list of authorization attributes, see Table 44 on page 262.)
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command removes the
WX4400# clear user Hosni attr
See Also
226 CHAPTER 8: AAA COMMANDS
clear user group Removes a user with a password from membership in a user group in the local database on the WX.
(To remove a user from a user group in RADIUS, see the documentation for your RADIUS server.)
Syntax ??? clear user username group
??username ??? Username of a user with a password.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? Removing the user from the group removes the group name from the user profile, but does not delete either the user or the user group from the local WX database. To remove the group, use clear usergroup.
Examples ??? The following command removes the user Nin from a user group:
WX4400# clear user Nin group success: change accepted.
See Also
clear user lockout Restores access to a user who has been locked out of the system due to an expired password or exceeding the maximum number of failed
login attempts.
Syntax ??? clear user username lockout
Defaults ??? None.
Access ??? Enabled.
clear usergroup 227
Syntax ??? clear usergroup
??
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? Removing a user group from the local WX database does not remove the user profiles of the group members from the database.
Examples ??? The following command deletes the cardiology user group from the local database:
WX4400# clear usergroup cardiology success: change accepted.
228 CHAPTER 8: AAA COMMANDS
See Also
??clear usergroup attr on page 228
clear usergroup attr Removes an authorization attribute from a user group in the local database on the WX.
(To remove an authorization attribute in RADIUS, see the documentation for your RADIUS server.)
Syntax ??? clear usergroup
??
??
users in the group for a particular service or session characteristic. (For a list of authorization attributes, see Table 44 on page 262.)
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command removes the members of the user group cardiology from a network access time restriction by deleting the
WX4400# clear usergroup cardiology attr
See Also
display aaa 229
Examples ??? To display all current AAA settings, type the following command:
Server groups sg1:
Web Portal: enabled
set authentication admin Jose sg3 set authentication console * none
set authentication mac ssid mycorp * local
set authentication dot1x ssid mycorp Geetha
set authentication dot1x ssid mycorp *
set accounting admin Natasha
user Nin
Password = 082c6c64060b (encrypted)
230 CHAPTER 8: AAA COMMANDS
user
user
Table 42 describes the fields that can appear in display aaa output.
Table 42 display aaa Output
See Also
??set accounting {admin | console} on page 235
??set authentication admin on page 239
??set authentication console on page 241
??set authentication dot1x on page 243
??set authentication mac on page 247
232 CHAPTER 8: AAA COMMANDS
display accounting statistics 233
AAA_ACCT_SVC_ATTR=2
AAA_VLAN_NAME_ATTR=default
Table 43 describes the fields that can appear in display accounting statistics output.
Table 43 display accounting statistics Output
234 CHAPTER 8: AAA COMMANDS
Table 43 display accounting statistics Output (continued)
Examples ??? The following command displays the list of location policy rules in the location policy on an WX switch:
WX4400 display location policy
Id Clauses
1)deny if user eq *.theirfirm.com
2)permit vlan guest_1 if vlan neq *.wodefirm.com
3)permit vlan bld4.tac inacl tac_24.in if user eq *.ny.wodefirm.com
See Also
Syntax ??? set accounting {admin | console}
?? admin ??? Users with administrative access to the WX switch through Telnet or Web View.
?? console ??? Users with administrative access to the WX switch through a console connection.
??
236CHAPTER 8: AAA COMMANDS
??Specify a username, use the
This option does not apply if mac is specified. For mac, specify a
??
network session.
??
session.
??method1, method2, method3, method4 ??? At least one of up to four
methods that MSS uses to process accounting records. Specify one or more of the following methods in priority order. If the first method does not succeed, MSS tries the second method, and so on.
A method can be one of the following:
??local ??? Stores accounting records in the local database on the
WX switch. When the local accounting storage space is full, MSS overwrites older records with new ones.
??
Remote Authentication
Defaults ??? Accounting is disabled for all users by default.
Access ??? Enabled.
History
Usage ??? For network users with
Examples ??? The following command issues
WX4400# set accounting admin Natasha
set accounting {dot1x | mac | web |
Sets up accounting services for specified wireless users with network access, and defines the accounting records and where they are sent.
Syntax ??? set accounting {dot1x | mac | web |
[method4]
??dot1x ??? Users with network access through the WX switch who are
authenticated by 802.1X.
??mac ??? Users with network access through the WX switch who are
authenticated by MAC authentication
??web ??? Users with network access through the WX switch who are
authenticated by WebAAA
??ssid
To apply the rule to all SSIDs, type any.
??wired ??? Applies this accounting rule specifically to users who are
authenticated on a wired authentication port.
??
network access.
Specify a username, use the
This option does not apply if mac or
??
address. Specify a MAC address, or use the wildcard (*) character to specify a set of MAC addresses. (For details, see ???MAC Address Globs??? on page 31.)
This option applies only when mac is specified.
238CHAPTER 8: AAA COMMANDS
??
??
??method1, method2, method3, method4 ??? At least one of up to four methods that MSS uses to process accounting records. Specify one or more of the following methods in priority order. If the first method does not succeed, MSS tries the second method, and so on.
A method can be one of the following:
??local ??? Stores accounting records in the local database on the
WX switch. When the local accounting storage space is full, MSS overwrites older records with new ones.
??
Remote Authentication
Defaults ??? Accounting is disabled for all users by default.
Access ??? Enabled.
History
Usage ??? For network users with
Examples ??? The following command issues
WX4400# set accounting dot1x Nin
See Also
set authentication admin 239
240 CHAPTER 8: AAA COMMANDS
History
The syntax descriptions for the set authentication commands are separated for clarity. However, the options and behavior for the set authentication admin command are the same as in previous releases.
Usage ??? You can configure different authentication methods for different groups of users. (For details, see ???User Globs, MAC Address Globs, and VLAN Globs??? on page 30.)
If you specify multiple authentication methods in the set authentication console command, MSS applies them in the order that they appear in the command, with these results:
If the first method responds with pass or fail, the evaluation is final.
If the first method does not respond, MSS tries the second method, and so on.
However, if local appears first, followed by a RADIUS server group, MSS ignores any failed searches in the local WX database and sends an authentication request to the RADIUS server group.
If a AAA rule specifies local as a secondary AAA method, to be used if the RADIUS servers are unavailable, and MSS authenticates a client with the local method, MSS starts again at the beginning of the method list when attempting to authorize the client. This can cause unexpected delays during client processing and can cause the client to time out before completing logon.
Examples ??? The following command configures administrator Jose, who connects via Telnet, for authentication on RADIUS server group sg3:
WX4400# set authentication admin Jose sg3 success: change accepted.
See Also
??clear authentication admin on page 214
??set authentication console on page 241
242 CHAPTER 8: AAA COMMANDS
Defaults ??? By default, authentication is deactivated for all console users, and the default authentication method in a console authentication rule is none. MSS requires no username or password, by default. These users can press Enter at the prompts for administrative access.
It is recommended that you change the default setting unless the WX is in a secure physical location.
Access ??? Enabled.
History
The syntax description for the set authentication commands are separated for clarity. However, the options and behavior for the set authentication console command are the same as in previous releases.
Usage ??? You can configure different authentication methods for different groups of users. (For details, see ???User Globs, MAC Address Globs, and VLAN Globs??? on page 30.)
If you specify multiple authentication methods in the set authentication console command, MSS applies them in the order in which they appear in the command, with these results:
If the first method responds with pass or fail, the evaluation is final.
If the first method does not respond, MSS tries the second method, and so on.
However, if local appears first, followed by a RADIUS server group, MSS ignores any failed searches in the local WX database and sends an authentication request to the RADIUS server group.
Examples ??? To set the console port so that it does not enforce
WX4400# set authentication console * none success: change accepted.
See Also
set authentication dot1x 243
??set authentication admin on page 239
??set authentication dot1x on page 243
??set authentication mac on page 247
??set authentication mac on page 247
??set authentication web on page 254
set authentication Configures authentication and defines how it is performed for specified dot1xwireless or wired authentication clients who use an IEEE 802.1X
authentication protocol to access the network through the WX.
Syntax ??? set authentication dot1x {ssid
??ssid
applies. To apply the rule to all SSIDs, type any.
??wired ??? Applies this authentication rule specifically to users
connected to a wired authentication port.
??
access.
Specify a username, use the
??bonded ??? Enables Bonded Auth??? (bonded authentication). When
this feature is enabled, MSS authenticates the user only if the computer the user is on has already been authenticated.
??protocol ??? Protocol used for authentication. Specify one of the
following:
??
Uses
Provides no encryption or integrity checking for the connection
??
244 CHAPTER 8: AAA COMMANDS
Provides mutual authentication,
Requires X.509 public key certificates on both sides of the connection
Provides encryption and integrity checking for the connection
Cannot be used with RADIUS server authentication (requires user information to be in the WX local database)
??
Handshake Authentication Protocol version 2
Uses TLS for encryption and data integrity checking and
Provides
Only the server side of the connection needs a certificate.
The wireless client authenticates using TLS to set up an encrypted session. Then
??
RADIUS server.
??method1, method2, method3, method4 ??? At least one and up to four
methods that MSS uses to handle authentication. Specify one or more of the following methods in priority order. MSS applies multiple methods in the order you enter them.
A method can be one of the following:
??local ??? Uses the local database of usernames and user groups on
the WX switch for authentication.
??
for authentication. You can enter up to four names of existing RADIUS server groups as methods.
RADIUS servers cannot be used with the
set authentication dot1x 245
Defaults ??? By default, authentication is unconfigured for all clients with network access through MAP ports or wired authentication ports on the WX switch. Connection, authorization, and accounting are also disabled for these users.
Bonded authentication is disabled by default.
Access ??? Enabled.
History
Usage ??? You can configure different authentication methods for different groups of users by ???globbing.??? (For details, see ???User Globs??? on page 30.)
You can configure a rule either for wireless access to an SSID, or for wired access through a WX wired authentication port. If the rule is for wireless access to an SSID, specify the SSID name or specify any to match on all SSID names. If the rule is for wired access, specify wired instead of an SSID name.
You cannot configure client authentication that uses both
If you specify multiple authentication methods in the set authentication dot1x command, MSS applies them in the order in which they appear in the command, with these results:
If the first method responds with pass or fail, the evaluation is final.
If the first method does not respond, MSS tries the second method, and so on.
However, if local appears first, followed by a RADIUS server group, MSS overrides any failed searches in the local WX database and sends an authentication request to the server group.
If the user does not support 802.1X, MSS attempts to perform MAC authentication for the user. In this case, if the WX configuration contains a set authentication mac command that matches the SSID the user is attempting to access and the user MAC address, MSS uses the method specified by the command. Otherwise, MSS uses local MAC authentication by default.
246 CHAPTER 8: AAA COMMANDS
If the username does not match an authentication rule for the SSID the user is attempting to access, MSS uses the fallthru authentication type configured for the SSID, which can be
Examples ??? The following command configures
WX4400# set authentication dot1x ssid mycorp Geetha
success: change accepted.
The following command configures
WX4400# set authentication dot1x ssid examplecorp *@example.com
success: change accepted.
See Also
??clear authentication dot1x on page 216
??set authentication admin on page 239
??set authentication console on page 241
??set authentication mac on page 247
??set authentication mac on page 247
set authentication mac 247
set authentication Configures authentication and defines where it is performed for specified macnon-802.1X users with network access through a media access control
(MAC) address.
Syntax ??? set authentication mac
{ssid
[method2] [method3] [method4]
??ssid
applies. To apply the rule to all SSIDs, type any.
??wired ??? Applies this authentication rule specifically to users
connected to a wired authentication port.
??
address. Specify a MAC address, or use the wildcard (*) character to specify a set of MAC addresses. (For details, see ???MAC Address Globs??? on page 31.)
??method1, method2, method3, method4 ??? At least one of up to four
methods that MSS uses to handle authentication. Specify one or more of the following methods in priority order. MSS applies multiple methods in the order you enter them.
A method can be one of the following:
??local ??? Uses the local database of usernames and user groups on
the WX switch for authentication.
??
for authentication. You can enter up to four names of existing RADIUS server groups as methods.
For more information, see ???Usage.???
Defaults ??? By default, authentication is deactivated for all MAC users, which means MAC address authentication fails by default. When using RADIUS for authentication, the default password for a MAC user is the MAC address of the user.
Access ??? Enabled.
History
Usage ??? You can configure different authentication methods for different groups of MAC addresses by ???globbing.??? (For details, see ???User Globs, MAC Address Globs, and VLAN Globs??? on page 30.)
248 CHAPTER 8: AAA COMMANDS
If you specify multiple authentication methods in the set authentication mac command, MSS applies them in the order in which they appear in the command, with these results:
If the first method responds with pass or fail, the evaluation is final.
If the first method does not respond, MSS tries the second method, and so on.
However, if local appears first, followed by a RADIUS server group, MSS ignores any failed searches in the local WX database and sends an authentication request to the RADIUS server group.
If the WX configuration contains a set authentication mac command that matches the SSID the user is attempting to access and the user MAC address, MSS uses the method specified by the command. Otherwise, MSS uses local MAC authentication by default.
If the username does not match an authentication rule for the SSID the user is attempting to access, MSS uses the fallthru authentication type configured for the SSID, which can be
Examples ??? To use the local WX database to authenticate all users who access the mycorp2 SSID by their MAC address, type the following command:
WX4400# set authentication ssid mycorp2 mac ** local success: change accepted.
See Also
??clear authentication mac on page 217
??set authentication admin on page 239
??set authentication console on page 241
??set authentication dot1x on page 243
set authentication
See Also
??clear user lockout on page 226
250 CHAPTER 8: AAA COMMANDS
See Also
??clear user lockout on page 226
set authentication
set authentication
Specifies the minimum allowable length for user passwords.
Syntax ??? set authentication
??length ??? Minimum number of characters that can be in a user
password. You can specify a minimum password length between 0
??? 32 characters. Specifying 0 removes the restriction on password
length.
Defaults ??? By default, there is no minimum length for user passwords.
Access ??? Enabled.
History ??? Introduced in MSS 6.0.
Usage ??? Use this command to specify the minimum length for user
passwords. When this command is configured, you cannot configure a password shorter than the specified length.
When you enable this command, MSS evaluates the passwords configured on the WX and displays a list of users whose password does not meet the minimum length restriction.
Examples ??? To set the minimum length for user passwords at 7 characters, type the following command:
WX# set authentication
Warning: The following users have passwords that are shorter than the minimum password length:
dan admin user2 goofball
success: change accepted.
See Also
??clear user lockout on page 226
252 CHAPTER 8: AAA COMMANDS
set authentication Activates password restrictions for network and administrative users.
Syntax ??? set authentication
??enable ??? Enables password restrictions on the WX.
??disable ??? Disables password restrictions on the WX.
Defaults ??? By default the password restrictions are disabled.
Access ??? Enabled.
History
Usage ??? When this command is enabled, the following password restrictions take effect:
Passwords must be a minimum of 10 characters in length, and a mix of uppercase letters, lowercase letters, numbers, and special characters, including at least two of each (for example, Tre%Pag32!).
A user cannot reuse any of his or her 10 previous passwords (not applicable to network users).
When a user changes his or her password, at least 4 characters must be different from the previous password.
When you enable the password restrictions, MSS evaluates the passwords configured on the WX switch and displays a list of users whose password does not meet the restriction on length and character types.
Examples ??? To enable password restrictions on the WX switch, type the following command:
WX# set authentication
warning: the following users have passwords that do not have at least 2 each of
dan admin user1 user2 goofball dang
success: change accepted.
WX4400# set authentication proxy ssid mycorp ** srvrgrp1
254 CHAPTER 8: AAA COMMANDS
See Also
??clear authentication proxy on page 218
??set radius proxy client on page 585
??set radius proxy port on page 586
set authentication Configures an authentication rule to allow a user to log in to the network webusing a web page served by the WX. The rule can be activated if the user
is not otherwise granted or denied access by 802.1X, or granted access by MAC authentication.
Syntax ??? set authentication web {ssid
??
Specify a username, use the
??ssid
applies. To apply the rule to all SSIDs, type any.
??wired ??? Applies this authentication rule specifically to users
connected to a wired authentication port.
??method1, method2, method3, method4 ??? At least one and up to four
methods that MSS uses to handle authentication. Specify one or more of the following methods in priority order. MSS applies multiple methods in the order you enter them.
A method can be one of the following:
??local ??? Uses the local database of usernames and user groups on
the WX switch for authentication.
??
for authentication. You can enter up to four names of existing RADIUS server groups as methods.
RADIUS servers cannot be used with the
For more information, see ???Usage.???
set authentication web 255
Defaults ??? By default, authentication is unconfigured for all clients with network access through MAP ports or wired authentication ports on the WX switch. Connection, authorization, and accounting are also disabled for these users.
Access ??? Enabled.
History
Usage ??? You can configure different authentication methods for different groups of users by ???globbing.??? (For details, see ???User Globs??? on page 30.)
You can configure a rule either for wireless access to an SSID, or for wired access through a WX wired authentication port. If the rule is for wireless access to an SSID, specify the SSID name or specify any to match on all SSID names. If the rule is for wired access, specify wired instead of an SSID name.
If you specify multiple authentication methods in the set authentication web command, MSS applies them in the order in which they appear in the command, with these results:
If the first method responds with pass or fail, the evaluation is final.
If the first method does not respond, MSS tries the second method, and so on.
However, if local appears first, followed by a RADIUS server group, MSS overrides any failed searches in the local WX database and sends an authentication request to the server group.
MSS uses a WebAAA rule only under the following conditions:
The client is not denied access by 802.1X or does not support 802.1X.
The client MAC address does not match a MAC authentication rule.
The fallthru method is web. (For a wireless authentication rule, the fallthru method is specified by the set
256 CHAPTER 8: AAA COMMANDS
Examples ??? The following command configures a WebAAA rule in the local WX database for SSID ourcorp and userglob rnd*:
WX4400# set authentication web ssid ourcorp rnd* local success: change accepted.
See Also
??clear authentication proxy on page 218
??set authentication admin on page 239
??set authentication console on page 241
??set authentication dot1x on page 243
??set authentication mac on page 247
set location policy Creates and enables a location policy on a WX. The location policy enables you to locally set or change authorization attributes for a user after the user is authorized by AAA, without making changes to the AAA server.
Syntax ??? set location policy deny if {ssid operator
| vlan operator
Syntax ??? set location policy permit
{vlan
if {ssid operator
[before
??deny ??? Denies access to the network to users with attributes that
match the location policy rule.
??permit ??? Allows access to the network or to a specified VLAN,
and/or assigns a particular security ACL to users with attributes matching match the location policy rule.
??Action options ??? For a permit rule, MSS changes the attributes
assigned to the user to the values specified by the following options:
??vlan
attributes matching the location policy rule.
set location policy 257
??inacl
packets sent to the WX with attributes matching the location policy rule.
Optionally, you can add the suffix .in to the name.
??outacl
packets sent from the WX with attributes matching the location policy rule.
Optionally, you can add the suffix .out to the name.
??Condition options ??? MSS takes the action specified by the rule if
all conditions in the rule are met. You can specify one or more of the following conditions:
??ssid operator
The operator must be eq, which applies the location policy rule to all users associated with the SSID. Asterisks (wildcards) are not supported in SSID names. You must specify the complete SSID name.
??vlan operator
and condition that determines if the location policy rule applies. Replace operator with one of the following operands:
??eq ??? Applies the location policy rule to all users assigned VLAN
names matching
??neq ??? Applies the location policy rule to all users assigned VLAN
names not matching
For
(.). (For details, see ???VLAN Globs??? on page 32.)
??user operator
determines if the location policy rule applies. Replace operator with one of the following operands:
??eq ??? Applies the location policy rule to all usernames matching
??neq ??? Applies the location policy rule to all usernames not
matching
258 CHAPTER 8: AAA COMMANDS
For
??before
another rule in the location policy. Specify the number of the existing location policy rule. (To determine the number, use the display location policy command.)
??modify
the new rule. Specify the number of the existing location policy rule. (To determine the number, use the display location policy command.)
??port
location policy rule applies.
Defaults ??? By default, users are permitted VLAN access and assigned security ACLs according to the
Access ??? Enabled.
History
Version 3.2.
Usage ??? Only a single location policy is allowed per WX switch. Once configured, the location policy becomes effective immediately. To disable location policy operation, use the clear location policy command.
Conditions within a rule are AND???ed. All conditions in the rule must match for MSS to take the specified action. If the location policy contains multiple rules, MSS compares the user information to the rules one at a time, in the order the rules appear in the WX configuration file, beginning with the rule at the top of the list. MSS continues comparing until a user matches all conditions in a rule or until there are no more rules.
The order of rules in the location policy is important to ensure users are properly granted or denied access. To position rules within the location policy, use before
set location policy 259
When applying security ACLs:
Use inacl
Use outacl
You can optionally add the suffixes .in and .out to
Examples ??? The following command denies network access to all users at *.theirfirm.com, causing them to fail authorization:
WX4400# set location policy deny if user eq *.theirfirm.com
The following command authorizes access to the guest_1 VLAN for all users who are not at *.wodefirm.com:
WX4400# set location policy permit vlan guest_1 if user neq *.wodefirm.com
The following command authorizes users at *.ny.ourfirm.com to access the bld4.tac VLAN instead, and applies the security ACL tac_24 to the traffic they receive:
WX4400# set location policy permit vlan bld4.tac outacl tac_24 if user eq *.ny.ourfirm.com
The following command authorizes access to users on VLANs with names matching bld4.* and applies security ACLs svcs_2 to the traffic they send and svcs_3 to the traffic they receive:
WX4400# set location policy permit inacl svcs_2 outacl svcs_3 if vlan eq bldg4.*
The following command authorizes users entering the network on WX ports 1 and 2 to use the floor2 VLAN, overriding any settings from AAA:
WX4400# set location policy permit vlan floor2 if port
260 CHAPTER 8: AAA COMMANDS
Syntax ??? set
??
separated by colons (:). You can omit leading zeros.
??
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? MSS does not require MAC users to belong to user groups.
Users authenticated by MAC address are authenticated only for network access through the WX. MSS does not support passwords for MAC users.
Examples ??? The following command creates a user profile for a user at MAC address 01:02:03:04:05:06 and assigns the user to the eastcoasters user group:
WX4400# set
set
See Also
set
(To assign authorization attributes through RADIUS, see the documentation for your RADIUS server.)
Syntax ??? set
??
separated by colons (:). You can omit leading zeros.
??
authorize a MAC user for a particular service or session characteristic. For a list of authorization attributes and values that you can assign to local users, see Table 44.
262 CHAPTER 8: AAA COMMANDS
Table 44 Authentication Attributes for Local Users
You can use
264 CHAPTER 8: AAA COMMANDS
Table 44 Authentication Attributes for Local Users (continued)
Date and time, in the following format:
You can use
set
Table 44 Authentication Attributes for Local Users (continued)
(network access mode only)
Day(s) and time(s) during which the user is permitted to log into the network.
After authorization, the user session can last until either the
One of the following:
??
??
??
??One or more ranges of values that consist of one of the following day designations (required), and a time range in
Separate values or a series of ranges (except time ranges) with commas (,) or a vertical bar (|). Do not use spaces.
The maximum number of characters is 253.
For example, to allow access only on Tuesdays and Thursdays between 10 a.m. and 4 p.m., specify the following:
To allow access only on weekdays between 9 a.m and 5 p.m., and on Saturdays from 10 p.m. until 2 a.m., specify the following:
(Also see the examples for set user attr on page 273.)
You can use
266 CHAPTER 8: AAA COMMANDS
Table 44 Authentication Attributes for Local Users (continued)
to use the standard RADIUS attribute
updates, if
Number between 180 and 3,600 seconds, or 0 to disable periodic accounting updates.
The WX ignores the
If both a RADIUS server and the WX supply a value for the
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To change the value of an attribute, enter set
set
You can assign attributes to individual MAC users and to MAC user groups. If attributes are configured for a MAC user and also for the group the MAC user is in, the attributes assigned to the individual MAC user take precedence for that user. For example, if the
Examples ??? The following command assigns input access control list (ACL)
WX4400# set
success: change accepted.
The following command restricts a user at MAC address 06:05:04:03:02:01 to network access between 7 p.m. on Mondays and Wednesdays and 7 a.m. on Tuesdays and Thursdays:
WX4400# set
See Also
??clear
set
attrauthenticated by a MAC address, and assigns authorization attributes for the group.
(To configure a user group and assign authorization attributes through RADIUS, see the documentation for your RADIUS server.)
Syntax ??? set
??
32 alphanumeric characters, with no spaces.
268CHAPTER 8: AAA COMMANDS
??
authorize all MAC users in the group for a particular service or session characteristic. (For a list of authorization attributes, see Table 44 on page 262.)
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To change the value of an attribute, enter set
You can assign attributes to individual MAC users and to MAC user groups. If attributes are configured for a MAC user and also for the group of the MAC user, the attributes assigned to the individual MAC user take precedence for that user. For example, if the
Examples ??? The following command creates the MAC user group eastcoasters and assigns the group members to VLAN orange:
WX4400# set
See Also
set
set
Syntax ??? set
??name ??? Name of the Mobility Profile. Specify up to 32 alphanumeric
characters, with no spaces.
??none ??? Prevents any user to whom this profile is assigned from
accessing any MAP access point or wired authentication port on the WX switch.
??all ??? Allows any user to whom this profile is assigned to access all
MAP access ports and wired authentication port on the WX switch.
??
through which any user assigned this profile is allowed access. The same port can be used in multiple Mobility Profile port lists.
??
user assigned this profile is allowed access. The same Distributed MAP can be used in multiple Mobility Profile port lists.
Defaults ??? No default Mobility Profile exists on the WX. If you do not assign Mobility Profile attributes, all users have access through all ports, unless denied access by other AAA servers or by access control lists (ACLs).
Access ??? Enabled.
History
Usage ??? To assign a Mobility Profile to a user or group, specify it as an authorization attribute in one of the following commands:
set user attr
set usergroup attr
set
To enable the use of the Mobility Profile feature on the WX switch, use the set
270 CHAPTER 8: AAA COMMANDS
CAUTION: When the Mobility Profile feature is enabled, a user is denied access if assigned a
To change the ports in a profile, use set
Examples ??? The following commands create the Mobility Profile magnolia, which restricts user access to port 2; enable the Mobility Profile feature on the WX switch; and assign the magnolia Mobility Profile to user Jose.
WX1200# set
WX1200# set
WX1200# set user Jose attr
The following command adds port 3 to the magnolia Mobility Profile (which is already assigned to port 2):
WX1200# set
See Also
??clear
??display
??set
??set
set
set
CAUTION: When the Mobility Profile feature is enabled, a user is denied access if assigned a
Syntax ??? set
??enable ??? Enables the use of the Mobility Profile feature on the WX.
??disable ??? Specifies that all Mobility Profile attributes are ignored by
the WX.
272CHAPTER 8: AAA COMMANDS
??encrypted ??? Indicates that the password string you entered is
already in its encrypted form. If you use this option, MSS does not encrypt the displayed form of the password string, and instead displays the string exactly as you entered it. If you omit this option, MSS does encrypt the displayed form of the string.
??password string ??? Password of up to 32 alphanumeric characters,
with no spaces.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? Although MSS allows you to configure a user password for the special
Examples ??? The following command creates a user profile for user Nin in the local database, and assigns the password goody:
WX4400# set user Nin password goody success: User Nin created
The following command assigns the password chey3nne to the admin user:
WX4400# set user admin password chey3nne success: User admin created
The following command changes Nin???s password from goody to 29Jan04:
WX4400# set user Nin password 29Jan04
See Also
set user attr 273
WX4400# set user Tamara attr
274 CHAPTER 8: AAA COMMANDS
See Also
??clear user lockout on page 226
??set authentication
Syntax ??? set usergroup
??
of up to 32 alphanumeric characters, with no spaces.
276CHAPTER 8: AAA COMMANDS
??
using to authorize all users in the group for a particular service or session characteristic. For a list of authorization attributes and values that you can assign to users, see Table 44 on page 262.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To change the value of an attribute, enter set usergroup attr with the new value. To delete an attribute, use clear usergroup attr.
To add a user to a group, user the command set user group.
You can assign attributes to individual users and to user groups. If attributes are configured for a user and also for the group the user is in, the attributes assigned to the individual user take precedence for that user. For example, if the
Examples ??? The following command adds the user group cardiology to the local database and assigns all the group members to VLAN crimson:
WX4400# set usergroup cardiology attr
See Also
set usergroup
See Also
??clear user lockout on page 226
??set authentication
278 CHAPTER 8: AAA COMMANDS
Syntax ??? set
??enable ??? Enables WebAAA on the switch.
??disable ??? Disables WebAAA on the switch.
Defaults ??? Enabled.
Access ??? Enabled.
History
Usage ??? This command disables or reenables support for WebAAA. However, WebAAA has additional configuration requirements. For information, see the ???Configuring AAA for Network Users??? chapter in the Wireless LAN Switch and Controller Configuration Guide.
Examples ??? To disable WebAAA, type the following command:
WX4400# set
See Also
??clear authentication proxy on page 218
Use Mobility Domain commands to configure and manage Mobility
Domain groups.
A Mobility Domain is a system of WX switches and MAP access points working together to support a roaming user (client). One WX acts as a seed switch, which maintains and distributes a list of IP addresses of the domain members.
3Com recommends that you run the same MSS version on all the WX switches in a Mobility Domain.
set
set
set
display
display
display
display
clear
280 CHAPTER 9: MOBILITY DOMAIN COMMANDS
display
Examples ??? To display Mobility Domain status, type the following command:
Table 46 display
282 CHAPTER 9: MOBILITY DOMAIN COMMANDS
Table 46 display
See Also
??clear
display
Displays the configuration of the Mobility Domain.
Syntax ??? display
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command displays the Mobility Domain configuration:
WX# display
This switch is the seed for domain
10.10.10.66 is a member
See Also
??clear
display
display
On the seed WX, displays the Mobility Domain status and members.
Syntax ??? display
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? To display Mobility Domain status, type the following command:
WX4400# display
Table 47 describes the fields in the display.
Table 47 display
See Also
??clear
284 CHAPTER 9: MOBILITY DOMAIN COMMANDS
See Also
??clear
set
set
Sets the IP address of the secondary seed WX on a nonseed WX.
Syntax ??? set
??
dotted decimal notation.
??key
security. Specify the key as 16 hexadecimal bytes. Use a colon between each byte, as in the following example: 00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff.
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command sets the current WX switch as a nonseed member of the Mobility Domain whose secondary seed has the IP address 192.168.1.8:
WX4400# set
seed IP is: 192.168.1.8
See Also
set
set
Sets the current WX as a
Syntax ??? set
??
??
Mobility Domain
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? You can optionally specify a secondary seed in a Mobility Domain. The secondary seed provides redundancy for the primary seed switch in the Mobility Domain. If the primary seed becomes unavailable, the secondary seed assumes the role of the seed switch. This allows the Mobility Domain to continue functioning if the primary seed becomes unavailable.
When the primary seed switch fails, the remaining members form a Mobility Domain, with the secondary seed taking over as the primary seed switch.
If countermeasures had been in effect on the primary seed, they are stopped while the secondary seed gathers RF data from the member switches. Once the secondary seed has rebuilt the RF database, countermeasures can be restored.
VLAN tunnels (other than those between the member switches and the primary seed) continue to operate normally.
Roaming and session statistics continue to be gathered, providing that the primary seed is uninvolved with roaming.
When the primary seed is restored, it resumes its role as the primary seed switch in the Mobility Domain. The secondary seed returns to its role as a regular member of the Mobility Domain.
288 CHAPTER 9: MOBILITY DOMAIN COMMANDS
Examples ??? The following command configures this WX as the secondary seed in a Mobility Domain named Pleasanton:
WX# set
Pleasanton
mode is:
domain name is: Pleasanton
See Also
set
Creates a Mobility Domain by setting the current WX as the seed device and naming the Mobility Domain.
Syntax ??? set
??
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? Before you use this command, the current WX must have its IP address set with the set system
You must explicitly configure only one WX switch per domain as the seed. All other WX switches in the domain receive their Mobility Domain information from the seed.
Examples ??? The following command creates a Mobility Domain named Pleasanton with the current WX as the seed:
WX4400# set
domain name is: Pleasanton
set domain security 289
See Also
??clear
??display
set domain security Sets mobility domain security to required (enabled) or none (disabled) on the wireless LAN switch. The command needs to be entered on each wireless LAN switch that will participate as a member of the secure mobility domain.
Syntax ??? set domain security {required | none}
Defaults ??? Mobility domain security is disabled by default.
Access ??? Enabled.
History ??? Introduced in MSS 5.0.
Usage ??? Domain keys for all switches must be properly configured before enabling domain security on the wireless LAN switch.
Examples ??? The following command enables mobility domain security on the wireless LAN switch:
WX4400# set domain security required success: change accepted.
290 CHAPTER 9: MOBILITY DOMAIN COMMANDS
Use Network Domain commands to configure and manage Network
Domain groups.
A Network Domain is a group of geographically dispersed Mobility Domains that share information over a WAN link. This shared information allows a user configured on a WX in one Mobility Domain to establish connectivity on a WX in another Mobility Domain in the same Network Domain. The WX forwards the user traffic by creating a VLAN tunnel to a WX in the remote Mobility Domain.
In a Network Domain, one or more WX switches serve as a seed switch. At least one of the Network Domain seeds maintains a connection with each of the member WX switches in the Network Domain. The Network Domain seeds share information about the VLANs configured on their members, so that all the Network Domain seeds have a common database of VLAN information.
Network Domain This chapter presents Network Domain commands alphabetically. Use Commands by Table 48 to locate commands in this chapter based on their use.
Usage
Table 48 Network Domain Commands by Usage
292 CHAPTER 10: NETWORK DOMAIN COMMANDS
Table 48 Network Domain Commands by Usage (continued)
clear
296 CHAPTER 10: NETWORK DOMAIN COMMANDS
WX1200# display
Member Network Domain name: California
On a WX switch that is a Network Domain seed, information is displayed about the Network Domains of which the WX switch is a member, as well as Network Domain seeds with which the WX switch has a peer relationship. For example:
display
Table 49 describes the fields in the display.
Table 49
ParameterDescription
Output if WX is the Network Domain Seed
See Also
??clear
??set
298 CHAPTER 10: NETWORK DOMAIN COMMANDS
WX1200# set
success: change accepted.
300 CHAPTER 10: NETWORK DOMAIN COMMANDS
set
Creates a Network Domain by setting the current WX as a seed device and naming the Network Domain.
Syntax ??? set
??
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? Before you use this command, the current WX must have its IP address set with the set system
You can configure multiple WX switches as Network Domain seeds. If you do this, you must identify them as peers by using the set network domain peer command.
Examples ??? The following command creates a Network Domain named California with the current WX as a seed:
WX1200# set
The seed switch in a Network Domain must also be configured as a member of the Network Domain, with the specified seed IP address pointing to the seed itself.
set
For example, the following command sets the current WX switch as a member of a Network Domain where the WX switch with IP address 192.168.9.254 is a seed:
WX1200# set
See Also
Use MAP access point commands to configure and manage MAP access points. Be sure to do the following before using the commands:
??Define the
??Install the MAP access point and connect it to a port on the WX switch.
??Configure a MAP as a directly connected MAP or a Distributed MAP. (See set port type ap on page 97 and set ap on page 87.)
CAUTION: Changing the system country code after MAP configuration disables MAP access points and deletes their configuration. If you change the country code on a WX, you must reconfigure all MAP access points.
MAP Access Point This chapter presents MAP access point commands alphabetically. Use the Commands by following table to locate commands in this chapter based on their use.
Usage
Table 50 Map Access Point Commands by Usage
302 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 50 Map Access Point Commands by Usage (continued)
MAP Access Point Commands by Usage 303
Table 50 Map Access Point Commands by Usage (continued)
304 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 50 Map Access Point Commands by Usage (continued)
MAP Access Point Commands by Usage 305
Table 50 Map Access Point Commands by Usage (continued)
306 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 50 Map Access Point Commands by Usage (continued)
clear ap
See Also
??set vlan profile on page 127
308 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Syntax ??? clear ap
??ap
??radio 1 ??? Radio 1 of the MAP.
??radio 2 ??? Radio 2 of the MAP. (This option does not apply to
??radio all ??? All radios on the MAP.
Defaults ??? The clear ap radio command resets the radio to the default settings listed in Table 51 and in Table 72 on page 416.
Table 51
clear ap radio 309
Table 51
Number of the channel in which a radio transmits and receives traffic
Access ??? Enabled
History
Usage ??? When you clear a radio, MSS performs the following actions:
??Clears the transmit power, channel, and external antenna setting from the radio.
??Removes the radio from its radio profile and places the radio in the default radio profile.
This command does not affect the PoE setting.
Examples ??? The following command disables and resets radio 2 on the MAP access point connected to port 3:
WX1200# clear ap 3 radio 2
See Also
??set ap radio mode on page 391
310 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
See Also
??display ap
??set ap boot- configuration ip on page 369
??set ap boot- configuration switch on page 374
clear ap radio
clear ap radio
Removes a MAP radio from its
Syntax clear ap
??ap
??radio 1 ??? Radio 1 of the MAP.
??radio 2 ??? Radio 2 of the MAP. (This option does not apply to
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? If an MAP radio has been assigned to an RF load balancing group, you can use this command to remove the MAP radio from the
group.
Examples ??? The following command clears radio 1 on MAP 7 from the load balancing group to which it had been assigned:
WX# clear ap 7 radio 1
WX#
See Also
??display
??set ap radio load balancing on page 389
312 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
clear
Syntax ??? clear
??name ??? Radio profile name.
??parameter ??? Radio profile parameter:
??
??countermeasures
??
??
??
??
??
??
??
For information about these parameters, see the set
Defaults ??? If you reset an individual parameter, the parameter is returned to the default value listed in Table 72 on page 416.
Access ??? Enabled.
History
Usage ??? If you specify a parameter, the setting is reset to its default value. The settings of the other parameters are unchanged and the radio profile remains in the configuration. If you do not specify a parameter, the entire radio profile is deleted from the configuration. All radios that use this profile must be disabled before you can delete the profile.
Examples ??? The following commands disable the radios using radio profile rp1 and reset the
WX4400# set
clear
The following commands disable the radios using radio profile rptest and remove the profile:
WX4400# set
WX4400# clear
success: change accepted.
See Also
??display
??set ap radio
??set
??display
clear
Syntax ??? clear
[soda
??soda
??soda
fails the SODA agent checks. By default, the page is generated dynamically.
??soda
ACL for the service profile. When no remediation ACL is specified, a client is disconnected from the network when it fails SODA agent checks.
??soda
the checks performed by the SODA agent. By default, the page is generated dynamically.
??soda
of the network. By default, the client is disconnected from the network without loading a page.
Defaults ??? None.
314 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
display ap arp 315
Examples ??? The following command displays ARP entries for AP 7:
WX# display ap arp 7
AP 7:
Table 52 describes the fields in this display.
Table 52 Output for display ap arp
??
??
??
See Also
316 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
display ap config Displays global and
Syntax ??? display ap config
??
??radio 1 ??? Shows configuration information for radio 1.
??radio 2 ??? Shows configuration information for radio 2. (This option
does not apply to
Defaults ??? None.
Access ??? All.
History
Usage ??? MSS lists information separately for each MAP access point.
Examples ??? The following example shows configuration information for MAP 2:
WX# display ap config 2
AP 2:
communication timeout: 10 location:
contact:
Radio 1: type: 802.11g, mode: disabled, channel: dynamic
tx pwr: 18, profile: default
Table 53 describes the fields in this display.
communication timeout
318 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 53 Output for display ap config (continued)
See Also
??display ap connection on page 343
??display ap global on page 345
??display ap unconfigured on page 347
display ap counters 319
??set ap radio mode on page 391
??set ap radio antennatype on page 383
??set ap radio channel on page 387
??set ap radio
??set ap radio
display ap counters Displays MAP access point and radio statistics counters.
Syntax ??? display ap counters
??
??radio 1 ??? Shows statistics counters for radio 1.
??radio 2 ??? Shows statistics counters for radio 2. (This option does not
apply to
Defaults ??? None.
Access ??? All.
History
Version 4.0:
??Radio Recv Phy Err Ct
??Transmit Retries
??Radio Adjusted Tx Pwr
??Noise Floor
??802.3 Packet Tx Ct
??803.3 Packet Rx Ct
??No Receive Descriptor
Version 6.0 removed the dap option and added the Illegal Rates field.
Usage ??? To display statistics counters and other information for individual user sessions, use the display sessions network command.
320 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command shows statistics counters for
Distributed MAP 7:
display ap counters 321
Table 54 describes the fields in this display.
Table 54 Output for display ap counters
322 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 54 Output for display ap counters (continued)
display ap counters 323
Table 54 Output for display ap counters (continued)
324 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 54 Output for display ap counters (continued)
The counters above are global for all data rates. The counters below are for individual data rates.
If counters for lower data rates are incrementing but counters for higher data rates are not incrementing, this can indicate poor throughput. The poor throughput can be caused by interference. If the cause is not interference or the interference cannot be eliminated, you might need to relocate the MAP in order to use the higher data rates and therefore improve throughput.
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 6.0.
Examples ??? The following command displays FDB entries for AP 7:
WX# display ap fdb 7
AP 7:
# = System Entry. $ = Authenticate Entry
Table 55 describes the fields in the display ap fdb output.
Table 55 Output for display ap fdb
326 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
See Also
??set ap
??set vlan profile on page 127
display ap
Syntax ??? display ap
??
??clear ??? Clears the counters after displaying their current values.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 4.0. Version 4.2 added the TxDrop field. Version 6.0 removed the dap option.
Usage ??? Repeating this command with the clear option at regular intervals allows you to monitor transmission and drop rates.
Examples ??? The following command shows statistics for the MAP forwarding queues on a Distributed MAP.
======================================
etherstats
Syntax ??? display ap etherstats
??
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
328 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command displays Ethernet statistics for the
Ethernet ports on Distributed MAP 1:
Table 57 describes the fields in this display.
Table 57 Output of display ap etherstats
display ap group 329
Table 57 Output of display ap etherstats (continued)
display ap group Deprecated in MSS Version 6.0. To display information about RF load balancing, see ???display
Syntax ??? display ap
??
??path ??? Displays statistics for the path of mesh services devices of
which this MAP is part.
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 6.0.
330 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command mesh link information for AP 7:
WX# display ap
AP: 7
Operational Mode:
The following command displays statistics for the path of mesh services devices that MAP is part of.
0007
Table 58 describes the fields in the display ap
Table 58 Output for display ap
display ap status 331
See Also
??set ap
??set
display ap status Displays MAP access point and radio status information.
Syntax ???
{1 | 2}]]
??terse ??? Displays a brief line of essential status information for each
MAP.
??
??all ??? Shows status information for all directly attached MAP access
points and all Distributed MAP access points configured on the switch.
??radio 1 ??? Shows status information for radio 1.
??radio 2 ??? Shows status information for radio 2. (This option does
not apply to
Defaults ??? None.
Access ??? Enabled.
History
Version 6.0 removed the dap option.
332 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command displays the status of a MAP access point:
WX4400# display ap status 7
Dap: 1,
fingerprint: b4:f9:2a:52:37:58:f4:d0:10:75:43:2f:45:c9:52:c3
====================================================
State: operational
CPU info: IBM:PPC speed=266666664 Hz version=405GPr id=0x28f10158a47f0408 ram=33554432 s/n=0332600444 hw_rev=A3
Uptime: 21 hours, 27 minutes, 51 seconds
Radio 1 type: 802.11g, state: configure succeed [Enabled] operational channel: 64 operational power: 14
base mac: 00:0b:0e:00:d2:c1
bssid1: 00:0b:0e:00:d2:94, ssid: private
The following command displays the status of a directly connected MAP:
WX# display ap status 7
AP: 7, AP model:
====================================================
State: operational (not encrypt)
CPU info: IBM:PPC speed=266666664 Hz version=405GPr, ram=33554432 s/n=0333703050 hw_rev=A3
Uptime: 503 hours, 51 minutes, 5 seconds
Radio 1 type: 802.11g, state: configure succeed [Enabled]
operational channel: 11 (Auto) operational power: 1
bssid1: 00:0b:0e:00:ca:c0, ssid: public
bssid2: 00:0b:0e:00:ca:c2, ssid:
load balance: enabled, current load: (unavailable)
RFID Reports: Inactive
Radio 2 type: 802.11a, state: configure succeed [Disabled] (Sweep mode)
operational channel: 44 (Auto) operational power: 1
bssid1: 00:0b:0e:00:ca:c1, ssid:
load balance: enabled, current load: (unavailable)
RFID Reports: Inactive
display ap status 333
The following command uses the terse option to display brief information for MAPs:
WX# display ap status terse
Total number of entries: 120
Operational: 1, Image Downloading: 0, Unknown: 119, Other: 0
Table 59 and Table 60 describe the fields in this display.
Table 59 Output for display ap status
334 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 59 Output for display ap status (continued)
display ap status 335
Table 59 Output for display ap status (continued)
??
??
Countermeasures Enabled indicates that the radio is sending countermeasures packets to combat a rogue.
Radar Scan indicates that the radio is performing the initial channel availability check for Dynamic Frequency Selection (DFS). This state lasts during the first 60 seconds an 802.11a radio is on a new channel, during which time the radio does not transmit. If the radio does not detect any radar on the channel, the radio starts using the channel for data. If the radio does detect radar, the flag changes to Radar Detected. (See below).
??Radar Detected indicates that DFS has detected radar on the channel. When this occurs, the MAP stops transmitting on the channel for 30 minutes. If RF
Note: Radar Scan and Radar Detected apply only to 802.11a radios, for country codes that use DFS.
336 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 59 Output for display ap status (continued)
This field is applicable only if the MAP is configured on the
WX switch as a Distributed MAP.
display ap vlan 337
Table 60 Output for display ap status terse (continued)
338 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 61 describes the fields in the display ap vlan output.
Table 61 Output for display ap vlan
See Also
??set ap
??set vlan profile on page 127
Defaults ??? None.
Access ??? Enabled.
History
display
Examples ??? The following command displays RF attribute information for radio 1 on the directly connected MAP access point on port 2:
Table 62 describes the fields in this display.
Table 62 Output for display
See Also
??display
??display
??set ap radio
??set ap radio
??set
??set
??set
340 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Syntax ??? display
??
??radio 1 ??? Shows neighbor information for radio 1.
??radio 2 ??? Shows neighbor information for radio 2. (This option does
not apply to
??radio all ??? Shows neighbor information for both radios.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? For simplicity, this command displays a single entry for each 3Com radio, even if the radio is supporting multiple BSSIDs. However, BSSIDs for
Information is displayed for a radio if the radio sends beacon frames or responds to probe requests. Even if a radio SSIDs are unadvertised, 3Com radios detect the empty beacon frames (beacon frames without SSIDs) sent by the radio, and include the radio in the neighbor list.
display
Examples ??? The following command displays neighbor information for radio 1 on the directly connected MAP access point on port 2:
Table 63 describes the fields in this display.
Table 63 Output for display
See Also
??display
??display
??set ap radio
??set ap radio
??set
??set
??set
342 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Syntax ??? display ap
??
Defaults ??? None.
Access ??? Enabled.
History
??Field Mesh
??Field Mesh SSID
??Field Mesh PSK
Examples ??? The following command displays static IP configuration information for Distributed MAP 1:
WX# display ap
Static Boot Configuration
AP: 7
IP Address: Disabled
VLAN Tag: Disabled
Switch: Disabled
Mesh: Disabled
IP Address:
Netmask:
Gateway:
VLAN Tag:
Switch IP:
Switch Name:
Mesh SSID:
Mesh PSK:
Table 64 describes the fields in this display.
connection
Syntax ??? display ap connection
??
??
Defaults ??? None.
Access ??? Enabled.
344 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
History
Usage ??? The
This command provides information only if the Distributed MAP is configured on the switch where you use the command. The switch does not need to be the one that booted the MAP, but it must have the MAP in its configuration. Also, the switch that booted the MAP must be in the same Mobility Domain as the switch where you use the command.
If a Distributed MAP is configured on this WX switch (or another WX switch in the same Mobility Domain) but does not have an active connection, the command does not display information for the MAP. To show connection information for Distributed MAPs, use the display ap global command on one of the switches where the MAPs are configured.
Examples ??? The following command displays information for all Distributed MAPs configured on this WX switch that have active connections:
The following command displays connection information specifically for a
Distributed MAP with serial ID M9DE48B6EAD00:
Table 65 describes the fields in this display.
display ap global 345
Table 65 Output of display ap connection
See Also
??display ap config on page 316
??display ap global on page 345
??display ap unconfigured on page 347
display ap global Displays connection information for Distributed MAPs configured on a WX.
Syntax ??? display ap global
??
??
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? Connections are shown only for the Distributed MAPs that are configured on the WX switch from which you enter the command, and only for the Mobility Domain the switch is in.
To show information only for Distributed MAPs that have active connections, use the display ap connection command.
346 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command displays configuration information for all the Distributed MAPs configured on a WX switch:
Table 66 describes the fields in this display.
Table 66 Output for display ap global
See Also
??display ap config on page 316
??display ap connection on page 343
display ap unconfigured 347
Examples ??? The following command displays information for two
Distributed MAPs that are not configured:
Table 67 describes the fields in this display.
Table 67 Output for display ap unconfigured
348 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 67 Output for display ap unconfigured (continued)
group
Syntax ??? display
??
?? all ??? Displays information for every
??
?? radio {1 | 2}??? Displays status information for a radio on an MAP. This option displays information about radios in the same group as the specified radio.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0. Version 6.0 removed the dap option.
Usage ??? Use this command to display information about the RF
display
Examples ??? The following command displays information about the MAP radios that are in the same group as radio 1 on MAP 3:
Radios in the same
The following command displays information about RF load balancing group blue:
Table 57 describes the fields in displayed by the display
Table 68 Output for display
See also
??set
350 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Version 4.2 has the following changes:
??WMM enabled field renamed to QoS Mode.
??Long Retry Limit and Short Retry Limit fields moved to display
??Allow 802.11g clients only field removed. (This option is now configured using the set
Usage ??? MSS contains a default radio profile. 3Com recommends that you do not change this profile but instead keep the profile for reference.
Examples ??? The following command shows radio profile information for the default radio profile:
display
Table 69 describes the fields in this display.
Table 69 Output for display
352 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 69 Output for display
See Also
??set
??set
??set
??set
??set
??set
??set
??set
??set
display
354CHAPTER 11: MANAGED ACCESS POINT COMMANDS
??CAC mode
??CAC sessions
??User idle timeout
??Idle client probing
??Web Portal Session Timeout
??Transmit rates for 11a / 11b / 11g:
??beacon rate
??multicast rate
??mandatory rate
??standard rates
??disabled rates
Version 6.0 removed the dap option, and added these new fields:
??Client DSCP
??Mesh enabled
??Bridging enabled
??Load Balance Exempt
??Web Portal Logout
??Custom Web Portal Logout URL
11g mandatory rate: 1.0,2.0,5.5,11.0 standard rates: 6.0,9.0,12.0,18.0,24.0, 36.0,48.0,54.0
Table 70 describes the fields in this display.
356 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 70 Output for display
not have an authentication rule with a userglob that matches the username.
??
??
??
display
Table 70 Output for display
358 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 70 Output for display
display
Table 70 Output for display
360 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 70 Output for display
11a / 11b / 11g transmit rate fields
Data transmission rate settings for each radio type:
??beacon
??multicast
??mandatory
??standard
??disabled
See Also
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
display
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
362 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set ap auto 363
The profile uses the default radio profile by default. You can change the profile using the set ap auto radio
Table 71 Configurable Profile Parameters for Distributed MAPs
Examples ??? The following command creates a profile for automatic Distributed MAP configuration:
WX1200# set ap auto success: change accepted.
See Also
??set ap auto mode on page 366
??set ap auto persistent on page 364
364CHAPTER 11: MANAGED ACCESS POINT COMMANDS
??set ap radio
??set ap radio
??set ap radio
??set ap radio mode on page 391
??set ap radio
??set ap
Syntax ??? set ap auto persistent
??
??all ??? Converts the configurations of all
the switch into permanent configurations.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To display the Distributed MAP numbers assigned to
Examples ??? The following command converts the configuration of
WX4400# set ap auto persistent 10 success: change accepted.
See Also
set ap auto radiotype 365
Defaults ??? The default radio type for models AP2750,
Access ??? Enabled.
History ??? Version 6.0 removed the dap option.
Examples ??? The following command sets the radio type to 802.11b:
WX4400# set dap auto radiotype 11b success: change accepted.
See Also
366 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set ap auto mode Enables a WX profile for automatic Distributed MAP configuration.
Syntax ??? set ap auto mode {enable | disable}
??enable ??? Enables the MAP configuration profile.
??disable ??? Disables the MAP configuration profile.
Defaults ??? The MAP configuration profile is disabled by default.
Access ??? Enabled.
History
Usage ??? You must use the set ap auto command to create the profile before you can enable it.
Examples ??? The following command enables the profile for automatic
Distributed MAP configuration:
WX4400# set ap auto mode enable success: change accepted.
See Also
??set ap auto persistent on page 364
??set ap auto radiotype on page 365
??set ap radio
??set ap radio
??set ap radio
??set ap radio mode on page 391
set ap bias 367
Syntax ??? set ap
??ap
??ap auto ??? Configures bias for the MAP configuration profile. (See
??high ??? High bias.
??low ??? Low bias.
Defaults ??? The default bias is high.
Access ??? Enabled.
History
Usage ??? High bias is preferred over low bias. Bias applies only to WX switches indirectly attached to the MAP through an intermediate Layer 2 or Layer 3 network. A MAP always attempts to boot on MAP port 1 first, and if an WX is directly attached on MAP port 1, the MAP always boots from it.
If MAP port 1 is indirectly connected to WX switches through the network, the MAP boots from the WX with the high bias for the MAP. If the bias for all connections is the same, the MAP selects the WX that has the greatest capacity to add more active MAPs. For example, if a MAP is dual homed to two WX4400 wireless LAN switches, and one of the switches has 50 active MAPs while the other WX has 60 active MAPs, the new MAP selects the WX that has only 50 active MAPs.
If the boot request on MAP port 1 fails, the MAP attempts to boot over its port 2, using the same process described above.
MAP selection of a WX is sticky. After a MAP selects a WX to boot from, the MAP continues to use that WX for its active data link even if another switch configured with high bias for the MAP becomes available.
368 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set ap boot- configuration ip 369
WX4400# set ap 1
success: change accepted.
370 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
See Also
??display ap
set ap
set ap
Specifies a preshared key (PSK) phrase that a Mesh AP uses for authentication to its Mesh Portal AP.
Syntax ??? set ap
passphrase
??ap
??passphrase ??? An ASCII string from 8 to 63 characters long. The
string can contain blanks if you use quotation marks at the
beginning and end of the string.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? Use this command to configure the preshared key that a Mesh AP uses to authenticate to a Mesh Portal AP. You must connect the MAP to an WX switch and enter this command to configure the MAP for mesh services prior to deploying the Mesh AP in its final untethered location.
MSS converts the passphrase into a
Examples ??? The following command configures MAP 7 to use passphrase ???1234567890123<>?=+&% The quick brown fox jumps over the lazy sl??? when authenticating with a Mesh Portal AP
WX# set ap 7
success: change accepted.
See Also
??display ap
372 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set ap
Configures a raw hexadecimal preshared key (PSK) to use for authenticating a Mesh AP to a Mesh Portal AP. Radios use the PSK as a pairwise master key (PMK) to derive unique pairwise session keys for individual WPA clients.
Syntax ??? set ap
??ap
??hex ??? A
number. Enter the
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? Use this command to configure the preshared key that a Mesh AP uses to authenticate to a Mesh Portal AP. You must connect the MAP to an WX switch and enter this command to configure the MAP for mesh services prior to deploying the Mesh AP in its final untethered location.
MSS converts the hexadecimal into a
Examples ??? The following command configures MAP 7 to use a raw PSK to authenticate with a Mesh Portal AP:
WX# set ap 7
success: change accepted.
See Also
??display ap
set ap
WX# set ap 7
??display ap
374 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set ap
WX1200# set ap 1 boot- configuration switch
success: change accepted.
The following command configures Distributed MAP 1 to use the WX with the name wxr2 as its boot device. The DNS server at 172.16.0.1 is used to resolve the name of the WX switch.
WX4400# set ap 1
success: change accepted.
See Also
??clear ap
??display ap
set ap
Specifies 802.1Q VLAN tagging information for a Distributed MAP.
Syntax ??? set ap
Syntax ??? set ap
??ap
??
number from 1 ??? 4095.
??mode {enable | disable} ??? Enables or disables use of the specified
VLAN tag on the Distributed MAP.
Defaults ??? None.
Examples ??? Enabled.
History
376 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
See Also
??display ap config on page 316
set ap fingerprint Verifies a MAP fingerprint on a WX. If
Syntax ??? set ap
?? ap
set ap fingerprint 377
??fingerprint ??? The
Use a colon between each digit. Make sure the fingerprint you enter matches the fingerprint used by the MAP.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? MAPs are configured with an encryption key pair at the factory. The fingerprint for the public key is displayed on a label on the back of the MAP, in the following format:
RSA aaaa:aaaa:aaaa:aaaa: aaaa:aaaa:aaaa:aaaa
If a MAP is already installed and operating, you can use the display ap status command to display the fingerprint. The display ap config command lists a MAP fingerprint only if the fingerprint has been verified in MSS. If the fingerprint has not been verified, the fingerprint information in the command output is blank.
Examples ??? The following example verifies the fingerprint for Distributed MAP 8:
WX4400# set ap 8 fingerprint b4:f9:2a:52:37:58:f4:d0:10:75:43:2f:45:c9:52:c3
success: change accepted.
See Also
??display ap config on page 316
378 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Defaults ??? Forced image download is disabled by default.
Access ??? Enabled.
History
Usage ??? A change to the forced image download option takes place the next time the MAP is restarted.
Even when forced image download is disabled (the default), the MAP still checks with the WX to verify that the MAP has the latest image, and to verify that the WX is running MSS Version 5.0 or later.
The MAP loads a local image only if the WX is running MSS Version 5.0 or later and does not have a different MAP image than the one in the MAP local storage. If the WX is not running MSS Version 5.0 or later, or the WX has a different version of the MAP image than the current version on the MAP, the MAP loads an image from the WX.
Examples ??? The following command enables forced image download on Distributed MAP 69:
WX1200# set ap 69
See Also
set ap
Enables local switching for a specified MAP.
Syntax ??? set ap
??
??mode {enable | disable} ??? Enables or disables local switching for the
MAP.
Defaults ??? Local switching is disabled by default.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? Local switching allows traffic for specified VLANs to be switched by the MAP itself, instead of being tunneled back to a WX. The VLANs for which local switching is performed are specified in a VLAN profile.
Local switching can be enabled on MSPs that are connected to the WX via an intermediate Layer 2 or Layer 3 network. Local switching is not supported for MAPs that are directly connected to an WX.
380 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
If local switching is enabled on an MAP, but no VLAN profile is configured, then a default VLAN profile is used. The default VLAN profile includes a single VLAN named default that is not tagged.
Examples ??? The following command enables local switching for MAP 7:
WX# set ap 7
See Also
set ap
Applies a specified VLAN profile to an MAP to use with local switching.
Syntax ??? set ap
profile name
??
??
Defaults ??? If local switching is enabled on an MAP, but no VLAN profile isconfigured, then a default VLAN profile is used. The default VLAN profile includes a single VLAN named default that is not tagged.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
History ??? A VLAN profile consists of a list of VLANs and tags. When a VLAN profile is applied to an MAP, traffic for the VLANs specified in the VLAN profile is locally switched by the MAP instead of being tunneled back to an WX.
When applying a VLAN profile causes traffic that had been tunneled to an WX to be locally switched by MAPs, or
set ap name 381
Examples ??? The following command specifies that MAP 7 use VLAN profile locals:
WX# set ap 7
See Also
??clear ap
??set ap
??set vlan profile on page 127
Syntax ??? set ap ap number name name
??ap
??name ??? Alphanumeric string of up to 16 characters, with no spaces.
Defaults ??? The default name of a directly attached MAP is based on the port number of the MAP access port attached to the MAP. For example, the default name for a MAP on MAP access port 1 is MAP01.
Access ??? Enabled.
History
Examples ??? The following command changes the name of the MAP on port 1 to techpubs:
WX1200# set ap 1 name techpubs success: change accepted.
See Also
382 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
??
??
??
Defaults ??? The default antenna location is indoors.
Access ??? Enabled.
History
Examples ??? The following command sets the antenna location for radio 1 on Distributed MAP 22 to outdoors:
WX2200# set ap 22 radio 1
See Also
set ap radio antennatype 383
??
??
?? internal ??? uses the internal antenna instead
384 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Defaults ??? All radios use the internal antenna by default, if the MAP model has an internal antenna. The
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0. Model numbers added for 802.11a external antennas, and the default changed to internal (except for the AP3150) in MSS Version 3.2. Model numbers added for
Examples ??? The following command configures the 802.11b/g radio on
Distributed MAP 1 to use antenna model ANT1060:
WX4400# set ap 1 radio 1 antennatype ANT1060 success: change accepted.
See Also
set ap radio
Sets the maximum power that RF
Syntax ???
??ap
??ap auto ??? Sets the maximum power for radios configured by the
MAP configuration profile. (See set ap auto on page 362.)
??radio 1 ??? Radio 1 of the MAP.
??radio 2 ??? Radio 2 of the MAP. (This option does not apply to
??
to the radio, expressed as the number of decibels in relation to 1 milliwatt (dBm). You can specify a value from 1 up to the maximum value allowed for the country of operation.
The
set ap radio
Defaults ??? The default maximum power setting that RF
Access ??? Enabled.
History
Examples ??? The following command sets the maximum power that RF
WX1200# set ap 7 radio 1
See Also
??set ap radio
set ap radio
Sets the maximum percentage of client retransmissions a radio can experience before RF
Syntax ??? set {ap
??ap
??ap auto ??? Sets the maximum retransmissions for radios configured
by the MAP configuration profile. (See set ap auto on page 362.)
??radio 1 ??? Radio 1 of the MAP.
??radio 2 ??? Radio 2 of the MAP. (This option does not apply to
??retransmissions ??? Percentage of packets that can result in
retransmissions without resulting in a channel change. You can specify from 1 to 100.
386 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Defaults ??? The default is 10 percent.
Access ??? Enabled.
History
Usage ??? A retransmission is a packet sent from a client to a MAP radio that the radio receives more than once. This can occur when the client does not receive an 802.11 acknowledgement for a packet sent to the radio.
If the radio receives only a single copy of a packet that is transmitted multiple times by a client, the packet is not counted by the radio as a retransmission. For example, if a packet is corrupted and the radio does not receive it, but the second copy of the packet does reach the radio, the radio does not count the packet as a retransmission since the radio received only one recognizable copy of the packet.
The interval is 1000 packets. If more than the specified percentage of packets within a group of 1000 packets received by the radio are retransmissions, the radio increases power.
When the percentage of retransmissions exceeds the
If the retransmissions still exceed the threshold after the minimum allowed data rate is reached, the radio increases power by 1 dBm. The radio continues increasing the power in 1 dBm increments until the retransmissions fall below the threshold.
After the retransmissions fall below the threshold, the radio reduces power by 1 dBm. As long as retransmissions remain below the threshold, the radio continues reducing power in 1 dBm increments until it returns to its default power level.
set ap radio channel 387
?? channel
Defaults ??? The default channel depends on the radio type:
??The default channel number for 802.11b/g is 6.
??The default channel number for 802.11a is the lowest valid channel number for the country of operation.
Access ??? Enabled.
History
388 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Usage ??? You can configure the transmit power of a radio on the same command line. Use the
This command is not valid if dynamic channel tuning (RF
Examples ??? The following command configures the channel on the 802.11a radio on the MAP access point connected to port 5:
WX1200# set ap 5 radio 1 channel 36 success: change accepted.
The following command configures the channel and transmit power on the 802.11b/g radio on the MAP access point connected to port 1:
WX1200# set ap 1 radio 1 channel 1
See Also
??display ap config on page 316
??set ap radio
Syntax ??? set ap
??ap
??radio 1 ??? Radio 1 of the MAP.
??radio 2 ??? Radio 2 of the MAP. (This option does not apply to
??mode enable ??? Enables link calibration packets for the MAP radio.
??mode disable ??? Disables link calibration packets for the MAP radio.
Defaults ??? Disabled.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
set ap radio load balancing 389
Usage ??? A Mesh Portal MAP can be configured to emit link calibration packets to assist with positioning the Mesh AP. A link calibration packet is an unencrypted 802.11 management packet of type Action. When enabled on an MAP, link calibration packets are sent at a rate of 5 per second.
The
Only one radio on an MAP can be configured to send link calibration packets. Link calibration packets are intended to be used only during installation of MAPs; they are not intended to be enabled on a continual basis.
Examples ??? The following command enables link calibration packets for MAP radio 1 on MAP 7:
WX# set ap 7 radio 1
WX#
See Also
??display ap
??set ap
??set
set ap radio load Disables or enables RF load balancing for an MAP radio. balancing
Syntax ??? set ap
??ap
??radio 1 ??? Radio 1 of the MAP.
??radio 2 ??? Radio 2 of the MAP. (This option does not apply to
??enable ??? Enables link calibration packets for the MAP radio.
390CHAPTER 11: MANAGED ACCESS POINT COMMANDS
??disable ??? Disables link calibration packets for the MAP radio.
Defaults ??? Disabled.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? By default, RF load balancing is enabled on all MAP radios. Use this command to disable or
RF load balancing can also be disabled or
Examples ??? The following command disables RF load balancing for
MAP radio 1 on MAP 7:
WX# set ap 7 radio 1
WX#
See Also
??set
??clear ap radio
??set ap
??display
set ap radio load Assigns an MAP radio to a load balancing group. balancing group
Syntax ??? set ap
??ap
??radio 1 ??? Radio 1 of the MAP.
??radio 2 ??? Radio 2 of the MAP. (This option does not apply to
??group name ??? Name of an RF load balancing group to which the
MAP radio is assigned. A radio can belong to only one group.
set ap radio mode 391
??rebalance ??? Configures the MAP radio to disassociate its client
sessions and rebalance them whenever a new MAP radio is added to the load balancing group.
Defaults ??? By default, MAP radios are not part of an RF load balancing group.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? Assigning radios to specific load balancing groups is optional. When you do this, MSS considers them to have exactly overlapping coverage areas, rather than using signal strength calculations to determine their overlapping coverage. MSS attempts to distribute client sessions across radios in the load balancing group evenly. A radio can be assigned to only one group.
Examples The following command assigns MAP radio 1 on MAP 7 to load balancing group room1:
WX# set ap 7 radio 1
WX#
See Also
??clear ap radio
??display
??set
??set ap
set ap radio mode Enables or disables a radio on a MAP access point.
Syntax ??? set ap
??ap
??radio 1 ??? Radio 1 of the MAP.
??radio 2 ??? Radio 2 of the MAP. (This option does not apply to
?? mode enable ??? Enables a radio.
392CHAPTER 11: MANAGED ACCESS POINT COMMANDS
??mode disable ??? Disables a radio.
Defaults ??? MAP access point radios are disabled by default.
Access ??? Enabled.
History
Usage ??? To enable or disable one or more radios to which a profile is assigned, use the set ap radio
Examples ??? The following command enables radio 1 on the MAP 1:
WX1200# set ap 1 radio 1 mode enable success: change accepted.
The following command enables radio 2 on on MAP 1:
WX1200# set ap 1 radio 2 mode enable success: change accepted.
See Also
??display ap config on page 316
??set ap radio
??set
set ap radio
??
characters, with no spaces.
??mode enable ??? Enables radios on the specified ports with the
parameter settings in the specified radio profile.
??mode disable ??? Disables radios on the specified ports.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? When you create a new profile, the radio parameters in the profile are set to their factory default values.
To enable or disable all radios using a specific radio profile, use set
Examples ??? The following command enables radio 1 on MAP 5 assigned to radio profile rp1:
WX1200# set ap 5radio 1
See Also
??display
??set ap radio mode on page 391
??set
394CHAPTER 11: MANAGED ACCESS POINT COMMANDS
??
1 milliwatt (dBm). The valid values depend on the country of operation.
The maximum transmit power you can configure on any 3Com radio is the maximum allowed for the country in which you plan to operate the radio or one of the following values if that value is less than the country maximum: on an 802.11a radio, 11 dBm for channel numbers less than or equal to 64, or 10 dBm for channel numbers greater than 64; on an 802.11b/g radio, 16 dBm for all valid channel numbers for 802.11b, or 14 dBm for all valid channel numbers for 802.11g.
Defaults ??? The default transmit power on all MAP radio types is the highest setting allowed for the country of operation or highest setting supported on the hardware, whichever is lower.
Access ??? Enabled.
History
Usage ??? You also can configure a radio channel on the same command line. Use the channel option.
This command is not valid if dynamic power tuning (RF
Examples ??? The following command configures the transmit power on the 802.11a radio on the MAP access point connected to port 5:
WX1200# set ap 5 radio 1
The following command configures the channel and transmit power on the 802.11b/g radio on the MAP access point connected to port 1:
WX1200# set ap 1 radio 1 channel 1
See Also
set ap security 395
set
set
Syntax ??? set
??none ??? When a client supports both 802.11a and 802.11b/g radio
bands, does not steer the client to a specific MAP radio.
??enable ??? When a client supports both 802.11a and 802.11b/g radio
bands, steers the client to the 802.11b/g radio.
??disable ??? When a client supports both 802.11a and 802.11b/g
radio bands, steers the client to the 802.11a radio.
Defaults ??? By default, clients are not steered to specific MAP radios for
RF load balancing.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? Use this command to steer clients that support both the 802.11a and 802.11b/g bands, to a specific radio on an MAP for the purpose of load balancing. This global
Examples ??? The following command steers clients that support both the 802.11a and 802.11b/g bands to the 802.11a radio on an MAP:
WX# set
WX#
See Also
??display
??set
398 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set
Syntax ??? set
??enable ??? Enables RF load balancing globally on the WX.
??disable ??? Disables RF load balancing globally on the WX.
Defaults ??? RF load balancing is enabled by default.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? By default, RF load balancing is enabled on all MAP radios. Use this command to disable or
If RF load balancing has been enabled or disabled for a specific MAP radio, then the setting for the individual radio takes precedence over the global setting.
Examples ??? The following command globally disables RF load balancing for all MAP radios managed by the WX switch:
WX# set
WX#
See Also
??display
??set
set
400 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
At the other end of the spectrum, when max strictness is specified, if an MAP radio has reached its maximum client load, MSS makes it invisible to new clients, causing them to attempt to connect to other MAP radios. In the event that all the MAP radios in the group have reached their maximum client load, then no new clients would be able to connect to the network.
Examples The following command sets the RF load balancing strictness
to the maximum setting:
WX# set
Success: strictness set to "MAX"
See Also
??display
??set
??set
??set ap radio load balancing on page 389
set
look for rogue devices by sending probe any requests (probe requests with a null SSID name), to solicit probe responses from other access points.
Passive scanning is always enabled and cannot be disabled. During passive scanning, radios look for rogues by listening for beacons and probe responses.
Syntax ??? set
??name ??? Radio profile name.
??enable ??? Configures radios to actively scan for rogues.
set
??disable ??? Configures radios to scan only passively for rogues by
listening for beacons and probe responses.
Defaults ??? Active scanning is enabled by default.
Access ??? Enabled.
History
Usage ??? You can enter this command on any WX in the Mobility Domain. The command takes effect only on that WX.
Examples ??? The following command disables active scan in radio profile radprof3:
wx4400# set
See Also
set
When configured, the MAP 802.11a radio selects a channel from a limited range of available channels or all available channels.
Syntax ??? set
??
channel range.
??
radio: 36, 40, 44, 48, 52, 56, 60, or 64.
??
Defaults ??? None
Access ??? Enabled
History
Usage ??? Improves the 802.11a radio usage on the network.
402 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command enables the 802.11a radio to select any available channel in the 802.11a range:
WX1200# set
success: change accepted.
set
Disables or reenables dynamic channel tuning (RF
Syntax ??? set
{enable |
??name ??? Radio profile name.
??enable ??? Configures radios to dynamically select their channels when
the radios ares started.
??disable ??? Configures radios to use their statically assigned channels,
or the default channels if unassigned, when the radios are started.
??
of client status. Without this option, a radio changes the channel only if the radio does not have any active clients on that channel.
Defaults ??? Dynamic channel assignment is enabled by default.
Access ??? Enabled.
History
Usage ??? If you disable RF
If RF
RF
set
Examples ??? The following command disables dynamic channel tuning for radios in the rp2 radio profile:
WX4400# set
success: change accepted.
See Also
??display
??set ap radio channel on page 387
??set
set
Sets the minimum number of seconds a radio in a radio profile must remain at its current channel assignment before RF
Syntax ??? set
holddown
??name ??? Radio profile name.
??holddown ??? Minimum number of seconds a radio must remain on its
current channel setting before RF
Defaults ??? The default RF
Access ??? Enabled.
History
Usage ??? The channel holddown applies even if RF anomalies occur that normally cause an immediate channel change.
404 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command changes the channel holddown for radios in radio profile rp2 to 600 seconds:
WX4400# set
See Also
??display
set
Sets the interval at which RF
Syntax ??? set
seconds
??name ??? Radio profile name.
??seconds ??? Number of seconds RF
radio channels to adjust to RF changes, if needed. You can specify from 0 to 65535 seconds.
Defaults ??? The default channel interval is 3600 seconds (one hour).
Access ??? Enabled.
History
Usage ??? 3Com recommends that you use an interval of at least 300 seconds (5 minutes).
RF
If you set the interval to 0, RF
set
Examples ??? The following command sets the channel interval for radios in radio profile rp2 to 2700 seconds (45 minutes):
WX4400# set
See Also
??display
set
Locks down the current channel settings on all radios in a radio profile.
The channel settings that are in effect when the command is entered are changed into statically configured channel assignments on the radios. RF
Syntax ??? set
??name ??? Radio profile name.
Defaults ??? By default, when RF
Access ??? Enabled.
History
Usage ??? To save this command and the static channel configuration
commands created when you enter this command, save the configuration.
406 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command locks down the channel settings
for radios in radio profile rp2:
WX# set
success: change accepted
See Also
??display
??set
??set
set
Enables or disables dynamic power tuning (RF
Syntax ??? set
??name ??? Radio profile name.
??enable ??? Configures radios to dynamically set their power levels
when the MAPs are started.
??disable ??? Configures radios to use their statically assigned power
levels, or the default power levels if unassigned, when the radios are started.
Defaults ??? Dynamic power assignment is disabled by default.
Access ??? Enabled.
History
Usage ??? When RF
When RF
410 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Access ??? Enabled.
History
Usage ??? You must disable all radios that are using a radio profile before you can change parameters in the profile. Use the set
Examples ??? The following command changes the beacon interval for radio profile rp1 to 200 ms:
WX4400# set
See Also
??display
??set
set
clients from being able to use rogue access points.
CAUTION: Countermeasures affect wireless service on a radio. When a MAP radio is sending countermeasures, the radio is disabled for use by network traffic, until the radio finishes sending the countermeasures.
MAP radios can also issue countermeasures against interfering devices. An interfering device is not part of the 3Com network but also is not a rogue. No client connected to the device has been detected communicating with any network entity listed in the forwarding database (FDD) of any WX in the Mobility Domain. Although the interfering device is not connected to your network, the device might be causing RF interference with MAP radios.
Syntax ??? set
??name ??? Radio profile name.
??all ??? Configures radios to attack rogues and interfering devices.
??rogue ??? Configures radios to attack rogues only.
set
??configured ??? Configures radios to attack only devices in the attack
list on the WX switch
??none ??? Disables countermeasures for this radio profile.
Defaults ??? Countermeasures are disabled by default.
Access ??? Enabled.
History ??? Command introduced in MSS Version 4.0. New option configured added to support
Examples ??? The following command enables countermeasures in radio profile radprof3 for rogues only:
WX1200# set
The following command disables countermeasures in radio profile radprof3:
WX1200# clear
The following command causes radios managed by radio profile radprof3 to issue countermeasures against devices in the WX switch???s attack list:
WX1200# set
Note that when you issue this command, countermeasures are then issued only against devices in the WX attack list, not against other devices that were classified as rogues by other means.
See Also
412 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set
sends the multicast and broadcast frames stored in its buffers to clients who request them in response to the DTIM.
The DTIM interval applies to both the beaconed SSID and the nonbeaconed SSID.
Syntax ??? set
??name ??? Radio profile name.
??interval ??? Number of times the DTIM is transmitted after every
beacon. You can enter a value from 1 through 31.
Defaults ??? By default, MAP access points send the DTIM once after each beacon.
Access ??? Enabled.
History
Usage ??? You must disable all radios that are using a radio profile before you can change parameters in the profile. Use the set
The DTIM interval does not apply to unicast frames.
Examples ??? The following command changes the DTIM interval for radio profile rp1 to 2:
WX4400# set
See Also
set
See Also
??display
??set
??set
set
milliseconds that a frame scheduled to be transmitted by a radio can remain in buffer memory.
Syntax ??? set
??name ??? Radio profile name.
??time ??? Number of milliseconds. You can enter a value from 500
(0.5 second) through 250,000 (250 seconds).
Defaults ??? The default maximum transmit threshold for MAP radios is 2000 ms (2 seconds).
Access ??? Enabled.
History
Usage ??? You must disable all radios that are using a radio profile before you can change parameters in the profile. Use the set
Examples ??? The following command changes the maximum transmit threshold for radio profile rp1 to 4000 ms:
WX4400# set
See Also
??display
416 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Defaults ??? Each radio profile that you create has a set of properties with factory default values that you can change with the other set
Table 72 lists the parameters controlled by a radio profile and their default values.
Table 72 Defaults for Radio Profile Parameters
set
Table 72 Defaults for Radio Profile Parameters (continued)
Access ??? Enabled.
History
Version 4.2 made the following changes:
??Removed the following parameters that no longer apply:
??
??
??
??The wmm parameter name changed to
Usage ??? Use the command without any optional parameters to create new profile. If the radio profile does not already exist, MSS creates a new radio profile. Use the enable or disable option to enable or disable all the radios using a profile. To assign the profile to one or more radios, use the set ap radio
418 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
To change a parameter in a radio profile, you must first disable all the radios in the profile. After you complete the change, you can reenable the radios.
To enable or disable specific radios without disabling all of them, use the set ap radio command.
Examples ??? The following command configures a new radio profile named rp1:
WX4400# set
The following command enables the radios that use radio profile rp1:
WX4400# set
The following commands disable the radios that use radio profile rp1, change the beacon interval, then reenable the radios:
WX4400# set
WX4400# set
WX4400# set
The following command enables the WPA IE on MAP radios in radio profile rp2:
WX4400# set
See Also
??display ap config on page 316
??display
set
set
Syntax ??? set
??name ??? Radio profile name.
??long ??? Advertises support for long preambles.
??short ??? Advertises support for short preambles.
Defaults ??? The default is short.
Access ??? Enabled.
History
Usage ??? Changing the preamble length value affects only the support advertised by the radio. Regardless of the preamble length setting (short or long), an 802.11b/g radio accepts and can generate 802.11b/g frames with either short or long preambles.
If a client associated with an 802.11b/g radio uses long preambles for unicast traffic, the MAP still accepts frames with short preambles but does not transmit frames with short preambles. This change also occurs if the access point overhears a beacon from an 802.11b/g radio on another access point that indicates the radio has clients that require long preambles.
You must disable all radios that use a radio profile before you can change parameters in the profile. Use the set
Examples ??? The following command configures 802.11b/g radios that use the radio profile rp_long to advertise support for long preambles instead of short preambles:
WX4400# set
See Also
420 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set
set
allows system administrators to track mobile assets using RFID tags.
When you enable RFID mode on a radio profile, radios in the profile can receive and process signals transmitted by RFID tags and relay them with related information to the AeroScout Engine. If the floor plan is modeled in 3WXM, you also can use 3WXM to display the locations of assets.
Syntax ??? set
??
??
??
Defaults ??? The default is disable.
Access ??? Enabled.
History
Examples ??? The following command enables radios managed by radio profile rp1 to act as asset location receivers:
WX1200# set
See Also
??set
??display
set
associate with the MAP.
Syntax ??? set
??name ??? Radio profile name.
??enable ??? Enables data rate enforcement for the radios in the radio
profile.
??disable ??? Disables data rate enforcement for the radios in the radio
profile.
422 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Defaults ??? Data rate enforcement is disabled by default.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? Each type of radio (802.11a, 802.11b, and 802.11g) providing service to an SSID has a set of radio rates allowed for use when sending beacons, multicast frames, and unicast data. You can configure the rate set for each type of radio, specifying rates in three categories:
Mandatory - Valid 802.11 transmit rates that clients must support in order to associate with the MAP.
Disabled - Valid 802.11 transmit rates are disabled. MAPs do not transmit at the disabled rates.
Standard - Valid 802.11 transmit rates that are not disabled and are not mandatory.
By default, the rate set is not enforced, meaning that a client can associate with and transmit data to the MAP using a disabled data rate, although the MAP does not transmit data back to the client at the disabled rate.
You can use this command to enforce the data rates, which means that a connecting client must transmit at one of the mandatory or standard ates in order to associate with the MAP. When data rate enforcement is nabled, clients transmitting at the disabled rates are not allowed to associate with the MAP.
This command is useful if you want to completely prevent clients from transmitting at disabled data rates. For example, you can disable slower data rates so that clients transmitting at these rates do not consume bandwidth on the channel at the expense of clients transmitting at faster rates.
Examples ??? The following command enables data rate enforcement for radio profile rp1:
WX# set
See Also
??display ap counters on page 319
??set
set
with another frame.
Syntax ??? set
??name ??? Radio profile name.
??threshold ??? Maximum frame length, in bytes. You can enter a value
from 256 through 3000.
Defaults ??? The default RTS threshold for a MAP radio is 2346 bytes.
Access ??? Enabled.
History
Usage ??? You must disable all radios that are using a radio profile before you can change parameters in the profile. Use the set
Examples ??? The following command changes the RTS threshold for radio profile rp1 to 1500 bytes:
WX4400# set
See Also
424 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set
settings, in the service profile.
Syntax ??? set
??
characters, with no spaces.
??
alphanumeric characters, with no spaces.
Defaults ??? A radio profile does not have a service profile associated with it by default. In this case, the radios in the radio profile use the default settings for parameters controlled by the service profile. Table 73 lists the parameters controlled by a service profile and their default values.
Table 73 Defaults for Service Profile Parameters
Table 73 Defaults for Service Profile Parameters (continued)
426 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Table 73 Defaults for Service Profile Parameters (continued)
Table 73 Defaults for Service Profile Parameters (continued)
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
??set
430 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set
set
use powersave mode to more efficiently request buffered unicast packets from MAP radios.
When
A client can but is not required to request
Syntax ??? set
??name ??? Radio profile name.
??enable ??? Enable
??disable ??? Disables
Defaults ???
Access ??? Enabled.
History
set
Usage ???
Examples ??? The following command enables
WX2200# set
See Also
??set
??set
??display
set
attributes are applied in addition to any supplied by the RADIUS server or from the local database.
Syntax ??? set
??name ??? Service profile name.
??
using to authorize SSID users for a particular service or session characteristic. For a list of authorization attributes and values that you can assign to network users, see Table 44 on page 262. All of the attributes listed in Table 44 can be used with this command except ssid.
Defaults ??? By default, a service profile does not have any authorization attributes set.
Access ??? Enabled.
History
Usage ??? To change the value of a default attribute for a service profile, use the set
434 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
See Also
??display
??set
??set
??set
set
for that SSID for a userglob that matches the username. If the SSID does not have an authentication rule that matches the username, authentication for the user falls through to the fallthru method.
The fallthru method is a service profile parameter, and applies to all radios within the radio profiles that are mapped to the service profile.
Syntax ??? set
??
access to the SSID requested by the user, without requiring a username and password.
??none ??? Denies authentication and prohibits the user from accessing
the SSID.
The fallthru authentication type none is different from the authentication method none you can specify for administrative access. The fallthru authentication type none denies access to a network user. In contrast, the authentication method none allows access to the WX switch by an administrator. (See ???set authentication admin??? on page 239 and ???set authentication console??? on page 241.)
??
nonvolatile storage for secure login to the network.
Defaults ??? The default fallthru authentication type is
If a username does not match a userglob in an authentication rule for the SSID requested by the user, the WX switch that is managing the radio the user is connected to redirects the user to a web page located on the WX switch. The user must type a valid username and password on the web page to access the SSID.
set
Access ??? Enabled.
History
Usage ??? The
The
Wireless LAN Switch and Controller Configuration Guide.)
Examples ??? The following command sets the fallthru authentication for
SSIDS managed by the service profile rnd_lab to none:
WX4400# set
See Also
??display
??set
set
element (IE) is enabled in the service profile.
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables PSK authentication of WPA clients.
??disable ??? Disables PSK authentication of WPA clients.
Defaults ??? When the WPA IE is enabled, PSK authentication of WPA clients is enabled by default. If the WPA IE is disabled, the
436 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Syntax ??? set
??name ??? Service profile name.
set
?? enable ??? Enables beaconing of the SSID managed by the service profile.
438 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Usage ??? WLAN mesh services can be used in a wireless bridge
configuration, implementing MAPs as bridge endpoints in a transparent Layer 2 bridge. A typical application of wireless bridging is to provide network connectivity between two buildings using a wireless link.
A Mesh Portal AP serving as a bridge endpoint can support up to five Mesh APs serving as bridge endpoints. A Mesh AP serving as a bridge endpoint picks up packets from its wired port and transfers them to the other bridge endpoint. A simple source/destination learning mechanism is used in order to avoid forwarding packets across the bridge unnecessarily.
When wireless bridging is enabled for a service profile, the MAPs with the applied service profile serve as bridge peers. When a Mesh AP associates with a Mesh Portal AP through this service profile, the Mesh Portal AP automatically configures the Mesh AP to operate in bridge mode.
Examples ??? The following command enables wireless bridging on service profile sp1:
WX# set
See Also
??display ap
??set ap
??set
set
Syntax ??? set
??name ??? Service profile name.
??none ??? CAC is not used.
??session ??? CAC is based on the number of active sessions.
Defaults ??? The default CAC mode is none.
Access ??? Enabled.
History
set
Examples ??? The following command enables
WX4400# set
See Also
??display
??set
set
maximum allowed number of active sessions, the radio refuses connections from additional clients.
Syntax ??? set
??name ??? Service profile name.
??
radio.
Defaults ??? The default number of sessions allowed is 14.
Access ??? Enabled.
History
Usage ??? This command applies only when the CAC mode is session. If the CAC mode is none, you can still change the maximum number of sessions, but the setting does not take effect until you change the CAC mode to session. To change the CAC mode, use the set
Examples ??? The following command changes the maximum number of sessions for radios used by service profile sp1 to 10:
WX4400# set
See Also
440 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
See Also
??display
??set
??set
See Also
??display
??set
??set
??set
set
444 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
To support
WEP keys. Use the set
Examples ??? The following command configures service profile sp2 to use
WX4400# set
See Also
??display
??set
??set
??set
??set
??set
set
Syntax ??? set
??name ??? Service profile name.
??level ??? CoS value assigned by the MAP to all traffic in the service
profile.
Defaults ??? The default static CoS level is 0.
Access ??? Enabled.
History
Usage ??? This command applies only when static CoS is enabled. If static CoS is disabled, prioritization is based on the QoS mode configured in the radio profile, and on any ACLs that set CoS. (See the ???Configuring Quality of Service??? chapter of the Wireless LAN Switch and Controller Configuration Guide.) To enable static CoS, use the set
Examples ??? The following command changes the static CoS level to 7 (voice priority):
set
WX4400# set
See Also
??display
??set
set
until the client has been authenticated and authorized. All other traffic is captured by the WX and is not forwarded. After the client is successfully authorized, the traffic restriction is removed.
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables DHCP Restrict.
??disable ??? Disables DHCP Restrict.
Examples ??? DHCP Restrict is disabled by default.
Access ??? Enabled.
History
Usage ??? To further reduce the overhead of DHCP traffic, use the set
Examples ??? The following command enables DHCP Restrict on service profile sp1:
WX4400# set
See Also
??display
446 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set
a client that is still active sends an Ack in reply to the keepalive.
If a client does not send any data or respond to any keepalives before the user idle timeout expires, MSS changes the client session to the Disassociated state.
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables keepalives.
??disable ??? Disables keepalives.
Defaults ???
Access ??? Enabled.
History
Usage ??? The length of time a client can remain idle (unresponsive to
Examples ??? The following command disables
WX4400# set
See Also
set
set
When this option is disabled, a user???s VLAN is reassigned by each WX switch to which a user roams.
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables radios to leave a roamed user on the same VLAN
instead of reassigning the VLAN.
??disable ??? Configures radios to reassign a roamed user???s VLAN.
Defaults ??? This option is disabled by default.
Access ??? Enabled.
History
Usage ??? Even when this option is enabled, the WX switch to which a user roams (the
??A location policy on the local switch reassigns the VLAN.
??The user is configured in the switch???s local database and the
??The access rule on the
Examples ??? The following command enables the
WX1200# set
See Also
set
set
frame without receiving an acknowledgment. A long unicast frame is a frame that is equal to or longer than the
Syntax ??? set
??name ??? Service profile name.
??threshold ??? Number of times the radio can send the same long
unicast frame. You can enter a value from 1 through 15.
Defaults ??? The default long unicast retry threshold is 5 attempts.
Access ??? Enabled.
History
Examples ??? The following command changes the long retry threshold for service profile sp1 to 8:
WX4400# set
See Also
??set
450 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables mesh services for the service profile.
??disable ??? Disables mesh services for the service profile.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
Usage ??? Use this command to configure mesh services for a service profile. Once configured, the service profile can then be mapped to a radio profile that manages a radio on the Mesh Portal MAP, which then allows a Mesh Portal AP to beacon a mesh services SSID to Mesh APs.
Examples ??? The following command enables mesh services for service profile sp1:
WX# set
See Also
set
set
available for unicast traffic. The
When enabled, the
??ARP
??DHCP Offers or
The
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables the
allowed to send broadcast traffic to clients on the service profile???s SSID.
??disable ??? Disables the
Defaults ??? The
Access ??? Enabled.
History
Usage ??? To further reduce ARP traffic on a service profile, use the set
452 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command enables the
WX4400# set
See Also
??display
??set
??set
set
broadcast overhead on a service profile SSID by eliminating ARP broadcasts from MAP radios to the SSID???s clients.
If the ARP request is for a client with an IP address the WX does not already know, the WX allows MAP radios to send the ARP request to clients. If the
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables proxy ARP.
??disable ??? Disables proxy ARP.
Defaults ??? Proxy ARP is disabled by default.
Access ??? Enabled.
History
Usage ??? To further reduce broadcast traffic on a service profile, use the set
set
Examples ??? The following command enables proxy ARP on service profile sp1:
WX4400# set
success: change accepted.
See Also
??display
??set
??set
set
pairwise master key (PMK) to derive unique pairwise session keys for individual WPA clients.
Syntax ??? set
??name ??? Service profile name.
??passphrase ??? An ASCII string from 8 to 63 characters long. The
string can contain blanks if you use quotation marks at the beginning and end of the string.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? MSS converts the passphrase into a
To use PSK authentication, you must enable it and you also must enable the WPA IE.
454 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command configures service profile sp3 to use passphrase ???1234567890123<>?=+&% The quick brown fox jumps over the lazy sl???:
WX4400# set
success: change accepted.
See Also
??display
??set
??set
??set
??set
set
pairwise master key (PMK) to derive unique pairwise session keys for individual WPA clients.
Syntax ??? set
??name ??? Service profile name.
??hex ??? A
number. Enter the
Defaults ??? None.
Examples ??? Enabled.
History
Usage ??? MSS converts the hexadecimal number into a
To use PSK authentication, you must enable it and you also must enable
WPA IE.
set
Examples ??? The following command configures service profile sp3 to use a raw PSK with PSK clients:
WX4400# set
success: change accepted.
See Also
??display
??set
??set
??set
??set
set
The RSN IE advertises the RSN authentication methods and cipher suites supported by radios in the radio profile mapped to the service profile.
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables the RSN IE.
??disable ??? Disables the RSN IE.
Defaults ??? The RSN IE is disabled by default.
Access ??? Enabled.
History
Examples ??? The following command enables the RSN IE in service profile sprsn:
WX4400# set
See Also
456 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set
Use this command only if advised to do so by 3Com. This command does not enable preshared key (PSK) authentication for
set
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables
??disable ??? Disables
Defaults ???
Access ??? Enabled.
History
Examples ??? The following command enables
WX4400# set
See Also
??display
??set
??set
set
frame without receiving an acknowledgment. A short unicast frame is a frame that is shorter than the
Syntax ??? set
threshold
??name ??? Service profile name.
set
??threshold ??? Number of times a radio can send the same short
unicast frame. You can enter a value from 1 through 15.
Defaults ??? The default short unicast retry threshold is 5 attempts.
Examples ??? Enabled.
History
Examples ??? The following command changes the short retry threshold for service profile sp1 to 3:
WX4400# set
See Also
??display
??set
??set
set
Syntax ??? set
directory
??name ??? Service profile name.
??directory ??? Directory on the WX for SODA agent files.
Defaults ??? By default, the WX expects SODA agent files to be located in a directory with the same name as SSID.
Access ??? Enabled.
History
Usage ??? If the same SODA agent is used for multiple service profiles, you can use this command to specify a single directory for SODA agent files on the WX, rather than placing the same SODA agent files in a separate directory for each service profile.
458 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Examples ??? The following command specifies
WX4400# set
success: change accepted.
See Also
??display
??install soda agent on page 673
??uninstall soda agent on page 688
set
Syntax ??? set
??name ??? Service profile name.
??enable ??? SODA agent checks are performed before the client is
allowed access to the network.
??disable ??? Allows the client access to the network immediately after
the SODA agent is downloaded, without waiting for the checks to be run.
Defaults ??? By default, SODA agent checks are performed before the client is allowed access to the network.
Access ??? Enabled
History
Usage ??? When the SODA agent is enabled in a service profile, by default the SODA agent checks are downloaded to a client and run before the client is allowed on the network. You can use this command to disable the enforcement of the SODA security checks, so that the client is allowed access to the network immediately after the SODA agent is downloaded, rather than waiting for the security checks to be run.
set
When the enforce checks option is enabled, upon successful completion of the SODA agent checks, the client performs an HTTP Get operation to load the success page. Upon loading the success page, the client is granted access to the network.
In order for the client to load the success page, you must make sure the SODA agent is configured (through SODA Manager) with the correct URL of the success page, so that the WX can serve the page to the client.
Similarly, you must make sure the SODA agent is configured with the correct URLs of the failure and logout pages, so that when the client requests these pages, the WX can serve those pages as well.
Examples ??? The following command allows network access to clients after they have downloaded the SODA agent, but without requiring that the SODA agent checks be completed:
WX4400# set
See Also
??display
??set
set
Syntax ??? set
??name ??? Service profile name.
??page ??? Page that is loaded if the client fails the security checks
performed by the SODA agent.
Defaults ??? By default, the WX dynamically generates a page indicating that the SODA agent checks have failed.
Access ??? Enabled.
History
460 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Usage ??? Use this command to specify a custom page to be loaded by the client when the SODA agent checks fail. After this page is loaded, the specified remediation ACL takes effect, or if there is no remediation ACL configured, then the client is disconnected from the network.
This functionality occurs only when the enforce checks option is enabled for the service profile. The enforce checks option is enabled by default.
The page is assumed to reside in the root directory on the WX. You can optionally specify a different directory where the page resides.
Examples ??? The following command specifies failure.html as the page to load when a client fails the SODA agent checks:
WX4400# set
success: change accepted.
The following command specifies failure.html, in the
WX4400# set
success: change accepted.
See Also
??display
??set
??set
set
Syntax ??? set
??name ??? Service profile name.
??page ??? Page that is loaded when the client closes the SODA virtual
desktop.
Defaults ??? None.
Access ??? Enabled.
set
History
Usage ??? When a client closes the SODA virtual desktop, the client is automatically disconnected from the network. You can use this command to specify a page that loads when the client closes the SODA virtual desktop.
The client can request this page at any time, to ensure that the client???s session has been terminated. You can add the IP address of the WX switch to the DNS server as a
The page is assumed to reside in the root directory on the WX switch. You can optionally specify a different directory where the page resides.
For the logout page to load properly, you must enable the HTTPS server on the WX switch, so that clients can access the page using HTTPS. To do this, use the set ip https server enable command.
Examples ??? The following command specifies logout.html as the page to load when a client closes the SODA virtual desktop:
WX4400# set
The following command specifies logout.html, in the
WX4400# set
success: change accepted.
See Also
462 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
set
set
See Also
??display
??set
??set
set
Syntax ??? set
??name ??? Service profile name.
??
include blank spaces in the name, if you delimit the name with single or double quotation marks. You must use the same type of quotation mark (either single or double) on both ends of the string.
Defaults ??? The default SSID name is private.
Access ??? Enabled.
History
Examples ??? The following command applies the name guest to the
SSID managed by service profile clear_wlan:
WX4400# set
See Also
466 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
See Also
??display
??set
set
countermeasures are in effect, MAP radios dissociate all TKIP and WPA WEP clients and refuse all association and reassociation requests until the countermeasures end.
Syntax ??? set
??name ??? Service profile name.
??
effect. You can specify from 0 to 60,000.
Defaults ??? The default countermeasures wait time is 60,000 ms (60 seconds).
Access ??? Enabled.
History
Usage ??? Countermeasures apply only to TKIP and WEP clients. This includes WPA WEP clients and
The TKIP cipher suite must be enabled. The WPA IE also must be enabled.
Examples ??? The following command changes the countermeasures wait time for service profile sp3 to 30,000 ms (30 seconds):
WX4400# set
See Also
??display
??set
??set
set
802.1p or DSCP markings in the packets themselves, and regardless of any ACLs that mark CoS. This option provides a simple way to configure an SSID for priority traffic such as VoIP traffic.
When static CoS is enabled, the standard MSS prioritization mechanism is not used. Instead, the MAP sets CoS as follows:
??For traffic from the MAP to clients, the MAP places the traffic into the forwarding queue that corresponds to the CoS level configured on the service profile. For example, if the static CoS level is set to 7, the MAP radio places client traffic in its Voice queue.
??For traffic from clients to the network, the MAP marks the DSCP value in the IP headers of the tunnel packets used to carry the user data from the MAP to the WX switch.
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables static CoS on the service profile.
??disable ??? Disables static CoS on the service profile.
468 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Defaults ??? Static CoS is disabled by default.
Access ??? Enabled.
History
Usage ??? The CoS level is specified by the set
Examples ??? The following command enables static CoS on service profile sp1:
WX4400# set
See Also
??display
??set
set
Syntax ??? set
??name ??? Service profile name.
??11a | 11b | 11g ??? Radio type.
??mandatory
These rates are advertised in the basic rate set of 802.11 beacons, probe responses, and reassociation response frames sent by MAP radios.
Data frames and management frames sent by MAP radios use one of the specified mandatory rates.
The valid rates depend on the radio type:
??
??
??
Use a comma to separate multiple rates; for example: 6.0,9.0,12.0
??disabled
not use to transmit data. This setting applies only to data sent by the MAP radios. The radios still accepts frames from clients at disabled data rates.
The valid rates depend on the radio type and are the same as the valid rates for mandatory.
??
radios. This rate is also used for
The valid rates depend on the radio type and are the same as the valid rates for mandatory. However, you cannot set the beacon rate to a disabled rate.
??
sent by MAP radios.
??
depend on the radio type and are the same as the valid rates for mandatory. However, you cannot set the multicast rate to a disabled rate.
??
clients connected to the MAP radio.
Defaults ??? This command has the following defaults:
??mandatory:
??
??
??
??
470CHAPTER 11: MANAGED ACCESS POINT COMMANDS
??
??
??
??
??
Access ??? Enabled.
History
Usage ??? If you disable a rate, you cannot use the rate as a mandatory rate or the beacon or multicast rate. All rates that are applicable to the radio type and that are not disabled are supported by the radio.
Examples ??? The following command sets 802.11a mandatory rates for service profile sp1 to 6 Mbps and 9 Mbps, disables rates 48 Mbps and 54 Mbps, and changes the beacon rate to 9 Mbps:
WX4400# set
success: change accepted.
See Also
??display
Syntax ??? set
??name ??? Service profile name.
??enabled ??? Enables mapping QoS level from the DSCP level.
??disabled ??? Disables mapping QoS level from the DSCP level.
Defaults ??? Disabled.
Access ??? Enabled.
History ??? Introduced in MSS Version 6.0.
set
History
Examples ??? The following command enables mapping the QoS level of IP packets based on their DSCP value for service profile sp1:
WX# set
See Also
??display
set
probes). If the timer expires, the client session is changed to the Dissociated state.
The timer is reset to 0 each time a client sends data or responds to an
Syntax ??? set
??name ??? Service profile name.
??seconds ??? Number of seconds a client is allowed to remain idle
before MSS changes the session to the Dissociated state. You can specify from 20 to 86400 seconds.
To disable the timer, specify 0.
Defaults ??? The default user idle timeout is 180 seconds (3 minutes).
Access ??? Enabled.
History
Examples ??? The following command increases the user idle timeout to 360 seconds (6 minutes):
472 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
WX4400# set
See Also
??display
??set
??set
set
Use this command if you create a custom
Syntax ??? set
??
??
during authentication.
Defaults ??? By default, a service profile
Access ??? Enabled.
History
Usage ??? The first time you set the service profile
set
The
Examples ??? The following command changes the
WX1200# set
See Also
??set
??display
set
Syntax ??? set
??name ??? Service profile name.
??url ??? WX subdirectory name and HTML page name of the login
page. Specify the full path. For example,
Defaults ??? The 3Com Web login page is served by default.
Access ??? Enabled.
History
Usage ??? 3Com recommends that you create a subdirectory for the custom page and place all the page???s files in that subdirectory. Do not place the custom page in the root directory of the switch???s user file area.
If the custom login page includes gif or jpg images, their path names are interpreted relative to the directory from which the page is served.
474 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
To use WebAAA, the fallthru authentication type in the service profile that manages the SSID must be set to web. To use WebAAA for a wired authentication port, edit the port configuration with the set port type
Examples ??? The following commands create a subdirectory named
WX4400# mkdir
WX4400# copy
WX4400# copy
===============================================================================
file:
WX4400# set
success: change accepted.
See Also
??display
??set port type
480 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Defaults ??? By default, no static WEP keys are defined.
Access ??? Enabled.
History
Usage ??? MSS automatically enables static WEP when you define a WEP key. MSS continues to support dynamic WEP.
If you plan to use static WEP, do not map more than 8 service profiles that contain static WEP keys to the same radio profile.
Examples ??? The following command configures WEP key index 1 for service profile sp2 to aabbccddee:
WX4400# set
success: change accepted.
See Also
??display
??set
set
set
by radios in the radio profile mapped to the service profile.
Syntax ??? set
??name ??? Service profile name.
??enable ??? Enables the WPA IE.
??disable ??? Disables the WPA IE.
Defaults ??? The WPA IE is disabled by default.
Access ??? Enabled.
History
Usage ??? When the WPA IE is enabled, the default authentication method is 802.1X. There is no default cipher suite. You must enable the cipher suites you want the radios to support.
Examples ??? The following command enables the WPA IE in service profile sp2:
WX4400# set
See Also
??display
??set
??set
??set
??set
482 CHAPTER 11: MANAGED ACCESS POINT COMMANDS
Use Spanning Tree Protocol (STP) commands to configure and manage spanning trees on the virtual LANs (VLANs) configured on a wireless LAN switch or controller, to maintain a
484 CHAPTER 12: STP COMMANDS
Table 74 STP Commands by Usage (continued)
Syntax ??? clear spantree portcost
??
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? This command resets the cost in all VLANs. To reset the cost for only specific VLANs, use the clear spantree portvlancost command.
Examples ??? The following command resets the STP port cost on ports 5 and 6 to the default value:
WX1200# clear spantree portcost
See Also
??clear spantree portvlancost on page 485
??display spantree on page 488
??display spantree portvlancost on page 494
486CHAPTER 12: STP COMMANDS
??vlan
the specified VLAN.
488 CHAPTER 12: STP COMMANDS
display spantree Displays STP configuration and
Syntax ??? display spantree
??
displays STP information for all ports.
??vlan
MSS displays STP information for all VLANs.
??active ??? Displays information for only the active (forwarding) ports.
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 3.0. Version 4.2 added a value STP Off for
Examples ??? The following command displays STP information for VLAN default:
490 CHAPTER 12: STP COMMANDS
Table 75 Output for display spantree (continued)
display spantree backbonefast 491
Table 75 Output for display spantree (continued)
492 CHAPTER 12: STP COMMANDS
Examples ??? The following command shows information about blocked ports on a WX switch for the default VLAN (VLAN 1):
WX4400# display spantree blockedports vlan default
PortVlan
2190 Blocking 4 128 Disabled
Number of blocked ports (segments) in VLAN 1 : 1
The port information is the same as the information displayed by the display spantree command. See Table 75 on page 489.
See Also
display spantree portfast 493
Syntax ??? display spantree portfast
??
displays uplink fast convergence information for all ports.
Defaults ??? None.
Access ??? All.
History
Examples ??? The following command shows uplink fast convergence information for all ports:
WX1200# display spantree portfast
Table 76 describes the fields in this display.
Table 76 Output for display spantree portfast
See Also
494 CHAPTER 12: STP COMMANDS
Syntax ??? display spantree portvlancost
??
Defaults ??? None.
Access ??? All.
History
Examples ??? The following command shows the STP port cost of port 1:
WX4400# display spantree portvlancost 1 port 1 VLAN 1 have path cost 19
See Also
??clear spantree portcost on page 484
??clear spantree portvlancost on page 485
??display spantree on page 488
??set spantree portcost on page 505
??set spantree portvlancost on page 508
display spantree Displays STP statistics for one or more WX network ports. statistics
Syntax ??? display spantree statistics
??
displays STP statistics for all ports.
??vlan
MSS displays STP statistics for all VLANs.
Defaults ??? None.
Access ??? All.
History
display spantree statistics 495
Usage ??? The command displays statistics separately for each port.
Examples ??? The following command shows STP statistics for port 1:
WX4400# display spantree statistics 1
BPDU related parameters
498 CHAPTER 12: STP COMMANDS
Table 77 Output for display spantree statistics (continued)
display spantree statistics 499
Table 77 Output for display spantree statistics (continued)
502 CHAPTER 12: STP COMMANDS
Syntax ??? set spantree backbonefast {enable | disable}
??enable ??? Enables backbone fast convergence.
??disable ??? Disables backbone fast convergence.
Defaults ??? STP backbone fast path convergence is disabled by default.
Access ??? Enabled.
History
Usage ??? If you plan to use the backbone fast convergence feature, you must enable it on all the bridges in the spanning tree.
Examples ??? The following command enables backbone fast convergence:
WX4400# set spantree backbonefast enable success: change accepted.
See Also
set spantree fwddelay 503
See Also
??display spantree on page 488
set spantree hello Changes the interval between STP hello messages sent by a wireless LAN switch when operating as the root bridge, on one or all of its configured VLANs.
Syntax ??? set spantree hello interval {all | vlan
??interval ??? Interval value. You can specify from 1 through 10
seconds.
??all ??? Changes the interval on all VLANs.
??vlan
only the specified VLAN.
Defaults ??? The default hello timer interval is 2 seconds.
504 CHAPTER 12: STP COMMANDS
??
40 seconds.
??all ??? Changes the maximum age on all VLANs.
??vlan
age on only the specified VLAN.
Defaults ??? The default maximum age for root bridge hello packets is 20 seconds.
Access ??? Enabled.
History
Examples ??? The following command changes the maximum acceptable age for root bridge hello packets on all VLANs to 15 seconds:
WX4400# set spantree maxage 15 all success: change accepted.
See Also
set spantree portpri 507
set spantree portpri Changes the STP priority of a network port or ports for selection as part of the path to the STP root bridge in the default VLAN on a wireless LAN switch.
Syntax ??? set spantree portpri
??
ports.
??priority value ??? Priority value. You can specify a value from 0
(highest priority) through 255 (lowest priority).
Defaults ??? The default STP priority for all network ports is 128.
Access ??? Enabled.
History
Usage ??? This command applies only to the default VLAN (VLAN 1). To change the priority of a port in another VLAN, use the set spantree portvlanpri command.
Examples ??? The following command sets the priority of ports 3 and 4 to 48:
WX1200# set spantree portpri
See Also
??clear spantree portpri on page 485
??clear spantree portvlanpri on page 486
508 CHAPTER 12: STP COMMANDS
set spantree portvlanpri 509
See Also
??clear spantree portpri on page 485
??clear spantree portvlanpri on page 486
510 CHAPTER 12: STP COMMANDS
Syntax ??? set spantree uplinkfast {enable | disable}
??enable ??? Enables uplink fast convergence.
??disable ??? Disables uplink fast convergence.
Defaults ??? Disabled.
Access ??? Enabled.
set spantree uplinkfast 511
History
Usage ??? The uplink fast convergence feature is applicable to bridges that are acting as access switches to the network core (distribution layer) but are not in the core themselves. Do not enable the feature on WX switches that are in the network core.
Examples ??? The following command enables uplink fast convergence:
WX4400# set spantree uplinkfast enable success: change accepted.
See Also
512 CHAPTER 12: STP COMMANDS
Use Internet Group Management Protocol (IGMP) snooping commands to configure and manage multicast traffic reduction on a WX.
514 CHAPTER 13: IGMP SNOOPING COMMANDS
clear igmp statistics Clears IGMP statistics counters on one VLAN or all VLANs on a wireless LAN switch and resets them to 0.
Syntax ??? clear igmp statistics [vlan
??vlan
VLAN, IGMP statistics are cleared for all VLANs.
Syntax ??? display igmp [vlan
??vlan
VLAN, MSS displays IGMP information for all VLANs.
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 3.0.
display igmp 515
Examples ??? The following command displays IGMP information for
VLAN orange:
516 CHAPTER 13: IGMP SNOOPING COMMANDS
Table 81 describes the fields in this display.
Table 81 Output for display igmp
display igmp 517
Table 81 Output for display igmp (continued)
Syntax ??? display igmp querier [vlan
??vlan
VLAN, MSS displays querier information for all VLANs.
Defaults ??? None.
Access ??? Enabled.
520 CHAPTER 13: IGMP SNOOPING COMMANDS
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command displays querier information for
VLAN orange:
WX1200# display igmp querier vlan orange
The following command shows the information MSS displays when the querier is the WX itself:
WX1200# display igmp querier vlan default
Querier for vlan default:
I am the querier for vlan default, time to next query is 20
The output indicates how many seconds remain before the
If IGMP snooping does not detect a querier, the output indicates this finding, as shown in the following example:
WX1200# display igmp querier vlan red
Querier for vlan red:
There is no querier present on vlan red
This condition does not necessarily indicate a problem. For example, election of the querier might be in progress.
Table 83 describes the fields in this display. Table 82 on page 519 describes the fields in the display when a querier other than the WX is present.
Table 83 Output for display igmp mrouter
Field Description
Querier for vlan VLAN containing the querier. Information is listed separately for each VLAN.
Defaults ??? None.
Access ??? All.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command displays all multicast receivers in
VLAN orange:
522 CHAPTER 13: IGMP SNOOPING COMMANDS
The following command lists all receivers for multicast groups 237.255.255.1 through 237.255.255.255, in all VLANs:
Table 84 describes the fields in this display.
Table 84 Output for display igmp
See Also
524 CHAPTER 13: IGMP SNOOPING COMMANDS
Table 85 Output of display igmp statistics
Syntax ??? set igmp {enable | disable} [vlan
?? enable ??? Enables IGMP snooping.
?? disable ??? Disables IGMP snooping.
?? vlan
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command disables IGMP snooping on VLAN orange:
WX1200# set igmp disable vlan orange success: change accepted
See Also
526 CHAPTER 13: IGMP SNOOPING COMMANDS
Defaults ??? The default last member query interval is 10 tenths of a second (1 second).
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command changes the last member query interval on VLAN orange to 5 tenths of a second:
WX1200# set igmp lmqi 5 vlan orange success: change accepted.
See Also
set igmp mrouter 527
set igmp mrouter Adds or removes a port in a WX???s list of ports on which it forwards traffic to multicast routers. Static multicast ports are immediately added to or removed from the list of router ports and do not age out.
Syntax ??? set igmp mrouter port
??port
in the list of static multicast router ports.
??enable ??? Adds the port to the list of static multicast router ports.
??disable ??? Removes the port from the list of static multicast router
ports.
Defaults ??? By default, no ports are static multicast router ports.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? You cannot add MAP access ports or wired authentication ports as static multicast ports. However, MSS can dynamically add these port types to the list of multicast ports based on multicast traffic.
Examples ??? The following command adds port 6 as a static multicast router port:
WX1200# set igmp mrouter port 6 enable success: change accepted.
The following command removes port 6 from the static multicast router port list:
WX1200# set igmp mrouter port 6 disable success: change accepted.
See Also
528 CHAPTER 13: IGMP SNOOPING COMMANDS
Syntax ??? set igmp mrsol {enable | disable} [vlan
??enable ??? Enables multicast router solicitation.
??disable ??? Disables multicast router solicitation.
??vlan
VLAN, multicast router solicitation is disabled or enabled on all VLANs.
Defaults ??? Multicast router solicitation is disabled on all VLANs by default.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? The following command enables multicast router solicitation on VLAN orange:
WX1200# set igmp mrsol enable vlan orange success: change accepted
See Also
??set igmp mrsol mrsi on page 528
set igmp mrsol mrsi Changes the interval between multicast router solicitations by a WX on one VLAN or all VLANs.
Syntax ??? set igmp mrsol mrsi seconds [vlan
??seconds ??? Number of seconds between multicast router solicitations.
You can specify a value from 1 through 65,535.
??vlan
VLAN, MSS changes the multicast router solicitation interval for all
VLANs.
Defaults ??? The interval between multicast router solicitations is 30 seconds by default.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
set igmp qi 531
Syntax ??? set igmp qi seconds [vlan
??qi seconds ??? Number of seconds that elapse between general
queries sent by the WX when the WX switch is the querier for the subnet. You can specify a value from 1 through 65,535.
??vlan
VLAN, the timer change applies to all VLANs.
Defaults ??? The default query interval is 125 seconds.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? The query interval is applicable only when the WX is querier for the subnet. For the WX switch to become the querier, the
Examples ??? The following command changes the query interval on
VLAN orange to 100 seconds:
WX1200# set igmp qi 100 vlan orange success: change accepted.
See Also
??set igmp querier on page 533
532 CHAPTER 13: IGMP SNOOPING COMMANDS
Defaults ??? The default query response interval is 100 tenths of a second (10 seconds).
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? The query response interval is applicable only when the WX is querier for the subnet. For the WX to become the querier, the
Examples ??? The following command changes the query response interval on VLAN orange to 50 tenths of a second (5 seconds):
WX1200# set igmp qri 50 vlan orange success: change accepted.
See Also
set igmp querier 533
set igmp querier Enables or disables the IGMP
Syntax ??? set igmp querier {enable | disable} [vlan
??enable ??? Enables the
??disable ??? Disables the
??vlan
VLAN, the
Defaults ??? The
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? 3Com recommends that you use the
Examples ??? The following example enables the
WX1200# set igmp querier enable vlan orange success: change accepted.
See Also
??display igmp querier on page 519
set igmp receiver Adds or removes a network port in the list of ports on which a WX forwards traffic to multicast receivers. Static multicast receiver ports are immediately added to or removed from the list of receiver ports and do not age out.
Syntax ??? set igmp receiver port
??port
the list of static multicast receiver ports.
??enable ??? Adds the port to the list of static multicast receiver ports.
??disable ??? Removes the port from the list of static multicast receiver
ports.
534 CHAPTER 13: IGMP SNOOPING COMMANDS
set igmp rv 535
See Also
536 CHAPTER 13: IGMP SNOOPING COMMANDS
Use security ACL commands to configure and monitor security access control lists (ACLs). Security ACLs filter packets to restrict or permit network usage by certain users or traffic types, and can assign to packets a class of service (CoS) to define the priority of treatment for packet filtering.
(Security ACLs are different from the location policy on a WX, which helps you locally control user access. For location policy commands, see ???AAA Commands??? on page 211.)
538 CHAPTER 14: SECURITY ACL COMMANDS
clear security acl Clears a specified security ACL, an access control entry (ACE), or all security ACLs, from the edit buffer. When used with the command commit security acl, clears the ACE from the running configuration.
Syntax ??? clear security acl
??
start with a letter and are
??all ??? Clears all security ACLs.
??
entry (ACE) in the security ACL to clear. If you do not specify an ACE, all ACEs are cleared from the ACL.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? This command deletes security ACLs only in the edit buffer. You must use the commit security acl command with this command to delete the ACL or ACE from the running configuration and nonvolatile storage.
The clear security acl command deletes a security ACL, but does not stop its current filtering function if the ACL is mapped to any virtual LANs (VLANs), ports, or virtual ports, or if the ACL is applied in a
Examples ??? The following commands display the current security ACL configuration, clear acl_133 in the edit buffer, commit the deletion to the running configuration, and redisplay the ACL configuration to display that it no longer contains acl_133:
clear security acl map 539
WX4400# display security acl info all
ACL information for all
set security acl ip acl_133 (hits #1 0)
1. deny IP source IP 192.168.1.6 0.0.0.0 destination IP any set security acl ip acl_134 (hits #3 0)
1. permit IP source IP 192.168.0.1 0.0.0.0 destination IP any
1. deny IP source IP 192.168.1.1 0.0.0.0 destination IP any
WX4400# commit security acl acl_133 configuration accepted
WX4400# display security acl info all
ACL information for all
set security acl ip acl_134 (hits #3 0)
1. permit IP source IP 192.168.0.1 0.0.0.0 destination IP any
1. deny IP source IP 192.168.1.1 0.0.0.0 destination IP any
See Also
??clear security acl map on page 539
??commit security acl on page 541
??display security acl info on page 545
??set security acl on page 552
clear security acl Deletes the mapping between a security ACL and a virtual LAN (VLAN), mapone or more physical ports, or a virtual port. Or deletes all ACL maps to
VLANs, ports, and virtual ports on a WX switch.
Security ACLs are applied to users or groups dynamically via the
attr, clear usergroup attr, or clear
commit security acl 541
To clear all physical ports, virtual ports, and VLANs on a WX switch of the ACLs mapped for incoming and outgoing traffic, type the following command:
WX4400# clear security acl map all success: change accepted.
See Also
??clear security acl on page 538
??display security acl map on page 546
??set security acl map on page 557
commit security acl Saves a security ACL, or all security ACLs, in the edit buffer to the running configuration and nonvolatile storage on the WX switch. Or, when used with the clear security acl command, commit security acl deletes a security ACL, or all security ACLs, from the running configuration and nonvolatile storage.
Syntax ??? commit security acl
??
must start with a letter and are
??all ??? Commits all security ACLs in the edit buffer.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? Use the commit security acl command to save security ACLs into, or delete them from, the permanent configuration. Until you commit the creation or deletion of a security ACL, it is stored in an edit buffer and is not enforced. After you commit a security ACL, it is removed from the edit buffer.
A single commit security acl all command commits the creation and/or deletion of whatever display security acl info all editbuffer shows to be currently stored in the edit buffer.
542 CHAPTER 14: SECURITY ACL COMMANDS
Examples ??? The following commands commit all the security ACLs in the edit buffer to the configuration, display a summary of the committed ACLs, and show that the edit buffer has been cleared:
WX4400# display security acl info all editbuffer acl editbuffer information for all
See Also
??clear security acl on page 538
??display security acl on page 542
??display security acl info on page 545
??rollback security acl on page 551
??set security acl on page 552
display security acl Displays a summary of the security ACS that are mapped.
Syntax ??? display security acl
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? This command lists only the ACLs that have been mapped to something (a user, or VLAN, or port, and so on). To list all committed ACLs, use the display security acl info command. To list ACLs that have not yet been committed, use the display security acl editbuffer command.
Examples ??? To display a summary of the mapped security ACLs on a on a WX switch, type the following command:
Syntax ??? display security acl [info all] editbuffer
?? info all ??? Displays the ACEs in each uncommitted ACL. Without this option, only the ACE names are listed.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 1.0.
Examples ??? To view a summary of the security ACLs in the edit buffer, type the following command:
WX4400# display security acl editbuffer
544 CHAPTER 14: SECURITY ACL COMMANDS
To view details about these uncommitted ACLs, type the following command.
WX4400# display security acl info all editbuffer
ACL
set security acl ip
1.permit IP source IP 192.168.254.12 0.0.0.0 destination IP
any
2.permit IP source IP 192.168.253.11 0.0.0.0 destination IP
any
3.deny SRC source IP 192.168.253.1 0.0.0.255
set security acl ip
1. permit SRC source IP 192.168.1.1 0.0.0.0
See Also
??clear security acl on page 538
??commit security acl on page 541
??display security acl on page 542
??display security acl info on page 545
??set security acl on page 552
display security acl Displays the number of packets filtered by security ACLs (???hits???) on the hitsWX switch. Each time a packet is filtered by a security ACL, the hit
counter increments.
Syntax ??? display security acl hits
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Usage ??? For MSS to count hits for a security ACL, you must specify hits in the set security acl commands that define ACE rules for the ACL.
display security acl info 545
Examples ??? To display the security ACL hits on a WX switch, type the following command:
WX4400# display security acl hits
See Also
??set security acl
??set security acl on page 552
display security acl Displays the contents of a specified security ACL or all security ACLs that infoare committed ??? saved in the running configuration and nonvolatile
storage ??? or the contents of security ACLs in the edit buffer before they are committed.
Syntax ??? display security acl info
??
must start with a letter and are
??all ??? Displays the contents of all security ACLs.
??editbuffer ??? Displays the contents of the specified security ACL or
all security ACLs that are stored in the edit buffer after being created with set security acl. If you do not use this parameter, only committed ACLs are shown.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0. The
546 CHAPTER 14: SECURITY ACL COMMANDS
Examples ??? To display the contents of all security ACLs committed on a
WX switch, type the following command:
WX4400# display security acl info
ACL information for all
set security acl ip acl_123 (hits #5 462)
1.permit IP source IP 192.168.1.11 0.0.0.255 destination IP any
2.deny IP source IP 192.168.2.11 0.0.0.0 destination IP any
set security acl ip acl_134 (hits #3 0)
1. permit IP source IP 192.168.0.1 0.0.0.0 destination IP any
1. deny IP source IP 192.168.1.1 0.0.0.0 destination IP any
The following command displays the contents of acl_123 in the edit buffer, including the committed ACE rules 1 and 2 and the uncommitted rule 3:
WX4400# display security acl info acl_123 editbuffer
ACL
set security acl ip acl_123 (ACEs 3, add 3, del 0, modified 0)
1.permit IP source IP 192.168.1.11 0.0.0.255 destination IP any
2.deny IP source IP 192.168.2.11 0.0.0.0 destination IP any
3.deny SRC source IP 192.168.1.234 255.255.255.255
See Also
??clear security acl on page 538
??commit security acl on page 541
??set security acl on page 552
Syntax ??? display security acl map
??
static mapping. ACL names must start with a letter and are
Defaults ??? None.
display security acl
550 CHAPTER 14: SECURITY ACL COMMANDS
Table 87 Output of display security acl
rollback security acl 551
Table 87 Output of display security acl
rollback security acl Clears changes made to the security ACL edit buffer since it was last saved. The ACL is rolled back to its state after the last commit security acl command was entered. All uncommitted ACLs in the edit buffer are cleared.
Syntax ??? rollback security acl
??
must start with a letter and are
??all ??? Rolls back all security ACLs in the edit buffer, clearing all
uncommitted ACEs.
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
552 CHAPTER 14: SECURITY ACL COMMANDS
Examples ??? The following commands show the edit buffer before a rollback, clear any changes in the edit buffer to security acl_122, and show the edit buffer after the rollback:
WX4400# display security acl info all editbuffer
ACL
set security acl ip acl_122 (ACEs 3, add 3, del 0, modified 0)
1.permit IP source IP 20.0.1.11 0.0.0.255 destination IP any
2.deny IP source IP 20.0.2.11 0.0.0.0 destination IP any
3.deny SRC source IP 192.168.1.234 255.255.255.255
WX4400# rollback security acl acl_122
WX4400# display security acl info all editbuffer
ACL
set security acl 553
By ICMP packets
Syntax ??? set security acl ip
By TCP packets
Syntax ??? set security acl ip
By UDP packets
Syntax ??? set security acl ip
??
the WX switch, must start with a letter, and are
??Letters a through z and A through Z
??Numbers 0 through 9
??Hyphen
3Com recommends that you do not use the same name with different capitalizations for ACLs. For example, do not configure two separate ACLs with the names acl_123 and ACL_123.
In an ACL name, do not include the term all,
??permit ??? Allows traffic that matches the conditions in the ACE.
??cos cos ??? For permitted packets, a
packet handling. Specify a value from 0 through 7:
??1 or
554CHAPTER 14: SECURITY ACL COMMANDS
??0 or
??4 or
Use CoS level 4 or 5 for voice over IP (VoIP) packets other than SpectraLink Voice Priority (SVP).
??6 or
In MSS Version 3.0, use 6 or 7 only for VoIP phones that use SVP, not for other types of traffic.
??deny ??? Blocks traffic that matches the conditions in the ACE.
??protocol ??? IP protocol by which to filter packets:
??ip
??tcp
??udp
??icmp
??A protocol number between 0 and 255.
(For a complete list of IP protocol names and numbers, see
??
network or host from which the packet is being sent. Specify both address and mask in dotted decimal notation. For more information, see ???Wildcard Masks??? on page 30.
??operator port [port2] ??? Operand and port number(s) for matching
TCP or UDP packets to the number of the source or destination port on
??eq ??? Packets are filtered for only port number.
??gt ??? Packets are filtered for all ports that are greater than port
number.
??lt ??? Packets are filtered for all ports that are less than port
number.
??neq ??? Packets are filtered for all ports except port number.
??range ??? Packets are filtered for ports in the range between port
and port2. To specify a port range, enter two port numbers. Enter the lower port number first, followed by the higher port number.
set security acl map 557
The following command adds an ACE to acl_123 that denies packets from IP address 192.168.2.11:
WX4400# set security acl ip acl_123 deny 192.168.2.11 0.0.0.0
The following command creates acl_125 by defining an ACE that denies TCP packets from source IP address 192.168.0.1 to destination IP address 192.168.0.2 for established sessions only, and counts the hits:
WX4400# set security acl ip acl_125 deny tcp 192.168.0.1 0.0.0.0 192.168.0.2 0.0.0.0 established hits
The following command adds an ACE to acl_125 that denies TCP packets from source IP address 192.168.1.1 to destination IP address 192.168.1.2, on destination port 80 only, and counts the hits:
WX4400# set security acl ip acl_125 deny tcp 192.168.1.1 0.0.0.0 192.168.1.2 0.0.0.0 eq 80 hits
Finally, the following command commits the security ACLs in the edit buffer to the configuration:
WX4400# commit security acl all configuration accepted
See Also
??clear security acl on page 538
??commit security acl on page 541
??display security acl on page 542
set security acl map Assigns a committed security ACL to a VLAN, physical port or ports, virtual port, or Distributed MAP on the WX switch.
To assign a security ACL to a user or group in the local WX database, use the command set user attr, set
set security acl
560 CHAPTER 14: SECURITY ACL COMMANDS
Examples ??? The first command sets MSS to sample ACL hits every 15 seconds. The second and third commands display the results. The results show that 916 packets matching security acl_153 were sent since the ACL was mapped.
WX4400# set security acl
WX4400# display security acl info acl_153
ACL information for acl_153
set security acl ip acl_153 (hits #3 916)
1. permit IP source IP 20.1.1.1 0.0.0.0 destination IP any
WX4400# display security acl hits
See Also
A digital certificate is a form of electronic identification for computers. The WX requires digital certificates to authenticate its communications to 3WXM and Web Manager, to WebAAA clients, and to Extensible Authentication Protocol (EAP) clients for which the WX performs all EAP processing. Certificates can be generated on the WX or obtained from a certificate authority (CA). Keys contained within the certificates allow the WX, its servers, and its wireless clients to exchange information secured by encryption.
If the switch does not already have certificates, MSS automatically generates the missing ones the first time you boot using MSS Version 4.2 or later. You do not need to install certificates unless you want to replace the ones automatically generated by MSS. (For more information, see the ???Certificates Automatically Generated by MSS??? section in the ???Managing Keys and Certificates??? chapter of the Wireless LAN Switch and Controller Configuration Guide.)
Before installing a new certificate, verify with the display timedate and display timezone commands that the WX is set to the correct date, time, and time zone. Otherwise, certificates might not be installed correctly.
562 CHAPTER 15: CRYPTOGRAPHY COMMANDS
crypto
Syntax ??? crypto
?? admin ??? Stores the certificate authority???s certificate that signed the administrative certificate for the WX switch.
The administrative certificate authenticates the WX to 3Com wireless switch manager (3XWM) or Web View.
?? eap ??? Stores the certificate authority???s certificate that signed the Extensible Authentication Protocol (EAP) certificate for the WX switch.
The EAP certificate authenticates the WX to 802.1X supplicants (clients).
??web ??? Stores the certificate authority???s certificate that signed the
WebAAA certificate for the WX switch.
The Web certificate authenticates the WX to clients who use
WebAAA.
crypto
??
certificate authority PKCS #7 certificate, consisting of up to
5120 characters that you have obtained from the certificate authority.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? The
To use this command, you must already have obtained a copy of the certificate authority???s certificate as a PKCS #7 object file. Then do the following:
1Open the PKCS #7 object file with an ASCII text editor such as Notepad or vi.
2Enter the crypto
3When MSS prompts you for the
Examples ??? The following command adds the certificate authority???s certificate to WX certificate and key storage:
WX4400# crypto
Enter
MIIDwDCCA2qgAwIBAgIQL2jvuu4PO5FAQCyewU3ojANBgkqhkiG9wOBAQUFADCB
mzerMClaweVQQTTooewi\wpoer0QWNFNkj90044mbdrl1277SWQ8G7DiwYUtrqoQplKJvxz
.....
Lm8wmVYxP56M;CUAm908C2foYgOY40=
See Also
564 CHAPTER 15: CRYPTOGRAPHY COMMANDS
crypto certificate Installs one of the WX switch???s PKCS #7 certificates into the certificate and key storage area on the WX switch. The certificate, which is issued and signed by a certificate authority, authenticates the WX switch either to 3WXM or Web Manager, or to 802.1X supplicants (clients).
Syntax ??? crypto certificate {admin | eap | web}
??admin ??? Stores the certificate authority???s administrative certificate,
which authenticates the WX switch to 3WXM or Web Manager.
??eap ??? Stores the certificate authority???s Extensible Authentication
Protocol (EAP) certificate, which authenticates the WX switch to 802.1X supplicants (clients).
??web ??? Stores the certificate authority???s WebAAA certificate, which
authenticates the WX to clients who use WebAAA.
??
PKCS #7 certificate, consisting of up to 5120 characters, that you have obtained from the certificate authority.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To use this command, you must already have generated a certificate request with the crypto generate request command, sent the request to the certificate authority, and obtained a signed copy of the WX switch certificate as a PKCS #7 object file. Then do the following:
1Open the PKCS #7 object file with an ASCII text editor such as Notepad or vi.
2Enter the crypto certificate command on the CLI command line.
3When MSS prompts you for the
The WX switch verifies the validity of the public key associated with this certificate before installing it, to prevent a mismatch between the WX switch???s private key and the public key in the installed certificate.
crypto generate key 565
Examples ??? The following command installs a certificate:
WX4400# crypto certificate admin
Enter
MIIBdTCP3wIBADA2MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQOExGjAYBgNVBAMU
EXR1Y2hwdWJzQHRycHouY29tMIGfMAOGCSqGSIb3DQEBAQAA4GNADCBiQKBgQC4
.....
2L8Q9tk+G2As84QYLm8wmVY>xP56M;CUAm908C2foYgOY40=
See Also
??crypto generate request on page 566
??crypto generate
crypto generate key Generates an RSA
Syntax ??? crypto generate key {admin | domain | eap | ssh | web} {128 |512 | 1024 | 2048}
??admin ??? Generates an administrative key pair for authenticating the
WX switch to 3WXM or Web Manager.
??domain ??? Generates a key pair for securing the management traffic
between WX switches.
??eap ??? Generates an EAP key pair for authenticating the WX switch to
802.1X supplicants (clients).
??ssh ??? Generates a key pair for authenticating the WX switch to
Secure Shell (SSH) clients.
??web ??? Generates an administrative key pair for authenticating the WX
switch to WebAAA clients.
??512 | 1024 | 2048 ??? Length of the key pair in bits.
The minimum key size for SSH is 1024.
Defaults ??? None.
Access ??? Enabled.
566 CHAPTER 15: CRYPTOGRAPHY COMMANDS
History
Usage ??? You can overwrite a key by generating another key of the same type.
SSH requires an SSH authentication key, but you can allow MSS to generate it automatically. The first time an SSH client attempts to access the SSH server on a WX switch, the switch automatically generates a
Examples ??? To generate an administrative key for use with 3WXM, type the following command:
WX4400# crypto generate key admin 1024 key pair generated
See Also
??display crypto key ssh on page 576
crypto generate Generates a Certificate Signing Request (CSR). This command outputs a requestPEM-formatted PKCS #10 text string that you can cut and paste to
another location for delivery to a certificate authority.
This command generates either an administrative CSR for use with 3WXM and Web View, or an EAP CSR for use with 802.1X clients.
Syntax ??? crypto generate request {admin | eap | web}
??admin ??? Generates a request for an administrative certificate to
authenticate the WX switch to 3WXM or Web Manager.
??eap ??? Generates a request for an EAP certificate to authenticate the
WX switch to 802.1X supplicants (clients).
??web ??? Generates a request for a WebAAA certificate to authenticate
the WX switch to WebAAA clients.
After you type the command, you are prompted for the following variables:
??Country Name string ??? (Optional) Specify the abbreviation for the
country in which the WX switch is operating, in 2 alphanumeric characters with no spaces.
crypto generate request 567
??State Name string ??? (Optional) Specify the name of the state, in up
to 64 alphanumeric characters. Spaces are allowed.
??Locality Name string ??? (Optional) Specify the name of the locality,
in up to 80 alphanumeric characters with no spaces.
??Organizational Name string ??? (Optional) Specify the name of the
organization, in up to 80 alphanumeric characters with no spaces.
??Organizational Unit string ??? (Optional) Specify the name of the
organizational unit, in up to 80 alphanumeric characters with no spaces.
??Common Name string ??? Specify a unique name for the WX switch, in
up to 80 alphanumeric characters with no spaces. Use a fully qualified name if such names are supported on your network. This field is required.
??Email Address string ??? (Optional) Specify your email address, in
up to 80 alphanumeric characters with no spaces.
??Unstructured Name string ??? (Optional) Specify any name, in up to
80 alphanumeric characters with no spaces.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To use this command, you must already have generated a
Enter crypto generate request admin, crypto generate request eap, or crypto generate request web and press Enter. When you are prompted, type the identifying values in the fields, or press Enter if the field is optional. You must enter a common name for the WX switch.
This command outputs a PKCS #10 text string in
568 CHAPTER 15: CRYPTOGRAPHY COMMANDS
Examples ??? To request an administrative certificate from a certificate authority, type the following command:
WX4400# crypto generate request admin
Country Name: US
State Name: CA
Locality Name: Pleasanton
Organizational Name: MyCorp
Organizational Unit: ENG
Common Name: ENG
Email Address: admin@example.com
Unstructured Name: admin CSR for admin is
MIIBuzCCASQCAQAwezELMAkGA1UEBhMCdXMxCzAJBgNVBAgTAmNhMQswCQYDVQQH
EwJjYTELMAkGA1UEChMCY2ExCzAJBgNVBAsTAmNhMQswCQYDVQQDEwJjYTEYMBYG
CSqGSIb3DQEJARYJY2FAY2EuY29tMREwDwYJKoZIhvcNAQkCEwJjYTCBnzANBgkq
hkiG9w0BAQEFAAOBjQAwgYkCgYEA1zatpYStOjHMa0QJmWHeZPPFGQ9kBEimJKPG
bznFjAC780GcZtnJPGqnMnOKj/4NdknonT6NdCd2fBdGbuEFGNMNgZMYKGcV2JIu
M32SvpSEOEnMYuidkEzqLQol621vh67RM1KTMECM6uCBBROq6XNypIHn1gtrrpL/
LhyGTWUCAwEAAaAAMA0GCSqGSIb3DQEBBAUAA4GBAHK5z2kfjBbV/F0b0MyC5S7K
htsw7T4SwmCij55qfUHxsRelggYcw6vJtr57jJ7wFfsMd8C50NcbJLF1nYC9OKkB
hW+5gDPAOZdOnnr591XKz3Zzyvyrktv00rcld8Fo2RtTQ3AOT9cUZqJVelO85GXJ
See Also
??crypto certificate on page 564
??crypto generate key on page 565
crypto generate Generates a
users.
Syntax ??? crypto generate
??admin ??? Generates an administrative certificate to authenticate the
WX switch to 3WXM or Web Manager.
??eap ??? Generates an EAP certificate to authenticate the WX switch to
802.1X supplicants (clients).
??web ??? Generates a WebAAA certificate to authenticate the WX
switch to WebAAA clients.
crypto generate
After you type the command, you are prompted for the following variables:
??Country Name string ??? (Optional) Specify the abbreviation for the
country in which the WX switch is operating, in 2 alphanumeric characters with no spaces.
??State Name string ??? (Optional) Specify the abbreviation for the
name of the state, in 2 alphanumeric characters with no spaces.
??Locality Name string ??? (Optional) Specify the name of the locality,
in up to 80 alphanumeric characters with no spaces.
??Organizational Name string ??? (Optional) Specify the name of the
organization, in up to 80 alphanumeric characters with no spaces.
??Organizational Unit string ??? (Optional) Specify the name of the
organizational unit, in up to 80 alphanumeric characters with no spaces.
??Common Name string ??? Specify a unique name for the WX switch, in
up to 80 alphanumeric characters with no spaces. Use a fully qualified name if such names are supported on your network. This field is required.
Note: If you are generating a WebAAA (web) certificate, use a common name that looks like a domain name (two or more strings connected by dots, with no spaces). For example, use common.name instead of common name. The string is not required to be an actual domain name. It simply needs to be formatted like one.
??Email Address string ??? (Optional) Specify your email address, in up
to 80 alphanumeric characters with no spaces.
??Unstructured Name string ??? (Optional) Specify any name, in up to
80 alphanumeric characters with no spaces.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To use this command, you must already have generated a
570 CHAPTER 15: CRYPTOGRAPHY COMMANDS
To generate a
WX4400# crypto generate
Country Name:
State Name:
Locality Name:
Organizational Name:
Organizational Unit:
Common Name: wx1@example.com
Email Address: Unstructured Name:
success:
crypto otp 571
Note: On an WX switch that handles communications to and from Microsoft Windows clients, use a
The following characters cannot be used as part of the
??Quotation marks (??? ???)
??Question mark (?)
??Ampersand (&)
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? The password allows the
3Com recommends that you create a password that is memorable to you but is not subject to easy guesses or a dictionary attack. For best results, create a password of alphanumeric uppercase and lowercase characters.
Examples ??? The following command creates the
WX4400# crypto generate otp eap hap9iN#ss
OTP set
See Also
572 CHAPTER 15: CRYPTOGRAPHY COMMANDS
display crypto
Examples ??? The following commands copy a PKCS #12 object file for an EAP certificate and key
PKCS #12 file:
WX4400# copy tftp://192.168.253.1/2048full.p12 2048full.p12 success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
WX4400# crypto otp eap hap9iN#ss
OTP set
WX4400# crypto pkcs12 eap 2048full.p12
Unwrapped from PKCS12 file: keypair
device certificate CA certificate
certificate that signed the administrative certificate for the WX switch.
The administrative certificate authenticates the WX to 3WXM or Web
View.
?? eap ??? Displays information about the certificate authority???s certificate that signed the Extensible Authentication Protocol (EAP) certificate for the WX switch.
The EAP certificate authenticates the WX switch to 802.1X supplicants (clients).
?? web ??? Displays information about the certificate authority???s certificate that signed the WebAAA certificate for the WX switch.
The WebAAA certificate authenticates the WX switch to WebAAA clients.
Defaults ??? None.
574 CHAPTER 15: CRYPTOGRAPHY COMMANDS
Access ??? Enabled.
History
Examples ??? To display information about the certificate of a certificate authority, type the following command:
WX4400# display crypto
Table 89 describes the fields in the display.
Table 89 display crypto
Syntax ??? display crypto certificate {admin | eap | web}
?? admin ??? Displays information about the administrative certificate that authenticates the WX switch to 3WXM or Web Manager.
?? eap ??? Displays information about the EAP certificate that authenticates the WX switch to 802.1X supplicants (clients).
?? web ??? Displays information about the WebAAA certificate that authenticates the WX switch to WebAAA clients.
display crypto certificate 575
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? You must have generated a
Examples ??? To display information about a cryptographic certificate, type the following command:
WX4400# display crypto certificate eap
Table 90 describes the fields of the display.
Table 90 crypto certificate Output
See Also crypto generate key on page 565
578 CHAPTER 16: RADIUS AND SERVER GROUP COMMANDS
Defaults ??? Global RADIUS parameters have the following default values:
??
??
??
??
Access ??? Enabled.
History
Usage ??? To override the globally set values on a particular RADIUS server, use the set radius server command.
Examples ??? To reset all global RADIUS parameters to their factory defaults, type the following commands:
WX4400# clear radius deadtime success: change accepted. WX4400# clear radius key success: change accepted. WX4400# clear radius retransmit success: change accepted.
clear radius client
WX4400# clear radius timeout success: change accepted.
See Also
??set radius server on page 587
clear radius client Removes the WX switch???s system IP address from use as the permanent
server(s).
Syntax ??? clear radius client
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? The clear radius client
Examples ??? To clear the system IP address as the permanent source address for RADIUS client requests, type the following command:
WX4400# clear radius client
See Also
580 CHAPTER 16: RADIUS AND SERVER GROUP COMMANDS
clear radius proxy Removes RADIUS proxy client entries for
Syntax ??? clear radius proxy client all
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command clears all RADIUS proxy client entries from the switch:
WX4400# clear radius proxy client all success: change accepted.
See Also
??set radius proxy client on page 585
clear radius proxy Removes RADIUS proxy ports configured for
Syntax ??? clear radius proxy port all
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command clears all RADIUS proxy port entries from the switch:
WX4400# clear radius proxy port all success: change accepted.
See Also
clear radius server 581
clear radius server Removes the named RADIUS server from the WX configuration.
Syntax ??? clear radius server
??
remote AAA services for the WX switch.
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command removes the RADIUS server rs42 from a list of remote AAA servers:
WX4400# clear radius server rs42 success: change accepted.
See Also
??set radius server on page 587
clear server group Removes a RADIUS server group from the configuration, or disables load balancing for the group.
Syntax ??? clear server group
??
remote AAA services for WX switches.
??
services among servers.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? Deleting a server group removes the server group from the configuration. However, the members of the server group remain.
582 CHAPTER 16: RADIUS AND SERVER GROUP COMMANDS
Note: Use this option only if you are entering the key in its encrypted form. To enter the key in unencrypted form, use the key string option instead.
??key string ??? Password (shared secret key) used to authenticate to
the RADIUS server. You must provide the same password that is defined on the RADIUS server. The password can be 1 to 64 characters long, with no spaces or tabs.
set radius 583
MSS encrypts the display form of the string in display config and display aaa output.
??retransmit number ??? Number of transmission attempts the WX
switch makes before declaring an unresponsive RADIUS server unavailable. You can specify from 1 to 100 retries.
??timeout seconds ??? Number of seconds the WX switch waits for the
RADIUS server to respond before retransmitting. You can specify from 1 to 65,535.
Defaults ??? Global RADIUS parameters have the following default values:
??deadtime ??? 0 (zero) minutes (The WX switch does not designate unresponsive RADIUS servers as unavailable.)
??
??key ??? No key
??retransmit ??? 3 (the total number of attempts, including the first attempt)
??timeout ??? 5 seconds
Access ??? Enabled.
History
Usage ??? You can specify only one parameter per command line.
Examples ??? The following commands sets the dead time to 5 minutes, the RADIUS key to goody, the number of retransmissions to 1, and the timeout to 21 seconds on all RADIUS servers connected to the WX switch:
WX1200# set radius deadtime 5 success: change accepted. WX1200# set radius key goody success: change accepted. WX1200# set radius retransmit 1 success: change accepted. WX1200# set radius timeout 21 success: change accepted.
584 CHAPTER 16: RADIUS AND SERVER GROUP COMMANDS
See Also
set radius proxy client 585
set radius proxy Adds a RADIUS proxy entry for a
listens for RADIUS traffic from the AP.
Syntax ??? set radius proxy client address
string
??address
address in dotted decimal notation.
??port
for RADIUS
??
switch listens for RADIUS
??key string ??? Password (shared secret key) the WX switch uses to
authenticate and encrypt RADIUS communication.
Defaults ??? The default UDP port number for
The default UDP port number for
Access ??? Enabled.
History
Usage ??? AAA for
Wireless LAN Switch and Controller Configuration Guide.
Examples ??? The following command configures a RADIUS proxy entry for a
WX4400# set radius proxy client address 10.20.20.9 key radkey1 success: change accepted.
See Also
??clear radius proxy client on page 580
586 CHAPTER 16: RADIUS AND SERVER GROUP COMMANDS
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? AAA for
Wireless LAN Switch and Controller Configuration Guide.
Enter a separate command for each SSID, and its tag value, you want the
WX to support.
Examples ??? The following command maps SSID mycorp to packets received on port 3 or 4, using 802.1Q tag value 104:
WX4400# set radius proxy port
See Also
?? clear radius proxy port on page 580
588CHAPTER 16: RADIUS AND SERVER GROUP COMMANDS
??
RADIUS server for MAC users. Specify a password of up to 64 alphanumeric characters with no spaces or tabs.
Defaults ??? Default values are listed below:
??
??
??timeout ??? 5 seconds
??retransmit ??? 3 (the total number of attempts, including the first attempt)
??deadtime ??? 0 (zero) minutes (The WX switch does not designate unresponsive RADIUS servers as unavailable.)
??key ??? No key
??
??
Access ??? Enabled.
History
Usage ??? For a given RADIUS server, the first instance of this command must set both the server name and the IP address and can include any or all of the other optional parameters. Subsequent instances of this command can be used to set optional parameters for a given RADIUS server.
To configure the server as a remote authenticator for the WX switch, you must add it to a server group with the set server group command.
Do not use the same name for a RADIUS server and a RADIUS server group.
set server group 589
Examples ??? To set a RADIUS server named RS42 with IP address 198.162.1.1 to use the default accounting and authorization ports with a timeout interval of 30 seconds, two transmit attempts, 5 minutes of dead time, and a key string of keys4u, type the following command:
WX1200# set radius server RS42 address 198.162.1.1 timeout 30 retransmit 2 deadtime 5 key keys4U
See Also
??set authentication admin on page 239
??set authentication console on page 241
??set authentication dot1x on page 243
??set authentication mac on page 247
??set authentication mac on page 247
??set authentication web on page 254
??set server group on page 589
set server group Configures a group of one to four RADIUS servers.
Syntax ??? set server group
??
spaces or tabs.
??members
servers. You can enter up to four server names.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? You must assign all group members simultaneously, as shown in the example. To enable load balancing, use set server group
590 CHAPTER 16: RADIUS AND SERVER GROUP COMMANDS
set server group
Examples ??? To enable load balancing between the members of server group shorebirds, type the following command:
WX1200# set server group shorebirds
To disable load balancing between shorebirds server group members, type the following command:
WX1200# set server group shorebirds
See Also
??clear server group on page 581
592 CHAPTER 16: RADIUS AND SERVER GROUP COMMANDS
clear dot1x
See Also
?? set dot1x
clear dot1x
596 CHAPTER 17: 802.1X MANAGEMENT COMMANDS
See Also
598 CHAPTER 17: 802.1X MANAGEMENT COMMANDS
clear dot1x timeout Resets to the default setting the number of seconds that must elapse
Syntax ??? clear dot1x timeout
Defaults ??? The default is 30 seconds.
Access ??? Enabled.
History
Examples ??? To reset the default timeout for requests to an authentication server, type the following command:
WX4400# clear dot1x timeout
See Also
??set dot1x timeout
clear dot1x timeout Resets to the default setting the number of seconds that must elapse supplicantbefore the WX switch times out an authentication session with a
supplicant (client).
Syntax ??? clear dot1x timeout supplicant
Defaults ??? The default for the authentication timeout sessions is 30 seconds.
Access ??? Enabled.
History
Examples ??? Type the following command to reset the timeout period for an authentication session:
WX4400# clear dot1x timeout supplicant success: change accepted.
See Also
600 CHAPTER 17: 802.1X MANAGEMENT COMMANDS
History
Examples ??? Type the following command to display the 802.1X clients:
Type the following command to display the 802.1X configuration:
WX1200# display dot1x config
802.1X user policy
602 CHAPTER 17: 802.1X MANAGEMENT COMMANDS
Table 93 display dot1x stats Output
set dot1x
Syntax ??? set dot1x
??seconds ??? Number of seconds MSS retains session information for an
authenticated machine while waiting for a client to (re)authenticate on the same machine. You can change the bonded authentication period to a value from 1 to 300 seconds.
Defaults ??? The default bonded period is 0 seconds, which disables the feature.
Access ??? Enabled.
History
604 CHAPTER 17: 802.1X MANAGEMENT COMMANDS
Usage ??? Normally, the Bonded Auth period needs to be set only if the network has Bonded Auth clients that use dynamic WEP, or use
3Com recommends that you try 60 seconds, and change the period to a longer value only if clients are unable to authenticate within 60 seconds.
The bonded authentication period applies only to 802.1X authentication rules that contain the bonded option.
Examples ??? To set the bonded authentication period to 60 seconds, type the following command:
WX4400# set dot1x
See Also
??clear dot1x
set dot1x
Syntax ??? set dot1x
??enable ??? Enables transmission of encryption key information to
clients.
??disable ??? Disables transmission of encryption key information to
clients.
Defaults ??? Key transmission is enabled by default.
Access ??? Enabled.
History
set dot1x
Examples ??? Type the following command to enable key transmission:
WX4400# set dot1x
See Also
set dot1x
Syntax ??? set dot1x
??
Defaults ??? The default number of EAP retransmissions is 2.
Access ??? Enabled.
History
Usage ??? To support SSIDs that have both 802.1X and static WEP clients, MSS sends a maximum of two ID requests, even if this parameter is set to a higher value. Setting the parameter to a higher value does affect all other types of EAP messages.
Examples ??? Type the following command to set the maximum number of EAP request retransmissions to three attempts:
WX4400# set dot1x
See Also
608 CHAPTER 17: 802.1X MANAGEMENT COMMANDS
See Also
??set dot1x
??set dot1x
Syntax ??? set dot1x
??
Defaults ??? The default number of reauthentication attempts is 2.
Access ??? Enabled.
History
Usage ??? If the number of reauthentications for a wired authentication client is greater than the maximum number of reauthentications allowed, MSS sends an EAP failure packet to the client and removes the client from the network. However, MSS does not remove a wireless client from the network under these circumstances.
Examples ??? Type the following command to set the number of authentication attempts to 8:
WX4400# set dot1x
See Also
610 CHAPTER 17: 802.1X MANAGEMENT COMMANDS
See Also
??clear dot1x timeout
Syntax ??? set dot1x timeout supplicant seconds
??seconds ??? Specify a value between 1 and 65,535.
Defaults ??? The default is 30 seconds.
Access ??? Enabled.
History
Examples ??? Type the following command to set the number of seconds for authentication session timeout to 300:
WX4400# set dot1x timeout supplicant 300 success: dot1x supplicant timeout set to 300.
See Also
??clear dot1x timeout
set dot1x
Syntax ??? set dot1x
??seconds ??? Specify a value between 1 and 65,535.
Defaults ??? The default is 5 seconds.
Access ??? Enabled.
History
set dot1x
Examples ??? Type the following command to set the number of seconds before the WX switch retransmits an EAPoL packet to 300:
WX4400# set dot1x
See Also
??clear dot1x
Syntax ??? set dot1X
??enable ??? Causes the broadcast and multicast keys for WEP to be
rotated at an interval set by the set dot1x
??disable ??? WEP broadcast and multicast keys are never rotated.
Defaults ??? WEP key rotation is enabled, by default.
Access ??? Enabled.
History
Usage ??? Reauthentication is not required for WEP key rotation to take place. Broadcast and multicast keys are always rotated at the same time, so all members of a given radio, VLAN, or encryption type receive the new keys at the same time.
Examples ??? Type the following command to disable WEP key rotation:
WX4400# set dot1x
See Also
612 CHAPTER 17: 802.1X MANAGEMENT COMMANDS
See Also
Use session management commands to display and clear administrative and network user sessions.
Syntax ??? clear sessions {admin | console | telnet [client
??admin ??? Clears sessions for all users with administrative access to the
WX switch through a Telnet or SSH connection or a console plugged into the switch.
??console ??? Clears sessions for all users with administrative access to
the WX switch through a console plugged into the switch.
??telnet ??? Clears sessions for all users with administrative access to
the WX switch through a Telnet connection.
614CHAPTER 18: SESSION MANAGEMENT COMMANDS
??telnet client
the CLI to remote devices, or clears an individual session identified by session ID.
??
individual Mesh AP session identified by session ID.
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? To clear all administrator sessions type the following command:
WX4400# clear sessions admin
This will terminate manager sessions, do you wish to continue? (y|n) [n]y
To clear all administrative sessions through the console, type the following command:
WX4400# clear sessions console
This will terminate manager sessions, do you wish to continue? (y|n) [n]y
To clear all administrative Telnet sessions, type the following command:
WX4400# clear sessions telnet
This will terminate manager sessions, do you wish to continue? (y|n) [n]y
To clear Telnet client session 0, type the following command:
WX4400# clear sessions telnet client 0
See Also
clear sessions network 615
616 CHAPTER 18: SESSION MANAGEMENT COMMANDS
Examples ??? To clear all sessions for MAC address 00:01:02:03:04:05, type the following command:
WX4400# clear sessions network
To clear session 9, type the following command:
WX1200# clear sessions network
SM Apr 11 19:53:38 DEBUG
Localid 9, globalid
display sessions 617
??telnet ??? Displays sessions for all users with administrative access to
the WX switch through a Telnet connection.
??telnet client ??? Displays Telnet sessions from the CLI to remote
devices.
Defaults ??? None.
Access ??? All, except for display sessions telnet client, which has enabled access.
History
Examples ??? To view information about sessions of administrative users, type the following command:
3 admin sessions
To view information about console users??? sessions, type the following command:
1 console session
To view information about Telnet users sessions, type the following command:
618 CHAPTER 18: SESSION MANAGEMENT COMMANDS
To view information about Telnet client sessions, type the following command:
Table 95 describes the fields of the display sessions admin, display sessions console, and display sessions telnet displays.
Table 95 display sessions admin, display sessions console, and display sessions telnet Output
Table 96 describes the fields of the display sessions telnet client display.
Table 96 display sessions telnet client Output
See Also
display sessions
Table 97describes the fields of display sessions
Table 97 display sessions
620 CHAPTER 18: SESSION MANAGEMENT COMMANDS
See also ???clear sessions??? on page 613
display sessions Displays summary or verbose information about all network sessions, or networknetwork sessions for a specified username or set of usernames, MAC
address or set of MAC addresses, VLAN or set of VLANs, or session ID.
Syntax ??? display sessions network
[user
??user
set of users.
Specify a username, use the
??
address. Specify a MAC address in hexadecimal numbers separated by colons (:).
Or use the wildcard character (*) to specify a set of MAC addresses. (For details, see ???MAC Address Globs??? on page 31.)
??ssid
??vlan
set of VLANs.
Specify a VLAN name, use the
??
session. To find local session IDs, use the display sessions command. The verbose option is not available with this form of the display sessions network command.
??wired ??? Displays all network sessions on wired authentication ports.
??verbose ??? Provides detailed output for all network sessions or ones
displayed by username, MAC address, or VLAN name.
display sessions network 621
Defaults ??? None.
Access ??? All.
History
Usage ??? MSS displays information about network sessions in three types of displays. See the following tables for field descriptions.
??Summary display ??? See Table 98 on page 623.
??Verbose display ??? See Table 99 on page 624.
??display sessions network
Examples ??? To display summary information for all network sessions, type display sessions network. For example:
The following command displays summary information about the sessions for MAC address 00:05:5d:7e:98:1a:
622 CHAPTER 18: SESSION MANAGEMENT COMMANDS
The following command displays summary information about all the sessions of users whose names begin with E:
2 sessions match criteria (of 3 total)
(Table 98 on page 623 describes the summary displays of display sessions network commands.)
The following command displays detailed (verbose) session information about user nin@example.com:
The following command displays verbose output about the sessions of all current network users:
display sessions network 623
1 sessions total
(Table 99 on page 624 describes the additional fields of the verbose output of display sessions network commands.)
The following command displays information about network session 27:
WX1200# display sessions network
Global Id:
State: ACTIVE
Port/Radio: 3/1
MAC Address: 00:00:2d:6f:44:77
User Name: EXAMPLE Natasha
IP Address: 10.10.40.17
Vlan Name:
Tag: 1
Session Timeout: 1800
Authentication Method: PEAP, using server 10.10.70.20
Session statistics as updated from AP:
Unicast packets in: 653
Unicast bytes in: 46211
Unicast packets out: 450
Unicast bytes out: 50478
Multicast packets in: 317
Multicast bytes in: 10144
Number of packets with encryption errors: 0
Number of bytes with encryption errors: 0
Last packet data rate: 2
Last packet signal strength:
Last packet data S/N ratio: 55
Table 98 describes the output of this command. For descriptions of the fields of display sessions network
Table 98 display sessions network (summary) Output
624 CHAPTER 18: SESSION MANAGEMENT COMMANDS
Table 98 display sessions network (summary) Output
Table 99 Additional display sessions network verbose Output
Field Description
Client MAC MAC address of the session user.
display sessions network 625
Table 99 Additional display sessions network verbose Output (continued)
626 CHAPTER 18: SESSION MANAGEMENT COMMANDS
Table 100 display sessions network
display sessions network 627
Table 100 display sessions network
See Also
628 CHAPTER 18: SESSION MANAGEMENT COMMANDS
MSS automatically performs RF detection scans on enabled and disabled radios to detect rogue access points. A rogue access point is a BSSID (MAC address associated with an SSID) that does not belong to a 3Com switch and is not a member of the ignore list configured on the seed switch of the Mobility Domain. The ignore list is a list of
MSS can issue countermeasures against rogue devices to prevent clients from being able to use them.
You can configure RF detection parameters only on the seed switch of a
Mobility Domain.
632 CHAPTER 19: RF DETECTION COMMANDS
clear rfdetect
remove.
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? The following command removes client OUI aa:bb:cc:00:00:00 from the permitted vendor list:
WX4400# clear rfdetect
See Also
634 CHAPTER 19: RF DETECTION COMMANDS
??
the specified local session ID.
Defaults ??? None.
Access ??? Enabled.
History ??? Version 4.2 Command introduced. Version 6.0 Name of command changed from test rflink to rfping.
Usage ??? Use this command to send test packets to a specified client. The output of the command indicates the number of test packets received and acknowledged by the client, as well as the client??s signal strength and
Examples ??? The following command tests the RF link between the WX
switch and the client with MAC address 00:0e:9b:bf:ad:13:
Table 83 describes the fields in this display.
Table 102 rfping Output
See Also
??display rfdetect data on page 642
??display rfdetect visible on page 650
See Also
display rfdetect clients 637
The following command displays more details about a specific client:
WX4400# display rfdetect clients mac 00:0c:41:63:fd:6d
Client Mac Address: 00:0c:41:63:fd:6d, Vendor: Linksys
Port: ap 1, Radio: 1, Channel: 11, RSSI:
84
Bssid: 00:0b:0e:01:02:00, Vendor: 3Com, Type: intfr, Dst: ff:ff:ff:ff:ff:ff
Last Rogue Status Check (secs ago): 3
The first line lists information for the client. The other lines list information about the most recent 802.11 packet detected from the client.
Table 103 and Table 104 describe the fields in these displays.
638 CHAPTER 19: RF DETECTION COMMANDS
Table 103 display rfdetect clients Output
display rfdetect countermeasures 639
Table 104 display rfdetect clients mac Output (continued)
640 CHAPTER 19: RF DETECTION COMMANDS
Table 105 describes the fields in this display.
Table 105 display rfdetect countermeasures Output
display rfdetect counters 641
Examples ??? The following command shows counters for rogue activity detected by a WX switch:
644 CHAPTER 19: RF DETECTION COMMANDS
BSSID.
Defaults ??? None.
Access ??? Enabled.
History
Vendor, Type and Flag fields added in MSS Version 4.0.
display rfdetect
Usage ??? This command is valid only on the seed switch of the Mobility Domain. To display rogue information for an individual switch, use the display rfdetect data command on that switch.
Only rogues are listed. To display all devices detected, including 3Com radios, use the display rfdetect data command.
Examples ??? The following example displays information about the
BSSIDs detected in the Mobility Domain managed by the seed switch:
The lines in this display are compiled from data from multiple listeners (MAP radios). If an item has the value unresolved, not all listeners agree on the value for that item. Generally, an unresolved state occurs only when a MAP or a Mobility Domain is still coming up, and lasts only briefly.
The following command displays detailed information for rogues using
SSID
WX1200# display rfdetect
BSSID: 00:0a:5e:4b:4a:ca Vendor: 3Com SSID:
Type: intfr Adhoc: no
RSSI:
BSSID: 00:0b:0e:00:7a:8a Vendor: 3Com SSID:
Type: intfr Adhoc: no
646 CHAPTER 19: RF DETECTION COMMANDS
RSSI:
RSSI:
Two types of information are shown. The lines that are not indented show the BSSID, vendor, and information about the SSID. The indented lines that follow this information indicate the listeners (MAP radios) that detected the SSID. Each set of indented lines is for a separate MAP listener.
In this example, two BSSIDs are mapped to the SSID. Separate sets of information is shown for each of the BSSIDs, and information about the listeners for each BSSID are shown.
The following command displays detailed information for a BSSID.
WX1200# display rfdetect
BSSID: 00:0b:0e:00:04:d1 Vendor: Cisco SSID: notmycorp
Type: rogue Adhoc: no
RSSI:
RSSI:
display rfdetect
Table 107 and Table 108 describe the fields in these displays.
Table 107 display rfdetect
648 CHAPTER 19: RF DETECTION COMMANDS
Table 108 display rfdetect
See Also
display rfdetect
650 CHAPTER 19: RF DETECTION COMMANDS
Examples ??? The following example shows the permitted vendor list on
WX switch:
Defaults ??? None.
Access ??? Enabled.
History
set rfdetect
656 CHAPTER 19: RF DETECTION COMMANDS
You can start countermeasures against more than one BSSID by typing additional set rfdetect countermeasures mac commands.
After you type the first set rfdetect countermeasures mac command, MSS does not issue countermeasures against any devices except the ones you specify using this command. To resume normal countermeasures operation, where MSS automatically issues countermeasures against detected rogues, use the clear rfdetect countermeasures mac all command.
This command is valid only on the seed switch of the Mobility Domain. The countermeasures take effect only if countermeasures are enabled for the Mobility Domain, using the set rfdetect countermeasures enable command.
This command does not become part of the configuration file when you save the configuration and therefore is not reloaded if the switch is restarted.
Examples ??? The following command begins countermeasures against rogue BSSID aa:bb:cc:11:22:33:
WX1200# set rfdetect countermeasures mac aa:bb:cc:11:22:33 success: set rfdetect countermeasures mac aa:bb:cc:11:22:33
See Also
??clear rfdetect
??display rfdetect ignore on page 644
??set rf detect countermeasures on page 654
set rfdetect ignore Configures a list of known devices to ignore during an RF scan. MSS does not generate log messages or traps for the devices in the ignore list.
Syntax ??? set rfdetect ignore
??
Defaults ??? MSS reports all unknown BSSIDs detected during an RF scan.
Access ??? Enabled.
History
set rfdetect log 657
660 CHAPTER 19: RF DETECTION COMMANDS
test rflink 661
662 CHAPTER 19: RF DETECTION COMMANDS
Examples ??? The following command tests the RF link between the WX switch and the client with MAC address 00:0e:9b:bf:ad:13:
WX4400# test rflink mac 00:0e:9b:bf:ad:13
Packets Sent
20
Table 110 describes the fields in this display.
Table 110 test rflink Output
See Also
Use file management commands to manage system files and to display software and boot information.
664 CHAPTER 20: FILE MANAGEMENT COMMANDS
Table 111 File Management Commands by Usage (continued)
backup 665
Archive files created by the all option are larger than files created by the critical option. The file size depends on the files in the user area, and the file can be quite large if the user area contains image files.
The backup command places the boot configuration file into the archive. (The boot configuration file is the Configured boot configuration in the display boot command???s output.) If the running configuration contains changes that have not been saved, these changes are not in the boot configuration file and are not archived. To make sure the archive contains the configuration that is currently running on the switch, use the
save config command to save the running configuration to the boot configuration file, before using the backup command.
Examples ??? The following command creates an archive of the
WX1200# backup system tftp:/10.10.20.9/sysa_bak critical
success: sent 28263 bytes in 0.324 seconds [ 87231 bytes/sec]
Table 112 describes the fields.
Table 112 Output for backup
Field Description
[tftp:/ip Name of the archive file to create. You can store the file locally in the
ename
See Also
666 CHAPTER 20: FILE MANAGEMENT COMMANDS
copy 667
Syntax ??? copy
??
resource locator (URL) can be one of the following:
??[subdirname/]filename
??file:[subdirname/]filename
??
??tmp:filename
For the filename, specify between 1 and 128 alphanumeric characters, with no spaces. Enter the IP address in dotted decimal notation.
The subdirname/ option specifies a subdirectory.
??
place the copy. The URL can be one of the following:
??[subdirname/]filename
??file:[subdirname/]filename
??
If you are copying a system image file into nonvolatile storage, the filename must include the boot partition name. You can specify one of the following:
??boot0:/filename
??boot1:/filename
668 CHAPTER 20: FILE MANAGEMENT COMMANDS
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? The filename and file:filename URLs are equivalent. You can use either URL to refer to a file in an WX switch???s nonvolatile memory. The
The tmp:filename URL specifies a file in temporary storage. You can copy a file out of temporary storage but you cannot copy a file into temporary storage. Temporary storage is reserved for use by MSS.
If you are copying a system image file into nonvolatile storage, the filename must be preceded by the boot partition name, which can be boot0 or boot1. Enter the filename as boot0:/filename or boot1:/filename. You must specify the boot partition that was not used to load the currently running image.
The maximum supported file size for TFTP is 32 MB.
Examples ??? The following command copies a file called floorwx from nonvolatile storage to a TFTP server:
WX4400# copy floorwx tftp://10.1.1.1/floorwx
success: sent 365 bytes in 0.401 seconds [ 910 bytes/sec]
The following command copies a file called closetwx from a TFTP server to nonvolatile storage:
WX4400# copy tftp://10.1.1.1/closetwx closetwx success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
The following command copies system image WXA03001.Rel from a TFTP server to boot partition 1 in nonvolatile storage:
WX4400# copy tftp://10.1.1.107/WXA03001.Rel boot1:WXA03001.Rel
............................................................
................................................success: received 9163214 bytes in 105.939 seconds [ 86495 bytes/sec]
delete 669
The following commands rename
WX4400# copy
WX4400# delete
success: file deleted.
The following command copies file
WX4400# copy
Syntax ??? delete url
??url ??? Filename. Specify between 1 and 128 alphanumeric characters,
with no spaces.
If the file is in a subdirectory, specify the subdirectory name, followed by a forward slash, in front of the filename. For example: subdir_a/file_a.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? You might want to copy the file to a TFTP server as a backup before deleting the file.
670 CHAPTER 20: FILE MANAGEMENT COMMANDS
Examples ??? The following commands copy file testconfig to a TFTP server and delete the file from nonvolatile storage:
WX4400# copy testconfig tftp://10.1.1.1/testconfig success: sent 365 bytes in 0.401 seconds [ 910 bytes/sec] WX4400# delete testconfig
success: file deleted.
The following commands delete file dang_doc from subdirectory dang:
WX4400# delete dang/dang_doc success: file deleted.
See Also
Syntax ??? dir [subdirname] [file:] | [core:] | [boot0:] | [boot1:]
??subdirname ??? Subdirectory name. If you specify a subdirectory name,
the command lists the files in that subdirectory. Otherwise, the command lists the files in the root directory and also lists the subdirectories.
??file ??? Limits dir output to the contents of the user files area.
??core: ??? Limits dir output to the contents of the /tmp/core
subdirectory.
??boot0: ??? Limits dir output to the contents of the boot0 partition.
??boot1: ??? Limits dir output to the contents of the boot1 partition
Defaults ??? None.
Access ??? Enabled.
History
dir 671
Examples ??? The following command displays the files in the root directory:
WX4400# dir
===============================================================================
===============================================================================
===============================================================================
temporary files:
The following command displays the files in the old subdirectory:
WX4400# dir old
===============================================================================
file:
672 CHAPTER 20: FILE MANAGEMENT COMMANDS
The following command limits the output to the contents of the user files area:
WX4400# dir file:
===============================================================================
The following command limits the output to the contents of the /tmp/core subdirectory:
WX4400# dir core:
===============================================================================
The following command limits the output to the contents of the boot0 partition:
WX4400# dir boot0:
===============================================================================
file:
Table 113 describes the fields in the dir output.
install soda agent 673
Table 113 Output for dir
Field Description
Filename Filename or subdirectory name.
See Also
install soda agent Installs Sygate
Syntax ??? install soda agent
directory
??
agent files.
??directory ??? Directory on the WX switch where SODA agent files are
to be installed. The command automatically creates this directory.
Defaults ??? None.
Access ??? Enabled.
History
674 CHAPTER 20: FILE MANAGEMENT COMMANDS
Examples ??? The following command shows the boot information for a
WX switch:
display config 675
Table 114 describes the fields in the display boot output.
Table 114 Output for display boot
676CHAPTER 20: FILE MANAGEMENT COMMANDS
??
??l2acl
??log
??
??
??ntp
??portconfig
??
??qos
??
??rfdetect
??
??sm
??snmp
??snoop
??spantree
??system
??trace
??vlan
??
??
If you do not specify a configuration area, nondefault information for all areas is displayed.
??all ??? Includes configuration items that are set to their default values.
Defaults ??? None.
Access ??? Enabled.
History
display version 677
Usage ??? If you do not use one of the optional parameters, configuration commands that set nondefault values are displayed for all configuration areas. If you specify an area, commands are displayed for that area only. If you use the all option, the display also includes commands for configuration items that are set to their default values.
Examples ??? The following command shows configuration information for VLANs:
WX4400# display config area vlan
#Configuration nvgen'd at
#Image 3.0.0
#Model WX4400
#Last change occurred at
See Also
Syntax ??? display version [details]
??details ??? Includes additional software build information and
information about the MAP access points configured on the WX switch.
Defaults ??? None
Access ??? All.
History
678 CHAPTER 20: FILE MANAGEMENT COMMANDS
Examples ??? The following command displays version information for a
WX switch:
WX1200# display version
Mobility System Software, Version: 4.1.0 QA 67
Copyright (c) 2002, 2003, 2004, 2005 3Com Corporation. All rights reserved.
Build Information: (build#67) TOP
WX1200# display version details
Mobility System Software, Version: 4.1.0 QA 67
Copyright (c) 2002, 2003, 2004, 2005 3Com Corporation. All rights reserved.
Build Information: (build#67) TOP
load config 679
Table 115 describes the fields in the display version output.
Table 115 Output for display version
Syntax ??? load config [url]
??url ??? Filename. Specify between 1 and 128 alphanumeric characters,
with no spaces.
If the file is in a subdirectory, specify the subdirectory name, followed by a forward slash, in front of the filename. For example: backup_configs/config_c.
680 CHAPTER 20: FILE MANAGEMENT COMMANDS
Defaults ??? The default file location is nonvolatile storage.
The current version supports loading a configuration file only from the switch???s nonvolatile storage. You cannot load a configuration file directly from a TFTP server.
If you do not specify a filename, MSS uses the same configuration filename that was used for the previous configuration load. For example, if the WX switch used configuration for the most recent configuration load, MSS uses configuration again unless you specify a different filename. To display the filename of the configuration file MSS loaded during the last reboot, use the display boot command.
Access ??? Enabled.
History
Usage ??? This command completely replaces the running configuration with the configuration in the file.
Examples ??? The following command reloads the configuration from the most recently loaded configuration file:
WX4400# load config
Reloading configuration may result in lost of connectivity, do you wish to continue? (y/n) [n]y
success: Configuration reloaded
The following command loads configuration file testconfig1:
WX4400# load config testconfig1
Reloading configuration may result in lost of connectivity, do you wish to continue? (y/n) [n]y
success: Configuration reloaded
See Also
682 CHAPTER 20: FILE MANAGEMENT COMMANDS
Examples ??? The following commands create a subdirectory called corp2 and display the root directory to verify the result:
WX4400# mkdir corp2 success: change accepted. WX4400# dir
===============================================================================
===============================================================================
Boot:
===============================================================================
reset system 683
Syntax ??? reset system [force]
??force ??? Immediately restarts the system and reboots, without
comparing the running configuration to the configuration file.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? If you do not use the force option, the command first compares the running configuration to the configuration file. If the running configuration and configuration file do not match, MSS does not restart the WX switch but instead displays a message advising you to either save the configuration changes or use the force option.
Examples ??? The following command restarts an WX switch that does not have any unsaved configuration changes:
WX4400# reset system
This will reset the entire system. Are you sure (y/n)y
The following commands attempt to restart an WX switch with a running configuration that has unsaved changes, and then force the switch to restart:
WX4400# reset system
error: Cannot reset, due to unsaved configuration changes. Use "reset system force" to override.
WX4400# reset system force
...... rebooting ......
See Also
684 CHAPTER 20: FILE MANAGEMENT COMMANDS
rmdir 685
See Also
Syntax ??? rmdir [subdirname]
??subdirname ??? Subdirectory name. Specify between 1 and 32
alphanumeric characters, with no spaces.
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? MSS does not allow the subdirectory to be removed unless it is empty. Delete all files from the subdirectory before attempting to remove it.
Examples ??? The following example removes subdirectory corp2:
WX4400# rmdir corp2 success: change accepted.
See Also
Syntax ??? save config [filename]
??filename ??? Name of the configuration file. Specify between 1 and
128 alphanumeric characters, with no spaces.
To save the file in a subdirectory, specify the subdirectory name, followed by a forward slash, in front of the filename. For example: backup_configs/config_c.
Defaults ??? By default, MSS saves the running configuration as the configuration filename used during the last reboot.
686 CHAPTER 20: FILE MANAGEMENT COMMANDS
688 CHAPTER 20: FILE MANAGEMENT COMMANDS
uninstall soda agent 689
Usage ??? The uninstall soda command removes the SODA agent directory and all of its contents. All files in the specified directory are removed. The command removes the directory and its contents, regardless of whether it contains SODA agent files.
Examples ??? The following command removes the directory sp1 and all of its contents:
WX4400# uninstall soda agent
This will delete all files in
See Also
690 CHAPTER 20: FILE MANAGEMENT COMMANDS
Use trace commands to perform diagnostic routines. While MSS allows you to run many types of traces, this chapter describes commands for those traces you are most likely to use. For a complete listing of the types of traces MSS allows, type the set trace ? command.
CAUTION: Using the set trace command can have adverse effects on system performance. 3Com recommends that you use the lowest levels possible for initial trace commands, and slowly increase the levels to get the data you need.
display trace 693
To clear the session manager trace, type the following command:
WX4400# clear trace sm success: clear trace sm
See Also
??set trace authentication on page 694
??set trace authorization on page 695
Syntax ??? display trace [all]
??all ??? Displays all possible trace options and their configuration.
Defaults ??? None.
Access ??? Enabled.
History
Examples ??? To view the traces currently running, type the following command:
See Also
??set trace authentication on page 694
694 CHAPTER 21: TRACE COMMANDS
Syntax ??? save trace filename
??filename ??? Name for the trace file. To save the file in a subdirectory,
specify the subdirectory name, then a slash. For example: traces/trace1
696 CHAPTER 21: TRACE COMMANDS
See Also
Syntax ??? set trace dot1x
??
address, using colons to separate the octets (for example, 00:11:22:aa:bb:cc).
??port
??user username ??? Traces a user. Specify a username of up to
80 alphanumeric characters with no spaces.
??level level ??? Determines the quantity of information included in
the output. You can set the level with an integer from 1 to 10, where level 10 provides the most information. Levels 1 through 5 provide
Defaults ??? The default trace level is 5.
Access ??? Enabled.
History
Examples ??? The following command starts a trace for the 802.1X sessions for MAC address 00:01:02:03:04:05:
WX4400# set trace dot1x
See Also
set trace sm 697
Syntax ??? set trace sm
[user username] [level level]
??
address, using colons to separate the octets (for example, 00:11:22:aa:bb:cc).
??port
??user username ??? Traces a user. Specify a username of up to
80 alphanumeric characters, with no spaces.
??level level ??? Determines the quantity of information included in
the output. You can set the level with an integer from 1 to 10, where level 10 provides the most information. Levels 1 through 5 provide
Defaults ??? The default trace level is 5.a
Access ??? Enabled.
History
Examples ??? Type the following command to trace session manager activity for MAC address 00:01:02:03:04:05:
WX4400# set trace sm
See Also
698 CHAPTER 21: TRACE COMMANDS
Use snoop commands to monitor wireless traffic, by using a MAP as a sniffing device. The MAP copies the sniffed 802.11 packets and sends the copies to an observer, which is typically a protocol analyzer such as Ethereal or Tethereal.
(For more information, including setup instructions for the monitoring station, see the ???Remotely Monitoring Traffic??? section in the ???Troubleshooting a WX Switch??? chapter of the Wireless LAN Switch and Controller Configuration Guide.)
700 CHAPTER 22: SNOOP COMMANDS
Defaults ??? None.
Access ??? Enabled.
History
set snoop 701
Examples ??? The following command removes snoop filter snoop2 from radio 2 on Distributed MAP 3:
WX1200# clear snoop map snoop2 ap 3 radio 2 success: change accepted.
The following command removes all snoop filter mappings from all radios:
WX1200# clear snoop map all success: change accepted.
See Also
??display snoop map on page 707
Syntax ??? set snoop
??
alphanumeric characters, with no spaces.
??
are ANDed. Therefore, to be copied and sent to an observer, a packet must match all criteria in the
??
??channel {eq | neq} channel
??bssid {eq | neq} bssid
??
??
??
??
??direction {eq | neq} {transmit | receive}
702 CHAPTER 22: SNOOP COMMANDS
To match on packets to or from a specific MAC address, use the
If you omit a condition, all packets match that condition. For example, if you omit
For most conditions, you can use eq (equal) to match only on traffic that matches the condition value. Use neq (not equal) to match only on traffic that is not equal to the condition value.
??observer
the protocol analyzer is located. If you do not specify an observer, the MAP radio still counts the packets that match the filter.
??
capture. If you do not specify a length, the entire packet is copied and sent to the observer. 3Com recommends specifying a snap length of 100 bytes or less.
Defaults ??? No snoop filters are configured by default.
Access ??? Enabled.
History
Usage ??? Traffic that matches a snoop filter is copied after it is decrypted.
The decrypted (clear) version is sent to the observer.
For best results:
??Do not specify an observer that is associated with the MAP where the snoop filter is running. This configuration causes an endless cycle of snoop traffic.
??If the snoop filter is running on a Distributed MAP, and the MAP used a DHCP server in its local subnet to configure its IP information, and the MAP did not receive a default gateway address as a result, the observer must also be in the same subnet. Without a default gateway, the MAP cannot find the observer.
set snoop 703
??The MAP that is running a snoop filter forwards snooped packets directly to the observer. This is a
Examples ??? The following command configures a snoop filter named snoop1 that matches on all traffic, and copies the traffic to the device that has IP address 10.10.30.2:
WX1200# set snoop snoop1 observer 10.10.30.2
The following command configures a snoop filter named snoop2 that matches on all data traffic between the device with MAC address aa:bb:cc:dd:ee:ff and the device with MAC address 11:22:33:44:55:66, and copies the traffic to the device that has IP address 10.10.30.3:
WX1200# set snoop snoop2
See Also
??display snoop info on page 706
704 CHAPTER 22: SNOOP COMMANDS
Defaults ??? Snoop filters are unmapped by default.
Access ??? Enabled.
History
Usage ??? You can map the same filter to more than one radio. You can map up to eight filters to the same radio. If more than one filter has the same observer, the MAP sends only one copy of a packet that matches a filter to the observer. After the first match, the MAP sends the packet and stops comparing the packet against other filters for the same observer.
If the filter does not have an observer, the MAP still maintains a counter of the number of packets that match the filter. (See display snoop stats on page 708.)
Examples ??? The following command maps snoop filter snoop1 to radio 2 on MAP 3:
WX1200# set snoop map snoop1 ap 3 radio 2 success: change accepted.
See Also
?? clear snoop map on page 700
?? display snoop map on page 707
set snoop mode 705
706 CHAPTER 22: SNOOP COMMANDS
WX1200# display snoop
See Also
??display snoop map on page 707
display snoop info Shows the configured snoop filters.
Syntax ??? display snoop
??
Defaults ??? None.
Access ??? Enabled.
History
display snoop map 707
Examples ??? The following command shows the snoop filters configured in the examples above:
WX1200# display snoop info snoop1:
observer 10.10.30.2
snoop2:
observer 10.10.30.3
See Also
display snoop map Shows the MAP radios that are mapped to a specific snoop filter.
Syntax ??? display snoop map
??
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? To display the mappings for all snoop filters, use the display snoop command.
Examples ??? The following command shows the mapping for snoop filter snoop1:
WX1200# display snoop map snoop1 filter 'snoop1' mapping
ap: 3 Radio: 2
See Also
708 CHAPTER 22: SNOOP COMMANDS
display snoop stats Displays statistics for enabled snoop filters.
Syntax ??? display snoop stats
??
??
mapped
??radio 1 ??? Radio 1 of the MAP
??radio 2 ??? Radio 2 of the MAP. (This option does not apply to
Defaults ??? None.
Access ??? Enabled.
History
Usage ??? The MAP retains statistics for a snoop filter until the filter is changed or disabled. The MAP then clears the statistics.
Examples ??? The following command shows statistics for snoop filter snoop1:
===============================================================================
snoop1 3 196 4 0 stopped
display snoop stats 709
Table 118 describes the fields in this display.
Table 118 display snoop stats Output
710 CHAPTER 22: SNOOP COMMANDS
Use the system log commands to record information for monitoring and troubleshooting. MSS system logs are based on RFC 3164, which defines the log protocol.
configuration for a syslog server and stops sending log messages to that server.
Syntax ??? clear log [buffer | server
?? buffer ??? Deletes the log messages stored in nonvolatile storage.
?? server
Defaults ??? None.
712 CHAPTER 23: SYSTEM LOG COMMANDS
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? To stop sending system logging messages to a server at 192.168.253.11, type the following command:
WX4400# clear log server 192.168.253.11 success: change accepted.
Type the following command to clear all messages from the log buffer:
WX4400# clear log buffer success: change accepted.
See Also
display log buffer Displays system information stored in the nonvolatile log buffer or the trace buffer.
Syntax ??? display log buffer
[severity
??buffer ??? Displays the log messages in nonvolatile storage.
??+|-
specified as follows:
??A positive number (for example, +100), displays that number of log entries starting from the oldest in the log.
??A negative number (for example,
??facility
message. Type a space and a question mark (?) after display log buffer facility for a list of valid facilities.
??matching string ??? Displays messages that match a
example, a username or IP address.
714 CHAPTER 23: SYSTEM LOG COMMANDS
See Also
??display log config on page 714
display log config Displays log configuration information.
Syntax ??? display log config
Defaults ??? None.
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0.
Examples ??? To display how logging is configured, type the following command:
See Also
display log trace 715
display log trace Displays system information stored in the nonvolatile log buffer or the trace buffer.
Syntax ??? display log trace
[facility
[severity
??trace ??? Displays the log messages in the trace buffer.
??
specified as follows:
??A positive number (for example, +100), displays that number of log entries starting from the oldest in the log.
??A negative number (for example,
??A number preceded by a slash (for example, /100) displays that number of the most recent log entries in the log, starting with the least recent.
??facility
message. Type a space and a question mark (?) after display log trace facility for a list of valid facilities.
??matching string ??? Displays messages that match a
example, a username or IP address.
??severity
greater than or equal to the level specified. Specify one of the following:
??emergency ??? The WX switch is unusable.
??alert ??? Action must be taken immediately.
??critical ??? You must resolve the critical conditions. If the
conditions are not resolved, the WX can reboot or shut down.
??error ??? The WX is missing data or is unable to form a connection.
??warning ??? A possible problem exists.
??notice ??? Events that potentially can cause system problems have
occurred. These are logged for diagnostic purposes. No action is required.
??info ??? Informational messages only. No problem exists.
??debug ??? Output from debugging.
716 CHAPTER 23: SYSTEM LOG COMMANDS
ASO, BOOT, CLI, CLUSTER, COPP, CRYPTO, DOT1X, ENCAP, ETHERNET, GATEWAY, HTTPD, IGMP, IP, MISC, NOSE, NP, RAND, RESOLV, RIB, ROAM, ROGUE, SM, SNMPD, SPAN, STORE, SYS, TAGMGR, TBRIDGE, TCPSSL, TELNET, TFTP, TLS, TUNNEL, VLAN, X509, XML, MAP,
RAPDA, WEBVIEW, EAP, PORTCONFIG, FP.
set log 717
??Logging state (enabled or disabled)
To override the session defaults for an individual session, type the set log command from within the session and use the current option.
??trace ??? Sets log parameters for trace files.
??Port
syslog server. You can specify a number from 1 to 65535. The default syslog port is 514.
??severity
than or equal to the level specified. Specify one of the following:
??emergency ??? The WX switch is unusable.
??alert ??? Action must be taken immediately.
??critical ??? You must resolve the critical conditions. If the
conditions are not resolved, the WX can reboot or shut down.
??error ??? The WX is missing data or is unable to form a connection.
??warning ??? A possible problem exists.
??notice ??? Events that potentially can cause system problems have
occurred. These are logged for diagnostic purposes. No action is required.
??info ??? Informational messages only. No problem exists.
??debug ??? Output from debugging.
??
server, maps all messages of the severity you specify to one of the standard local log facilities defined in RFC 3164. You can specify one of the following values:
??0 ??? maps all messages to local0.
??1 ??? maps all messages to local1.
??2 ??? maps all messages to local2.
??3 ??? maps all messages to local3.
??4 ??? maps all messages to local4.
??5 ??? maps all messages to local5.
??6 ??? maps all messages to local6.
??7 ??? maps all messages to local7.
718 CHAPTER 23: SYSTEM LOG COMMANDS
If you do not specify a local facility, MSS sends the messages with their default MSS facilities. For example, AAA messages are sent with facility 4 and boot messages are sent with facility 20 by default.
??enable ??? Enables messages to the specified target.
??disable ??? Disables messages to the specified target.
Defaults ??? The following are defaults for the set log commands.
??Events at the error level and higher are logged to the WX console.
??Events at the error level and higher are logged to the WX system buffer.
??Trace logging is enabled, and
Access ??? Enabled.
History ??? Introduced in MSS Version 3.0. Version 4.2 added the option port.
Usage ??? Using the command with only enable or disable turns logging on or off for the target at all levels. For example, entering set log buffer enable with no other keywords turns on logging to the system buffer of all facilities at all levels. Entering set log buffer disable with no other keywords turns off all logging to the buffer.
Examples ??? To log only emergency, alert, and critical system events to the console, type the following command:
WX4400# set log console severity critical enable success: change accepted.
See Also
set log mark 719
Defaults ??? Mark messages are disabled by default. When they are enabled, MSS generates a message at the notice level once every 300 seconds by default.
Access ??? Enabled.
History ??? Introduced in MSS Version 4.1.
Examples ??? The following command enables mark messages:
WX1200# set log mark enable success: change accepted.
See Also
720 CHAPTER 23: SYSTEM LOG COMMANDS
Boot prompt commands enable you to perform basic tasks, including booting a system image file, from the boot prompt (boot>). A CLI session enters the boot prompt if MSS does not boot successfully or you intentionally interrupt the boot process. To interrupt the boot process, press q followed by Enter (return).
CAUTION: Generally, boot prompt commands are used only for troubleshooting. 3Com recommends that you use these commands only when working with 3Com Technical Support to diagnose a system issue. In particular, commands that change boot parameters can interfere with a WX switch???s ability to boot successfully.
722 CHAPTER 24: BOOT PROMPT COMMANDS
Table 120 Boot Prompt Commands by Usage (continued)
Boot Profile Management display on page 730
Syntax ??? autoboot [ON | on | OFF | off]
??ON ??? Enables the autoboot option.
??on ??? Same effect as ON.
??OFF ??? Disables the autoboot option.
??off ??? Same effect as OFF.
Defaults ??? The autoboot option is enabled by default.
Access ??? Boot prompt.
History
Examples ??? The following command displays the current setting of the autoboot option:
boot> autoboot
The autoboot flag is on.
See Also
boot 723
Syntax ??? boot [BT=type] [DEV=device] [FN=filename]
??BT=type ??? Boot type:
??c ??? Compact flash. Boots using nonvolatile storage or a flash
card.
??n ??? Network. Boots using a TFTP server.
??DEV=device ??? Location of the system image file:
??c: ??? Nonvolatile storage area containing boot partition 0
??d: ??? Nonvolatile storage area containing boot partition 1
??e: ??? Primary partition of the flash card in the flash card slot
??f: ??? Secondary partition of the flash card in the flash card slot
??boot0 ??? boot partition 0
??boot1 ??? boot partition 1
??FN=filename ??? System image filename.
??
parameter applies only when the boot type is n (network).
??FL=num ??? Number representing the bit settings of boot flags to pass
to the booted system image. Use this parameter only if advised to do so by 3Com.
??OPT=option ??? String up to 128 bytes of boot options to pass to the
booted system image instead of the boot option(s) in the currently active boot profile. The options temporarily replace the options in the boot profile. Use this parameter only if advised to do so by 3Com.
??OPT+=option ??? String up to 128 bytes of boot options to pass to the
booted system image in addition to the boot option(s) in the currently active boot profile. The options are appended to the options already in the boot profile. Use this parameter only if advised to do so by 3Com.
Defaults ??? The boot settings in the currently active boot profile are used by default.
Access ??? Boot prompt.
History
724 CHAPTER 24: BOOT PROMPT COMMANDS
Usage ??? If you use an optional parameter, the parameter setting overrides the setting of the same parameter in the currently active boot profile. However, the boot profile itself is not changed. To display the currently active boot profile, use the display command. To change the currently active boot profile, use the change command.
Examples ??? The following command loads system image file
WXA30001.Rel from boot partition 1:
boot> boot FN=WXA03001.Rel DEV=boot1
Compact Flash load from boot0:WXA03001.Rel. unzip: Inflating ramdisk_3.0.1_092304_WX4400 OK unzip file len 36196930 OK
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004 The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.
Detecting hardware...done. readclock:
system initialized (3.0.1), starting MSS Executing update_3
Starting supervisor 3.0.1_092304_WX4400 ...
SNMPD Sep 29 21:45:34.262293 NOTICE SNMPD: SNMP Agent Resident Module Version 16.1.0.0
SNMPD Sep 29 21:45:34.263146 NOTICE SNMPD: Copyright (c) 2004 3Com Corporation. All rights reserved.
SYS Sep 29 21:45:36.849457 NOTICE Port 1 up 1000 Full Duplex
SYSLOGD Sep 29 21:45:38.857125 ALERT SYSTEM_READY: The system has finished booting. (cause was "Warm Reboot")
Copyright (c) 2004 3Com Corporation. All rights reserved.
Username:
See Also
change 725
726 CHAPTER 24: BOOT PROMPT COMMANDS
The following command enters the configuration mode for the currently active boot profile and configures the WX switch (in this example, an WXR100) to boot using a TFTP server:
boot> change
Changing the default configuration is not recommended.
Are you sure that you want to proceed? (y/n)y
Syntax ??? create
Defaults ??? The new boot profile has the same settings as the currently active boot profile by default.
Access ??? Boot prompt.
History
delete 727
Usage ??? A WX switch can have up to four boot profiles. The boot profiles are stored in slots, numbered 0 through 3. When you create a new profile, the system uses the next available slot for the profile. If all four slots already contain profiles and you try to create a fifth profile, the switch displays a message advising you to change one of the existing profiles instead.
To make a new boot profile the currently active boot profile, use the next command. To change boot parameter settings, use the change command.
Examples ??? The following command creates a new boot profile in slot 1 on a WX switch that currently has only one boot profile, in slot 0:
boot> create
Syntax ??? delete
Defaults ??? None.
Access ??? Boot prompt.
History
728 CHAPTER 24: BOOT PROMPT COMMANDS
Usage ??? When you type the delete command, the
Examples ??? To remove the currently active boot profile, type the following command:
boot> delete
Syntax ??? dhcp [ON | on | OFF | off]
?? ON ??? Enables the DHCP option.
?? on ??? Same effect as ON.
?? OFF ??? Disables the DHCP option.
?? off ??? Same effect as OFF.
Defaults ??? The DHCP option is disabled by default.
Access ??? Boot prompt.
History
diag 729
730 CHAPTER 24: BOOT PROMPT COMMANDS
Access ??? Boot prompt.
History
Usage ??? To display the system image software versions, use the fver command. This command does not list the boot code versions. To display the boot code versions, use the version command.
Examples ??? The following command displays all the boot code and system image files on a WX switch:
boot> dir
?? Boot type ??? Either compact flash (local device on the WX switch) or network (TFTP)
?? Boot device ??? Location of the system image file
?? Filename ??? System image file
?? Flags ??? Number representing the bit settings of boot flags to pass to the booted system image.
?? Options ??? String up to 128 bytes of boot options to pass to the booted system image
display 731
A WX switch can have up to four boot profiles, numbered 0 through 3. Only one boot profile can be active at a time. You can create, change, and delete boot profiles. You also can activate another boot profile in place of the currently active one.
Syntax ??? display
Defaults ??? None.
Access ??? Boot prompt.
History
Examples ??? To display the currently active boot profile, type the following command at the boot prompt:
boot> display
BOOT Index: 0
BOOT TYPE: c
DEVICE: boot1:
FILENAME: default
FLAGS: 00000000
OPTIONS: run=nos;boot=0
Table 121 describes the fields in the display.
Table 121 Output of display command
732 CHAPTER 24: BOOT PROMPT COMMANDS
Table 121 Output of display command (continued)
Syntax ??? fver {c: | d: | e: | f: | boot0: | boot1:} [filename]
?? c: ??? Nonvolatile storage area containing boot partition 0 (primary).
?? d: ??? Nonvolatile storage area containing boot partition 1 (secondary).
?? e: ??? Primary partition of the flash card in the flash card slot.
?? f: ??? Secondary partition of the flash card in the flash card slot.
?? boot0: ??? Boot partition 0.
?? boot1: ??? Boot partition 1.
?? filename ??? System image filename.
Defaults ??? None.
help 733
Access ??? Boot prompt.
History
Usage ??? To display the image filenames, use the dir command. This command does not list the boot code versions. To display the boot code versions, use the version command.
Examples ??? The following command displays the system image version installed in boot partition 1:
boot> fver boot1
File boot1:default version is 3.0.1.
See Also
Syntax ??? help
??
Defaults ??? None.
Access ??? Boot prompt.
History
Usage ??? If you specify a command name, detailed information is displayed for that command. If you do not specify a command name, all the boot prompt commands are listed.
734 CHAPTER 24: BOOT PROMPT COMMANDS
Examples ??? The following command displays detailed information for the fver command:
boot> help fver
fver Display the version of the specified device:filename.
USAGE: fver [c:file|d:file|e:file|f:file|boot0:file|boot1:file| boot2:file|boot3:file]
next 735
information about boot profiles, see display on page 730.)
Syntax ??? next
Defaults ??? None.
Access ??? Boot prompt.
History
Usage ??? A WX switch contains 4 boot profile slots, numbered
0 through 3. This command activates the boot profile in the next slot, in ascending numerical order. If the currently active slot is 3, the command activates the boot profile in slot 0.
736 CHAPTER 24: BOOT PROMPT COMMANDS
Examples ??? To activate the boot profile in the next slot and display the profile, type the following command:
boot> next
test 737
3Com
Version 3.0.2 Release
Compiled on Wed Sep 22 09:18:47 PDT 2004 by
738 CHAPTER 24: BOOT PROMPT COMMANDS
Examples ??? The following command displays the current setting of the poweron test flag:
boot> test
The diagnostic execution flag is not set.
See Also
740 APPENDIX A: OBTAINING SUPPORT FOR YOUR 3COM PRODUCTS
Contact Us 741
Telephone Technical To obtain telephone support as part of your warranty and other service Support and Repair benefits, you must first register your product at:
When you contact 3Com for assistance, please have the following information ready:
???Product model name, part number, and serial number
???A list of system hardware and software, including revision level
???Diagnostic error messages
???Details about recent configuration changes, if applicable
To send a product directly to 3Com for repair, you must first obtain a return materials authorization number (RMA). Products sent to 3Com without authorization numbers clearly marked on the outside of the package will be returned to the sender unopened, at the sender???s expense. If your product is registered and under warranty, you can obtain an RMA number online at http://eSupport.3com.com/.
Telephone numbers are correct at the time of publication. Find a current directory of 3Com resources by region at: http://csoweb4.3com.com/contactus/
742 APPENDIX A: OBTAINING SUPPORT FOR YOUR 3COM PRODUCTS
Pakistan Call the U.S. direct by dialing 00 800 01001, then dialing 800 763 6780
Sri Lanka Call the U.S. direct by dialing 02 430 430, then dialing 800 763 6780
Vietnam Call the U.S. direct by dialing 1 201 0288, then dialing 800 763 6780
You can also obtain
Europe, Middle East, and Africa ??? Telephone Technical Support and Repair
From anywhere in these regions not listed below, call: +44 1442 435529
From the following countries, call the appropriate number:
You can also obtain support in this region using this URL: http://emea.3com.com/support/email.html
You can also obtain
Technical support and general requests: customer_support@3com.com
Return material authorization: warranty_repair@3com.com
Contract requests: emea_contract@3com.com
You can also obtain support in this region in the following ways:
???Spanish speakers, enter the URL: http://lat.3com.com/lat/support/form.html
???Portuguese speakers, enter the URL: http://lat.3com.com/br/support/form.html
???English speakers in Latin America, send
Contact Us 743
744 APPENDIX A: OBTAINING SUPPORT FOR YOUR 3COM PRODUCTS
