[notes]
If using 7921G world mode phone, you must enable 802.11d
world-mode dot11d country US both
If the AP does not support CCX or proxy ARP is not enabled, then the idle battery life will be up to 50% less. Set the DTIM period to 2 and beacon period to 100
TSpec has precedence over QBSS
TCLAS is supported in WLC release 5.1.1.51.0
Multicast packets are set at the highest basic data rate enabled. Capacity and throughput are reduced when lower rates are enabled.
Cisco APs can support up to 27 bi-directional RTP streams for 802.11a and 802.11g at a data rate of 24Mb+. To achieve this, you must use U-APSD, and have minimal WLAN background traffic & RF utilization. At 6 MBps, a Cisco AP can support up to 13 bi-directional RTP streams.
DTPC
Do not use the default setting of Max Power for client power, as this setting will not advertise DTPC to the client
5Ghz channels overlap their adjacent channel, so there should be at least one channel of separation for adjacent Access Points.
If planning to use UNII-2 extended channels (100-140), it is recommended to disable UNII-2 channels 52-64 on the AP. Having many 5GHz channels enabled on the WLAN can delay discovery of new APs.
If using 802.11b in a high multipath environment, lower data rates should be used in those areas (1&2MBps)
To see all APs in the neighbor list menu, place a call to a wired IP phone, where scanning occurs constantly while the phone call is active in auto scan mode.
Monday, November 30, 2009
WCS Client Calibration + RFID Tags
[notes]
Open caveat with dual band client calibration cscsh88795 – calibrate one band at a time or use two client devices to calibrate both bands simultaneously. CCXv1 or Non CCX clients will be forced to reassociate/reauthenticate to generate probe requests. They do not respond to unicast radio measurement requests
When doing calibration – temporarily disable TPC, ensure WLAN calibration client connects to is configured to support Aironet IE.
To use a “test point” in WCS – Advanced Debug must be enabled on the location appliance/MSE
802.11b asset tags that transmit messages using L2 multicasts will not cause the initiation of any 802.11g protection mode under any circumstances. This includes CCXv1 tags.
- A probe request from an 802.11b tag that is not associated to an AP does not cause protection mode. Not until the asset tag associates to the cell in question, or an adjacent cell on the same channel. APs not on the same channel as the tag or not an adjacent RF, no protection mode is enabled.
Enable Asset tag RF Data timeout – (valid range: 60-7200) (default: 1200)
- recommended to be set to a minimum of 3x to a maximum of 8x the longest tag transmission interval found in the general tag population. This should be inclusive of any stationary and “in-motion” transmission intervals.
RFID data timeout should always be greater than the asset tag polling interval on the location appliance/MSE
Recording asset tag location history is disabled by default.
The archival interval between writes of historical data to the database is 720 seconds by default.
Tag activator range = 3 feet
Transmission parameters:
- message repetitions: change from default value of 1 to 3 to overcome the tags’ transmissions being lost due to lost RSSI readings. Settings above 5 are not necessary.
LOCP Echo Request: 100 bytes transmitted on TCP destination port 16113
LOCP Echo Response: 100 bytes
LOCP Info. Request: From location appliance to WLC, 106 bytes on TCP destination port 16113
LOCP Info. Response: from WLC to location appliance, if no tags are detected – 113 bytes, one tag detected – 144 bytes, two tags detected – 175 bytes (example tag tx not including telemetry data)
Tag high priority notifications:
When a call button is depressed on an asset tag (CCX compliant) a LOCP Information Notification is transmitted by the WLC to the location appliance/MSE. The basic size is 130 bytes
This transmission is sent to the location appliance/MSE for each high priority notification sreceived by EACH of the WLC’s registered APs.
Chokepoint triggers in WCS
Range value set on chokepoints is only for a visual aide of the chokepoint range. The vendor’s management application is what truly adjusts the chokepoint range.
Chokepoint usage – checkbox must be enabled in order for the location appliance/MSE to use chokepoint location techniques to localize tags.
Chokepoint out of range timeout – this is the timer that is used to age the last “in-range” report received from or received for an asset tag that is being localized using chokepoint location techniques
AeroScout T2 tags
The typical size of the tag multicast frame emitted when in the proximity of a chokepoint trigger = 71 bytes
The routine periodic transmission = 56 bytes
There are an extra 8 bytes of vendor specific information included
CCX allows tags to communicate historical information about the chokepoints they traverse to CUWN. This can increase the size of the frame by 10 bytes per chokepoint trigger (depending on number of historical entries maintained)
The number of LOCP measurement notification generated by one or more WLCs for a single tag transmits multicast frames indicating it has been triggered by a chokepoint depends on:
- the number of registered APs within range of the tag that detected the chokepoint event
- the number of times the tag will transmit a multicast frame on each configured 802.11 channel in response to the chokepoint trigger
The repetition count of the multicast frames sent after an exciter event is managed independent of the repetition count for other tag events. This is configured on a per-exciter basis
A tag sends one multicast frame from an exciter event – the WLC parses it into two separate LOCP notifications
LOCP measurement notification – contains chokepoint group information = 160 bytes
LOCP information notification – contains vendor specific information = 138 bytes in length
The fragment number should always start from zero even if the burst length is zero.
For a packet burst, the fragment number should be set to N where N is the packet index within the burst starting from zero.
show RFID summary
show RFID config
config advanced location expiry {calibrating client|client|rogue-APs|tags}
config advanced location RSSI-half-life {calibrating client|client|rogue-APs|tags}
If tag detection is enabled and the asset tag is configured to transmit on the channel the AP is configured for, check to see that the AP is forwarding the multicast packet to the WLC by using this debug:
debug dot11 dot11radio0 trace print mcast
*as of code version 4.1 – this command must be entered at the AP console, it cannot be entered remotely at the WLC.
verify asset tag telemetry and events:
debug MAC addr [MAC address]
debug dot11 RFID enable
show LOCP status
debug LOCP event enable
v4.2 of CUWN introduces an enhancement that allows for individual limits to be placed on what portion of the location appliances’ aggregate tracked device capacity is allocated to each tracked device category (clients, tags, rogues)
Open caveat with dual band client calibration cscsh88795 – calibrate one band at a time or use two client devices to calibrate both bands simultaneously. CCXv1 or Non CCX clients will be forced to reassociate/reauthenticate to generate probe requests. They do not respond to unicast radio measurement requests
When doing calibration – temporarily disable TPC, ensure WLAN calibration client connects to is configured to support Aironet IE.
To use a “test point” in WCS – Advanced Debug must be enabled on the location appliance/MSE
802.11b asset tags that transmit messages using L2 multicasts will not cause the initiation of any 802.11g protection mode under any circumstances. This includes CCXv1 tags.
- A probe request from an 802.11b tag that is not associated to an AP does not cause protection mode. Not until the asset tag associates to the cell in question, or an adjacent cell on the same channel. APs not on the same channel as the tag or not an adjacent RF, no protection mode is enabled.
Enable Asset tag RF Data timeout – (valid range: 60-7200) (default: 1200)
- recommended to be set to a minimum of 3x to a maximum of 8x the longest tag transmission interval found in the general tag population. This should be inclusive of any stationary and “in-motion” transmission intervals.
RFID data timeout should always be greater than the asset tag polling interval on the location appliance/MSE
Recording asset tag location history is disabled by default.
The archival interval between writes of historical data to the database is 720 seconds by default.
Tag activator range = 3 feet
Transmission parameters:
- message repetitions: change from default value of 1 to 3 to overcome the tags’ transmissions being lost due to lost RSSI readings. Settings above 5 are not necessary.
LOCP Echo Request: 100 bytes transmitted on TCP destination port 16113
LOCP Echo Response: 100 bytes
LOCP Info. Request: From location appliance to WLC, 106 bytes on TCP destination port 16113
LOCP Info. Response: from WLC to location appliance, if no tags are detected – 113 bytes, one tag detected – 144 bytes, two tags detected – 175 bytes (example tag tx not including telemetry data)
Tag high priority notifications:
When a call button is depressed on an asset tag (CCX compliant) a LOCP Information Notification is transmitted by the WLC to the location appliance/MSE. The basic size is 130 bytes
This transmission is sent to the location appliance/MSE for each high priority notification sreceived by EACH of the WLC’s registered APs.
Chokepoint triggers in WCS
Range value set on chokepoints is only for a visual aide of the chokepoint range. The vendor’s management application is what truly adjusts the chokepoint range.
Chokepoint usage – checkbox must be enabled in order for the location appliance/MSE to use chokepoint location techniques to localize tags.
Chokepoint out of range timeout – this is the timer that is used to age the last “in-range” report received from or received for an asset tag that is being localized using chokepoint location techniques
AeroScout T2 tags
The typical size of the tag multicast frame emitted when in the proximity of a chokepoint trigger = 71 bytes
The routine periodic transmission = 56 bytes
There are an extra 8 bytes of vendor specific information included
CCX allows tags to communicate historical information about the chokepoints they traverse to CUWN. This can increase the size of the frame by 10 bytes per chokepoint trigger (depending on number of historical entries maintained)
The number of LOCP measurement notification generated by one or more WLCs for a single tag transmits multicast frames indicating it has been triggered by a chokepoint depends on:
- the number of registered APs within range of the tag that detected the chokepoint event
- the number of times the tag will transmit a multicast frame on each configured 802.11 channel in response to the chokepoint trigger
The repetition count of the multicast frames sent after an exciter event is managed independent of the repetition count for other tag events. This is configured on a per-exciter basis
A tag sends one multicast frame from an exciter event – the WLC parses it into two separate LOCP notifications
LOCP measurement notification – contains chokepoint group information = 160 bytes
LOCP information notification – contains vendor specific information = 138 bytes in length
The fragment number should always start from zero even if the burst length is zero.
For a packet burst, the fragment number should be set to N where N is the packet index within the burst starting from zero.
show RFID summary
show RFID config
config advanced location expiry {calibrating client|client|rogue-APs|tags}
config advanced location RSSI-half-life {calibrating client|client|rogue-APs|tags}
If tag detection is enabled and the asset tag is configured to transmit on the channel the AP is configured for, check to see that the AP is forwarding the multicast packet to the WLC by using this debug:
debug dot11 dot11radio0 trace print mcast
*as of code version 4.1 – this command must be entered at the AP console, it cannot be entered remotely at the WLC.
verify asset tag telemetry and events:
debug MAC addr [MAC address]
debug dot11 RFID enable
show LOCP status
debug LOCP event enable
v4.2 of CUWN introduces an enhancement that allows for individual limits to be placed on what portion of the location appliances’ aggregate tracked device capacity is allocated to each tracked device category (clients, tags, rogues)
LBS 4.1 Design Guide
[notes]
TDOA formula: D=C(t)
Distance in Meters = propagation speed of ~300m/microsecond (time in microseconds)
TDOA uses relative time measurements at each receiving sensor in place of absolute time measurements. It does not require a synchronized time source – the TDOA receivers require a time sync.
TDOA is rooted in hyperbolic lateration, also referred to as Enhanced Observed Time Difference
Path loss model for indoor propagation:
PL = PL1meter + 10log (dn) + s
PL = total path loss between receiver and sender in dB
PL1meter = reference path loss for desired frequency when receiver to transmitter distance is one meter
d = distance between receiver and transmitter in meters
n = path loss exponent for the environment
s = standard deviation associated with the degree of shadow fading present in the environment in dB
Pure RSS based lateration techniques that do not take additional steps to account for attenuation and multipath in the environment rarely produce acceptable results except in very controlled situations
Angle of arrival – (direction of arrival) locates the mobile station by determining the angle of incidence at which signals arrive at the receiving sensor.
Well known implementation – VOR VHF Omnidirectional Range – system used for aircraft navigation from 108.1 – 117.95 MHz
Location Patterning – may be implemented totally in software, which can reduce complexity and cost significantly compared to angulation or purely time based lateration systems.
Location Patterning Positioning Algorithms:
deterministic – attempt to find minimum statistical signal distance between a detected RSSI location vector and the location vectors of the various calibration sample points
probabilistic – use probability inferences to determine the likelihood of a particular location given that a particular location vector array has already been detected.
other techniques – neural networks, support vector modeling outside boundaries of deterministic and probabilistic approaches.
It is not possible to use calibration data in more than one area of a building. Despite any similarities, the probability that the location vectors collected at the same positions on each floor being identical is significantly low. *Cisco RF fingerprinting can share RF calibration models
Active logistics shipping & receiving area:
Accuracy degradation of 20% can reasonably be expected in a 30 day period
It is not unreasonable to expect to re-verify calibration data accuracy quarterly and to plan for a complete recalibration semi-annually.
Client probing
Unassociated clients generate probe requests quite regularly. Associated clients scan less often and may active scan or passive scan, or a mix of the two. Passive scanning does little to improve location fidelity.
CCXv2 clients support S36 Radio Measurement Requests and will perform active scanning and probe all configured SSIDs on command.
CCX Location Measurement in WLC can be adjusted from 60 seconds (default) to 32,400 seconds
WCS WLAN clients – first 250 are displayed, to view location data of those beyond the first 250, client filtering must be enabled
Off-channel scans occur for ~500ms out of every 180 seconds of operation.
- or ~50ms per non-primary channel per 180 second interval
APs configured as WGB do not respond to broadcast Radio Measurement Requests. use IOS CLI command mobile station period threshold
- this command causes the WGB to perform an active scan when it detects low AP RSSI, excessive interference or a high % of frame loss
Tag batter state info can be pushed via asynchronous NB notifications from the location appliance (MSE), tag telemetry is made available to location clients only via the SOAP/XML API
Location appliance/MSE disk space command:
df –H
The dual on-board Ethernet controllers on the location appliance (MSE) are NOT intended for redundant/simultaneous connections to the same IP network. This configuration is not recommended at this time
#/etc/init.d/loc serverd stop
#shutdown –h now
The remote SSH session will be terminated before power down will be visible. Wait 2 minutes after disconnect before powering off the location appliance/MSE
Insufficient inter-Access Point distance can expose the system to short range antenna pattern anomalies, which may also be non-conducive to good location accuracy.
distances of 40~70ft between each AP is best, they should be spaced greater than 28ft apart
7921g, -67dBm, 20% overlap, 25dB SNR = 24 ft cell size
Inter-Access Point spacing = 33 ft
APs that are placed into the design solely for location purposes should not be included in either RRM TX PWR CTRL or coverage hole remediation processes. Configure a static channel/power to remove them from the RRM process.
TDOA formula: D=C(t)
Distance in Meters = propagation speed of ~300m/microsecond (time in microseconds)
TDOA uses relative time measurements at each receiving sensor in place of absolute time measurements. It does not require a synchronized time source – the TDOA receivers require a time sync.
TDOA is rooted in hyperbolic lateration, also referred to as Enhanced Observed Time Difference
Path loss model for indoor propagation:
PL = PL1meter + 10log (dn) + s
PL = total path loss between receiver and sender in dB
PL1meter = reference path loss for desired frequency when receiver to transmitter distance is one meter
d = distance between receiver and transmitter in meters
n = path loss exponent for the environment
s = standard deviation associated with the degree of shadow fading present in the environment in dB
Pure RSS based lateration techniques that do not take additional steps to account for attenuation and multipath in the environment rarely produce acceptable results except in very controlled situations
Angle of arrival – (direction of arrival) locates the mobile station by determining the angle of incidence at which signals arrive at the receiving sensor.
Well known implementation – VOR VHF Omnidirectional Range – system used for aircraft navigation from 108.1 – 117.95 MHz
Location Patterning – may be implemented totally in software, which can reduce complexity and cost significantly compared to angulation or purely time based lateration systems.
Location Patterning Positioning Algorithms:
deterministic – attempt to find minimum statistical signal distance between a detected RSSI location vector and the location vectors of the various calibration sample points
probabilistic – use probability inferences to determine the likelihood of a particular location given that a particular location vector array has already been detected.
other techniques – neural networks, support vector modeling outside boundaries of deterministic and probabilistic approaches.
It is not possible to use calibration data in more than one area of a building. Despite any similarities, the probability that the location vectors collected at the same positions on each floor being identical is significantly low. *Cisco RF fingerprinting can share RF calibration models
Active logistics shipping & receiving area:
Accuracy degradation of 20% can reasonably be expected in a 30 day period
It is not unreasonable to expect to re-verify calibration data accuracy quarterly and to plan for a complete recalibration semi-annually.
Client probing
Unassociated clients generate probe requests quite regularly. Associated clients scan less often and may active scan or passive scan, or a mix of the two. Passive scanning does little to improve location fidelity.
CCXv2 clients support S36 Radio Measurement Requests and will perform active scanning and probe all configured SSIDs on command.
CCX Location Measurement in WLC can be adjusted from 60 seconds (default) to 32,400 seconds
WCS WLAN clients – first 250 are displayed, to view location data of those beyond the first 250, client filtering must be enabled
Off-channel scans occur for ~500ms out of every 180 seconds of operation.
- or ~50ms per non-primary channel per 180 second interval
APs configured as WGB do not respond to broadcast Radio Measurement Requests. use IOS CLI command mobile station period
- this command causes the WGB to perform an active scan when it detects low AP RSSI, excessive interference or a high % of frame loss
Tag batter state info can be pushed via asynchronous NB notifications from the location appliance (MSE), tag telemetry is made available to location clients only via the SOAP/XML API
Location appliance/MSE disk space command:
df –H
The dual on-board Ethernet controllers on the location appliance (MSE) are NOT intended for redundant/simultaneous connections to the same IP network. This configuration is not recommended at this time
#/etc/init.d/loc serverd stop
#shutdown –h now
The remote SSH session will be terminated before power down will be visible. Wait 2 minutes after disconnect before powering off the location appliance/MSE
Insufficient inter-Access Point distance can expose the system to short range antenna pattern anomalies, which may also be non-conducive to good location accuracy.
distances of 40~70ft between each AP is best, they should be spaced greater than 28ft apart
7921g, -67dBm, 20% overlap, 25dB SNR = 24 ft cell size
Inter-Access Point spacing = 33 ft
APs that are placed into the design solely for location purposes should not be included in either RRM TX PWR CTRL or coverage hole remediation processes. Configure a static channel/power to remove them from the RRM process.
WLC config checklist
[notes]
Set QoS to platinum
enable WMM to enable QoS & ability to use U-APSD
disable DHCP address assignment requested
ensure Aggressive Load Balancing is disabled
Settings>Status>Site Survey (from phone menu)
When not in a call the phone only scans other non associated channels once the current signal strength reaches a certain threshold. To see all APs, place a call to a wired IP phone
Coverage statistics can be viewed by telnetting to the 7921 phone
Vocera
DHCP server cannot be run on the Vocera server
- devices may get duplicate IP addresses
- devices may not get IP addresses
- devices may get invalid, unusable information
- no DHCP option 150 is needed
Badge broadcast is sent by the badge at DSCP EF, when the multicast comes back to the group from the WLC, it is marked as “best effort”
Set QoS to platinum
enable WMM to enable QoS & ability to use U-APSD
disable DHCP address assignment requested
ensure Aggressive Load Balancing is disabled
Settings>Status>Site Survey (from phone menu)
When not in a call the phone only scans other non associated channels once the current signal strength reaches a certain threshold. To see all APs, place a call to a wired IP phone
Coverage statistics can be viewed by telnetting to the 7921 phone
Vocera
DHCP server cannot be run on the Vocera server
- devices may get duplicate IP addresses
- devices may not get IP addresses
- devices may get invalid, unusable information
- no DHCP option 150 is needed
Badge broadcast is sent by the badge at DSCP EF, when the multicast comes back to the group from the WLC, it is marked as “best effort”
792X and Client Roaming
[notes]
Client roaming – values are communicated to CCX compliant clients. may be a little low for a VoWLAN deployment, as VoWLAN cell sizes are usually smaller.
Voice call admission control – default value for Max Bandwidh = 75%
For best performance, the most accurate assessment of call capacity; Load Based AC should be enabled.
Max RF Reservation should not be greater than 60% - set at 40-60%
Troubleshooting – WCS is best place to start
DHCP option 150 = TFTP server for phone firmware
To reset the phone to factory defaults = **2
To unlock the phone configuration = **#
7921s do not support WPA2 with TKIP
7921s support WPA2 with AES, but CCKM is not supported
ACS must be configured to explicitly support EAP-FAST authentication. 7921g supports only the automatic provisioning of the PAC, so Anonymous In-Band PAC Provisioning must be enabled.
If a 7921 phone has both radios enabled:
- if default AUTO-RSSI is enabled, the phone will associate to the strongest RSSI on bootup
- if auto b/g or auto a is enabled, the phone will connect to auto setting and will fall back to non specified frequencies if the specified frequency is unavailable. If the phone has associated to an AP on a particular band, it will only scan for & roam to APs on the same frequency band.
Client roaming – values are communicated to CCX compliant clients. may be a little low for a VoWLAN deployment, as VoWLAN cell sizes are usually smaller.
Voice call admission control – default value for Max Bandwidh = 75%
For best performance, the most accurate assessment of call capacity; Load Based AC should be enabled.
Max RF Reservation should not be greater than 60% - set at 40-60%
Troubleshooting – WCS is best place to start
DHCP option 150 = TFTP server for phone firmware
To reset the phone to factory defaults = **2
To unlock the phone configuration = **#
7921s do not support WPA2 with TKIP
7921s support WPA2 with AES, but CCKM is not supported
ACS must be configured to explicitly support EAP-FAST authentication. 7921g supports only the automatic provisioning of the PAC, so Anonymous In-Band PAC Provisioning must be enabled.
If a 7921 phone has both radios enabled:
- if default AUTO-RSSI is enabled, the phone will associate to the strongest RSSI on bootup
- if auto b/g or auto a is enabled, the phone will connect to auto setting and will fall back to non specified frequencies if the specified frequency is unavailable. If the phone has associated to an AP on a particular band, it will only scan for & roam to APs on the same frequency band.
Device Mobility
[notes]
Device mobility info – configures IP subnets and associates device pools to the IP subnets
Device mobility group – defines a logical group of sites with similar dialing patterns
Physical Location – geographically located device pools
Roaming Sensitive Settings – override the device level settings when a device is roaming within or outside a device mobility group
Device Mobility Related settings – will override the device level settings only when the device is roaming within a device mobility group
DTIM settings are global, not to be changed on a per WLAN basis.
RRM baseline level changed from -65dbm to -70dbm in 4.1.185 code
If RF-Group mode is disabled, the WLCs run computations based only on the neighbor data gathered from the APs connected to that WLC via LWAPP, trying to optimize the signal to -70dbm between APs.
Within an AP-group, there may be APs that do not see each other. These APs form a logical RF sub-group whose RF parameters are calculated separately.
The RF Group leader uses the gathered values to determine whether another channel schema will result in an improvement of at least 5db SNR for the worst performing AP.
Preference is given to APs based on utilization. A less used neighbor has a higher likelihood of having its channel changed
show AP auto-RF IEEE {802.11a|802.11b} [AP-name]
Transmit power level assignment is controlled by the TPC algorithm that is run at fixed intervals of every 10 minutes by default.
TPC tries to adjust levels downward
There is a 6db hysteresis used built into the TPC algorithm to prevent it from continuously hunting for the -70dbm value.
Monitor intervals determine how often the APs stop serving clients to perform RRM & wireless duties.
Device mobility group – defines a logical group of sites with similar dialing patterns
Physical Location – geographically located device pools
Roaming Sensitive Settings – override the device level settings when a device is roaming within or outside a device mobility group
Device Mobility Related settings – will override the device level settings only when the device is roaming within a device mobility group
DTIM settings are global, not to be changed on a per WLAN basis.
RRM baseline level changed from -65dbm to -70dbm in 4.1.185 code
If RF-Group mode is disabled, the WLCs run computations based only on the neighbor data gathered from the APs connected to that WLC via LWAPP, trying to optimize the signal to -70dbm between APs.
Within an AP-group, there may be APs that do not see each other. These APs form a logical RF sub-group whose RF parameters are calculated separately.
The RF Group leader uses the gathered values to determine whether another channel schema will result in an improvement of at least 5db SNR for the worst performing AP.
Preference is given to APs based on utilization. A less used neighbor has a higher likelihood of having its channel changed
show AP auto-RF IEEE {802.11a|802.11b} [AP-name]
Transmit power level assignment is controlled by the TPC algorithm that is run at fixed intervals of every 10 minutes by default.
TPC tries to adjust levels downward
There is a 6db hysteresis used built into the TPC algorithm to prevent it from continuously hunting for the -70dbm value.
Monitor intervals determine how often the APs stop serving clients to perform RRM & wireless duties.
Saturday, November 14, 2009
VoWLAN Design Guide 4.1
[notes]
VoWLAN Design Guide 4.1
U-APSD – the primary benefit is that it allows the voice client to synchronize the transmit and receive of voice frames with the AP, thereby allowing the client to go into power-save mode between the transmit and receive of each voice frame tuple.
The use of U-APSD allows the use of long DTIM intervals to maximize standby time without sacrificing call quality (also increases call capacity)
Client in power save detects data waiting for it at the AP via the presence of a TIM in the AP beacon. The client PS-polls the AP to get the data
There are two major problems with this:
1. Requiring PS-polls on top of the normal data exchange to go through the standard access delays associated with DCF.
2. Retrieving the buffered data is dependent on the DTIM, which is a multiple of the beacon interval. Standard beacon intervals are 100ms, DTIM intervals can be integer multiples of this.
The AP sends data to the client as a TXOP burst where only the first frame has the EDCF access delay.
- timing of the polling is controlled via the client. Jitter introduced is symmetric rather than N x 100ms
TSpec allows an 802.11e client to signal its traffic requirements to the AP. It can also be used to control the use of various ACs in EDCF. The use of EDCF ACs rather than HCCA to meet TSpec requests is possible in many cases because the traffic parameters are sufficiently simple to allow them to be met by allocating capacity rather than creating a specific TXOP to meet the application requirements.
QoS Basis Service Set (QBSS) is an IE element advertised by the Cisco AP. The load field indicates the portion of available bandwidth currently used to transmit data on the AP.
1 octet 1 octet 4 bytes
ELEMENT ID (11) LENGTH LOAD
There are three QBSS IEs that need to be supported in certain situations
The QBSS used depends on the WMM & 7920 phone settings on the WLAN.
Client CAC limit – supports legacy 7920 code pre v2.01
AP CAC limit -7920 settings are learned from the WLAN advertisement
Enabling admission control determines how much AP bandwidth will be set aside for voice clients attempting to roam to the AP. This is based on the APs capacity, not factoring in the possible channel loading impact of other APs in the area. Load Based ac uses channel load in capacity calculations.
TSpec admission control is used to protect high priority resources, not to deny clients access to the WLAN.
L2 LWAPP does not effectively support QoS because the AP does not send the 802.1p/q tags and in L2 LWAPP there is not an outer DSCP on which to fall back because the AP no longer uses NULL VLAN ID
- APs carry out EDCF-like queuing on radio egress
- APs do FIFO on the Ethernet egress
Call capacity assuming no competing high priority WLAN traffic & normal background noise:
- 14 simultaneous call son 2.4ghz
- 20 simultaneous call son 5ghz
WLAN QoS is performed AFTER the CCA.
Standard office environment – AP client RADIUS of 43 feet, co-channel interference RADIUS of 150 feet using 2db gain antennas and a power output of 16dbm (40mw)
VoWLAN & 5ghz – generally recommended to use the lower 4 channels & upper 4 channels. These channels do not require the use of DFS or TPC.
UNII-1: 36, 40, 44, 48
UNII-2: 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
UNII-3: 149, 153, 157, 161
show {IEEE 802.11a | IEEE 802.11bg} L2 roam RF-params
show {IEEE 802.11a | IEEE 802.11bg} L2 roam statistics [AP-MAC]
show client roam-history [client-MAC]
EIGRP – two main route summarization ways in campus test architecture = route summarization & stub
reduce EIGRP hello/dead timers to 1 & 3 seconds (hello = 1 & dead = 3) rather than the default timers of 5 & 15
QoS policing – check on classification using port trust state & policy maps being mutually exclusive in 2970, 3560, and 3750s
Deployment models for Cisco Unified Communication Manager
number of call processing agent clusters
number of IP phones
location of the call processing clusters & IP phones
For voice traffic, it is better to deny network access under congestion conditions that to allow traffic to be dropped or delayed.
QoS protects voice from being overrun by data
CAC protects voice from voice
CAC topology unaware – based on static configuration
CAC topology aware – based on communication between call processing agent & the network about available resources – uses Resource Reservation Protocol (RSVP)
VoWLAN Design Guide 4.1
U-APSD – the primary benefit is that it allows the voice client to synchronize the transmit and receive of voice frames with the AP, thereby allowing the client to go into power-save mode between the transmit and receive of each voice frame tuple.
The use of U-APSD allows the use of long DTIM intervals to maximize standby time without sacrificing call quality (also increases call capacity)
Client in power save detects data waiting for it at the AP via the presence of a TIM in the AP beacon. The client PS-polls the AP to get the data
There are two major problems with this:
1. Requiring PS-polls on top of the normal data exchange to go through the standard access delays associated with DCF.
2. Retrieving the buffered data is dependent on the DTIM, which is a multiple of the beacon interval. Standard beacon intervals are 100ms, DTIM intervals can be integer multiples of this.
The AP sends data to the client as a TXOP burst where only the first frame has the EDCF access delay.
- timing of the polling is controlled via the client. Jitter introduced is symmetric rather than N x 100ms
TSpec allows an 802.11e client to signal its traffic requirements to the AP. It can also be used to control the use of various ACs in EDCF. The use of EDCF ACs rather than HCCA to meet TSpec requests is possible in many cases because the traffic parameters are sufficiently simple to allow them to be met by allocating capacity rather than creating a specific TXOP to meet the application requirements.
QoS Basis Service Set (QBSS) is an IE element advertised by the Cisco AP. The load field indicates the portion of available bandwidth currently used to transmit data on the AP.
1 octet 1 octet 4 bytes
ELEMENT ID (11) LENGTH LOAD
There are three QBSS IEs that need to be supported in certain situations
- Old QBSS (draft 6 pre-standard)
- New QBSS (draft 13 IEEE 802.11e (standard))
- New distributed cac load IE (a Cisco IE)
The QBSS used depends on the WMM & 7920 phone settings on the WLAN.
Client CAC limit – supports legacy 7920 code pre v2.01
AP CAC limit -7920 settings are learned from the WLAN advertisement
Enabling admission control determines how much AP bandwidth will be set aside for voice clients attempting to roam to the AP. This is based on the APs capacity, not factoring in the possible channel loading impact of other APs in the area. Load Based ac uses channel load in capacity calculations.
TSpec admission control is used to protect high priority resources, not to deny clients access to the WLAN.
L2 LWAPP does not effectively support QoS because the AP does not send the 802.1p/q tags and in L2 LWAPP there is not an outer DSCP on which to fall back because the AP no longer uses NULL VLAN ID
- APs carry out EDCF-like queuing on radio egress
- APs do FIFO on the Ethernet egress
Call capacity assuming no competing high priority WLAN traffic & normal background noise:
- 14 simultaneous call son 2.4ghz
- 20 simultaneous call son 5ghz
WLAN QoS is performed AFTER the CCA.
Standard office environment – AP client RADIUS of 43 feet, co-channel interference RADIUS of 150 feet using 2db gain antennas and a power output of 16dbm (40mw)
VoWLAN & 5ghz – generally recommended to use the lower 4 channels & upper 4 channels. These channels do not require the use of DFS or TPC.
UNII-1: 36, 40, 44, 48
UNII-2: 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
UNII-3: 149, 153, 157, 161
show {IEEE 802.11a | IEEE 802.11bg} L2 roam RF-params
show {IEEE 802.11a | IEEE 802.11bg} L2 roam statistics [AP-MAC]
show client roam-history [client-MAC]
EIGRP – two main route summarization ways in campus test architecture = route summarization & stub
reduce EIGRP hello/dead timers to 1 & 3 seconds (hello = 1 & dead = 3) rather than the default timers of 5 & 15
QoS policing – check on classification using port trust state & policy maps being mutually exclusive in 2970, 3560, and 3750s
Deployment models for Cisco Unified Communication Manager
number of call processing agent clusters
number of IP phones
location of the call processing clusters & IP phones
For voice traffic, it is better to deny network access under congestion conditions that to allow traffic to be dropped or delayed.
QoS protects voice from being overrun by data
CAC protects voice from voice
CAC topology unaware – based on static configuration
CAC topology aware – based on communication between call processing agent & the network about available resources – uses Resource Reservation Protocol (RSVP)
LBS positioning technologies & TDOA
[notes]
LBS positioning technologies:
location precision – repeatability/confidence level of successful detection 10m~90% of the time
inter-access point recommended separation 50-70ft
TDOA formula: D=C(t)
Distance in Meters = propagation speed of ~300m/microsecond (time in microseconds)
TDOA uses relative time measurements at each receiving sensor in place of absolute time measurements. It does not require a synchronized time source – the TDOA receivers require a time sync.
TDOA is rooted in hyperbolic lateration, also referred to as Enhanced Observed Time Difference
Path loss model for indoor propagation:
PL = PL1meter + 10log (dn) + s
PL = total path loss between receiver and sender in dB
PL1meter = reference path loss for desired frequency when receiver to transmitter distance is one meter
d = distance between receiver and transmitter in meters
n = path loss exponent for the environment
s = standard deviation associated with the degree of shadow fading present in the environment in dB
Pure RSS based lateration techniques that do not take additional steps to account for attenuation and multipath in the environment rarely produce acceptable results except in very controlled situations
Angle of arrival – (direction of arrival) locates the mobile station by determining the angle of incidence at which signals arrive at the receiving sensor.
Well known implementation – VOR VHF Omnidirectional Range – system used for aircraft navigation from 108.1 – 117.95 MHz
Location Patterning – may be implemented totally in software, which can reduce complexity and cost significantly compared to angulation or purely time based lateration systems.
Location Patterning Positioning Algorithms:
deterministic – attempt to find minimum statistical signal distance between a detected RSSI location vector and the location vectors of the various calibration sample points
probabilistic – use probability inferences to determine the likelihood of a particular location given that a particular location vector array has already been detected.
other techniques – neural networks, support vector modeling outside boundaries of deterministic and probabilistic approaches.
It is not possible to use calibration data in more than one area of a building. Despite any similarities, the probability that the location vectors collected at the same positions on each floor being identical is significantly low. *Cisco RF fingerprinting can share RF calibration models
Active logistics shipping & receiving area:
Accuracy degradation of 20% can reasonably be expected in a 30 day period
It is not unreasonable to expect to re-verify calibration data accuracy quarterly and to plan for a complete recalibration semi-annually.
Client probing
Unassociated clients generate probe requests quite regularly. Associated clients scan less often and may active scan or passive scan, or a mix of the two. Passive scanning does little to improve location fidelity.
CCXv2 clients support S36 Radio Measurement Requests and will perform active scanning and probe all configured SSIDs on command.
CCX Location Measurement in WLC can be adjusted from 60 seconds (default) to 32,400 seconds
WCS WLAN clients – first 250 are displayed, to view location data of those beyond the first 250, client filtering must be enabled
Off-channel scans occur for ~500ms out of every 180 seconds of operation.
- or ~50ms per non-primary channel per 180 second interval
APs configured as WGB do not respond to broadcast Radio Measurement Requests. use IOS CLI command mobile station periodthreshold
- this command causes the WGB to perform an active scan when it detects low AP RSSI, excessive interference or a high % of frame loss
Tag battery state info can be pushed via asynchronous NB notifications from the location appliance (MSE), tag telemetry is made available to location clients only via the SOAP/XML API
Location appliance/MSE disk space command:
df –H
The dual on-board Ethernet controllers on the location appliance (MSE) are NOT intended for redundant/simultaneous connections to the same IP network. This configuration is not recommended at this time
#/etc/init.d/loc serverd stop
#shutdown –h now
The remote SSH session will be terminated before power down will be visible. Wait 2 minutes after disconnect before powering off the location appliance/MSE
Insufficient inter-Access Point distance can expose the system to short range antenna pattern anomalies, which may also be non-conducive to good location accuracy.
distances of 40~70ft between each AP is best, they should be spaced greater than 28ft apart
7921g, -67dBm, 20% overlap, 25dB SNR = 24 ft cell size
Inter-Access Point spacing = 33 ft
APs that are placed into the design solely for location purposes should not be included in either RRM TX PWR CTRL or coverage hole remediation processes. Configure a static channel/power to remove them from the RRM process.
LBS positioning technologies:
- cell of origin (nearest cell)
- distance (lateration)
- angle (angulation)
- location patterning (pattern recognition)
location precision – repeatability/confidence level of successful detection 10m~90% of the time
inter-access point recommended separation 50-70ft
TDOA formula: D=C(t)
Distance in Meters = propagation speed of ~300m/microsecond (time in microseconds)
TDOA uses relative time measurements at each receiving sensor in place of absolute time measurements. It does not require a synchronized time source – the TDOA receivers require a time sync.
TDOA is rooted in hyperbolic lateration, also referred to as Enhanced Observed Time Difference
Path loss model for indoor propagation:
PL = PL1meter + 10log (dn) + s
PL = total path loss between receiver and sender in dB
PL1meter = reference path loss for desired frequency when receiver to transmitter distance is one meter
d = distance between receiver and transmitter in meters
n = path loss exponent for the environment
s = standard deviation associated with the degree of shadow fading present in the environment in dB
Pure RSS based lateration techniques that do not take additional steps to account for attenuation and multipath in the environment rarely produce acceptable results except in very controlled situations
Angle of arrival – (direction of arrival) locates the mobile station by determining the angle of incidence at which signals arrive at the receiving sensor.
Well known implementation – VOR VHF Omnidirectional Range – system used for aircraft navigation from 108.1 – 117.95 MHz
Location Patterning – may be implemented totally in software, which can reduce complexity and cost significantly compared to angulation or purely time based lateration systems.
Location Patterning Positioning Algorithms:
deterministic – attempt to find minimum statistical signal distance between a detected RSSI location vector and the location vectors of the various calibration sample points
probabilistic – use probability inferences to determine the likelihood of a particular location given that a particular location vector array has already been detected.
other techniques – neural networks, support vector modeling outside boundaries of deterministic and probabilistic approaches.
It is not possible to use calibration data in more than one area of a building. Despite any similarities, the probability that the location vectors collected at the same positions on each floor being identical is significantly low. *Cisco RF fingerprinting can share RF calibration models
Active logistics shipping & receiving area:
Accuracy degradation of 20% can reasonably be expected in a 30 day period
It is not unreasonable to expect to re-verify calibration data accuracy quarterly and to plan for a complete recalibration semi-annually.
Client probing
Unassociated clients generate probe requests quite regularly. Associated clients scan less often and may active scan or passive scan, or a mix of the two. Passive scanning does little to improve location fidelity.
CCXv2 clients support S36 Radio Measurement Requests and will perform active scanning and probe all configured SSIDs on command.
CCX Location Measurement in WLC can be adjusted from 60 seconds (default) to 32,400 seconds
WCS WLAN clients – first 250 are displayed, to view location data of those beyond the first 250, client filtering must be enabled
Off-channel scans occur for ~500ms out of every 180 seconds of operation.
- or ~50ms per non-primary channel per 180 second interval
APs configured as WGB do not respond to broadcast Radio Measurement Requests. use IOS CLI command mobile station period
- this command causes the WGB to perform an active scan when it detects low AP RSSI, excessive interference or a high % of frame loss
Tag battery state info can be pushed via asynchronous NB notifications from the location appliance (MSE), tag telemetry is made available to location clients only via the SOAP/XML API
Location appliance/MSE disk space command:
df –H
The dual on-board Ethernet controllers on the location appliance (MSE) are NOT intended for redundant/simultaneous connections to the same IP network. This configuration is not recommended at this time
#/etc/init.d/loc serverd stop
#shutdown –h now
The remote SSH session will be terminated before power down will be visible. Wait 2 minutes after disconnect before powering off the location appliance/MSE
Insufficient inter-Access Point distance can expose the system to short range antenna pattern anomalies, which may also be non-conducive to good location accuracy.
distances of 40~70ft between each AP is best, they should be spaced greater than 28ft apart
7921g, -67dBm, 20% overlap, 25dB SNR = 24 ft cell size
Inter-Access Point spacing = 33 ft
APs that are placed into the design solely for location purposes should not be included in either RRM TX PWR CTRL or coverage hole remediation processes. Configure a static channel/power to remove them from the RRM process.
Mobile IP RFC 3344
[notes]
Mobile IP RFC 3344
The Home Agent (HA) contains the location database unlike the CUWN, the HA does not maintain a distributed database between WLCs. It does not query other HA’s
The mobile IP client joining the WLAN does not provide the HA with any information. There are two methods of client notification of a roam event:
Behind a NAT gateway = UDP tunneling
Typically, the foreign WLC modifies the destination MAC address of any packet from the wireless client to be its gateway MAC before forwarding it on.
DHCP option 68 can be used to convey the HA to the MN (Mobile Node)
Mobile IP client software manipulate the host’s forwarding table so that the lower metric interface is the mobile IP client interface
Mobile IP RFC 3344
The mobile IP client joining the WLAN does not provide the HA with any information. There are two methods of client notification of a roam event:
- Win OS L2 notification: Media Sense
- Foreign Agent (FA) advertisements: the FAs are forwarded to the HA so the HA can build a new tunnel to the new FA and proceed to forward packets to the client.
Mobile IP client software manipulate the host’s forwarding table so that the lower metric interface is the mobile IP client interface
VoWLAN
[notes]
VoWLAN
Recommendation to place all antennas 1 to 2 wavelengths from highly reflective surfaces.
2.4Ghz = 4.92 inches (12.5 cm)
The human head and body attenuates 5db of RF signal
If the antenna is in the body of the phone, the loss ~ 4db – 9db
802.11A handsets do have a diversity antenna solution
DFS, 802.11h
When radar is detected:
Cisco recommends that for voice apps, the cell edge be determined by using the actual phone at the desired data rate.
Voice packets sent between the AP and the phone are generally unicast RTP G711 packets with a typical size of 236 bytes.
Cisco recommends all APs have a maximum transmission power of 13dBm.
A call between two phones associated to the same AP counts as two active voice streams.
Guest anchor WLC – can support EoIP tunnels from 40 WLCs and supports 2500 simultaneous users and has forwarding capacity of 2gbps.
Multicast is not supported over guest tunnels.
One additional port number can be monitored for redirection: network web-auth-port
VoWLAN
2.4Ghz = 4.92 inches (12.5 cm)
- 5GHz = 2.36 inches (6 cm)
The human head and body attenuates 5db of RF signal
If the antenna is in the body of the phone, the loss ~ 4db – 9db
Handsets do not have diversity antennas due to the length of the 2.4ghz wavelength distance (4.92in)
When radar is detected:
- stop packet transmission within 200ms
- stop control transmission within 10 seconds
- avoid transmitting on the channel for 30 minutes
- scan a new channel for 60 seconds before transmitting
Cisco recommends that for voice apps, the cell edge be determined by using the actual phone at the desired data rate.
Cisco recommends all APs have a maximum transmission power of 13dBm.
Guest anchor WLC – can support EoIP tunnels from 40 WLCs and supports 2500 simultaneous users and has forwarding capacity of 2gbps.
Multicast is not supported over guest tunnels.
[notes]
MESH
By default, a RAP AP uses channel 161
Background scanning on 1510s operates on the 802.11a link, for 1505s it operates on the 802.11b/g link.
config mesh background-scanning enable/disable
show mesh background-scanning
Parent AP is chosen by using the adjusted ease. This is the ease of each neighbor divided by the number of hops to the RAP.
Parents are given a 20% of bonus ease to reduce link flapping.
Routing Around an Interface (RAI)
config mesh secondary-backhaul enable
For this to work properly, all APs beyond the first hop to the one that is being used on the first hop must be on the same channel. RRM does not work with RAI
config mesh secondary-backhaul enable force same-secondary channel
This forces the whole subtree rooted at one hop MAPs to have the same secondary channel. Ignore RRM or manually assigned for MAPs at two hops and deeper.
Design constraints:
Recommended backhaul is 18Mbps
Number of backhaul hops – limit to 3 or 4
Number of MAPs/RAP – suggested limit of 20/1
Multiple RAPs for hardware diversity – deploy on same channel as primary RAP.
32 MAPs/RAP limit should be remembered.
Map density & distance
If building out a mesh to backhaul data - 1000 Ft RADIUS
Providing complete client coverage – 600 Ft RADIUS
MESH
By default, a RAP AP uses channel 161
Background scanning on 1510s operates on the 802.11a link, for 1505s it operates on the 802.11b/g link.
config mesh background-scanning enable/disable
show mesh background-scanning
Parent AP is chosen by using the adjusted ease. This is the ease of each neighbor divided by the number of hops to the RAP.
Parents are given a 20% of bonus ease to reduce link flapping.
Routing Around an Interface (RAI)
config mesh secondary-backhaul enable
For this to work properly, all APs beyond the first hop to the one that is being used on the first hop must be on the same channel. RRM does not work with RAI
config mesh secondary-backhaul enable force same-secondary channel
This forces the whole subtree rooted at one hop MAPs to have the same secondary channel. Ignore RRM or manually assigned for MAPs at two hops and deeper.
Design constraints:
Recommended backhaul is 18Mbps
Number of backhaul hops – limit to 3 or 4
Number of MAPs/RAP – suggested limit of 20/1
Multiple RAPs for hardware diversity – deploy on same channel as primary RAP.
32 MAPs/RAP limit should be remembered.
Map density & distance
If building out a mesh to backhaul data - 1000 Ft RADIUS
Providing complete client coverage – 600 Ft RADIUS
Cisco Unified Wireless QoS
[notes]
Cisco Unified Wireless QoS
fixed network delay – encoding/decoding time
variable network delay – queuing/congestion
Radio downstream is most common deployment.
Radio client upstream QoS depends on client implementation.
When providing only radio downstream QoS from the AP, radio upstream client traffic is treated as best effort.
Data frames in 802.11 are sent using distributed coordination function (DCF)
interframe spaces – (SIFS, PIFS, DIFS)
random backoff (contention window) DCF is used in 802.11 networks to manage access to the medium.
Interframe spaces (base timing in 802.11b listed below – 802.11a/g are different)
SIFS = 10us
(PCF) PIFS = SIFS +1 x slot time = 30us
(DCF) DIFS = 50us + 2 x slot time = 50us
Random backoff
When a data frame using DCF is ready to be sent it goes through the following steps:
1. generates a random backoff number between 0 and a minimum contention window (CWmin)
2. waits until the channel is free for a DIFS interval
3. if the channel is still free, begins to decrement the random backoff number for every slot time (20us) that the channel remains free.
4. if the channel becomes busy, the decrement stops & steps 2 – 4 are repeated
5. if the channel remains free until the random backoff reaches zero, the frame can be sent.
Contention window is defined by aCWmin & aCWmax
The random number is between zero and aCWmin
If the initial random backoff expires without successfully sending the frame, the STA or AP increments the retry counter & doubles the value random backoff window size. The doubling continues in size until the size equals aCWmax. The retries continue until the max retries or TTL is reached.
This process is referred to as binary exponential backoff
WMM is primarily the implementation of the EDCA component of 802.11e
WMM uses the 802.11p classification scheme developed by the IEEE (now part of the 802.11d spec)
U-APSD
A U-APSD client remains listening to the AP until it receives a frame from the AP with an end of service period (EOSP) bit set. This bit tells the client it can now go back into power save mode. The use of U-APSD allows the use of long DTIM intervals to maximize standby time without sacrificing call quality.
TSpec admission control – allows an 802.11e client to signal its traffic requirements to the AP. a TSpec request can be used to control the use of the various access categories in EDCA.
- 7920 does not support TSpec
- 7921G does support TSpec
Add Traffic Stream (ADDTS) – it’s how a WLAN client performs an admission request to an AP. Signaling it’s TSpec request, an admission request is in one of two forms:
ADDTS action frame – when a phone call is originated or terminated by a client associated to the AP
Association & Re-association message – the association message might contain one or more TSpecs & one TSRS (traffic stream rate set) IE if the STA wants to establish the traffic stream as part of the association.
WAN QoS & H-REAP – for locally switched WLANs with WMM traffic, the AP marks the dot1p value in the dot1q VLAN tag for upstream traffic. This occurs only on tagged VLANs; not on native VLANs.
With multicast enabled, any kind of multicast packet received on the VLAN from the first hop router is transmitted over the wireless including HSRP hellos, all router, EIGRP, and PIM multicast packets.
AP sends heartbeat messages to the WLC once every 30 seconds. If one response is missed, the AP sends 5 successive heartbeats (one per second) to determine whether connectivity still exists.
Up to 8 H-REAP APs needs at least 128kbps. PKC capable clients that roam between H-REAP APs undergo full 802.1x authentication.
If a WLAN is configured for IPSEC, CRANITE or FORTRESS, that WLAN cannot be configured for local switching on an H-REAP AP.
If dynamic DHCP is used, establish more aggressive NAT translation entry timeouts for ports 12222 & 12223 to 20-25 seconds.
Cisco Unified Wireless QoS
fixed network delay – encoding/decoding time
variable network delay – queuing/congestion
Radio downstream is most common deployment.
Radio client upstream QoS depends on client implementation.
When providing only radio downstream QoS from the AP, radio upstream client traffic is treated as best effort.
Data frames in 802.11 are sent using distributed coordination function (DCF)
interframe spaces – (SIFS, PIFS, DIFS)
random backoff (contention window) DCF is used in 802.11 networks to manage access to the medium.
Interframe spaces (base timing in 802.11b listed below – 802.11a/g are different)
SIFS = 10us
(PCF) PIFS = SIFS +1 x slot time = 30us
(DCF) DIFS = 50us + 2 x slot time = 50us
Random backoff
When a data frame using DCF is ready to be sent it goes through the following steps:
1. generates a random backoff number between 0 and a minimum contention window (CWmin)
2. waits until the channel is free for a DIFS interval
3. if the channel is still free, begins to decrement the random backoff number for every slot time (20us) that the channel remains free.
4. if the channel becomes busy, the decrement stops & steps 2 – 4 are repeated
5. if the channel remains free until the random backoff reaches zero, the frame can be sent.
Contention window is defined by aCWmin & aCWmax
The random number is between zero and aCWmin
If the initial random backoff expires without successfully sending the frame, the STA or AP increments the retry counter & doubles the value random backoff window size. The doubling continues in size until the size equals aCWmax. The retries continue until the max retries or TTL is reached.
This process is referred to as binary exponential backoff
WMM is primarily the implementation of the EDCA component of 802.11e
WMM uses the 802.11p classification scheme developed by the IEEE (now part of the 802.11d spec)
U-APSD
A U-APSD client remains listening to the AP until it receives a frame from the AP with an end of service period (EOSP) bit set. This bit tells the client it can now go back into power save mode. The use of U-APSD allows the use of long DTIM intervals to maximize standby time without sacrificing call quality.
TSpec admission control – allows an 802.11e client to signal its traffic requirements to the AP. a TSpec request can be used to control the use of the various access categories in EDCA.
- 7920 does not support TSpec
- 7921G does support TSpec
Add Traffic Stream (ADDTS) – it’s how a WLAN client performs an admission request to an AP. Signaling it’s TSpec request, an admission request is in one of two forms:
ADDTS action frame – when a phone call is originated or terminated by a client associated to the AP
Association & Re-association message – the association message might contain one or more TSpecs & one TSRS (traffic stream rate set) IE if the STA wants to establish the traffic stream as part of the association.
WAN QoS & H-REAP – for locally switched WLANs with WMM traffic, the AP marks the dot1p value in the dot1q VLAN tag for upstream traffic. This occurs only on tagged VLANs; not on native VLANs.
With multicast enabled, any kind of multicast packet received on the VLAN from the first hop router is transmitted over the wireless including HSRP hellos, all router, EIGRP, and PIM multicast packets.
AP sends heartbeat messages to the WLC once every 30 seconds. If one response is missed, the AP sends 5 successive heartbeats (one per second) to determine whether connectivity still exists.
Up to 8 H-REAP APs needs at least 128kbps. PKC capable clients that roam between H-REAP APs undergo full 802.1x authentication.
If a WLAN is configured for IPSEC, CRANITE or FORTRESS, that WLAN cannot be configured for local switching on an H-REAP AP.
If dynamic DHCP is used, establish more aggressive NAT translation entry timeouts for ports 12222 & 12223 to 20-25 seconds.
ISRs CISF DSCP & dynamic ARP
[notes]
The only WLC that does not map WLAN traffic directly to a physical/logical interface at Layer 2 are ISR based WLC modules
ISRs do not have access to all the IOS & IPS features. IP traffic from the WLAN clients must be directed in and out of specific ISR service module interfaces using IOS VRF features on the router.
CISF is currently only available on the access switch – benefits obtained only if the traffic from the wireless attacker goes through the switch.
The primary difference between an LAP & a standard client is that the DSCP value of a LAP should be trusted.
Port security – if response is shutdown, port goes into err-disable. If response is restrict, traffic with unknown source MAC addresses is dropped
- not recommended on H-REAP AP ports or WLC
Dynamic ARP inspection – DAI is enabled on the access switch on a per-VLAN basis. This prevents ARP poisoning that may lead to MIM attacks. When DAI is configured on a VLAN, and ARP rate limiter is configured globally to prevent flooding of ARP requests coming from a certain port. The default value is 15 packets/sec. When the limit is reached, the port is disabled.
Turn off ARP rate limiter on AP switchports
IP ARP inspection limit none
IP source guard - when enabled on an interface of the access switch, IP source guard dynamically creates a per port access list (PACL) based on the contents of the DHCP snooping binding table. There is an option (port security) to filter the incoming address, also using the MAC address in the DHCP snooping binding table.
The only WLC that does not map WLAN traffic directly to a physical/logical interface at Layer 2 are ISR based WLC modules
ISRs do not have access to all the IOS & IPS features. IP traffic from the WLAN clients must be directed in and out of specific ISR service module interfaces using IOS VRF features on the router.
CISF is currently only available on the access switch – benefits obtained only if the traffic from the wireless attacker goes through the switch.
The primary difference between an LAP & a standard client is that the DSCP value of a LAP should be trusted.
Port security – if response is shutdown, port goes into err-disable. If response is restrict, traffic with unknown source MAC addresses is dropped
- not recommended on H-REAP AP ports or WLC
Dynamic ARP inspection – DAI is enabled on the access switch on a per-VLAN basis. This prevents ARP poisoning that may lead to MIM attacks. When DAI is configured on a VLAN, and ARP rate limiter is configured globally to prevent flooding of ARP requests coming from a certain port. The default value is 15 packets/sec. When the limit is reached, the port is disabled.
Turn off ARP rate limiter on AP switchports
IP ARP inspection limit none
IP source guard - when enabled on an interface of the access switch, IP source guard dynamically creates a per port access list (PACL) based on the contents of the DHCP snooping binding table. There is an option (port security) to filter the incoming address, also using the MAC address in the DHCP snooping binding table.
DHCP ARP Rogue Detection and MFPs
[notes]
DHCP & ARP protection
When a WLC is a DHCP relay, it checks that the MAC included in the DHCP request matches the MAC of the WLAN client sending the request. The WLC does not forward DHCP requests back out the WLAN, this prevents a WLAN client from acting as a DHCP server.
WLCs do not allow direct ARP communication between WLAN clients.
AIR/RF detection
When searching for a rogue AP, a LAP goes off channel for 50ms to listen for rogue clients and to monitor for noise & channel interference.
Rogue detector – radio is OFF, its role is to listen on the wired network for MAC addresses of clients associated to rogue APs. It listens for ARP packets that include these macs.
-should be connected to all available broadcast domains using a switched port analyzer (SPAN)
MFP- the MIC used in MFP is not a simple crc hashing of the message – it also includes a digital signature component. This component is shared among mobility groups.
DHCP & ARP protection
When a WLC is a DHCP relay, it checks that the MAC included in the DHCP request matches the MAC of the WLAN client sending the request. The WLC does not forward DHCP requests back out the WLAN, this prevents a WLAN client from acting as a DHCP server.
WLCs do not allow direct ARP communication between WLAN clients.
AIR/RF detection
When searching for a rogue AP, a LAP goes off channel for 50ms to listen for rogue clients and to monitor for noise & channel interference.
Rogue detector – radio is OFF, its role is to listen on the wired network for MAC addresses of clients associated to rogue APs. It listens for ARP packets that include these macs.
-should be connected to all available broadcast domains using a switched port analyzer (SPAN)
MFP- the MIC used in MFP is not a simple crc hashing of the message – it also includes a digital signature component. This component is shared among mobility groups.
Encryption Types
[notes]
TKIP is the encryption method certified as WPA
two primary functions of TKIP are the generation of a per packet key using RC4 encryption of the MAC service data unit (MSDU) & a MIC in the encrypted packet. The IV changes with each frame transmission, and is susceptible to an active attack.
AES counter mode/CBC MAC protocol (CCMP)
Additional authentication data (AAD) is taken from the MAC header & included in the CCM encryption process. To protect against replay attacks a sequenced (PN) packet number is included in the CCMP header. The PN & portions of the MAC header are used to generate a nonce that is in turn used by the CCM encryption process.
PKC – proactive key caching & CCM
- an 802.11i extension that allows for the proactive caching (before a roam event) of the PMK that is derived during a client 802.1x/EAP authentication at the AP.
CCKM – implementation is different than PKC, two mechanisms are incompatible.
show pmk-cache all
802.11r workgroup is responsible for the standardization of an FSR mechanism for 802.11
TKIP is the encryption method certified as WPA
two primary functions of TKIP are the generation of a per packet key using RC4 encryption of the MAC service data unit (MSDU) & a MIC in the encrypted packet. The IV changes with each frame transmission, and is susceptible to an active attack.
AES counter mode/CBC MAC protocol (CCMP)
Additional authentication data (AAD) is taken from the MAC header & included in the CCM encryption process. To protect against replay attacks a sequenced (PN) packet number is included in the CCMP header. The PN & portions of the MAC header are used to generate a nonce that is in turn used by the CCM encryption process.
PKC – proactive key caching & CCM
- an 802.11i extension that allows for the proactive caching (before a roam event) of the PMK that is derived during a client 802.1x/EAP authentication at the AP.
CCKM – implementation is different than PKC, two mechanisms are incompatible.
show pmk-cache all
802.11r workgroup is responsible for the standardization of an FSR mechanism for 802.11