EAP request -sent by the authenticator to supplicant
The type field is used to indicate what is requested
The sequence number is used to allow authenticator and peer to match the response to the request. EAP response - sent by supplicant to the authenticator The sequence number is used to match EAP request, except if the response is a negative acknowledgement (NAK) EAP success - sent from authenticator to supplicant
Sent when successful authentication has occurred. EAP failure - sent from authenticator to supplicant
Sent when unsuccessful authentication has occurred.
EAP Supplicants
PEAP MSCHAPv2 - uses TLS tunnel to protect an encapsulated MSCHAPv2 exchange between WLAN clients and the authentication server.
PEAP GTC - uses a TLS tunnel to protect a generic token card exchange (one time password or LDAP authentication)
EAP FAST - uses a tunnel similar to PEAP, but does not require the use of a PKI infrastructure.
EAP TLS - uses PKI to authenticate the WLAN network to the WLAN client, requiring a client certificate and an authentication server certificate
[notes] Data rate set to mandatory - allows transmission for all packets, unicast & multicast. If more than one data rate is set to mandatory - multicast/broadcast are sent at the highest common mandatory rate of all associated clients.
Data rate set to supported - allows transmissions at this rate for unicast packets only.
The transmit power control (TPC) and dynamic frequency management performed by RRM are not the TPC & DFS required for operation in the UNII-2 bands that are defined in 802.11h
WLC code version 4.815 introduced a significant number of enhancements to RRM.
Auto RF: In each RF group, a leader is chosen. The leader collects network wide neighbor information from a group of controllers and the leader does the channel/power computation for an optimal system wide map.
AP's transmit RRm neighbor packets at full power at regular intervals. These messages contrain a field that is a has of the RF group name, BSSID and time stamp. Once packets are validated to have the same RF group name as the receiving AP, the information is forwarded to the WLC with the LWAPP packet status field containing the SNR & RSSI of the received neighbor packet.
TPC performs only downward power level adjustments. Coverage hole detection and correctionincreases power levels.
When the average SNR of a single client dips below the SNR threshold for at least 60 seconds, this is seen as an indication that the WLAN client does not have a viable location to which to roam.
Client load balancing is done at the client association, not when a client is connected.
Rogue detection scanning happens off channel for a period not greater than 60ms to listen to other channels. Packet headers are forwarded to the WLC for analysis. On average, this is 0.2% of the AP's time.
[notes] Client power should be adjusted to match the AP power settings. Maintaining a higher setting on the client does not result in higher performance and it can cause interference in nearby cells.
Antennas give the WLAN three fundamental properties: gain direction polarization
Best Practices: Number of users per AP 15-25 (data only) 7-8 (voice) limit data rates
Changes to the channel topology causes clients to reassociate, and calls to drop. Change sin AP power do not impact client connectivity.
Range is generally affected by a factor of a 30% increase (approximately) for every halving of a data rate.
[notes] dB - attenuation/amplification of the power level - expressed as the base 10 logarithm of the ratio of the power of two signals, as shown here:
dB = 10 x Log10 (P1/P2)
dBi - power gain rating of antennas dBm - uses same calculations as dB, but has a reference value of 1mW. Can also describe receiver sensitivity in -dBm.
Data networks: AP separation of 120-130 feet Voice networks: cell edge at -67dBm, 2 non overlapping APs at an RSSI +35 baseline power of 35-50mw requires 15% more APs than a 100mW deployment
APs have an aggregate throughput less than the data rate because the 802.11 provides a reliable transport mechanism that ACKs all packets, thereby halving the throughput on the channel.
[notes] Higher frequencies exhibit less range and are subject to greater attenuation from solid objects. 2.4Ghz
FCC = 11 channels
ETSI = 13 channels
TELEC = 14 channels (special licensing needed for Channel 14)
DSSS encodes redundant information into the RF signal chipping sequence = 11 chips per bit.
Binary Phase Shifting Keying/Quadrature Phase-Shift Keying (BPSK/QPSK) @ 1Mb/2Mb
8 chips at the 11 & 5.5MBs data rate.
At 11Mbps, 8 bits are transmitted for every one bit of data.
The chipping sequence is transmitted in parallel across the spread spectrum frequency range.
[notes] L2 LWAPP tunnel uses Ethertype 0xBBBB to encapsulate traffic between the AP and WLC. L2 LWAPP does not provide corresponding CoS marking for Ethertype frames and is not able to provide transparent end-to-end QoS.
LWAPP control packet originates from UDP source port 12223 Control type 12 is the configuration command to a LWAPP AP by a WLC
AP groups do not allow multicast roaming across group boundaries.
RF group leaders exchange RRM messages every 600 seconds by default. Maximum number of WLCs per RF group = 20
Mobility Tunneling - If uRPF checks are enabled on the next-hop routed interface, traffic is dropped after the client roams to a different subnet.
The benefit of DHCPProxy is realized during an L3 client roam, or when a client roams across an AP group boundary. In these cases, the WLC will receive a DHCP renewal erquest upon which it will verify the client is roaming within the mobilty group and allow the client to renew (keep) its IP address/subnet assignment even though the client roamed to a new subnet on a foreign WLC.
DHCP Proxy is required with asymmetric mobility tunneling.
ARP The default behavior of the WLC is to respond to ARP queries directly based on its local ARP cache. The WLC CLI command network arpunicast enable can be used to override this behavior. The purpose of this command is to avoid excessive retries by IP clients looking for a WLAN client that may have roamed from the WLAN network.
Broadcast & Multicast traffic When enabled - is a global setting -disable CDP on interfaces connecting to WLCs -port filter incoming CDP and HSRP traffic on VLANs connecting to the WLCs -multicast security including link layer multicast security must be considered
Centralizing WLCs The distributed deployment model is not recommended because of current shortcomings with multicast support associated with L3 roaming.
Average LWAPP control traffic planes on the network is approximately .35kb/sec The overhead introduced by tunneling (L3) adds 44 bytes to a typical IP packet to/from a WLAN client. Average packet size = 300 bytes. This is a 15% overhead increase.
Additionally, Cisco recommends that Catalyst Integrated Security Features (CISF) be enabled on the LWAPP AP switchports to provide additional protection to the WLAN infrastructure.
APs in the same physical location should be joined to the same WLC. All APs without primary, secondary or tertiary WLC definitions will join a WLC configured for master controller mode.
Firmware changes -Migrate APs to secondary WLC, upgrade primary WLC and then migrate APs back in a controlled manner. AP failback should be disabled to ensure APs return to their primary WLC in a controlled manner.
[notes] Two seperate solutions - VLAN translation and Auto Anchor mode
Single Controller/VLAN translation mode Access switch trunks wired guest traffic in the guest VLAN to the WLC providing the guest access solution. This WLC carries out the VLAN translation form the ingress wired guest VLAN to the egress VLAN
Two WLCs/Auto Anchor Mode The access switch trunks wired guest traffic to a local WLC nearest the access switch. This local WLC anchors the client onto a DMZ anchor WLC configured for wired and wireless guest access.
5 guest LANs for wired guest access are supported security: open, web-auth, web pass through
If the EoIP tunnel between the remote and anchor WLC fails, the client database is cleaned up from the anchor WLC. The client needs to re-associate and reauthenticate.
Multicast and broadcast traffic on wired guest LANs is dropped.
