Home
Главная
D-Link
Беспроводной контроллер
DWC-1000
Руководство пользователя для ревизии A1 _версии ПО 4.3.0.x _ 4.4.0.x_ Страница: 82

D-Link DWC-1000 [82/246] Securing your network

DWC-1000 Wireless Controller User’s Guide

5. SECURING YOUR NETWORK

The wireless controller supports a number of features for securing your network. This

chapter describes the following commonly used security features:

 Managing Clients (page 83)

 Content Filtering (page 88)

For information about additional security settings not described in this chapter, see

―Additional Security Settings‖ on page 94.

Note: The procedures in this chapter should only be performed by expert users who

understand networking concepts and terminology.

Содержание

Dwc 1000 wireless controller 1
Fastfind links 1
User s guide 1
Contents 2
Preface vii 2
Product overview 11 2
Unpacking and installation 13 2
Advanced configuration settings 52 3
Basic configuration 27 3
Securing your network 82 4
Viewing status and statistics 127 4
Vpn settings 95 4
Maintenance 188 5
Appendix a basic planning worksheet 232 6
Appendix b factory default settings 235 6
Appendix c glossary 237 6
Appendix d limited lifetime warranty 239 6
Index 241 6
Troubleshooting 214 6
Preface 7
Audience 8
This guide is designed for the person who installs configures deploys and maintains the wireless controller this document assumes the reader has moderate hardware computer and internet skills 8
A version 2 9 27 2012 initial release 9
Changes in this revision 9
Document revision level 9
Dwc 1000 wireless controller user s guide 9
Dwl 2600ap access point user manual 9
Dwl 3600ap access point user manual 9
Dwl 6600ap access point user manual 9
Dwl 8600ap access point user manual 9
In addition to this guide you may find the following additional documents helpful 9
N a this is first version of this document 9
Preface 9
Related documents 9
This section provides a history of the revision changes to this document 9
Wireless controller cli reference guide dwc 1000 9
Document conventions 10
Safety and warnings 10
This guide also uses the following typographic conventions 10
This guide uses the following conventions to draw your attention to certain information 10
This guide uses the following symbols to draw your attention to certain information 10
Typographic conventions 10
Product overview 11
And optimizing network performance 12
Authentication server 12
Auto discovery of access points in l2 and l3 domains 12
Centralized management and configuration 12
Configurable management vlan 12
Dhcp server for dynamic ip address provisioning 12
Dwc 1000 wireless controller user s guide 12
Features and benefits 12
Functionality via two gigabit ethernet option ports 12
Guest access and captive portal access 12
Identity based security authentication with an external radius server or an internal 12
Maximum of 4 wireless controllers allows for up to 96 access points in a single network 12
Product overview 12
Purchased license pack dwc 1000 vpn lic enables vpn router and firewall 12
Purchased license packs dwc 1000 ap6 lic in increments of 6 access points allow for 12
Real time monitoring of access points and associated client stations 12
Rogue access point detection classification and mitigation 12
Scalable architecture with stacking and redundancy 12
Security 12
Simplified profile based configuration 12
Single point of management for the entire wireless network 12
Support of up to 24 access points on a single wireless controller 12
Supports auto failover redundancy 12
Supports for 6 access points on a single wireless controller with no additional license 12
Supports ieee 802 1a 802 1b 802 1g and 802 1n protocols 12
System alarms and statistics reports on managed access points for managing controlling 12
The dwc 1000 wireless controller is intended for campuses branch offices and small to medium businesses in a stacked configuration with the appropriate licenses a wireless controller can support up to 96 access points the wireless controller allows you to manage your wireless network from a central point implement security and qos features centrally configure a guest access captive portal and support voice over wi fi 12
Unpacking and installation 13
A personal computer pc with one of the web browsers on page 28 installed 14
A power over ethernet poe switch 14
Confirm that all items listed in the package contents section are included in the 14
D link dwl 2600ap dwl 3600ap dwl 6600ap and or dwl 8600ap access points 14
Dwc 1000 wireless controller user s guide 14
Each wireless controller package contains the following items 14
Follow these steps to unpack the wireless controller and prepare it for operation 14
One 3 foot ethernet category 5 utp straight through cable 14
One d link dwc 1000 wireless controller 14
One power cord 14
One reference cd rom containing product documentation in pdf format 14
One rj 45 to db 9 console cable 14
Open the shipping container and carefully remove the contents 14
Package contents 14
Required tools and information 14
Return all packing materials to the shipping container and save it 14
Shipment check each item for damage if any item is damaged or missing notify your authorized d link representative 14
Two rack mounting brackets 14
Unpacking 14
Unpacking and installation 14
You will need the following additional items to install your wireless controller 14
Selecting a location 15
Front panel ports and leds 16
One rj 45 console port 16
Two gigabit option ports 16
Facing the front of the wireless controller the power led is located on the far left side this led provides a visual indication of the wireless controller s power on or power off state 17
Four gigabit ethernet lan ports 17
Four gigabit ethernet ports labeled lan 1 through lan 4 let you connect ethernet devices such as computers switches and hubs each port has an activity led left and link led right see table 2 2 17
Power led 17
Table 2 2 usb leds 17
Table 2 3 power led 17
Two universal serial bus usb 2 ports are provided for connecting usb flash drives hard drives computers and printers each port has an led 17
Two usb 2 ports 17
Rear panel 18
Using the reset button 18
Bottom panel default ip address 19
Installing the wireless controller 19
Licenses 19
Rack mounting the wireless controller 19
Connecting the wireless controller 20
Connecting to a secured network 22
Sample applications 22
Authenticating to an authentication server 23
Figure 2 6 on page 22 shows an example of a network configuration that uses a wireless controller access points poe switch and a remote authentication dial in user service radius for authentication in this configuration the radius server authenticates users before they gain access to the wlan 23
In this configuration 23
Same ip address range assigned to that subnet 23
Switch the uplink of the poe switch connects to a layer 3 switch or router that provides internet access 23
The access points and wireless controller are connected in the same subnet and use the 23
The access points and wireless controller are connected to a power over ethernet poe 23
There are no routers between the access points and the wireless controller 23
There is a shared secret key exchanged between the access point and radius server 23
To configure the wireless controller for wpa or wpa wpa2 security perform the basic configuration procedure described in chapter 3 and then use the procedure below to configure the wireless controller for wpa or wpa wpa2 security 23
Types of authentication such as kerberos have other settings that must be configured 23
User and user privileges are specified in the radius database servers using other 23
Web authentication is a feature that denies a client access to the network until that client supplies a valid username and password 23
To configure the wireless controller for this configuration use the procedure below 24
Logging in to a captive portal 25
After installing the wireless controller proceed to chapter 3 to perform basic configuration procedures 26
To configure an interface for captive portal access perform the basic configuration procedure described in chapter 3 and then use the procedure below to configure an interface for captive portal access you can associate a configured captive portal with a specific physical interface or wireless network ssid 26
Where to go from here 26
Basic configuration 27
Logging in to the web management interface 28
Web management interface layout 31
Basic configuration procedures 32
Basic configuration step 1 enable dhcp server optional 33
Basic configuration step 2 select the access points to be managed 34
Click manage complete the fields in the valid ap page see table 3 2 and click save settings when the confirmation appears click ok 35
Repeat step 2 for each additional access point you want the wireless controller to manage 35
Table 3 2 fields on the valid ap page 35
Under list of aps check the first access point you want the wireless controller to manage 35
Basic configuration step 3 change the ssid name and set up security 36
Complete the fields on the networks page see table 3 3 and click save settings 37
Table 3 3 ssid and security settings 37
Table 3 4 wep page settings 38
Ap profile the ap profiles summary page appears 39
Table 3 5 wpa wpa 2 page settings 39
To add another ssid repeat steps 1 through 3 39
Basic configuration step 4 confirm access point profile is associated 42
Basic configuration step 5 configure captive portal settings 43
Add captive portal users 44
C complete the fields in table 3 6 and click save settings 44
Table 3 6 captive portal settings 44
Users the users page appears 44
C complete the fields in table 3 7 and click save settings 46
Table 3 7 captive portal user settings 46
C complete the fields see table 3 8 and click save settings the message operation 49
Succeeded appears and then the captive portal setup page appears 49
Table 3 8 fields on the customized captive portal setup page 49
D under list of available profiles click the profile and the show preview button for the 50
E when you are satisfied with the appearance of the custom portal page 50
Profile you just configured confirm that the appearance of the login page suits your requirements if not repeat steps 5c through 5e as necessary 50
Under captive portal policies click a policy and then click the enable button to enable the policy 50
Under list of available profiles click the profile and then click the enable button to enable the profile 50
Basic configuration step 6 use ssid with radius 51
Where to go from here 51
Advanced configuration settings 52
Enabling qos mode 53
Qos configuration 53
Defining dscp and cos settings 55
Enabling vlans 59
Creating vlans 60
Click save settings 61
Complete the fields in the page see table 4 1 61
Table 4 1 fields on the available vlans page 61
Editing vlans 62
Deleting vlans 64
Port vlans 65
Multivlan subnets 66
Click save settings 67
Edit the settings as desired see 67 67
Table 4 2 fields on the multi vlan subnet config page 67
Configuring a port to operate as a dmz 69
Dmz settings 69
Configuring dmz settings 70
Table 4 3 fields on the dmz setup page 71
Adding a static route 72
Static routing 72
Click save settings 73
Complete the fields in the page see table 4 4 73
Table 4 4 fields on the static route configuration page 73
Editing static routes 74
Deleting static routes 75
Auto failover settings 76
Click save settings 77
Complete the settings under option failure detection method see table 4 5 77
Table 4 5 option failure detection method fields 77
Load balancing settings 78
Additional advanced configuration settings 80
Note note asterisks in the table below indicate advanced configuration settings that require a dwc 1000 vpn lic license pack 80
The wireless controller provides more advanced configuration settings than covered in this chapter the following table describes these settings for more information go to the page in the web management interface and then access the wireless controller online help in the helpful hints area see figure 3 1 on page 32 80
Securing your network 82
Managing clients 83
Viewing known clients and adding clients 83
Click save settings 85
Complete the fields in the page see table 5 1 85
Table 5 1 fields on the known clients page 85
Editing clients 86
Deleting clients 87
Content filtering 88
Enabling content filtering 88
Specifying approved urls 89
Specifying blocked keywords 91
Exporting web filters 92
Additional security settings 94
Note note asterisks in the table below indicate settings that require a dwc 1000 vpn lic license pack 94
The wireless controller provides more security settings than those covered in this chapter the following table describes these settings for more information go to the page in the web management interface and then access the wireless controller online help in the helpful hints area see figure 3 1 on page 32 94
Vpn settings 95
Configuring vpn clients 96
Adding ipsec policies 98
Configuring ipsec policies 98
Click save settings 99
Complete the fields in the page see table 6 1 99
Table 6 1 fields on the ipsec configuration page 99
Aes 128 16 characters 104
Aes 192 24 characters 104
Aes 256 32 characters 104
Aes ccm 16 characters 104
Aes gcm 20 characters 104
Blowfish and cast128 are variable length algorithms 104
Des 24 characters 104
Des 8 characters 104
Dwc 1000 wireless controller user s guide 104
Encryption algorithm select an algorithm to encrypt the data 104
For blowfish the key length must be a value between 40 and 448 and a multiple of 8 104
For cast128 the key length must be a value between 40 and 128 and a multiple of 8 104
Integrity algorithm select the algorithm used to verify the integrity of the data choices are 104
Key in enter the encryption key of the inbound policy the length of the key depends on the algorithm chosen 104
Key in enter the integrity key for esp with integrity mode for the inbound policy the length of the key depends on the algorithm chosen 104
Key length if encryption algorithm blowfish or cast12 enter a key length 104
Key out enter the encryption key of the outbound policy the length of the key depends on the algorithm chosen as shown for key in 104
Key out enter the integrity key for esp with integrity mode for the outbound policy the length of the key depends on the algorithm chosen as shown for key in 104
Md5 16 characters 104
Sha 1 20 characters 104
Sha 224 104
Sha 256 104
Sha 384 104
Sha 512 104
Sha2 224 28 characters 104
Sha2 256 32 characters 104
Sha2 384 48 characters 104
Sha2 512 64 characters 104
Spi incoming enter a hexadecimal value from 3 and 8 characters for example 0x1234 104
Spi outgoing enter a hexadecimal value from 3 and 8 characters for example 0x1234 104
Twofish 128 16 characters 104
Twofish 192 24 characters 104
Twofish 256 32 characters 104
Vpn settings 104
Editing ipsec policies 107
Enabling ipsec policies 108
Disabling ipsec policies 109
Exporting ipsec policies 110
Deleting ipsec policies 111
Mode config settings 112
Table 6 2 fields on the ipsec mode config page 114
Dhcp range 115
Pptp lt2p tunnels 116
Pptp tunnel support 116
Click save settings 117
Configuring pptp servers 117
Table 6 4 fields on the pptp client page 117
Table 6 5 fields on the pptp server page 119
L2tp tunnel support 121
Table 6 6 fields on the l2tp server page 122
Openvpn support 124
Table 6 7 fields on the openvpn configuration page 125
Additional vpn settings 126
Client routes 126
Configured client routes 126
Dwc 1000 wireless controller user s guide 126
Enable ssl vpn server 126
Enabling this option adds transport layer security tls authentication which adds a layer of authentication tls uses public key infrastructure pki to acquire and validate digital certificates a digital certificate is a cryptographically signed structure that guarantees the association between at least one identifier and a public key it is valid for a limited time period and use subject to certificate policy conditions the certificate authority issues certificates to client and server this option can only be checked if a tls key is uploaded 126
First row set of certificates and keys the server uses 126
L2tp active users 126
Local networking split tunneling 126
Login profiles 126
Note note asterisks in the table below indicate settings that require a dwc 1000 vpn lic license pack 126
Openvpn 126
Openvpn authentication 126
Openvpn local networks split 126
Openvpn remote networks site to 126
Port forwarding 126
Portal layouts 126
Pptp active users 126
Remote networking site to site 126
Resources 126
Second row set of newly uploaded certificates and keys 126
Select the set of certificates openvpn server uses 126
Ssl vpn client 126
Ssl vpn policies 126
Ssl vpn server 126
Ssl vpn server enable 126
The wireless controller provides more vpn settings than those covered in this chapter the following table describes these settings for more information go to the page in the web management interface and then access the wireless controller online help in the helpful hints area see figure 3 1 on page 32 126
Tunneling 126
Vpn settings 126
This chapter describes the following pages which display wireless controller and access point status information and statistics 127
Viewing status and statistics 127
Viewing cpu and memory utilization 129
Table 7 1 fields on the dashboard page 130
Viewing system status 131
Figure 7 2 system status page 132
Viewing managed access point information 133
Table 7 2 fields on the wireless lan ap information page 134
Table 7 3 buttons on the wireless lan ap information page 134
Viewing cluster information 135
Table 7 4 fields on the cluster page 136
Viewing hardware and usage statistics 137
Wired port statistics 139
Figure 7 7 managed ap statistics page 140
Managed access points and associated clients statistics 140
Managed ap statistics 140
Table 7 5 fields on the managed ap statistics page 140
The managed ap statistics page shows information about traffic on the access point s wired and wireless interfaces this information can help diagnose network issues such as throughput problems 140
Table 7 6 buttons on the managed ap statistics information 141
Lan associated clients 142
Table 7 7 fields on the associated clients statistics page 143
Table 7 8 buttons on the associated clients statistics page 143
Wlan associated clients 144
Sessions through the wireless controller 145
Associated clients 146
Figure 7 11 associated clients status page 146
Status 146
Table 7 10 fields on the associated clients status page 146
The associated clients status page shows clients that are associated with the access points being managed by the wireless controller 146
Table 7 11 buttons on the associated clients status page 147
Lan clients 148
Detected clients 149
Table 7 12 fields on the detected client status page 150
Access point status 151
Table 7 13 fields on the access point page 152
Access point summary 153
Table 7 14 fields on the access points summary page 154
Table 7 15 buttons on the access points summary page 154
Managed access point 155
Table 7 16 fields on the managed ap status page 156
Table 7 17 buttons on the managed ap status page 156
Authentication failure status 157
Table 7 18 reasons for access point failures 158
Table 7 19 fields on the ap authentication failure status page 158
Ap rf scan status 159
Table 7 20 fields on the ap rf scan status page 160
Global status 161
Table 7 21 fields on the summary page 162
Table 7 22 buttons on the summary page 163
Peer controller status 164
Table 7 23 fields on the peer controller status page 165
Configuration 166
Peer controller configuration status 166
Table 7 24 fields on the peer controller configuration page 166
The peer controller configuration status page provides information about the access points that each peer controller in the cluster manages use the menu above the table to select the peer controller with the access point information to display each peer controller is identified by its ip address 166
Peer controller managed ap status 167
Table 7 25 fields on the peer controller managed ap status page 168
Ip discovery 169
Table 7 26 fields on the ip discovery page 170
Configuration receive status 171
Ap database 172
Ap profiles 172
Applying ap profile configuration 172
Captive portal 172
Channel power 172
Configuration shows which portions of configuration were last received from a peer controller possible values are 172
Current receive status global status when wireless configuration is received from a peer controller possible status values are 172
Discovery 172
Dwc 1000 wireless controller user s guide 172
Failure invalid code version 172
Failure invalid configuration 172
Failure invalid hardware version 172
Global 172
Known client 172
None wireless controller has not received any configuration for another controller 172
Not started 172
Peer controller ip address peer controller ip address of the last wireless controller from which this controller received any wireless configuration data 172
Qos acl 172
Qos diffserv 172
Radius client 172
Receiving configuration 172
Saving configuration 172
Success 172
Table 7 27 fields on the configuration receive status page 172
Timestamp shows the last time this wireless controller received any configuration data from a peer controller the peer controller managed ap status page shows information about the access points that each peer controller in the cluster manages use the drop down list at the top of this page to select a peer controller whose access point information you want to view each peer controller is identified by its ip address 172
Viewing status and statistics 172
Ap h w capability 173
Ap hardware capability 173
Table 7 28 fields on the ap hardware capability page 173
The wireless controller supports access points that have different hardware capabilities such as number of radios supported ieee 802 1 modes and software images using the ap hardware capability page you view information about the radio hardware and ieee modes supported by access points as well as software images that are available for download to the access point 173
Client status 174
Table 7 29 fields on the client statistics page 175
Associated client status 176
Status 176
Table 7 30 fields on the associated client status page 176
The associated client status page shows a variety of information about the wireless clients that are associated with the access points the wireless controller is managing 176
Table 7 31 buttons on the associated client status page 177
Associated client ssid status 178
Ssid status 178
Table 7 32 fields on the ssid associated client status page 178
The ssid associated client status page shows ssid information for the wireless clients on the wlan 178
Table 7 33 buttons on the ssid associated client status page 179
Associated client vap status 180
Table 7 34 fields on the vap associated client status page 181
Table 7 35 buttons on the vap associated client status page 181
Controller associated client status 182
Table 7 37 buttons on the controller associated client status page 183
Detected client status 184
Table 7 38 fields on the detected client status page 185
Table 7 39 buttons on the detected client status page 185
Pre auth history 186
Pre authorization history 186
Summary page 186
Table 7 40 fields on the detected client pre authentication history 186
Table 7 41 button on the detected client status page 186
The detected client pre authentication history summary page shows detected clients that have made pre authentication requests and identifies the access points that received the requests 186
To help authenticated clients roam without losing sessions and needing to re authenticate wireless clients can try to authenticate to other access points within range of the client for successful pre authentication the target access point must have a vap with an ssid and security configuration that match the client including mac authentication encryption method and pre shared key or radius parameters the access point that the client is associated with captures all pre authentication requests and sends them to the controller 186
Detected client roam history 187
Roam history 187
Table 7 42 fields on the roam history page 187
Table 7 43 buttons on the roam history page 187
The wireless system keeps a record of clients as they roam from one managed access point to another and displays this information on the roam history page 187
Activating licenses page 211 188
Backing up configuration settings page 204 188
Dwc 1000 wireless controller user s guide 188
Group management page 189 188
Maintenance 188
Rebooting the wireless controller page 207 188
Restoring configuration settings page 205 188
Restoring factory default settings page 206 188
This chapter describes the following maintenance activities 188
Upgrading firmware page 208 188
User management page 199 188
Using the command line interface page 213 188
Adding user groups 189
Group management 189
Table 8 1 group configuration page settings 191
Deleting user groups 192
Editing user groups 192
Configuring login policies 193
Check the box next to a user group 194
Click the policies by browsers button the groups page appears 194
Configuring browser policies 194
Groups 194
Groups the groups page appears 194
Table 8 2 groups page settings 194
The following procedure describes how to configure browser specific policies for user groups using this procedure you can allow or deny the users in a user group from using particular web browsers to log in to the wireless controllers web management interface 194
Configuring ip policies 196
Adding users manually 199
User management 199
Complete the fields in the page see table 8 4 and click save settings 200
Table 8 4 users configuration page settings 200
Importing users 201
Editing users 202
Check the box next to each user you want to delete or click the box next to list of users 203
Click the delete button 203
Deleting users 203
If you no longer a user you can delete the user 203
Note note a precautionary message does not appear before you delete a user therefore be sure you do not need a user before you delete it 203
Table 8 5 users configuration page settings 203
To delete a user 203
To select all users 203
Users the users page appears 203
Backing up configuration settings 204
Restoring configuration settings 205
Restoring factory default settings 206
Rebooting the wireless controller 207
Access point firmware upgrade 208
Upgrading firmware 208
Wireless controller firmware upgrade 209
Activating licenses 211
Using the command line interface 213
Connection problems page 217 214
Discovery problems with access points page 217 214
Dwc 1000 wireless controller user s guide 214
In the unlikely event you encounter a problem using the wireless controller refer to the troubleshooting suggestions in this chapter to identify and resolve the problem 214
Led troubleshooting page 215 214
Network performance and rogue access point detection page 218 214
Problems with date and time page 217 214
The topics covered in this chapter are 214
Troubleshooting 214
Troubleshooting the web management interface page 216 214
Using diagnostic tools on the wireless controller page 218 214
Using the reset button to restore default settings page 216 214
Lan port leds not on 215
Led troubleshooting 215
Power led is off 215
Troubleshooting the web management interface 216
Using the reset button to restore default settings 216
Connection problems 217
Discovery problems with access points 217
Problems with date and time 217
Network performance and rogue access point detection 218
Pinging an ip address 218
Using diagnostic tools on the wireless controller 218
Using traceroute 219
Performing dns lookups 221
Capturing log packets 222
Checking log settings 223
For each facility the following events in order of severity can be logged 224
View all logs or a remote syslog server for later review e mail logs discussed in a subsequent section follow the same configuration as logs configured for a syslog server 224
Tracking traffic 225
Accepted packets example 226
After making your selections on this page click save settings to save your changes or click don t save settings to revert to the previous settings 226
Dropped packets example 226
If a lan machine tries to make an ssh connection when the option accept packets from lan to option is enabled and there is a firewall rule to allow ssh traffic from a lan those packets are accepted and a message is logged if the log option is set to allow for the ssh firewall rule 226
If a lan machine tries to make an ssh connection when the option drop packets from lan to option is enabled and there is a firewall rule to block ssh traffic from a lan those packets are dropped and a message is logged be sure the log option is set to allow for this firewall rule 226
Remote logging 227
The following table describes the options on this page 228
Wireless controller event log 230
Ipsec vpn log messages 231
A basic planning worksheet similar to the one in this appendix allows you to collect the following critical information to expedite your planning efforts 232
Appendix a basic planning worksheet 232
Areas where you cannot deploy an access point 232
Areas where you do not want coverage 232
Areas where you want to deploy access points 232
Building dimensions 232
Check each step that applies in the worksheet after the step is completed 232
Desired access point data rates 232
Distance between floors 232
Number of floors 232
Radio type s 232
Rf planning enables you to specify how wi fi coverage will be provided it provides coverage maps and locations prone to weak signals or dead spots that might require additional access points to provide adequate wi fi coverage 232
Total number of users and number of users per access point 232
Walls and possible obstructions to wireless coverage 232
Appendix b factory default settings 235
Appendix c glossary 237
Appendix d limited lifetime warranty 239
Usa and canada only 239
D link dwc 1000 wireless controller user s guide 246
Document version version 2 246
September 2 246

D-Link DWC-1000 [82/246] Securing your network

Содержание

Похожие устройства