cwm Configuration And Setup Guide D-link Academyacademy.dlink.com/temp/exam_Issue/229/CWM...

transcript

CWM Configuration And Setup Guide

D-Link Academy

Central WiFiManager (CWM)

• Fundamental Concepts of 802.11 Wireless LANs

• Introduction to D-Link Central WiFiManager (CWM)

• CWM and AP Module Installation

• Site and Network Configurations

• SSID Configurations

• Wireless Client Connections

• Configuration For User Authentication

• Troubleshooting and Maintenance

2 D-Link Academy

3 D-Link Academy

Wireless LAN Terminology

• A wireless local-area network (LAN) uses radio waves to connect devices such as laptops, smartphones, to the Internet as well as your business network and its applications.

• Radio frequencies (RF) are generated by antennas which propagate the waves into the air.

• Antennas fall under two different categories: directional and omni-directional:

• Directional antennas: used in point-to-point configurations (connecting two distant buildings)

• Omni-directional antennas are used in point-to-multipoint configurations

4 D-Link Academy

• Band steering detects and steers 5 GHz capable clients away from the overcrowded 2.4 GHz network to the less congested 5 GHz network.

• Airtime fairness allocates time equally among clients, so each client can transmit at its highest speed regardless of location or 802.11 standard version.

• Load balancing ensures optimal network performance by limiting the maximum number of users per access point.

5 D-Link Academy

• WLANs bands

• 900 MHz Used by older cordless phones

• 2.4 GHz Used by newer cordless phones, WLANs, Bluetooth, microwaves, and other devices

• 5 GHz Used by the newest models of cordless phones and WLAN devices

• 5GHz has a shorter range compared with 2.4GHz

• The 2.4GHz frequency is way more crowded than 5GHz

6 D-Link Academy

• Fast roaming allows wireless users to move between different rooms or even buildings using a wireless devices, without losing their network/Internet access.

• The initial handshake allows the client and APs to do the Pairwise Transient Key (PTK) calculation in advance. These PTK keys are applied to the client and AP after the client does the re-association request or response exchange with the new target AP.

• Please make sure customer’s wireless NIC supports Fast Roaming [D-Track: DEUR20160315000006]

7 D-Link Academy

Dual-Band Access Points

• Dual-Band Access Points have the capability to transmit on the 5 GHz and 2.4 GHz wireless band

• 2.4GHz channel

• All 802.11b and g devices run on 2.4GHz only (for example, microwave ovens, cordless phones, Bluetooth devices)

• Only 3 non-overlapping channels for transmission

• 5GHz channel

• 23 non-overlapping channels

• Delivering high performance connections for sharing large files, or for applications such as webinars and video conferences

8 D-Link Academy

Wireless 802.11 AC Benefits

• Uses the 5GHz band with less interference

• Faster Speed (1300 megabits per second (Mbps) vs. 450Mbps speed in 802.11n)

• Compatibility (Everything Works Together)

• Works perfectly with 802.11a (introduced in 1999), 802.11b (2000), 802.11g (2003) and 802.11n (2007)

9 D-Link Academy

Wireless LAN Security

• Encrypting network traffic using WPA2 or WPA2 Enterprise password protection instead of WEP

• Wi-Fi Protected Access (WPA) 2, provides stronger data protection and network access control

• Only authorized users can access their wireless networks

• WPA2-Enterprise verifies network users through a server

• Ensuring the firmware in all of your Wireless AP devices is kept updated

• User authentication, which identifies devices trying to connect to the network

• Secure access for visitors and guests

10 D-Link Academy

11 D-Link Academy

D-Link Central WiFiManager

• D-Link Central Wi-FiManager (CWM) software controller helps network administrators streamline their wireless AP management workflow

• A management system to configure, monitor and control up to 1,000 Wi-Fi Access Points

• Work with Microsoft Windows-based OS computer

• Can be deployed on a local computer, or hosted on a public cloud service

• Web-based management allows access through any device with a web browser. Examples of a device is a smartphone, tablet, laptop or desktop

12 D-Link Academy

Central WiFiManager

• Installed in a local computer or hosted on a public cloud service

• Deployed with multi-site deployment as well as multi-tenancy management

• Enterprise vs. local branch office

• Site

• Logically separated with its own configuration profile, access security, as well as network map

• Network

• Network Access Point Configuration profile

13 D-Link Academy

Central WiFiManager

• WLAN Management Features

• AP Grouping

• Multi-tenancy

• Visualized topology

• NAT pass-through

14 D-Link Academy

Central WiFiManager

• Easy to expand the wireless network in the future

• Adding wireless access point is easy

• Output power increase shall any failure of access points under managed domain

15 D-Link Academy

Central WiFiManager

• Deployment scenarios

• Businesses in a single location

• Corporate headquarters and branch offices are connected via Wide Area Networks (WANs). For example, schools, hotels and hospitals

• A public cloud service to manage customers’ Wireless APs in different locations

• User right management

• Administrator

• Multi-tenancy

16 D-Link Academy

Central WiFiManager

• Access Points Administration Management

• Able to manage wireless Access Points in remote locations, even though they (Access Points) are behind a NAT device (router or firewall)

• Supports automatic channel and output power optimization

• Optimizes wireless bandwidth

• Access detailed reports

• Scheduling of “Firmware update” & “Configuration update”

• Online Check of “Firmware” and “Module”

17 D-Link Academy

Central WiFiManager

• Access Points Security Control

• Supports 8 SSIDs per radio

• Supports local DB, external RADIUS, LDAP, POP3

• Supports Captive Portal with Wi-Fi passcode authentication, and

• Supports user access control

18 D-Link Academy

Central WiFiManager

• RF Management and Control

• Auto Output Power Control

• Auto Channel

• Self-healing around failed APs

• Wireless radio on/off by scheduling

19 D-Link Academy

CWM vs. APMII

• CWM-100

• AP is actively seeking CWM to maintain communication

• APMII

• APM is actively looking for AP to establish AP and APMII communication

D-Link Academy

CWM System Requirements

• System Requirements

Large Scale Deployment Small Scale Deployment

Maximum APs Managed

1,000 Aps 100 Aps

Recommended CPU Microsoft® Intel i5 3.2GHz CPU Microsoft® Intel i3 3.5GHz CPU

Recommended RAM 4G DDR3 2G DDR2

Recommended Storage

2TB 1TB

Ethernet NIC Gigabit Gigabit

Display Card DirectX 11 1GB DirectX 11 1GB

Windows Platform

Microsoft® Windows 2008 Server Microsoft® Windows 2012 Server

Microsoft® Windows 7 Professional Microsoft® Windows 2008 Server Microsoft® Windows 2012 Server

D-Link Academy

CWM System Requirements

• System Requirements [D-Track: DEUR20160212000002]

• The hard driver size requirement shall depend upon the numbers of APs/stations being utilized in customer environment

• CWM system is designed automatically to retrieve the syslog, event and operation status directly from APs (DAP Series)

• As such, it is recommended sufficient storage free space is reserved for CWM operations

22 D-Link Academy

Supported APs

• 802.11ac Access Points • DAP-3662 (AC1200 Concurrent Dual Band Outdoor PoE)

• DAP-2695 (AC1750 Concurrent Dual Band PoE)

• DAP-2660 (AC1200 Concurrent Dual Band PoE)

• 802.11n Dual Band Access Points • DAP-2690 H/W B1 (PoE with Plenum-rated Chassis)

• 802.11n Single Band Access Points • DAP-3320 (PoE Outdoor)

• DAP-2230 (PoE)

• DAP-2360 H/W B1 (PoE with Plenum-rated Chassis)

• DAP-2330 (PoE)

• DAP-2310 H/W B1

23 D-Link Academy

DAP-3662

• DAP-3662 (Wireless AC1200 Concurrent Dual Band Outdoor PoE Access Point)

• Is a versatile, high power outdoor access point designed with weather-resistant features

• IP67 weatherproof housing that protects it from dirt and rain

• Supports both Personal and Enterprise versions of WPA and WPA2

• 2 Gigabit LAN Port (LAN1 supports PoE)

• 300 Mbps over the 2.4 GHz band

• 900 Mbps over the 5 GHz band

24 D-Link Academy

DAP-2695

• DAP-2695 (AC1750 Plenum-Rated Dual Band Gigabit PoE Access Point)

• Is designed to support small to medium business or enterprise environments

• Supports for the Wi-Fi Multimedia (WMM) Quality of Service (QoS) feature, makes it an ideal access point for audio, video, and voice applications

• 450 Mbps over the 2.4 GHz band

• 1300 Mbps over the 5 GHz band

25 D-Link Academy

DAP-2660

• DAP-2660 (Wireless AC1200 Concurrent Dual Band Gigabit PoE Access Point)

• Featuring a clean modern design

• Can be mounted easily onto any wall or ceiling

• Supports advanced radio management features such as band steering, airtime fairness, and load balancing

• 300 Mbps using the 2.4 GHz band

• 867 Mbps using the 5 GHz band

26 D-Link Academy

Application Download

• Central Wifi Manager v1.03r0098

• CWM Download Path: PMD: Software > AP Management > CWM

• AP Module Download Path: Wireless LAN > Wireless AP > (AP Module) > CWM

• D-Track: DEUR20161118000005

27 D-Link Academy

CWM [AP Module]

• For “Central WifiManager v1.03r0098.exe”

• CWM_DAP2230 v1.05-R02-CWMv1.03r0098-FWv105rc029.exe

• CWM_DAP2310B v2.10-R26-CWMv1.03r0098-FWv210rc036.exe

• CWM_DAP3320 v1.05-R03-FWv105rc016.exe

• CWM_DWP2360B v2.10-R15-CWMv1.03r0098-FWv210rc020.exe

28 D-Link Academy

CWM [AP Firmware]

• For “Central WifiManager v1.03r0098.exe”

• DAP2230-firmware-v1.05-rc029.bin

• DAP2310B-firmware-v210-rc036.bin

• DAP2330-firmware-v110-rc034.bin

• DAP2360b-firmware-v210-rc050.bin

• DAP2553b_v3.10_rc031.bin

• DAP2690b-firmware-v320-rc106.bin

• DAP3320-firmware-v1.05-rc019.bin

29 D-Link Academy

TCP/UDP Ports

• The following tcp / udp ports SHALL be permitted for access

• UDP 161 (SNMP port)

• UDP 162 (SNMP trap port)

• UDP 514 (Syslog port)

• UDP 8090 (Listen port)

• UDP 64768 (Service port)

• TCP 443 (HTTPS, Management port)

• TCP 9000, to initiate the FTP transfer / Enable ftp-ALG (Manager port)

• TCP 10000-11000

• Note: CWM v1.01xxx uses SNMPV2 for communication and CWM v1.02xxx adapts SNMPv3 for communication [D-Track: HQ20151231000003]

30 D-Link Academy

CWM Menu (System, Settings)

• After logging into CWM, then click on System, you should be able to see “Settings” on the left

• In CWM, System function, this function consists of 5 tabs

• General

• Module

• Database

• Advanced

• SMTP

31 D-Link Academy

• 5 tabs

• General, Module, Database, SMTP, and Payment

32 D-Link Academy

• General tab

• Max. Online User: the maximum amount of users that will be allowed to access the management interface at the same time

• AP List Packet Settings: available options: Auto, 2, 5, 10, 20, and 30

• Time Zone

• Access Address: The access address is for administrator to access CWM interface remotely

33 D-Link Academy

• General tab

• AP Live Packet Setting: Live Packet Interval Time

• Options with 5/10/20/30 seconds

• If deploying CWM with significant amount APs and the Live packet interval time is 5, it might bring CWM server in a unstable position. There are instances that CWM might be de-activated. [D-Track: DGC20160114000006]

• Recommended action: to increase the Live Packet Interval Time

34 D-Link Academy

• Module tab

• A list of access point modules will be displayed in the Module Name section (D-Track: DK1600647)

• Press the button of “Check Now” to confirm the latest module and firmware version on line

• In this example, no module has been pre-installed

35 D-Link Academy

• Database tab

• Tasks relate to database backup and restore (General sub-tab)

36 D-Link Academy

• Database tab

• Tasks relate to database backup and restore (Backup subtab)

37 D-Link Academy

• Database tab

• Steps to backup database

38 D-Link Academy

• Database tab

• The database backup, under current database design, includes all of the relevant information, such as logs

• The size of the database may also increase proportionally to the transactions on daily basis [D-Track Case:DEUR20151230000005]

• The CWM offers the availability to save and export the wireless log to local hard-drive [D-Track: DEUR20161024000003]

39 D-Link Academy

• SMTP tab (screen shot)

40 D-Link Academy

• SMTP tab

• Mail Server: SMTP server’s IP address or domain name

• Port: SMTP server’s port number

• Encryption: Options available are SSL and TSL

• Enable authentication: Select this option if the SMTP server requires authentication to successfully send emails

• Username: SMTP user account’s username

• Password: SMTP user account’s password

41 D-Link Academy

• Payment tab

42 D-Link Academy

CWM Menu (System, User Manager)

• User List

43 D-Link Academy

User Management (1/2)

• Root admin

• Capable of administering and managing entire CWM operations, the highest privilege level

• Root User

• Able to view all the settings of groups, system configuration, monitoring, systemlog etc.

• Local Admin

• Manage the group specified by root admin

44 D-Link Academy

User Management (2/2)

• Local User

• View all the info of group specified by Root admin. cannot manage

• Front Desk Staff

• Only passcode has been set in the group specified by Front Desk Staff. this account can manage info of passcode

45 D-Link Academy

New User Account Creation

• New user account creation

• Required Columns

• Username (max. length: 64 characters)

• Password

46 D-Link Academy

User Management Troubleshooting

• Root User [D-Track: DI20160105000004]

• Able to view all the settings of groups, system configuration, monitoring, systemlog etc.

• It is not capable of modifying/adding the SSID, nor making any changes on VLAN settings

47 D-Link Academy

48 D-Link Academy

Business Scenarios

• Objective: This documentation is to present a step-by-step CWM installation, wireless connections activities, and troubleshooting guide

• Equipment consists of

• CWM-100 (installed in a notebook)

• Layer 2 switch *1

• DAP-2660 *2

• Laptop with wireless connections *2

• Network Topology and IP address management are shown in next slide

49 D-Link Academy

Network Topology

• Network Topology

Site: Asia

Network: Taipei

v1.02r0068

172.17.3.14

Internet

DAP-2660

7062-B852-25A0

172.17.3.69

DAP-2660

7062-B854-5200

172.17.3.72

Wireless client

172.17.3.84

Wireless client

172.17.3.85

Layer 2 switch

D-Link Academy

• CWM and AP Module Installations

• CWM Installation

51 D-Link Academy

CWM Installation

• Central Wi-Fi Manager installation (exe) file

• Version: v1.03r0098

52 D-Link Academy

CWM Installation

• CWM installation process, follow the installation wizard

• Select setup language

53 D-Link Academy

CWM Installation

• CWM installation process

• InstallShield Wizard welcome window

54 D-Link Academy

CWM Installation

• Destination folder, use Browse button to change path

55 D-Link Academy

CWM Installation

• These ports are used for AP connections

• Any modification here is not recommended

56 D-Link Academy

CWM Webserver IP

• CWM server IP (that is the IP address used for connections)

57 D-Link Academy

DB Password Configuration

• PostgreSQL DB Password Configuration (for example, dlink)

58 D-Link Academy

Visual C++ 2008 Redistributable

59 D-Link Academy

PostgreSQL DB Installation

• Database installation in background

• Note: Sharing PostgreSQL with other applications is not recommended

60 D-Link Academy

Allow CWM Services

• Click “Allow Access” button to allow Apache HTTP Server

61 D-Link Academy

Start CWM Server

• Two application shortcuts icons shown in desktop

• Double click Central Wi-Fi Manager Server

62 D-Link Academy

Allow CWM Services

• Central Wi-Fi Manager Server

• Allow CWM Services

63 D-Link Academy

Start CWM Server

• Central Wi-Fi Manager Server

• Menu: Server > Start to initialize this application

64 D-Link Academy

Start CWM Server

• Central Wi-Fi Manager Server changes status to on line

65 D-Link Academy

Central WifiManager Server

• Central WifiManager Server Text file

• Path (for example: C:\Program Files (x86)\D-Link\Central WifiManager)

66 D-Link Academy

• AP Module Installation

67 D-Link Academy

• Module tab

• A list of access point modules will be displayed in the Module Name section

• Press the button of “Check Now” to confirm the latest module and firmware version on line

• In this example, no module being installed

68 D-Link Academy

AP Module

• Each AP model planned to use in CWM requires identical module installation

• If the CWM server is already running, it must be stopped and closed, so AP manager module is able to be installed

69 D-Link Academy

AP Module Installation

• Module tab

• Steps to install AP Module

• First, stop your CWM, otherwise you would experience an error message as shown below

70 D-Link Academy

• Module tab

• Then, double click exe file, in this lab example, we use DAP-2660

71 D-Link Academy

• Module tab

• DAP-2660 installation wizard

72 D-Link Academy

• Module tab

• Latest information in module tab (login CWM)

73 D-Link Academy

• Module tab

• Click the “Check Now” button and it shows existing version is the latest one

74 D-Link Academy

75 D-Link Academy

Site and Network Configurations

• Steps regarding Site and Network Configurations

• Navigate to the CWM-100 Configuration tab, then create the Site and Network

• Use the Export tab and download the AP config file by clicking it

• Launch AP installation tool to upload the config file you just downloaded

• Should proper AP modules being installed, then, the communication between both is well established

D-Link Academy

DAP Configurations

• To build correct communication with CWM, all of the DAPs shall have proper network configurations, including IP address, network gateway, and DNS

• If CWM is installed behind an NAT environment, you need to specify the WAN IP of the NAT, as the CWM IP address or DDNS domain

D-Link Academy

Launch CWM

• Double click Central WiFi Manager icon in your desktop

D-Link Academy

Login to the CWM

• You shall be presented with Central WiFiManager login GUI

• Default username/password: admin/admin

D-Link Academy

Remote Login CWM

• You can connect to CWM remotely, by entering the IP address or Domain Name of the computer that has the server application being installed

• Open an Internet browser, and type

• https://IP_address, or

• https://domain-name.com

• Any software installation on connecting device is NOT required

D-Link Academy

CWM MainPage

• CWM MainPage

D-Link Academy

• Create a Site, click the + sigh in right hand panel

82 D-Link Academy

• Create a Site, named “Asia”

83 D-Link Academy

• Create a Site, named “Asia”

• Verify the Site settings

84 D-Link Academy

• Create a Network, click the + sigh in right hand panel

85 D-Link Academy

• Create a Network, named “Taipei”

86 D-Link Academy

• Create a Network, named “Taipei”

• Verify the settings

87 D-Link Academy

• Export “Site and Network Configurations” profile

88 D-Link Academy

• Export “Site and Network Configurations”

• Save it in your local device for upload it later

89 D-Link Academy

AP Installation Utility

• AP Installation utility is used to scan for new D-Link access points in the local subnet

• It (the AP installation utility) shall be used only to upload/push the CWM configuration into AP (DAP Series). That is different from general AP configuration.

• The config file you upload into the AP through the AP installation utility is the information of the CWM and where the AP is going to register/find the CWM (IP address, port number...) (D-Track: DEUR20160405000004)

• This utility is not able to locate access points across a layer 3 environment

90 D-Link Academy

AP Installation Utility Installation

• AP Installation utility for CWM is a tool to configure DAPs

• Double click the exe file to launch this application

91 D-Link Academy

• This utility has three functions

• Discovery: to discover APs in your network

• Set IP: to configure AP’s network settings

• Set GroupInfo: to insert CWM configurations

92 D-Link Academy

• Discovery: to discover APs in your network

• For example, two DAP-2660 now in our network

93 D-Link Academy

• Set IP: to configure AP’s IP Add, Gateway, and DNS

• DNS is required, if CWM and AP are in different subnet

94 D-Link Academy

• The key objective of using AP Installation Utility is to inform AP about CWM's IP address and port(s) being used.

• It shall not be utilized to update any further configuration

95 D-Link Academy

Site and Network Profile

• Launch AP Installation Utility for CWM to import config.

• Select target APs and then click “Set Groupinfo”

96 D-Link Academy

• Select target APs and then click “Set Groupinfo”

• Use the path to find out pre-downloaded file

97 D-Link Academy

• Test the connectivity by clicking “Test”

• Select OK to continue this step

98 D-Link Academy

• Configuration file uploading to selected APs

99 D-Link Academy

• Configuration file uploading to selected APs

• This info provides a means for AP to actively seeking CWM, in order to establish communication

100 D-Link Academy

• There are some occasions that AP installation utility can not push configuration through to AP. Possible cause:

• Checks on DNS correctness [D-Track: DEUR20160105000010]

• AP installation utility can't across the VPN tunnel [HQ20151231000003]

101 D-Link Academy

• Configuration file verifications

• Home > Dashboard

102 D-Link Academy

• Configuration file verifications

• Home > Site

103 D-Link Academy

• In AP’s GUI, you shall see corresponding settings

• Maintenance > Administration Settings

• Central WiFi Manager: Enable

104 D-Link Academy

105 D-Link Academy

SSID Configurations

• Objective: to create a SSID, named “Neihu2” associated with Site (Asia) and Network (Taipei)

• This SSID is in Band 2.4Ghz, primary Index, with SSID name “Neihu2”

• Use open system as security settings

• Note:

• CWM configuration is composed at network level

• APs in the same network share the same configuration

106 D-Link Academy

SSID Configurations

• Go to Menu bar: Configuration, Site “Asia”

• Network, Taipei

• SSID, click + sign

107 D-Link Academy

SSID Configurations

• Input relevant information, then clicking the Save button

108 D-Link Academy

SSID Configurations

• Verify the configurations

109 D-Link Academy

SSID Configurations

• Upload configuration, select Run and click Complete

Any configuration changes require a scheduled task to push the configuration to all managed APs in the network

D-Link Academy

SSID Configurations

• Verify the upload config status

111 D-Link Academy

SSID Configurations

• The APs shall be temporary offline, as CWM would reboot APs

112 D-Link Academy

SSID Configurations

• Uploading configuration task is finished

113 D-Link Academy

SSID Configurations

• Confirm the detail results

• Configuration is successfully uploaded

114 D-Link Academy

Lab: SSID Creation

• Use available laptop to connect to SSID “Neihu2”

• Information on connected clients as shown below

115 D-Link Academy

Verify Managed APs

• Verify Managed Aps

• Menu: Home > Site > Asia

116 D-Link Academy

Verify Managed APs

• Menu: Home > Site > Asia > Taipei

117 D-Link Academy

Verify Managed APs

• Menu: Home > Site

• Click one of the IP address

118 D-Link Academy

Verify Managed APs

119 D-Link Academy

120 D-Link Academy

Connected Client Information

• Client Information

121 D-Link Academy

Connected Client Information

• WLAN Traffic Status (click refresh to update data)

122 D-Link Academy

123 D-Link Academy

User Authentication Setup

• Objective: The documentation presents a step-by-step CWM User Authentication configurations

• Pre-requisite: Please refer to “CWM Setup Guide” for CWM installation and configuration

• Equipment consists of

• CWM-100 (installed in a notebook)

• Layer 2 switch *1

• DAP-2660 *2

• Laptop with wireless connections *2

• Network Topology and IP address management are shown in next slide

124 D-Link Academy

Network Topology

Site: Asia

Network: Taipei

v1.02r0068

172.17.3.14

Internet

DAP-2660

7062-B852-25A0

172.17.3.69

DAP-2660

7062-B854-5200

172.17.3.72

Wireless client

172.17.3.84

Wireless client

172.17.3.85

Layer 2 switch

D-Link Academy

Authentication Mechanisms

• Supported User Authentication mechanisms include:

• Local username and password

• RADIUS

• LDAP

• POP3

• Passcode

• Enable User Authentication mechanism is applied on SSID basis

• A customized background graphic is allowed for each network.

• It is a common background for all of the SSIDs’ authentication pages in the same network.

D-Link Academy

User Authentication

User Authentication configurations include 2 examples

• Local Database Authentication

• Passcode

127 D-Link Academy

User Authentication

• Passcode

128 D-Link Academy

Local Database Authentication

• Network administrator is given the privilege to create username and password pairs on CWM server

• Configuration parameters

• Site: D-Link

• Network: Taipei

• Band: 2.4G

• Index: Primary

• SSID: Neihu2

• SSID Visibility: Enable

• Security: Open System

• User Authentication: Username / Password

(dlink/dlink)

129 D-Link Academy

• Screen shot of configuration

130 D-Link Academy

• Go to User Authentication session, Authentication Type

• Select “username/password”

• Input user name/password: dlink/dlink

131 D-Link Academy

• Make sure you click “Save” button

132 D-Link Academy

• Verify configurations in the “User Authentication” column

• Please notice there is an orange icon, next to Site “Asia”

• To make sure the right changes are made, we need to upload configurations

133 D-Link Academy

• Upload Configurations to APs

134 D-Link Academy

• Configurations upload to APs status

• Please confirm responding description in “Result Detail”

135 D-Link Academy

• Use a mobile device to connect to Neihu2 SSID

136 D-Link Academy

• Wireless client is prompted with login page

137 D-Link Academy

• Wireless client attempts to connect (login page)

• Make sure you click “Use Policy” then, input username/ password, followed by clicking “Login”

138 D-Link Academy

User Authentication

• Passcode

139 D-Link Academy

WLAN Hotspot Business Scenario

• Coffee Shop WLAN Hotspot Deployment

• When users at a coffee shop initially try to access the Internet, they are authenticated using a web browser that is redirected to a web server

• Users provide authentication credentials to the service provider using a secure HTTP browser

• After the user is successfully authenticated, he is given access to the Internet

D-Link Academy

Passcode Authentication

• Business Scenario: Two DAP-2660s are installed in a coffee Shop. The front desk agent is able to login CWM and generate passcode keys providing customers for Internet access.

• Front desk user account must be configured before assigning them to a site and its network.

• The max. number of username / password, using passcode, is 64, per SSID

• Max. devices can use the same Captive Portal login: 256

• UDP 64768 shall be made available on CWM

• The following slides presents step-by-step configuration guide to reach this goal

141 D-Link Academy

Network Topology

Site: Asia

Network: Taipei

v1.02r0068

172.17.3.14

Internet

DAP-2660

7062-B852-25A0

172.17.3.69

DAP-2660

7062-B854-5200

172.17.3.72

Wireless client

172.17.3.84

Wireless client

172.17.3.85

Layer 2 switch

D-Link Academy

The configurations involves the following 3 steps

• User account creation

• Passcode key generation (D-Track: DK1600644)

• Wireless client authentication

143 D-Link Academy

• Passcode key generation

144 D-Link Academy

• We first view the latest Site config. (Site: Asia)

D-Link Academy

• We then take a look of Network config. (Network: Taipei)

D-Link Academy

• Move to “System” session and review “User Manager” tab

D-Link Academy

• Create a user account, with front desk privilege

• For example, Name: dlink; password: dlink

D-Link Academy

• Go back to “Site” profile, add the newly created user (“dlink” into this site (binding association)

D-Link Academy

• Make sure “dlink” is in selected category. Click OK

D-Link Academy

• Please confirm that (dlink) user account is in Asia profile

D-Link Academy

• Go back to Network settings (network name: Taipei)

• Identify the SSID which we will configure with passcode configurations

• Select Neihu2 SSID (2.4GHz) and click Modify

D-Link Academy

• Make sure we are in the correct SSID item

D-Link Academy

• Set up the configuration from “Disable” to “Passcode”

D-Link Academy

• Upload configurations to those 2 DAP-2660s

D-Link Academy

156 D-Link Academy

• Frontdesk agent logins CWM and then generates passcode for mobile users to connect to Internet

D-Link Academy

• Frontdesk agent generates passcode for mobile users to login

• Configure the required information and then select “generate”

• We set up 5 passcodes with duration of 5 hours

D-Link Academy

• Newly created passcodes should be presented immediately, as indicated below

D-Link Academy

160 D-Link Academy

• A mobile user use the passcode of “25580326” to login

D-Link Academy

• A mobile user use the passcode of “25580326” to login

D-Link Academy

• Passcode utilization

D-Link Academy

• You also can view user connection information shown in CWM

D-Link Academy

• What information can we view the status of each passcode?

• CWM provides the info of “duration”, “last active day”…..

D-Link Academy

• Are we able to modify any of the passcode settings?

• Yes, please double the Modify icon and make necessary changes

D-Link Academy

General Troubleshooting Techniques

• When the Windows Firewall status is ON, please ensure to allow the "Public networks" item as well

• This is of necessary for Apache HTTP Server, when used with passcode

D-Link Academy

• In CWM version 1.02, the Passcode authentication is required to work with Captive Portal

• In fact, the wireless client and DAP-Series management VLAN shall be configured in the same VLAN, more accurately, in the default VLAN

• D-Track: IMA20160707000001

D-Link Academy

• Although the CWM admin deletes a Passcode account, would the pre passcode-authenticated client remains connections to the wireless network?

• When a wireless station (STA) completes the passcode authentication process, the AP is also being notified the acceptable time length for user connection. During such time frame, this AP would not communication to CWM regarding validity of measurement.

• As such, any further changes regarding that passcode brings no immediate modifications

• Once the passcode duration got expired, this client is required to conduct another authentication process

D-Link Academy

• What would be the maximum capability for DAP on passcode configuration?

• Each AP is able to process 256 passcode(s) at any specific time. AP will remove a passcode, when

passcode duration expired, or

“session timeout” timeout (default value is 60 minutes as CWM offers you the flexibility in configurations, as indicated below screenshot)

D-Link Academy

User Authentication: RADIUS

• The Radius Authenticated negotiation is practiced between DAP Series and Radius Server

• We could configure a non-default VLAN to a specific SSID, after the RADIUS authentication task is verified and completed, the wireless client will connect to that SSID and being assigned to that non-default VLAN for connections

• D-Track: IMA20160707000001

D-Link Academy

172 D-Link Academy

• Scenario: Where can I obtain AP Installation Utility?

• Solutions

• Menu: Configuration > Site, then double click the arrow button

173 D-Link Academy

• Scenario: The AP Installation Utility does not locate APs

• Solutions

• Check the firmware and hardware version of your Access Point

• Ensure the computer running the installation tool and APs are at the same network. The installation tool is Windows based utility that use layer 2 broadcast to scan for APs. It cannot discover APs remotely across a layer3 network

• Should more than 1 network adapter is installed in your AP Installation Utility system, please ensure only one is functioning. As such, it is able to scan APs

174 D-Link Academy

Launching CWM Application

• Launching the application

• Click the Central WiFiManager icon to run CWM in local mode

• Menu: Server > Start to start this application

175 D-Link Academy

Failure To Connect CWM Console

• Failure to connect CWM Console [DEUR20151215000008] • Confirm the personal firewall on the CWM server is being disabled

• The Central WiFiManager Window Service is started

• Specific ports activated for connection access

• UDP 161 (SNMP port)

• UDP 162 (SNMP trap port)

• UDP 514 (Syslog port)

• UDP 8090 (Listen port: for AP to sync config with CWM)

• UDP 64768 (Service port)

• TCP 9000 + ftp-ALG or TCP 9000 + TCP 10000 to 11000 (Manager port)

• TCP 443 (HTTPS, Management port, CWM side)

• Enable ftp-ALG (Manager port) if not available then open TCP 54000-54999 (CWM FTP PSV)

• Click Central WiFiManager server and check if the start button is greyed out

• Remote access requires TCP/UDP 443 176 D-Link Academy

Can’t Boot CWM Management Console

• Can’t boot CWM Management Console

• Windows service is not started

• Connect to database failed

• Port 443 being used by other application

177 D-Link Academy

System IP Address

• When the IP address of a CWM has been modified, the CWM server shall be stopped and in “shut down” mode, before we re-activate the CWM Server.

• Once all of the stated above steps are finished, you can log in to the CWM Server to perform the export of the AP setting.

• Incorrect step of the action could result the AP unable to connect to the CWM

Non-Supported Devices

• If the DAP models we have are not supported by CWM, what is the alternative to manage our DAP devices?

• Solution: AP Array or APMII (AP Manager) v3.0

179 D-Link Academy

CWM-100 Version (in production)

• Login CWM

• Menu Bar: About (latest version: 1.03 r0098)

180 D-Link Academy

APs Do Not Display In CWM

• The network profile has been imported, however, APs remains not be displayed

• Check over the APs whether they are installed using supported firmware version

• APs are configured with proper network settings, such as IP address, network mask, default gateway and DNS in the same network subnet

• Remote access requires TCP/UDP 443

181 D-Link Academy

Can’t Access CWM Remotely

• Can’t access CWM remotely

• Solution:

• Login to CWM on local server

• Navigate to the System>General page, and check the access address

• If there is firewall between your remote notebook and CWM server, please add a policy to allow the appropriate incoming TCP (https 443) and UDP ports to be open to traffic

182 D-Link Academy

AP’s Functionality, When CWM Is Down

• When AP lose connection to the CWM controller, only three functions are impacted

• Auto RF management

• Roaming User Authentication

• Passcode

183 D-Link Academy

• Auto RF is used to ensure that the APs do not broadcast on the same Wireless channel

• In order to achieve this, CWM needs to gather information from all APs in the vicinity. When CWM is not able to function, Auto RF management would be impacted

• Passcode

184 D-Link Academy

• A user can roaming from AP to AP without having to re-authenticate his ID if no idle timeout is reached.

• When CWM is unreachable, the user will need to re-authenticate whilst roaming from one AP to another AP

• Passcode

185 D-Link Academy

• Passcode

• Pass code is generated by the CWM server

• When CWM is not able to provide services, the passcode can not function either

186 D-Link Academy

PostgreSQL Database

• Verify PostgreSQL Database activities

• Control panel, System and Security, Administrative Tools

187 D-Link Academy

PostgreSQL Database

• Verify PostgreSQL Database activities

• Windows Task Manager

188 D-Link Academy

Password Specified Was Incorrect

• Should the following warning message pop up, it means Postgres SQL had pre-installed in this Windows system for other application

189 D-Link Academy

Reset Postgres Database Password

• Step to reset Postgres SQL Database password

• On the Windows server please go to Computer Management -> Local Users and Group -> Users -> postgres to set a new password

190 D-Link Academy

Connect To Database Failed

• Error Message: could not connect to server: Connection refused (0x0000274D/10061)

• Solution

• Uninstall CWM and the AP modules

• Delete the Postgres user in Users

• Install CWM again

• Once installed, the user Postrgres will be recreated

191 D-Link Academy

Port Conflict In Remote Login

• CWM's Web-GUI is using HTTPS (Port 443)

• Only https port need to be open on remote site access

• What if port 443 is used for other application?

• Solution: (change to 8443, as shown in the following example) • First locate C:\Program Files (x86)\D-Link\Central

WifiManager\web\redrect.php

• Original settings: <?PHP$Url="https://".$_SERVER['SERVER_NAME']."/index.php";header("Location: ".$Url);?>

• Change to <?PHP$Url="https://".$_SERVER['SERVER_NAME'].":8443/index.php";

header("Location: ".$Url);?>

192 D-Link Academy

Admin Password Reset

• Should you require to reset Admin Password, you need to

• Uninstall CWM (which means all the existed configuration of CWM should no more be available)

• Obtain professional services to remotely update the password

193 D-Link Academy

AP Status

• Colors of the display shows AP status

• Blue: online

194 D-Link Academy

AP Status

• Red: configuration in upload progress. No further command can be accepted

195 D-Link Academy

AP Status

• Gray: offline (not managed by CWM)

• (D-Track HQ20150924000005)

196 D-Link Academy

Captures Packets In Wireshark

• The following Wireshark diagram shows continuous communication (encryptedPDU: privKey unknown) between AP and CWM. Is this accurate?

• Ans: It is a common activity when CWM ensures whether

• AP is alive

• Specific NAT port is available and its status

197 D-Link Academy

Static Radio Channel or Power

• CWM-100 is a management system to provide general configuration to associated APs

• The APs would make its best decision in terms of radio channel and power. thus static radio channel or power is not a proper option here

198 D-Link Academy

MAC Filter

• Security mechanism of MAC address filtering

• In the whitelist section of SSID configuration, CWM provides the feature to allow Admin to upload the MAC addresses for authentication

• Maximum 64 MAC address, per SSID

• Each radio (2.4G or 5G) can support up to 8 SSIDs, thus offering the capability of 512 (8*64) MAC address (D-Track:DEUR20160203000003)

• This filtering information is sent from CWM to AP and being stored in AP memory (D-Track: DEUR20160330000003)

• In Unified Wireless product family, when the ap is managed by the DWC, the white list/black list is stored in controller (D-Track: DEUR20160330000002)

199 D-Link Academy

MAC Filter File Format

• In the whitelist section of SSID configuration, CWM provides the feature to allow Admin to upload the MAC addresses for authentication. What are the proper format to input that information?

• Ans: The file format is ".txt“ with sample content (D-Track: DK1500338)

• 00:11:22:33:44:55

• 00:22:33:44:55:66

• 00:33:44:55:22:11

200 D-Link Academy

MAC Access Control

• MAC Access Control configuration example (HQ20161020000010)

201 D-Link Academy

MAC ACL List Config

• 1. login to CWM, and create "Site" and "Network“ properly

• 2. add an SSID, set SSID and CP setting properly

• 3. add MAC ACL and add White list

• 4. push save button

• 5. select the created SSID and download MAC ACL List and White List

• 6. add a new SSID, set SSID and CP setting properly

• 7. upload MAC ACL List which was downloaded at step5, and confirm it is successful

• 8. enable White List, then upload White list which was downloaded at step5

• 9. push upload button, and confirm File content error...

Network Management

• Simple Network Management Protocol (SNMP) is an Internet-standard protocol being used here

• In fact, CWM server and APs communicate by using SNMP protocol to verify [D-Track: DEUR20160218000004]

• The AP’s status

• The total data traffic quantity being passing through

• Individual AP’s event log, as well as other

• Operation standing point status

203 D-Link Academy

Network Management

• Default SNMP community string: public/private

• Once an DAP is managed by CWM, the AP's SNMP Community or SNMPv3 User Name being modified automatically

• SNMP Community was changed from public to pubqfzvq

• SNMPv3 Username was changed to sec27jbd

204 D-Link Academy

Download Report

• You can use Central WiFiManager > Monitor > Report > Association to download report

• Supported format include: TXT, PDF and Excel

205 D-Link Academy

CWM Activities In Live

• The server will automatically start up if user checks the two boxes on the CWM Server configuration window (D-Track: HQ20160118000009)

• That could prevent the instance that Central WiFiManger Server Stops when User Logs out

206 D-Link Academy

Syslog And Traps Events

• CWM Server gather the events and then sends E-mail at five minute intervals

• There is not limitation regarding the size of Syslog and Public/Private Event

• The maximum number of Monitor list and Condition list being displayed: 16

• D-Track case: HQ20160113000008

207 D-Link Academy

Multiple SSID With Passcode

• CWM v.1.03 is able to support Passcode when using Multiple M-SSID

• Business application: One of those SSIDs will be free and with limited bandwidth, the other will be with payment over time.

WPA-PSK Passphrase

• When configuring WPA-PSK passphrase in CWM, Passphrase cannot contain special characters such as (" ' \ &)

WPA-PSK Passphrase

• “When enable auto RF in CWM, the channel setting in device view should be fixed in "auto" when user push device "channel“

• detail report about auto-channel and auto-power (Auto-RF).

WPA-PSK Passphrase

• The mechanism of the Auto-RF / RF-Optimization (DK1500171)

• Basically we can say the Auto-RF / RF-Optimization function is used to avoid the same channel be generated in a AP array/group, the master AP, backup master AP and slave AP will communicate the current radio environment status, to determine the channel they will provide for each access point in current environment is not duplicate.

• For the better wireless performance and connection, this mechanism could reduce the same channel/RF interference in an AP Array group.

WPA-PSK Passphrase

• Auto-RF works on two band , if you enable this function, it works all the time.

• Enable the Auto-RF, no matter whether "Auto Channel Selection" is disabled or enabled, Auto-RF will set "Auto Channel Selection" to enable, and RESTART the wireless connection at this time, the APs channel would(might) be changed in the first time configuration.

WPA-PSK Passphrase

• What's more, if Auto-RF need to adjust the wireless, Auto-RF would check two points:

• (a) if there is no any station connected on AP, Auto-RF will do ACS, the AP’s channel would(might) be changed. (ACS: Auto Channel Select)

• (b) if there is wireless station connected on AP, Auto-RF would adjust power only, not change the current channel

Security Certificate Is Not Valid

• About Captive portal and CWM web UI https show " Security Certificate is not valid ; continue with the website (not recommended)“

• Solution: This is because Browser will check https://URL security Certificate, If Customer don't want to see this page , they should have own or create a Security Certificate for their CWM server.

• And go to Central WiFiManager >System>Settings>Update SSL certificate, then upload Certificate From file and Key From File.

• After customer upload Certificate file, CWM web page and Captive portal will not show this warning message.

• If customer was upload the SSL certificate in v102 before, after install v103 are need upload SSL certificate again

RF-Optimization

• For the RF-Optimization is the same function as the Auto-RF of the AP Array, CWM server pretend the role of the Master AP in CWM site when we use the RF-Optimization function, and developer recommend to use 6 APs to verify it(it will more easy to see the phenomenon), you might refer to the test procedure below, to enable the RF-Optimization function and wait for 1-2 hours then check the result for CWM RF-Optimization test.

• The default AP channels setting is "auto" after in CWM enable auto RF function.

RF-Optimization

• Please note it, alpha respond they will enhancement this part no next formal release. thanks.

• "when enable auto RF in CWM, the channel setting in device view should be fixed in "auto" when user push device "channel"

Auto RF Optimize

• Please check "RF optimization"->"Auto initiation" is enable or not?

• Auto Init: Select this option to run the RF optimization feature periodically based on the period entered. After the initiation period has expired, the AP will automatically select the best channel

• Auto Init Period: After enabling the Auto Init option, enter the automatic initiation period value in hours

CWM (re)Installation

• CWM (Re)installation steps (D-Track: HQ20160309000011)

• Delete pgsql account

• Remove DAP module(s)

• Conduct uninstall CWM application

• Install the latest CWM application

• Install required DAP module(s)

218 D-Link Academy

CWM Upgrade

• Steps to upgrade CWM from v1.02 to v1.03

• Step 1: Upgrade Access Point (DAP) FW, corresponding to the CWM v1.03 requirements

• Step 2: Backup the CWM config file (System>Settings>Database) from CWM v1.02

• Step 3: Stop and turn off CWM service (Windows Service)

• Step 4: Install CWM v1.03 and AP module basing upon your network facility

• Step 5: Import CWM config file (System>Settings>Database) to CWM v1.03

219 D-Link Academy

Summary

• Web-based management

• Multi-site management • Multiple distributed sites can be managed from a central location

• The multi-tenant architecture provides multi-layer management authority

• NAT pass-through • Controllers can manage wireless access points in remote locations even if

they are behind a NAT device (router or firewall)

• Captive portal and access control • Supports local DB, external RADIUS, LDAP, POP3 and Wi-Fi passcode

authentication

• Supports user access control

• Max number of devices can use the same Captive Portal: 256

• Customizable captive portal login page

220 D-Link Academy

• Thank You!

D-Link Academy

cwm Configuration And Setup Guide D-link Academyacademy.dlink.com/temp/exam_Issue/229/CWM...

Documents