Configuring Wireless LAN Security

In Wireless LAN System, Layer 2 and Layer 3 security options are enforced by creating Security Profiles that are assigned to an ESSID. As such, they can be tailored to the services and the structure (virtual Port, Virtual Cell, etc.) offered by the ESSID and propagated to the associated APs. Security profiles for a controller can also be configured from E(z)RF Network Manager. You can tell where a profile was configured by checking the read-only field Owner. The Owner is either E(z)RF or controller. The general security configuration tasks are as follows:

1. Create VLANs to keep the client traffic in each SSID secure and separate from clients in other SSIDs. See the chapter
2. Set up the Certificate Server or RADIUS server configuration (see the RADIUS server documentation for instructions).
3. Configure Security Profiles based on the type of security required (continue with the following sections).
4. Configure one or more ESSIDs (see the chapter Configuring an ESS for directions) and assign the VLAN and Security Profile to them.

Virtual Interfaces

When operating in L3 Routing mode, Virtual Interfaces can be configured in order to act in much the same way as the standard physical interfaces on a device: they can be assigned an IP (or range of IPs), subnet, and gateway, and can be used to isolate clients in their own pri-

Virtual Interfaces

vate IP range. Once a Virtual Interface is created, it can be mapped to a DHCP scope (see Feature Group) and an ESS in order to service clients.

To view the virtual interface table, access the WebUI and navigate to Configuration > Wired > Virtual Interface. Note that until at least one interface has been created, the table will be blank.

Adding a Virtual Interface

To create a new virtual interface, access the Virtual Interface Table and click Add. The Virtual Interface – Add screen appears. See Figure 43.

Figure 43: Creating a Virtual Interface

Provide the required details as described in the following table.

TABLE 13: Virtual Interface Fields

Once the fields are filled in, click OK to save the interface. Repeat this process for as many interfaces as desired. After the interfaces have been created, you can assign them a DHCP scope. Refer to Feature Group for further instructions.

Configuring Management Interfaces

The Management Interfaces table (Configuration > Devices > System Settings > Management Interfaces) allows the user to control how traffic is sent from the controller to the wireless network. Refer to the following sections for each tab in the table.

Physical Interfaces

The Physical Interfaces table is where the user may configure the IP information for the physical Ethernet ports on the controller. The number of ports that may be configured will vary depending on the controller model purchased.

Add a Physical Interface

To configure a new physical interface, follow the steps below:

1. From the Physical Interfaces table, click Add. The Management Interface-Add window appears.

Configuring Management Interfaces

Figure 39: Adding a Physical Interface

2. Add in the required data as described in the table below.

3. Click Save to save the interface. Note that the controller must be rebooted in order to apply the changes.

VLAN Interfaces

VLAN Interfaces allow the user to specify VLANs that are to be used specifically for Management traffic on the network. This traffic includes:

• Communications between the controller and APs or controller to controller Access to the WebUI or CLI

Configuring Management Interfaces

• SNMP traffic
• Communications to the Network Management server and any additional Fortinet applications (SAM, Spectrum Manager, etc)
• Syslog messages
• Authentication server traffic (RADIUS, TACACS+, etc)
• NTP communications

Using this functionality, users can isolate management traffic from the rest of the network and route it specifically to the devices for which it is intended. Follow the steps in the section below to create a VLAN interface.

Add a Management VLAN Interface

1. From the VLAN Interfaces table, click Add. The Management Interface-Add window appears.

Figure 40: Adding a VLAN Interface

2. Add in the required data as described in the table below.

Configuring Management Interfaces

3. Click Save to save the VLAN. The new VLAN will appear in the VLAN Interfaces table.

Using Static Routes

Static routes allow the system administrator to manually define the adapters that are permitted access to configured subnets. This is of particular use in smaller deployments where only a few routes are needed, or in larger ones where certain subnets must be kept separate from each other. Static routing can also be advantageous in that it doesn’t require the processing power that dynamic routes (in which the network router automatically determines the best delivery path for packets) can.

To view the static route table, access the WebUI and navigate to Configuration > Devices > System Settings > Management Interfaces > Static Route. Figure 41: Static Route Table

Adding a Static Route

To create a new static route, access the Static Route Table and click Add. The Static Route Configuration – Add screen appears.

Configuring Management Interfaces

Figure 42: Creating a Static Route

Provide the required details as described in the following table.

TABLE 12: Static Route Fields

Once the fields are filled in, click OK to save the route. Repeat this process for as many routes as desired.

Link Aggregation

Link aggregation allows data traffic across both Ethernet ports on AP resulting in increased throughput and redundancy. You can configure LACP only on the second interface of the AP. Before you configure LACP on the second interface of the AP, enable bonding on the switch that terminates AP. When configured for link aggregation, the second interface of the AP will inherit all properties of the first interface. When enabled, LACP is functional on both ports.

The second interface of the AP is disabled by default and when enabled it functions as the bonded pair to the first interface. The second interface cannot be used in standalone mode. However, when LACP is enabled and if one of the interfaces fails, the second interface takes over and passes traffic. During a failover, the second interface will function only if there is an external power supply or if the switch can provide only power via PoE.

Link aggregation is available only on AP832, AP822, FAP-U421, and FAP-U423. If the switch that terminates the AP does not support LACP, the AP will fall back to non-LACP mode with only one interface passing data traffic. Static bonding is not supported.

Pre-requisites

Before you enable LACP on the AP, ensure that you do the following

• Remove port AP entry from the port profile of that AP.
• Enable LACP support for the ports on the switch that terminates the AP.
• AP requires 802.3at power to support LACP.

NOTE: If the switch does not support LACP, the AP will work in non-LACP mode.

Link Aggregation

Enabling LACP in CLI

Use the lacp enable command on an AP’s ethernet interface to enable LACP.

controller(15)# config terminal controller(15)(config)# interface ap 108 2 controller(15)(config‐if‐WiredEth)# lacp enable

Verifying LACP Status

The Uplink Type and LACP column in the show interfaces ap <ap-id> command displays the status of LACP for an AP.

Controller(15)# show interfaces Ethernet ap 108

Type        ID  Name            IfIndex MTU     MAC Address       Admin State Op State  Last Change          Uplink Type LACP     

ap          108 AP‐108          1       1500    00:0c:e6:13:01:a9 Up          Disabled  05/19/2014 20:05:12  Uplink      disable  

ap          108 AP‐108          2       1500    00:0c:e6:13:01:a9 Up          Disabled  05/20/2014 23:51:48  Uplink‐lacp enable   

        Ethernet Table(2 entries)

For additional diagnostics, you can view the Tx and Rx errors of AP interface using the show interfaces Ethernet statistics <ap-ID> command.

Controller(15)# show interfaces Ethernet statistics ap 13

 IfIndex   Node ID Node Name       Type        In Octets     In Errors     Out Octets    Out Errors   

• 13 AP‐13           ap          78217745      0             4637677       0            
• 13 AP‐13           ap          0             0             0             0            

LACP      13      AP‐13           ap          78217745      0             4638109       0            

        Ethernet Statistics(3 entries)

Enabling LACP in WebUI

1. Goto Configuration > Devices > AP, select the AP.

Link Aggregation

2. Goto Ethernet Interface tab, and select the second Ethernet Interface and set LACP to Enable.

To batch enable LACP on multiple APs.

1. Goto Configuration > Wired > Ethernet, select all APs and click the Bulk Update button.
2. Set LACP to Enable.

Configuring Port Profiles

The Port Profile configuration screen allows you to create custom Ethernet profiles that can be applied to non-primary Ethernet ports on deployed devices. Certain AP models implement multiple Ethernet ports, and while one is always used for wireless service, the remaining ones can be configured by applying a Port Profile to them. If this functionality is not needed, the port can also be disabled via the Port Profile feature.

Each device that is connected to a non-primary port (either directly or through a switch that is wired to the port) can be monitored as a wired station in the controller WebUI (via Monitor > Devices > All Stations). If the interface is configured for tunneled operation and the connected device is a VoIP phone utilizing SIP, the phone will be visible as a SIP phone in the controller’s phone database. Note that the maximum number of wired stations supported per wired interface is 128.

Refer to the following sections for steps on how to configure and apply Port Profiles.

Creating a Port Profile

By default, a default Port Profile is configured in the controller interface. To view the existing Port Profiles, simply open the WebUI and navigate to Configuration > Wired > Port. See Figure 38.

Figure 38: Port Table

Several options can be configured as part of a Port Profile.

Configuring Port Profiles

The following table describes each field displayed.

TABLE 11: Port Profile Options

If desired, the default profile can be modified by checking the box alongside it in the table and clicking Settings. To add a new profile, perform the following steps:

1. From the WebUI, navigate to Configuration > Wired > Port.
2. Click Add. The screen refreshes to display the Port Table – Add page.
3. Configure the profile as desired. Refer to Table 11 for descriptions of the configuration options.
4. When finished, click OK to save the new profile.

Once a profile has been created, it can be applied to the desired port(s) on network devices.

Refer to the following section for instructions.

Enabling a Port Profile on a Specific Ethernet Port

To specify a port profile for a given Ethernet port, you must access the Port AP Table; from the Port Profile Table, select the desired profile and click Configuration. The Port AP Table is the second tab provided on the resulting screen.

By default, the Port AP Table is blank; you can manually add ports as desired. To add a port for the profile:

1. From the Port AP Table screen, click Add. The resulting table will allow you to select the AP and Interface ID to which the port profile will apply.
2. Use the drop-down lists to select the desired AP and Ethernet IDs. Note that if the Ethernet Interface Index specified is an Uplink interface (i.e., the interface is its primary connection to the network), it cannot be configured for a port profile and an error message will appear.
3. Click OK to save the changes.

These steps may be repeated for as many profiles as desired.

Enable 802.1x Authentication

Wired clients can be connected to the AP’s Wired Interface directly or can be connected via an L2 switch. In a deployment that uses L2 switch for multiple wired clients, the L2 switch must be configured to pass through 802.1x packets.

To enable 802.1 x authentication for wired clients, do the following:

1. Create a RADIUS profile and security profile (using 802.1x L2 authentication mechanism with Clear Encryption mode )
2. Attach the security profile to the respective port profile configuration.

Enabling using CLI

Create RADIUS Profile default(15)(config)# default(15)(config)# radius‐profile dot1xport default(15)(config‐radius)# ip‐address 10.10.10.10 default(15)(config‐radius)# key meru2002 default(15)(config‐radius)# port 1812 default(15)(config‐radius)# exit

Create Security Profile default(15)# configure terminal default(15)(config)# security‐profile dotxportauth default(15)(config‐security)# allowed‐l2‐modes 802.1x default(15)(config‐security)# encryption‐modes clear default(15)(config‐security)# radius‐server primary dot1xport

Configuring Port Profiles

default(15)(config‐security)# exit

Create Port Profile default(15)# configure terminal default(15)(config)# port‐profile dot1xauth default(15)(config‐port‐profile)# enable default(15)(config‐port‐profile)# dataplane tunnelled default(15)(config‐port‐profile)# security‐profile dot1xportauth default(15)(config‐port‐profile)# exit default(15)#

Enabling using WebUI

Create RADIUS Profile

Create Security Profile

Create Port Profile

Dual-Ethernet Operation

Dual-Ethernet support enables the controller’s second Ethernet port and provides the ability for it to work either as a redundant interface or a second active interface.

If the second interface is configured as redundant, it will serve as a backup interface to the first interface. This means that it will be idle as long as the first interface is functional and will perform all functions of the first interface if the first interface fails. In a redundant configuration, the first interface can have static or DHCP IP address.

If the second interface is configured as active, it can be configured as a separate interface that can support an additional configuration, for example to support GRE tunneling while the first interface is configured for VLANs.

The first Ethernet interface is treated as the default interface. The responsibility of the default interface is to pass wireless tunnel traffic between the APs and the controller. In addition to the general support of GRE and VLAN, the default interface is also the designated management interface for the controller, providing support for management access traffic via SSH and HTTPS.

It is implicit in the configuration of redundant mode that the second Ethernet interface should be connected to a switch port in which it can perform the same functions as the default Ethernet interface.

Note that when changing from redundant to dual active operation, a controller reboot is required.

Configuring Dual Ethernet

The second Ethernet interface can be configured as either redundant or active. An active interface can be used to support a VLAN or GRE (Generic Routing Encapsulation) tunneling. A redundant interface is a backup interface in case the primary interface fails.

Dual-Ethernet Operation

Configuring a Redundant Interface

See the chapter Implementing Redundancy.

Configuring an Active Interface

The following commands configure Ethernet port 2 as an active interface that can be used to support a VLAN or GRE (Generic Routing Encapsulation) tunneling. The ip address specifies the IP address of the VLAN or GRE local endpoint followed by the associated netmask. The gw command specifies the gateway address, and is a mandatory field.

default# configure terminal default(config)# interface FastEthernet 2

default(config‐if‐FastEth)# ip address 172.26.16.200 255.0.0.0 default(config‐if‐FastEth)# gw 172.26.16.1 default(config‐if‐FastEth)# type active default(config‐if‐FastEth)# exit default(config)# exit

After completing the interface configuration above, to configure a GRE tunnel, see Configure GRE Tunnels in the Security chapter.

Viewing FastEthernet Interface Information

To view the FastEthernet interface 1 configuration, use the show interfaces FastEthernet controller or show interfaces FastEthernet ap commands to display information relating to each type of interface.

To view the FastEthernet interface 2 redundant configuration, use the command show second_interface_status.

Interface and Networking Commands

The following interface and networking configuration commands are available.

Dual-Ethernet Operation

TABLE 10: Interface and Networking Commands

Configuring Basic Networking for the Interface

Use the following commands to configure network parameters, if necessary:

• To change the parameters of the FastEthernet port, use the interface FastEthernet command.
• To set up a dynamic IP address assignment for the wireless clients using the DHCP relay server, use the ip dhcp-server ip-address command.
• To set the IP address of the controller, use the ip address ip-address netmask command.
• To set the default gateway, use the ip default-gateway ip-address command.
• To set the domain name, use the ip domainname name command.
• To add one or more DNS name servers, use the ip dns-server ip-address command.

For additional information about configuring network information, see the FortiWLC (SD) Getting Started Guide. For more information about the listed commands, see the FortiWLC (SD) Command Reference.

802.11d Support

The original 802.11 standard defined operation in only a few regulatory domains (countries). 802.11d added the ability for 802.11 WLAN equipment to operate in additional countries by advertising the country code in the beacon. Devices pick up the country code and adjust com-

Configuring Basic Networking for the Interface                                                                                                                      199

munication accordingly. You do not have to configure or enable this feature; the Fortinet implementation currently works automatically for all countries listed in setup. There is no show command that displays this feature. Validate 802.11d in the 802.11 Beacons and Probe Response, Country code IE field.

Option 43

Option 43 is not part of any Fortinet product; it is a method for mapping controllers. With DHCP Option 43, you can specify a primary and backup controller for APs. With this configuration, the backup controller can be in a different subnet from the primary controller. Option 43 implements redundancy by specifying which controllers (primary and secondary) an AP should associate to. This feature is supported across all access points. A backup controller can be configured using either DHCP or DNS.

Option 43

For example, using Option 43, if “wlan-controller” is mapped to P1 (and P1 has a redirect to P2) and “wlan-controller-2” is mapped to S1 (and S1 has a redirect to S2), the discovery order would be P1, P2, S1, S2. If a controller has both a DNS entry and Option 43 enabled, the AP will first use the host address as configured on the AP (default value = wlan-controller). If the host address is configured as 0.0.0.0 or if the host is a name and the name cannot be resolved using DNS, only then will the AP look at the DHCP Option 43 value. For specific Option 43 configuration directions, see the Support Portal How-To 4062-125.

AP Aware Redundancy using DHCP Option 43

• Configure APs with L3 preferred and the controller name as 0.0.0.0
• On the DHCP server, Option 43 values need to be configured with primary and secondary controller IPs and/or hostnames. Then, when an AP contacts the DHCP server to obtain an IP address, it also receives primary and secondary controller IP information using the Option 43 value from the DHCP server.

AP Aware Redundancy using DNS

• Configure APs with L3 preferred and the controller name as the hostname of the controller.
• Configure a DNS entry to resolve the primary hostname on the DNS server. Configure a DNS entry to resolve the secondary hostname on the DNS server.
• Configure the hostname of the primary controller on the AP with L3 preferred mode.