WLAN access commands -- beacon ssid-hide

Use beacon ssid-hide to disable advertising of the Service Set Identifier (SSID) in beacon frames.

Use undo beacon ssid-hide to restore the default.

Syntax

beacon ssid-hide

undo beacon ssid-hide

Default

The SSID is advertised in beacon frames.

Views

Service template view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

This command disables a radio from carrying SSIDs in the beacon frames and responding to probe requests after the specified service template is bound to the radio.

Examples

# Disable advertising the SSID in beacon frames.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-s1] beacon ssid-hide

WLAN access commands -- broadcast-probe reply (on ACs)

Use broadcast-probe reply enable to enable an AP to respond to broadcast probe requests.

Use broadcast-probe reply disable to disable an AP from responding to broadcast probe requests.

Use undo broadcast-probe reply to restore the default.

Syntax

broadcast-probe reply { disable | enable }

undo broadcast-probe reply

Default

In AP view, the AP uses the configuration in AP group view.

In AP group view, an AP responds to broadcast probe requests.

Views

AP view

AP group view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

Broadcast probe requests do not carry an SSID. Upon receiving a broadcast probe request, an AP responds with a probe response that carries service information for the AP. To ensure that clients that send unicast probe requests can associate with the AP, disable the AP from responding to broadcast probe requests.

Examples

# Disable AP ap1 from responding to broadcast probe requests.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-ACN

[Sysname-wlan-ap-ap1] broadcast-probe reply disable

# Disable APs in AP group group1 from responding to broadcast probe requests.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] broadcast-probe reply disable

WLAN access commands -- classifier acl (on ACs)

Use classifier acl to configure a forwarding rule for a forwarding policy.

Use undo classifier acl to remove a forwarding rule.

Syntax

classifier acl { acl-number | ipv6 ipv6-acl-number } behavior { local | remote }

undo classifier acl { acl-number | ipv6 ipv6-acl-number }

Default

No forwarding rules are configured for a forwarding policy.

Views

Forwarding policy view

Predefined user roles

network-admin

network-operator

Parameters

acl-number: Specifies an IPv4 or Layer 2 ACL number in the range of 2000 to 4999.

ipv6 ipv6-acl-number: Specifies an IPv6 ACL number in the range of 2000 to 3999.

behavior: Specifies a forwarding mode for traffic that matches the specified ACL.

local: Specifies the local forwarding mode.

remote: Specifies the centralized forwarding mode.

Usage guidelines

A forwarding rule takes effect immediately after it is created. You can configure a maximum of 1000 forwarding rules for a forwarding policy.

Examples

# Configure a forwarding rule to locally forward packets that match ACL 2000.

<sysname> system-view

[sysname] wlan forwarding-policy abc

[sysname-wlan-fp-abc] classifier acl 2000 behavior local

WLAN access commands -- client association-location (on ACs)

Use client association-location to enable client association at the AC or APs.

Use undo client association-location to restore the default.

Syntax

client association-location { ac | ap }

undo client association-location

Default

Client association is performed at the AC.

Views

Service template view

Predefined user roles

network-admin

mdc-admin

Parameters

ac: Enables client association at the AC.

ap: Enables client association at APs.

Usage guidelines

Make sure the service template is disabled before you execute this command.

Examples

# Enable client association at the AC.

<Sysname> system-view

[Sysname] wlan service-template s1

[Sysname-wlan-st-s1] client association-location ac

WLAN access commands -- client forwarding-location (on ACs)

Use client forwarding-location to specify the client data traffic forwarder.

Use undo client forwarding-location to restore the default.

Syntax

client forwarding-location { ac | ap [ vlan { start- vlan [ to end-vlan ] } ] }

undo client forwarding-location

Default

The AC forwards client data traffic.

Views

Service template view

Predefined user roles

network-admin

mdc-admin

Parameters

ac: Enables the AC to forward client data traffic.

ap: Enables APs to forward client data traffic.

vlan start- vlan to end-vlan: Specifies a VLAN ID range. The value range for the start- vlan and end-vlan arguments is 1 to 4094. If you do not specify this option, APs forward client data traffic from all VLANs.

Usage guidelines

Make sure the service template is disabled before you execute this command.

If APs forward client data traffic, you can specify a VLAN or a VLAN range for the APs to forward client data traffic from the specified VLANs. The AC forwards data traffic from other VLANs.

Examples

# Configure APs to forward client data traffic from all VLANs.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] user-forward location ap

WLAN access commands -- client forwarding-policy enable (on ACs)

Use client forwarding-policy enable to enable policy-based forwarding for a service template.

Use undo client forwarding-policy enable to disable policy-based forwarding for a service template.

Syntax

client forwarding-policy enable

undo client forwarding-policy enable

Default

Policy-based forwarding is disabled for a service template.

Views

Service template view

Predefined user roles

network-admin

network-operator

Usage guidelines

Enable policy-based forwarding for a service template for the following forwarding policies to take effect:

· The forwarding policy applied to the service template.

· The forwarding policy applied to a user profile that uses the service template.

Examples

# Enable policy-based forwarding for service template 1.

<Sysname> system-view

[Sysname] wlan service-template 1

[Sysname-wlan-st-1] client forwarding-policy enable

Related commands

client-security authentication-location

WLAN access commands -- client forwarding-policy-name (on ACs)

Use client forwarding-policy-name to apply a forwarding policy to a service template.

Use undo client forwarding-policy-name to restore the default.

Syntax

client forwarding-policy-name policy-name

undo client forwarding-policy-name

Default

No forwarding policy is applied to a service template.

Views

Service template view

Predefined user roles

network-admin

network-operator

Parameters

policy-name: Specifies a forwarding policy by its name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

Make sure the service template is disabled before you execute this command.

For the forwarding policy to take effect, you must enable policy-based forwarding and specify the AC to perform client authentication for the service template.

Examples

# Apply forwarding policy strategy to service template 1.

<Sysname> system-view

[Sysname] wlan service-template 1

[Sysname-wlan-st-1] client forwarding-policy-name strategy

Related commands

client forwarding-policy enable

client-security authentication-location

WLAN access commands -- client frame-format (on ACs)

Use client frame-format to set the client data frame format.

Use undo client frame-format to restore the default.

Syntax

client frame-format { dot3 | dot11 }

undo client frame-format

Default

Client data frames are encapsulated in 802.3 format.

Views

Service template view

Predefined user roles

network-admin

mdc-admin

Parameters

dot3: Specifies the 802.3 format.

dot11: Specifies the 802.11 format.

Usage guidelines

Make sure the service template is disabled before you execute this command.

This command takes effect only in centralized forwarding mode.

Examples

# Configure the client data frames to be encapsulated in 802.11 format.

<Sysname> system-view

[Sysname] wlan service-template s1

[Sysname-wlan-st-s1] client frame-format dot11

Related commands

client forwarding-location

WLAN access commands -- client idle-timeout (on ACs)

Use client idle-timeout to set the client idle timeout timer.

Use undo client idle-timeout to restore the default.

Syntax

client idle-timeout timeout

undo client idle-timeout

Default

In AP view, the AP uses the configuration in AP group view.

In AP group view, the client idle timeout timer is 3600 seconds.

Views

AP view

AP group view

Predefined user roles

network-admin

mdc-admin

Parameters

timeout: Specifies the client idle timeout timer in the range of 60 to 86400 seconds.

Usage guidelines

If an online client does not send any frames to the associated AP before the client idle timeout timer expires, the AP logs off the client.

Examples

# Set the client idle timeout timer to 2000 seconds for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-ACN

[Sysname-wlan-ap-ap1] client idle-timeout 2000

# Set the client idle timeout timer to 2000 seconds for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client idle-timeout 2000

WLAN access commands -- client keepalive (on ACs)

Use client keepalive enable to enable client keepalive.

Use client keepalive disable to disable client keepalive.

Use undo client keepalive to restore the default.

Syntax

client keepalive { disable | enable }

undo client keepalive

Default

In AP view, the AP uses the configuration in AP group view.

In AP group view, client keepalive is disabled.

Views

AP view

AP group view

Predefined user roles

network-admin

mdc-admin

Parameters

disable: Disables client keepalive.

enable: Enables client keepalive.

Usage guidelines

This feature enables an AP to send keepalive packets to clients at the client keepalive interval to determine whether the clients are online. If the AP does not receive any replies from a client within three keepalive intervals, it logs off the client.

Examples

# Enable client keepalive for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-ACN

[Sysname-wlan-ap-ap1] client keepalive enable

# Enable client keepalive for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client keepalive enable

Related commands

client keepalive interval

WLAN access commands -- client keepalive interval (on ACs)

Use client keepalive interval to set the client keepalive interval.

Use undo client keepalive interval to restore the default.

Syntax

client keepalive interval interval

undo client keepalive interval

Default

In AP view, the AP uses the configuration in AP group view.

In AP group view, the client keepalive interval is 300 seconds.

Views

AP view

AP group view

Predefined user roles

network-admin

mdc-admin

Parameters

interval: Specifies the client keepalive interval in the range of 3 to 1800 seconds.

Usage guidelines

This command enables an AP to send keepalive packets to clients at the client keepalive interval to determine whether the clients are online. If the AP does not receive any replies from a client within three keepalive intervals, it logs off the client.

Enable client keepalive before you execute this command.

Examples

# Set the keepalive interval to 20 seconds for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-ACN

[Sysname-wlan-ap-ap1] client keepalive 20

# Set the keepalive interval to 20 seconds for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client keepalive interval 20

Related commands

client keepalive enable

WLAN access commands -- display wlan blacklist

Use display wlan blacklist to display blacklist entries.

Syntax

display wlan blacklist { dynamic | static }

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

dynamic: Specifies the dynamic blacklist.

static: Specifies the static blacklist.

Examples

# Display static blacklist entries.

<Sysname> display wlan blacklist static

Total number of clients: 3

MAC addresses:

000e-35b2-000e

0019-5b8e-b709

001c-f0bf-9c92

# Display dynamic blacklist entries.

<Sysname> display wlan blacklist dynamic

Total number of clients: 3

MAC address APID Lifetime (s) Duration (hh:mm:ss)

000f-e2cc-0001 1 300 00:02:11

000f-e2cc-0002 2 300 00:01:17

000f-e2cc-0003 3 300 00:02:08

Table 1 Command output

Field | Description
MAC address | Client MAC address.
APID | ID of the AP that detects the rogue client.
Lifetime (s) | Lifetime of the entry in seconds.
Duration (hh:mm:ss) | Duration for the entry since the entry was added to the dynamic blacklist.

WLAN access commands -- display wlan client

Use display wlan client to display client information.

Syntax

ACs:

display wlan client [ ap ap-name [ radio radio-id ] | mac-address mac-address | service-template service-template-name ] [ verbose ]

Fat APs:

display wlan client [ interface wlan-radio interface-num ber | mac-address mac-address | service-template service-template-name ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

ap ap-nam e: Displays information about clients that are connected to the specified AP. The AP name is a case-insensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-). (ACs.)

radio radio-id: Displays information about clients that are connected to the specified radio. The value range for the radio-id argument varies by device model. If you do not specify this option, the command displays information about all clients that are connected to the specified AP. (ACs.)

wlan-radio interface-number: Displays information about clients that are connected to the specified radio interface. (Fat APs.)

mac-address mac-address: Specifies a client by its MAC address.

service-template service-template-name: Displays information about clients that are associated with the specified service template. The service template name is a case-insensitive string of 1 to 63 characters.

verbose: Displays detailed client information. If you do not specify this keyword, the command displays brief client information.

Examples

# Display brief information about all clients.

<Sysname> display wlan client

Total number of clients: 3

MAC address Username APID/RID IP address VLAN ID

000f-e265-6400 N/A 1/1 1.1.1.1 100

000f-e265-6401 user 1024/1 3.0.0.3 200

000f-e265-6402 abcde 102/1 FE:11:12:03::11:25:13 300

Table 2 Command output

Field | Description
MAC address | Client MAC address.
Username | Client username: · The field displays the client username if the client uses 802.1X or MAC authentication. · The field displays N/A if the client does not use 802.1X or MAC authentication. NOTE: If the client uses portal authentication, this field does not display the portal username of the client.
APID/RID | ID of the AP or radio that the client is associated with.
IP address | IP address of the client.
VLAN ID | ID of the VLAN to which the client belongs.

# Display detailed information about all clients.

<Sysname> display wlan client verbose

Total number of clients: 1

MAC address : 000f-e265-6400

IPv4 address : 10.1.1.114

IPv6 address : 2001::1234:5678:0102:0304

Username : N/A

AID : 1

AP ID : 1

AP name : ap1

Radio ID : 1

SSID : office

BSSID : 0026-3e08-1150

VLAN ID : 3

Power save mode : Active

Wireless mode : 802.11ac

Channel bandwidth : 80MHz

SM power save : Enabled

SM power save mode : Dynamic

Short GI for 20MHz : Supported

Short GI for 40MHz : Supported

Short GI for 80MHz : Supported

Short GI for 160/80+80MHz : Not supported

STBC RX capability : Not supported

STBC TX capability : Not supported

LDPC RX capability : Not supported

SU beamformee capability : Not supported

MU beamformee capability : Not supported

Beamformee STS capability : N/A

Block Ack : TID 0 In

Supported VHT-MCS set : NSS1 0, 1, 2, 3, 4, 5, 6, 7, 8

NSS2 0, 1, 2, 3, 4, 5, 6, 7, 8

Supported HT MCS set : 0, 1, 2, 3, 4, 5, 6, 7,

8, 9, 10, 11, 12, 13, 14,

15, 16, 17, 18, 19, 20,

21, 22, 23

Supported rates : 6, 9, 12, 18, 24, 36,

48, 54 Mbps

QoS mode : WMM

Listen interval : 10

RSSI : 62

Rx/Tx rate : 130/11

Authentication method : Open system

Security mode : PRE-RSNA

AKM mode : N/A

Cipher suite : N/A

User authentication mode : Bypass

Authorization ACL ID : 3001(Not effective)

Authorization user profile : N/A

Roam status : N/A

Key derivation : SHA1

PMF status : Enabled

Forward policy : N/A

Online time : 0days 0hours 1minutes 13seconds

FT status : Inactive

Table 3 Command output

Field | Description
MAC address | Client MAC address.
IPv4 address | Client IPv4 address.
IPv6 address | Client IPv6 address.
Username | Client username: · The field displays the client username if the client uses 802.1X or MAC authentication. · The field displays N/A if the client does not use 802.1X or MAC authentication. NOTE: If the client uses portal authentication, this field does not display the portal username of the client.
AID | Association ID.
AP ID | ID of the AP that the client is associated with.
AP name | Name of the AP that the client is associated with.
Radio ID | ID of the radio that the client is associated with.
SSID | SSID with which the client is associated.
VLAN ID | ID of the VLAN to which the client belongs.
Power save mode | Power saving mode of the client: Active or Sleep.
Wireless mode | Wireless mode: 802.11a, 802.11b, 802.11g, 802.11gn, 802.11an, or 802.11ac.
Channel bandwidth | Channel bandwidth: 20 MHz, 40 MHz, 80 MHz, or 160 MHz.
SM Power Save | SM Power Save enables only one antenna of a client to operate in active state, and others to operate in sleep state to save power. · Enabled—SM Power Save is enabled. · Disabled—SM Power Save is disabled.
SM power save mode | Power saving mode: Dynamic or Static.
Short GI for 20MHz | Whether the client supports short GI when its channel bandwidth is 20 MHz: Supported or Not supported.
Short GI for 40MHz | Whether the client supports short GI when its channel bandwidth is 40 MHz: Supported or Not supported.
Short GI for 80MHz | Whether the client supports short GI when its channel bandwidth is 80 MHz: Supported or Not supported.
Short GI for 160/80+80MHz | Whether the client supports short GI when its channel bandwidth is 160 MHz or 80 + 80 MHz: Supported or Not supported.
STBC Rx Capability | Client STBC receive capability: Supported or Not supported.
STBC Tx Capability | Client STBC transmission capability: Supported or Not supported.
LDPC Rx capability | Client LDPC receive capability: Supported or Not supported.
SU beamformee capability | Client SU beamformee capability: Supported or Not supported.
MU beamformee capability | Client MU beamformee capability: Supported or Not supported.
Beamformee STS capability | Client beamformee STS capability: Supported or Not supported.
Block Ack | Negotiation result of Block ACK with TID: · IN—Sends Block ACK for inbound traffic. · OUT—Sends Block ACK for outbound traffic. · BOTH—Sends Block ACK for both inbound and outbound traffic.
Supported VHT-MCS set | VHT-MCS supported by the client.
Supported HT MCS set | HT-MCS supported by the client.
QoS mode | QoS mode: · N/A—WMM is not supported. · WMM—WMM is supported. WMM information negotiation is carried out between an AP and a client that both support WMM.
Listen interval | Interval at which the client wakes up to listen for beacon frames. It is counted by beacon interval.
RSSI | Received signal strength indication. This value indicates the client signal strength detected by the AP.
Rx/Tx rate | Sending and receiving rates of data, management, and control frames.
Authentication method | Authentication method: Open system or Shared key.
Security mode | Security mode: · RSN—Beacons and probe responses carry RSN IE. · WPA—Beacons and probe responses carry WPA IE. · PRE-RSN—Beacons and probe responses do not carry RSN IE or WPA IE.
AKM mode | AKM mode: 802.1X or PSK.
Cipher suite | Cipher suite: N/A, WEP40, WEP104, WEP128, CCMP, or TKIP.
User authentication mode | User authentication mode: · Bypass—No client authentication. · MAC. · 802.1X. · OUI.
Authorization ACL ID | Authorized ACL number: · This field displays the ACL number if the authorized ACL takes effect. · This field displays ACL number(Not effective) if the authorized ACL does not take effect. · This field displays N/A if the authentication server is configured without any authorized ACL.
Authorization user profile | Name of the authorized user profile: · This field displays the authorized user profile name if the authorized user profile takes effect. · This field displays authorized user profile name + Not effective if the authorized user profile does not take effect. · This field displays N/A if the authentication server is configured without any authorized user profile.
Roam status | Roam status: · Roaming in progress. · Inter-AC slow roaming. · Inter-AC fast roaming. · Intra-AC slow roaming. · Intra-AC fast roaming. · This field displays N/A if the client stays in one BSS after coming online.
Key derivation | Key derivation type: · SHA1—Uses the HMAC-SHA1 hash algorithm. · SHA256—Uses the HMAC-SHA256 hash algorithm. · N/A—No key derivation algorithm is involved for the authentication type.
PMF status | PMF status: · Enabled—Management frame protection is enabled. · Disabled—Management frame protection is disabled. · N/A—Management frame protection is not involved.
Forward policy | WLAN forwarding policy: · N/A—No WLAN forwarding policy is configured. · Policy-name.
Online time | Client online duration.
FT status | Fast BSS transition (FT): · Active—FT is enabled. · Inactive—FT is disabled.

WLAN access commands -- display wlan region-code

Use display wlan region-code to display region code information for all APs or the specified AP.

Syntax

display wlan region-code ap { all | name ap-name }

Views

Any view

Predefined user roles

network-admin

mdc-admin

Parameters

all: Specifies all APs.

name ap-name: Specifies an AP by its name, a case-insensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-).

Examples

# Display region code information for all APs.

<Sysname> display wlan region-code ap all

Region Code

-----------------------------------------------------------------------

AP name Region Code

-----------------------------------------------------------------------

ap1 CN CHINA

ap2 CN CHINA

ap3 CN CHINA

Table 4 Command output

Field | Description
Region Code | Region code. For more information about region codes, see Table 7.

WLAN access commands -- display wlan service-template

Use display wlan service-template to display service template information.

Syntax

display wlan service-template [ service-template-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters. If you do not specify this argument, the command displays information about all service templates.

Examples

# Display information about all service templates.

<Sysname> display wlan service-template

Service template name : service1

SSID : wuxianfuwu

SSID-hide : Disabled

User-isolation : Disabled

Service template status : Disabled

Maximum clients per BSS : 64

Frame format : Dot3

Seamless-roam : Disabled

Seamless-roam RSSI threshold : 50

Seamless-roam RSSI gap : 20

VLAN ID : 1

AKM mode : PSK

Security IE : RSN

Cipher suite : WEP40

WEP key ID : 1

TKIP countermeasure time : 100 sec

PTK lifetime : 43200 sec

GTK rekey : Enabled

GTK rekey method : Time-based

GTK rekey time : 86400 sec

GTK rekey client-offline : Enabled

User authentication mode : 802.1X

Intrusion protection : Disabled

Intrusion protection mode : Temporary-block

Temporary block time : 180 sec

Temporary service stop time : 20 sec

Fail VLAN ID : 1

802.1X handshake : Enabled

802.1X handshake secure : Disabled

802.1X domain : my-domain

MAC-auth domain : Not configured

Max 802.1X users : 4096

Max MAC-auth users : 4096

802.1X re-authenticate : Enabled

Authorization fail mode : Online

Accounting fail mode : Online

Authorization : Permitted

Key derivation : SHA1

PMF status : Optional

Hotspot policy number : Not configured

Forward policy : Not configured

FT status : Enabled

FT method : over-the-air

FT reassociation deadline : 20 sec

QoS trust : Port

QoS priority : 0

Table 5 Command output

Field | Description
SSID | SSID of the service template.
SSID-hide | Whether the SSID is hidden in beacons: Disabled or Enabled.
User-isolation | Use isolation: Disabled or Enabled.
Service template status | Service template status: Disabled or Enabled.
Maximum clients per BSS | Maximum number of clients that the BSS supports.
Frame format | Client data frame encapsulation format: · Dot3—802.3 format. · Dot11—802.11 format.
Seamless-roam | Seamless roaming: Disabled or Enabled. This field is not supported in the current software version.
Seamless-roam RSSI threshold | Seamless roaming RSSI threshold. This field is not supported in the current software version.
Seamless-roam RSSI gap | Seamless roaming RSSI gap. This field is not supported in the current software version.
VLAN ID | ID of the VLAN bound to the service template.
AKM mode | AKM mode: 802.1X or PSK.
Security IE | Security IE: RSN or WPA.
Cipher suite | Cipher suite: WEP40, WEP104, WEP128, TKIP, or CCMP.
TKIP countermeasure time | TKIP countermeasure time. The value 0 indicates no countermeasures are taken.
GTK rekey | Whether GTK rekey is enabled: Disabled or Enabled.
GTK rekey method | GTK rekey method: Time-based or Packet-based.
GTK rekey time | GTK rekey interval.
GTK rekey packets | Number of packets that can be transmitted before the GTK is refreshed.
GTK rekey client-offline | Whether client-off GTK rekey is enabled: Disabled or Enabled.
User authentication mode | Authentication mode: · Bypass—No authentication. · MAC. · MAC-or-802.1X—MAC authentication is performed first. If MAC authentication fails, 802.1X authentication is performed. · 802.1X. · 802.1X-or-MAC—802.1X authentication is performed first. If 802.1X authentication fails, MAC authentication is performed. · OUI-or-802.1X—OUI authentication is performed first. If OUI authentication fails, 802.1X authentication is performed.
Intrusion protection | Whether intrusion protection is enabled: Disabled or Enabled.
Intrusion protection mode | Intrusion protection mode: · Temporary-block—Temporarily adds intruders to the block list. · Service-stop—Stops all services provided by the BSS that receives illegal packets until it resets. · Temporary-service-stop—Temporarily stops the access service provided by the BSS that receives illegal packets.
Temporary block time | Temporary block time in seconds.
Temporary service stop time | Temporary service stop time in seconds.
Fail VLAN ID | ID of the VLAN to which clients are added if they cannot pass the authentication when the authentication server can be reached. This field displays Not configured if the fail VLAN ID is not configured.
Critical VLAN ID | ID of the VLAN to which clients are added if they cannot pass the authentication because the authentication server cannot be reached. This field displays Not configured if the critical VLAN ID is not configured.
802.1X handshake | Whether 802.1X handshake is enabled: Disabled or Enabled.
802.1X handshake secure | Whether secure 802.1X handshake is enabled: Disabled or Enabled.
802.1X domain | 802.1X authentication domain. This field displays Not configured if the domain is not configured.
MAC-auth domain | MAC authentication domain. This field displays Not configured if the domain is not configured.
Max 802.1X users | Maximum number of supported 802.1X users.
Max MAC-auth users | Maximum number of supported users that pass the MAC authentication.
802.1X re-authenticate | Whether 802.1X reauthentication is enabled: Disabled or Enabled.
Authorization fail mode | Authorization fail mode: · Offline—Clients are logged off when authorization fails. · Online—Clients are not logged off when authorization fails.
Accounting fail mode | Accounting fail mode: · Offline—Clients are logged off when accounting fails. · Online—Clients are not logged off when accounting fails.
Authorization | Authorization information: · Permitted—Applies the authorization information issued by the RADIUS server or the local device. · Ignored—Ignores the authorization information issued by the RADIUS server or the local device.
Key derivation | Key derivation type: · SHA1—Uses the HMAC-SHA1 hash algorithm. · SHA256—Uses the HMAC-SHA256 hash algorithm. · SHA1-AND-SHA256—Uses the HMAC SHA1 and SHA256 hash algorithm.
PMF status | PMF status: · Disabled—Management frame protection is disabled. · Optional—Management frame protection in optional mode is enabled. · Mandatory—Management frame protection in mandatory mode is enabled.
Forward policy | WLAN forwarding policy: · Not configured—No WLAN forwarding policy is configured. · Policy-name.
FT status | FT status: Disabled or Enabled.
FT method | FT method: over-the-air or over-the-ds.
FT reassociation deadline | FT reassociation timeout timer in seconds.
QoS trust | QoS priority trust mode: · Port—Port priority trust mode. · Dot11e—802.11e priority trust mode.
QoS priority | Port priority in the range of 0 to 7.

WLAN access commands -- display wlan statistics

Use display wlan statistics to display client statistics or service template statistics.

Syntax

display wlan statistics { ap { all | name ap-name } connect-history | client [ mac-address mac-address ] | service-template service-template-name [ connect-history ] }

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

ap: Specifies APs.

all: Specifies all APs.

name ap-name: Specifies an AP by its name, a case-insensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-).

connect-history: Displays the connection history.

client: Specifies client statistics.

mac-address mac-address: Specifies a client by its MAC address. If you do not specify this option, the command displays statistics for all clients.

service-template service-template-name: Specifies a service template by its name. If you also specify the connect-history keyword, the command displays the connection history for the specified service template.

Examples

# Display statistics for all clients.

<Sysname> display wlan statistics client

MAC address : 0014-6c8a-43ff

AP name : ap1

Radio ID : 1

SSID : office

BSSID : 000f-e2ff-7700

RSSI : 31 dB

Sent frames:

Back ground : 0/0 (frames/bytes)

Best effort : 9/1230 (frames/bytes)

Video : 0/0 (frames/bytes)

Voice : 2/76 (frames/bytes)

Received frames:

Back ground : 0/0 (frames/bytes)

Best effort : 18/2437 (frames/bytes)

Video : 0/0 (frames/bytes)

Voice : 7/468 (frames/bytes)

Discarded frames:

Back ground : 0/0 (frames/bytes)

Best effort : 0/0 (frames/bytes)

Video : 0/0 (frames/bytes)

Voice : 5/389 (frames/bytes)

Table 6 Command output

Field | Description
SSID | SSID of the service template.
MAC address | Client MAC address.
Back ground | AC-BK queue.
Best effort | AC-BE queue.
Video | AC-VI queue.
Voice | AC-VO queue.

# Display statistics for service template 1.

<Sysname> display wlan statistics service-template 1

AP name : ap1

Radio ID : 1

Received:

Frame count : 1713

Frame bytes : 487061

Data frame count : 1683

Data frame bytes : 485761

Association request count : 2

Sent:

Frame count : 62113

Frame bytes : 25142076

Data frame count : 55978

Data frame bytes : 22626600

Association response count : 2

# Display the connection history for service template 1.

<Sysname> display wlan statistics service-template 1 connect-history

AP name : ap1

Radio ID : 1

Associations : 132

Association failures : 3

Reassociations : 30

Rejections : 12

Exceptional deassociations : 2

Current associations : 57

AP name : ap1

Radio ID : 2

Associations : 1004

Association failures : 35

Reassociations : 59

Rejections : 4

Exceptional deassociations : 22

Current associations : 300

# Display the connection history for AP ap1.

<Sysname> display wlan statistics ap name ap1 connect-history

AP name : ap1

Associations : 1

Reassociations : 0

Failures : 0

Rejections : 0

Exceptional deassociations : 0

Current associations : 1

WLAN access commands -- display wlan whitelist

Use display wlan whitelist to display whitelist entries.

Syntax

display wlan whitelist

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Examples

# Display whitelist entries.

<Sysname> display wlan whitelist

Total number of clients: 3

MAC addresses:

000e-35b2-000e

0019-5b8e-b709

001c-f0bf-9c92

WLAN access commands -- inherit exclude service-template

Use inherit exclude service-template to configure an AP to not inherit the specified service template from the AP group to which it belongs.

Use undo inherit exclude service-template to restore the default.

Syntax

inherit exclude service-template service-template-name

undo inherit exclude service-template service-template-name

Default

An AP inherits the service template bound to an AP group.

Views

Radio view

Predefined user roles

network-admin

mdc-admin

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters.

Examples

# Configure AP ap1 to not inherit service template st from an AP group.

<Sysname> system-view

[Sysname] wlan ap ap1

[Sysname-ap-ap1] radio 1

[Sysname-ap-ap1-radio-1] inherit exclude service-template st

WLAN access commands -- map-configuration

Use map-configuration to deploy a configuration file to an AP.

Use undo map-configuration to restore the default.

Syntax

map-configuration filename

undo map-configuration

Default

No configuration file is deployed to an AP.

Views

AP view

Predefined user roles

network-admin

mdc-admin

Parameters

filename: Specifies a configuration file by its name, a case-insensitive string of 1 to 63 characters. Make sure the configuration file is stored in the storage medium of the AC.

Usage guidelines

Contents in the configuration file must be complete commands.

The configuration file takes effect when the CAPWAP tunnel to the AC is in Run state. It does not survive an AP reboot.

An AP can only use its main IP address to establish a CAPWAP tunnel to the AC if the AP is configured by using a configuration file.

Examples

# Deploy configuration file downconfig.txt to AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-ACN

[Sysname-wlan-ap-ap1] map-configuration downconfig.txt

WLAN access commands -- nas-id

Use nas-id to set the network access server identifier (NAS ID).

Syntax

nas-id nas-id

undo nas-id

Default

In AP view, the AP uses the configuration in AP group view. If no configuration exists in AP group view, the AP uses the configuration in global configuration view.

In AP group view, the AP uses the configuration in global configuration view.

In global configuration view, no NAS ID is specified.

Views

AP view

AP group view

Global configuration view

Predefined user roles

network-admin

mdc-admin

Parameters

nas-id: Specifies a NAS ID, a case-sensitive string of 1 to 63 characters.

Usage guidelines

After coming online, a client sends a RADIUS request that carries the NAS ID to the RADIUS server to indicate its network access server.

The priorities for the configuration in AP view, AP group view, and global configuration view are in descending order. You can also set the NAS ID when binding a service template to a radio. If you have specified a NAS ID when binding a service template to a radio, the AP uses the NAS ID specified for the service template.

Examples

# Set the NAS ID to abc123 for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-AGN

[Sysname-wlan-ap-ap1] nas-id abc123

# Set the NAS ID to abc123 for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] nas-id abc123

# Set the global NAS ID to abc123.

<Sysname> system-view

[Sysname] wlan global-configuration

[Sysname-wlan-global-configuration] nas-id abc123

WLAN access commands -- nas-port-id

Use nas-port-id to set the network access server port identifier (NAS port ID).

Use the undo nas-port-id to restore the default.

Syntax

nas-port-id nas-port-id

undo nas-port-id

Default

In AP view, the AP uses the configuration in AP group view. If no NAS ID is specified in AP group view, the AP uses the configuration in global configuration view.

In AP group view, the AP uses the configuration in global configuration view.

In global configuration view, no NAS port ID is specified.

Views

AP view

AP group view

Global configuration view

Predefined user roles

network-admin

mdc-admin

Parameters

nas-port-id: Specifies a NAS port ID, a case-sensitive string of 1 to 63 characters.

Usage guidelines

After coming online, a client sends a RADIUS request that carries the NAS port ID to the RADIUS server to indicate its network access server.

The priorities for the configuration in AP view, AP group view, and global configuration view are in descending order. You can also set the NAS port ID when binding a service template to a radio. If you have specified a NAS port ID when binding a service template to a radio, the AP uses the NAS port ID specified for the service template.

Examples

# Set the NAS port ID to abcd1234 for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-AGN

[Sysname-wlan-ap-ap1] nas-port-id abcd1234

# Set the NAS port ID to abcd1234 for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] nas-port-id abcd1234

# Set the global NAS port ID to abcd1234.

<Sysname> system-view

[Sysname] wlan global-configuration

[Sysname-wlan-global-configuration] nas-port-id abcd1234

WLAN access commands -- quick-association enable

Use quick-association to enable quick association.

Use undo quick-association to disable quick association.

Syntax

quick-association enable

undo quick-association enable

Default

Quick association is disabled.

Views

Service template view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

This command disables APs from performing load balancing or band navigation on clients associated with the specified service template.

Examples

# Enable quick association for service template 1.

<Sysname> system-view

[Sysname] wlan service-template 1

[Sysname-wlan-st-1]quick-association enable

WLAN access commands -- region-code

Use region-code to specify a region code.

Use undo region-code to restore the default.

Syntax

region-code code

undo region-code

Default

In AP view, the AP uses the configuration in AP group view. If no region code is specified in AP group view, the AP uses the configuration in global configuration view.

In AP group view, the AP uses the configuration in global configuration view.

In global configuration view, the region code is CN.

Views

AP view

AP group view

Global configuration view

Predefined user roles

network-admin

mdc-admin

Parameters

code: Specifies a region code. For more information about region codes, see Table 7.

Table 7 Region code information

Country | Code | Country | Code
Andorra | AD | Korea, Republic of Korea | KR
United Arab Emirates | AE | Kenya | KE
Albania | AL | Kuwait | KW
Armenia | AM | Kazakhstan | KZ
Australia | AU | Lebanon | LB
Argentina | AR | Liechtenstein | LI
Australia | AT | Sri Lanka | LK
Azerbaijan | AZ | Lithuania | LT
Bosnia and Herzegovina | BA | Luxembourg | LU
Belgium | BE | Latvia | LV
Bulgaria | BG | Libyan | LY
Bahrain | BH | Morocco | MA
Brunei Darussalam | BN | Monaco | MC
Bolivia | BO | Moldova | MD
Brazil | BR | Macedonia | MK
Bahamas | BS | Macau | MO
Belarus | BY | Martinique | MQ
Belize | BZ | Malta | MT
Canada | CA | Mauritius | MU
Switzerland | CH | Mexico | MX
Cote d'ivoire | CI | Malay Archipelago | MY
Chile | CL | Namibia | NA
China | CN | Nigeria | NG
Colombia | CO | Nicaragua | NI
Costarica | CR | Netherlands | NL
Serbia | RS | Norway | NO
Cyprus | CY | New Zealand | NZ
Czech Republic | CZ | Oman | OM
Germany | DE | Panama | PA
Denmark | DK | Peru | PE
Dominica | DO | Poland | PL
Algeria | DZ | Philippines | PH
Ecuador | EC | Pakistan | PK
Estonia | EE | Puerto Rico | PR
Egypt | EG | Portugal | PT
Spain | ES | Paraguay | PY
Faroe Islands | FO | Qatar | QA
Finland | FI | Romania | RO
France | FR | Russian Federation | RU
Britain | GB | Saudi Arabia | SA
Georgia | GE | Sweden | SE
Gibraltar | GI | Singapore | SG
Greenland | GL | Slovenia | SI
Guadeloupe | GP | Slovak | SK
Greece | GR | San Marino | SM
Guatemala | GT | Salvador | SV
Guyana | GY | Syrian | SY
Honduras | HN | Thailand | TH
Hong Kong | HK | Tunisia | TN
Croatia | HR | Turkey | TR
Hungary | HU | Trinidad and Tobago | TT
Iceland | IS | Taiwan, Province of China | TW
India | IN | Ukraine | UA
Indonesia | ID | United States of America | US
Ireland | IE | Uruguay | UY
Israel | IL | Uzbekistan | UZ
Iraq | IQ | The Vatican City State | VA
Italy | IT | Venezuela | VE
Iran | IR | Virgin Islands | VI
Jamaica | JM | Vietnam | VN
Jordan | JO | Yemen | YE
Japan | JP | South Africa | ZA
Democratic People's Republic of Korea | KP | Zimbabwe | ZW

Usage guidelines

A region code determines characteristics such as available frequencies, available channels, and transmit power level. Set a valid region code before configuring an AP.

The priorities of the configuration in AP view, AP group view, and global configuration view are in descending order.

Examples

# Specify US as the region code for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-ACN

[Sysname-wlan-ap-ap1] region-code US

# Specify US as the region code for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] region-code US

# Specify US as the global region code.

<Sysname> system-view

[Sysname] wlan global-configuration

[Sysname-wlan-global-configuration] region-code US

Related commands

region-code-lock

WLAN access commands -- region-code-lock

Use region-code-lock enable to lock the region code.

Use region-code-lock disable to unlock the region code.

Use undo region-code-lock to restore the default.

Syntax

region-code-lock { disable | enable }

undo region-code-lock

Default

In AP view, the AP uses the configuration in AP group view. If no configuration exists in AP group view, the AP uses the configuration in global configuration view.

In AP group view, the AP uses the configuration in global configuration view.

In global configuration view, the region code is not locked.

Views

AP view

AP group view

Global configuration view

Predefined user roles

network-admin

mdc-admin

Parameters

A locked region code cannot be changed.

The priorities of the configuration in AP view, AP group view, and global configuration view are in descending order.

The region-code-lock enable command does not take effect on an AP if you execute this command without specifying a region code first in AP view. The AP's region code is determined by the region code configuration for the AP group to which the AP belongs, or by the global configuration. The same rule applies to an AP group in the same situation.

Examples

# Lock the region code for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-ACN

[Sysname-wlan-ap-ap1] region-code-lock enable

# Lock the region code for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] region-code-lock enable

# Lock the global region code.

<Sysname> system-view

[Sysname] wlan global-configuration

[Sysname-wlan-global-configuration] region-code-lock enable

Related commands

region-code

WLAN access commands -- reset wlan client

Use reset wlan client to log off a client or all clients.

Syntax

reset wlan client { all | mac-address mac-address }

View

User view

Predefined user roles

network-admin

mdc-admin

Parameters

all: Specifies all clients.

mac-address mac-address: Specifies a client by its MAC address.

Examples

# Log off all clients.

<Sysname> reset wlan client all

Related commands

display wlan client

WLAN access commands -- reset wlan dynamic-blacklist

Use reset wlan dynamic-blacklist to remove the specified client or all clients from the dynamic blacklist.

Syntax

reset wlan dynamic-blacklist [ mac-address mac-address ]

Views

User view

Predefined user roles

network-admin

mdc-admin

Parameters

mac-address mac-address: Specifies a client by its MAC address. If you do not specify this option, the command removes all clients from the dynamic blacklist.

Examples

# Remove all clients from the dynamic blacklist.

<Sysname> reset wlan dynamic-blacklist

# Remove the specified client from the dynamic blacklist.

<Sysname> reset wlan dynamic-blacklist mac-address b8ca-32a2-df69

Related commands

display wlan blacklist

WLAN access commands -- service-template

Use service-template to bind a service template to a radio or a radio interface.

Use undo service-template to unbind a service template from a radio or a radio interface.

Syntax

ACs:

service-template service-template-name [ vlan vlan-id | vlan-group vlan-group-name ] [ nas-id nas-id | nas-port-id nas-port-id ] [ ssid-hide ]

undo service-template service-template-name

Fat APs:

service-template service-template-name

undo service-template service-template-name

Default

In radio view, the AP uses the configuration in AP group view.

In AP group radio view, no service template is bound to a radio.

In radio interface view, no service template is bound to a radio interface.

Views

ACs:

Radio view, AP group radio view

Fat APs:

WLAN-Radio interface view

Predefined user roles

network-admin

mdc-admin

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters.

nas-id nas-id: Specifies a NAS ID, a case-insensitive string of 1 to 63 characters that do not contain spaces.

nas-port-id nas-port-id: Specifies a NAS port ID, a case-insensitive string of 1 to 63 characters that do not contain spaces.

ssid-hide: Hides SSIDs in beacon frames.

vlan vlan-id: Specifies a VLAN to be bound to the radio by its VLAN ID. The value range for this option varies by device model. If you do not specify this option, the radio uses the VLAN bound to the service template. If the specified VLAN does not exist, this command creates the VLAN when clients come online.

vlan-group vlan-group-name: Specifies a VLAN group to be bound to the radio by the VLAN group name, a case-insensitive string of 1 to 16 characters. If you do not specify this option, the radio uses the VLAN bound to the service template. For more information about configuring VLAN groups, see VLAN commands in Layer 2—LAN Switching Command Reference.

Usage guidelines

The VLAN ID or VLAN group configured using this command takes precedence over the VLAN ID configured for a service template.

Before you bind a service template to a radio or a radio interface, you must create the service template.

Examples

# (ACs.) Bind service template service1 and VLAN group vg1 to radio 1.

<Sysname> system-view

[Sysname] wlan ap ap1

[Sysname-ap-ap1] radio 1

[Sysname-ap-ap1-radio-1] service-template service1 vlan-group vg1

# (ACs.) Bind service template service1 and VLAN group vg1 to radio 1 in AP group apgroup1.

<Sysname> system-view

[Sysname] wlan ap-group apgroup1

[Sysname-wlan-ap-group-apgroup1] ap-model WA4620i-ACN

[Sysname-wlan-ap-group-apgroup1-ap-model-WA4620i-ACN] radio 1

[Sysname-wlan-ap-group-apgroup1-ap-model-WA4620i-ACN-radio-1] service-template service1 vlan-group vg1

# (Fat APs.) Bind service template service1 to WLAN-Radio 1/0/1.

<Sysname> system-view

[Sysname] interface wlan-radio 1/0/1

[Sysname-wlan-radio-1] service-template service1

WLAN access commands -- service-template enable

Use service-template enable to enable a service template.

Use undo service-template enable to disable a service template.

Syntax

service-template enable

undo service-template enable

Default

A service template is disabled.

Views

Service template view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

If the number of BSSs on an AC exceeds the limit, you cannot enable a new service template.

Examples

# Enable service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] service-template enable

WLAN access commands -- snmp-agent trap enable wlan client

Use snmp-agent trap enable wlan client to enable SNMP notifications for WLAN access.

Use undo snmp-agent trap enable wlan client to disable SNMP notifications for WLAN access.

Syntax

snmp-agent trap enable wlan client

undo snmp-agent trap enable wlan client

Default

SNMP notifications are disabled for WLAN access.

Views

System view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

To report critical WLAN access events to an NMS, enable SNMP notifications for WLAN access. For WLAN access event notifications to be sent correctly, you must also configure SNMP on the device. For more information about SNMP configuration, see the Network Management and Monitoring Configuration Guide.

Examples

# Enable SNMP notifications for WLAN access.

<Sysname> system-view

[Sysname] snmp-agent trap enable wlan client

WLAN access commands -- ssid

Use ssid to set an SSID for a service template.

Use undo ssid to restore the default.

Syntax

ssid ssid-name

undo ssid

Default

No SSID is configured for a service template.

Views

Service template view

Predefined user roles

network-admin

mdc-admin

Parameters

ssid-name: Specifies an SSID name, a case-sensitive string of 1 to 32 characters.

Usage guidelines

Disable the service template before you execute this command.

Examples

# Set the SSID to lynn for service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] ssid lynn

WLAN access commands -- unknown-client

Use unknown-client to set the way that an AP processes traffic from unknown clients.

Use undo unknown-client to restore the default.

Syntax

unknown-client { deauthenticate | drop }

undo unknown-client

Default

An AP drops packets from unknown clients and deauthenticates these clients.

Views

Service template view

Predefined user roles

network-admin

mdc-admin

Parameters

deauthenticate: Drops packets from unknown clients and deauthenticates these clients.

drop: Drops packets from unknown clients.

Examples

# Configure AP ap1 to drop packets from unknown clients but not deauthenticate these clients.

<Sysname> system-view

[Sysname] wlan service-template example

[Sysname -wlan-st-example] unknown-client drop

WLAN access commands -- vlan

Use vlan to bind a VLAN to a service template.

Use undo vlan to restore the default.

Syntax

vlan vlan-id

undo vlan

Default

VLAN 1 is bound to the service template.

Views

Service template view

Predefined user roles

network-admin

mdc-admin

Parameters

vlan-id: Specifies a VLAN by its VLAN ID, in the range of 1 to 4094. If the specified VLAN does not exist, this command creates the VLAN when clients come online.

Usage guidelines

Clients coming online through a service template are assigned to the VLAN bound to the service template.

Disable the service template before you execute this command.

Examples

# Bind VLAN 2 to service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] vlan 2

WLAN access commands -- wlan broadcast-probe reply (on fat APs)

Use wlan broadcast-probe reply to enable the AP to respond to broadcast probe requests.

Use undo wlan broadcast-probe reply to disable the AP from responding to broadcast probe requests.

Syntax

wlan broadcast-probe reply

undo wlan broadcast-probe reply

Default

The AP responds to broadcast probe requests.

Views

System view

Predefined user roles

network-admin

mdc-admin

Examples

# Disable the AP from responding to broadcast probe requests.

<Sysname> system-view

[Sysname] undo wlan broadcast-probe reply

WLAN access commands -- wlan client forwarding-policy-name (on ACs)

Use wlan client forwarding-policy-name to apply a forwarding policy to a user profile.

Use undo wlan client forwarding-policy-name to restore the default.

Syntax

wlan client forwarding-policy-name policy-name

undo wlan client forwarding-policy-name

Default

No forwarding policy is applied to a user profile.

Views

User profile view

Predefined user roles

network-admin

network-operator

Parameters

policy-name: Specifies a forwarding policy name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

For the AC to perform policy-based forwarding for clients that use a user profile, apply a forwarding policy to the user profile. After a client passes authentication, the authentication server sends the user profile name specified for the client to the AC. The AC will forward traffic of the client based on the forwarding policy applied to the user profile.

For the forwarding policy applied to a user profile to take effect, perform the following tasks for the service template that the user profile uses:

· Enable policy-based forwarding.

· Specify the AC to perform client authentication.

The AC preferentially uses the forwarding policy applied to a user profile to direct client traffic forwarding. If the user profile of a client does not have a forwarding policy applied, the AC uses the forwarding policy applied to the service template.

Examples

# Apply forwarding policy policy-name to user profile profilename.

<Sysname> system-view

[Sysname] user-profile profilename

[Sysname-user-profile-profilename] wlan client forward-policy-name policy-name

Related commands

client forwarding-policy enable

client-security authentication-location

WLAN access commands -- wlan client idle-timeout (on fat APs)

Use wlan client idle-timeout to set the client idle timeout timer.

Use undo wlan client idle-timeout to restore the default.

Syntax

wlan client idle-timeout timeout

undo wlan client idle-timeout

Default

The client idle timeout timer is 3600 seconds.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

timeout: Specifies the client idle timeout timer in the range of 60 to 86400 seconds.

Usage guidelines

If an online client does not send any frames to the associated AP before the client idle timeout timer expires, the AP logs off the client.

Examples

# Set the client idle timeout timer to 2000 seconds.

<Sysname> system-view

[Sysname] wlan client idle-timeout 2000

WLAN access commands -- wlan client keepalive (on fat APs)

Use wlan client keepalive to enable client keepalive and set the client keepalive interval.

Use undo wlan client keepalive to disable client keepalive.

Syntax

wlan client keepalive interval

undo wlan client keepalive

Default

Client keepalive is disabled.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

interval: Specifies the client keepalive interval in the range of 3 to 1800 seconds.

Usage guidelines

This command enables an AP to send keepalive packets to clients at the client keepalive interval to determine whether the clients are online. If the AP does not receive any replies from a client within three keepalive intervals, it logs off the client.

Examples

# Enable client keepalive and set the client keepalive interval to 1000 seconds.

<Sysname> system-view

[Sysname] wlan client keepalive 1000

WLAN access commands -- wlan dynamic-blacklist lifetime

Use wlan dynamic-blacklist lifetime to set the aging time for dynamic blacklist entries.

Use undo wlan dynamic-blacklist lifetime to restore the default.

Syntax

wlan dynamic-blacklist lifetime lifetime

undo wlan dynamic-blacklist lifetime

Default

The aging time is 300 seconds for dynamic blacklist entries.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

lifetime: Specifies the aging time in the range of 1 to 3600 seconds.

Usage guidelines

The configured aging time takes effect only on entries added to the dynamic blacklist after this command is executed.

Examples

# Set the aging time for dynamic blacklist entries to 3600 seconds.

<Sysname> system-view

[Sysname] wlan dynamic-blacklist lifetime 3600

WLAN access commands -- wlan forwarding-policy (on ACs)

Use wlan forwarding-policy to create a forwarding policy and enter its view, or enter the view of an existing forwarding policy.

Use undo wlan forwarding-policy to delete a forwarding policy.

Syntax

wlan forwarding-policy policy-name

undo wlan forwarding-policy policy-name

Default

No forwarding policies are created.

Views

System view

Predefined user roles

network-admin

network-operator

Parameters

policy-name: Specifies a forwarding policy name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

You can create a maximum of 1000 forwarding policies.

Examples

# Create forwarding policy abc and enter its view.

<Sysname> system-view

[Sysname] wlan forwarding-policy abc

[Sysname-wlan-fp-abc]

WLAN access commands -- wlan link-test

Use wlan link-test to test wireless link quality.

Syntax

wlan link-test mac-address

Views

Any view

Predefined user roles

network-admin

mdc-admin

Parameters

mac-address: Specifies the client MAC address in the H-H-H format.

Usage guidelines

Wireless link quality detection enables an AP to test the quality of the link to a wireless client. The AP sends empty data frames to the client at each supported rate. Then it calculates link quality information such as RSSI, packet retransmissions, and RTT based on the responses from the client.

The timeout timer for wireless link quality detection is 10 seconds. If wireless link detection is not completed within the timeout timer, test results cannot be obtained.

Examples

# Test the quality of the wireless link to the client with MAC address 60a4-4cda-eff0.

<Sysname> wlan link-test 60a4-4cda-eff0

Testing link to 60a4-4cda-eff0. Press CTRL + C to break.

Link Status

-----------------------------------------------------------------------

MAC address: 60a4-4cda-eff0

-----------------------------------------------------------------------

VHT-MCS Rate(Mbps) TxCnt RxCnt RSSI Retries RTT(ms)

-----------------------------------------------------------------------

NSS = 1

-----------------------------------------------------------------------

0 32.5 5 5 54 0 0

1 65 5 5 51 0 0

2 97.5 5 5 49 0 0

3 130 5 5 47 0 0

4 195 5 5 45 0 0

5 260 5 5 45 0 0

6 292.5 5 5 44 0 0

7 325 5 5 44 0 0

8 390 5 5 44 0 0

9 433.3 5 5 43 0 0

-----------------------------------------------------------------------

NSS = 2

-----------------------------------------------------------------------

0 65 5 5 44 0 0

1 130 5 5 44 0 0

2 195 5 5 44 0 0

3 260 5 5 44 0 0

4 390 5 5 44 0 0

5 520 5 5 44 0 0

6 585 5 5 43 0 0

7 650 5 5 43 0 0

8 780 5 5 43 0 0

9 866.7 5 5 43 0 0

Table 8 Command output

Field | Description
No./MCS/VHT-MCS | · No.—Rate number for link quality test on 802.11a, 802.11b, or 802.11g clients. · MCS—MCS index for link quality test on 802.11n clients. · VHT-MCS—VHT-MCS index for link quality test on 802.11ac clients.
Rate(Mbps) | Rate at which the AP sends wireless link quality detection frames.
TxCnt | Number of wireless link quality detection frames sent by the AP.
RxCnt | Number of responses received by the AP.
RSSI | RSSI of the client detected by the AP.
Retries | Number of wireless link quality retransmission frames sent by the AP.
RTT(ms) | Round trip time for link quality test frames from the AP to the client.
NSS | Number of spatial streams for link quality test on 802.11n or 802.11ac clients.

WLAN access commands -- wlan permit-ap-group

Use wlan permit-ap-group to specify a permitted AP group for client association.

Use undo permit-ap-group to delete a permitted AP group.

Syntax

wlan permit-ap-group ap-group-name

undo wlan permit-ap-group [ ap-group-name ]

Default

No permitted AP group is specified for client association.

Views

User profile view

Predefined user roles

network-admin

mdc-admin

Parameters

ap-group-name: Specifies an AP group by its name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

If no permitted AP group is specified for client association, client access is not restricted.

If you specify a permitted AP group for client association, clients can only associate with APs in the AP group.

The undo form of the command deletes all permitted AP groups if you do not specify the ap-group-name argument.

Examples

# Specify AP group group1 as the permitted AP group for client association.

<Sysname> system-view

[Sysname] user-profile profile1

[Sysname-user-profile-profile1] wlan permit-ap-group group1

WLAN access commands -- wlan permit-ssid

Use wlan permit-ssid to specify a permitted SSID for client association.

Use undo permit-ssid to delete a permitted SSID.

Syntax

wlan permit-ssid ssid-name

undo wlan permit-ssid [ ssid-name ]

Default

No permitted SSID is specified for client association.

Views

User profile view

Predefined user roles

network-admin

mdc-admin

Parameters

ssid-name: Specifies an SSID by its name, a case-sensitive string of 1 to 32 characters.

Usage guidelines

If no permitted SSID is specified for client association, client association is not restricted.

If you specify a permitted SSID for client association, clients can only associate with WLANs through the SSID.

The undo form of the command deletes all permitted SSIDs if you do not specify the ssid-name argument.

Examples

# Specify SSID ssid1 as the permitted SSID for client access.

<Sysname> system-view

[Sysname] user-profile profile1

[Sysname-user-profile- profile1] wlan permit-ssid ssid1

WLAN access commands -- wlan service-template

Use wlan service-template to create a service template and enter its view, or enter the view of an existing service template.

Use undo wlan service-template to delete a service template.

Syntax

wlan service-template service-template-name

undo wlan service-template service-template-name

Default

No service template exists.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters.

Usage guidelines

You cannot delete a service template that has been bound to a radio.

Examples

# Create service template service1 and enter its view.

<Sysname> system-view

[Sysname] wlan service-template service1

WLAN access commands -- wlan static-blacklist mac-address

Use wlan static-blacklist mac-address to add a client to the static blacklist.

Use undo wlan static-blacklist mac-address to remove a client from the static blacklist.

Syntax

wlan static-blacklist mac-address mac-address

undo wlan static-blacklist [ mac-address mac-address ]

Default

No clients exist in the static blacklist.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

mac-address mac-address: Specifies a client by its MAC address in H-H-H format.

Usage guidelines

If you add an online client to the static blacklist, the command logs off the client.

You cannot add a client to both the whitelist and the static blacklist.

The undo form of the command removes all clients from the static blacklist if you do not specify the mac-address mac-address option.

Examples

# Add MAC address 001c-f0bf-9c92 to the static blacklist.

<Sysname> system-view

[Sysname] wlan static-blacklist mac-address 001c-f0bf-9c92

Related commands

display wlan blacklist

WLAN access commands -- wlan whitelist mac-address

Use wlan whitelist mac-address to add a client to the whitelist.

Use undo wlan whitelist mac-address to remove a client from the whitelist.

Syntax

wlan whitelist mac-address mac-address

undo wlan whitelist [ mac-address mac-address ]

Default

No clients exist in the whitelist.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

mac-address mac-address: Specifies a client by its MAC address in H-H-H format.

Usage guidelines

When you add the first client to the whitelist, the system asks you whether to disconnect all online clients. Enter Y at the prompt to configure the whitelist.

If you remove an online client from the whitelist, the command logs off the client. If you remove all clients from the whitelist, online clients will not be logged off.

You cannot add a client to both the whitelist and the static blacklist.

The undo form of the command removes all clients from the whitelist if you do not specify the mac-address mac-address option.

Examples

# Add MAC address 001c-f0bf-9c92 to the whitelist.

<Sysname> system-view

[Sysname] wlan whitelist mac-address 001c-f0bf-9c92

This command will disconnect all clients. Continue? [Y/N]:

Related commands

display wlan whitelist