3Com OfficeConnect WX1200 Release Note Download Page 26

26

W

IRELESS

 LAN S

WITCH

 

AND

 C

ONTROLLER

 MSS V

ERSION

 3.0 R

ELEASE

 N

OTES

Deleting a user group or MAC user group does 
not delete membership from its members. 
(14833)

If you type the 

clear usergroup

 or 

clear mac-user-

group

 command to delete a user group or MAC user 

group, the 

display aaa

 command shows that the 

user group is gone. However, the user profiles for the 
users still list them as members of the deleted groups.

Use the 

clear user group

 and 

clear mac-user group

 

commands in addition to the 

clear usergroup

 and 

clear mac-usergroup

 commands to explicitly remove 

individual users or MAC users from a group.

Incorrect zero value for Acct-Authentic appears 
in accounting statistics. (14851)

In the output of the 

display accounting statistics

 

command, the Acct-Authentic field in accounting 
records always displays 0 (zero) to indicate the loca-
tion where a user was authenticated for the session. 
The correct value is 1 (one) if RADIUS performed 
authentication or 2 if authentication took place in the 
local WX database.

Ignore the Acct-Authentic value in 

display account-

ing statistics

 output.

The display radius command is not documented 
and has no output. (18233)

Web AAA Issues

Web AAA users receive page not found error if 
RADIUS is the authentication method. (17752)

If you use a RADIUS server group as the authentica-
tion method for Web AAA users, the user receives a 
page not found error in their browser after entering 
their username and password. This issue does not 
affect local authentication.

The message can safely be ignored. Web AAA is com-
pleted and the user is placed on the proper VLAN in 
spite of the error message displayed on the browser. 
Open a new browser window about 20 seconds after 
entering the username and password. Alternatively, 
use local authentication. 

Web AAA is not supported for wired 
authentication clients. (17934) 

Clients receive page not found error if RADIUS is 
used for Web AAA authentication. (17752)

Normally, when a client logs in using a Web AAA 
page, the WX switch should display a message 
informing the client that they will be redirected 
shortly. This works as expected when the local data-
base is used to authenticate the Web AAA client. 
However, if RADIUS is used, the client instead receives 
a page not found error in the browser. 

Wait for 20 seconds for the login to complete, then 
close and reopen the browser. 

Summary of Contents for OfficeConnect WX1200

Page 1: ...cting exe that you have downloaded from the 3Com Web site Points to Note when using the WX1200 and WX4400 Follow these best practice recommendations during configuration and implementation to avoid or...

Page 2: ...le below lists the NICs that have been used successfully with MSS The majority were tested using recently available drivers using the Microsoft native 802 1X client and a Microsoft IAS RADIUS server 3...

Page 3: ...ds that you set up a sepa rate service profile for WPA CCMP with a different SSID for compatibility If you are migrating from Dynamic WEP to WPA TKIP 3Com recommends creat ing separate service profile...

Page 4: ...e to the client through the MAP for the duration of the 802 1X quiet period timer which defaults to 60 seconds An error mes sage indicating that a client has failed authorization appears in the WX swi...

Page 5: ...Some drivers install this automatically if you run the setup exe utility to install the driver 3Com strongly recommends that you update the driver manually using the driver properties in the Network c...

Page 6: ...ble WEP encryption When using dynamic WEP in Windows 2000 select static WEP 128bit and enter any static WEP key as a placeholder This temporary key configures the driver to use WEP to encrypt packets...

Page 7: ...the current Panther client If you need to run both WPA TKIP and Dynamic WEP at the same time you must configured separate service profiles for each encryption type in order to maintain compatibility w...

Page 8: ...KB826942 or Hotfix KB822596 Windows 2000 requires hotfix KB822596 Using PEAP MS CHAP V2 with computer authenti cation will allow users who have never logged on to a PC authenticate wirelessly without...

Page 9: ...LDAP with specific protocols as noted in the table The tests were initially performed using Dynamic WEP though subsequent testing has revealed no noticeable differ ences in RADIUS compatibility when...

Page 10: ...pe in this case Dynamic WEP Additionally compatibility with wireless NICs is reduced Downloading the latest drivers for your wireless NIC is strongly recommended See 802 1X Cli ents for specific infor...

Page 11: ...rmation Security Best Practices MSS and 3WXM provide robust options for securing management access to WX switches and to the 3WXM client and 3WXM monitoring service To opti mize security for managemen...

Page 12: ...SNMP if not already disabled use the set ip snmp server disable command To change the community strings use the set snmp community command CLI Access MSS allows CLI access through the console through...

Page 13: ...the one where you installed the certificate signed by the CA Communication between the WX Switch and 3WXM or Web Manager Administration certificate requirement 11974 Before the WX switch can communica...

Page 14: ...atedly disables and reenables the link caus ing STP to repeatedly stop the other device s port from forwarding traffic As a result the boot attempt is never successful To allow a MAP to boot over a li...

Page 15: ...c For a user ACL to take effect you must explicitly set both the source and destina tion addresses in the ACL Add Authentication Rules for Last Resort Access to Any SSID Last resort authentication is...

Page 16: ...o use these strings you will need to con figure them manually To configure an SNMP commu nity string use the set snmp community command The quickstart command prompts for time and date parameters 1817...

Page 17: ...ng on the license WX1200 20 configured 12 active Includes directly attached MAPs and Distributed MAPs Inactive configurations are backups Minimum link speed within a Mobility Domain 128 Kbps Network P...

Page 18: ...t 18367 MSS can tunnel traffic for a VLAN through a WX switch that does not have that VLAN statically config ured If you attempt to add a static VLAN to a switch that is already tunneling traffic for...

Page 19: ...ed Below is an example of the error message This applies to both MX1200 and MX4400 Example Starting supervisor 3 0 3 0_110304_WX1200 SPAN Nov 05 07 01 44 073135 ERROR SPAN_VLAN_ERR span_port_change po...

Page 20: ...port group before you add the groups ports to the VLAN then add the port group to the VLAN MAP Issues WX1200 allows configuration of ports 7 and 8 as MAP access ports 18280 Ports 7 and 8 on the WX120...

Page 21: ...e to the additional messages sent by 802 11b g radios When the radio enters protection mode a message such as the following appears in the WX switch s log buffer MAP Jul 09 21 01 36 845822 WARNING Por...

Page 22: ...tem IP address from 3WXM causes the switch to be unmanageable from 3WXM 18414 If you use 3WXM to change a managed switch s system name or system IP address other changes to the switch are not received...

Page 23: ...conds with the following command set arp agingtime 1200 Logging in to SSH requires hitting Enter twice 15613 When you start an SSH session with a WX switch the switch does not display the login prompt...

Page 24: ...rt become congested and another instance of the RADIUS server on the same machine is configured to use a different UDP port number MSS does not allow you to specify the UDP port number of a RADIUS ser...

Page 25: ...s However the commands that con figure MAC Web and last resort network access rules accept the value This is an invalid configuration and can provide unexpected results The command for configuring 802...

Page 26: ...tatistics output The display radius command is not documented and has no output 18233 Web AAA Issues Web AAA users receive page not found error if RADIUS is the authentication method 17752 If you use...

Page 27: ...he ACE name that starts with abc which is not a CLI keyword is accepted WX1200 set security acl ip port_abc deny 0 0 0 0 255 255 255 255 error Wrong ACL name input port_abc WX1200 set security acl ip...

Page 28: ...tream through a MAP stop receiving the stream if one of the clients leaves the group Do not disable IGMP snooping The feature is enabled by default Invalid IP multicast forwarded 12784 IGMP multicast...

Reviews: