![background image](http://html1.mh-extra.com/html/amx/nxa-wapzd1000/nxa-wapzd1000_operation-reference-manual_2937893021.webp)
Installation and Setup
17
NXA-WAPZD1000 ZoneDirector Smart WLAN Controller
About Wireless WLAN Security
When you connect to the NXA-WAPZD1000 for the first time and run the Setup Wizard, you are prompted to
set up two basic WLAN configurations -- an Internal WLAN for your internal users, and a Guest WLAN for
guests. By default, authorized users connect to your internal WLAN, and visitors to your organization connect
to the Guest WLAN. You can create additional WLANs and WLAN groups for more specific roles.
One of the first things you should do once your device is installed is decide on which methods of
authentication and encryption to use for regular internal users and for guests.
Authentication options include:
Open (no authentication)
Shared (a single key shared among all users)
802.1X EAP
MAC Address
Encryption options depend on which type of authentication is chosen. Even with Open authentication, you can
still encrypt WLAN traffic using WPA, WPA2 or WEP encryption. If you choose Shared authentication, you
will only be able to use WEP encryption, because WPA and WPA2 use unique dynamically generated keys.
WPA/WPA2 provides increased security, but limits flexibility because some client devices do not support the
newer standards.
Certificate-based 802.1X EAP is a very secure authentication/encryption method that requires a backend
authentication server such as RADIUS, Active Directory or other LDAP (Lightweight Directory Access
Protocol) server. Your choice mostly depends on what kinds of authentication your users' client devices
support.
One drawback to 802.1X is the more labor-intensive setup, which can require (among other tasks) the transfer
of root certificate copies to your users, who must then import the certificates into their client devices. This task
can be automated by using the Wireless Zero-IT Activation, which significantly reduces the amount of setup
required.
Finally, you can choose to authenticate clients by MAC address. This can be used to allow or deny access to
clients based on their MAC addresses. Of course, it also requires that each authorized client’s MAC address be
listed in an authentication database.
Enabling Smart Redundancy
The NXA-WAPZD1000’s Smart Redundancy feature allows two devices to be configured as a redundant pair,
with one unit actively managing your network while the other serves as a backup in standby mode, ready to
take over if the first device fails or loses power.
Each NXA-WAPZD1000 will either be in active or standby state. If the active device fails, the standby device
becomes active. When the original active device recovers, it automatically assumes the standby state as it
discovers an already active device on the network.
The NXA-WAPZD1000 in active state manages all APs and client connections. The device in standby state is
responsible for monitoring the health of the active unit and periodically synchronizing its settings to match
those of the active device. The device in standby state will not respond to Discovery requests from APs and
changing from active to standby state will release all associated APs.
When failover occurs, all associated APs will continue to provide wireless service to clients during the
transition, and will associate to the newly active NXA-WAPZD1000 within approximately one minute.
Configuring the NXA-WAPZD1000 for Smart Redundancy
For management convenience, both NXA-WAPZD1000s in a Smart Redundancy deployment can be managed
via a single shared IP address. In this situation, three IP addresses would need to be configured:
Primary device’s real address
Backup device’s real address
Management address
All configuration changes are made to the active NXA-WAPZD1000 and synchronized to the standby unit.
The user can access the Browser-Based Configuration Pages from any of the three IP addresses, however not
all configuration options are available from the standby device.
Summary of Contents for NXA-WAPZD1000
Page 4: ......
Page 12: ...viii NXA WAPZD1000 ZoneDirector Smart WLAN Controller Table of Contents ...
Page 16: ...Introduction 12 NXA WAPZD1000 ZoneDirector Smart WLAN Controller ...
Page 130: ...Blocking Client Devices 126 NXA WAPZD1000 ZoneDirector Smart WLAN Controller ...
Page 146: ...Smart Mesh Networking Best Practices 142 NXA WAPZD1000 ZoneDirector Smart WLAN Controller ...
Page 153: ...Troubleshooting 149 NXA WAPZD1000 ZoneDirector Smart WLAN Controller ...