Access Point CLI Commands 145
B CLI for AP Configuration
1. Set the Security Mode
DLINK-AP#
set interface wlan0 security wpa-enterprise
2. Set the WPA versions based on what types of client stations you want to support.
-
WPA—If all client stations on the network support the original WPA but none support
the newer WPA2, then use WPA.
set bss wlan0bssvap0 wpa-allowed on
set bss wlan0bssvap0 wpa2-allowed off
-
WPA2—If all client stations on the network support WPA2, we suggest using WPA2
which provides the best security per the IEEE 802.11i standard.
set bss wlan0bssvap0 wpa-allowed off
set bss wlan0bssvap0 wpa2-allowed on
-
WPA and WPA2—If you have a mix of clients, some of which support WPA2 and
others which support only the original WPA, select both. This lets both WPA and
WPA2 client stations associate and authenticate, but uses the more robust WPA2 for
clients who support it. This WPA configuration allows more interoperability, at the
expense of some security.
set bss wlan0bssvap0 wpa-allowed on
set bss wlan0bssvap0 wpa2-allowed on
3. Enable Pre-Authentication
If you set WPA versions to “WPA2” or “Both”, you can enable pre-authentication for
WPA2 clients.
Enable pre-authentication if you want WPA2 wireless clients to send pre-authentication
packet. The pre-authentication information will be relayed from the access point the client
is currently using to the target access point. Enabling this feature can help speed up
authentication for roaming clients who connect to multiple access points.
To enable pre-authentication for WPA2 clients, enter the following command:
set bss wlan0bssvap0 rsn-preauthentication on
To disable pre-authentication for WPA2 clients, enter the following command:
set bss wlan0bssvap0 rsn-preauthentication on
The pre-authentication option does not apply if you set the WPA Version to support “WPA”
clients because the original WPA does not support this pre-authentication
4. Set the Cipher Suite you want to use.
-
TKIP Only: Temporal Key Integrity Protocol (TKIP).
set bss wlan0bssvap0 wpa-cipher-tkip on
set bss wlan0bssvap0 wpa-cipher-ccmp off
-
CCMP (AES) Only—Counter mode/CBC-MAC Protocol (CCMP) is an encryption
method for IEEE 802.11i that uses the Advanced Encryption Algorithm (AES).
set bss wlan0bssvap0 wpa-cipher-tkip off
set bss wlan0bssvap0 wpa-cipher-ccmp on
-
TKIP and CCMP (AES)—When you enable both authentication algorithms, both
TKIP and AES clients can associate with the access point. WPA clients must have
