6-6
Cisco Wireless LAN Controller Configuration Guide
OL-1926-06OL-9141-03
Chapter 6 Configuring WLANsWireless Device Access
Configuring WLANs
Configuring MAC Filtering for WLANs
When you use MAC filtering for client or administrator authorization, you need to enable it at the WLAN
level first. If you plan to use local MAC address filtering for any WLAN, use the commands in this
section to configure MAC filtering for a WLAN.
Enabling MAC Filtering
Use these commands to enable MAC filtering on a WLAN:
•
Enter
config wlan mac-filtering enable
wlan-id
to enable MAC filtering.
•
Enter
show wlan
to verify that you have MAC filtering enabled for the WLAN.
When you enable MAC filtering, only the MAC addresses that you add to the WLAN are allowed to join
the WLAN. MAC addresses that have not been added are not allowed to join the WLAN.
Creating a Local MAC Filter
Controllers have built-in MAC filtering capability, similar to that provided by a RADIUS authorization
server.
Use these commands to add MAC addresses to a WLAN MAC filter:
•
Enter
show macfilter
to view MAC addresses assigned to WLANs.
•
Enter
config macfilter add
mac-addr
wlan-id
to assign a MAC address to a WLAN MAC filter.
•
Enter
show macfilter
to verify that MAC addresses are assigned to the WLAN.
Configuring a Timeout for Disabled Clients
You can configure a timeout for disabled clients. Clients who fail to authenticate three times when
attempting to associate are automatically disabled from further association attempts. After the timeout
period expires, the client is allowed to retry authentication until it associates or fails authentication and
is excluded again. Use these commands to configure a timeout for disabled clients:
•
Enter
config wlan blacklist
wlan-id
timeout
to configure the timeout for disabled clients. Enter a
timeout from
1
to
65535
seconds, or enter
0
to permanently disable the client.
•
Use the
show wlan
command to verify the current timeout.
Assigning WLANs to VLANs
Use these commands to assign a WLAN to a VLAN:
•
Enter this command to assign a WLAN to a VLAN:
config wlan vlan
wlan-id
{
default
|
untagged
|
vlan-id controller-vlan-ip-address vlan-netmask
vlan-gateway
}
–
Use the
default
option to assign the WLAN to the VLAN configured on the network port.
–
Use the
untagged
option to assign the WLAN to VLAN 0.
–
Use the
vlan-id, controller-vlan-ip-address, vlan-netmask,
and
vlan-gateway
options to assign
the WLAN to a specific VLAN and to specify the controller VLAN IP address, the local IP
netmask for the VLAN, and the local IP gateway for the VLAN.
