Extreme Networks Altitude 3500 Series, Руководство по продукции

Страница: 527 / 594

Altitude 3500 Series Access Point Product Reference Guide
527
defined for client bridge support only, the Available On checkbox should not be selected. Instead, it
only needs to have the Enable Client Bridge Backhaul option selected.
5 Use the Maximum MUs field to define the number of MUs allowed to associate with this WLAN.
This number should be defined based on the number of client bridge and repeaters within this mesh
network. This value can be increased as the mesh network grows and devices are added.
Only advanced users should define the number of devices allowed to associate with the WLAN, as
setting the value too low could restrict devices from joining an expanding mesh network, and setting
it too high could prohibit other WLANs from granting access to the all the devices needed.
6 Select the Enable Client Bridge Backhaul checkbox to make this WLAN available in the Mesh Network
Name drop-down menu within the Radio Configuration screen. Only WLANs defined for mesh
networking support should have this checkbox selected, in order to keep the list of WLANs available
(within the Radio Configuration screen) restricted to just WLANs configured specifically with mesh
attributes.
7 Refer to the Security Policy drop-down menu to select the security policy used within this WLAN
and mesh network.
A security policy for a mesh network should be configured carefully since the data protection
requirements within a mesh network differ somewhat compared to a typical wireless LAN.
No
Encryption is a bad idea in a mesh network, since mesh networks are typically not guest networks,
wherein public assess is more important than data protection. Extreme Networks also discourages
user-based authentication schemes such as Kerberos and 802.1x EAP, as these authentication schemes
are not supported within a mesh network.
If none of the existing policies are suitable, select the Create button to the right of the Security Policy
drop-down menu and configure a policy suitable for the mesh network. For information on
configuring a security using the authentication and encryption techniques available to the
access point, see
“Enabling Authentication and Encryption Schemes” on page 172 .
8 ACL policies should be configured to allow or deny a range of MAC addresses from interoperating
with the WLAN used with the mesh network. ACLs should be defined based on the client bridge
and repeater (an access point defined as both a base and client bridge) association requirements
within the mesh network.
For information on defining an ACL for use with the WLAN assigned to the mesh network, see
“Configuring a WLAN Access Control List (ACL)” on page 139 .
NOTE
The Kerberos User Name and Kerberos Password fields can be ignored, as Kerberos is not supported
as a viable authentication scheme within a mesh network.
9 Select the Disallow MU to MU Communication checkbox to restrict MUs from interacting with each
other both within this WLAN, as well as other WLANs.
Selecting this option could be a good idea, if restricting device “chatter” improves mesh network
performance. If base bridges and client bridges are added at any given time to extent the coverage
are of a mesh network, the data going back and forth amongst just those radios could be
compromised by network interference. Adding mesh device traffic could jeopardize network
throughput. If however, MU to MU communication is central to the organization (for example,
scanners sharing data entry information) then this checkbox should remain unselected.
10 Select the Use Secure Beacon checkbox to not transmit the ESSID amongst the access points and
devices within the mesh network. If a hacker tries to find an ESSID via an MU, the access point’s
ESSID does not display since the ESSID is not in the beacon. Extreme Networks recommends
keeping the option enabled to reduce the likelihood of hacking into the WLAN.