Help with RFS 6000 installation

[md355]

So my friends, last week I bought a RFS 6000 with 24 licenses (I checked on-line and found that it had been upgraded from 8 licenses) and I tried to put it on my network and replace my old WS 5100. There are 16 AP300 on the network and the Firmware of the RFS 6000 is currently 5.4.3.0-018R, which is compatible with AP300 as it is before x5.7.1.x

Now first step was to factory reset the switch to get new username/password
Next I connected with the Browser and fixed the IP address on the uplink port, changed password, put Country setup for the RF and created a Wireless Network with SSID.

Next I connected the my 16 units of AP300 which where on another switch in the uplink port of the RFS 6000.
Within a few minutes it recognized and adopted all of them.

The problem now is that I cannot find the SSID anywhere with wireless devices.

When I check the status monitor of the RFS 6000 is has a red X mark with RF Quality Poor.

What does this mean

Am I missing something

Thanks !!!

[jcoehoorn]

You can buy and sell the device on your own (that's law; it's call the right of first sale), and that includes the "demo" licenses the come with it. But my understanding is additional licenses are not transferable and cannot be resold. You might get it work, but you won't be able to get support or maintenance until you get your own licenses, and it's a legal gray area at best.

But for why there's no SSID: you did a factory reset on the RFS6000 controller and set up the network. Then you had it adopt APs. But at no point did you assign a profile to the APs. The wireless SSIDs don't attach to APs devices directly. Instead, they attach to profiles, and profiles attach to devices.

[McNulty]

Good job so far.
AP300 management is a little bit different. There isnt a profile e.g. profile ap650 default-ap650.

Do you have a manual config for each ap300?

e.g.
!
ap300 00-15-70-18-32-67
 country-code nz
 interface radio1
  description WAP_001_R1
  channel 6
  power 17
  wlan 2 bss 1 primary
  wlan 10 bss 2 primary
  wlan 1 bss 3 primary
  wlan 6 bss 4 primary
 interface radio2
  description WAP_001_R2
  power 10
!
ap300 00-15-70-18-32-92
 country-code nz
 interface radio1
  description WAP_002_R1
  placement outdoor
  channel 6
  power 17
  wlan 2 bss 1 primary
  wlan 10 bss 2 primary
  wlan 1 bss 3 primary
  wlan 6 bss 4 primary
 interface radio2
!


Can you paste your config here? (Remove sensitive info first)

[md355]

Thank you both for your help !

I noticed that there is no profile for the AP 300 on the list of existing profiles...

I do not have a manul config for each AP300.

On the WS5100 it was simply plug and play !

Can you help me create a profile ?

A quick look seems to me that the only thing that changes is the MAC address and the country code.

I have 16 AP300, does this mean that I have to make 16 profiles, one for each MAC address ?

You help is very much appreciated !! Thank you !!

Good job so far.
AP300 management is a little bit different. There isnt a profile e.g. profile ap650 default-ap650.

Do you have a manual config for each ap300?

e.g.
!
ap300 00-15-70-18-32-67
 country-code nz
 interface radio1
  description WAP_001_R1
  channel 6
  power 17
  wlan 2 bss 1 primary
  wlan 10 bss 2 primary
  wlan 1 bss 3 primary
  wlan 6 bss 4 primary
 interface radio2
  description WAP_001_R2
  power 10
!
ap300 00-15-70-18-32-92
 country-code nz
 interface radio1
  description WAP_002_R1
  placement outdoor
  channel 6
  power 17
  wlan 2 bss 1 primary
  wlan 10 bss 2 primary
  wlan 1 bss 3 primary
  wlan 6 bss 4 primary
 interface radio2
!


Can you paste your config here? (Remove sensitive info first)

[md355]

Anyone care to share your thought ? Thanks !

[md355]

Update :

So I managed to get the system to work !!!!!

I followed your advice and attached the 2 Radios of each Access Port AP300 to the SSID of my WiFi Network.

It worked immediately.

For a couple of hour I though everything was cool.

Then I started receiving some complaints.

The problem now is that every approx. 15 minutes users are disconnected from the WiFi and for 1-2 minutes they are unable to reconnect to the network.

Then the SSID becomes available again and they reconnect...

What could be the problem

The switch is brand new Linksys / Cisco series managed 100 MBps.

[Gary Hartstone]

Anything in the log.
If you're seeing handshake errors the you need to access the CLI and apply the following config to the WLAN.

wpa-wpa2 handshake priority normal

If it's happening to all devices at once, then  I'd be asking what encryption you're using. Not TKIP I hope.

[md355]

What encryption should I use ?

I just typed the command :

show logging

RESULT :

TKIP countermeasures ended on wlan "MY-SSID-WLAN"  ssid "MY-SSID-WLAN"

Initiating TKIP countermeasures on wlan "MY-SSID-WLAN"  ssid "MY-SSID-WLAN"



The above appears 2-3 times... What does this mean

Thanks for your help !!!

[Gary Hartstone]

That's what I thought.
TKIP Countermeasures causes the WLAN to go offline due to a perceived threat.
Might be a real threat or a legitimate device with a faulty WLAN radio/firmware.

The standard downtiem is 60 seconds, but it can be modified through the CLI by adding the following config to the WLAN

wpa-wpa2 tkip-countermeasures holdtime 0

I'd start by checking the log to see what device is causing the countermeasurs to activate. if it's the same device each time then remove that device.

[Gary Hartstone]

Sorry, I think you can now modify the holdtime from the WLAN security screen.
Or change your encryption from TKIP-CCMP to WPA2-CCMP if your devices are compatible with WPA2

[jcoehoorn]

> Or change your encryption from TKIP-CCMP to WPA2-CCMP if your devices are compatible with WPA2

I'd hope so. TKIP is kinda broken now. If you're running that, I could sit in your parking with a laptop running the right software and after a few minutes start reading traffic as it goes across your network.

[md355]

Thank you for your help !!!

I just replaced TKIP-CCMP to WPA2-CCMP !!!

Hope it works and there is not timeout or countermeasures...

[md355]

Hi again !!

I see to have a slight problem... I fixed the TKIP to WPA2, but now I still get some disconnections...

To give you specifics for the setup, the Route is 192.168.1.1 /24
The RFS6000 is 192.168.1.20
And the DHCP run on the Router starting 192.168.1.21 - 253

There is a separate switch with the 16 AP300 and it is connected on the uplink port on the RFS6000

The message on the log is :

Interface vlan1 IP Address overlaps Interface me1



What does this mean The only IP address I configured was for the management me1 port , where I connect my laptop to configure the RFS6000...

Am I missing something ?

Furthermore, it seems strange that I cannot access the RFS6000 through the WiFi, only with the cable connected to me1

Help ?

[AVAGO]

set the me port ip to to anything 10.x.x.x then give then set the virtual interface with the lan static address

The way I have it is the ME port is my backdoor if you like, off the LAN so if the switch throws a wobbly and you can not get access via the lan you should be able toovia the ME1 port

So ge1 is the physical and is enabled
then set the Lan ip on VLan 1 ( or what ever the vlan number is you have set for access

[md355]

set the me port ip to to anything 10.x.x.x then give then set the virtual interface with the lan static address

The way I have it is the ME port is my backdoor if you like, off the LAN so if the switch throws a wobbly and you can not get access via the lan you should be able toovia the ME1 port

So ge1 is the physical and is enabled
then set the Lan ip on VLan 1 ( or what ever the vlan number is you have set for access

Thank you !!!!!!! I fixed it, I no longer get IP conflicts, and now I can actually manage the RFS 6000 from Wifi network !!!


The only thing left to fix now is the disconnections...

I found this article :



Wireless Clients are disassociated due to 4 Way Handshake Timeout

During the WPA/WPA2 handshake an access point waits a defined amount of time (timeout) for a response from the client.  If a response is not received, the access point resends the handshake message. This process repeats until a successful handshake is performed or until the maximum number of attempts have been made.  Some clients may be slow to respond to WPA handshake messages due to limitations of the device or problems in the RF environment.  If the handshake is unsuccessful, the client will be disassociated from the WLAN and the following log message will be seen on the WLAN controller:

2015-03-12 11:51:05     OFFICE-FLOOR-AP2 DOT11      CLIENT_DISASSOCIATED Client '00-AA-BB-CC-DD-EE' disassociated from wlan 'OFFICE-FLOOR-AP' radio 'OFFICE-FLOOR-AP2:R2': dot11i 4way handshake timeout (reason code: 15)
Resolution   
Increase the WLAN WPA-WPA2 handshake attempts and timeout values to allow the client to have more time to process and respond to the message.

Controller(config-WLAN-WLAN_NAME)# wpa-wpa2 handshake attempts <MAX_ATTEMPTS>
Controller(config-WLAN-WLAN_NAME)# wpa-wpa2 handshake timeout <1ST_TRY> <2ND> <3RD>...

Example (with suggested values):
wm3400-AABBCC>enable
wm3400-AABBCC#conf t
wm3400-AABBCC(config)#wlan test
wm3400-AABBCC(config-wlan-test)#wpa-wpa2 handshake attempts 5
wm3400-AABBCC(config-wlan-test)#wpa-wpa2 handshake timeout 200 300 400 500




And I put the maximum of 5 attempts and timeout 5000 5000 5000 5000

Let's see if it works !!!!!!! I hope I don't get any complaints that the system disconnects the users !!!!!!