ESS Profiles (requires Level 10 permission)

A basic service set (BSS) is the basic building block of an IEEE 802.11 wireless LAN; one access point together with all associated clients is called a BSS. An AP acquires its clients by broadcasting its name (SSID) which is picked up by clients within range. Clients can then respond, establishing a connection. It is legitimate for multiple access points to share the same SSID if they provide access to the same network as part of an Extended Service Set (ESS). Note that Meru AP1000 and AP300 can share an SSID, but you won’t be able to use the features Virtual Cell or Virtual Port, so we recommend that you give them different SSIDs. You can establish different kinds of ESS for different situations such as:

a VLAN that supports multiple access points per ESS.
several different ESSs on one physical access point.
a VLAN for each ESS to separate network traffic. You can also specify that a VLAN be shared between multiple ESSs. an ESS that supports just one person.
an ESS for a remote AP, such as in a branch office. That AP can additionally support ESSs for local traffic.
an ESS divided to support different security requirements. For example, you can set up an ESS such that clients who use WPA are placed into a VLAN named vlan10, and clients who enter the network in Open mode are placed into a VLAN named vlan20. (For information about configuring security, see Security).

The Meru Wireless LAN System also allows you to customize a beacon per ESS to support different access point settings, such as base or supported transmit rates, different BSSs, different beacon intervals, and different DTIM periods. This beacon customization allows service customization for each ESS, as well as more flexibility in supporting different clients and services. ESS profiles for a controller can also be configured from E(z)RF Network Manager. You can tell where an ESS was configured by checking the read-only field Owner. The Owner is either E(z)RF NMS or controller.

Add an ESS

ESS profiles can be configured either from E(z)RF Network Manager or from this interface on the controller. You can tell where a profile was configured by checking the read-only field Owner; the Owner is either E(z)RF NMS or controller. To add an ESS from the controller’s Web UI, follow these steps:

Click Configuration > Wireless > ESS > Add.
In the ESS Profile Name field, type the name (ID) of the extended service set. The name can be up to 32 alphanumeric characters long with no spaces. In the SSID field, type the SSID for this ESS. The SSID is what clients see and connect to.
In the SSID field, type the name of the SSID for this ESS.
In the Security Profile Name list, select an existing Security Profile to associate with the ESS profile. By default, an ESS profile is associated with the Security Profile named default. For more explanation, see Security.
In the Primary Radius Accounting Server list, select either the name of a previously configured Radius accounting server profile or the No RADIUS option. Selecting No RADIUS means that no Radius accounting messages will be sent for clients connecting to this ESSID profile.
In the Secondary Radius Accounting Server list, select the name of a previously configured Radius accounting server profile or the No RADIUS option. No RADIUS means that no Radius accounting messages will be sent for clients connecting to this ESSID profile.
In the Accounting Interim Interval field, type the time (in seconds) that elapses between accounting information updates for Radius authentication. If a Radius accounting server is enabled, the controller sends an interim accounting record to the Radius server at the interval specified. Accounting records are only sent to the Radius server for clients that authenticate using 802.1x. The interval can be from 600 through 36,000 seconds (10 minutes through 10 hours). The default value is 3,600 seconds (1 hour). For more information, see the System Director Configuration Guide security chapter Configuring Radius Accounting.
Beacon Interval sets the rate at which beacons are transmitted. Setting the beacon interval to a higher value decreases the frequency of unicasts and broadcasts sent by the access point. If the power-save feature is enabled on clients that are connected to access points, clients “wake up” less if fewer unicasts and broadcasts are sent, which conserves the battery life for the clients. In the Beacon Interval field, type the interval (in ms) at which beacons are transmitted. The beacon interval must be between 20 and 1000 milliseconds. For AP300 and AP1000 beacon interval is a multiple of 20, from 20 to 1000ms. For AP150 and OAP180, the beacon interval is a multiple of 100, from 100 to 500ms. If your WLAN consists mostly of Wi-Fi phones, and you have a low number of ESSIDs configured (for example, one or two), Meru Networks recommends setting the beacon interval to 100.
In the SSID Broadcast list, select one of the following:
On: SSID is included in the beacons transmitted.
Off: SSID is not included in the beacons transmitted. Also Probe Responses are not sent in response to probe requests that do not specify an SSID.
In the Bridging area, check any of these bridging options:
AirFortress: FortressTech Layer 2 bridging and encryption with Fortress Technology AirFortress gateway
IPv6: Configures bridging Internet version 6 addresses. IPv6 via tunneling mode has these limitations:
No dynamic VLAN
No multiple ESSID mapping to same VLAN
No support for IPv6 filtering
No IPv6 IGMP snooping AppleTalk: configures bridging to AppleTalk networks on this ESS.
In the New APs Join ESS profile list, select one of the following:
On: Access points automatically join an ESS profile and are configured radius with its parameters.
Off: Prevents access points from automatically joining an ESS profile.
In the Tunnel Interface Type, select one of the following:
No Tunnel: No tunnel is associated with this ESS profile.
Configured VLAN Only: Only a configured VLAN listed in the following VLAN Name list is associated with this ESS profile. If you select this option, go to Step 13. Also see Assigning a VLAN with the CLI.
Radius VLAN Only: Use Radius VLAN Only when you want the VLAN assigned by the Radius server via the Radius attribute Tunnel Id in a Radius Accept packet. This method is supported only when clients authenticate via 802.1x/WPA/WPA2 or MAC Filtering.
Radius and Configured VLAN: Both a configured VLAN and Radius VLAN are associated with this ESS profile. If you select this option, proceed to Step 15.
GRE: Specifies a GRE Tunnel configuration If you select this option, go to Step 14. For details, see the security chapter Configuring GRE Tunnels.
If you selected Configured VLAN Only in Step 12, select a VLANs from the list to associate with this ESS profile.
If you selected GRE for Tunnel Interface Type, select the name of a GRE Tunnel profile previously configured in the Configuration > Wired > GRE area. For GRE to work, DHCP relay must be enabled either locally or globally. Also see
In the Allow Multicast Flag list, optionally enable multicasting (on). Only enable multicasting if you need to use a multicast application. Enabling multicasting causes all multicast packets on the air side to appear on the wired side, and all multicast packets on the wired side to appear on the air side.
On: Enables multicasting. Enable multicasting only if you need to use a multicast application. Enabling multicasting causes all multicast packets on the air side to appear on the wired side, and all multicast packets on the wired side to appear on the air side.

Caution

Off

Silent Client Polling is used with Virtual Cell to track wireless clients that roam without transmitting , for example phones and other devices that conserve battery life. This feature is enabled by default in release 4.0. In the Silent Client Polling list, select one of the following:
On: (default) Tracking information is sent between the controller and APs, and also sent between the APs and a phone that is not in a call or in powersave mode. This feature keeps the system appraised of a client phone location if the client moves between APs while the phone is inactive.
Off: Disables silent client polling.

Virtual Cell (which includes Virtual Port) is on by default; this affects AP300 and AP1000. To enable/disable Virtual Cell on the AP300s using this ESS, select one of the following:
On: (default) Access points on the same channel share the same BSSID, forming a Virtual Cell (default).
Off: Prevents AP300s on the same channel from sharing the same BSSID.

On the AP1000, Virtual Cell is controlled exclusively by the setting here. You can create any combination of virtual cell ESS profiles and non-Virtual Cell ESS profiles on a radio. For AP300s, this Virtual Cell setting is not the only factor that affects AP300 Virtual Cell - the AP300 Dot11 radio interface setting for each radio also controls Virtual Cell on each AP300. They both must on for Virtual Cell to work - see the chart below.

AP300 Radio VCell Mode	ESS Profile VCELL Mode	Result
on	enabled	Virtual Cell is working on AP300
on	disabled	no Virtual Cell on AP300
off	enabled	no Virtual Cell on AP300
off	disabled	no Virtual Cell on AP300

Note that all APs on the same channel in a Virtual Cell must have the same setting for these values: RF-Mode, Channel Width, N-only Mode.

Note that if you set Virtual Cell on for an ESS used with AP300s and then turn it off, Virtual Cell capability is removed from the AP300 interface and must be added to the AP300 interface again if Virtual Cell is turned on again in the ESS. To add the SSID back to AP300, the best option is to delete the ESS profile and then re-add it. Alternately, you can add a BSSID to each and every interface manually. Note with this last option, if there are multiple APs in network then this option does not help.

Virtual Cell combines resources into one pool while Virtual Port divides that pool into individual dedicated resources for each client. In release 4.1, the two features have been combined so that Virtual Port is no longer configurable.
If Virtual Cell is off and the APs are AP300 models, you can also select a non-Virtual Cell ESS for “overflow from” - the selected Virtual Cell ESS will overflow into this non-Virtual Cell ESS when the Virtual Cell is at 50% capacity. This way, the two ESS Profiles can share an SSID and seamlessly move clients back and forth as needed. The overflow decision is based on the percentage of airtime spent on beacons crossing a threshold. This feature is designed for a high density deployment and addresses the bottleneck caused by transmitting beacons.
In release 4.1, WMM configuration has no effect. WMM (for QoS) is supported only by AP300 and is always enabled.
For APSD support, select on or off. APSD stands for Advanced WMM Power Save and is supported only on AP300.
On: AP300 data packets for powersave mode clients are buffered and delivered based on the trigger provided by the client. This feature saves more power and provides longer lifetime for batteries than the legacy power save mode (TIM method). Note that you must have WMM set to on for this to work - see previous step.
Off: No APSD support for AP300.
DTIM affects clients in power save mode. In the DTIM Period field, type the number of beacon intervals that elapse before broadcast and multicast frames stored in buffers are sent. This value is transmitted in the DTIM period field of beacon frames. The DTIM period can be a value from 1 through 255. The default DTIM period is 1. Setting the DTIM period to a higher value decreases the frequency of broadcasts sent by the access point. If power save is enabled on clients that are connected to access points, clients “wake up” less if fewer broadcasts are sent, which conserves battery life for the clients. Only the behavior of clients currently in power-save mode is affected by the DTIM period value. Because broadcasts are generally wasteful of air resources, the Meru WLAN has devised mechanisms that mitigate broadcasts either with proxy services or with more efficient, limited unicasts. As an example, ARP Layer 2 broadcasts received by the wired side are not relayed to all wireless clients. Instead, the Meru controller maintains a list of IP-MAC address mappings for all wireless clients and replies with proxy-ARP on behalf of the client.
In the Dataplane Mode list, select the type of AP/Controller configuration:
Tunneled: (default) In tunneled mode, a controller and an AP300/AP1000 are connected with a data tunnel so that data and control packets from a mobile station are tunneled to the controller from the AP and vise versa.
Bridged: (Bridged mode was formerly Remote AP mode.) In bridged mode, data packets are not passed between AP300/AP1000 and the controller; only control plane packets are passed. When bridged mode is configured, an AP300 can be installed and managed at a location separated from the controller by a WAN or ISP, for example at a satellite office. The controller monitors the remote APs through a keep-alive signal. Remote APs can exchange control information with the controller, including authentication and accounting information, but they are unable to exchange data. Remote APs can exchange data with other APs within their subnet A VLAN tag can be configured for a Bridged mode profile and then multiple profiles can be associated to that VLAN tag. AP VLAN priority can be set in the next step.
Provide an AP VLAN tag between zero and 4094. This VLAN tag value is configured in the controller VLAN profile and is used for tagging client traffic for ESSIDs with dataplane mode bridged, using 802.1q VLAN.This field indicates whether an AP needs to map incoming VLAN 802.1p data packets into WMM ACs or not. By default in a bridged ESS, this field is disabled and an AP always honors DSCP field in IPV4 packet to map an incoming packet to one of WMM ACs. When you turn this on, an AP honors VLAN 802.1p priority over DSCP priority when the packet is mapped into one of WMM ACs.
To Enable VLAN Priority, set this field to On.
On: AP disregards the DSCP value in the IP header of a packet.
Off: AP honors the DSCP values in the IP header of a packet. AP converts the DSCP value in the IP header to appropriate WMM queues. This feature works only for downstream packets and only for an ESSID with dataplane mode set to bridged.
For Countermeasure, select when to enable or disable MIC Countermeasures: On: (default) Countermeasures are helpful if an AP encounters two consecutive MIC errors from the same client within a 60 second period. The AP will disassociate all clients from the ESSID where the errors originated and not allow any clients to connect for 60 seconds. This prevents an MIC attack. Off: Countermeasures should only be turned off temporarily while the network administrator identifies and then resolves the source of a MIC error.
In the Enable Multicast MAC Transparency field, indicate on or off. For more explanation, see Multicast MAC Transparency in the ESS chapter of the System Director Configuration Guide.
On: All downstream multicast packets will have the MAC address of the streaming station.
Off: (default) All downstream multicast packets will have the MAC address of the controller.
Band steering balances multi-band capable clients on AP300/AP1000 by assigning bands to clients based on their capabilities. Without band steering, an ABG client could formerly associate on either the A or the B/G channels, leading to overcrowding on one band or the other. With band steering, you can leave all voice-capable clients the B/G channels (where bandwidth is not a concern) and move data-only clients to the A band to achieve higher data rates. To use band steering for ABGN traffic, you could use A-steering to direct dual mode clients with A capability to the 5 GHz band and use N-steering to direct all dual mode clients with AN capability to the 5 GHz band. Band steering is also useful for directing multicast traffic. For this command to work as clients are added, also set the field New APs Join ESS to on. Band Steering Mode options are:
Band Steering Disabled
Band Steering to A band: Infrastructure attempts to steer all A-Capable wireless clients to the 5 GHz band when they connect to this ESS.
Band Steering to N band: Infrastructure attempts to steer all N-Capable wireless client that are also A-Capable to the 5GHz band when they connect to this ESS. Infrastructure also attempts to steer non N-Capable wireless clients to the 2.4 GHz band.
Band Steering Timeout sets the number of seconds that assignment for a steered client is blocked on the forbidden band while it is unassociated. For this command to work, also set the field Band Steering to A-band or N-band (see above). Band Steering Timeout can be any integer from 1-65535.
For the remaining Supported and Base Transmit Rates for B, A, G, and BG modes, enable or disable rates as needed.
Click OK.