ESS Profile - Update

Use the ESS Profile - Update page to modify an ESS profile. In the Summary Selection area, the Profile page shows the identifying number of the profile (No), the ESS Profile Name, and the name of the SSID in use. To modify ESS profile parameters:

1. In the Enable/Disable list, select one of the option to enable or disable the profiles:
   • Enable: (default) When a specific ESS profile is Enabled, NMS creates all services which belong to the ESS profile. Client will associate to the ESSID profile only when its state is Disabled. 
   • Disable: When a specific ESS profile is Disabled, NMS will delete all services which belong to the ESS profile. Client will not associate to the ESSID profile when its state is Disabled.
2. In the Security Profile Name list, select the Security Profile you want to associate with the ESS profile. By default, an ESS profile is associated with the Security Profile named default.
3. In the Primary Radius Accounting Server list, select the name of a previously configured RADIUS accounting server profile or the No RADIUS option.
4. In the Secondary Radius Accounting Server list, select the name of a previously configured RADIUS accounting server profile or the No RADIUS option.
5. In the Accounting Interim Interval field, type the time (in seconds) that elapses between accounting information updates. If a Radius accounting server is enabled, the controller sends an interim accounting record to the Radius server at the interval specified. Accounting records are only sent to the Radius server for clients that authenticate using 802.1x. The interval can be from 600 through 36,000 seconds (10 minutes through 10 hours). The default value is 3,600 seconds (1 hour).
6. In the Beacon Interval field, type the interval (in ms) at which beacons are transmitted.  The beacon interval must be between 20 through 1000 milliseconds. For AP300 and AP208 beacon interval is a multiple of 20, from 20 to 1000ms. For AP150 and OAP180, the beacon interval is a multiple of 100, from 100 to 500ms. If your WLAN consists mostly of Wi-Fi phones, and you have a low number of ESSIDs configured (for example, one or two), Meru Networks recommends setting the beacon interval to 100 TUs.
7. In the SSID Broadcast list, select one of the following:
   • On: SSID is included in the beacons transmitted.
   • Off: SSID is not included in the beacons transmitted.
8. In the Bridging area, click to check any of the bridging options:
   • AirFortress: FortressTech Layer 2 bridging and encryption with Fortress Technology AirFortress gateway.
   • IPv6: configures bridging Internet version 6 addresses.
   • AppleTalk: configures bridging to AppleTalk networks on this ESS.
9. In the New APs Join ESS profile list, select one of the following:
   • On: Specifies that access points automatically join an ESS profile and are configured with its parameters (default).
   • Off: Prevents access points from automatically joining an ESS profile.
10. In the Tunnel Interface Type field, select one of the following:
    • No Tunnel: Specifies that no tunnel is associated with this ESS profile.
    • Configured VLAN Only: Specifies that only a configured VLAN, listed in the following VLAN Name list, is associated with this ESS profile. If you select this option, go to step 13.
    • RADIUS VLAN Only: Specifies that only the Radius VLAN is associated with this ESS profile.
    • RADIUS and Configured VLAN: Specifies that both a configured VLAN and RADIUS VLAN are associated with this ESS profile. If you select this option, go to step 12.
    • GRE: Specifies a GRE Tunnel configuration.
11. If you selected Configured VLAN Only for Tunnel Interface Type, for VLAN Name list, select one of the existing VLANs to associate with this ESS profile.
12. If you selected GRE for Tunnel Interface Type, for GRE Tunnel Profile Name, select the name of the GRE Tunnel profile (previously configured in the Wired>GRE area). For GRE to work, DHCP relay must be enabled locally or globally.
13. In the Allow Multicast Flag list, select one of the following:
    • On: Enables multicasting.
      Enable multicasting only if you need to use a multicast application. Enabling multicasting causes all multicast packets on the air side to appear on the wired side, and all multicast packets on the wired side to appear on the air side.

      Caution! Multicasting is allowed only when an ESS profile has a one-to-one mapping with the default VLAN for this ESS profile; no other ESS profile uses the same VLAN and security rules associated with this ESS profile do not redirect traffic to another VLAN. Multicasting is an advanced feature. Enable multicasting only if you need to use a multicast application. Enabling multicasting causes all multicast packets on the air side to appear on the wired side, and all multicast packets on the wired side to appear on the air side.

    • Off: Disables multicasting.
14. Silent polling is used with Virtual Cell to track and identify wireless clients that roam across AP200s without transmitting (for example,  phones and devices on deep powersave mode). This feature is enabled by default for AP300 in release 4.0 Releases. In the Silent Client Polling list, select one of the following:
    • On: (default) Tracking information is sent between the controller and APs, and also sent between the APs and a phone that is not in a call or in powersave mode. This feature keeps the system appraised of a client phone location if the client moves between APs while the phone is inactive. 
    • Off: Disables silent client polling.
15. In the Enable Virtual Cell, select one of the following:
    • On: (default) Access points on the same channel share the same BSSID, forming a Virtual Cell (default). Note that if a profile with Virtual Cell and/or Virtual Port is set to broadcast on a non-Virtual Cell AP300 radio it will broadcast as non-Virtual Cell and Virtual Port. Conversely, if an AP300 radio is capable of Virtual Cell and Virtual Port, but this setting is off, it will also broadcast as non-Virtual Cell and Virtual Port. Both the AP and the BSSID must have Virtual Cell on for it to work.
    • Off: Prevents access points on the same channel from sharing the same BSSID.
16. In the WMM Support drop-down list, select one of the following:
    • On: WMM (for QoS) is supported by both AP300 and AP200. For AP200, this setting enables Wifi Multimedia (WMM) Enhanced Distribution Channel Access (EDCA) for QoS priority scheduling and Automatic Power Save Delivery (APSD) for improvements over the 802.11 legacy power management. AP300 always has WMM enabled; it cannot be turned off. WMM includes these features: - WMM (for QoS) - WMM PS (uAPSD) - helps with battery life - WMM AC (TSPEC) - admission control
    • Off: Disables WMM on AP200 only. Has no effect on AP300. WMM is disabled by default on AP200 and always enabled on AP300.
17. For APSD support, select on or off. APSD stands for Advanced WMM Power Save and is supported on AP200 and AP300.
• On: Data packets for powersave mode clients are buffered and delivered based on the trigger provided by the client. This feature saves more power and provides longer lifetime for batteries than the  legacy power save mode (TIM method).
• Off: No U-APSD support
18. DTIM affects clients in power save mode. In the DTIM Period field, type the number of beacon intervals that elapse before broadcast frames stored in buffers are sent. This value is transmitted in the DTIM period field of beacon frames. The DTIM period can be a value from 1 through 255. The default DTIM period is 1. Setting the DTIM period to a higher value decreases the frequency of broadcasts sent by the access point. If power save is enabled on clients that are connected to access points, clients "wake up" less if fewer broadcasts are sent, which conserves battery life for the clients.

    Only the behavior of clients currently in power-save mode is affected by the DTIM period value. Because broadcasts are generally wasteful of air resources, this  setting will mitigate broadcasts either with proxy services or with more efficient, limited unicasts. As an example, ARP Layer 2 broadcasts received by the wired side are not relayed to all wireless clients. Instead, the controller maintains a list of IP-MAC address mappings for all wireless clients and replies with proxy-ARP on behalf of the client.

19. If Virtual Cell is enabled, indicate whether Virtual Port should be on or off. 
    • Off: Enables the standard Virtual Cell behavior, where access points are on the same channel and share the same BSSID, forming a Virtual Cell (default).
    • On: Enables Virtual Port which causes each station in the Virtual Cell to use a unique BSSID. Note that if a profile with Virtual Cell and Virtual Port is set to broadcast on a non-Virtual Cell AP300 radio it will broadcast as non-Virtual Cell and Virtual Port. Conversely, if an AP300 radio is capable of Virtual Cell and Virtual Port, but this setting is off, it will also broadcast as non-Virtual Cell and non-Virtual Port.
20. In the Dataplane Mode list, select the type of AP/controller configuration:
    • Tunneled: The default connection between controllers and APs, where data and control packets are passed.
    • Bridged: (formerly Remote AP mode) Bridged mode ESS profiles are supported by AP300s. In bridged mode, data packets are not passed to the controller; only control plane packets are passed to the controller. This setting determines the type of traffic that is passed between the controller and an AP. By default, tunneled mode is active where a controller and an AP are connected with a data tunnel so that data from a mobile station is tunneled to the controller from the AP and vise versa. When bridged mode is configured, an AP can be installed and managed at a location separated from the controller by a WAN or ISP, for example a satellite office. The controller monitors the remote APs through a keep-alive signal. Remote APs can exchange control information, including authentication and accounting information, with the controller but are unable to exchange data. Remote APs can exchange data with other APs within their subnet. Because remote APs cannot exchange dataplane traffic (including DHCP) with the controller, these System Director features are not available for Remote AP configuration: Virtual Cell, VLAN, Captive Portal, L3 Mobility, and QoS. A VLAN tag can be configured for a Bridged mode profile (see below) and then multiple profiles can be associated to that VLAN tag .
21. For the remaining Supported and Base Transmit Rates, enable or disable rates as needed.
22. In the Enable Countermeasure list, select when to enable or disable MIC Countermeasures:
    • On: (default) Countermeasures are helpful if an AP encounters two consecutive MIC errors from the same client within a 60 second period. The AP will disassociate all clients from the ESSID where the errors originated and not allow any clients to connect for 60 seconds. This prevents an MIC attack. 
    • Off: Countermeasures  should only be turned off temporarily while a network administrator identifies and then resolves the source of a MIC error.
23. In the Enable Multicast Transparency field, indicate on or off.
• On: All downstream multicast packets will have the MAC address of the streaming station.
• Off: Default - all downstream multicast packets will have the MAC address of the controller.
24. Provide an AP VLAN tag between zero and 4094. This VLAN tag value is configured in the controller VLAN profile and is used for tagging client traffic for ESSIDs with dataplane mode bridged, using 802.1q VLAN.
25. To Enable VLAN Priority, set this field to On.
    • On: AP disregards the DSCP value in the IP header of a packet. 
    • Off: AP honors the DSCP values in the IP header of a packet. AP converts the DSCP value in the IP header to appropriate WMM queues. This feature works only for downstream packets and only for an ESSID with dataplane mode set to bridged.
26. Band steering balances multi-band capable clients by assigning bands to clients based on their capabilities. Without band steering, an ABG client could formerly associate on either the A or the B/G channels, leading to overcrowding on one band or the other. With band steering, you can leave all voice-capable clients the B/G channels (where bandwidth is not a concern) and move data-only clients to the A band to achieve higher data rates. To use band steering for ABGN traffic, you could use A-steering to direct dual mode clients with A capability to the 5 GHz band and use N-steering to direct all dual mode clients with AN capability to the 5 GHz band. Band steering is also useful for directing multicast traffic. For this command to work as clients are added, also set the field New APs Join ESS to on. Band Steering Mode options are: 
    • Band Steering to A band: Infrastructure attempts to steer all A-Capable wireless clients to the 5 GHz band when they connect to this ESS.
    • Band Steering to N band: Infrastructure attempts to steer all N-Capable wireless client that are also A-Capable to the 5GHz band when they connect to this ESS. Infrastructure also attempts to steer  non N-Capable wireless clients to the 2.4 GHz band.
    • Band Steering Disabled
27. Band Steering Timeout sets the number of seconds that assignment for a steered client is blocked on the forbidden band while it is unassociated. For this command to work, also set the field Band Steering to A-band or N-band (see above). Band Steering Timeout can be any integer from 1-65535.
28. The Expedited Forward Override option is implemented to Override the DSCP value of Expedited Forwarding to Class Selector CS6 in the IP-Header of the Voice Packet sent by WLAN Phones. This feature is specific to AP300 and is disabled by Default.
29. The SSID Broadcast for Vport is specific to address the CISCO phone connectivity issues. It consists of three options as follows:
    • Disable: This is the default configuration on the ESSID profile page. Configuring the parameter to “Disable” enables the AP to advertise the beacons as usual following the concept of CSSID.
    • Always: Configuring the parameter to “Always” enables the AP to advertise the SSID on the beacons always. This must not be configured unless recommended.
    • Till-Association: Configuring the parameter to “Till-Association” enables the AP to advertise the SSID in the beacons till association stage of the client and disable the SSID broadcast in the later part of connectivity. This parameter is preferable to configure for the certain version of phones which will resolves the connectivity issues with the Vport ON. Once station associated, AP320 will stop broadcasting SSID string. Here the users are allowed to configure SSID broadcast for VPort parameter from controller GUI per ESS basis in addition to AP CLI.
30. Click OK.