Siemens scalance WLC711 Getting Started

SCALANCE WLC711

___________________

SIMATIC NET

Industrial Wireless LAN

SCALANCE WLC711

Getting Started

04/2016

C7900

0-G8976-C269-07

Preface

Security recommendations

1

Description

2

Getting started

3

Basic configuration with the

wizard

4

Managing access points

5

Configuring specific use

cases with the wizard

6

Optional configuration

7

Siemens AG

Division Process Industries and Drives

Postfach 48 48

90026 NÜRNBERG

GERMANY

Document order number: C79000-G8976-C269-06

Ⓟ

11/2016 Subject to change

Legal information

Warning notice system

This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent

damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert

symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are

graded according to the degree of danger.

DANGER

indicates that death or severe personal injury will result if proper precautions are not taken.

WARNING

indicates that death or severe personal injury may result if proper precautions are not taken.

CAUTION

indicates that minor personal injury can result if proper precautions are not taken.

NOTICE

indicates that property damage can result if proper precautions are not taken.

If more than one degree of danger is present, the warning notice representing the highest degree of danger will

be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to

property damage.

Qualified Personnel

The product/system described in this documentation may be operated only by

personnel qualified

for the specific

task in accordance with the relevant documentation, in particular its warning notices and safety instructions.

Qualified personnel are those who, based on their training and experience, are capable of identifying risks and

avoiding potential hazards when working with these products/systems.

Proper use of Siemens products

Note the following:

WARNING

Siemens products may only be used for the applications described in the catalog and in the relevant technical

documentation. If products and components from other manufacturers are used, these must be recommended

or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and

maintenance are required to ensure that the products operate safely and without any problems. The permissible

ambient conditions must be complied with. The information in the relevant documentation must be observed.

Trademarks

All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication

may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.

Disclaimer of Liability

We have reviewed the contents of this publication to ensure consistency with the hardware and software

described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the

information in this publication is reviewed regularly and any necessary corrections are included in subsequent

editions.

SCALANCE WLC711

Getting Started, 04/2016, C79000-G8976-C269-07

3

Preface

Introduction

By using the Industrial Wireless LAN controller SCALANCE WLC711 along with controller-

based access points, it is possible to set up a single wireless infrastructure for the entire

company. This achieves a high degree of flexibility since mobile subscribers (for example a

laptop) move both in the office and in the automation network and can change over

seamlessly between these networks (roaming). This means that data can be accessed from

anywhere in the company over wireless.

Thanks to the use of a centralized security mechanism for each user group, data is protected

from unauthorized access and manipulation.

The controller-based access points SCALANCE W78xC support the WLAN standards IEEE

802.11a/b/g ad 802.11n and are connected to the IWLAN controller SCALANCE WLC via

gigabit Ethernet. The same applies to the access points SCALANCE W786C, with which a

connection via fiber-optic is possible depending on the version. The controller-based access

points SCALANCE W786-2HPW support the WLAN standards IEEE 802.11a/b/g and are

connected to the IWLAN controller SCALANCE WLC via fast Ethernet or fiber-optic cable.

One requirement for operation is always the use of the IWLAN controller SCALANCE WLC

which makes the group configuration of access points possible. This allows a widespread

IWLAN infrastructure to be represented clearly. The central management with the IWLAN

controller also allows the recording of disruptions, monitoring and documentation of

statistics.

Who is this document intended for?

The Getting Started is intended for system administrators who want to configure the wireless

LAN controller SCALANCE Industrial Wireless LAN controller WLC711 and the access

points with the Web Based Management (WBM) of the SCALANCE Industrial Wireless LAN

controller and access points.

Purpose of this document

This document provides you with a general overview of the functions of the WBM

SCALANCE Industrial Wireless LAN controller and access points. The Getting Started will

quickly help you to learn about configuring the devices.

We recommend that you read the Getting Started not selectively but rather from front to

back. You will get to know the important components that can help you during configuration.

Validity of this document

This document is valid for the SCALANCE IWLAN controller WLC711 and the controller-

based SCALANCE W78xC access points as of firmware version V 9.21.

Preface

SCALANCE WLC711

4 Getting Started, 04/2016, C79000-G8976-C269-07

SIMATIC NET glossary

Explanations of many of the specialist terms used in this documentation can be found in the

SIMATIC NET glossary.

You will find the SIMATIC NET glossary here:

● SIMATIC NET Manual Collection or product DVD

The DVD ships with certain SIMATIC NET products.

● On the Internet under the following address:

50305045 (https://support.industry.siemens.com/cs/ww/en/view/50305045)

Security messages

Note

Siemens offers IT security mechanisms for its automation and drive product portfolio in order

to support the safe operation of the plant/machine. Our products are also continuously

developed further with regard to IT security. We therefore recommend that

you regularly

check for updates of our products and that you only use the latest versions. You will find

information in:

http://www.siemens.com/industrialsecurity. (http://www.siemens.com/industrialsecurity.)

Here, you can register for a product

-specific newsletter.

For the safe operation of a plant/machine, however, it is also necessary to integrate the

automation components into an overall IT security concept for the entire plant/machine,

whic

h corresponds to the state-of-the-art IT technology. You will find information on this in:

https://support.industry.siemens.com (https://support.industry.siemens.com/cs/de/en/)

Products from

other manufacturers that are being used must also be taken into account.

SCALANCE WLC711

Getting Started, 04/2016, C79000-G8976-C269-07

5

Table of contents

Preface ................................................................................................................................................... 3

1 Security recommendations ...................................................................................................................... 7

1.1 General information .................................................................................................................. 7

1.2 Security recommendations ....................................................................................................... 8

2 Description ............................................................................................................................................ 13

2.1 General ................................................................................................................................... 13

2.2 Requirement for configuration ................................................................................................ 15

2.3 LED display ............................................................................................................................. 16

3 Getting started ...................................................................................................................................... 17

3.1 Sequence ................................................................................................................................ 17

3.2 Logon ...................................................................................................................................... 19

3.3 Shutting down and turning off ................................................................................................. 21

4 Basic configuration with the wizard ........................................................................................................ 23

4.1 Procedure - "Basic Installation Wizard" page ......................................................................... 25

4.2 Procedure - "Management" page ........................................................................................... 28

5 Managing access points ........................................................................................................................ 35

5.1 Commissioning access points ................................................................................................ 35

5.2 Registering access points ....................................................................................................... 39

5.3 Configuring access points ....................................................................................................... 45

5.3.1 Single configuration ................................................................................................................ 45

5.3.2 Multiple configuration .............................................................................................................. 58

6 Configuring specific use cases with the wizard ...................................................................................... 61

6.1 Use case: Bridged at WLC ..................................................................................................... 61

6.2 Use case: Bridged at AP ......................................................................................................... 70

7 Optional configuration ........................................................................................................................... 79

7.1 Expanding the number of manageable access points ............................................................ 79

7.2 Access using the Command Line Interface (CLI) ................................................................... 82

7.3 Data backup ............................................................................................................................ 84

7.4 Using reports ........................................................................................................................... 87

7.5 Using policies .......................................................................................................................... 89

7.6 Authentication via RADIUS server .......................................................................................... 91

7.7 User configuration ................................................................................................................... 94

Table of contents

SCALANCE WLC711

6 Getting Started, 04/2016, C79000-G8976-C269-07

Index .................................................................................................................................................... 97

SCALANCE WLC711

Getting Started, 04/2016, C79000-G8976-C269-07

7

Security recommendations

1

1.1

General information

Note

Note the information in the SCALANCE WLC711 user guide and the compact operating

instructions SCALANCE WLC711.

Notes on secure network design

To protect your network from attacks, note the following points:

●

Use WPA2/ WPA2-PSK with AES

To prevent misuse of a password, use only WPA2/AES. WPA2/ WPA2-PSK with AES

provides the highest security.

●

Protect your network against man-in-the-middle attacks

To protect your network from man-in-the-middle attacks, a network topology is

recommended, that makes it more difficult for an attacker to tap into the communications

path between two end devices.

– You can, for example, protect WLAN devices by arranging so that the management

port is accessible only via a separate management VLAN.

– You can also install a separate HTTPS certificate on a WLAN client / access point.

The HTTPS certificate checks the identity of the device and controls the encrypted

data exchange. You can install the HTTPS certificate via HTTP.

●

Use SNMPv3

SNMPv3 provides you with highest possible security when accessing the WLAN devices

via SNMP.

Security recommendations

1.2 Security recommendations

SCALANCE WLC711

8 Getting Started, 04/2016, C79000-G8976-C269-07

1.2

Security recommendations

To prevent unauthorized access, note the following security recommendations.

General

● You should make regular checks to make sure that the device meets these

recommendations and/or other security guidelines.

● Evaluate your plant as a whole in terms of security. Use a cell protection concept with

suitable products.

● When confidential zones are used, the internal and external network are disconnected, an

attacker cannot access the data from the outside.

● Operate the device only within a protected network area.

● Use additional devices with VPN functionality (e.g. SCALANCE S) to encrypt and

authenticate communication from and to the devices.

● For data transfer via a non-secure network, use an encrypted VPN tunnel (IPsec) by

using additional devices with VPN functionality (e.g. SCALANCE S).

● For operation of the device in a non-secure infrastructure no product liability will be

accepted.

● Separate connections correctly (WBM. Telnet, SSH etc.).

Physical access

● Restrict physical access to the device to qualified personnel.

● Lock unused physical ports on the device. Unused ports can be used to gain forbidden

access to the plant.

Software (security functions)

● Keep the software up to date. Check regularly for security updates of the product.

You will find information on this on the Internet pages "Industrial Security

(http://www.siemens.com/industrialsecurity".

● Inform yourself regularly about security advisories and bulletins published by Siemens

ProductCERT (http://www.siemens.com/cert/en/cert-security-advisories.htm).

● Only activate protocols that you really require to use the device.

● Use the security functions such as address translation with NAT (Network Address

Translation) or NAPT (Network Address Port Translation) to protect receiving ports from

access by third parties.

● Restrict access to the device with a firewall or rules in an access control list (ACL -

Access Control List).

● If RADIUS authentication is via remote access, make sure that the communication is

within the secured network area or is via a secure channel.

● The option of VLAN structuring provides good protection against DoS attacks and

unauthorized access. Check whether this is practical or useful in your environment.

Security recommendations

1.2 Security recommendations

SCALANCE WLC711

Getting Started, 04/2016, C79000-G8976-C269-07

9

● Enable logging functions. Use the central logging function to log changes and access

attempts centrally. Check the logging information regularly.

● Configure a Syslog server to forward all logs to a central location.

● Use WPA2/ WPA2-PSK with AES to protect the WLAN.

Passwords

● Define rules for the use of devices and assignment of passwords.

● Regularly update passwords and keys to increase security.

● Change all default passwords for users before you operate the device.

● Only use passwords with a high password strength. Avoid weak passwords for example

password1, 123456789, abcdefgh.

● Make sure that all passwords are protected and inaccessible to unauthorized personnel.

● Do not use the same password for different users and systems or after it has expired.

Keys and certificates

This section deals with the security keys and certificates you require to set up HTTPS (

HyperText Transfer Protocol Secured Socket Layer).

● We strongly recommend that you create your own HTTPS certificates and make them

available.

There are preset certificates and keys on the device. The preset and automatically

created HTTPS certificates are self-signed.

We recommend that you use HTTPS certificates signed either by a reliable external or by

an internal certification authority. The HTTPS certificate checks the identity of the device

and controls the encrypted data exchange. You can install the HTTPS certificate via the

WBM (System > Load and Save).

● Handle user-defined private keys with great caution if you use user-defined SSH or SSL

keys.

● Use the certification authority including key revocation and management to sign the

certificates.

● Verify certificates and fingerprints on the server and client to avoid "man in the middle"

attacks.

● We recommend that you use certificates with a key length of 2048 bits.

● Change keys and certificates immediately, if there is a suspicion of compromise.

Security recommendations

1.2 Security recommendations

SCALANCE WLC711

10 Getting Started, 04/2016, C79000-G8976-C269-07

Secure/non-secure protocols

● Avoid and disable non-secure protocols, for example Telnet and TFTP. For historical

reasons, these protocols are still available, however not intended for secure applications.

Use non-secure protocols on the device with caution.

● The following protocols provide secure alternatives:

– SNMPv1/v2 → SNMPv3

Check whether use of SNMPv1 is necessary. SNMPv1 is classified as non-secure.

Use the option of preventing write access. The product provides you with suitable

setting options.

If SNMP is enabled, change the community names. If no unrestricted access is

necessary, restrict access with SNMP.

Use SNMPv3 in conjunction with passwords.

– HTTP → HTTPS

– SNTP → NTP

● Use secure protocols when access to the device is not prevented by physical protection

measures.

● To prevent unauthorized access to the device or network, take suitable protective

measures against non-secure protocols.

● If you require non-secure protocols and services, operate the device only within a

protected network area.

● Restrict the services and protocols available to the outside to a minimum.

Security recommendations

1.2 Security recommendations

SCALANCE WLC711

Getting Started, 04/2016, C79000-G8976-C269-07

11

Port list

The following table provides an overview of the ports through which the IWLAN

controller/access point communicate. Ports may need to be opened for correct working in the

network. Keep this in mind when configuring a firewall.

Component

Protocol

Soruce

Port

Destina-

tion Port

Service

Remark

Require

Firewall

to open

Source

Destination

(TCP/UDP)

Ports for AP/Controller Communication

Controller Access Point UDP Any 13910 WASSP

Management and Data Tunnel

between AP and Controller

Yes

Access Point Controller UDP Any 13910 WASSP

Management and Data Tunnel

between AP and Controller

Yes

Controller Access Point UDP 4500 Any Secured

WASSP

Management Tunnel between

AP and Controller

Optional

Access Point Controller UDP Any 4500 Secured

WASSP

Management Tunnel between

AP and Controller

Optional

Access Point

Controller

UDP

Any

13907

WASSP

AP Registration to Controller

Yes

Access Point Controller UDP Any 67 DHCP

Server

If Controller is DHCP Server

for AP

Optional

Access Point

Controller

UDP

Any

427

SLP

AP Registration to Controller

Optional

Controller

Access Point

TCP/UDP

Any

69

TFTP

AP image transfer

Yes

1

Access Point

Controller

TCP/UDP

Any

69

TFTP

AP image transfer

Yes

1

Controller

Access Point

TCP/UDP

Any

22

SCP

AP traces

Yes

Any Access Point TCP Any 2002,

2003

RCAPD AP Real Capture (if enabled) Optional

Any

Access Point

TCP/UDP

Any

22

SSH

Remote AP login (if enabled)

Optional

Ports for Controller Management

Any Controller TCP/UDP Any 22 SSH Controller CLI access Yes

Any

Controller

TCP/UDP

Any

5825

HTTPS

Controller GUI access

Yes

Any

Controller

TCP/UDP

Any

161

SNMP

Controller SNMP access

Yes

Any Controller TCP/UDP Any 162 SNMP

Trap

Controller SNMP access Yes

Ports for Inter Controller Mobility and Availability

Controller Controller UDP Any 13911 WASSP Mobility and Availability Tun-

nel

Yes

Controller

TCP

Any

427

SLP

SLP Directory

Yes

Controller

TCP

Any

20506

Langley

Remote Langley Secure

Yes

Controller

TCP

Any

60606

Mobility

VN MGR

Yes

Controller

TCP

Any

123

NTP

Availability time sync

Yes

Controller DHCP Server UDP Any 67 SLP Asking DHCP Server for SLP

DA

Yes

DHCP Server Controller UDP Any 68 SLP Response from DHCP Server

for SLP DA request

Yes

Security recommendations

1.2 Security recommendations

SCALANCE WLC711

12 Getting Started, 04/2016, C79000-G8976-C269-07

Component

Protocol

Soruce

Port

Destina-

tion Port

Service

Remark

Require

Firewall

to open

Source

Destination

(TCP/UDP)

Core Back-End Communication

Controller DNServer UDP Any 53 DNS If using DNS Optional

Controller Syslog Server UDP Any 514 Syslog If Controller logs to external

syslog server

Optional

Controller RADIUS

Server

UDP Any 1812 RADIUS

Authenti-

cation

and

Authori-

zation

If using RADIUS AAA Optional

Controller RADIUS

Server

UDP Any 1813 RADIUS

Account-

ing

If enabled RADIUS account-

ing

Optional

Dynamic Au-

thorization

Client (typically

NAC)

Controller UDP Any 3799 Dynamic

Authori-

zation

Server

(DAS)

Request from Dynamic Au-

thorization Client to discon-

nect a specific client

Optional

Controller AeroScout

Server

UDP 1144 12092 Location-

Based

Service

Proxy

(lbs)

AeroScout Location-Based

Service

Optional

AeroScout

Server

Controller UDP 12092 1144 Location-

Based

Service

Proxy

(lbs)

AeroScout Location-Based

Service

Optional

Controller Check Point UDP Any 18187 Check-

point

Logging to Check Point Serv-

er

Optional

1

TFTP uses port 69 only when the secure control tunnel is NOT enabled between the AP and controller. If the secure

control tunnel is enabled TFTP exchanges take place within the secure tunnel and port 69 is not used

SCALANCE WLC711

Getting Started, 04/2016, C79000-G8976-C269-07

13

Description

2

2.1

General

Information

Siemens Customer Support

If you have questions or problems, contact Siemens Customer Support at the following

address:

● https://support.industry.siemens.com

Related information can be found on the accompanying SIMATIC NET IWLAN CD:

● BAK W78xC

● BAK W786-2HPW

● SCALANCE W-700 configuration manual

Which access points can be used?

To achieve an optimum WLAN, the following SCALANCE wireless LAN access points are

ideal:

● SCALANCE wireless LAN W78xC access points

● SCALANCE Wireless LAN access points W788C-2 RJ-45

● SCALANCE Wireless LAN access points W788C-2 M12

● SCALANCE Wireless LAN access points W788C-2 M12 EEC

● SCALANCE Wireless LAN access points W786-2HPW

Note

Detection of W788C-2 M12 EEC devices

During detection of devices, the devices of the

W788C-2 M12 EEC variant are shown as

W788C

-2 M12

How is data transferred?

To transfer the data, the SCALANCE WLC711 has the following RJ-45 Ethernet connectors:

● Management port: "admin" interface. The configuration data is transferred at this port at

10/100/1000 Mbps.

● Data port: "esa0" interface. At this port, the data is transferred at 10/100/1000 Mbps.

You will find further information in the compact operating instructions SCALANCE WLC711.

Description

2.1 General

SCALANCE WLC711

14 Getting Started, 04/2016, C79000-G8976-C269-07

Where is the configuration data stored?

Your configuration data is stored directly on the WLC. It is, however, possible to store this

data as a backup and to transfer it to other WLCs. How to create backups is explained in the

SCALANCE WLC711 User Guide.

What can the WBM do?

All access points connected to a WLC are centrally monitored and managed to achieve

better administrative control. When necessary, each AP can be configured, enabled or

disabled separately. APs can be managed using the WLC. Alarms, traps and reporting

statistics are generated and can be evaluated by the network manager. The APs also send

data about performance, security and use to the WLC that can then be put together in

detailed reports.

With the WBM, you have the following options:

● Central configuration, administration and monitoring of several access points by the

SCALANCE Industrial Wireless LAN controller.

● Configuration of filter functions.

● Making the settings:

– Bridge traffic locally at WLC.

The data coming from the access points is forwarded centrally via the WLC.

– Bridge traffic locally at AP:

The data coming from the access points us forwarded directly by the access points to

the wired network.

Description

2.2 Requirement for configuration

SCALANCE WLC711

Getting Started, 04/2016, C79000-G8976-C269-07

15

2.2

Requirement for configuration

To be able to configure the SCALANCE Industrial Wireless LAN controller and the access

points with the WBM, the following conditions must be met:

● Correct connection of the hardware.

● A correct connection between the management port of the SCALANCE WLC711 and a

PC.

You will find information about setting up in the compact operating instructions SCALANCE

WLC711.

Description

2.3 LED display

SCALANCE WLC711

16 Getting Started, 04/2016, C79000-G8976-C269-07

2.3

LED display

Introduction

This section contains information explaining how the LED displays work. This means you

can make sure that the wireless LAN controller has started up completely.

LED display

Status displays

LED

Meaning

LED

Description

PWR Power supply OFF

GREEN

Standby mode

Supply voltage is applied.

L1 - - -

L2 Battery display flashing RED

RED

Battery low (remaining life less than 1 month).

Battery empty.

L3 RUN/STOP Flashing

YELLOW

flashing GREEN

System is starting up.

System running.

The L2 and L3 LEDs each flash at 1 second intervals.

If the L2 and L3 LEDs flash yellow together at an interval of 2 seconds, an upgrade or the

import of a configuration following an upgrade is being performed.

SCALANCE WLC711

Getting Started, 04/2016, C79000-G8976-C269-07

17

Getting started

3

3.1

Sequence

Below you will find an overview of the best way to configure access points.

Step 1 - Prior to configuration

Decide which WLAN service you want to use. The following are available:

●

Data

This WLAN service is recommended if your WLAN is used mainly for normal data traffic,

for example intranet. This WLAN service can be suitable for PROFINET IO if WLAN

clients move within the range of one access point (no roaming of WLAN clients between

several access points). Possible topologies for the WLAN service are as follows:

– Bridge at AP (requirement for PNIO)

– Bridge at WLC

– Routed

Note

PNIO

For complex plants requiring PROFINET IO communication, stand

-alone access

points with iPCF support are recommended.

●

Voice

This WLAN service is recommended if your WLAN is used mainly for voice and video

communication, for example VoIP.

Possible topologies for this WLAN type are as follows:

– Bridged at WLC

– Routed

●

Captive portal

With this WLAN service, you can set up a WLAN specifically for guests.

Step 2 - Setting up the network

Make sure that the external servers such as DHCP and RADIUS are available and

adequately configured. Make sure that the data port between the Industrial Ethernet switch

(IE Switch) and WLC and the IE switch and APs have the identical subnet configuration.

Getting started

3.1 Sequence

SCALANCE WLC711

18 Getting Started, 04/2016, C79000-G8976-C269-07

Step 3 - Installing hardware

Install the SCALANCE Industrial Wireless LAN controller and the access points. You will find

further information in the compact operating instructions SCALANCE WLC711.

Getting started

3.2 Logon

SCALANCE WLC711

Getting Started, 04/2016, C79000-G8976-C269-07

19

3.2

Logon

Prerequisite

To log on with the WBM, a connection must exist between the management port ("admin"

interface) of the WLC and the configuration PC.

Calling up the logon page

To call up the logon page, open a Web browser and enter the default IP address

https://192.168.10.1:5825 in the address line.

Note

Display of a security message

If a security message is displayed in the Web browser, confirm this to continue the download

of the Web page. The secu

rity message results from the pre-installed, self-signed certificate.

It is possible to install your own certificate. You will find more detailed information in the

SCALANCE WLC711 user guide.

This default IP address can be changed using the WBM. The logon page of the WBM

SCALANCE Industrial Wireless LAN controller and access points opens:

Figure 3-1 Logon page

Getting started

3.2 Logon

SCALANCE WLC711

20 Getting Started, 04/2016, C79000-G8976-C269-07

Initial logon

Default user data is set in the factory. When you log on the first time, follow the steps below:

1. Enter the user name

admin in the "User Name" input box.

2. Enter the password

abc123 in the "Password" input box.

3. Click the "Login" button. The page for basic configuration with the wizard opens.

When you have completed the basic configuration the start page of the WBM SCALANCE

Industrial Wireless LAN controller and access points is displayed immediately after a new

logon.

Access protection of the system - changing passwords

We recommend that you protect the system from unauthorized access. To do this, change

the factory-set default administrator password. The procedure is described during basic

configuration with the wizard.

Entering the wrong user name or password

If you enter an unconfigured user name or an incorrect password, an error message is

displayed.

Page is loading ...

Siemens scalance WLC711 Getting Started

Siemens scalance WLC711 Getting Started

Related papers

Other documents