Wi-Fi Mini Physical Interface Module (MPIM)

Configure Access Point

To configure the access point associated with the wireless LAN interface wl-x/0/0:

1. Configure the interface.

   content_copy zoom_out_map

   [edit]
   user@host# set wlan access-point name interface wl-x/0/0 
   

2. Set the country code (applicable only for SRX-MP-WLAN-WW models of the Mini-PIM).

   Note:

   If you do not set the country code for the SRX-MP-WLAN-WW models, the Mini-PIM considers the country code as US. You cannot set the country code for the SRX-MP-WLAN-US and SRX-MP-WLAN-IL models.

   content_copy zoom_out_map

   [edit]
   user@host# set wlan access-point name access-point-options country country-code 
   

3. Set the physical location (location of your hardware device, example: 1st-floor).

   content_copy zoom_out_map

   [edit]
   user@host# set wlan access-point name location location 
   

4. Commit the configuration.

   content_copy zoom_out_map

   [edit]
   user@host# commit 
   

Configure Radios

Every access point has two radios—radio 1 operates at 5-GHz bandwidth and radio 2 operates at 2.4-GHz bandwidth. A VAP is configured based on the radio. You can configure up to eight VAPs per radio and map up to 16 ESSIDs to individual VLANs. Wi-Fi Mini-PIM supports both the radios (2.4 and 5 GHz) to work simultaneously. You can also disable a radio. Table 2 lists the modes supported on each radio.

Changing the radio settings can cause the access point to stop and restart system processes. If this occurs, wireless clients that are connected to the access point temporarily lose connectivity. We recommend that you change radio settings when WLAN traffic is low.

To configure the radio:

1. Configure the radio mode. Radio 1 supports acn and an modes. Radio 2 supports only gn mode.

   content_copy zoom_out_map

   For radio 1:
   [edit]
   user@host# set wlan access-point name radio 1 radio-options mode [an|acn] 
   

   content_copy zoom_out_map

   For radio 2:
   [edit]
   user@host# set wlan access-point name radio 2 radio-options mode gn 
   

2. Configure the channel number. If you select auto, then the Mini-PIM chooses the channel automatically. By default, channel number is set to auto.

   content_copy zoom_out_map

   [edit]
   user@host# set wlan access-point name radio [1|2] radio-options channel number [auto | channel-number]  
   

3. Configure the channel bandwidth. The default channel bandwidth is 20 MHz for the 2.4 GHz radio and 40 MHz for the 5 GHz radio. You can only set 80 MHz as the channel bandwidth for 5 GHz radio and not for 2.4GHz.

   content_copy zoom_out_map

   [edit]
   user@host# set wlan access-point name radio [1|2] radio-options channel bandwidth [20|40|80] 
   

4. Configure the transmit power. You can configure the transmit power on a per-radio basis.

   Note:

   When you configure the transmit power, the Mini-PIM card will fix transmit power to the specified value set, in this case, the power by rate functionality does not work. So it is recommended not to set transmit power to a specified value. When you do not configure the transmit power (do not fix the transmit power to a specified value), the power by rate functionality works. If you configure the transmit power percentage to 100, then it chooses the option "auto", the behavior is similar to no transmit power configured and power by rate functionality will work.

   content_copy zoom_out_map

   [edit]
   user@host# set wlan access-point name radio [1|2] radio-options transmit-power percent  
   

5. Commit the configuration.

   content_copy zoom_out_map

   [edit]
   user@host# commit 
   

   In countries where Dynamic Frequency Selection (DFS) is required, the Wi-Fi card performs appropriate checks for radar. DFS is enabled by default. If you set the channel number to auto, the access point selects the channel from the list of DFS and non-DFS channels. You can disable DFS by using the dfs-off option set wlan access-point name radio 1 radio-options dfs-off.

   Only the 5 GHz radio (radio 1) supports DFS.

   For more information on DFS, see Channels and Frequencies Supported on the Wi-Fi Mini-PIM.

Configure Virtual Access Points (VAP)

VAPs allow segmentation of the wireless LAN into multiple broadcast domains that are the wireless equivalents of Ethernet VLANs. To configure the VAP:

1. Enter an ID and description for the VAP.

   content_copy zoom_out_map

   [edit]
   user@host# set wlan access-point name radio [1|2] virtual-access-point id description description 
   

2. Enter the SSID value.

   content_copy zoom_out_map

   [edit]
   user@host# set wlan access-point name radio [1|2] virtual-access-point id ssid ssid 
   

3. Configure one of the following security authentication methods for the VAP.

   • none—The data transferred between clients and the access point is not encrypted. Clients can associate with the access point without any authentication.

     content_copy zoom_out_map

     [edit]
     user@host# set wlan access-point name radio [1|2] virtual-access-point id security none 
     

   • wpa-enterprise—The device authenticates through an 802.1X-compliant RADIUS server.

     content_copy zoom_out_map

     [edit]
     user@host# set wlan access-point name radio [1|2] virtual-access-point id security wpa-enterprise cipher-suites ccmp 
     user@host# set wlan access-point name radio [1|2] virtual-access-point id security wpa-enterprise radius-server ip-address 
     user@host# set wlan access-point name radio [1|2] virtual-access-point id security wpa-enterprise radius-port port 
     user@host# set wlan access-point name radio [1|2] virtual-access-point id security wpa-enterprise radius-key secret-key 
     user@host# set wlan access-point name radio [1|2] virtual-access-point id security wpa-enterprise wpa-version v2 
     

   • wpa-personal—The device uses preshared keys (PSKs) or a passphrase for authentication and encryption. Keys are stored on the device and on all wireless clients. You do not need to configure a separate authentication server.

     content_copy zoom_out_map

     [edit]
     user@host# set wlan access-point name radio [1|2] virtual-access-point id security wpa-personal cipher-suites ccmp 
     user@host# set wlan access-point name radio [1|2] virtual-access-point id security wpa-personal key-type [ascii|hex] 
     user@host# set wlan access-point name radio [1|2] virtual-access-point id security wpa-personal key password 
     user@host# set wlan access-point name radio [1|2] virtual-access-point id security wpa-personal wpa-version v2 
     

4. Configure and specify the upload and download rate limits on the Wi-Fi Mini-PIM. The range for upload-limit and download-limit is from 256 Kbps to 1,048,576 Kbps.

   content_copy zoom_out_map

   [edit]
   user@host# set wlan access-point name radio [1|2] virtual-access-point id upload-limit upload-limit-rate 
   user@host# set wlan access-point name radio [1|2] virtual-access-point id download-limit download-limit-rate  
   

5. Specify the maximum number of clients that can be connected to the VAP.

   content_copy zoom_out_map

   [edit]
   user@host# set wlan access-point name radio [1|2] virtual-access-point id maximum-stations number 
   

6. Commit the configuration.

   content_copy zoom_out_map

   [edit]
   user@host# commit 
   

After completing the configuration successfully, you can view the parameters by using the show wlan access-points name detail command.

Configure WPA enterprise authentication

(Optional) Wi-Fi protected access (WPA) enterprise is Wi-Fi alliance standard that uses RADIUS server authentication with AES-CCMP cipher suite. With this mode you can use high security encryption along with a centrally managed user authentication. Only the WPA2 standard is supported. To configure the WPA enterprise authentication:

1. Configure the address book and assign a security zone.

   content_copy zoom_out_map

   [edit]
   user@host# set security address-book book-name address address-name ip-prefix 
   user@host# set security address-book book-name attach zone trust  
   user@host# set security address-book book-name attach zone dot1x  
   

2. Configure security source rule-set from trust zone to the WPA authentication.

   content_copy zoom_out_map

   [edit]
   user@host# set security nat source rule-set rule-set-name from zone trust 
   user@host# set security nat source rule-set   rule-set-name to zone dot1x 
   

3. Configure the security source to match the source and destination address.

   content_copy zoom_out_map

   [edit]
   user@host# set security nat source rule-set  rule-set-name rule rule-name match source-address ip-address 
   user@host# set security nat source rule-set rule-set-name rule rule-name match destination-address ip-address 
   

4. Configure the UDP protocol and security source on the interface.

   content_copy zoom_out_map

   [edit]
   user@host# set security nat source rule-set rule-set-name rule rule-name match protocol udp 
   user@host# set security nat source rule-set rule-set-name rule rule-name then source-nat interface  
   

5. Assign the security policies to the source and destination address.

   content_copy zoom_out_map

   [edit]
   user@host# set security policies from-zone trust to-zone dot1x policy internet-access match source-address ip-address  
   user@host# set security policies from-zone trust to-zone dot1x policy internet-access match destination-address ip-address  
   user@host# set security policies from-zone trust to-zone dot1x policy internet-access match application any  
   user@host# set security policies from-zone trust to-zone dot1x policy internet-access then permit  
   

6. Commit the configuration.

After completing the configuration successfully completed, you can view the parameters by using the show wlan access-points name virtual-access-points command.