Contents

WLAN access commands· 1

access-control acl 1

accounting-level 2

beacon ssid-advertise· 3

beacon ssid-hide· 3

broadcast-probe reply· 4

client idle-timeout 5

client keep-alive· 6

client keep-alive interval 6

client max-count 7

client preferred-vlan authorized· 8

client report-mandatory· 9

client smart-access enable· 9

client vlan-alloc· 10

client-statistics-report 11

customlog format wlan· 11

description· 12

display wlan ap all client-number 13

display wlan ap all radio client-number 13

display wlan ap-group all client-number 14

display wlan blacklist 14

display wlan bss· 15

display wlan client 16

display wlan client ipv6· 23

display wlan client online-duration· 24

display wlan client status· 25

display wlan service-template· 27

display wlan statistics client 32

display wlan statistics connect-history· 33

display wlan statistics service template· 35

display wlan whitelist 35

inherit exclude service-template· 36

nas-id· 36

nas-port-id· 37

nas-port-type· 38

nas-vlan· 39

quick-association enable· 40

reset wlan client 41

reset wlan dynamic-blacklist 41

reset wlan statistics client 42

reset wlan statistics service-template· 42

roam-enhance· 43

service-template· 44

service-template enable· 45

snmp-agent trap enable wlan client 45

snmp-agent trap enable wlan client-audit 46

ssid· 46

unknown-client 47

vlan· 48

wlan accounting-policy· 48

wlan apply accounting-policy· 49

wlan association optimization· 50

wlan client bss-load-ie enable· 50

wlan client forwarding enable· 51

wlan client reauthentication-period· 52

wlan dynamic-blacklist active-on-ap· 53

wlan dynamic-blacklist lifetime· 53

wlan imc· 54

wlan link-test 54

wlan management-wifi ssid-hide· 56

wlan nas-port-id format 57

wlan permit-ap-group· 58

wlan permit-ssid· 59

wlan service-template· 59

wlan static-blacklist mac-address· 60

wlan web-server api-path· 61

wlan web-server host 61

wlan web-server max-client-entry· 62

wlan whitelist mac-address· 63

 

WLAN access commands

access-control acl

Use access-control acl to specify an ACL for ACL-based access control.

Use undo access-control acl to restore the default.

Syntax

access-control acl acl-number

undo access-control acl

Default

No ACL is specified.

Views

AP view

Service template view

Predefined user roles

network-admin

Parameters

acl-number: Specifies the number of a Layer 2 ACL, in the range of 4000 to 4999.

Usage guidelines

This feature controls client access by using the specified ACL rules. When the device receives an association request, it performs the following actions:

·     Allows the client to access the WLAN if the MAC address of the client matches the MAC address attribute or MAC address OUI attribute in a rule and the rule action is permit. If multiple clients match the OUI attribute, all these clients are allowed to access the WLAN.

·     Denies the client's access to the WLAN if no match is found or the matched rule has a deny statement.

When you configure this feature, follow these restrictions and guidelines:

·     If the specified ACL contains a deny statement, configure a permit statement for the ACL to permit all clients. If you do not do so, no clients can come online.

·     ACL-based access control configuration takes precedence over whitelist and blacklist configuration.

·     You can specify only one ACL. If you execute this command multiple times, the most recent configuration takes effect.

·     The configuration in AP view takes precedence over the configuration in service template view.

Examples

# Create ACL 4000 and create ACL rules to permit the client with MAC address 000e-35b2-000e and clients with the specified OUI. Specify ACL 4000 for service template service1.

<Sysname> system-view

[Sysname] acl mac 4000

[Sysname-acl-mac-4000] rule 0 permit source-mac 000e-35b2-000e ffff-ffff-ffff

[Sysname-acl-mac-4000] rule 1 permit source-mac 000e-35b2-000f ffff-ff00-0000

[Sysname-acl-mac-4000] rule 2 deny

[Sysname-acl-mac-4000] quit

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] access-control acl 4000

# Create ACL 4000 and create ACL rules to permit the client with MAC address 000e-35b2-000e and clients with the specified OUI. Specify ACL 4000 for AP ap1.

<Sysname> system-view

[Sysname] acl mac 4000

[Sysname-acl-mac-4000] rule 0 permit source-mac 000e-35b2-000e ffff-ffff-ffff

[Sysname-acl-mac-4000] rule 1 permit source-mac 000e-35b2-000f ffff-ff00-0000

[Sysname-acl-mac-4000] rule 2 deny

[Sysname-acl-mac-4000] quit

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] access-control acl 4000

accounting-level

Use accounting-level to specify a traffic level for ACL-based accounting.

Use undo accounting-level to remove the accounting configuration for a traffic level.

Syntax

accounting-level level acl { acl-number | ipv6 ipv6-acl-number }

undo accounting-level level

Default

No traffic levels are specified for ACL-based accounting.

Views

Accounting policy view

Predefined user roles

network-admin

Parameters

level: Specifies the traffic level in the range of 1 to 8.

acl-number: Specifies an IPv4 ACL number in the range of 3000 to 3999.

ipv6 ipv6-acl-number: Specifies an IPv6 ACL number in the range of 3000 to 3999.

Usage guidelines

An accounting policy takes effect on matching packets no matter whether the ACL action is deny or permit. For wireless packets received on an AP, the ACL matches the destination address of the packets. For wireless packets sent by an AP, the ACL matches the source address of the packets.

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Specify the traffic level as 1 for packets matching ACL 3000 in accounting policy view of policy abc.

<Sysname> system-view

[Sysname] wlan accounting-policy abc

[Sysname-wlan-acctpolicy-abc] accounting-level 1 acl 3000

Related commands

wlan accounting-policy

beacon ssid-advertise

Use beacon ssid-advertise to enable Service Set Identifier (SSID) broadcast in beacon frames.

Use undo beacon ssid-advertise to restore the default.

Syntax

beacon ssid-advertise

undo beacon ssid-advertise

Default

An AP hides SSIDs in beacon frames when the maximum number of associated clients is reached.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

This feature enables new clients to discover APs even if the number of associated clients reaches the upper limit. However, these clients cannot associate with the APs.

Examples

# Enable SSID broadcast in beacon frames.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-s1] beacon ssid-advertise

Related commands

client max-count

 

beacon ssid-hide

Use beacon ssid-hide to disable advertising of the Service Set Identifier (SSID) in beacon frames.

Use undo beacon ssid-hide to restore the default.

Syntax

beacon ssid-hide

undo beacon ssid-hide

Default

The SSID is advertised in beacon frames.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

This command disables a radio from carrying SSIDs in the beacon frames and responding to probe requests after the specified service template is bound to the radio.

Examples

# Disable advertising the SSID in beacon frames.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] beacon ssid-hide

broadcast-probe reply

Use broadcast-probe reply enable to enable an AP to respond to broadcast probe requests.

Use broadcast-probe reply disable to disable an AP from responding to broadcast probe requests.

Use undo broadcast-probe reply to restore the default.

Syntax

broadcast-probe reply { disable | enable [ rssi-threshold rssi-value ] } [ frequency-band { 2.4 | 5 } ]

undo broadcast-probe reply

Default

In AP view, an AP uses the configuration in AP group view.

In AP group view, an AP responds to all broadcast probe requests.

Views

AP view

AP group view

Predefined user roles

network-admin

Parameters

rssi-threshold rssi-value: Specifies an RSSI threshold in the range of 1 to 100. If you do not specify this option, the command enables the AP to respond to broadcast probe requests with any RSSIs.

frequency-band: Specifies a frequency band. If you do not specify this keyword, the command enables the AP to respond to broadcast probe requests received at both the 5 GHz and 2.4 GHz bands.

2.4: Specifies the 2.4 GHz band.

5: Specifies the 5 GHz band.

Usage guidelines

Broadcast probe requests do not carry any SSIDs. Upon receiving a broadcast probe request, an AP responds with a probe response that carries service information for the AP.

By default, an AP responds to all broadcast probe requests, which might threat network security and decrease AP performance. However, disabling responding to broadcast probe requests might forbid clients from roaming to the optimal AP in time, affecting client access.

You can perform this task to enable an AP to respond to broadcast requests from a specific frequency band with strong signal strength.

The configuration in AP view takes precedence over the configuration in AP group view.

Examples

# Disable AP ap1 from responding to broadcast probe requests at all frequency bands.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] broadcast-probe reply disable

# Disable APs in AP group group1 from responding to broadcast probe requests at all frequency bands.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] broadcast-probe reply disable

client idle-timeout

Use client idle-timeout to set the client idle timeout timer.

Use undo client idle-timeout to restore the default.

Syntax

client idle-timeout timeout

undo client idle-timeout

Default

In AP view, an AP uses the configuration in AP group view.

In AP group view, the client idle timeout timer is 3600 seconds.

Views

AP view

AP group view

Predefined user roles

network-admin

Parameters

timeout: Specifies the client idle timeout timer in the range of 60 to 86400 seconds.

Usage guidelines

If an online client does not send any frames to the associated AP before the client idle timeout timer expires, the AP logs off the client.

The configuration in AP view takes precedence over the configuration in AP group view.

Examples

# Set the client idle timeout timer to 2000 seconds for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] client idle-timeout 2000

# Set the client idle timeout timer to 2000 seconds for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client idle-timeout 2000

client keep-alive

Use client keep-alive enable to enable client keepalive.

Use client keep-alive disable to disable client keepalive.

Use undo client keep-alive to restore the default.

Syntax

client keep-alive { disable | enable }

undo client keep-alive

Default

In AP view, an AP uses the configuration in AP group view.

In AP group view, client keepalive is disabled.

Views

AP view

AP group view

Predefined user roles

network-admin

Parameters

disable: Disables client keepalive.

enable: Enables client keepalive.

Usage guidelines

This feature enables an AP to send keepalive packets to clients at the client keepalive interval to determine whether the clients are online. If the AP does not receive any replies from a client within three keepalive intervals, it logs off the client.

The configuration in AP view takes precedence over the configuration in AP group view.

Examples

# Enable client keepalive for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] client keep-alive enable

# Enable client keepalive for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client keep-alive enable

Related commands

client keep-alive interval

client keep-alive interval

Use client keep-alive interval to set the client keepalive interval.

Use undo client keep-alive interval to restore the default.

Syntax

client keep-alive interval interval

undo client keep-alive interval

Default

In AP view, an AP uses the configuration in AP group view.

In AP group view, the client keepalive interval is 300 seconds.

Views

AP view

AP group view

Predefined user roles

network-admin

Parameters

interval: Specifies the client keepalive interval in the range of 3 to 1800 seconds.

Usage guidelines

Enable client keepalive before you execute this command.

This feature enables an AP to send keepalive packets to clients at the client keepalive interval to determine whether the clients are online. If the AP does not receive any replies from a client within three keepalive intervals, it logs off the client.

As a best practice to ensure client stability, set the keepalive interval to a value larger than 10 seconds.

The configuration in AP view takes precedence over the configuration in AP group view.

Examples

# Set the keepalive interval to 20 seconds for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] client keep-alive interval 20

# Set the keepalive interval to 20 seconds for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client keep-alive interval 20

Related commands

client keep-alive enable

client max-count

Use client max-count to set the maximum number of associated clients for a service template.

Use undo client max-count to restore the default.

Syntax

client max-count max-number

undo client max-count

Default

The number of associated clients for a service template is not limited.

Views

Service template view

Predefined user roles

network-admin

Parameters

max-number: Specifies the maximum number of clients in the range of 1 to 512.

Usage guidelines

With this feature configured, new clients cannot access the WLAN from a radio and the SSID is hidden when the maximum number is reached on the radio.

Examples

# Set the maximum number of associated clients to 38 for service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client max-count 38

Related commands

beacon ssid-hide

client preferred-vlan authorized

Use client preferred-vlan authorized to configure clients to prefer the authorization VLAN after roaming.

Use undo client preferred-vlan authorized to configure client VLANs to remain unchanged after client roaming.

Syntax

client preferred-vlan authorized

undo client preferred-vlan authorized

Default

Clients prefer the authorization VLAN after roaming.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

This feature takes effect only on 802.1X and MAC authentication clients.

Typically, the VLAN of a client remains unchanged after client roaming. However, if the client triggers a security alert configured on IMC after roams to another AP, the issued authorization VLAN for user isolation takes effect.

Examples

# Configure clients to prefer the authorization VLAN after roaming.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client preferred-vlan authorized

client report-mandatory

Use client report-mandatory to allow locally authenticated clients to come online after successful client information reporting.

Use undo client report-mandatory to allow locally authenticated clients to come online immediately after successful local authentication.

Syntax

client report-mandatory

undo client report-mandatory

Default

Locally authenticated clients come online after successful client information reporting.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

By default, an AP reports information about locally authenticated clients that pass authentication to the AC, and the AC creates client entries and informs the AP to get the clients online. If the CAPWAP tunnel between the AC and the AP operates incorrectly, clients might fail to come online and perform reauthentication repeatedly. To avoid this problem, you can allow clients to come online immediately after successful local authentication so that the AP can forward client traffic when the AC cannot be reached. The AP synchronizes client information to the AC when the tunnel recovers.

Examples

# Allow locally authenticated clients to come online immediately after successful local authentication.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] undo client report-mandatory

client smart-access enable

Use client smart-access enable to enable smart client access.

Use undo client smart-access enable to restore the default.

Syntax

client smart-access enable

undo client smart-access enable

Default

Smart client access is disabled.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

This feature enables H3C wireless clients to access the WLAN automatically when the AKM mode is set to PSK or when the radio is bound to an empty service template.

Examples

# Enable smart client access.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client smart-access enable

client vlan-alloc

Use client vlan-alloc to set the VLAN allocation method for clients.

Use undo client vlan-alloc to restore the default.

Syntax

client vlan-alloc { dynamic | static | static-compatible }

undo client vlan-alloc

Default

The VLAN allocation method for clients is dynamic.

Views

Service template view

Predefined user roles

network-admin

Parameters

dynamic: Specifies dynamic VLAN allocation.

static: Specifies static VLAN allocation.

static-compatible: Specifies compatible static VLAN allocation.

Usage guidelines

When a client comes online for the first time, the associated AP assigns a random VLAN to it. When the client comes online again, the VLAN assigned to the client depends on the allocation method.

·     Static allocation—The client inherits the VLAN that has been assigned to it. If the IP address lease has not expired, the client will use the same IP address. This method helps save IP addresses.

·     Dynamic allocation—The radio re-assigns a VLAN to the client. This method balances clients in all VLANs.

·     Compatible static allocation—The client inherits the VLAN that has been assigned to it when roaming between Comware 5 and Comware 7 ACs.

Examples

# Set the VLAN allocation method for clients to dynamic.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client vlan-alloc dynamic

Related commands

service-template

client-statistics-report

Use client-statistics-report enable to enable client statistics reporting.

Use client-statistics-report disable to disable client statistics reporting.

Use undo client-statistics-report to restore the default.

Syntax

client-statistics-report { disable | enable [ interval interval ] }

undo client-statistics-report

Default

In AP view, an AP uses the configuration in AP group view.

In AP group view, client statistics reporting is enabled.

Views

AP view

AP group view

Predefined user roles

network-admin

Parameters

interval interval: Specifies the interval at which client statistics are reported, in the range of 2 to 120 seconds. The interval is 50 seconds by default.

Usage guidelines

This feature enables an AP to report client statistics to the AC at the specified intervals for client entry update. The AC informs the AP to log off a client if the client's information does not exist in the saved entries.

To avoid frequent client re-association, disable this feature when the network is in a bad condition.

The configuration in AP view takes precedence over the configuration in AP group view.

Examples

# Enable client statistics reporting and set the reporting interval to 20 seconds for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] client-statistics-report enable interval 20

# Enable client statistics reporting and set the reporting interval to 20 seconds for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client-statistics-report enable interval 20

customlog format wlan

Use customlog format wlan to enable the device to generate client logs in the specified format.

Use undo customlog format wlan to restore the default.

Syntax

customlog format wlan { normal | sangfor }

undo customlog format wlan

Default

The device generates client logs only in H3C format.

Views

System view

Predefined user roles

network-admin

Parameters

normal: Specifies normal format.

sangfor: Specifies sangfor format.

Usage guidelines

By default, the device generates client logs only in H3C format that logs AP name, radio ID, client MAC address, SSID, BSSID, and client online status.

You can configure the device to generate client logs in one of the following formats:

·     Normal—Logs AP MAC address, AP name, client IP address, client MAC address, SSID, and BSSID.

·     Sangfor—Logs AP MAC address, client IP address, and client MAC address.

This feature does not affect the generation of client logs in H3C format.

Examples

# Enable the device to generate client logs in sangfor format.

<Sysname> system-view

[Sysname] customlog format wlan sangfor

description

Use description to configure a description for a service template.

Use undo description to restore the default.

Syntax

description text

undo description

Default

No description is configured for a service template.

Views

Service template view

Predefined user roles

network-admin

Parameters

text: Specifies a description, a case-sensitive string of 1 to 64 characters.

Examples

# Configure a description for service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] description wlanst

display wlan ap all client-number

Use display wlan ap all client-number to display the number of online clients at the 2.4 GHz band and the 5 GHz band.

Syntax

display wlan ap all client-number

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the number of online clients at both the 2.4 GHz and 5 GHz bands.

<System> display wlan ap all client-number

AP name           Clients           2.4GHz            5GHz

ap1               2                 2                 0

Table 1 Command output

‌

display wlan ap all radio client-number

Use display wlan ap all radio client-number to display the number of online clients and channel information for each radio.

Syntax

display wlan ap all radio client-number

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the number of online clients and channel information for each radio.

<Sysname> display wlan ap all radio client-number

AP name                    RID     Channel     Clients

ap1                        1       44          12

ap1                        2       11          4

display wlan ap-group all client-number

Use display wlan ap-group all client-number to display the number of online clients in each radio group.

Syntax

display wlan ap-group all client-number

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the number of online clients in each radio group.

<Sysname> display wlan ap-group all client-number

AP group name                    Group ID    Clients     2.4GHz      5GHz

default-group                    1           150         100         50

1                                2           250         50          200

Table 2 Command output

‌

display wlan blacklist

Use display wlan blacklist to display blacklist entries.

Syntax

display wlan blacklist { dynamic | static }

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

dynamic: Specifies the dynamic blacklist.

static: Specifies the static blacklist.

Examples

# Display static blacklist entries.

<Sysname> display wlan blacklist static

Total number of clients: 3

 MAC addresses:

  000e-35b2-000e

  0019-5b8e-b709

  001c-f0bf-9c92

# Display dynamic blacklist entries.

<Sysname> display wlan blacklist dynamic

Total number of clients: 3

MAC address     APID   RID   Lifetime (s)  Duration (hh:mm:ss)

000f-e2cc-0001  1      1     300           00:02:11

000f-e2cc-0002  2      1     300           00:01:17

000f-e2cc-0003  3      1     300           00:02:08

Table 3 Command output

‌

display wlan bss

Use display wlan bss to display basic service set (BSS) information.

Syntax

display wlan bss { all | ap ap-name | bssid bssid } [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

all: Displays all BSSs.

ap ap-name: Specifies an AP by its name, a case-sensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), dots (.), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-).

bssid bssid: Specifies a BSS by its ID. The value is a 48-bit hexadecimal number in the format of H-H-H.

verbose: Displays detailed client information. If you do not specify this keyword, the command displays brief client information.

Examples

# Display brief information about all BSSs.

<Sysname> display wlan bss all

Total number of BSSs: 4

AP name                   RID  SSID                            BSSID

ap1                       1    SSID1                           001c-f08f-f804

ap1                       2    SSID1                           001c-f08f-f806

ap2                       1    SSID1                           001c-f0bf-9c92

ap2                       2    SSID1                           001c-f0bf-9c94

# Display detailed information about the BSS with ID 001c-f08f-f804.

<Sysname> display wlan bss bssid 001c-f08f-f804 verbose

AP name                       : ap1

BSSID                         : 001c-f08f-f804

Radio ID                      : 1

Service template name         : servcie1

SSID                          : SSID1

VLAN ID                       : 1

VLAN ID2                      : 4

AKM mode                      : Not configured

User authentication mode      : Bypass

Table 4 Command output

‌

display wlan client

Use display wlan client to display client information.

Syntax

display wlan client [ ap ap-name [ radio radio-id ] | mac-address mac-address | service-template service-template-name | frequency-band { 2.4 | 5 } ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

ap ap-name: Displays information about clients that are connected to the specified AP. The AP name is a case-sensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), dots (.), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-).

radio radio-id: Displays information about clients that are connected to the specified radio. The value range for the radio-id argument varies by device model. If you do not specify this option, the command displays information about all clients that are connected to the specified AP.

mac-address mac-address: Specifies a client by its MAC address.

service-template service-template-name: Displays information about clients that are associated with the specified service template. The service template name is a case-insensitive string of 1 to 63 characters.

frequency-band: Displays information about clients working on the specified band.

2.4: Specifies the 2.4 GHz band.

5: Specifies the 5 GHz band.

verbose: Displays detailed client information. If you do not specify this keyword, the command displays brief client information.

Examples

# Display brief information about all clients.

<Sysname> display wlan client

Total number of clients: 3

 

MAC address    Username             AP name               R IP address      VLAN

000f-e265-6400 N/A                  ap1                   1 1.1.1.1         100

000f-e265-6401 user                 ap2                   1 3.0.0.3         200

84db-ac14-dd08 N/A                  ap1                   1 5.5.5.3         1

Table 5 Command output

‌

# Display detailed information about the client with MAC address 000f-e265-6400.

<Sysname> display wlan client mac-address 000f-e265-6400 verbose

Total number of clients: 1

 

MAC address                        : 000f-e265-6400

IPv4 address                       : 10.1.1.114

IPv6 address                       : 2001::1234:5678:0102:0304

Username                           : N/A

AID                                : 1

AP ID                              : 1

AP name                            : ap1

Radio ID                           : 1

Channel                            : 36

SSID                               : office

BSSID                              : 0026-3e08-1150

VLAN ID                            : 3

VLAN ID2                           : N/A

Sleep count                        : 3

Wireless mode                      : 802.11gn

Channel bandwidth                  : 20MHz

20/40 BSS Coexistence Management   : Not supported

SM power save                      : Enabled

Short GI for 20MHz                 : Supported

Short GI for 40MHz                 : Supported

Short GI for 80MHz                 : Supported

Short GI for 160/80+80MHz          : Not supported

STBC RX capability                 : Not supported

STBC TX capability                 : Not supported

LDPC RX capability                 : Not supported

SU beamformee capability           : Not supported

MU beamformee capability           : Not supported

Beamformee STS capability          : N/A

Block Ack                          : TID 0 In

Supported VHT-MCS set              : NSS1 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

                                     NSS2 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

Supported HT MCS set               : 0, 1, 2, 3, 4, 5, 6, 7,

                                     8, 9, 10, 11, 12, 13, 14,

                                     15

Supported rates                    : 1, 2, 5.5, 6, 9, 11,

                                     12, 18, 24, 36, 48, 54 Mbps

QoS mode                           : WMM

Listen interval                    : 10

RSSI                               : 62

Rx/Tx rate                         : 130/195 Mpbs

Speed                              : N/A

Authentication method              : Open system

Security mode                      : PRE-RSNA

AKM mode                           : Not configured

Cipher suite                       : N/A

User authentication mode           : Bypass

WPA3 status                        : Disabled

Authorization ACL ID               : 3001(Not effective)

Authorization user profile         : N/A

Authorization CAR                  :

  Average input rate               : 102400 bps

  Average output rate              : 102400 bps

Roam status                        : N/A

Key derivation                     : SHA1

PMF status                         : Enabled

Forwarding policy name             : Not configured

Online time                        : 0days 0hours 1minutes 13seconds

FT status                          : Inactive

BTM status                         : Disabled

Table 6 Command output

‌

display wlan client ipv6

Use display wlan client ipv6 to display information about client IPv6 addresses.

Syntax

display wlan client ipv6

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display brief status information about the specified client.

<Sysname> display wlan client ipv6

MAC address    AP name               IPv6 address                            VLAN

84db-ac14-dd08 ap1                   1::2:0:0:3                              300

Table 7 Command output

‌

display wlan client online-duration

Use display wlan client online-duration to display client online duration.

Syntax

display wlan client online-duration [ ap ap-name ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

ap ap-name: Specifies an AP by its name, a case-sensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), dots (.), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-).

verbose: Displays detailed information. If you do not specify this keyword, the command displays brief information.

Examples

# Display brief information about client online duration.

<Sysname> display wlan client online-duration

Total number of online clients: 2

MAC address            IPv4 address    Online duration

a4c1-5b79-fa5b-1d62    192.168.11.123  0days 0hours 2minutes 23seconds

22d3-c5b7-a4b5-96fa    192.168.11.234  0days 0hours 5minutes 34seconds

Table 8 Command output

‌

display wlan client status

Use display wlan client status to display client status information.

Syntax

display wlan client status [ mac-address mac-address ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

mac-address mac-address: Specifies a client by its MAC address in the format of H-H-H. If you do not specify this option, the command displays status information about all clients.

verbose: Displays detailed client status information. If you do not specify this keyword, the command displays brief client status information.

Examples

# Display brief status information about the specified client.

<Sysname> display wlan client status mac-address 001c-f08f-f804

Total number of clients: 1

 

MAC address     RSSI  Rx/Tx rate   Speed(bps)   Discard  AP name          RID

001c-f08f-f804  0     39M/117M      N/A          0.00%    ap2              2

# Display brief status information about all clients.

<Sysname> display wlan client status

Total number of clients: 2

 

MAC address      RSSI  Rx/Tx rate   Speed(bps)   Discard  AP name          RID

000b-c002-9d09   65    39M/117M      N/A          0.00%    ap2              2

000f-e265-6401   62    130M/195M     N/A          0.00%    ap1              1

Table 9 Command output

‌

# Display detailed status information about the specified client.

<Sysname> display wlan client status mac-address 001c-f08f-f804 verbose

Total number of clients: 1

 

MAC address                       : 001c-f08f-f804

AP name                           : ap2

Radio ID                          : 2

RSSI                              : 0

Rx/Tx rate                        : 39/117 Mbps

Speed                             ：N/A

Received:

 Retransmitted packets            : 84

 Retransmitted packet ratio       : 64.12 %

Sent:

 Retransmitted packets            : 0

 Retransmitted packet ratio       : 0.00 %

Discarded:

 Discarded packets                : 0

 Discarded packet ratio           : 0.00 %

Table 10 Command output

‌

display wlan service-template

Use display wlan service-template to display service template information.

Syntax

display wlan service-template [ service-template-name ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters. If you do not specify this argument, the command displays information about all service templates.

verbose: Displays detailed service template information.

Examples

# Display brief information about all service templates.

[Sysname] display wlan service-template

Total number of service templates: 2

Service template name           SSID                                    Status

1                               2333                                    Enabled

2                               3222                                    Enabled

# Display detailed information about all service templates.

<Sysname> display wlan service-template verbose

Service template name                            : service1

Description                                      : Not configured

SSID                                             : wuxianfuwu

SSID-hide                                        : Disabled

User-isolation                                   : Disabled

Service template status                          : Disabled

Maximum clients per BSS                          : 64

Frame format                                     : Dot3

Seamless roam status                             : Disabled

Seamless roam RSSI threshold                     : 50

Seamless roam RSSI gap                           : 20

VLAN ID                                          : 1

Service VLAN ID                                  : N/A

Service VLAN TPID                                : dot1q

Customer Vlan                                    : 3

AKM mode                                         : PSK

Security IE                                      : RSN

Cipher suite                                     : CCMP

WEP key ID                                       : 1

TKIP countermeasure time                         : 100 sec

PTK lifetime                                     : 43200 sec

PTK rekey                                        : Enabled

GTK rekey                                        : Enabled

GTK rekey method                                 : Time-based

GTK rekey time                                   : 86400 sec

GTK rekey client-offline                         : Enabled

WPA3 status                                      : Disabled

PPSK                                             : Disabled

PPSK Fail Permit                                 : Disabled

Enhance-open status                              : Enabled

Enhanced-open transition-mode service-template   : N/A

User authentication mode                         : Bypass

Intrusion protection                             : Disabled

Intrusion protection mode                        : Temporary-block

Temporary block time                             : 180 sec

Temporary service stop time                      : 20 sec

Fail VLAN ID                                     : 1

802.1X handshake                                 : Enabled

802.1X handshake secure                          : Disabled

802.1X domain                                    : my-domain

MAC-auth domain                                  : Not configured

Max 802.1X users per BSS                         : 4096

Max MAC-auth users per BSS                       : 4096

802.1X re-authenticate                           : Enabled

Authorization fail mode                          : Online

Accounting fail mode                             : Online

Authorization                                    : Permitted

Key derivation                                   : SHA1

PMF status                                       : Optional

Hotspot policy number                            : Not configured

Forwarding policy status                         : Disabled

Forwarding policy name                           : Not configured

Forwarder                                        : AP

FT status                                        : Disabled

QoS trust                                        : Port

QoS priority                                     : 0

BTM status                                       : Disabled

Table 11 Command output

‌

display wlan statistics client

Use display wlan statistics client to display client statistics.

Syntax

display wlan statistics client [ mac-address mac-address ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

mac-address mac-address: Specifies a client by its MAC address. If you do not specify this option, the command displays statistics for all clients.

Examples

# Display statistics for all clients.

<Sysname> display wlan statistics client

MAC address                : 0014-6c8a-43ff

AP name                    : ap1

Radio ID                   : 1

SSID                       : office

BSSID                      : 000f-e2ff-7700

RSSI                       : 31

Sent frames:

  Back ground              : 0/0 (frames/bytes)

  Best effort              : 9/1230 (frames/bytes)

  Video                    : 0/0 (frames/bytes)

  Voice                    : 2/76 (frames/bytes)

Received frames:

  Back ground              : 0/0 (frames/bytes)

  Best effort              : 18/2437 (frames/bytes)

  Video                    : 0/0 (frames/bytes)

  Voice                    : 7/468 (frames/bytes)

Discarded frames:

  Back ground              : 0/0 (frames/bytes)

  Best effort              : 0/0 (frames/bytes)

  Video                    : 0/0 (frames/bytes)

  Voice                    : 5/389 (frames/bytes)

Table 12 Command output

‌

display wlan statistics connect-history

Use display wlan statistics connect-history to display client connection history.

Syntax

display wlan statistics connect-history { ap { all | name ap-name } | service-template service-template-name }

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

ap: Specifies APs.

all: Specifies all APs.

name ap-name: Specifies an AP by its name, a case-sensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), dots (.), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-).

service-template service-template-name: Specifies a service template by its name.

Examples

# Display the connection history for service template 1.

<Sysname> display wlan statistics connect-history service-template 1

AP name                     : ap1

Radio ID                    : 1

Associations                : 132

Association failures        : 3

Reassociations              : 30

Rejections                  : 12

Abnormal disassociations    : 2

Current associations        : 57

# Display the connection history for AP ap1.

<Sysname> display wlan statistics connect-history ap name ap1

AP name                       : ap1

Associations                  : 1

Reassociations                : 0

Failures                      : 0

Rejections                    : 0

Abnormal disassociations      : 0

Current associations          : 1

Current 2G sta                : 0

   11b sta                    : 0

   11g sta                    : 0

   11gn sta                   : 0

   11gac sta                  : 0

   11gax sta                  : 0

Current 5G sta                : 0

   11a sta                    : 0

   11an sta                   : 0

   11ac sta                   : 2

   11ax sta                   : 0

Received bytes                : 1000

Sent bytes                    : 2000

display wlan statistics service template

Use display wlan statistics service-template to display service template statistics.

Syntax

display wlan statistics service-template service-template-name

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

service-template service-template-name: Specifies a service template by its name.

Examples

# Display statistics for service template 1.

<Sysname> display wlan statistics service-template 1

AP name                       : ap1

Radio ID                      : 1

Received:

  Frame count                 : 1713

  Frame bytes                 : 487061

  Data frame count            : 1683

  Data frame bytes            : 485761

  Association request count   : 2

Sent:

  Frame count                 : 62113

  Frame bytes                 : 25142076

  Data frame count            : 55978

  Data frame bytes            : 22626600

  Association response count  : 2

display wlan whitelist

Use display wlan whitelist to display whitelist entries.

Syntax

display wlan whitelist

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display whitelist entries.

<Sysname> display wlan whitelist

Total number of clients: 3

 MAC addresses:

  000e-35b2-000e

  0019-5b8e-b709

  001c-f0bf-9c92

inherit exclude service-template

Use inherit exclude service-template to configure an AP to not inherit the specified service template from the AP group to which it belongs.

Use undo inherit exclude service-template to restore the default.

Syntax

inherit exclude service-template service-template-name

undo inherit exclude service-template service-template-name

Default

An AP inherits the service template bound to an AP group.

Views

Radio view

Predefined user roles

network-admin

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters.

Examples

# Configure AP ap1 to not inherit service template st from an AP group.

<Sysname> system-view

[Sysname] wlan ap ap1

[Sysname-ap-ap1] radio 1

[Sysname-ap-ap1-radio-1] inherit exclude service-template st

nas-id

Use nas-id to set the network access server identifier (NAS ID).

Syntax

nas-id nas-id

undo nas-id

Default

In AP view, an AP uses the configuration in AP group view. If no configuration exists in AP group view, the AP uses the configuration in global configuration view.

In AP group view, an AP uses the configuration in global configuration view.

In global configuration view, no NAS ID is specified.

Views

AP view

AP group view

Global configuration view

Predefined user roles

network-admin

Parameters

nas-id: Specifies a NAS ID, a case-sensitive string of 1 to 63 characters.

Usage guidelines

After coming online, a client sends a RADIUS request that carries the NAS ID to the RADIUS server to indicate its network access server.

The priorities for the configuration in AP view, AP group view, and global configuration view are in descending order. You can also set the NAS ID when binding a service template to a radio. If you have specified a NAS ID when binding a service template to a radio, the AP uses the NAS ID specified for the service template.

Examples

# Set the NAS ID to abc123 for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-AGN

[Sysname-wlan-ap-ap1] nas-id abc123

# Set the NAS ID to abc123 for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] nas-id abc123

# Set the global NAS ID to abc123.

<Sysname> system-view

[Sysname] wlan global-configuration

[Sysname-wlan-global-configuration] nas-id abc123

nas-port-id

Use nas-port-id to set the network access server port identifier (NAS port ID).

Use the undo nas-port-id to restore the default.

Syntax

nas-port-id nas-port-id

undo nas-port-id

Default

In AP view, an AP uses the configuration in AP group view. If no NAS ID is specified in AP group view, the AP uses the configuration in global configuration view.

In AP group view, an AP uses the configuration in global configuration view.

In global configuration view, no NAS port ID is specified.

Views

AP view

AP group view

Global configuration view

Predefined user roles

network-admin

Parameters

nas-port-id: Specifies a NAS port ID, a case-sensitive string of 1 to 63 characters.

Usage guidelines

After coming online, a client sends a RADIUS request that carries the NAS port ID to the RADIUS server to indicate its network access server.

The priorities for the configuration in AP view, AP group view, and global configuration view are in descending order. You can also set the NAS port ID when binding a service template to a radio. If you have specified a NAS port ID when binding a service template to a radio, the AP uses the NAS port ID specified for the service template.

Examples

# Set the NAS port ID to abcd1234 for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-AGN

[Sysname-wlan-ap-ap1] nas-port-id abcd1234

# Set the NAS port ID to abcd1234 for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] nas-port-id abcd1234

# Set the global NAS port ID to abcd1234.

<Sysname> system-view

[Sysname] wlan global-configuration

[Sysname-wlan-global-configuration] nas-port-id abcd1234

nas-port-type

Use nas-port-type to set the NAS port type attribute in RADIUS requests.

Use the undo nas-port-type to restore the default.

Syntax

nas-port-type value

undo nas-port-type

Default

The NAS port type is Wireless-IEEE 802.11.

Views

Service template view

Predefined user roles

network-admin

Parameters

value: Specifies a NAS port type by its code value in the range of 0 to 255. Table 13 lists the most commonly used NAS port types and their code values.

Table 13 Common NAS port types and their code values

‌

Usage guidelines

You can execute this command to set the NAS port type attribute in RADIUS requests for 802.11X and MAC-authenticated clients.

Make sure the service template is disabled before you execute this command.

Examples

# Set the NAS port type in RADIUS requests to 15 (Ethernet).

<Sysname> system-view

[Sysname] wlan service-template 1

[Sysname-wlan-st-1] nas-port-type 15

nas-vlan

Use nas-vlan to set the network access server VLAN identifier (NAS VLAN ID) and enable the AC to encapsulate the VLAN ID in RADIUS requests.

Use undo nas-vlan to restore the default.

Syntax

nas-vlan vlan-id

undo nas-vlan

Default

No NAS VLAN ID is set. Authentication requests sent to the RADIUS server do not contain the NAS VLAN ID field.

Views

AP view

Predefined user roles

network-admin

Parameters

vlan-id: Specifies a NAS VLAN ID in the range of 1 to 4096.

Usage guidelines

When the NAS VLAN ID is set, the AC encapsulates the VLAN ID in RADIUS requests sent to the RADIUS server to indicate clients' network access server.

Set the NAS VLAN ID when a third-party Security Accounting Management (SAM) server is used as the RADIUS server.

Examples

# Set the NAS VLAN ID to 1234 for the AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] nas-vlan 1234

quick-association enable

Use quick-association to enable quick association.

Use undo quick-association to disable quick association.

Syntax

quick-association enable

undo quick-association enable

Default

Quick association is disabled.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

This command disables APs from performing load balancing or band navigation on clients associated with the specified service template.

Examples

# Enable quick association for service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1]quick-association enable

reset wlan client

Use reset wlan client to log off a client or all clients.

Syntax

reset wlan client { all | mac-address mac-address }

View

User view

Predefined user roles

network-admin

Parameters

all: Specifies all clients.

mac-address mac-address: Specifies a client by its MAC address.

Examples

# Log off all clients.

<Sysname> reset wlan client all

Related commands

display wlan client

reset wlan dynamic-blacklist

Use reset wlan dynamic-blacklist to remove the specified client or all clients from the dynamic blacklist.

Syntax

reset wlan dynamic-blacklist [ mac-address mac-address ]

Views

User view

Predefined user roles

network-admin

Parameters

mac-address mac-address: Specifies a client by its MAC address. If you do not specify this option, the command removes all clients from the dynamic blacklist.

Examples

# Remove all clients from the dynamic blacklist.

<Sysname> reset wlan dynamic-blacklist

# Remove the specified client from the dynamic blacklist.

<Sysname> reset wlan dynamic-blacklist mac-address b8ca-32a2-df69

Related commands

display wlan blacklist

reset wlan statistics client

Use reset wlan statistics client to clear client statistics.

Syntax

reset wlan statistics client { all | mac-address mac-address }

View

User view

Predefined user roles

network-admin

Parameters

all: Specifies all clients.

mac-address mac-address: Specifies a client by its MAC address.

Examples

# Clear statistics about all clients.

<Sysname> reset wlan statistics client all

Related commands

display wlan statistics

reset wlan statistics service-template

Use reset wlan statistics service-template to clear service template statistics.

Syntax

reset wlan statistics service-template service-template-name

View

User view

Predefined user roles

network-admin

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters.

Examples

# Clear statistics about service template service1.

<Sysname> reset wlan statistics service-template service1

Related commands

display wlan statistics

roam-enhance

Use roam-enhance to enable roaming enhancement.

Use undo roam-enhance to disable roaming enhancement.

Syntax

roam-enhance ssid ssid

undo roam-enhance

Default

In radio view, the configuration in an AP group's radio view is used.

In an AP group's radio view, roaming enhancement is disabled.

Views

Radio view

AP group's radio view

Predefined user roles

network-admin

Parameters

ssid: Specifies an SSID for roaming enhancement, a case-sensitive string of 1 to 32 characters.

Usage guidelines

You can enable this feature only on the 2.4G radio. If you perform this task multiple times, the most recent configuration takes effect.

Bind the 5G radio to a minimum of one service template that uses the SSID specified for roaming enhancement for the 2.4G radio.

You can bind a maximum of five service templates using the specified SSID to the 5G radio.

To avoid packet loss, do not configure the 5G radio as a scanning radio.

The 5G radio cannot operate in a radar channel. As a best practice, manually specify a non-radar channel, enable auto channel selection, or configure the channel scanning whitelist or blacklist for the 5G radio.

Examples

# Enable roaming enhancement for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] radio 2

[Sysname-wlan-ap-ap1-radio-2] roam-enhance ssid agv

# Enable roaming enhancement for APs in AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group apgroup1

[Sysname-wlan-ap-group-apgroup1] ap-model WA6320

[Sysname-wlan-ap-group-apgroup1-ap-model-WA6320] radio 2

[Sysname-wlan-ap-group-apgroup1-ap-model-WA6320-radio-2] roam-enhance ssid agv

service-template

Use service-template to bind a service template to a radio.

Use undo service-template to unbind a service template from a radio.

Syntax

service-template service-template-name [ vlan vlan-id1 | vlan-group vlan-group-name ] [ ssid-hide ] [ nas-port-id nas-port-id ] [ nas-id nas-id ]

undo service-template service-template-name

Default

In radio view, an AP uses the configuration in AP group view.

In an AP group's radio view, no service template is bound to a radio.

Views

Radio view

AP group's radio view

Predefined user roles

network-admin

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters.

vlan vlan-id1: Specifies a VLAN ID in the range of 1 to 4094.

vlan-group vlan-group-name: Specifies a VLAN group name, a case-insensitive string of 1 to 31 characters. If you do not specify this option, the radio uses the VLAN configured for the service template. For more information about configuring VLAN groups, see VLAN commands in Layer 2—LAN Switching Command Reference for the switch.

ssid-hide: Hides SSIDs in beacon frames.

nas-port-id nas-port-id: Specifies a NAS port ID, a case-insensitive string of 1 to 63 characters that do not contain spaces.

nas-id nas-id: Specifies a NAS ID, a case-insensitive string of 1 to 63 characters that do not contain spaces.

Usage guidelines

Before you bind a service template to a radio or a radio interface, you must create the service template.

If you specify a non-existent VLAN, the AC creates the VLAN when a client comes online.

The VLAN ID or VLAN group configured using this command takes precedence over the VLAN ID configured for a service template.

The configuration in radio view takes precedence over the configuration in an AP group's radio view.

Examples

# Bind service template service1 to radio 1 and specify VLAN group vg1 for the radio.

<Sysname> system-view

[Sysname] wlan ap ap1

[Sysname-ap-ap1] radio 1

[Sysname-ap-ap1-radio-1] service-template service1 vlan-group vg1

# Bind service template service1 to radio 1 and specify VLAN group vg1 for the radios in AP group apgroup1.

<Sysname> system-view

[Sysname] wlan ap-group apgroup1

[Sysname-wlan-ap-group-apgroup1] ap-model WA6320

[Sysname-wlan-ap-group-apgroup1-ap-model-WA6320] radio 1

[Sysname-wlan-ap-group-apgroup1-ap-model-WA6320-radio-1] service-template service1 vlan-group vg1

service-template enable

Use service-template enable to enable a service template.

Use undo service-template enable to disable a service template.

Syntax

service-template enable

undo service-template enable

Default

A service template is disabled.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

If the number of BSSs on a device exceeds the limit, you cannot enable a new service template.

Examples

# Enable service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] service-template enable

snmp-agent trap enable wlan client

Use snmp-agent trap enable wlan client to enable SNMP notification for client access.

Use undo snmp-agent trap enable wlan client to disable SNMP notification for client access.

Syntax

snmp-agent trap enable wlan client

undo snmp-agent trap enable wlan client

Default

SNMP notification is disabled for client access.

Views

System view

Predefined user roles

network-admin

Usage guidelines

When this feature is enabled, the device sends a client status change notification to an NMS every time the status of a client changes. For the notifications to be sent correctly, you must also configure SNMP as described in Network Management and Monitoring Configuration Guide for the switch.

Examples

# Enable SNMP notification for client access.

<Sysname> system-view

[Sysname] snmp-agent trap enable wlan client

snmp-agent trap enable wlan client-audit

Use snmp-agent trap enable wlan client-audit to enable SNMP notification for client audit.

Use undo snmp-agent trap enable wlan client-audit to disable SNMP notification for client audit.

Syntax

snmp-agent trap enable wlan client-audit

undo snmp-agent trap enable wlan client-audit

Default

SNMP notification is disabled for client audit.

Views

System view

Predefined user roles

network-admin

Usage guidelines

When this feature is enabled, the device sends a client status change notification to an NMS when a client comes online, goes offline, roams to another AP, or obtains an IP address. For the notifications to be sent correctly, you must also configure SNMP as described in Network Management and Monitoring Configuration Guide for the switch.

Examples

# Enable SNMP notification for client audit.

<Sysname> system-view

[Sysname] snmp-agent trap enable wlan client-audit

ssid

Use ssid to set an SSID for a service template.

Use undo ssid to restore the default.

Syntax

ssid ssid-name

undo ssid

Default

No SSID is configured for a service template.

Views

Service template view

Predefined user roles

network-admin

Parameters

ssid-name: Specifies an SSID name, a case-sensitive string of 1 to 32 characters.

Usage guidelines

Disable the service template before you execute this command.

To specify an SSID starting with a space, enter the SSID in quotes. For example, you can enter " 12345" to specify the SSID as  12345 (starting with a space).

To specify an SSID starting with a quotation mark ("), attach a backslash (\) to the front of the string. For example, you can enter \"12345 to specify the SSID as "12345.

You can use the display wlan service-template command to display the configured SSID.

Examples

# Set the SSID to lynn for service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] ssid lynn

unknown-client

Use unknown-client to set the way that an AP processes traffic from unknown clients.

Use undo unknown-client to restore the default.

Syntax

unknown-client { deauthenticate | drop }

undo unknown-client

Default

An AP drops packets from unknown clients and deauthenticates these clients.

Views

Service template view

Predefined user roles

network-admin

Parameters

deauthenticate: Drops packets from unknown clients and deauthenticates these clients.

drop: Drops packets from unknown clients.

Examples

# Configure APs that use service template example to drop packets from unknown clients but not deauthenticate these clients.

<Sysname> system-view

[Sysname] wlan service-template example

[Sysname-wlan-st-example] unknown-client drop

vlan

Use vlan to assign clients coming online through a service template to the specified VLAN.

Use undo vlan to restore the default.

Syntax

vlan vlan-id1 [ customer-vlan vlan-id2 ]

undo vlan [ vlan-id1 ]

Default

Clients are assigned to VLAN 1 after coming online through a service template.

Views

Service template view

Predefined user roles

network-admin

Parameters

vlan-id1: Specifies an inner VLAN by its VLAN ID, in the range of 1 to 4094.

vlan-id2: Specifies an outer VLAN by its VLAN ID, in the range of 1 to 4094.

Usage guidelines

Disable the service template before you execute this command.

If the specified VLAN does not exist, this command creates the VLAN when clients come online.

Examples

# Assign clients coming online through service template service1 to VLAN 2.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] vlan 2

wlan accounting-policy

Use wlan accounting-policy to create an accounting policy and enter its view or enter the view of an existing accounting policy.

Use undo wlan accounting-policy to delete an accounting policy.

Syntax

wlan accounting-policy policy-name

undo wlan accounting-policy policy-name

Default

No accounting policies exist.

Views

System view

Predefined user roles

network-admin

Parameters

policy-name: Specifies the policy name, a case-insensitive string of 1 to 31 characters. The string can contain letters, digits, underscores (_), left brackets ([), right brackets (]), and hyphens (-).

Usage guidelines

For the accounting server to perform differentiated accounting on different client traffic, specify multiple traffic levels for an accounting policy.

The number of accounting policies that can be created varies by device model.

Examples

# Create accounting policy abc and enter its view.

<Sysname> system-view

[Sysname] wlan accounting-policy abc

[Sysname-wlan-acctpolicy-abc]

Related commands

accounting-level

wlan apply accounting-policy

wlan apply accounting-policy

Use wlan apply accounting-policy to apply an accounting policy to a user profile.

Use undo wlan apply accounting-policy to restore the default.

Syntax

wlan apply accounting-policy policy-name

undo wlan apply accounting-policy

Default

No accounting policy is applied to a user profile.

Views

User profile view

Predefined user roles

network-admin

Parameters

policy-name: Specifies the policy name, a case-insensitive string of 1 to 31 characters. The string can contain letters, digits, underscores (_), dots (.), left brackets ([), right brackets (]), and hyphens (-).

Usage guidelines

This feature enables APs to perform client traffic accounting based on the accounting policy applied to the user profile. Upon client association, the authentication server deploys the user profile bound to the client account to the client authenticator (AC or AP). If the AC is the authenticator, it deploys the user profile to the AP.

If no accounting policy is applied to a user profile, the system performs AAA accounting.

Accounting policy changes, including deletion, for a user profile do not affect online clients.

Examples

# Apply accounting policy abc to user profile 123.

<Sysname> system-view

[Sysname] user-profile 123

[Sysname-user-profile-123] wlan apply accounting-policy abc

Related commands

wlan accounting-policy

wlan association optimization

Use wlan association optimization to set the index for optimizing client association ratios.

Use undo wlan association optimization to restore the default.

Syntax

wlan association optimization value

undo wlan association optimization

Default

The index is 0. The device does not optimize client association ratios.

Views

System view

Predefined user roles

network-admin

Parameters

value: Specifies the index for optimizing client association ratios, in the range of 900 to 1000. The smaller the index is, the smaller the calculated association success ratio will be and the larger the calculated congestion ratio and abnormal disassociation ratio will be.

Usage guidelines

This feature enables the device to recalculate the client association success ratio, association congestion ratio, and abnormal disassociation ratio by using the specified index to get smaller ratio values.

The client association success ratio is the number of successful client associations divided by the total number of client association attempts. The client association congestion ratio is the number of failed client associations caused by AP overloading divided by the total number of client association attempts. The client abnormal disassociation ratio is the number of abnormal disassociations divided by the sum of successful associations and online clients.

Examples

# Set the index for optimizing client association ratios to 950.

<Sysname> system-view

[Sysname] wlan association optimization 950

wlan client bss-load-ie enable

Use wlan client bss-load-ie enable to enable beacon frames and probe responses to carry BSS Load IEs.

Use undo wlan client bss-load-ie enable to disable beacon frames and probe responses from carrying BSS Load IEs.

Syntax

wlan client bss-load-ie enable [ update-interval interval ]

undo wlan client bss-load-ie enable

Default

Beacon frames and probe responses do not carry BSS Load IEs.

Views

System view

Predefined user roles

network-admin

Parameters

update-interval interval: Specifies the BSS Load IE update interval, in the range of 5 to 30 seconds. By default, the interval is 15 seconds.

Usage guidelines

This feature enables beacon frames and probe responses to carry BSS Load IEs. A BSS Load IE contains information such as associated client quantity, channel usage, and remaining available media time.

As a best practice, enable this feature in networks where client roaming is required. This helps clients identify the optimal WLAN.

Examples

# Enable beacon frames and probe responses to carry BSS Load IEs.

<Sysname> system-view

[Sysname] wlan client bss-load-ie enable

wlan client forwarding enable

Use wlan client forwarding enable to enable client traffic forwarding.

Use undo wlan client forwarding enable to disable client traffic forwarding.

Syntax

wlan client forwarding enable

undo wlan client forwarding enable

Default

Client traffic forwarding is enabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

You must enable this feature if you configure the AC as the client traffic forwarder.

In an AC hierarchical network, disable this feature on the central AC and enable this feature on local ACs if the client traffic forwarder is the AC. This guarantees central AC's management performance in case a local AC is down.

If you enable this feature on both the central AC and local ACs, the local ACs forward client traffic by default. If a local AC fails, APs associate with the central AC directly and the central AC forwards client traffic.

In an AC hierarchy network, if you enable this feature only on the central AC or local ACs, APs associated with such an AC cannot forward client traffic even if the associated AC fails. For APs to take over the traffic forwarding service, you must disable and then enable the service templates for the APs.

For more information about AC hierarchy, see AC hierarchy in the configuration guide.

Examples

# Disable client traffic forwarding.

<Sysname> system-view

[Sysname] undo wlan client forwarding enable

wlan client reauthentication-period

Use wlan client reauthentication-period to set the idle period before client reauthentication.

Use undo wlan client reauthentication-period to restore the default.

Syntax

wlan client reauthentication-period [ period-value ]

undo wlan client reauthentication-period

Default

The idle period is 10 seconds.

Views

System view

Predefined user roles

network-admin

Parameters

period-value: Specifies the idle period in the range of 1 to 3600 seconds.

Usage guidelines

When URL redirection for WLAN MAC authentication is enabled, an AP redirects clients whose information is not recorded on the RADIUS server to the specified URL for Web authentication. Clients passing Web authentication are logged off and must perform MAC reauthentication to come online. However, MAC reauthentication fails if the IP addresses assigned to the clients have not expired.

Perform this task to add these clients to the dynamic blacklist for the specified idle period after they pass Web authentication to reduce reauthentication failures.

Examples

# Set the idle period before client reauthentication to 100 seconds.

<Sysname> system-view

[Sysname] wlan client reauthentication-period 100

wlan dynamic-blacklist active-on-ap

Use wlan dynamic-blacklist active-on-ap to configure the dynamic blacklist to take effect on APs.

Use undo wlan dynamic-blacklist active-on-ap to configure the dynamic blacklist to take effect on the AC.

Syntax

wlan dynamic-blacklist active-on-ap

undo wlan dynamic-blacklist active-on-ap

Default

The dynamic blacklist takes effect on APs.

Views

System view

Predefined user roles

network-admin

Usage guidelines

If you configure the dynamic blacklist to take effect on the AC, all APs connected to the AC will reject the client in the dynamic blacklist. If you configure the dynamic blacklist to take effect on APs, the AP associated with the client in the dynamic blacklist will reject the client, but the client can still associate with other APs connected to the AC. As a best practice, configure the dynamic blacklist to take effect on the AC in high-density environments.

Examples

# Configure the dynamic blacklist to take effect on the AC.

<Sysname> system-view

[Sysname] undo wlan dynamic-blacklist active-on-ap

wlan dynamic-blacklist lifetime

Use wlan dynamic-blacklist lifetime to set the aging time for dynamic blacklist entries.

Use undo wlan dynamic-blacklist lifetime to restore the default.

Syntax

wlan dynamic-blacklist lifetime lifetime

undo wlan dynamic-blacklist lifetime

Default

The aging time is 300 seconds for dynamic blacklist entries.

Views

System view

Predefined user roles

network-admin

Parameters

lifetime: Specifies the aging time in the range of 1 to 3600 seconds.

Usage guidelines

The configured aging time takes effect only on entries added to the dynamic blacklist after this command is executed.

The aging time for dynamic blacklist entries only applies to rogue client entries.

Examples

# Set the aging time for dynamic blacklist entries to 3600 seconds.

<Sysname> system-view

[Sysname] wlan dynamic-blacklist lifetime 3600

wlan imc

Use wlan imc to specify an IMC server by its IP address and port number.

Use undo wlan imc to restore the default.

Syntax

wlan imc ip ip-address port port-number

undo wlan imc

Default

No IMC server is specified.

Views

System view

Predefined user roles

network-admin

Parameters

ip ip-address: Specifies an IMC server by its IP address.

port port-number: Specifies an IMC server by its port number in the range of 1025 to 65535.

Usage guidelines

This feature enables the system to report association and disassociation events of APs, clients, and portal users to an IMC server, allowing you to view the statistics from the IMC platform.

Examples

# Specify an IMC server.

<Sysname> system-view

[Sysname] wlan imc ip 1.1.1.1 port 65535

wlan link-test

Use wlan link-test to test wireless link quality.

Syntax

wlan link-test mac-address

Views

Any view

Predefined user roles

network-admin

Parameters

mac-address: Specifies the client MAC address in the H-H-H format.

Usage guidelines

Wireless link quality detection enables an AP to test the quality of the link to a wireless client. The AP sends empty data frames to the client at each supported rate. Then it calculates link quality information such as RSSI, packet retransmissions, and RTT based on the responses from the client.

The timeout timer for wireless link quality detection is 10 seconds. If wireless link detection is not completed within the timeout timer, test results cannot be obtained.

Examples

# Test the quality of the wireless link to the client with MAC address 60a4-4cda-eff0.

<Sysname> wlan link-test 60a4-4cda-eff0

Testing link to 60a4-4cda-eff0. Press CTRL + C to break.

                              Link Status

-----------------------------------------------------------------------

MAC address: 60a4-4cda-eff0

-----------------------------------------------------------------------

VHT-MCS  Rate(Mbps)  Tx packets  Rx packets  RSSI   Retries RTT(ms)

-----------------------------------------------------------------------

NSS = 1

-----------------------------------------------------------------------

 0       32.5        5           5           54     0       0

 1       65          5           5           51     0       0

 2       97.5        5           5           49     0       0

 3       130         5           5           47     0       0

 4       195         5           5           45     0       0

 5       260         5           5           45     0       0

 6       292.5       5           5           44     0       0

 7       325         5           5           44     0       0

 8       390         5           5           44     0       0

 9       433.3       5           5           43     0       0

-----------------------------------------------------------------------

NSS = 2

-----------------------------------------------------------------------

 0       65          5           5           44     0       0

 1       130         5           5           44     0       0

 2       195         5           5           44     0       0

 3       260         5           5           44     0       0

 4       390         5           5           44     0       0

 5       520         5           5           44     0       0

 6       585         5           5           43     0       0

 7       650         5           5           43     0       0

 8       780         5           5           43     0       0

 9       866.7       5           5           43     0       0

# Test the quality of the wireless link to the client with MAC address 60a4-4cda-eff0.

<Sysname> wlan link-test 784f-43b6-077c

Testing link to 784f-43b6-077c. Press CTRL + C to break.

                              Link Status

-----------------------------------------------------------------------

MAC address: 784f-43b6-077c

-----------------------------------------------------------------------

MCS     Rate(Mbps)  Tx packets  Rx packets  RSSI   Retries  RTT(ms)

-----------------------------------------------------------------------

0       6.5         5           5           54     0        0

1       13          5           5           51     0        0

2       19.5        5           5           49     0        0

3       26          5           5           47     0        0

4       39          5           5           45     0        0

5       52          5           5           45     0        0

6       58.5        5           5           44     0        0

7       72.2        5           5           44     0        0

8       13          5           5           44     0        0

9       26          5           5           43     0        0

10       39         5           5           44     0        0

11       52         5           5           44     0        0

12       78         5           5           44     0        0

13       104        5           5           44     0        0

14       117        5           5           44     0        0

15       144.4      5           5           44     11       0

-----------------------------------------------------------------------

Table 14 Command output

‌

wlan management-wifi ssid-hide

 

Use wlan management-wifi ssid-hide to enable management Wi-Fi SSID hidden.

Use undo wlan management-wifi ssid-hide to disable management Wi-Fi SSID hidden.

Syntax

wlan management-wifi ssid-hide

undo wlan management-wifi ssid-hide

Default

An AP does not hide the SSID of its management Wi-Fi.

Views

Global configuration view

Predefined user roles

network-admin

Usage guidelines

Management Wi-Fi is for administrators and staff only. For security purposes, you can configure the system to hide management Wi-Fi SSIDs to prevent guests from discovering the networks. This also simplifies the discovered SSID list for guests.

With this feature configured, administrators and staff must manually specify the SSID and password at the first access.

Before configuring this feature, first make cloud-managed APs come online from the AC.

Examples

# Enable management Wi-Fi SSID hidden.

<Sysname> system-view

[Sysname] wlan global-configuration

[Sysname-wlan-global-configuration] wlan management-wifi ssid-hide

wlan nas-port-id format

Use wlan nas-port-id format to set the format of NAS port IDs for wireless clients.

Use undo wlan nas-port-id format to restore the default.

Syntax

wlan nas-port-id format { 2 | 4 }

undo wlan nas-port-id format

Default

Clients use format 2 to generate NAS port IDs.

Views

System view

Predefined user roles

network-admin

Parameters

2: Specifies the SlotID00IfNOVlanID format.

·     SlotID—Slot ID for client access, a string of two characters.

·     IfNO—Interface number for client access, a string of three characters.

·     VlanID—VLAN ID for client access, a string of nine characters.

4: Specifies the slot=**;subslot=**;port=**;vlanid=**;vlanid2=** format. The vlanid2 field is available only for clients accessing the WLAN through an interface configured with VLAN termination.

Usage guidelines

802.1X and MAC-authenticated clients provide NAS port IDs in the specified format in RADIUS packets.

If a NAS port ID has been specified by using the nas-port-id command, clients use the specified NAS port ID.

Examples

# Set the NAS port ID format to format 4.

<Sysname> system-view

[Sysname] wlan nas-port-id format 4

Related commands

nas-port-id

wlan permit-ap-group

Use wlan permit-ap-group to specify a permitted AP group for client association.

Use undo permit-ap-group to delete a permitted AP group.

Syntax

wlan permit-ap-group ap-group-name

undo wlan permit-ap-group [ ap-group-name ]

Default

No permitted AP group is specified for client association.

Views

User profile view

Predefined user roles

network-admin

Parameters

ap-group-name: Specifies an AP group by its name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

If no permitted AP group is specified for client association, client access is not restricted.

If you specify a permitted AP group for client association, clients can only associate with APs in the AP group.

The undo form of the command deletes all permitted AP groups if you do not specify the ap-group-name argument.

Examples

# Specify AP group group1 as the permitted AP group for client association.

<Sysname> system-view

[Sysname] user-profile profile1

[Sysname-user-profile-profile1] wlan permit-ap-group group1

wlan permit-ssid

Use wlan permit-ssid to specify a permitted SSID for client association.

Use undo permit-ssid to delete a permitted SSID.

Syntax

wlan permit-ssid ssid-name

undo wlan permit-ssid [ ssid-name ]

Default

No permitted SSID is specified for client association.

Views

User profile view

Predefined user roles

network-admin

Parameters

ssid-name: Specifies an SSID by its name, a case-sensitive string of 1 to 32 characters.

Usage guidelines

If no permitted SSID is specified for client association, client association is not restricted.

If you specify a permitted SSID for client association, clients can only associate with WLANs through the SSID.

The undo form of the command deletes all permitted SSIDs if you do not specify the ssid-name argument.

Examples

# Specify SSID ssid1 as the permitted SSID for client access.

<Sysname> system-view

[Sysname] user-profile profile1

[Sysname-user-profile- profile1] wlan permit-ssid ssid1

wlan service-template

Use wlan service-template to create a service template and enter its view, or enter the view of an existing service template.

Use undo wlan service-template to delete a service template.

Syntax

wlan service-template service-template-name

undo wlan service-template service-template-name

Default

No service template exists.

Views

System view

Predefined user roles

network-admin

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters.

Usage guidelines

You cannot delete a service template that has been bound to a radio.

Examples

# Create service template service1 and enter its view.

<Sysname> system-view

[Sysname] wlan service-template service1

wlan static-blacklist mac-address

Use wlan static-blacklist mac-address to add a client to the static blacklist.

Use undo wlan static-blacklist mac-address to remove a client from the static blacklist.

Syntax

wlan static-blacklist mac-address mac-address

undo wlan static-blacklist [ mac-address mac-address ]

Default

No clients exist in the static blacklist.

Views

System view

Predefined user roles

network-admin

Parameters

mac-address mac-address: Specifies a client by its MAC address in the format of H-H-H.

Usage guidelines

If you add an online client to the static blacklist, the command logs off the client.

You cannot add a client to both the whitelist and the static blacklist.

The undo form of the command removes all clients from the static blacklist if you do not specify the mac-address mac-address option.

Do not add multicast or broadcast MAC addresses to the static blacklist.

Examples

# Add MAC address 001c-f0bf-9c92 to the static blacklist.

<Sysname> system-view

[Sysname] wlan static-blacklist mac-address 001c-f0bf-9c92

Related commands

display wlan blacklist

wlan web-server api-path

Use wlan web-server api-path to specify the path of the Web server to which client information is reported.

Use undo wlan web-server api-path to restore the default.

Syntax

wlan web-server api-path path

undo wlan web-server api-path

Default

The path of the Web server is not specified.

Views

System view

Predefined user roles

network-admin

Parameters

path: Specifies a path, a case-sensitive string of 1 to 256 characters.

Usage guidelines

The Web server accepts client information only when the server's host name, port number, and path are specified.

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Specify the path of the Web server as /wlan/dev-cfg.

<Sysname> system-view

[Sysname] wlan web-server api-path /wlan/dev-cfg

Related commands

wlan web-server host

wlan web-server max-client-entry

wlan web-server host

Use wlan web-server host to specify the host name and port number of the Web server to which client information is reported.

Use undo wlan web-server host to restore the default.

Syntax

wlan web-server host host-name port port-number

undo wlan web-server host

Default

The host name and port number of the Web server are not specified.

Views

System view

Predefined user roles

network-admin

Parameters

host host-name: Specifies a host name, a case-insensitive string of 3 to 127 characters that can contain letters, digits, hyphens (-), underscores (_), and dots (.).

port port-number: Specifies a port number in the range of 1 to 65534.

Usage guidelines

The Web server accepts client information only when the server's host name, port number, and path are specified.

Client information changes are reported to the Web server in real time.

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Specify the host name and port number of the Web server as www.abc.com and 668, respectively.

<Sysname> system-view

[Sysname] wlan web-server host www.abc.com port 668

Related commands

wlan web-server api-path

wlan web-server max-client-entry

wlan web-server max-client-entry

Use wlan web-server max-client-entry to set the maximum number of client entries that can be reported at a time.

Use undo wlan web-server max-client-entry to restore the default.

Syntax

wlan web-server max-client-entry number

undo wlan web-server max-client-entry

Default

A maximum of ten client entries can be reported at a time.

Views

System view

Predefined user roles

network-admin

Parameters

number: Specifies a maximum number of client entries that can be reported at a time, in the range of 1 to 25.

Examples

# Set the maximum of client entries that can be reported at a time to 12.

<Sysname> system-view

[Sysname] wlan web-server max-client-entry 12

Related commands

wlan web-server api-path

wlan web-server host

wlan whitelist mac-address

Use wlan whitelist mac-address to add a client to the whitelist.

Use undo wlan whitelist mac-address to remove a client from the whitelist.

Syntax

wlan whitelist mac-address mac-address

undo wlan whitelist [ mac-address mac-address ]

Default

No clients exist in the whitelist.

Views

System view

Predefined user roles

network-admin

Parameters

mac-address mac-address: Specifies a client by its MAC address in the format of H-H-H.

Usage guidelines

When you add the first client to the whitelist, the system asks you whether to disconnect all online clients. Enter Y at the prompt to configure the whitelist.

If you remove an online client from the whitelist, the command logs off the client. If you remove all clients from the whitelist, online clients will not be logged off.

You cannot add a client to both the whitelist and the static blacklist.

The undo form of the command removes all clients from the whitelist if you do not specify the mac-address mac-address option.

Do not add multicast or broadcast MAC addresses to the whitelist.

Examples

# Add MAC address 001c-f0bf-9c92 to the whitelist.

<Sysname> system-view

[Sysname] wlan whitelist mac-address 001c-f0bf-9c92

This command will disconnect all clients. Continue? [Y/N]:

Related commands

display wlan whitelist