permit-remote-ap: Applies the permit rule in an ACL to remote APs. This keyword is available only in service template view. If you do not specify this keyword, no ACL rules are applied to remote APs.

Usage guidelines

This feature controls client access by using the specified ACL rules. When the device receives an association request, it performs the following actions:

· Allows the client to access the WLAN if the MAC address of the client matches the MAC address attribute or MAC address OUI attribute in a rule and the rule action is permit. If multiple clients match the OUI attribute, all these clients are allowed to access the WLAN.

· Denies the client's access to the WLAN if no match is found or the matched rule has a deny statement.

When you configure this feature, follow these restrictions and guidelines:

· If the specified ACL contains a deny statement, configure a permit statement for the ACL to permit all clients. If you do not do so, no clients can come online.

· ACL-based access control configuration takes precedence over whitelist and blacklist configuration.

· You can specify only one ACL. If you execute this command multiple times, the most recent configuration takes effect.

· The configuration in AP view takes precedence over the configuration in service template view.

· If you specify the permit-remote-ap keyword and enable the remote AP feature, the AC will synchronize the cached client entries that match the permit rule to APs. The APs allow only clients in the cached entries to associate with them after they enter remote AP mode.

Examples

# Create ACL 4000 and create ACL rules to permit the client with MAC address 000e-35b2-000e and clients with the specified OUI. Specify ACL 4000 for service template service1.

<Sysname> system-view

[Sysname] acl mac 4000

[Sysname-acl-mac-4000] rule 0 permit source-mac 000e-35b2-000e ffff-ffff-ffff

[Sysname-acl-mac-4000] rule 1 permit source-mac 000e-35b2-000f ffff-ff00-0000

[Sysname-acl-mac-4000] rule 2 deny

[Sysname-acl-mac-4000] quit

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] access-control acl 4000

# Create ACL 4000 and create ACL rules to permit the client with MAC address 000e-35b2-000e and clients with the specified OUI. Specify ACL 4000 for AP ap1.

<Sysname> system-view

[Sysname] acl mac 4000

[Sysname-acl-mac-4000] rule 0 permit source-mac 000e-35b2-000e ffff-ffff-ffff

[Sysname-acl-mac-4000] rule 1 permit source-mac 000e-35b2-000f ffff-ff00-0000

[Sysname-acl-mac-4000] rule 2 deny

[Sysname-acl-mac-4000] quit

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] access-control acl 4000

accounting-level

Use accounting-level to specify a traffic level for ACL-based accounting.

Use undo accounting-level to remove the accounting configuration for a traffic level.

Syntax

accounting-level level acl { acl-number | ipv6 ipv6-acl-number }

undo accounting-level level

Default

No traffic levels are specified for ACL-based accounting.

Views

Accounting policy view

Predefined user roles

network-admin

Parameters

level: Specifies the traffic level in the range of 1 to 8.

acl-number: Specifies an IPv4 ACL number in the range of 3000 to 3999.

ipv6 ipv6-acl-number: Specifies an IPv6 ACL number in the range of 3000 to 3999.

Usage guidelines

An accounting policy takes effect on matching packets no matter whether the ACL action is deny or permit. It does not identify the source address in the ACL. For wireless packets received on an AP, the ACL matches the destination address of the packets. For wireless packets sent by an AP, the ACL matches the source address of the packets.

If you execute this command multiple times, the most recent configuration takes effect.

The traffic level change takes effect only on clients coming online afterwards. Clients that have come online are not affected.

Examples

# Specify the traffic level as 1 for packets matching ACL 3000 in accounting policy view of policy abc.

<Sysname> system-view

[Sysname] wlan accounting-policy abc

[Sysname-wlan-acctpolicy-abc] accounting-level 1 acl 3000

Related commands

wlan accounting-policy

ap-name-advertise enable

Use ap-name-advertise enable to configure the beacon and probe response frames to carry the AP name.

Use undo ap-name-advertise enable to disable the beacon and probe response frames from carrying the AP name.

Syntax

ap-name-advertise enable

undo ap-name-advertise enable

Default

Beacon and probe response frames do not carry the AP name.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

Execute this command to configure the beacon and probe response frames to carry the AP name. This feature is applicable to the following scenarios:

· Quick AP identification.

· Quick AP locating.

· Displaying the AP name on clients.

Examples

# Configure the beacon and probe response frames to carry the AP name.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] ap-name-advertise enable

assign-vlan policy

Use assign-vlan policy enble to enable specific VLAN assignment.

Use assign-vlan policy disable to disable specific VLAN assignment.

Use assign-vlan policy disable to restore the default.

Syntax

assign-vlan policy enble

assign-vlan policy disable

undo assign-vlan policy

Default

Specific VLAN assignment is disabled.

Views

Service template view

Predefined user roles

network-admin

Examples

# Enable specific VLAN assignment.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] wlan assign-vlan policy enble

beacon ssid-advertise

Use beacon ssid-advertise to enable Service Set Identifier (SSID) broadcast in beacon frames.

Use undo beacon ssid-advertise to restore the default.

Syntax

beacon ssid-advertise

undo beacon ssid-advertise

Default

An AP hides SSIDs in beacon frames when the maximum number of associated clients is reached.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

This feature enables new clients to discover APs even if the number of associated clients reaches the upper limit. However, these clients cannot associate with the APs.

Examples

# Enable SSID broadcast in beacon frames.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-s1] beacon ssid-advertise

Related commands

client max-count

beacon ssid-hide

Use beacon ssid-hide to disable advertising of the Service Set Identifier (SSID) in beacon frames.

Use undo beacon ssid-hide to restore the default.

Syntax

beacon ssid-hide

undo beacon ssid-hide

Default

The SSID is advertised in beacon frames.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

This command disables a radio from carrying SSIDs in the beacon frames and responding to probe requests after the specified service template is bound to the radio.

Examples

# Disable advertising the SSID in beacon frames.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] beacon ssid-hide

broadcast-probe reply

Use broadcast-probe reply enable to enable an AP to respond to broadcast probe requests.

Use broadcast-probe reply disable to disable an AP from responding to broadcast probe requests.

Use undo broadcast-probe reply to restore the default.

Syntax

broadcast-probe reply { disable | enable [ rssi-threshold rssi-value ] } [ frequency-band { 2.4 | 5 } ]

undo broadcast-probe reply

Default

In AP view, an AP uses the configuration in AP group view.

In AP group view, an AP responds to all broadcast probe requests.

Views

AP view

AP group view

Predefined user roles

network-admin

Parameters

rssi-threshold rssi-value: Specifies an RSSI threshold in the range of 1 to 100. If you do not specify this option, the command enables the AP to respond to broadcast probe requests with any RSSIs.

frequency-band: Specifies a frequency band. If you do not specify this keyword, the command enables the AP to respond to broadcast probe requests received at both the 5 GHz and 2.4 GHz bands.

2.4: Specifies the 2.4 GHz band.

5: Specifies the 5 GHz band.

Usage guidelines

Broadcast probe requests do not carry any SSIDs. Upon receiving a broadcast probe request, an AP responds with a probe response that carries service information for the AP.

By default, an AP responds to all broadcast probe requests, which might threat network security and decrease AP performance. However, disabling responding to broadcast probe requests might forbid clients from roaming to the optimal AP in time, affecting client access.

You can perform this task to enable an AP to respond to broadcast requests from a specific frequency band with strong signal strength.

The configuration in AP view takes precedence over the configuration in AP group view.

Examples

# Disable AP ap1 from responding to broadcast probe requests at all frequency bands.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] broadcast-probe reply disable

# Disable APs in AP group group1 from responding to broadcast probe requests at all frequency bands.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] broadcast-probe reply disable

classifier acl

Use classifier acl to configure a forwarding rule for a forwarding policy.

Use undo classifier acl to remove a forwarding rule.

Syntax

classifier acl { acl-number | ipv6 ipv6-acl-number } behavior { local | remote }

undo classifier acl { acl-number | ipv6 ipv6-acl-number }

Default

No forwarding rules are configured.

Views

Forwarding policy view

Predefined user roles

network-admin

Parameters

acl-number: Specifies an IPv4 or Layer 2 ACL number in the range of 2000 to 4999.

ipv6 ipv6-acl-number: Specifies an IPv6 ACL number in the range of 2000 to 3999.

behavior: Specifies a forwarding mode for traffic that matches the specified ACL.

local: Specifies the local forwarding mode.

remote: Specifies the centralized forwarding mode.

Usage guidelines

Actions defined in ACL rules do not take effect in wireless packet forwarding. All matched packets are forwarded based on the forwarding mode.

A forwarding rule takes effect immediately after it is created. You can configure a maximum of 1000 forwarding rules for a forwarding policy.

Examples

# Configure a forwarding rule to locally forward packets that match ACL 2000.

<sysname> system-view

[sysname] wlan forwarding-policy abc

[sysname-wlan-fp-abc] classifier acl 2000 behavior local

client association-location

Use client association-location to enable client association at the AC or APs.

Use undo client association-location to restore the default.

Syntax

client association-location { ac | ap }

undo client association-location

Default

Client association is performed at the AC.

Views

Service template view

Predefined user roles

network-admin

Parameters

ac: Enables client association at the AC.

ap: Enables client association at APs.

Usage guidelines

Make sure the service template is disabled before you execute this command.

Examples

# Enable client association at the AC.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client association-location ac

client behavior-local network-flow-forwarding enable

Use client behavior-local network-flow-forwarding enable to enable APs to forward client traffic to the external network when local forwarding is enabled.

Use undo client behavior-local network-flow-forwarding enable to disable APs from forwarding client traffic to the external network when local forwarding is enabled.

Syntax

client behavior-local network-flow-forwarding enable

undo client behavior-local network-flow-forwarding enable

Default

APs drop client packets destined to the external network when local forwarding is enabled.

Views

WLAN forwarding policy view

Predefined user roles

network-admin

Usage guidelines

When local forwarding is enabled, APs drop client packets destined to the external network. This feature enables an AP to replace the destination MAC address of a client packet destined to the external network with the AP's MAC address. Through NAT, the packet's source IP address is converted to an IP address in the same network segment as the AP. This enables APs to forward client traffic to an external network correctly.

This feature is available only on APs that support NAT.

Examples

# Enable APs to forward client packets destined to the external network when local forwarding is enabled.

<Sysname> system-view

[Sysname] wlan forwarding-policy abc

[Sysname-wlan-fp-abc] client behavior-local network-flow-forwarding enable

Related commands

wlan forwarding-policy

client forwarding-location

Use client forwarding-location to specify the client data traffic forwarder.

Use undo client forwarding-location to restore the default.

Syntax

client forwarding-location { ac | ap | hybrid { ac-vlan | ap-vlan } vlan [ to end-vlan ] }

undo client forwarding-location

Default

The AC forwards the client data traffic.

Views

Service template view

Predefined user roles

network-admin

Parameters

ac: Enables the AC to forward client data traffic.

ap: Enables APs to forward client data traffic.

hybrid: Enables VLAN-based client data traffic forwarding.

ac-vlan: Enables the AC to forward data traffic of clients from the specified VLAN.

ap-vlan: Enables APs to forward data traffic of clients from the specified VLANs.

vlan [ to end-vlan ]: Specifies up to ten VLAN ID or VLAN ID range items. The value range for the vlan and end-vlan arguments is 1 to 4094.

Usage guidelines

Make sure the service template is disabled before you execute this command.

For the configuration of using the AC to forward client traffic to take effect, make sure client traffic forwarding has been enabled.

If you specify the AC as the traffic forwarder, make sure client association is enabled at the AC.

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Configure APs to forward client data traffic.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client forwarding-location ap

client forwarding-policy enable

Use client forwarding-policy enable to enable policy-based forwarding for a service template.

Use undo client forwarding-policy enable to disable policy-based forwarding for a service template.

Syntax

client forwarding-policy enable

undo client forwarding-policy enable

Default

Policy-based forwarding is disabled for a service template.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

Enable policy-based forwarding for a service template for the following forwarding policies to take effect:

· The forwarding policy applied to the service template.

· The forwarding policy applied to a user profile that uses the service template.

Examples

# Enable policy-based forwarding for service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client forwarding-policy enable

Related commands

client-security authentication-location

client forwarding-policy-name

Use client forwarding-policy-name to apply a forwarding policy to a service template.

Use undo client forwarding-policy-name to restore the default.

Syntax

client forwarding-policy-name policy-name

undo client forwarding-policy-name

Default

No forwarding policy is applied to a service template.

Views

Service template view

Predefined user roles

network-admin

Parameters

policy-name: Specifies a forwarding policy by its name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

Make sure the service template is disabled before you execute this command.

For the forwarding policy to take effect, you must enable policy-based forwarding and specify the AC to perform client authentication for the service template.

Make sure the AC and its associated APs are in different network segments.

Examples

# Apply forwarding policy strategy to service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client forwarding-policy-name strategy

Related commands

client forwarding-policy enable

client-security authentication-location

client frame-format

Use client frame-format to set the client data frame format.

Use undo client frame-format to restore the default.

Syntax

client frame-format { dot3 | dot11 }

undo client frame-format

Default

Client data frames are encapsulated in 802.3 format.

Views

Service template view

Predefined user roles

network-admin

Parameters

dot3: Specifies the 802.3 format.

dot11: Specifies the 802.11 format.

Usage guidelines

This command takes effect only in centralized forwarding mode.

Make sure the service template is disabled before you execute this command.

Examples

# Configure the client data frames to be encapsulated in 802.11 format.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client frame-format dot11

Related commands

client forwarding-location

client idle-timeout

Use client idle-timeout to set the client idle timeout timer.

Use undo client idle-timeout to restore the default.

Syntax

client idle-timeout timeout

undo client idle-timeout

Default

In AP view, an AP uses the configuration in AP group view.

In AP group view, the client idle timeout timer is 300 seconds.

Views

AP view

AP group view

Predefined user roles

network-admin

Parameters

timeout: Specifies the client idle timeout timer in the range of 60 to 86400 seconds.

Usage guidelines

If an online client does not send any frames to the associated AP before the client idle timeout timer expires, the AP logs off the client.

The configuration in AP view takes precedence over the configuration in AP group view.

Examples

# Set the client idle timeout timer to 2000 seconds for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] client idle-timeout 2000

# Set the client idle timeout timer to 2000 seconds for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client idle-timeout 2000

client keep-alive

Use client keep-alive enable to enable client keepalive.

Use client keep-alive disable to disable client keepalive.

Use undo client keep-alive to restore the default.

Syntax

client keep-alive { disable | enable }

undo client keep-alive

Default

In AP view, an AP uses the configuration in AP group view.

In AP group view, client keepalive is disabled.

Views

AP view

AP group view

Predefined user roles

network-admin

Parameters

disable: Disables client keepalive.

enable: Enables client keepalive.

Usage guidelines

This feature enables an AP to send keepalive packets to clients at the client keepalive interval to determine whether the clients are online. If the AP does not receive any replies from a client within three keepalive intervals, it logs off the client.

The configuration in AP view takes precedence over the configuration in AP group view.

Examples

# Enable client keepalive for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] client keep-alive enable

# Enable client keepalive for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client keep-alive enable

Related commands

client keep-alive interval

Use client keep-alive interval to set the client keepalive interval.

Use undo client keep-alive interval to restore the default.

Syntax

client keep-alive interval interval

undo client keep-alive interval

Default

In AP view, an AP uses the configuration in AP group view.

In AP group view, the client keepalive interval is 300 seconds.

Views

AP view

AP group view

Predefined user roles

network-admin

Parameters

interval: Specifies the client keepalive interval in the range of 3 to 1800 seconds.

Usage guidelines

Enable client keepalive before you execute this command.

As a best practice to ensure client stability, set the keepalive interval to a value larger than 10 seconds.

The configuration in AP view takes precedence over the configuration in AP group view.

Examples

# Set the keepalive interval to 20 seconds for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] client keep-alive interval 20

# Set the keepalive interval to 20 seconds for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client keep-alive interval 20

Related commands

client keep-alive enable

client max-count

Use client max-count to set the maximum number of associated clients for a service template.

Use undo client max-count to restore the default.

Syntax

client max-count max-number

undo client max-count

Default

The number of associated clients for a service template is not limited.

Views

Service template view

Predefined user roles

network-admin

Parameters

max-number: Specifies the maximum number of clients in the range of 1 to 512.

Usage guidelines

With this feature configured, new clients cannot access the WLAN from a radio and the SSID is hidden when the maximum number is reached on the radio.

Examples

# Set the maximum number of associated clients to 38 for service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client max-count 38

Related commands

beacon ssid-hide

client preferred-vlan authorized

Use client preferred-vlan authorized to configure clients to prefer the authorization VLAN after roaming.

Use undo client preferred-vlan authorized to configure client VLANs to remain unchanged after client roaming.

Syntax

client preferred-vlan authorized

undo client preferred-vlan authorized

Default

Clients prefer the authorization VLAN after roaming.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

This feature takes effect only on 802.1X and MAC authentication clients.

Typically, the VLAN of a client remains unchanged after client roaming. However, if the client triggers a security alert configured on IMC after roams to another AP, the issued authorization VLAN for user isolation takes effect.

Examples

# Configure clients to prefer the authorization VLAN after roaming.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client preferred-vlan authorized

client report-mandatory

Use client report-mandatory to allow locally authenticated clients to come online after successful client information reporting.

Use undo client report-mandatory to allow locally authenticated clients to come online immediately after successful local authentication.

Syntax

client report-mandatory

undo client report-mandatory

Default

Locally authenticated clients come online after successful client information reporting.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

By default, an AP reports information about locally authenticated clients that pass authentication to the AC, and the AC creates client entries and informs the AP to get the clients online. If the CAPWAP tunnel between the AC and the AP operates incorrectly, clients might fail to come online and perform reauthentication repeatedly. To avoid this problem, you can allow clients to come online immediately after successful local authentication so that the AP can forward client traffic when the AC cannot be reached. The AP synchronizes client information to the AC when the tunnel recovers.

Examples

# Allow locally authenticated clients to come online immediately after successful local authentication.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] undo client report-mandatory

client smart-access enable

Use client smart-access enable to enable smart client access.

Use undo client smart-access enable to restore the default.

Syntax

client smart-access enable

undo client smart-access enable

Default

Smart client access is disabled.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

This feature enables H3C wireless clients to access the WLAN automatically when the AKM mode is set to PSK or when the radio is bound to an empty service template.

Examples

# Enable smart client access.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client smart-access enable

client vlan-alloc

Use client vlan-alloc to set the VLAN allocation method for clients.

Use undo client vlan-alloc to restore the default.

Syntax

client vlan-alloc { dynamic | static | static-compatible }

undo client vlan-alloc

Default

The VLAN allocation method for clients is dynamic.

Views

Service template view

Predefined user roles

network-admin

Parameters

dynamic: Specifies dynamic VLAN allocation.

static: Specifies static VLAN allocation.

static-compatible: Specifies compatible static VLAN allocation.

Usage guidelines

When a client comes online for the first time, the VLAN assigned to the client depends on the allocation method.

· Static allocation—The client inherits the VLAN that has been assigned to it. If the IP address lease has not expired, the client will use the same IP address. This method helps save IP addresses.

· Dynamic allocation—The radio re-assigns a VLAN to the client. This method balances clients in all VLANs.

· Compatible static allocation—The client inherits the VLAN that has been assigned to it when roaming between Comware 5 and Comware 7 ACs.

When a client goes offline and then comes online again on the same service within the client cache aging time, it uses the VLAN from the last session by default. You can use the client cache aging-time command to set the client cache aging time. For more information about this command, see WLAN roaming commands in WLAN Roaming Command Reference.

Examples

# Set the VLAN allocation method for clients to dynamic.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] client vlan-alloc dynamic

Related commands

service-template

client cache aging-time (WLAN Roaming Command Reference)

client-mac

Use client-mac to add a client to the VIP client group.

Use undo ap-name to remove a client from the VIP client group.

Syntax

client-mac mac-address [ level level ]

undo client-mac mac-address

Default

No clients exist in the VIP client group.

Views

VIP client group view

Predefined user roles

network-admin

Parameters

mac-address: Specifies a client by its MAC address. The MAC address must be in the H-H-H format, where 0s at the beginning of each H (16-bit hexadecimal digit) can be omitted.

level level: Specifies the VIP client level. The value is 1 or 2. By default, the client level is 1.

Usage guidelines

You can add both online and offline clients to the VIP client group.

You can add a maximum of 128 level 1 VIP clients. The maximum number of level 2 VIP clients that can be added is the maximum number clients supported by the device.

Level 1 clients have a higher transmission and access priority than level 2 clients. The system does not rate limit level 1 clients.

When the maximum number of associated clients is reached on a radio and a new client attempts to come online, the system performs the following tasks:

· If the new client is a non-VIP client, the system rejects the client's association request.

· If the new client is a VIP client, the system logs off a non-VIP client or a VIP client of a lower level for the new client to come online.

¡ If non-VIP clients are online, the system logs off a non-VIP client.

¡ If no non-VIP client is online, the system logs off a level 2 VIP client.

¡ If all the online clients are level 1 VIP clients, the system rejects the client's association request.

The VIP client feature takes effect only on clients associated with the AC.

Examples

# Add a client with MAC address a0cc-2bca-a305 to the VIP client group.

<Sysname> system-view

[Sysname] wlan vip-client-group

[Sysname-wlan vip-client-group] client-mac a0cc-2bca-a305

client-statistics-report

Use client-statistics-report enable to enable client statistics reporting.

Use client-statistics-report disable to disable client statistics reporting.

Use undo client-statistics-report to restore the default.

Syntax

client-statistics-report { disable | enable [ interval interval ] }

undo client-statistics-report

Default

In AP view, an AP uses the configuration in AP group view.

In AP group view, client statistics reporting is enabled.

Views

AP view

AP group view

Predefined user roles

network-admin

Parameters

interval interval: Specifies the interval at which client statistics are reported, in the range of 2 to 120 seconds. The interval is 50 seconds by default.

Usage guidelines

This feature enables an AP to report client statistics to the AC at the specified intervals for client entry update. The AC informs the AP to log off a client if the client's information does not exist in the saved entries.

To avoid frequent client re-association, disable this feature when the network is in a bad condition.

The configuration in AP view takes precedence over the configuration in AP group view.

Examples

# Enable client statistics reporting and set the reporting interval to 20 seconds for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] client-statistics-report enable interval 20

# Enable client statistics reporting and set the reporting interval to 20 seconds for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] client-statistics-report enable interval 20

client-statistics-report smart-maintenance

Use client-statistics-report smart-maintenance enable to enable client O&M statistics reporting.

Use client-statistics-report smart-maintenance disable to disable client O&M statistics reporting.

Use undo client-statistics-report smart-maintenance to restore the default.

Syntax

client-statistics-report smart-maintenance { disable | enable }

undo client-statistics-report smart-maintenance

Default

Client O&M statistics reporting is enabled.

Views

AP view

Predefined user roles

network-admin

Usage guidelines

This feature enables an AP to report client O&M statistics to the AC at the interval specified by the client-statistics-report command. Then, the AC will report the statistics to the cloud platform.

As a best practice, disable this feature when the network is in a bad condition.

Examples

# Enable client O&M statistics reporting for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] client-statistics-report smart-maintenance enable

Related commands

client-statistics-report

customlog format wlan

Use customlog format wlan to enable the device to generate client logs in the specified format.

Use undo customlog format wlan to restore the default.

Syntax

customlog format wlan { normal | sangfor }

undo customlog format wlan

Default

The device generates client logs only in H3C format.

Views

System view

Predefined user roles

network-admin

Parameters

normal: Specifies normal format.

sangfor: Specifies sangfor format.

Usage guidelines

By default, the device generates client logs only in H3C format that logs AP name, radio ID, client MAC address, SSID, BSSID, and client online status.

You can configure the device to generate client logs in one of the following formats:

· Normal—Logs AP MAC address, AP name, client IP address, client MAC address, SSID, and BSSID.

· Sangfor—Logs AP MAC address, client IP address, and client MAC address.

This feature does not affect the generation of client logs in H3C format.

Examples

# Enable the device to generate client logs in sangfor format.

<Sysname> system-view

[Sysname] customlog format wlan sangfor

description

Use description to configure a description for a service template.

Use undo description to restore the default.

Syntax

description text

undo description

Default

No description is configured for a service template.

Views

Service template view

Predefined user roles

network-admin

Parameters

text: Specifies a description, a case-sensitive string of 1 to 64 characters.

Examples

# Configure a description for service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] description wlanst

display wlan ap all client-number

Use display wlan ap all client-number to display the number of online clients at the 2.4 GHz band and the 5 GHz band.

Syntax

display wlan ap all client-number

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the number of online clients at both the 2.4 GHz and 5 GHz bands.

<System> display wlan ap all client-number

AP name Clients 2.4GHz 5GHz

ap1 2 2 0

Table 1 Command output

Field	Description
Clients	Total number of online clients.
2.4GHz	Number of online clients at the 2.4 GHz band.
5GHz	Number of online clients at the 5 GHz band.

‌

display wlan ap all radio client-number

Use display wlan ap all radio client-number to display the number of online clients and channel information for each radio.

Syntax

display wlan ap all radio client-number

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the number of online clients and channel information for each radio.

<Sysname> display wlan ap all radio client-number

AP name RID Channel Clients

ap1 1 44 12

ap1 2 11 4

display wlan ap-group all client-number

Use display wlan ap-group all client-number to display the number of online clients in each radio group.

Syntax

display wlan ap-group all client-number

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the number of online clients in each radio group.

<Sysname> display wlan ap-group all client-number

AP group name Group ID Clients 2.4GHz 5GHz

default-group 1 150 100 50

1 2 250 50 200

Table 2 Command output

Field	Description
2.4GHz	Number of clients at the 2.4 GHz band.
5GHz	Number of clients at the 5 GHz band.

‌

display wlan blacklist

Use display wlan blacklist to display blacklist entries.

Syntax

display wlan blacklist { dynamic | static }

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

dynamic: Specifies the dynamic blacklist.

static: Specifies the static blacklist.

Examples

# Display static blacklist entries.

<Sysname> display wlan blacklist static

Total number of clients: 3

MAC addresses:

000e-35b2-000e

0019-5b8e-b709

001c-f0bf-9c92

# Display dynamic blacklist entries.

<Sysname> display wlan blacklist dynamic

Total number of clients: 3

MAC address APID RID Lifetime Duration Reason

000f-e2cc-0001 1 1 300s 10m 46s WIPS countermeasure

000f-e2cc-0002 2 1 300s 08m 46s WIPS countermeasure

000f-e2cc-0003 3 1 300s 08m 22s WIPS countermeasure

Table 3 Command output

Field	Description
MAC address	Client MAC address.
APID	ID of the AP that detected the rogue client.
RID	Radio ID of the AP that detected the rogue client.
Lifetime	Lifetime of the entry in seconds.
Duration	Duration for the entry since the entry was added to the dynamic blacklist.
Reason	Reason why the entry was added to the dynamic blacklist: · WIPS countermeasure. · Reauthentication rejection. · Password failure limit. · Others. For example, the entry is added and deployed dynamically by the Ops platform.

‌

display wlan bss

Use display wlan bss to display basic service set (BSS) information.

Syntax

display wlan bss { all | ap ap-name | bssid bssid } [ slot slot-number ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

all: Displays all BSSs.

ap ap-name: Specifies an AP by its name, a case-sensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), dots (.), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-).

bssid bssid: Specifies a BSS by its ID. The value is a 48-bit hexadecimal number in the format of H-H-H.

slot slot-number: Specifies a cloud cluster member device by its member ID. If you do not specify a member device, this command displays client information on the master device.

verbose: Displays detailed client information. If you do not specify this keyword, the command displays brief client information.

Examples

# Display brief information about all BSSs.

<Sysname> display wlan bss all

Current BSS number: 4

Max BSS number: 6144

Bound BSS number: 5

AP name RID SSID BSSID

ap1 1 SSID1 001c-f08f-f804

ap1 2 SSID1 001c-f08f-f806

ap2 1 SSID1 001c-f0bf-9c92

ap2 2 SSID1 001c-f0bf-9c94

Table 4 Command output

Field	Description
Current BSS number	Number of current BSSs.
Max BSS number	Maximum number of supported BSSs.
Bound BSS number	Number of BSSs that can be created or number of radios bound with a service template. This field might have a larger value than the Max BSS number field.

‌

# Display detailed information about the BSS with ID 001c-f08f-f804 on member device 1.

<Sysname> display wlan bss bssid 001c-f08f-f804 slot 1 verbose

AP name : ap1

BSSID : 001c-f08f-f804

Radio ID : 1

Service template name : servcie1

SSID : SSID1

VLAN ID : 1

AKM mode : Not configured

User authentication mode : Bypass

Table 5 Command output

Field	Description
AKM mode	AKM mode: · 802.1X. · PSK. · Not configured.
User authentication mode	User authentication mode: · Bypass—No client authentication. · MAC. · 802.1X. · OUI.

Field

Description

AKM mode

AKM mode:

· 802.1X.

· PSK.

· Not configured.

User authentication mode

User authentication mode:

· Bypass—No client authentication.

· MAC.

· 802.1X.

· OUI.

‌

display wlan bss count

Use display wlan bss count to display BSS quantity information.

Syntax

display wlan bss count [ slot slot-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

slot slot-number: Specifies a cloud cluster member device by its member ID. If you do not specify a member device, this command displays client information on all member devices.

Examples

# Display BSS quantity information.

<Sysname> display wlan bss count

Current BSS number: 4

Max BSS number: 6144

Bound BSS number: 5

Table 6 Command output

Field	Description
Current BSS number	Number of current BSSs.
Max BSS number	Maximum number of supported BSSs.
Bound BSS number	Number of BSSs that can be generated by binding service templates to radios. The bound BSS number might exceed the max BSS number.

‌

display wlan client

Use display wlan client to display client information.

Syntax

display wlan client [ ap ap-name [ radio radio-id ] | mac-address mac-address | service-template service-template-name | frequency-band { 2.4 | 5 } ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

ap ap-name: Displays information about clients that are connected to the specified AP. The AP name is a case-sensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), dots (.), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-).

radio radio-id: Displays information about clients that are connected to the specified radio. The value range for the radio-id argument varies by device model. If you do not specify this option, the command displays information about all clients that are connected to the specified AP.

mac-address mac-address: Specifies a client by its MAC address.

service-template service-template-name: Displays information about clients that are associated with the specified service template. The service template name is a case-insensitive string of 1 to 63 characters.

frequency-band: Displays information about clients working on the specified band.

2.4: Specifies the 2.4 GHz band.

5: Specifies the 5 GHz band.

verbose: Displays detailed client information. If you do not specify this keyword, the command displays brief client information.

Examples

# Display brief information about all clients.

<Sysname> display wlan client

Total number of clients: 3

MAC address Username AP name R IP address VLAN

000f-e265-6400 N/A ap1 1 1.1.1.1 100

000f-e265-6401 user ap2 1 3.0.0.3 200

84db-ac14-dd08 N/A ap1 1 5.5.5.3 1

Table 7 Command output

Field	Description
MAC address	Client MAC address.
Username	Client username: · The field displays the client username if the client uses 802.1X or MAC authentication. · The field displays N/A if the client does not use 802.1X or MAC authentication. NOTE: If the client uses portal authentication, this field does not display the portal username of the client.
AP name	Name of the AP that the client is associated with.
R	ID of the radio that the client is associated with.
IP address	IPv4 address of the client.
VLAN ID	ID of the VLAN to which the client belongs.

‌

# Display detailed information about the client with MAC address 000f-e265-6400.

<Sysname> display wlan client mac-address 000f-e265-6400 verbose

Total number of clients: 1

MAC address : 000f-e265-6400

IPv4 address : 10.1.1.114

IPv6 address : 2001::1234:5678:0102:0304

Username : N/A

AID : 1

AP ID : 1

AP name : ap1

Radio ID : 1

Channel : 36

SSID : office

BSSID : 0026-3e08-1150

VLAN ID : 3

Sleep count : 3

Wireless mode : 802.11gn

Channel bandwidth : 20MHz

20/40 BSS Coexistence Management : Not supported

SM power save : Disabled

Short GI for 20MHz : Supported

Short GI for 40MHz : Supported

Short GI for 80MHz : Supported

Short GI for 160/80+80MHz : Not supported

STBC RX capability : Not supported

STBC TX capability : Not supported

LDPC RX capability : Not supported

SU beamformee capability : Not supported

MU beamformee capability : Not supported

Beamformee STS capability : N/A

Block Ack : TID 0 In

Supported VHT-MCS set : NSS1 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

NSS2 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

Supported HT MCS set : 0, 1, 2, 3, 4, 5, 6, 7,

8, 9, 10, 11, 12, 13, 14,

Supported rates : 1, 2, 5.5, 6, 9, 11,

12, 18, 24, 36, 48, 54 Mbps

QoS mode : N/A

Listen interval : 10

RSSI : 62

Rx/Tx rate : 130/195 Mpbs

Authentication method : Open system

Security mode : PRE-RSNA

AKM mode : Not configured

Cipher suite : N/A

User authentication mode : Bypass

WPA3 status : Disabled

Authorization CAR :

Average input rate : 102400 bps

Average output rate : 102400 bps

Authorization ACL ID : 3001

Authorization user profile : N/A

Roam status : N/A

Key derivation : SHA1

PMF status : Disabled

Forwarding policy name : Not configured

Online time : 0days 0hours 1minutes 13seconds

FT status : Inactive

BTM status : Disabled

Authorization user group : N/A

Table 8 Command output

Field	Description
MAC address	Client MAC address.
IPv4 address	Client IPv4 address.
IPv6 address	Client IPv6 address.
Username	Client username: · The field displays the client username if the client uses 802.1X or MAC authentication. · The field displays N/A if the client does not use 802.1X or MAC authentication. NOTE: If the client uses portal authentication, this field does not display the portal username of the client.
AID	Association ID.
AP ID	ID of the AP that the client is associated with.
AP name	Name of the AP that the client is associated with.
Radio ID	ID of the radio that the client is associated with.
Channel	Channel of the radio that the client is associated with.
SSID	SSID with which the client is associated.
VLAN ID	ID of the VLAN to which the client belongs.
Sleep count	Client sleep times.
Wireless mode	Wireless mode: · 802.11a. · 802.11b. · 802.11g. · 802.11gn. · 802.11an. · 802.11ac. · 802.11gac. · 802.11ax. · 802.11gax. · 802.11eax. · 802.11be. · 802.11abe. · 802.11gbe.
Cha nnel bandwidth	Channel bandwidth: · 20 MHz. · 40 MHz. · 80 MHz. · 160 MHz. · 320 MHz.
SM Power Save	SM Power Save status: · Enabled—Only one antenna of a client operates in active state, and others operate in sleep state to save power. · Disabled.
Short GI for 20MHz	Whether the client supports short GI when its channel bandwidth is 20 MHz: · Supported. · Not supported.
Short GI for 40MHz	Whether the client supports short GI when its channel bandwidth is 40 MHz: · Supported. · Not supported.
Short GI for 80MHz	Whether the client supports short GI when its channel bandwidth is 80 MHz: · Supported. · Not supported.
Short GI for 160/80+80MHz	Whether the client supports short GI when its channel bandwidth is 160 MHz or 80 + 80 MHz: · Supported. · Not supported.
STBC Rx Capability	Client STBC receive capability; · Not supported. · Supported.
STBC Tx Capability	Client STBC transmission capability: · Not supported. · Supported.
LDPC Rx capability	Client LDPC receive capability; · Not supported. · Supported.
SU beamformee capability	Client SU beamformee capability: · Not supported. · Supported.
MU beamformee capability	Client MU beamformee capability: · Not supported. · Supported.
Beamformee STS capability	Supported spatial stream quantity if the client is a beamformee receiver, in the range of 0 to 7 (the maximum spatial stream quantity specified by the MIMO mode minus one). This field displays N/A if the client cannot act as a beamformee receiver.
Number of Sounding Dimensions	Supported spatial stream quantity if the client is a beamformee transmitter, in the range of 0 to 7 (the maximum spatial stream quantity specified by the MIMO mode minus one). This field displays N/A if the client cannot act as a beamformee transmitter.
Block Ack	Negotiation result of Block ACK with TID: · TID 0 In—Sends Block ACK for inbound traffic. · TID 0 Out—Sends Block ACK for outbound traffic. · TID 0 Both—Sends Block ACK for both inbound and outbound traffic. · N/A—Does not send Block ACK for both inbound and outbound traffic.
Supported VHT-MCS set	VHT-MCS supported by the client.
Supported HT MCS set	HT-MCS supported by the client.
5G 40And80MHz Channel bandwidth	Client support for 5G 40 MHz and 80 MHz channel bandwidth: · Not Supported. · Supported.
5G 160MHz Channel bandwidth	Client support for 5G 160 MHz channel bandwidth: · Not Supported. · Supported.
5G 8080MHz Channel bandwidth	Client support for 5G 80+80 MHz channel bandwidth: · Not Supported. · Supported.
6G 320MHz Channel bandwidth	Client support for 6G 320 MHz channel bandwidth: · Not Supported. · Supported.
OFDMA random access RUs	Support for OFDMA random selection of RUs. · Not Supported. · Supported.
Supported HE-MCS set	Supported HE-MCS sets.
Supported EHT 80MHz-MCS set	Supported 80 MHz EHT-MCS sets.
Supported EHT160MHz-MCS set	Supported 160 MHz EHT-MCS sets.
Supported EHT 320MHz-MCS set	Supported 320 MHz EHT-MCS sets.
TWT scheduled	Whether the client is a TWT scheduled client. A TWT scheduled client can calculate and negotiate TWT scheduling information. · Yes. · No.
QoS mode	QoS mode: · N/A—WMM is not supported. · WMM—WMM is supported. WMM information negotiation is carried out between an AP and a client that both support WMM.
Listen interval	Interval at which the client wakes up to listen for beacon frames. It is counted by beacon interval.
RSSI	Received signal strength indication. This value indicates the client signal strength detected by the AP.
Rx/Tx rate	Sending and receiving rates of data, management, and control frames.
Speed	Sending and receiving rates in the past 2 minutes in Kbps, rounded to three decimal places. This field displays N/A if both the sending and receiving rates are 0.
Authentication method	Authentication method: · Open system. · Shared key. · SAE.
Security mode	Security mode: · RSN—Beacons and probe responses carry RSN IE. · WPA—Beacons and probe responses carry WPA IE. · PRE-RSNA—Beacons and probe responses do not carry RSN IE or WPA IE.
AKM mode	AKM mode: · 802.1X. · PSK. · Not configured.
Cipher suite	Cipher suite: · N/A. · WEP40. · WEP104. · WEP128. · CCMP. · TKIP. · GCMP.
User authentication mode	User authentication mode: · Bypass—No client authentication. · MAC. · 802.1X. · OUI.
WPA3 status	WPA3 status: · Disabled. · Enabled. · N/A.
Authorization CAR	Authorization CAR: · Average input rate—Average uplink rate in bps. · Average output rate—Average downlink rate in bps. · N/A—This field displays N/A if the authentication server is not configured with authorization CAR for users.
Authorization ACL ID	Authorized ACL number: This field displays N/A if the authentication server is configured without any authorized ACL.
Authorization user profile	Name of the authorized user profile: · This field displays the authorized user profile name if the authorized user profile takes effect. · This field displays authorized user profile name + Not effective if the authorized user profile does not take effect. · This field displays N/A if the authentication server is configured without any authorized user profile.
Roam status	Roam status: · Roaming in progress. · Inter-AC roam. · Inter-MA roam. · Intra-AC roam. · Intra-MA roam. · This field displays N/A if the client stays in one BSS after coming online.
Key derivation	Key derivation type: · SHA1—Uses the HMAC-SHA1 hash algorithm. · SHA256—Uses the HMAC-SHA256 hash algorithm. · SHA384—Uses the HMAC-SHA384 hash algorithm. · N/A—No key derivation algorithm is involved for the authentication type.
PMF status	PMF status: · Enabled—Management frame protection is enabled. · Disabled—Management frame protection is disabled. · N/A—Management frame protection is not involved.
Forwarding policy name	WLAN forwarding policy name: · Not configured. · Policy-name.
Online time	Client online duration.
FT status	Fast BSS transition (FT): · Active—FT is enabled. · Inactive—FT is disabled.
BTM status	BTM status: · Disabled. · Enabled.
Authorization user group	Authorization user group.

‌

display wlan client device-information

Use display wlan client device-information to display information about client device.

Syntax

display wlan client device-information [ mac-address mac-address ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

mac-address mac-address: Specifies a MAC address of a client device. If you do not specify this option, the command displays status information about all clients

Examples

# Display information about client device.

<Sysname> display wlan client device-information

Total number of clients: 2

MAC_Address : 0000-0000-0001

Vendor Name : Oppo

Host Name : OPPO-Find-X2-Pro

MAC_Address : 0000-0000-0002

Vendor Name : Oppo

Host Name : OPPO-Find-X2

Table 9 Command output

Field	Description
MAC address	Client MAC address.
Vendor Name	Vendor name. If the client uses an IOS operating system or is configured with a random MAC, this field displays Unknown.
Host Name	Host name. If the client uses an IOS operating system, this field displays Unknown.

display wlan client ipv6

Use display wlan client ipv6 to display information about client IPv6 addresses.

Syntax

display wlan client ipv6

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display brief status information about the specified client.

<Sysname> display wlan client ipv6

MAC address AP name IPv6 address VLAN

84db-ac14-dd08 ap1 1::2:0:0:3 300

Table 10 Command output

Field	Description
MAC address	Client MAC address.
IPv6 address	Client IPv6 address.

‌

display wlan client online-duration

Use display wlan client online-duration to display client online duration.

Syntax

display wlan client online-duration [ ap ap-name ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

verbose: Displays detailed information. If you do not specify this keyword, the command displays brief information.

Examples

# Display brief information about client online duration.

<Sysname> display wlan client online-duration

Total number of online clients: 2

MAC address IPv4 address Online duration

a4c1-5b79-fa5b-1d62 192.168.11.123 0days 0hours 2minutes 23seconds

22d3-c5b7-a4b5-96fa 192.168.11.234 0days 0hours 5minutes 34seconds

Table 11 Command output

Field	Description
MAC address	Client MAC address.
IPv4 address	Client IPv4 address.
Online duration	Client online duration.

‌

display wlan client status

Use display wlan client status to display client status information.

Syntax

display wlan client status [ mac-address mac-address ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

mac-address mac-address: Specifies a client by its MAC address in the format of H-H-H. If you do not specify this option, the command displays status information about all clients.

verbose: Displays detailed client status information. If you do not specify this keyword, the command displays brief client status information.

Examples

# Display brief status information about the specified client.

<Sysname> display wlan client status mac-address 001c-f08f-f804

Total number of clients: 1

MAC address Access time RSSI Rx/Tx rate Discard AP name RID

001c-f08f-f804 41ms 0 39/117Mbps 0.00 ap2 2

# Display brief status information about all clients.

<Sysname> display wlan client status

Total number of clients: 2

MAC address Access time RSSI Rx/Tx rate Discard AP name RID

000b-c002-9d09 41ms 65 39/117Mbps 0.00% ap2 2

000f-e265-6401 10ms 62 130/195Mbps 0.00% ap1 1

Table 12 Command output

Field	Description
MAC address	Client MAC address.
Access time	Time the client took to associate with the WLAN.
RSSI	RSSI of the client.
Rx/Tx rate	Rates at which the client receives and sends data, management packets, and control packets.
Discard	Ratio of packets discarded by the client.
AP name	Name of the AP with which the client is associated.
RID	ID of the radio with which the client is associated.

‌

# Display detailed status information about the specified client.

<Sysname> display wlan client status mac-address 001c-f08f-f804 verbose

Total number of clients: 1

MAC address : 001c-f08f-f804

AP name : ap2

Radio ID : 2

Access time : 41 ms

RSSI : 0

Rx/Tx rate : 39/117 Mbps

Received:

Retransmitted packets : 84

Retransmitted packet ratio : 64.12%

Sent:

Retransmitted packets : 0

Retransmitted packet ratio : 0.00%

Discarded:

Discarded packets : 0

Discarded packet ratio : 0.00%

Table 13 Command output

Field	Description
MAC address	Client MAC address.
AP name	Name of the AP that the client is associated with.
Radio ID	ID of the radio that the client is associated with.
Access time	Time the client took to associate with the WLAN.
RSSI	RSSI of the client.
Rx/Tx rate	Rates at which the client receives and sends data, management packets, and control packets.
Received	Received packet statistics: · Retransmitted packets. · Retransmitted packet ratio.
Sent	Sent packet statistics: · Retransmitted packets. · Retransmitted packet ratio.
Discarded	Discarded packet statistics: · Discarded packets. · Discarded packet ratio.

‌

display wlan cpe

Use display wlan cpe to display CPE information.

Syntax

display wlan cpe [ mac-address ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

mac-address mac-address: Specifies CPE information by its MAC address.

verbose: Displays detailed CPE information. If you do not specify this keyword, the command displays brief CPE information.

Examples

# Display brief CPE information about all clients.

<Sysname> display wlan cpe

Total number of clients: 1

MAC address Username AP name R IP address VLAN

000f-e265-6400 N/A ap1 1 1.1.1.1 100

Table 14 Command output

Field	Description
MAC address	CPE MAC address.
Username	CPE username: · The field displays the CPE username if the CPE uses 802.1X or MAC authentication. · The field displays N/A if the CPE does not use 802.1X or MAC authentication. NOTE: If the CPE uses portal authentication, this field does not display the portal username of the CPE.
AP name	Name of the AP that the CPE is associated with.
R	ID of the radio that the CPE is associated with.
IP address	IPv4 address of the CPE.
VLAN ID	ID of the VLAN to which the CPE belongs.

‌

# Display detailed information about specified CPE.

<Sysname> display wlan cpe 000f-e265-6400 verbose

Total number of clients: 1

MAC address : 000f-e265-6400

IPv4 address : 10.1.1.114

IPv6 address : 2001::1234:5678:0102:0304

Username : N/A

AID : 1

AP ID : 1

AP name : ap1

Radio ID : 1

Channel : 36

SSID : office

BSSID : 0026-3e08-1150

VLAN ID : 3

Sleep count ：3

Wireless mode : 802.11gn

Channel bandwidth : 20MHz

20/40 BSS Coexistence Management : Not supported

SM power save : Disabled

Short GI for 20MHz : Supported

Short GI for 40MHz : Supported

Short GI for 80MHz : Supported

Short GI for 160/80+80MHz : Not supported

STBC RX capability : Not supported

STBC TX capability : Not supported

LDPC RX capability : Not supported

SU beamformee capability : Not supported

MU beamformee capability : Not supported

Beamformee STS capability : N/A

Block Ack : TID 0 In

Supported VHT-MCS set : NSS1 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

NSS2 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

Supported HT MCS set : 0, 1, 2, 3, 4, 5, 6, 7,

8, 9, 10, 11, 12, 13, 14,

Supported rates : 1, 2, 5.5, 6, 9, 11,

12, 18, 24, 36, 48, 54 Mbps

QoS mode : N/A

Listen interval : 10

RSSI : 62

Rx/Tx rate : 130/195 Mbps

Authentication method : Open system

Security mode : PRE-RSNA

AKM mode : Not configured

Cipher suite : N/A

User authentication mode : Bypass

WPA3 status : Disabled

Authorization CAR :

Average input rate : 102400 bps

Average output rate : 102400 bps

Authorization ACL ID : 3001

Authorization user profile : N/A

Roam status : N/A

Key derivation : SHA1

PMF status : Disabled

Forwarding policy name : Not configured

Online time : 0days 0hours 1minutes 13seconds

FT status : Inactive

BTM status : Disabled

Authorization user group : N/A

Table 15 Command output

Field	Description
MAC address	CPE MAC address.
IPv4 address	CPE IPv4 address.
IPv6 address	CPE IPv6 address.
Username	CPE username: · The field displays the CPE username if the CPE uses 802.1X or MAC authentication. · The field displays N/A if the CPE does not use 802.1X or MAC authentication. NOTE: If the CPE uses portal authentication, this field does not display the portal username of the CPE.
AID	Association ID.
AP ID	ID of the AP that the CPE is associated with.
AP name	Name of the AP that the CPE is associated with.
Radio ID	ID of the radio that the CPE is associated with.
Channel	Channel of the radio that the CPE is associated with.
SSID	SSID with which the CPE is associated.
BSSID	Basic service set identifier
VLAN ID	ID of the VLAN to which the CPE belongs.
Sleep count	CPE sleep times.
Wireless mode	Wireless mode: · 802.11a. · 802.11b. · 802.11g. · 802.11gn. · 802.11an. · 802.11ac. · 802.11gac. · 802.11ax. · 802.11gax.
Channel bandwidth	Channel bandwidth: · 20 MHz. · 40 MHz. · 80 MHz. · 160 MHz.
20/40 BSS Coexistence Management	Whether CPE support 20MHz and 40MHz bandwidth coexistence management. · Supported. · Not supported.
SM Power Save	SM Power Save status: · Enabled—Only one antenna of a CPE operates in active state, and others operate in sleep state to save power. · Disabled.
Short GI for 20MHz	Whether the CPE supports short GI when its channel bandwidth is 20 MHz: · Supported. · Not supported.
Short GI for 40MHz	Whether the CPE supports short GI when its channel bandwidth is 40 MHz: · Supported. · Not supported.
Short GI for 80MHz	Whether the CPE supports short GI when its channel bandwidth is 80 MHz: · Supported. · Not supported.
Short GI for 160/80+80MHz	Whether the CPE supports short GI when its channel bandwidth is 160 MHz or 80 + 80 MHz: · Supported. · Not supported.
STBC Rx Capability	CPE STBC receive capability; · Not supported. · Supported.
STBC Tx Capability	CPE STBC transmission capability: · Not supported. · Supported.
LDPC Rx capability	CPE LDPC receive capability; · Not supported. · Supported.
SU beamformee capability	CPE SU beamformee capability: · Not supported. · Supported.
MU beamformee capability	CPE MU beamformee capability: · Not supported. · Supported.
Beamformee STS capability	Supported spatial stream quantity if the CPE is a beamformee receiver, in the range of 0 to 7 (the maximum spatial stream quantity specified by the MIMO mode minus one). This field displays N/A if the CPE cannot act as a beamformee receiver.
Number of Sounding Dimensions	Supported spatial stream quantity if the CPE is a beamformee transmitter, in the range of 0 to 7 (the maximum spatial stream quantity specified by the MIMO mode minus one). This field displays N/A if the CPE cannot act as a beamformee transmitter.
Block Ack	Negotiation result of Block ACK with TID: · TID 0 In—Sends Block ACK for inbound traffic. · TID 0 Out—Sends Block ACK for outbound traffic. · TID 0 Both—Sends Block ACK for both inbound and outbound traffic. · N/A—Does not send Block ACK for both inbound and outbound traffic.
Supported VHT-MCS set	VHT-MCS supported by the CPE.
Supported HT MCS set	HT-MCS supported by the CPE.
Supported rates	CPE supported rates
2.4G 40MHz Channel bandwidth	CPE support for 2.4G 40 MHz channel bandwidth: · Not Supported. · Supported.
5G 40And80MHz Channel bandwidth	CPE support for 5G 40 MHz and 80 MHz channel bandwidth: · Not Supported. · Supported.
5G 160MHz Channel bandwidth	CPE support for 5G 160 MHz channel bandwidth: · Not Supported. · Supported.
5G 8080MHz Channel bandwidth	CPE support for 5G 80+80 MHz channel bandwidth: · Not Supported. · Supported.
OFDMA random access RUs	Support for OFDMA random selection of RUs. · Not Supported. · Supported.
Supported HE-MCS set	Supported HE-MCS sets.
Supported EHT 80MHz-MCS set	Supported 80 MHz HE-MCS sets.
Supported EHT160MHz-MCS set	Supported 160 MHz HE-MCS sets.
Supported EHT 8080MHz-MCS set	Supported 80+80 MHz HE-MCS sets.
TWT scheduled	Whether the CPE is a TWT scheduled CPE. A TWT scheduled CPE can calculate and negotiate TWT scheduling information. · Yes. · No.
QoS mode	QoS mode: · N/A—WMM is not supported. · WMM—WMM is supported. WMM information negotiation is carried out between an AP and a CPE that both support WMM.
Listen interval	Interval at which the CPE wakes up to listen for beacon frames. It is counted by beacon interval.
RSSI	Received signal strength indication. This value indicates the CPE signal strength detected by the AP.
Rx/Tx rate	Sending and receiving rates of data, management, and control frames.
Speed	Sending and receiving rates in the past 2 minutes in Kbps, rounded to three decimal places. This field displays N/A if both the sending and receiving rates are 0.
Authentication method	Authentication method: · Open system. · Shared key. · SAE.
Security mode	Security mode: · RSN—Beacons and probe responses carry RSN IE. · WPA—Beacons and probe responses carry WPA IE. · PRE-RSNA—Beacons and probe responses do not carry RSN IE or WPA IE.
AKM mode	AKM mode: · 802.1X. · PSK. · Not configured.
Cipher suite	Cipher suite: · N/A. · WEP40. · WEP104. · WEP128. · CCMP. · TKIP. · GCMP.
User authentication mode	User authentication mode: · Bypass—No CPE authentication. · MAC. · 802.1X. · OUI.
WPA3 status	WPA3 status: · Disabled. · Enabled. · N/A.
Authorization CAR	Authorization CAR: · Average input rate—Average uplink rate in bps. · Average output rate—Average downlink rate in bps. · N/A—This field displays N/A if the authentication server is not configured with authorization CAR for users.
Authorization ACL ID	Authorized ACL number: This field displays N/A if the authentication server is configured without any authorized ACL.
Authorization user profile	Name of the authorized user profile: · This field displays the authorized user profile name if the authorized user profile takes effect. · This field displays authorized user profile name + Not effective if the authorized user profile does not take effect. · This field displays N/A if the authentication server is configured without any authorized user profile.
Roam status	Roam status: · Roaming in progress. · Inter-AC roam. · Inter-MA roam. · Intra-AC roam. · Intra-MA roam. · This field displays N/A if the CPE stays in one BSS after coming online.
Key derivation	Key derivation type: · SHA1—Uses the HMAC-SHA1 hash algorithm. · SHA256—Uses the HMAC-SHA256 hash algorithm. · SHA384—Uses the HMAC-SHA384 hash algorithm. · N/A—No key derivation algorithm is involved for the authentication type.
PMF status	PMF status: · Enabled—Management frame protection is enabled. · Disabled—Management frame protection is disabled. · N/A—Management frame protection is not involved.
Forwarding policy name	WLAN forwarding policy name: · Not configured. · Policy-name.
Online time	CPE online duration.
FT status	Fast BSS transition (FT): · Active—FT is enabled. · Inactive—FT is disabled.
BTM status	BTM status: · Disabled. · Enabled.
Authorization user group	Authorization user group.

display wlan cpe client

Use display wlan cpe client to display information about clients connected to a CPE.

Syntax

display wlan cpe client

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display information about clients connected to a CPE.

<Sysname> display wlan cpe client

CPE MAC Interface Client MAC Client IPv4 address

70f9-6da1-9c4f GE1/0/4 58c7-ac99-8be0 192.168.101.220

Table 16 Command output

Field	Description
CPE MAC	MAC address of the CPE connected by the client.
Interface	Interface connected by the client.
Client MAC	Client MAC address.
Client IPv4 address	Client IPv4 address.

display wlan forwarding-policy

Use display wlan forwarding-policy to display WLAN forwarding policy information.

Syntax

display wlan forwarding-policy [ policy-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameter

policy-name: Specifies a WLAN forwarding policy by its name, a case-insensitive string of 1 to 31 characters. If you do not specify this argument, the command displays information about all WLAN forwarding policies.

Examples

# Display information about all WLAN forwarding policies.

<Sysname> display wlan forwarding-policy

Total number of forwarding policies: 2

Forwarding policy name: fwd1

Classifier ACL 2000: Local

Classifier ACL 2004: Local

Classifier IPv6 ACL 2001: Remote

Classifier IPv6 ACL 2002: Remote

Forwarding policy name: fwd2

Classifier ACL 4021: Local

Classifier IPv6 ACL 2000: Remote

Classifier IPv6 ACL 3024: Remote

Table 17 Command output

Field	Description
Classifier ACL number	IPv4 packet forwarding mode: · Local—Local forwarding. · Remote—Centralized forwarding.
Classifier IPv6 ACL number	IPv6 packet forwarding mode: · Local—Local forwarding. · Remote—Centralized forwarding.

Field

Description

Classifier ACL number

IPv4 packet forwarding mode:

· Local—Local forwarding.

· Remote—Centralized forwarding.

Classifier IPv6 ACL number

IPv6 packet forwarding mode:

· Local—Local forwarding.

· Remote—Centralized forwarding.

‌

Related commands

wlan forwarding-policy

display wlan lite-control-mode status

Use display wlan lite-control-mode status to display the status of the lite control mode.

Syntax

display wlan lite-control-mode status

The following compatibility matrixes show the support of hardware platforms for this command:

Hardware series	Product model	Product code	Command compatibility
WX3500X series	· WX3510X · WX3520X · WX3540X	· EWP-WX3510X · EWP-WX3520X · EWP-WX3540X	No
WX3500X-E series	WX3508X-E	EWP-WX3508X-E	Yes

Hardware series

Product model

Product code

Command compatibility

WX3500X series

· WX3510X

· WX3520X

· WX3540X

· EWP-WX3510X

· EWP-WX3520X

· EWP-WX3540X

WX3500X-E series

WX3508X-E

EWP-WX3508X-E

Yes

‌

Hardware series	Product model	Product code	Command compatibility
WX3800X series	· WX3820X · WX3840X	· EWP-WX3820X · EWP-WX3840X	No

Hardware series

Product model

Product code

Command compatibility

WX3800X series

· WX3820X

· WX3840X

· EWP-WX3820X

· EWP-WX3840X

‌

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the status of the lite control mode.

<Sysname> system-view

[Sysname] display wlan lite-control-mode status

Lite-control-mode is enabled.

display wlan service-template

Use display wlan service-template to display service template information.

Syntax

display wlan service-template [ service-template-name ] [ verbose ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters. If you do not specify this argument, the command displays information about all service templates.

verbose: Displays detailed service template information.

Examples

# Display brief information about all service templates.

[Sysname] display wlan service-template

Total number of service templates: 2

Service template name SSID Status

1 2333 Enabled

2 3222 Enabled

# Display detailed information about all service templates.

<Sysname> display wlan service-template verbose

Service template name : service1

Description : Not configured

SSID : wuxianfuwu

SSID-hide : Disabled

User-isolation : Disabled

Service template status : Disabled

Maximum clients per BSS : 64

Frame format : Dot3

Seamless roam status : Disabled

Seamless roam RSSI threshold : 50

Seamless roam RSSI gap : 20

VLAN ID : 1

AKM mode : PSK

Security IE : RSN

Cipher suite : CCMP

WEP key ID : 1

TKIP countermeasure time : 100 sec

PTK lifetime : 43200 sec

PTK rekey : Enabled

GTK rekey : Enabled

GTK rekey method : Time-based

GTK rekey time : 86400 sec

GTK rekey client-offline : Enabled

WPA3 status : Disabled

PPSK : Disabled

PPSK Fail Permit : Enabled

User authentication mode : Bypass

Intrusion protection : Disabled

Intrusion protection mode : Temporary-block

Temporary block time : 180 sec

Temporary service stop time : 20 sec

Fail VLAN ID : 1

802.1X handshake : Enabled

802.1X handshake secure : Disabled

802.1X domain : my-domain

MAC-auth domain : Not configured

Max 802.1X users per BSS : 4096

Max MAC-auth users per BSS : 4096

802.1X re-authenticate : Enabled

Authorization fail mode : Online

Accounting fail mode : Online

Authorization : Permitted

Key derivation : SHA1

PMF status : Optional

Hotspot policy number : Not configured

Forwarding policy status : Disabled

Forwarding policy name : Not configured

Forwarder : AP

FT status : Disabled

QoS trust : Port

QoS priority : 0

BTM mode : Disabled

Table 18 Command output

Field	Description
SSID	SSID of the service template.
SSID-hide	Whether the SSID is hidden in beacons: · Disabled. · Enabled.
User-isolation	Use isolation: · Disabled. · Enabled.
Service template status	Service template status: · Disabled. · Enabled.
Maximum clients per BSS	Maximum number of clients that the BSS supports.
Frame format	Client data frame encapsulation format: · Dot3—802.3 format. · Dot11—802.11 format.
Seamless roam status	This field is not supported in the current software version. Seamless roaming status: · Disabled. · Enabled.
Seamless roam RSSI threshold	This field is not supported in the current software version. Seamless roaming RSSI threshold.
Seamless roam RSSI gap	This field is not supported in the current software version. Seamless roaming RSSI gap.
VLAN ID	ID of the VLAN to which clients belong after they come online through the service template.
AKM mode	AKM mode: · 802.1X. · PSK.
Security IE	Security IE: · RSN. · WPA.
Cipher suite	Cipher suite: · WEP40. · WEP104. · WEP128. · TKIP. · CCMP. · GCMP.
TKIP countermeasure time	TKIP countermeasure time. The value 0 indicates no countermeasures are taken.
PTK rekey	Whether PTK rekey is enabled: · Enabled. · Disabled.
GTK rekey	Whether GTK rekey is enabled: · Enabled. · Disabled.
GTK rekey method	GTK rekey method: · Time-based. · Packet-based.
GTK rekey time	GTK rekey interval.
GTK rekey packets	Number of packets that can be transmitted before the GTK is refreshed.
GTK rekey client-offline	Whether client-off GTK rekey is enabled: · Enabled. · Disabled.
WPA3 status	WPA3 security mode: · Disabled. · Mandatory. · Optional. · Enterprise-192 bit. · Enterprise-only. · Enterprise-transition.
PPSK	Whether PPSK is enabled: · Disabled. · Enabled.
PPSK Fail Permit	Whether PPSK fail permit is enabled: · Disabled. · Enabled.
User authentication mode	Authentication mode: · Bypass—No authentication. · MAC. · 802.1X. · MAC-and-802.1X—Performs MAC authentication first and then 802.1X authentication. If MAC authentication fails, 802.1X authentication is not performed.
Intrusion protection	Whether intrusion protection is enabled: · Enabled. · Disabled.
Intrusion protection mode	Intrusion protection mode: · Temporary-block—Temporarily adds intruders to the block list. · Service-stop—Stops all services provided by the BSS that receives illegal packets until it resets. · Temporary-service-stop—Temporarily stops the access service provided by the BSS that receives illegal packets.
Temporary block time	Temporary block time in seconds.
Temporary service stop time	Temporary service stop time in seconds.
Fail VLAN ID	ID of the VLAN to which clients are added if they cannot pass the authentication when the authentication server can be reached. This field displays Not configured if the fail VLAN ID is not configured.
Critical VLAN ID	ID of the VLAN to which clients are added if they cannot pass the authentication because the authentication server cannot be reached. This field displays Not configured if the critical VLAN ID is not configured.
802.1X handshake	Whether 802.1X handshake is enabled: · Enabled. · Disabled.
802.1X handshake secure	Whether secure 802.1X handshake is enabled: · Enabled. · Disabled.
802.1X domain	802.1X authentication domain. This field displays Not configured if the domain is not configured.
MAC-auth domain	MAC authentication domain. This field displays Not configured if the domain is not configured.
Max 802.1X users per BSS	Maximum number of supported 802.1X users in a BSS.
Max MAC-auth users per BSS	Maximum number of supported users that pass the MAC authentication in a BSS.
802.1X re-authenticate	Whether 802.1X reauthentication is enabled: · Enabled. · Disabled.
Authorization fail mode	Authorization fail mode: · Offline—Clients are logged off when authorization fails. · Online—Clients are not logged off when authorization fails.
Accounting fail mode	Accounting fail mode: · Offline—Clients are logged off when accounting fails. · Online—Clients are not logged off when accounting fails.
Authorization	Authorization information: · Permitted—Applies the authorization information issued by the RADIUS server or the local device. · Ignored—Ignores the authorization information issued by the RADIUS server or the local device.
Key derivation	Key derivation type: · SHA1—Uses the HMAC-SHA1 hash algorithm. · SHA256—Uses the HMAC-SHA256 hash algorithm. · SHA1-AND-SHA256—Uses the HMAC SHA1 and SHA256 hash algorithm.
PMF status	PMF status: · Disabled—Management frame protection is disabled. · Optional—Management frame protection in optional mode is enabled. · Mandatory—Management frame protection in mandatory mode is enabled.
Hotspot policy number	Hotspot 2.0 policy number.
Forwarding policy status	WLAN forwarding policy status: · Disabled. · Enabled.
Forward policy name	WLAN forwarding policy name: · Not configured—No WLAN forwarding policy is configured. · policy-name.
Forwarder	Client traffic forwarder: · AC. · AP.
FT status	FT status: · Active. · Inactive.
FT method	FT method: over-the-air.
FT reassociation deadline	FT reassociation timeout timer in seconds.
QoS trust	QoS priority trust mode: · Port—Port priority trust mode. · Dot11e—802.11e priority trust mode.
QoS priority	Port priority in the range of 0 to 7.
BTM mode	BTM status: · Disabled. · Enabled.

‌

display wlan statistics client

Use display wlan statistics client to display client statistics.

Syntax

display wlan statistics client [ mac-address mac-address ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

mac-address mac-address: Specifies a client by its MAC address. If you do not specify this option, the command displays statistics for all clients.

Examples

# Display statistics for all clients.

<Sysname> display wlan statistics client

MAC address : 0014-6c8a-43ff

AP name : ap1

Radio ID : 1

SSID : office

BSSID : 000f-e2ff-7700

RSSI : 31

Sent frames:

Back ground : 0/0 (frames/bytes)

Best effort : 9/1230 (frames/bytes)

Video : 0/0 (frames/bytes)

Voice : 2/76 (frames/bytes)

Received frames:

Back ground : 0/0 (frames/bytes)

Best effort : 18/2437 (frames/bytes)

Video : 0/0 (frames/bytes)

Voice : 7/468 (frames/bytes)

Discarded frames:

Back ground : 0/0 (frames/bytes)

Best effort : 0/0 (frames/bytes)

Video : 0/0 (frames/bytes)

Voice : 5/389 (frames/bytes)

Table 19 Command output

Field	Description
SSID	SSID of the service template.
MAC address	Client MAC address.
Back ground	AC-BK queue.
Best effort	AC-BE queue.
Video	AC-VI queue.
Voice	AC-VO queue.

‌

display wlan statistics connect-history

Use display wlan statistics connect-history to display client connection history.

Syntax

display wlan statistics connect-history service-template service-template-name

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

service-template service-template-name: Specifies a service template by its name.

Examples

# Display the connection history for service template 1.

<Sysname> display wlan statistics connect-history service-template 1

AP name : ap1

Radio ID : 1

Associations : 132

Association failures : 3

Reassociations : 30

Rejections : 12

Abnormal disassociations : 2

Current associations : 57

display wlan statistics service template

Use display wlan statistics service-template to display service template statistics.

Syntax

display wlan statistics service-template service-template-name

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

service-template service-template-name: Specifies a service template by its name.

Examples

# Display statistics for service template 1.

<Sysname> display wlan statistics service-template 1

AP name : ap1

Radio ID : 1

Received:

Frame count : 1713

Frame bytes : 487061

Data frame count : 1683

Data frame bytes : 485761

Association request count : 2

Sent:

Frame count : 62113

Frame bytes : 25142076

Data frame count : 55978

Data frame bytes : 22626600

Association response count : 2

display wlan statistics vip-client

Use display wlan statistics vip-client to display VIP client statistics that an AP reports to the AC.

Syntax

display wlan statistics vip-client [ mac-address mac-address ] [ history-record ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

mac-address: Specifies a client by its MAC address. The MAC address must be in the H-H-H format, where 0s at the beginning of each H (16-bit hexadecimal digit) can be omitted.

history-record: Displays the history records for the VIP client. If you do not specify this keyword, the most recent statistics about the VIP client are displayed.

Usage guidelines

A maximum of 300 history records can be displayed for a VIP client.

Examples

# Display VIP client statistics that an AP reports to the AC.

<Sysname> display wlan statistics vip-client mac-address 1234-4321-1234

Total number of configured VIP clients: 1

Total number of online VIP clients: 1

MAC address : 1234-4321-1234

Data reporting time : 2018-8-15 12:20:15

AP name : ap1

Radio ID : 1

SSID : val-problem

Rx/Tx rate : 114.2/120.2 Mbps

Rx/Tx traffic : 16584/901021 Bytes

RSSI : 33

Current radio user number : 5

Current channel utilization : 20%

Packet loss rate : 0.25%

Packet error rate : 0.01%

Retransmission rate : 1.29%

Delay : 5us

VIP client level : 1

ARP packet num : 7

Table 20 Command output

Field	Description
MAC address	MAC address of the VIP client.
Data reporting time	Time at which the AP reported VIP client statistics to the AC.
AP name	Name of the AP associated with the VIP client.
Radio ID	ID of the radio associated with the VIP client.
SSID	SSID associated with the VIP client.
Rx/Tx rate	Rx/Tx rate for packets from the VIP client, including data, management, and control packets.
Rx/Tx traffic	Traffic received and sent by the VIP client within the report interval, in Bytes.
RSSI	RSSI of the VIP client.
Current radio user number	Number of clients on the current radio.
Current channel utilization	Usage of the current channel.
Clients on radio	Number of clients associated with the radio.
Delay	AP-to-VIP client packet sending delay in microseconds.
VIP client level	VIP level of the VIP client. For more information, see the client-mac command.

‌

Related commands

client-mac

wlan vip-client-group

display wlan virtual-ap-group all client-number

Use display wlan virtual-ap-group all client-number to display the number of online clients in each virtual AP group.

Syntax

display wlan virtual-ap-group all client-number

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the number of online clients in each virtual AP group.

<Sysname> display wlan virtual-ap-group all client-number

AP group name Group ID Clients 2.4GHz 5GHz

default-virtualapgroup 1 150 100 50

1 2 250 50 200

Table 21 Command output

Field	Description
AP group name	Virtual AP group name.
Group ID	Virtual AP group ID, the unique identifier of a virtual AP group on an AC.
Clients	Total number of online clients in the group.
2.4GHz	Number of online 2.4 GHz clients in the group.
5GHz	Number of online 5 GHz clients in the group.

‌

display wlan whitelist

Use display wlan whitelist to display whitelist entries.

Syntax

display wlan whitelist

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display whitelist entries.

<Sysname> display wlan whitelist

Total number of clients: 3

MAC addresses:

000e-35b2-000e

0019-5b8e-b709

001c-f0bf-9c92

mac assign vlan

Use mac assign vlan to configure specific VLAN assignment rules.

Use undo mac assign vlan to restore the default.

Syntax

mac mac-address [ mask { mac-mask | mask-length } ] assign vlan vlan-id description text

undo mac { mac-address [ mask { mac-mask | mask-length } | all }

Default

No specific VLAN assignment rule is configured.

Views

VLAN assignment policy view

Predefined user roles

network-admin

Parameters

mac-address: Specifies a MAC address in H-H-H format. Multicast and all-0 MAC addresses are not supported. You can omit the starting 0s in each address segment. For example, you can enter f-e2-1 to specify MAC 000f-00e2-0001.

mac-mask: Specifies a MAC address mask. In binary mode, the most significant part must be consecutive 1s. In hexadecimal mode, the most significant part must be consecutive fs. The default hexadecimal value contains only fs.

mask-length: Specifies a mask length in the range of 1 to 48.

vlan vlan-id: Specifies a VLAN tag ID, ranging from 1 to 4094.

description text: Specifies a description for the MAC address or MAC address range, a case-sensitive string of 1 to 128 characters.

all: Deletes all rules in the wireless VLAN assignment policy.

Usage guidelines

You can specify a maximum of 512 wireless VLAN assignment rules.

When the APs act as the client associator, make sure the APs to be configured with this feature are of version 2476, 2605, or higher.

Examples

# Configure a wireless VLAN assignment rule to assign the client with MAC address 0000-0000-0001, mask ffff-ffff-ffff, and description VIP to VLAN 1.

<Sysname> system-view

[Sysname] wlan assign-vlan policy

[Sysname-wlan-assign-vlan-policy] mac 0000-0000-0001 mask ffff-ffff-ffff assign vlan 1 description vip

nas-id

Use nas-id to set the network access server identifier (NAS ID).

Syntax

nas-id nas-id

undo nas-id

Default

In AP view, an AP uses the configuration in AP group view. If no configuration exists in AP group view, the AP uses the configuration in global configuration view.

In AP group view, an AP uses the configuration in global configuration view.

In virtual AP view, an AP uses the configuration in virtual AP group view. If no configuration exists in virtual AP group view, the AP uses the configuration in global configuration view.

In virtual AP group view, an AP uses the configuration in global configuration view.

In global configuration view, no NAS ID is specified.

Views

AP view

AP group view

Virtual AP view

Virtual AP group view

Global configuration view

Predefined user roles

network-admin

Parameters

nas-id: Specifies a NAS ID, a case-sensitive string of 1 to 63 characters.

Usage guidelines

After coming online, a client sends a RADIUS request that carries the NAS ID to the RADIUS server to indicate its network access server.

The priorities for the configuration in AP view, AP group view, and global configuration view are in descending order. You can also set the NAS ID when binding a service template to a radio. If you have specified a NAS ID when binding a service template to a radio, the AP uses the NAS ID specified for the service template.

The priorities for the configuration in virtual AP view, virtual AP group view, and global configuration view are in descending order. You can also set the NAS ID when binding a service template to a radio. If you have specified a NAS ID when binding a service template to a radio, the virtual AP uses the NAS ID specified for the service template.

You can specify a NAS-IN by using the following methods:

· Specify a NAS-ID when you bind a service template.

· Specify a NAS-ID in AP view.

· Specify a NAS-ID in AP group view.

· Specify a NAS-ID in global configuration view.

· Specify a NAS-ID in the NAS-ID profile bound to the user access VLAN.

· Specify a NAS-ID in ISP domain view.

The priorities of the NAS-IDs mentioned above are in descending order.

If no NAS-ID configuration exists, the device uses the device name configured by using the sysname command as the NAS-ID.

Examples

# Set the NAS ID to abc123 for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA6320

[Sysname-wlan-ap-ap1] nas-id abc123

# Set the NAS ID to abc123 for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] nas-id abc123

# Set the NAS ID to abc123 for virtual AP ap1.

<Sysname> system-view

[Sysname] wlan virtual-ap ap1 model WA6320

[Sysname-wlan-virtual-ap-ap1] nas-id abc123

# Set the NAS ID to abc123 for virtual AP group group1.

<Sysname> system-view

[Sysname] wlan virtual-ap-group group1

[Sysname-wlan-virtual-ap-group-group1] nas-id abc123

# Set the global NAS ID to abc123.

<Sysname> system-view

[Sysname] wlan global-configuration

[Sysname-wlan-global-configuration] nas-id abc123

nas-port-id

Use nas-port-id to set the network access server port identifier (NAS port ID).

Use the undo nas-port-id to restore the default.

Syntax

nas-port-id nas-port-id

undo nas-port-id

Default

In AP view, an AP uses the configuration in AP group view. If no NAS ID is specified in AP group view, the AP uses the configuration in global configuration view.

In AP group view, an AP uses the configuration in global configuration view.

In virtual AP view, an AP uses the configuration in virtual AP group view. If no NAS ID is specified in virtual AP group view, the virtual AP uses the configuration in global configuration view.

In virtual AP group view, a virtual AP uses the configuration in global configuration view.

In global configuration view, no NAS port ID is specified.

Views

AP view

AP group view

Virtual AP view

Virtual AP group view

Global configuration view

Predefined user roles

network-admin

Parameters

nas-port-id: Specifies a NAS port ID, a case-sensitive string of 1 to 63 characters.

Usage guidelines

After coming online, a client sends a RADIUS request that carries the NAS port ID to the RADIUS server to indicate its network access server.

The priorities for the configuration in AP view, AP group view, and global configuration view are in descending order. You can also set the NAS port ID when binding a service template to a radio. If you have specified a NAS port ID when binding a service template to a radio, the AP uses the NAS port ID specified for the service template.

The priorities for the configuration in virtual AP view, virtual AP group view, and global configuration view are in descending order.

Examples

# Set the NAS port ID to abcd1234 for AP ap1.

<Sysname> system-view

[Sysname] wlan ap ap1 model WA4320i-AGN

[Sysname-wlan-ap-ap1] nas-port-id abcd1234

# Set the NAS port ID to abcd1234 for AP group group1.

<Sysname> system-view

[Sysname] wlan ap-group group1

[Sysname-wlan-ap-group-group1] nas-port-id abcd1234

# Set the NAS port ID to abcd1234 for virtual AP ap1.

<Sysname> system-view

[Sysname] wlan virtual-ap ap1 model WA6320

[Sysname-wlan-virtual-ap-ap1] nas-port-id abc123

# Set the NAS port ID to abcd1234 for virtual AP group group1.

<Sysname> system-view

[Sysname] wlan virtual-ap-group group1

[Sysname-wlan-virtual-ap-group-group1] nas-port-id abc123

# Set the global NAS port ID to abcd1234.

<Sysname> system-view

[Sysname] wlan global-configuration

[Sysname-wlan-global-configuration] nas-port-id abcd1234

nas-port-type

Use nas-port-type to set the NAS port type attribute in RADIUS requests.

Use the undo nas-port-type to restore the default.

Syntax

nas-port-type value

undo nas-port-type

Default

The NAS port type is Wireless-IEEE 802.11.

Views

Service template view

Predefined user roles

network-admin

Parameters

value: Specifies a NAS port type by its code value in the range of 0 to 255. Table 22 lists the most commonly used NAS port types and their code values.

Table 22 Common NAS port types and their code values

NAS port type	Code value
Async	0
Sync	1
ISDN Sync	2
ISDN Async V.120	3
ISDN Async V.110	4
Virtual	5
PIAFS	6
HDLC Clear Channel	7
X.25	8
X.75	9
G.3 Fax	10
SDSL	11
ADSL-CAP	12
ADSL-DMT	13
IDSL	14
Ethernet	15
xDSL	16
Cable	17
Wireless-Other	18
Wireless-IEEE 802.11	19

‌

Usage guidelines

You can execute this command to set the NAS port type attribute in RADIUS requests for 802.11X and MAC-authenticated clients.

Make sure the service template is disabled before you execute this command.

Examples

# Set the NAS port type in RADIUS requests to 15 (Ethernet).

<Sysname> system-view

[Sysname] wlan service-template 1

[Sysname-wlan-st-1] nas-port-type 15

non-vip limit rate

Use non-vip limit rate to configure non-VIP client rate limit.

Use undo non-vip limit rate to remove the configuration.

Syntax

non-vip limit rate { inbound | outbound } [ mode { dynamic [ min min-cir ] [ max max-cir ] | static } ] cir cir

undo non-vip limit rate { inbound | outbound } cir

Default

Non-VIP client rate limit is not configured.

Views

VIP client group view

Predefined user roles

network-admin

Parameters

inbound: Limits the rate of incoming traffic.

outbound: Limits the rate of outgoing traffic.

dynamic: Specifies the dynamic rate limit mode. In this mode, the limited rate for each client is the total CIR divided by the number of clients.

min min-cir: Specifies the minimum CIR for a client, in the range of 16 to 1700000 kbps.

max max-cir: Specifies the maximum CIR for a client, in the range of 16 to 1700000 kbps. The maximum CIR must be larger than the minimum CIR.

static: Specifies the static rate limit mode. In this mode, the limited rate for each client is a fixed value.

cir cir: Specifies the CIR in Kbps. The value range for the cir argument is 16 to 1700000.

Usage guidelines

With non-VIP client rate limit configured, all non-VIP clients associated with a radio are rate limited when the radio has associated VIP clients. When all VIP clients associated with the radio go offline or if the radio does not have associated VIP clients, non-VIP clients are not rate limited.

If dynamic rate limit is configured, the limited rate for a client is the total limited rate divided by the number of clients. If the value is smaller than the minimum CIR, the minimum CIR takes effect. If the value is larger than the maximum CIR, the maximum CIR takes effect.

If both radio-based client rate limit and non-VIP client rate limit are configured, VIP clients are not rate limited and rate limit takes effect for non-VIP clients as follows:

· If the configured rate limit modes are different, the non-VIP rate limit configuration takes effect.

· If the configured rate limit modes are the same:

¡ In static mode, the rate of the non-VIP clients takes the smaller value.

¡ In dynamic mode, the non-VIP rate limit configuration takes effect.

You can rate limit both inbound and outbound traffic.

Examples

# Configure non-VIP client rate limit in VIP client group view: enable static rate limit and set the CIR to 500 Kbps for incoming traffic, and enable dynamic rate limit and set the CIR to 100 Kbps for outgoing traffic.

<Sysname> system-view

[Sysname] wlan vip-client-group

[Sysname-wlan vip-client-group] non-vip limit rate inbound mode static cir 500

[Sysname-wlan vip-client-group] non-vip limit rate outbound mode dynamic cir 100

Related commands

client-rate-limit (QoS Command Reference)

report-interval

Use report-interval to set the interval at which an AP reports VIP client statistics to the AC.

Use undo report-interval to restore the default.

Syntax

report-interval interval

undo report-interval

Default

An AP reports VIP client statistics to the AC at intervals of 20 seconds.

Views

VIP client group view

Predefined user roles

network-admin

Parameters

interval: Specifies the interval at which an AP reports VIP client statistics to the AC, in the range of 10 to 120 seconds.

Usage guidelines

This command takes effect only on level 1 VIP clients.

The AC sends VIP client statistics to the cloud platform every five minutes.

Examples

# Set the interval at which an AP reports VIP client statistics to the AC to 36 seconds.

<Sysname> system-view

[Sysname] wlan vip-client-group

[Sysname-wlan vip-client-group] report-interval 36

reset wlan client

Use reset wlan client to log off a client or all clients.

Syntax

reset wlan client { all | mac-address mac-address }

View

User view

Predefined user roles

network-admin

Parameters

all: Specifies all clients.

mac-address mac-address: Specifies a client by its MAC address.

Examples

# Log off all clients.

<Sysname> reset wlan client all

Related commands

display wlan client

reset wlan dynamic-blacklist

Use reset wlan dynamic-blacklist to remove the specified client or all clients from the dynamic blacklist.

Syntax

reset wlan dynamic-blacklist [ mac-address mac-address ]

Views

User view

Predefined user roles

network-admin

Parameters

mac-address mac-address: Specifies a client by its MAC address. If you do not specify this option, the command removes all clients from the dynamic blacklist.

Examples

# Remove all clients from the dynamic blacklist.

<Sysname> reset wlan dynamic-blacklist

# Remove the specified client from the dynamic blacklist.

<Sysname> reset wlan dynamic-blacklist mac-address b8ca-32a2-df69

Related commands

display wlan blacklist

reset wlan statistics client

Use reset wlan statistics client to clear client statistics.

Syntax

reset wlan statistics client { all | mac-address mac-address }

View

User view

Predefined user roles

network-admin

Parameters

all: Specifies all clients.

mac-address mac-address: Specifies a client by its MAC address.

Examples

# Clear statistics about all clients.

<Sysname> reset wlan statistics client all

Related commands

display wlan statistics

reset wlan statistics service-template

Use reset wlan statistics service-template to clear service template statistics.

Syntax

reset wlan statistics service-template service-template-name

View

User view

Predefined user roles

network-admin

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters.

Examples

# Clear statistics about service template service1.

<Sysname> reset wlan statistics service-template service1

Related commands

display wlan statistics

service-template

Use service-template to bind a service template to a radio.

Use undo service-template to unbind a service template from a radio.

Syntax

service-template service-template-name [ vlan vlan-id | vlan-group vlan-group-name ] [ ssid-hide ] [ nas-port-id nas-port-id ] [ nas-id nas-id ]

undo service-template service-template-name

Default

In radio view, an AP inherits the radio configuration from the AP group or the global AP group configuration.

In an AP group's radio view, no service template is bound to a radio.

In a global AP group’s radio view, no service template is bound to a radio.

In a virtual AP's radio view, a virtual AP uses the configuration in a virtual AP group's radio view.

In a virtual AP group's radio view, no service template is bound to a radio.

Views

Radio view

AP group's radio view

AP group’s global radio view

Virtual AP's radio view

Virtual AP group's radio view

Predefined user roles

network-admin

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters.

vlan vlan-id: Specifies a VLAN ID in the range of 1 to 4094.

vlan-group vlan-group-name: Specifies a VLAN group name, a case-insensitive string of 1 to 31 characters. If you do not specify this option, the radio uses the VLAN configured for the service template. For more information about configuring VLAN groups, see VLAN commands in Network Connectivity Command Reference.

ssid-hide: Hides SSIDs in beacon frames.

nas-port-id nas-port-id: Specifies a NAS port ID, a case-insensitive string of 1 to 63 characters that do not contain spaces.

nas-id nas-id: Specifies a NAS ID, a case-insensitive string of 1 to 63 characters that do not contain spaces.

Usage guidelines

Before you bind a service template to a radio or a radio interface, you must create the service template.

If you specify a non-existent VLAN, the AC creates the VLAN when a client comes online.

The VLAN ID configured using this command takes precedence over the VLAN ID configured for a service template.

A 6GHz radio can only be bound to a service template with the following features enabled:

· WPA3-SAE mandatory mode enabled by using the wpa3 personal mandatory command.

· PWE derived through the H2E method specified by using the akm sae pwe h2e command.

The configuration in radio view takes precedence over the configuration in an AP group's radio view or an AP group’s global radio view.

You cannot bind a service template to an AP group's radio view or the global radio view of the same AP group. The configuration in an AP group’s radio view and the configuration in the global radio view of the same AP group have the same priority.

The configuration in a virtual AP's radio view takes precedence over the configuration in a virtual AP group's radio view.

Examples

# Bind service template service1 to radio 1 and specify VLAN 2 for the radio.

<Sysname> system-view

[Sysname] wlan ap ap1

[Sysname-ap-ap1] radio 1

[Sysname-ap-ap1-radio-1] service-template service1 vlan 2

# Bind service template service1 to radio 1 and specify VLAN 2 for the radios in AP group apgroup1.

<Sysname> system-view

[Sysname] wlan ap-group apgroup1

[Sysname-wlan-ap-group-apgroup1] ap-model WA6320

[Sysname-wlan-ap-group-apgroup1-ap-model-WA6320] radio 1

[Sysname-wlan-ap-group-apgroup1-ap-model-WA6320-radio-1] service-template service1 vlan 2

# Bind service template service1 to radio 1 and specify VLAN group vg1 for the 5 GHz radios in AP group apgroup1.

<Sysname> system-view

[Sysname] wlan ap-group apgroup1

[Sysname-wlan-ap-group-apgroup1] radio 5g

[Sysname-wlan-ap-group-apgroup1-radio-5g] service-template service1 vlan-group vg1

# Bind service template service1 to radio 1 and specify VLAN 2 for the radio.

<Sysname> system-view

[Sysname] wlan virtual-ap ap1

[Sysname-virtual-ap-ap1] radio 1

[Sysname-virtual-ap-ap1-radio-1] service-template service1 vlan 2

# Bind service template service1 to radio 1 and specify VLAN 2 for the radios in virtual AP group apgroup1.

<Sysname> system-view

[Sysname] wlan virtual-ap-group apgroup1

[Sysname-wlan-virtual-ap-group-apgroup1] ap-model WA6320

[Sysname-wlan-virtual-ap-group-apgroup1-ap-model-WA6320] radio 1

[Sysname-wlan-virtual-ap-group-apgroup1-ap-model-WA6320-radio-1] service-template service1 vlan 2

service-template enable

Use service-template enable to enable a service template.

Use undo service-template enable to disable a service template.

Syntax

service-template enable

undo service-template enable

Default

A service template is disabled.

Views

Service template view

Predefined user roles

network-admin

Usage guidelines

If the number of BSSs on a device exceeds the limit, you cannot enable a new service template.

Examples

# Enable service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] service-template enable

snmp-agent trap enable wlan client

Use snmp-agent trap enable wlan client to enable SNMP notification for client access.

Use undo snmp-agent trap enable wlan client to disable SNMP notification for client access.

Syntax

snmp-agent trap enable wlan client

undo snmp-agent trap enable wlan client

Default

SNMP notification is disabled for client access.

Views

System view

Predefined user roles

network-admin

Usage guidelines

When this feature is enabled, the device sends a client status change notification to an NMS every time the status of a client changes. For the notifications to be sent correctly, you must also configure SNMP as described in Network Management and Monitoring Configuration Guide.

Examples

# Enable SNMP notification for client access.

<Sysname> system-view

[Sysname] snmp-agent trap enable wlan client

ssid

Use ssid to set an SSID for a service template.

Use undo ssid to restore the default.

Syntax

ssid ssid-name

undo ssid

Default

No SSID is configured for a service template.

Views

Service template view

Predefined user roles

network-admin

Parameters

ssid-name: Specifies an SSID name, a case-sensitive string of 1 to 32 characters.

Usage guidelines

Disable the service template before you execute this command.

Examples

# Set the SSID to lynn for service template service1.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] ssid lynn

unknown-client

Use unknown-client to set the way that an AP processes traffic from unknown clients.

Use undo unknown-client to restore the default.

Syntax

unknown-client { deauthenticate | drop }

undo unknown-client

Default

An AP drops packets from unknown clients and deauthenticates these clients.

Views

Service template view

Predefined user roles

network-admin

Parameters

deauthenticate: Drops packets from unknown clients and deauthenticates these clients.

drop: Drops packets from unknown clients.

Examples

# Configure APs that use service template example to drop packets from unknown clients but not deauthenticate these clients.

<Sysname> system-view

[Sysname] wlan service-template example

[Sysname-wlan-st-example] unknown-client drop

vip limit rate

Use vip limit rate to enable VIP client rate limit.

Use undo vip limit rate to disable VIP client rate limit.

Syntax

vip limit rate level level { inbound | outbound } mode { dynamic [ min min-cir ] [ max max-cir ] | static } cir cir

undo vip limit rate level level { inbound | outbound }

Default

VIP client rate limit is disabled.

Views

VIP client group view

Predefined user roles

network-admin

Parameters

level level: Specifies the VIP client level. Only 2 is available.

inbound: Limits the rate of incoming traffic.

outbound: Limits the rate of outgoing traffic.

dynamic: Specifies the dynamic rate limit mode. In this mode, the limited rate for each client is the total CIR divided by the number of clients.

min min-cir: Specifies the minimum CIR for each client, in the range of 16 to 1700000 Kbps. If you do not specify this option, the command does not limit the minimum total CIR.

max max-cir: Specifies the maximum CIR for each client, in the range of 16 to 1700000 Kbps. The maximum CIR must be larger than the minimum CIR. If you do not specify this option, the command does not limit the maximum total CIR.

static: Specifies the static rate limit mode. In this mode, the limited rate for each client is a fixed value.

cir cir: Specifies the CIR in Kbps. The value range for the cir argument is 16 to 1700000 Kbps.

Usage guidelines

If a large number of VIP clients are online, you can perform this task to rate limit VIP clients to guarantee bandwidth for each client and ensure good user experience.

If you specify both the minimum and maximum CIRs for dynamic rate limit, the feature operates as follows:

· If the specified CIR divided by the total number of clients is smaller than the minimum CIR, the minimum CIR takes effect for each client.

· If the specified CIR divided by the total number of clients is larger than the maximum CIR, the maximum CIR takes effect for each client.

· If the specified CIR divided by the total number of clients is between the minimum and maximum CIRs, the specified CIR divided by the total number of clients takes effect for each client.

You can execute this command multiple times to limit the rates of both the incoming and outgoing traffic.

If you configure both VIP client rate limit and radio-based client rate limit, the configuration that takes effect depends on the rate limit modes (static or dynamic):

· If different rate limit modes are configured, VIP client rate limit takes effect.

· If the static mode is configured, the smaller CIR takes effect.

· If the dynamic mode is configured, VIP client rate limit takes effect.

Examples

# Configure static VIP client rate limit: set the CIR to 500 Kbps for incoming traffic and set the CIR to 100 Kbps for outgoing traffic.

<Sysname> system-view

[Sysname] wlan vip-client-group

[Sysname-vip-client-group] vip limit rate level 2 inbound mode static cir 500

[Sysname-vip-client-group] vip limit rate level 2 outbound mode static cir 100

Related commands

client-rate-limit (QoS Command Reference)

vlan

Use vlan to assign clients coming online through a service template to the specified VLAN.

Use undo vlan to restore the default.

Syntax

vlan vlan-id

undo vlan [ vlan-id ]

Default

Clients are assigned to VLAN 1 after coming online through a service template.

Views

Service template view

Predefined user roles

network-admin

Parameters

vlan-id: Specifies a VLAN by its VLAN ID, in the range of 1 to 4094. If the specified VLAN does not exist, this command creates the VLAN when clients come online.

Usage guidelines

Disable the service template before you execute this command.

If the specified VLAN does not exist, this command creates the VLAN when clients come online.

Examples

# Assign clients coming online through service template service1 to VLAN 2.

<Sysname> system-view

[Sysname] wlan service-template service1

[Sysname-wlan-st-service1] vlan 2

wlan accounting-policy

Use wlan accounting-policy to create an accounting policy and enter its view or enter the view of an existing accounting policy.

Use undo wlan accounting-policy to delete an accounting policy.

Syntax

wlan accounting-policy policy-name

undo wlan accounting-policy policy-name

Default

No accounting policies exist.

Views

System view

Predefined user roles

network-admin

Parameters

policy-name: Specifies the policy name, a case-insensitive string of 1 to 31 characters. The string can contain letters, digits, underscores (_), left brackets ([), right brackets (]), and hyphens (-).

Usage guidelines

For the accounting server to perform differentiated accounting on different client traffic, specify multiple traffic levels for an accounting policy.

The number of accounting policies that can be created varies by device model.

Examples

# Create accounting policy abc and enter its view.

<Sysname> system-view

[Sysname] wlan accounting-policy abc

[Sysname-wlan-acctpolicy-abc]

Related commands

accounting-level

wlan apply accounting-policy

wlan ap-forwarding auto-configuration enable

Use wlan ap-forwarding auto-configuration enable to enable automatic configuration for local forwarding.

Use undo wlan ap-forwarding auto-configuration enable to disable automatic configuration for local forwarding.

Syntax

wlan ap-forwarding auto-configuration enable

undo wlan ap-forwarding auto-configuration enable

Default

Automatic configuration is enabled for local forwarding.

Views

System view

Predefined user roles

network-admin

Usage guidelines

With this feature enabled, the AC will deploy settings for local forwarding of client data frames to the uplink interface on the onboarding AP, including the port link-type trunk and port trunk permit vlan all commands. Editing and deploying these two commands to an AP by enabling remote configuration synchronization or by deploying a configuration file might affect this feature. Please be cautious.

For the configuration to take effect, you must restart the AP.

Examples

# Enable automatic configuration for local forwarding.

<Sysname> system-view

[Sysname] wlan ap-forwarding auto-configuration enable

For the configuration to take effect, you must reset APs.

Related commands

map-configuration (AP Management Command Reference)

remote-configuration (AP Management Command Reference)

wlan apply accounting-policy

Use wlan apply accounting-policy to apply an accounting policy to a user profile.

Use undo wlan apply accounting-policy to restore the default.

Syntax

wlan apply accounting-policy policy-name

undo wlan apply accounting-policy

Default

No accounting policy is applied to a user profile.

Views

User profile view

Predefined user roles

network-admin

Parameters

policy-name: Specifies the policy name, a case-insensitive string of 1 to 31 characters. The string can contain letters, digits, underscores (_), dots (.), left brackets ([), right brackets (]), and hyphens (-).

Usage guidelines

This feature enables APs to perform client traffic accounting based on the accounting policy applied to the user profile. Upon client association, the authentication server deploys the user profile bound to the client account to the client authenticator (AC or AP). If the AC is the authenticator, it deploys the user profile to the AP.

If no accounting policy is applied to a user profile, the system performs AAA accounting.

Accounting policy deployment, editing, or deletion for a user profile does not affect online clients.

Examples

# Apply accounting policy abc to user profile 123.

<Sysname> system-view

[Sysname] user-profile 123

[Sysname-user-profile-123] wlan apply accounting-policy abc

Related commands

wlan accounting-policy

wlan assign-vlan policy

Use wlan assign-vlan policy to enter wireless VLAN assignment policy view.

Syntax

wlan assign-vlan policy

Views

System view

Predefined user roles

network-admin

Usage guidelines

Only one VLAN assignment policy exists on the device.

Examples

# Enter wireless VLAN assignment policy view.

<Sysname> system-view

[Sysname] wlan assign-vlan policy

[Sysname-wlan-assign-vlan-policy]

wlan client bss-load-ie enable

Use wlan client bss-load-ie enable to enable beacon frames and probe responses to carry BSS Load IEs.

Use undo wlan client bss-load-ie enable to disable beacon frames and probe responses from carrying BSS Load IEs.

Syntax

wlan client bss-load-ie enable [ update-interval interval ]

undo wlan client bss-load-ie enable

Default

Beacon frames and probe responses do not carry BSS Load IEs.

Views

System view

Predefined user roles

network-admin

Parameters

update-interval interval: Specifies the BSS Load IE update interval, in the range of 5 to 30 seconds. By default, the interval is 15 seconds.

Usage guidelines

This feature enables beacon frames and probe responses to carry BSS Load IEs. A BSS Load IE contains information such as associated client quantity, channel usage, and remaining available media time.

As a best practice, enable this feature in Hotspot 2.0 networks or networks where client roaming is required. This helps clients identify the optimal WLAN.

Examples

# Enable beacon frames and probe responses to carry BSS Load IEs.

<Sysname> system-view

[Sysname] wlan client bss-load-ie enable

wlan client forwarding-policy-name

Use wlan client forwarding-policy-name to apply a forwarding policy to a user profile.

Use undo wlan client forwarding-policy-name to restore the default.

Syntax

wlan client forwarding-policy-name policy-name

undo wlan client forwarding-policy-name

Default

No forwarding policy is applied to a user profile.

Views

User profile view

Predefined user roles

network-admin

Parameters

policy-name: Specifies a forwarding policy name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

For the AC to perform policy-based forwarding for clients that use a user profile, apply a forwarding policy to the user profile. After a client passes authentication, the authentication server sends the user profile name specified for the client to the AC. The AC will forward traffic of the client based on the forwarding policy applied to the user profile.

For the forwarding policy applied to a user profile to take effect, perform the following tasks for the service template that the user profile uses:

· Enable policy-based forwarding.

· Specify the AC to perform client authentication.

If you modify or delete the applied forwarding policy, the change takes effect when the client comes online again.

The AC preferentially uses the forwarding policy applied to a user profile to direct client traffic forwarding. If the user profile of a client does not have a forwarding policy applied, the AC uses the forwarding policy applied to the service template.

Make sure the AC and its associated APs are in different network segments.

Examples

# Apply forwarding policy policyname to user profile profilename.

<Sysname> system-view

[Sysname] user-profile profilename

[Sysname-user-profile-profilename] wlan client forward-policy-name policyname

Related commands

client forwarding-policy enable

client-security authentication-location

wlan client reauthentication-period

Use wlan client reauthentication-period to set the idle period before client reauthentication.

Use undo wlan client reauthentication-period to restore the default.

Syntax

wlan client reauthentication-period [ period-value ]

undo wlan client reauthentication-period

Default

The idle period is 10 seconds.

Views

System view

Predefined user roles

network-admin

Parameters

period-value: Specifies the idle period in the range of 1 to 3600 seconds.

Usage guidelines

When URL redirection for WLAN MAC authentication is enabled, an AP redirects clients whose information is not recorded on the RADIUS server to the specified URL for Web authentication. Clients passing Web authentication are logged off and must perform MAC reauthentication to come online. However, MAC reauthentication fails if the IP addresses assigned to the clients have not expired.

Perform this task to add these clients to the dynamic blacklist for the specified idle period after they pass Web authentication to reduce reauthentication failures.

Examples

# Set the idle period before client reauthentication to 100 seconds.

<Sysname> system-view

[Sysname] wlan client reauthentication-period 100

wlan cpe maintain enable

Use wlan cpe maintain enable to enable CPE maintenance.

Use undo wlan cpe maintain enable to restore the default.

Syntax

wlan cpe maintain enable

undo wlan cpe maintain enable

Default

The CPE maintenance feature is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

With this feature enabled, the AC can manage CPE devices that connect to a fit AP through a wireless connection. This enables users to view to information about the CPE devices and clients through the AC.

Examples

# Enable CPE maintenance.

<Sysname> system-view

[Sysname] wlan cpe maintain enable

wlan 6g-discovery enable

NOTE:

Support for this command depends on the AP model.

Use wlan out-band 6g-discovery enable to set the 6 GHz service discovery feature.

Use undo wlan out-band 6g-discovery enable to restore the default.

Syntax

wlan out-band 6g-discovery enable

undo wlan out-band 6g-discovery enable

Default

The 6 GHz service discovery feature is disabled.

Views

Global configuration view

Predefined user roles

network-admin

Parameters

out-band: Specifies out-of-band discovery for 6 GHz band to discover 6 GHz wireless services from packets sent by 2.4 GHz and 5 GHz radios.

Usage guidelines

This configuration takes effect only on 802.11be and 802.11eax devices.

With this feature enabled, clients that support the 6 GHz band can discover available 6 GHz wireless services through APs' 6 GHz radios. Clients can discover 6 GHz wireless services by using either of the following methods:

· Out-of-band discovery—Clients read the messages sent by an AP' 2.4 GHz or 5 GHz radio to obtain information about 6 GHz wireless services. To use this method, make sure the 2.4 GHz or 5 GHz radio on the AP is enabled.

· In-band discovery—Clients read the messages sent by an AP' 6 GHz radio to obtain information about 6 GHz wireless services. To use this method, make sure the 2.4 GHz and 5 GHz radios on the AP are disabled and only the 6 GHz radio is enabled.

Only the out-of-band discovery method is supported.

Examples

# Enable out-of-band 6 GHz wireless service discovery.

<System> system-view

[Sysname] wlan global-configuraiton

[Sysname-wlan-global-configuraiton] wlan out-band 6g-discovery enable

wlan dynamic-blacklist active-on-ap

Use wlan dynamic-blacklist active-on-ap to configure the dynamic blacklist to take effect on APs.

Use undo wlan dynamic-blacklist active-on-ap to configure the dynamic blacklist to take effect on the AC.

Syntax

wlan dynamic-blacklist active-on-ap

undo wlan dynamic-blacklist active-on-ap

Default

The dynamic blacklist takes effect on APs.

Views

System view

Predefined user roles

network-admin

Usage guidelines

If you configure the dynamic blacklist to take effect on the AC, all APs connected to the AC will reject the client in the dynamic blacklist. If you configure the dynamic blacklist to take effect on APs, the AP associated with the client in the dynamic blacklist will reject the client, but the client can still associate with other APs connected to the AC. As a best practice, configure the dynamic blacklist to take effect on the AC in high-density environments.

Examples

# Configure the dynamic blacklist to take effect on the AC.

<Sysname> system-view

[Sysname] undo wlan dynamic-blacklist active-on-ap

wlan dynamic-blacklist lifetime

Use wlan dynamic-blacklist lifetime to set the aging time for dynamic blacklist entries.

Use undo wlan dynamic-blacklist lifetime to restore the default.

Syntax

wlan dynamic-blacklist lifetime lifetime

undo wlan dynamic-blacklist lifetime

Default

The aging time is 300 seconds for dynamic blacklist entries.

Views

System view

Predefined user roles

network-admin

Parameters

lifetime: Specifies the aging time in the range of 1 to 3600 seconds.

Usage guidelines

The configured aging time takes effect only on entries added to the dynamic blacklist after this command is executed.

Examples

# Set the aging time for dynamic blacklist entries to 3600 seconds.

<Sysname> system-view

[Sysname] wlan dynamic-blacklist lifetime 3600

wlan forwarding-policy

Use wlan forwarding-policy to create a forwarding policy and enter its view, or enter the view of an existing forwarding policy.

Use undo wlan forwarding-policy to delete a forwarding policy.

Syntax

wlan forwarding-policy policy-name

undo wlan forwarding-policy policy-name

Default

No forwarding policies are created.

Views

System view

Predefined user roles

network-admin

Parameters

policy-name: Specifies a forwarding policy name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

Actions defined in ACL rules do not take effect in wireless packet forwarding. All matched packets are forwarded based on the forwarding mode.

You can create a maximum of 1000 forwarding policies.

Examples

# Create forwarding policy abc and enter its view.

<Sysname> system-view

[Sysname] wlan forwarding-policy abc

[Sysname-wlan-fp-abc]

wlan link-test

Use wlan link-test to test wireless link quality.

Syntax

wlan link-test mac-address

Views

Any view

Predefined user roles

network-admin

Parameters

mac-address: Specifies the client MAC address in the H-H-H format.

Usage guidelines

Wireless link quality detection enables an AP to test the quality of the link to a wireless client. The AP sends empty data frames to the client at each supported rate. Then it calculates link quality information such as RSSI, packet retransmissions, and RTT based on the responses from the client.

The timeout timer for wireless link quality detection is 10 seconds. If wireless link detection is not completed within the timeout timer, test results cannot be obtained.

Examples

# Test the quality of the wireless link to the client with MAC address 60a4-4cda-eff0.

<Sysname> wlan link-test 60a4-4cda-eff0

Testing link to 60a4-4cda-eff0. Press CTRL + C to break.

Link Status

-----------------------------------------------------------------------

MAC address: 60a4-4cda-eff0

-----------------------------------------------------------------------

HE-MCS Rate(Mbps) Tx packets Rx packets RSSI Retries RTT(ms)

-----------------------------------------------------------------------

NSS = 1

-----------------------------------------------------------------------

0 36 5 5 85 2 1

1 72.1 5 5 86 3 1

2 108.1 5 5 86 3 1

3 144.1 5 5 82 6 2

4 216.2 5 5 81 10 27

5 288.2 5 5 82 10 4

6 324.3 5 5 86 4 18

7 360.3 5 5 83 5 3

8 432.4 5 5 83 10 2

9 480.4 5 5 83 2 2

10 540.4 5 5 84 5 2

11 600.5 5 5 83 4 23

-----------------------------------------------------------------------

NSS = 2

-----------------------------------------------------------------------

0 72.1 5 5 81 1 1

1 144.1 5 5 82 4 1

2 216.2 5 5 83 3 11

3 288.2 5 5 84 7 24

4 432.4 5 5 81 1 3

5 576.5 5 5 83 4 1

6 648.5 5 5 81 4 1

7 720.6 5 5 81 8 12

8 864.7 5 5 83 16 7

9 960.8 5 5 81 10 1

10 1080.9 5 5 84 4 63

11 1201 5 5 82 0 49

Table 23 Command output

Field	Description
No./MCS/VHT-MCS/HE-MCS	· No.—Rate number for link quality test on 802.11a, 802.11b, or 802.11g clients. · MCS—MCS index for link quality test on 802.11n clients. · VHT-MCS—VHT-MCS index for link quality test on 802.11ac clients. · HE-MCS—HE-MCS index for link quality test on 802.11ax clients
Rate(Mbps)	Rate at which the AP sends wireless link quality detection frames.
Tx packets	Number of wireless link quality detection frames sent by the AP.
Rx packets	Number of responses received by the AP.
RSSI	RSSI of the client detected by the AP.
Retries	Number of wireless link quality retransmission frames sent by the AP.
RTT(ms)	Round trip time for link quality test frames from the AP to the client.
NSS	Number of spatial streams for link quality test on 802.11n, 802.11ac, or 802.11ax clients.

‌

wlan lite-control-mode enable

Use wlan lite-control-mode enable to enable the lite control mode.

Use undo wlan lite-control-mode enable to disable the lite control mode

Syntax

wlan lite-control-mode enable

undo wlan lite-control-mode enable

The following compatibility matrixes show the support of hardware platforms for this command:

Hardware series	Product model	Product code	Command compatibility
WX3500X series	· WX3510X · WX3520X · WX3540X	· EWP-WX3510X · EWP-WX3520X · EWP-WX3540X	No
WX3500X-E series	WX3508X-E	EWP-WX3508X-E	Yes

Hardware series

Product model

Product code

Command compatibility

WX3500X series

· WX3510X

· WX3520X

· WX3540X

· EWP-WX3510X

· EWP-WX3520X

· EWP-WX3540X

WX3500X-E series

WX3508X-E

EWP-WX3508X-E

Yes

‌

Hardware series	Product model	Product code	Command compatibility
WX3800X series	· WX3820X · WX3840X	· EWP-WX3820X · EWP-WX3840X	No

Hardware series

Product model

Product code

Command compatibility

WX3800X series

· WX3820X

· WX3840X

· EWP-WX3820X

· EWP-WX3840X

‌

Default

The lite control mode is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

CAUTION:

Enabling or disabling the lite control mode clears current configurations and restarts the AC, causing AP disassociation and service interruption. Please use this feature with caution.

In lite control mode, APs forward client data traffic, and the forwarding mode configured by using the client forwarding-location command does not take effect.

For the AC to manage as many APs as possible, you can enable this mode in scenarios where centralized forwarding is not required.

Examples

# Enable the lite control mode.

<Sysname> system-view

[Sysname] wlan lite-control-mode enable

Enabling the lite control mode will clear current configuration and restart the device. Continue? [Y/N]:y

# Disable the lite control mode.

<Sysname> system-view

[Sysname] undo wlan lite-control-mode enable

Disabling the lite control mode will clear current configuration and restart the device. Continue? [Y/N]:y

Related commands

client forwarding-location

wlan nas-port-id format

Use wlan nas-port-id format to set the format of NAS port IDs for wireless clients.

Use undo wlan nas-port-id format to restore the default.

Syntax

wlan nas-port-id format { 2 | 4 }

undo wlan nas-port-id format

Default

Clients use format 2 to generate NAS port IDs.

Views

System view

Predefined user roles

network-admin

Parameters

2: Specifies the SlotID00IfNOVlanID format.

· SlotID—Slot ID for client access, a string of two characters.

· IfNO—Interface number for client access, a string of three characters.

· VlanID—VLAN ID for client access, a string of nine characters.

4: Specifies the slot=**;subslot=**;port=**;vlanid=**;vlanid2=** format. The vlanid2 field is available only for clients accessing the WLAN through an interface configured with VLAN termination.

Usage guidelines

802.1X and MAC-authenticated clients provide NAS port IDs in the specified format in RADIUS packets.

If a NAS port ID has been specified by using the nas-port-id command, clients use the specified NAS port ID.

Examples

# Set the NAS port ID format to format 4.

<Sysname> system-view

[Sysname] wlan nas-port-id format 4

wlan permit-ap-group

Use wlan permit-ap-group to specify a permitted AP group for client association.

Use undo permit-ap-group to delete a permitted AP group.

Syntax

wlan permit-ap-group ap-group-name

undo wlan permit-ap-group [ ap-group-name ]

Default

No permitted AP group is specified for client association.

Views

User profile view

Predefined user roles

network-admin

Parameters

ap-group-name: Specifies an AP group by its name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

If no permitted AP group is specified for client association, client access is not restricted.

If you specify a permitted AP group for client association, clients can only associate with APs in the AP group.

The undo form of the command deletes all permitted AP groups if you do not specify the ap-group-name argument.

Examples

# Specify AP group group1 as the permitted AP group for client association.

<Sysname> system-view

[Sysname] user-profile profile1

[Sysname-user-profile-profile1] wlan permit-ap-group group1

wlan permit-ssid

Use wlan permit-ssid to specify a permitted SSID for client association.

Use undo permit-ssid to delete a permitted SSID.

Syntax

wlan permit-ssid ssid-name

undo wlan permit-ssid [ ssid-name ]

Default

No permitted SSID is specified for client association.

Views

User profile view

Predefined user roles

network-admin

Parameters

ssid-name: Specifies an SSID by its name, a case-sensitive string of 1 to 32 characters.

Usage guidelines

If no permitted SSID is specified for client association, client association is not restricted.

If you specify a permitted SSID for client association, clients can only associate with WLANs through the SSID.

The undo form of the command deletes all permitted SSIDs if you do not specify the ssid-name argument.

Examples

# Specify SSID ssid1 as the permitted SSID for client access.

<Sysname> system-view

[Sysname] user-profile profile1

[Sysname-user-profile- profile1] wlan permit-ssid ssid1

wlan service-template

Use wlan service-template to create a service template and enter its view, or enter the view of an existing service template.

Use undo wlan service-template to delete a service template.

Syntax

wlan service-template service-template-name

undo wlan service-template service-template-name

Default

No service template exists.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

service-template-name: Specifies a service template by its name, a case-insensitive string of 1 to 63 characters.

Usage guidelines

You cannot delete a service template that has been bound to a radio.

Examples

# Create service template service1 and enter its view.

<Sysname> system-view

[Sysname] wlan service-template service1

wlan vip-client-group

Use wlan vip-client-group to create the VIP client group and enter its view or enter the view of the existing VIP client group.

Use undo wlan vip-client-group to delete the VIP client group.

Syntax

wlan vip-client-group

undo wlan vip-client-group

Default

No VIP client group exists.

Views

System view

Predefined user roles

network-admin

Usage guidelines

You can view information about online clients in the VIP client group from the cloud platform.

Examples

# Create the VIP client group.

<Sysname> system-view

[Sysname] wlan vip-client-group

[Sysname-wlan vip-client-group]

wlan static-blacklist mac-address

Use wlan static-blacklist mac-address to add a client to the static blacklist.

Use undo wlan static-blacklist mac-address to remove a client from the static blacklist.

Syntax

wlan static-blacklist mac-address mac-address

undo wlan static-blacklist [ mac-address mac-address ]

Default

No clients exist in the static blacklist.

Views

System view

Predefined user roles

network-admin

Parameters

mac-address mac-address: Specifies a client by its MAC address in the format of H-H-H.

Usage guidelines

If you add an online client to the static blacklist, the command logs off the client.

You cannot add a client to both the whitelist and the static blacklist.

The undo form of the command removes all clients from the static blacklist if you do not specify the mac-address mac-address option.

Do not add multicast or broadcast MAC addresses to the static blacklist.

Examples

# Add MAC address 001c-f0bf-9c92 to the static blacklist.

<Sysname> system-view

[Sysname] wlan static-blacklist mac-address 001c-f0bf-9c92

Related commands

display wlan blacklist

wlan whitelist mac-address

Use wlan whitelist mac-address to add a client to the whitelist.

Use undo wlan whitelist mac-address to remove a client from the whitelist.

Syntax

wlan whitelist mac-address mac-address

undo wlan whitelist [ mac-address mac-address ]

Default

No clients exist in the whitelist.

Views

System view

Predefined user roles

network-admin

Parameters

mac-address mac-address: Specifies a client by its MAC address in the format of H-H-H.

Usage guidelines

When you add the first client to the whitelist, the system asks you whether to disconnect all online clients. Enter Y at the prompt to configure the whitelist.

If you remove an online client from the whitelist, the command logs off the client. If you remove all clients from the whitelist, online clients will not be logged off.

You cannot add a client to both the whitelist and the static blacklist.

The undo form of the command removes all clients from the whitelist if you do not specify the mac-address mac-address option.

Do not add multicast or broadcast MAC addresses to the whitelist.

Examples

# Add MAC address 001c-f0bf-9c92 to the whitelist.

<Sysname> system-view

[Sysname] wlan whitelist mac-address 001c-f0bf-9c92

This command will disconnect all clients. Continue? [Y/N]:

Related commands

display wlan whitelist

06-WLAN Access Command Reference

client-mac

display wlan bss count

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us