B.2.1 - B.2.6

B.2.1 Initial provisioning

After connecting the device to mains power, it will boot with the Power LED on the front becoming steadily green. The LEDs on top flash green-yellow-blank to indicate that the device is unconfigured.

The Access Point defaults to being a DHCP server on a private subnet. For configuration access, simply connect a PC with a cross-over cable and make the PC a DHCP client. After connecting, the client will have an IP address in the 172.23.56.0/24 network. For configuration access, point your PC's browser to https://172.23.56.254

A wizard will ask you basic questions about your intended configuration which are non eduroam-specific. Please complete the wizard by answering all the questions.

Pay special attention to step 6, where you configure the IP address. Remember to check the box "Configure default gateway" since the access point needs to talk to RADIUS, NTP and syslog servers, which may lie in a different subnet!

At step 8 of 9, you will encounter the first crucial setting for compliance with the eduroam policy: time synchronisation. The device suggests an NTP server (pool.ntp.org), which is a sane default setting. However, if you operate your own NTP server, you can select "Other..." and enter your own server name (see screenshot). TODO!

If you changed the IP address of the Access Point with the wizard, re-connect to the Access Point on its new address after finishing the wizard.

B.2.2 Timezone setup

The Access point needs to be synchronised with a NTP or SNTP time server (which was set up using the wizard), which requires correct timezone settings. Click on "Configuration" -> "Date & Time" -> "General". and verify that the correct time zone and dayight saving time settings are set (see screenshot).

B.2.3 Logging

Another requirement in the eduroam policy is that the eduroam SP is required to maintain logs of the authentication and of MAC-address to IP address bindings. LANCOM devices can satisfy both by logging events via syslog. By default, the device keeps short-term logs by logging to "127.0.0.1". The logs look like the following (prefixed with the exact timestamp, left out for readability reasons):

As you can see, the authentication itself and all MAC -> IP binding actions are logged, both for IPv4 and IPv6.

It is required to log these notices to an external syslog server, since the syslog buffer in the device fills quickly and the information would be lost otherwise. Add your syslog server by selecting the menu item "Configuration" > "Log &Trace" > "Syslog" and make sure the box "Send information..." is checked (it is by default). Then click on "Syslog servers" and on the following page "Add".

Then enter the IP address of your syslog server, and choose the events that shall be logged. We suggest to select at least the sources

• System
• Login
• System time
• Console Login
• Connections
• Administration

and the levels

• Alert
• Error
• Warning
• Information

for a comprehensive overview of events on the device.

The logs that are collected with the localhost setting will show up under
Expert Configuration>Status>TCP-IP>Syslog.

B.2.4 Configuring the SSID

     1. Select Configuration>Wireless LAN>Logical WLAN setting – Network.
     2. Click on one of the available slots, then set the following options as described:
         WLAN network enabled to On.
         Network name (SSID) to eduroam.
         Deselect the box labelled "Suppress SSID broadcast"
         MAC filter enabled to Off.
         Maximum count of clients to 0.
         Client Bridge support to No.

B.2.5 WPA Enterprise security

     1. Configure the RADIUS server to use: Select Configuration – Wireless LAN – IEEE 802.1X – RADIUS
         server.
     2. Click on add and enter your server details:
You must now apply the RADIUS server and encryption scheme to the SSID eduroam:
     3. Select Configuration>Wireless LAN>802.11i/WEP.
     4. Click on WPA or Private WEP setting – 80211.i/WEP.

     5. Click on the slot in which you previously configured the SSID eduroam and enter the following settings:
         Encryption Activated to Activated.
         Method/Key 1 Length to 802.11i(WPA)-802.1x.
         WPA Version to WPA1/2.
         WPA1 Session Key Type to TKIP
         ○ WPA2 Session Key Type to AES

Other settings are irrelevant with WPA-Enterprise:

B.2.6 RADIUS accounting server (optional)

If RADIUS accounting for the eduroam SSID shall be enabled, you must configure a RADIUS server to receive
the accounting messages:

• Select Expert Configuration>Setup – WLAN – RADIUS-Accounting and complete the server details:
• Afterwards, activate the actual RADIUS Accounting reporting under Expert Configuration>Setup –
  Interfaces – WLAN – Network – RADIUS-Accounting

B.2.7 Using RadSec instead of RADIUS (optional)

LANCOM devices have a RadSec client built-in. It can be used instead of standard RADIUS for the uplink to an
IdP.

To use RadSec, you must have been given a eduroam Service Provider X.509 certificate from your NRO. First,
upload this certificate and the eduGAIN CA certificate (which can be downloaded athttp://sca.edugain.org/cacert/eduGAINCA.pem) via the device's "File Upload" menu:
Then, go to Expert Configuration>Setup>IEEE802.1X>RADIUS Server and set the Protocol option to
RADSEC:
The same option is also present in the RADIUS Accounting server menu that was discussed above. When
RadSec is to be used, we strongly suggest to use it for both authentication and accounting.