// to display images directly on GitHub
ifdef::env-github[]
:encoding: UTF-8
:lang: en
:doctype: book
:toc: left
:imagesdir: ../../images
endif::[]

////

    This file is part of the PacketFence project.

    See PacketFence_Network_Devices_Configuration_Guide.asciidoc
    for authors, copyright and license information.

////

  
//=== Motorola

In order to have the Motorola RFS controller working with PacketFence, you
need to define two Wireless LANs definition, one for the "public" network,
and one for the "secure" network.

==== WiNG (Firmware >= 5.0)

[float]
===== AAA Policy (RADIUS server)

First, we need to build the AAA Policy. Under _Configuration -> Wireless -> AAA Policy_, click on the *Add* button at the bottom right. Configure the RADIUS profile like the following:

* Host: Choose IP Address in the drop down, and put the RADIUS server (PF) IP
* Insert a RADIUS secret passphrase
* Select "Through Wireless Controller" Request Mode

CAUTION: Since we are using RADIUS Dynamic Authorization, we need to enable the RADIUS accounting. Under the RADIUS accounting tab, click the Add button at the bottom right, and insert the proper values.

[float]
===== Open SSID

Under _Configuration -> Wireless -> Wireless LANs_, click on the *Add* button at the bottom right. Under Basic Configuration:

* Profile Name : Give a convenient name
* SSID: This is the ESSID name
* Ensure that the WLAN Status is set to enable
* Select Single VLAN as VLAN assignment technique
* Ensure that "Allow RADIUS Override" is selected

.Security configuration:
* Select MAC as authentication type
* Select your AAA Policy previously created
* Ensure that you selected Open as the Encryption

.Accounting configuration:
* Make sure you select "Enable RADIUS Accounting"
* Select the previously configured AAA Policy

.Advanced configuration:
* Make sure you select RADIUS Dynamic Authorization

[float]
===== Secure SSID

Under _Configuration -> Wireless -> Wireless LANs_, click on the *Add* button at the bottom right. Under Basic Configuration:

* Profile Name : Give a convenient name
* SSID: This is the ESSID name
* Ensure that the WLAN Status is set to enable
* Select Single VLAN as VLAN assignment technique
* Ensure that "Allow RADIUS Override" is selected

.Security configuration:
* Select EAP as authentication type
* Select your AAA Policy previously created
* Ensure that you selected WPA/WPA2-TKIP as the Encryption
* Unselect everything under Fast Roaming (Disable caching)

.Accounting configuration:
* Make sure you select "Enable RADIUS Accounting"
* Select the previously configured AAA Policy

.Advanced configuration:
* Make sure you select RADIUS Dynamic Authorization

[float]
===== Profile (WLAN Mapping)

You have multiple options here. Either, you create a general AP profile, and you assign it to your Aps, or you modify the AP device configuration to map the WLAN to the radio interfaces. For the purpose of this document, we will modify the general profile. Under _Profiles -> default-apXXX_ (where XXX is your AP model), in _Interface -> Radios_, edit the existing radios settings. Go to the *WLAN Mapping* tab, select the two SSIDs and click on the *<<* button.

[float]
===== Profile (Management)

Here, we can configure our SNMP community strings. Located in _Configuration -> Management -> Management Policy_. Again, you can modify the default one, or you can create a brand new Policy.

[float]
===== VLANs

You need to ensure that the uplink interface of the controller is configured as a trunk, and that all the necessary VLANs are created on the device. This is configured under _Device -> rfsXXXX-MAC_ (where XXXX is your controller series, and MAC is the latest 3 octets of its mac address). Edit the device configuration, and go to _Interface -> Ethernet Ports_. Ensure that the up1 interface is set as trunk, with all the allowed VLANs. Next, create the VLAN under _Interface -> Virtual Interfaces_.

[float]
===== Roles (Per-User Firewall)

Since PacketFence 3.3.0, we now support roles for the Motorola hardware using WiNGS 5.x.  To add roles, go in _Configuration -> Security -> Wireless Client Roles_.  First create a global policy that
will contain your roles.  Next, create your Roles by clicking on the *Add* button on the bottom right.  It is important to configure the Group Configuration line properly by setting the string
name that we will use in the RADIUS packet.  For example, for a Guests Role, you can put *Group Configuration Exact Guests*, and for a Staff Roles, you can put *Group Configuration Exact Staff*. 
In the roles configuration in switches.conf, you would have something like :

   roles=CategoryGuests=Guests;CategoryStaff=Staff

Finally, don't forget to configure the appropriate firewall rules for your Roles!  Make sure also to commit the configuration upon your changes.

NOTE: You need to have an *Advanced Security* license to enable the Per-User Firewall feature.

===== WIPS

In order to enable the WIPS functionality on the Motorola, you need to follow this procedure.  The steps have been done using the CLI.

First, Create a wips-policy:

   wips-policy Rogue-AP
   history-throttle-duration 86400
   event ap-anomaly airjack
   event ap-anomaly null-probe-response
   event ap-anomaly asleap
   event ap-anomaly ad-hoc-violation
   event ap-anomaly ap-ssid-broadcast-in-beacon
   event ap-anomaly impersonation-attack
   ap-detection

Next, create an event policy:

   event-system-policy PF-WIDS
   event wips wips-event syslog off snmp on forward-to-switch off email off

Next, create or adjust your management policy to configure the SNMP traps.  Here is an example policy, please note the two last lines:

   management-policy default
   no http server
   https server
   ssh
   user admin password 1 e4c93663e3356787d451312eeb8d4704ef09f2331a20133764c3dc3121f13a5b role superuser access all
   user operator password 1 7c9b1fbb2ed7d5bb50dba0b563eac722b0676b45fed726d3e4e563b0c87d236d role monitor access all
   no snmp-server manager v3
   snmp-server community public ro
   snmp-server community private rw
   snmp-server user snmpoperator v3 encrypted des auth md5 0 operator
   snmp-server user snmptrap v3 encrypted des auth md5 0 motorola
   snmp-server user snmpmanager v3 encrypted des auth md5 0 motorola
   snmp-server enable traps
   snmp-server host 10.0.0.100 v2c 162

You then need to tell your controller to use the event policy:

   rfs6000 5C-0E-8B-17-F2-E3
   ...
   use event-system-policy PF-WIDS

Finally, you need to configure a radio interface on your AP to act as a sensor.  Here is an example configuration for a dual-radio AP650:

   ap650 00-23-68-86-EB-BC
   use profile default-ap650
   use rf-domain default
   hostname ap650-86EBBC
   country-code ca
   use wips-policy Rogue-AP
   interface radio1
   rf-mode sensor
   channel smart
   power smart
   data-rates default
   no preamble-short
   radio-share-mode off
   interface radio2
   ...


==== Older Firmwares (< 5.0)

.Option for Public Wireless LAN
* Check the Dynamic Assignment check-box
* Select "MAC Authentication" under Authentication
* Click "Config..." choose the Colon delimiter format
* Un-check all encryption options
* Under RADIUS put in PacketFence's RADIUS Server information

.Option for Secure Wireless LAN
* Check the Dynamic Assignment check-box
* Select "802.1X EAP" under Authentication
* Check WPA/WPA2-TKIP encryption option
* Under RADIUS put in PacketFence's RADIUS Server information

[float]
===== SNMP Global configuration

Add the two Read-Only and Read-Write users under _Management Access -> SNMP Access_.
