version 6.3.1.0-4.0.0
virtual-controller-country US
virtual-controller-key xxxxxxxxx
name High-School-Wireless
virtual-controller-ip 10.215.0.102
terminal-access
ntp-server 10.211.0.100
clock timezone Eastern-Time -05 00
clock summer-time EDT recurring second sunday march 02:00 first sunday november 02:00
rf-band 5.0
dynamic-radius-proxy

allow-new-aps
allowed-ap ...

snmp-server community xxxxxxxxxxx
snmp-server host 10.211.0.77 version 2c monitor inform

arm
 wide-bands 5ghz
 min-tx-power 6
 max-tx-power 127
 band-steering-mode prefer-5ghz
 air-time-fairness-mode fair-access
 client-aware
 scanning

rf dot11g-radio-profile
 spectrum-monitor
 dot11h
 interference-immunity 4
 csa-count 1

rf dot11a-radio-profile
 spectrum-monitor
 dot11h
 interference-immunity 4
 csa-count 1


syslog-level warn ap-debug 
syslog-level warn network 
syslog-level warn security 
syslog-level warn system 
syslog-level warn user 
syslog-level warn user-debug 
syslog-level warn wireless 






mgmt-user admin xxxxxxxxxxx

wlan access-rule default_wired_port_profile
 index 0
 rule any any match any any any permit

wlan access-rule wired-instant
 index 1
 rule 10.215.220.67 255.255.255.255 match tcp 80 80 permit
 rule 10.215.220.67 255.255.255.255 match tcp 4343 4343 permit
 rule any any match udp 67 68 permit
 rule any any match udp 53 53 permit

wlan access-rule WASD3
 index 2
 rule any any match any any any permit

wlan access-rule Guests
 index 3
 rule any any match tcp 80 80 permit
 rule any any match tcp 443 443 permit
 rule any any match icmp any any permit
 rule any any match udp 53 53 permit
 rule any any match udp 67 68 permit
 rule any any match udp 5156 5156 permit
 bandwidth-limit downstream 5120
 bandwidth-limit upstream 5120

wlan access-rule Guest-CP
 index 4
 rule any any match udp 53 53 permit
 rule any any match tcp 80 80 permit
 rule any any match tcp 443 443 permit
 bandwidth-limit downstream 5120
 bandwidth-limit upstream 5120

wlan ssid-profile WASD3
 enable
 index 0
 type employee
 essid WASD3
 opmode wpa2-aes
 max-authentication-failures 0
 auth-server ADM-DC-New
 rf-band all
 captive-portal disable
 dtim-period 1
 inactivity-timeout 1000
 broadcast-filter all
 radius-accounting
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

wlan ssid-profile Guests
 enable
 index 1
 type guest
 essid Guests
 wpa-passphrase xxxxxxxxxxxxxxxxxx
 opmode wpa2-psk-aes
 max-authentication-failures 0
 rf-band all
 captive-portal disable
 dtim-period 1
 inactivity-timeout 1000
 broadcast-filter all
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

wlan ssid-profile Guest-CP
 enable
 index 2
 type guest
 essid Guest-CP
 opmode opensystem
 max-authentication-failures 0
 vlan guest
 auth-server InternalServer
 rf-band all
 captive-portal internal
 dtim-period 1
 inactivity-timeout 1000
 broadcast-filter all
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

auth-survivability cache-time-out 24



wlan auth-server ADM-DC-New
 ip 10.211.0.100
 port 1812
 acctport 1813
 key xxxxxxxxxxxxxxxxxxxxxxxx

wlan auth-server 2012r2-DC
 ip 10.211.0.99
 port 1812
 acctport 1813
 key xxxxxxxxxxxxxxxxxxxxxxxx

wlan captive-portal
 background-color 39168
 banner-color 16777215
 banner-text "Welcome to the WASD Guest WiFi"
 terms-of-use "This guest network is unsecured. It is possible for other wireless clients on the network to see the data your device sends and receives. Use this network at your own risk."
 use-policy "By connecting to this network, you agree that WASD can intercept, view, track, and filter your network usage. This network is filtered for inappropriate content. WASD has the right to ban any client found to be misusing or abusing this network."

wlan external-captive-portal
 server localhost
 port 80
 url "/"
 auth-text "Authenticated"
 auto-whitelist-disable
 https


blacklist-time 3600
auth-failure-blacklist-time 3600

ids classification

ids
 wireless-containment none


wired-port-profile default_wired_port_profile
 switchport-mode trunk
 allowed-vlan all
 native-vlan 1
 shutdown
 access-rule-name default_wired_port_profile
 speed auto
 duplex full
 no poe
 type employee
 captive-portal disable
 no dot1x

wired-port-profile wired-instant
 switchport-mode access
 allowed-vlan all
 native-vlan guest
 no shutdown
 access-rule-name wired-instant
 speed auto
 duplex auto
 no poe
 type guest
 captive-portal disable
 no dot1x


enet0-port-profile default_wired_port_profile

uplink
 preemption
 enforce none
 failover-internet-pkt-lost-cnt 10
 failover-internet-pkt-send-freq 30
 failover-vpn-timeout 180


airgroup
 disable

airgroupservice airplay
 disable
 description AirPlay

airgroupservice airprint
 disable
 description AirPrint

attack
 drop-bad-arp-enable
 fix-dhcp-enable
 poison-check-enable