version 6.4.2.0-4.1.3
name HK-WiFi
organization HK-Club
virtual-controller-ip 10.0.2.101
virtual-controller-vlan 2 255.255.255.0 10.0.2.1
terminal-access
ntp-server tik.cesnet.cz
clock timezone Prague 01 00
rf-band all
restricted-mgmt-access 10.0.2.0 255.255.255.0

allow-new-aps
allowed-ap 70:3a:0e:c7:1f:b2
allowed-ap 70:3a:0e:c7:14:9c
allowed-ap 70:3a:0e:c7:14:a0
allowed-ap 70:3a:0e:c7:14:ee
allowed-ap 70:3a:0e:c7:1e:c6
allowed-ap 70:3a:0e:c7:15:38
allowed-ap 70:3a:0e:c7:1f:78
allowed-ap 70:3a:0e:c7:1f:28
allowed-ap 70:3a:0e:c7:1f:20
allowed-ap 70:3a:0e:c7:20:28
allowed-ap 70:3a:0e:c7:14:8c
allowed-ap 70:3a:0e:c7:20:06
allowed-ap 70:3a:0e:c7:20:80
allowed-ap 70:3a:0e:c7:20:02
allowed-ap 70:3a:0e:c7:1f:da
allowed-ap 70:3a:0e:c7:20:42
allowed-ap 70:3a:0e:c7:20:22
allowed-ap 70:3a:0e:c7:20:48
allowed-ap 70:3a:0e:c7:1f:82
allowed-ap 70:3a:0e:c7:20:46
allowed-ap 70:3a:0e:c7:1f:30
allowed-ap 70:3a:0e:c7:20:4e
allowed-ap 70:3a:0e:c7:20:72
allowed-ap 70:3a:0e:c7:20:40
allowed-ap 70:3a:0e:c7:20:32


arm
 wide-bands 5ghz
 80mhz-support
 min-tx-power 18
 max-tx-power 127
 band-steering-mode prefer-5ghz
 air-time-fairness-mode fair-access
 client-aware
 scanning


syslog-level warn ap-debug 
syslog-level warn network 
syslog-level warn security 
syslog-level warn system 
syslog-level warn user 
syslog-level warn user-debug 
syslog-level warn wireless 


extended-ssid




wlan access-rule HK-Guest
 index 0
 rule any any match any any any permit

wlan access-rule default_wired_port_profile
 index 1
 rule any any match any any any permit

wlan access-rule wired-instant
 index 2
 rule masterip 0.0.0.0 match tcp 80 80 permit
 rule masterip 0.0.0.0 match tcp 4343 4343 permit
 rule any any match udp 67 68 permit
 rule any any match udp 53 53 permit

wlan access-rule HK-Member
 index 3
 rule any any match any any any permit

wlan ssid-profile HK-Guest
 enable
 index 0
 type employee
 essid HK-Guest
 wpa-passphrase xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 opmode wpa2-psk-aes
 max-authentication-failures 0
 vlan 450
 auth-server InternalServer
 rf-band all
 captive-portal disable
 dtim-period 1
 inactivity-timeout 1000
 broadcast-filter arp
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

wlan ssid-profile HK-Member
 enable
 index 1
 type employee
 essid HK-Member
 opmode wpa2-aes
 max-authentication-failures 0
 vlan 450
 auth-server radius1
 auth-server radius2
 rf-band all
 captive-portal disable
 dtim-period 1
 inactivity-timeout 1000
 broadcast-filter arp
 radius-reauth-interval 30
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

auth-survivability cache-time-out 24



wlan auth-server radius1
 ip 10.0.2.10
 port 1812
 acctport 1813
 timeout 10
 key xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

wlan auth-server radius2
 ip 10.0.2.11
 port 1812
 acctport 1813
 timeout 10
 key xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

wlan captive-portal
 background-color 13421772
 banner-color 16750848
 banner-text "Welcome to Guest Network"
 terms-of-use "This network is not secure, and use is at your own risk"
 use-policy "Please read terms and conditions before using Guest Network"
 authenticated

wlan external-captive-portal
 server 10.0.2.12
 port 80
 url "/"
 auth-text "Welcome"
 server-fail-through
 auto-whitelist-disable


blacklist-time 3600
auth-failure-blacklist-time 3600

ids classification

ids
 wireless-containment none


wired-port-profile wired-instant
 switchport-mode access
 allowed-vlan all
 native-vlan guest
 no shutdown
 access-rule-name wired-instant
 speed auto
 duplex auto
 no poe
 type guest
 captive-portal disable
 no dot1x
 inactivity-timeout 1000

wired-port-profile default_wired_port_profile
 switchport-mode trunk
 allowed-vlan all
 native-vlan 2
 uplink-enable
 no shutdown
 spanning-tree
 access-rule-name default_wired_port_profile
 speed auto
 duplex full
 no poe
 type employee
 auth-server InternalServer
 captive-portal disable
 no dot1x
 inactivity-timeout 1000


enet0-port-profile default_wired_port_profile

uplink
 no preemption
 enforce ethernet
 failover-internet-pkt-lost-cnt 10
 failover-internet-pkt-send-freq 30
 failover-vpn-timeout 180


airgroup
 disable

airgroupservice airplay
 disable
 description AirPlay

airgroupservice airprint
 disable
 description AirPrint