Wireless Router configured as WAP

[jworth-p40]

How and where did you place your wireless devices?

We have an older "L" shaped building with the dropped ceiling tiles and I am running my cabling out of the clerks' office through a conduit hole in the concrete wall and putting it in the hallway somewhere.

My goal is to get it to the central part of the hallway to give the most overall coverage.

[Mikerowaved]

We used 3 WAP's to cover our 10 year old stake center. They went up in the "attic" area where access is limited to a very small number of brethren and were hard-wired back to the Cisco ASA. (See note.) Your mileage will certainly vary, especially with older non-traditional shaped buildings. We used less expensive 802.11g routers, but Draft-N routers should give you a little better punch.

Once positioned, set all the SSID's the same, the encryption keys the same, internal LAN IP addresses different, and use the widest possible channel spacing for each one. (For three WAP's, I used 1, 6, and 11.) This will allow seamless coverage for a typical user.

Note: We cheated a bit with our wiring in that we have only one WAP physically hard-wired to the ASA, the others are slaved off of it using the LAN ports on the switch. (To keep things easy, WAN ports were NEVER used.) This simplified the wiring, but sacrificed a bit in reliability. For us, it was a good trade-off.

[jworth-p40]

So, did you actually mount the device on some sort of structure so that it couldn't move?

I have done just an initial assessment and all I see is ductwork there. I don't think the wireless device would be safe to just place on top of a duct run.

Also, how are you gettting power to these devices? Normally, there shouldn't be an outlet available in the space above the drop ceiling. I am just running an extension cord to the other one that powers both the modem and firewall box.

[russellhltn]

I am just running an extension cord to the other one that powers both the modem and firewall box.

Extension cords for a fairly permanent installation in the ceiling gives me the creeps. (I wonder if it violates electoral code.) I'd suggest asking FM to install an outlet where you need it.

[lajackson]

(I wonder if it violates electoral code.)

Probably not. But it usually does violate the electrical code. [grin]

[Mikerowaved]

So, did you actually mount the device on some sort of structure so that it couldn't move?

I have done just an initial assessment and all I see is ductwork there. I don't think the wireless device would be safe to just place on top of a duct run.

From what I've been told (I'm in a wheelchair, so I don't have first-hand knowledge ), there is quite a bit of open space there, and yes, there are a few power outlets available. These may have been installed specifically for our "wiring the building for Internet" project, I'm not sure.

Also, how are you gettting power to these devices? Normally, there shouldn't be an outlet available in the space above the drop ceiling. I am just running an extension cord to the other one that powers both the modem and firewall box.

You can also look into the Cisco ASA's ability to run Power Over Ethernet (PoE) from ports 6 & 7. Using a IEEE 802.3af compliant WAP, no other power source would be needed.

[dkcook2-p40]

The power over ethernet idea is a nice one.

We've been through this now with two buildings. In the newer building in our stake we found outlets in the attic that were very close to the area where we wanted to place the WAPs. We contacted facilities and they were fine with us using them. I did put a surge protector on these.

In the older building we miraculously found a junction box in the closet we were putting the WAP and with facilities help we were able to put an outlet into the junction box. The other one was placed in an area that had an outlet all ready.

[russellhltn]

Probably not. But it usually does violate the electrical code. [grin]

*sigh* Good thing for me this isn't a presidential election year. Dang spell checker....

[jworth-p40]

The "DHCP Server" function will assign an IP address, and other important settings, to any device that connects to the router asking for them. Since we would like the Cisco firewall to handle that function, we need to turn it off in the router. We want only ONE active DHCP server in the same LAN segment.

The other setting you mentioned relates to how the router is assigned it's own IP address, BUT, that's referring to the WAN side of the router, which you wont normally use if it's pretending to be a dumb WAP, instead of a smart router. Since no cable should be connected to the WAN port, this setting doesn't matter at all.

(Note: The following applies to a Cisco ASA 5505 firewall only.)

You should also find a place in the router's configuration menu to assign a fixed LAN IP address to the router. I highly recommend using this field. Here's how you do it. When your Cisco firewall assigns IP addesses through its DHCP service, it always skips the first 5 following its own and starts with the 6th and goes up from there. So let's say if the IP address label on the top of your Cisco says 10.111.222.49, this is what it would look like...

10.111.222.49 Cisco router/firewall
10.111.222.50 skipped
10.111.222.51 skipped
10.111.222.52 skipped
10.111.222.53 skipped
10.111.222.54 skipped
10.111.222.55 1st IP address assigned
10.111.222.56 2nd IP address assigned
...and so on.

Those "skipped" addresses are important. They allow us to put fixed IP address devices on the LAN and not interfere with anything else. Grab the first address after your own Cisco's label and put it into the "Fixed LAN" (or LAN IP) spot in your router's configuration. Now a very important part. For the MASK you always want to enter 255.255.255.224. Anything else wont work.

Do this for all of your WAP's, assigning each a different "skipped" IP address and for goodness sake, WRITE DOWN what the IP assignments are and where the WAP's are located. That way if you need to log into their menu again and make changes (like wireless key) it becomes an easy task. From any wired or wireless PC's browser, just type the WAP's address in the form of http://10.xxx.xxx.xxx and enter the username password. (You DID change the default password on the router, RIGHT? )

I am looking at the ASA 5500 and the IP address is 10.217.12.255. It doesn't follow the naming convention talked about here. Now, with the above reasoning in assigning an IP address to the wireless device, do I assume that one of the five position before the 255 are the IP addresses that I should assign the wireless to?

[jworth-p40]

From what I've been told (I'm in a wheelchair, so I don't have first-hand knowledge ), there is quite a bit of open space there, and yes, there are a few power outlets available. These may have been installed specifically for our "wiring the building for Internet" project, I'm not sure.


You can also look into the Cisco ASA's ability to run Power Over Ethernet (PoE) from ports 6 & 7. Using a IEEE 802.3af compliant WAP, no other power source would be needed.

Does anyone know what router are IEEE 802.af compliant? I have a WRT150N to use as the wireless access point and it would save me from having to find a power outlet.