6

Check the output of show vlan. When a VLAN doesn't show up as active in the management domain, it will almost always be because the VLAN doesn't exist on the switch. The switch may have a configuration problem with VTP or it may be configured to operate in transparent mode.


6

You state that a Wireless Controller is not an option, so I'm assuming these are Autonomous Access Points. On Cisco Autonomous APs, you are looking for the show dot11 associations command and it's associated sub commands. It gives an output like so: SPARKY#show dot11 associations 802.11 Client Stations on Dot11Radio0: ...


5

Many Cisco devices include the fsck command to check the file system with. If you run this command on the flash, it will attempt to fix file system errors for you. These were my results: ap#fsck flash: Fsck operation may take a while. Continue? [confirm] flashfs[3]: WARNING - Unable to allocate backup blocks. Please free some space on the flash file system. ...


5

We solved this with new cable runs using STP instead of UTP. No more issues with POE to the APs. First time we've needed STP and we can't find anything that would cause the interference with the run.


5

Cisco's policy is to offer free software upgrades for security vulnerabilities. They only let you get the feature set you already have, and they give you the smallest "feature version" upgrade for which they have a fix. One trick is to find a security vulnerability that affects your current version requiring an upgrade to the version you want. ...


4

Yes, you can do that. It is called max-associations option under ssid configuration section and can be done per SSID. Let us say you want to set the maximum number of devices that can associate using your_ssid to 5: # conf t (config)# dot11 ssid your_ssid (config-ssid)# max-associations 5 (config-ssid)# end You can check more details at ...


4

Not directly on the WLC, but using Cisco ACS, ISE or other RADIUS server, you can set the captive URL using the url-redirect value of the cisco-av-pair RADIUS attribute. This overrides the WLC default setting for External Webauth URL. You can also set the url-redirect-acl to match a named ACL on the WLC.


4

Based on this Configuration Guide, it would appear to only support one portal. I don't know if there's a way to specify the SSID (network) to the portal page / WLC. (I've never needed to. [it's in the wlan query param]) Update: Apparently 7.3+ can, but it's a lot more involved. "Assigning Login, Login Failure, and Logout Pages per WLAN"


4

According to this list, none of those MIBs carry per-rate statistics. Looking through all the v1 and v2 MIBs, I see nothing to indicate a way to get the per-rate stats. Cisco IOS MIB Locator for my specific 1242. Use "New Search" to get the specifics for your 1142.


3

Untagged (native) VLANs don't really offer you any benefit over tagged VLANs, and they present a certain level of security risk. There is no real reason to use untagged VLANs when tagged VLANs are available. Some people prefer to use a network-wide VLAN for management, one for printers, etc. This scenario presents both security and operational risks. ...


3

I do not want users to use their windows credentials (so they do not connect phones) - Users are not allowed to know the password (same reason) As you mentioned Windows and ACS, you can still use user credentials via dot1X and not allow them to connect via phones. As long as you're doing Machine auth in ACS and requiring computer authentication in Windows ...


2

You can connect each AP to the controller directly, because you only have two APs and you happen to have two distribution ports on the controller. If you wanted to connect more than two APs to your WLC4402 you would need a switch. The ports that "are not ethernet" actually are ethernet, but you can't plug any cable directly into them. They're called SFP ...


2

Your Cisco 2500 WLC can authenticate wireless clients in many different ways, one of them being a captive web portal with username and password. A Radius server can be used, but this might be overkill if you are only going to set it up for authentication on the wireless network. Users can also be defined directly on the WLC. Explaining how to set this up ...


2

I think SSID isolation is not the same as Client Isolation. Some controllers will have both and I believe they perform two different tasks. With SSID isolation, it simply means that if you have multiple SSID's and clients connected to them, the clients from different SSID's will not be able to communicate. With client isolation ( which is what you want ), ...


2

According to Cisco release notes for the Cisco 2504 Wireless LAN Controller, the last software, that supported the Cisco 1140 Series AP and Cisco 1250 Series AP is Releases 8.0.150.0 (31-Aug-2017) and 8.0.152.0 (21-Oct-2017). From Cisco documentation: Supported Access Point Platforms The following access point platforms are supported in this release:...


2

Is there a way to display on a WLC a list of commands used for configuration of a given AP? For a given AP? No. But you can list all the commands from the running configuration with the following: show run-config commands Depending on your configuration this can be a very long output, so two pieces of advice. Enable logging of the output in your SSH ...


1

The error is a standard "warning" message you get when making this configuration. I don't believe this has any relation to your problem. Instead, you said you entered this: config wlan dhcp_server 1 0.0.0.0 required 1 This is not correct syntax for the CLI command. This is the correct syntax: config wlan dhcp_server <WLAN_ID> 0.0.0.0 required So ...


1

What Avery has said is correct. Assuming you mean NTP Servers for wireless clients, that would have to de bone through DHCP. You could only assign an NTP Server statically for the Wireless LAN Controller itself. Regarding the new WLAN implementation, if you want to use new VLANs, new dynamic interfaces have to be created on the controller in order to ...


1

Certificate with serial number: 3C1E27950000000C5C4B expired on 17 Jan 2017. Please double check certificates and configured trustpoints. It could be manufacturing installed certificates. I've found issue over here check if is not same in your case.


1

If your question is to get the following AP configs .. AP#capwap ap ip address AP#capwap ap ip default-gateway AP#capwap ap primary-base AP#capwap ap secondary-base AP#capwap ap hostname You can check the configuration of the AP with show capwap ip config, and after joining the WLC, you can check the details with show capwap client ...


1

If you mean host to network attachment, then it works much like any other Cisco wireless products using WPA2 Personal (Pre-Shared Key) or WPA2 Enterprise (802.1X using RADIUS). If you mean logging into the controller, it is very much like any other Cisco device, and you can use AAA with RADIUS or TACACS+. Cisco maintains a full library of documentation for ...


1

The OUI (Organizationally Unique Identifier) for a MAC address is assigned by the IEEE. The rest of the MAC address is assigned by the company to which the OUI is assigned, and it is completely up to the OUI owner for how to assign them. In your example, the OUI is 58:97:bd, assigned to Cisco Systems. The rest of the MAC addresses are assigned by Cisco in ...


1

The WLC should connect to a switch via ethernet. Normally it is configured using a trunk so that you can have multiple VLANs: one for the WLC management address, and one or more for the various SSIDs the LWAPs will use. The LWAPs will connect to switches closest to where they need to be, and they will get their addresses, and the address of the WLC, from ...


1

Consider looking into PacketFence(.org) + FreeRADIUS. PacketFence describes itself as : PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, powerful BYOD ...


Only top voted, non community-wiki answers of a minimum length are eligible