There are two main options for controller redundancy in Cisco's current wireless offerings. You can either use Backup Controllers or High Availability; depending on the firmware level of your 5508's, your acceptable failover time, and your budget.
Based on your question, we're working with the following topology:
Traditionally, utilizing Backup ...
Use a script to login to the WLC and run the transfer command:
You can use this to upload the config from the WLC to another server via TFTP/SFTP/FTP.
(Cisco Controller) >transfer upload mode sftp
(Cisco Controller) >transfer upload username my-osx-user
From a security perspective I've found the WLCs pretty bare on their own. You can do basic ACLs but not much more. I don't think you're going to find an answer on those alone.
You can use an external web filter in association with the ASA - http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/97277-pix-asa-url-filtering.html
Expect may be a good candidate to consider for the job.
Below is an example template I've put together that is commented out for you to play with. It will log into a WLC, grab the running configuration and append it to a file of your choice.
The example file name and location is /var/log/script-log/config-log.txt
You'll need to modify the file name and ...
If you don't need to confuse your users with multiple VLANs, don't do it. Leverage the tools you have. You mentioned you have ISE and you should be able to do all this with one SSID. As AdnanG already mentioned, you can utilize the profiling features of ISE to classify the devices.
Your ACS should be able to tie into the MS AD authentication and be able ...
Try with Port Security
Port security allows you to specify a maximum number of MAC addresses per interface and a security policy if the maximum number of addresses is reached. Since an AP is a L2 device your switch will learn multiple MAC addresses from a single ethernet interface (as if it was a switch).
Unless something changed recently in regards to WLC/Prime licensing, you can only do this when you are running a two controllers in a HA active/standby state. In this case, you only need permanent count licenses on the active WLC.
From Cisco documentation: "In Cisco Prime Infrastructure, the only HA configuration is supported is 1:1 - 1 primary system, 1 ...
I know this is an old post, but the best way I could find to automate the backing up from my controllers was to use SNMP in a script run from cron.
snmpset -v2c -c <snmp_RW> <WLC_IP> .184.108.40.206.4.1.14220.127.116.11.1.1.0 i 1
snmpset -v2c -c <snmp_RW> <WLC_IP> .18.104.22.168.4.1.1422.214.171.124.1.2.0 a TFTP_Server_IP
snmpset -v2c -c <snmp_RW> &...
Depending on how many devices you have, you could hack Rancid to get it to work with them. Then you can set it up with a version control system and have a nice web gui with diffs over time.
If you don't have many devices, the [clogin part of Rancid] should be sufficient in a script called from crontab daily, á la
for device in wlc1 wlc2 wlc3 (..) wlcN; do
I've never had to do a migration from 7.0 to 7.5 code in my environments.
The 2600 series APs were first supported in 7.2.110.
The 5508 can run also 7.2. If you could get the mobility group/anchor to work with 7.2, then why you could downgrade it to 7.2 during the ...
The easiest way to achieve this would be to separate the clients into different SSIDs/WLANs. Place the clients who need addresses from the Built-In DHCP server in one, and the clients who need addresses from the External DHCP server into another.
This way, you could point the Proxy DHCP server IP address wherever you need it to go depeding on which ...
Not directly on the WLC, but using Cisco ACS, ISE or other RADIUS server, you can set the captive URL using the url-redirect value of the cisco-av-pair RADIUS attribute. This overrides the WLC default setting for External Webauth URL. You can also set the url-redirect-acl to match a named ACL on the WLC.
Based on this Configuration Guide, it would appear to only support one portal. I don't know if there's a way to specify the SSID (network) to the portal page / WLC. (I've never needed to. [it's in the wlan query param])
Update: Apparently 7.3+ can, but it's a lot more involved. "Assigning Login, Login Failure, and Logout Pages per WLAN"
Turns out this is a bug and is on file already with Cisco.
From Cisco TAC:
A bug has already been filed on this type of scenario. Here is the bug
This should be addressed starting with the 8.0 FCS / 7.6 MR3(126.96.36.199) releases - i.e. at that point you should be able to download the applicable k9w8 image, install it on the AP, and then join ...
I do not want users to use their windows credentials (so they do not connect phones) - Users are not allowed to know the password (same reason)
As you mentioned Windows and ACS, you can still use user credentials via dot1X and not allow them to connect via phones. As long as you're doing Machine auth in ACS and requiring computer authentication in Windows ...
WLCs are NOT Radius Servers, you need an external Radius server and then point the WLCs to it
The page you are on right now is to configure credentials to actually be able to query the external radius server: IP Address & Ports, Shared Secret, and other connectivity options.
Cisco Radius servers are called ACS (secure Access Control System) and to ...
Take one copy of each of your AP models. You DO have one of each in a lab, right? (If not, you need to push to get this budgeted.)
Connect them to your WLC so they get the updated code.
Console in, download the image for each model.
TFTP the appropriate image to each AP worldwide*. Be aware this is going to suck if you don't know how to automate SSHing ...
Not really sure if this counts as a "method" but as pointed out, AP's are L2, so looking at the CAM table "show mac-address table" for interfaces with multiple macs is usually a giveaway that either an AP, soho-switch/hub etc. is connected to that port.
You can also set up dedicated AP's for RLDP. WCS also has a 'switch-port tracer' for Rogues (not sure if ...
Was looking for some other stuff and ran across this post. A few suggestions/thoughts in case anyone else runs across this.
On the DNS issue, agreed, it can be a pain in a larger environment to assign all AP's to one Controller. You could potentially use either IP Anycast for this, if you've set up your management networks for Anycast, or use round-robin ...
As @Mike Pennington suggested, Cisco Prime would be the best all-around-solution for monitoring Cisco LWAPs connected to Wireless LAN Controllers as you gain much more than just a simple ping alert mechanism. Wireless requires a systemic view that considers not only individual APs going up and down -- and any good wireless deployment has allowances for that ...
You can connect each AP to the controller directly, because you only have two APs and you happen to have two distribution ports on the controller. If you wanted to connect more than two APs to your WLC4402 you would need a switch.
The ports that "are not ethernet" actually are ethernet, but you can't plug any cable directly into them. They're called SFP ...
You are both somewhat right. In general, there are two reasons to use a VPN from a remote location:
Security. Encrypt traffic over the internet. This is always a good idea.
Reachability. If you're still using IPv4 (like everybody else), you're probably using private (RFC1918) addresses at one or both locations. The VPN will tunnel traffic across the ...
You will have difficulties towards configuring dhcp on the dell 5524 which is a layer 2 switch. A good switch in my experience, but it isn't a layer 3 switch.
You should use a layer 3 switch that provides the wanted dhcp options and/or relay the dhcp packets from your 5524 to a dedicated dhcp server (*nix dhcpd or window$ dhcp).
See this link for some more ...
Although this seems to be an AP-based rather than WLC-based command, it would appear you can get the info you want from the AP CLI through
show controller dot11radio1
The output includes a section called "DFS Blocked Frequencies" which should be what you're looking for.
Looking through the configuration I now see the problem. It was also hinted at in the screenshots you provided, but I missed it until I saw it in your configuration.
WLAN 1, your normal production WLAN is not configured as a FlexConnect WLAN. WLAN 4, your -Test WLAN is configured as a FlexConnect WLAN as indicated below:
wlan flexconnect local-switching 1 ...
It's right there in the footnote:
Arbitrary port number is assigned to every AP from range 1024 - 65535
when the AP joins the WLC. The WLC uses the number as the Destination
Port for CAPWAP Ctl/Data as long as the AP is connected.
Most of what you are looking for is explained here :
There is no HW difference that I'm aware of, however if you buy an -HA version of the controller, it can only ever be an HA controller, you can't convert it to be a primary controller, whereas the reverse ...
The WLC should connect to a switch via ethernet. Normally it is configured using a trunk so that you can have multiple VLANs: one for the WLC management address, and one or more for the various SSIDs the LWAPs will use.
The LWAPs will connect to switches closest to where they need to be, and they will get their addresses, and the address of the WLC, from ...