Depending on the version of WLC code that you're running, you can either manually disable the status LED on the AP or flash it by logging into the WLC and issuing a command... Then just walk around with your laptop and turn off / flash LEDs until you find the right AP.
To disable the status LED, use this...
config ap led-state disable AP27
To flash the ...
There are two main options for controller redundancy in Cisco's current wireless offerings. You can either use Backup Controllers or High Availability; depending on the firmware level of your 5508's, your acceptable failover time, and your budget.
Based on your question, we're working with the following topology:
Traditionally, utilizing Backup ...
Use a script to login to the WLC and run the transfer command:
You can use this to upload the config from the WLC to another server via TFTP/SFTP/FTP.
(Cisco Controller) >transfer upload mode sftp
(Cisco Controller) >transfer upload username my-osx-user
Assuming a Cisco WLC... Go to "WLAN > Select the WLAN Profile > General Tab > Radio Policy"
Updating my answer to clarify a few things...
802.11a operates at a maximum of 54Mbps, only in the 5GHz bands
802.11b operates at a maximum of 11Mbps, only in the 2.4GHz bands
802.11g operates at a maximum of 54Mbps, only in the 2.4GHz bands
Keep in mind that ...
If you check in the 7.2 release notes it has the following limitations:
Features Not Supported on Cisco 2500 Series Controllers
•Wired guest access
•Cisco 2500 Series Controller cannot be configured as an auto anchor
controller. However, you can configure it as a foreign controller.
•Access points in direct ...
I see no reason not to enable it if your WLC/AP's support it.
At the end of the day the neighbour list is only populated with neighbours that are under the same administrative control as the original AP and so it doesn't really open you up any more than a usual WiFi connection would.
802.11k is no greater security risk than a normal wireless network without 802.11k. Since the clients can already probe for your access points, this information is already available.
It can actually be a bit more secure as the information provided to the client will not include any rogue APs, so they will be less likely to be chosen.
The only reason I can ...
If you don't need to confuse your users with multiple VLANs, don't do it. Leverage the tools you have. You mentioned you have ISE and you should be able to do all this with one SSID. As AdnanG already mentioned, you can utilize the profiling features of ISE to classify the devices.
Your ACS should be able to tie into the MS AD authentication and be able ...
From a security perspective I've found the WLCs pretty bare on their own. You can do basic ACLs but not much more. I don't think you're going to find an answer on those alone.
You can use an external web filter in association with the ASA - http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/97277-pix-asa-url-filtering.html
Expect may be a good candidate to consider for the job.
Below is an example template I've put together that is commented out for you to play with. It will log into a WLC, grab the running configuration and append it to a file of your choice.
The example file name and location is /var/log/script-log/config-log.txt
You'll need to modify the file name and ...
Try with Port Security
Port security allows you to specify a maximum number of MAC addresses per interface and a security policy if the maximum number of addresses is reached. Since an AP is a L2 device your switch will learn multiple MAC addresses from a single ethernet interface (as if it was a switch).
Unless something changed recently in regards to WLC/Prime licensing, you can only do this when you are running a two controllers in a HA active/standby state. In this case, you only need permanent count licenses on the active WLC.
From Cisco documentation: "In Cisco Prime Infrastructure, the only HA configuration is supported is 1:1 - 1 primary system, 1 ...
I know this is an old post, but the best way I could find to automate the backing up from my controllers was to use SNMP in a script run from cron.
snmpset -v2c -c <snmp_RW> <WLC_IP> .220.127.116.11.4.1.1418.104.22.168.1.1.0 i 1
snmpset -v2c -c <snmp_RW> <WLC_IP> .22.214.171.124.4.1.14126.96.36.199.1.2.0 a TFTP_Server_IP
snmpset -v2c -c <snmp_RW> &...
Depending on how many devices you have, you could hack Rancid to get it to work with them. Then you can set it up with a version control system and have a nice web gui with diffs over time.
If you don't have many devices, the [clogin part of Rancid] should be sufficient in a script called from crontab daily, á la
for device in wlc1 wlc2 wlc3 (..) wlcN; do
The easiest way to achieve this would be to separate the clients into different SSIDs/WLANs. Place the clients who need addresses from the Built-In DHCP server in one, and the clients who need addresses from the External DHCP server into another.
This way, you could point the Proxy DHCP server IP address wherever you need it to go depeding on which ...
Turns out this is a bug and is on file already with Cisco.
From Cisco TAC:
A bug has already been filed on this type of scenario. Here is the bug
This should be addressed starting with the 8.0 FCS / 7.6 MR3(188.8.131.52) releases - i.e. at that point you should be able to download the applicable k9w8 image, install it on the AP, and then join ...
I've never had to do a migration from 7.0 to 7.5 code in my environments.
The 2600 series APs were first supported in 7.2.110.
The 5508 can run also 7.2. If you could get the mobility group/anchor to work with 7.2, then why you could downgrade it to 7.2 during the ...
We like LAGs on Cisco Wireless controllers, but how you do it depends on the model. We used to have 4404 controllers that required static LAGs. Now we have the 5508 and it supports LACP.
We had no problem with LAG, and I prefer it for uplinks from the controller.
Yes, the 2504 supports LAG in v7.4. Your first guide refers to v184.108.40.206 and the second guide written in 5/2013 implies v7.4. Enabling LAG requires a reboot of the WLC and has limitations similar to the 5500.
When LAG is enabled on a WLC, the WLC forwards data frames on the same port on which they were received. The WLC relies on the neighbor switch to ...
Based on this Configuration Guide, it would appear to only support one portal. I don't know if there's a way to specify the SSID (network) to the portal page / WLC. (I've never needed to. [it's in the wlan query param])
Update: Apparently 7.3+ can, but it's a lot more involved. "Assigning Login, Login Failure, and Logout Pages per WLAN"
Not directly on the WLC, but using Cisco ACS, ISE or other RADIUS server, you can set the captive URL using the url-redirect value of the cisco-av-pair RADIUS attribute. This overrides the WLC default setting for External Webauth URL. You can also set the url-redirect-acl to match a named ACL on the WLC.
APs and the controller being on the same subnet is rather unlikely. You'd probably have a centralized controller somewhere in your organization and the APs would be plugged into ports in different IDF closets which span multiple subnets. When the APs boot up, they take the domain-name assigned via DHCP and try and resolve CISCO-CAPWAP-CONTROLLER.domainname....
Putting the APs and the controller in the same L2 domain is the simplest solution as you don't have to do anything else for them to find one another. If you put the APs on a different subnet then you have to either configure DHCP option 43 on the APs subnet or put in a DNS entry for cisco-capwap-controller.DOMAIN-APs-GET-FROM.DHC. Formerly this was cisco-...
WLCs are NOT Radius Servers, you need an external Radius server and then point the WLCs to it
The page you are on right now is to configure credentials to actually be able to query the external radius server: IP Address & Ports, Shared Secret, and other connectivity options.
Cisco Radius servers are called ACS (secure Access Control System) and to ...
I do not want users to use their windows credentials (so they do not connect phones) - Users are not allowed to know the password (same reason)
As you mentioned Windows and ACS, you can still use user credentials via dot1X and not allow them to connect via phones. As long as you're doing Machine auth in ACS and requiring computer authentication in Windows ...
Take one copy of each of your AP models. You DO have one of each in a lab, right? (If not, you need to push to get this budgeted.)
Connect them to your WLC so they get the updated code.
Console in, download the image for each model.
TFTP the appropriate image to each AP worldwide*. Be aware this is going to suck if you don't know how to automate SSHing ...
Not really sure if this counts as a "method" but as pointed out, AP's are L2, so looking at the CAM table "show mac-address table" for interfaces with multiple macs is usually a giveaway that either an AP, soho-switch/hub etc. is connected to that port.
You can also set up dedicated AP's for RLDP. WCS also has a 'switch-port tracer' for Rogues (not sure if ...
I don't have anything on 7.2 still so I can't give you a definitive answer on your question. However, what I can say is that if you take the letter of the documentation as law and presume that you cannot combine FlexConnect and Local ACLs on a single WLAN, and you really don't want to create multiple WLANs, what I know you can do is use central switching on ...