Hot answers tagged

5

From a security perspective I've found the WLCs pretty bare on their own. You can do basic ACLs but not much more. I don't think you're going to find an answer on those alone. You can use an external web filter in association with the ASA - http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/97277-pix-asa-url-filtering.html ...


4

Not directly on the WLC, but using Cisco ACS, ISE or other RADIUS server, you can set the captive URL using the url-redirect value of the cisco-av-pair RADIUS attribute. This overrides the WLC default setting for External Webauth URL. You can also set the url-redirect-acl to match a named ACL on the WLC.


4

Based on this Configuration Guide, it would appear to only support one portal. I don't know if there's a way to specify the SSID (network) to the portal page / WLC. (I've never needed to. [it's in the wlan query param]) Update: Apparently 7.3+ can, but it's a lot more involved. "Assigning Login, Login Failure, and Logout Pages per WLAN"


4

Turns out this is a bug and is on file already with Cisco. From Cisco TAC: A bug has already been filed on this type of scenario. Here is the bug ID- CSCuo44475 This should be addressed starting with the 8.0 FCS / 7.6 MR3(7.6.130.0) releases - i.e. at that point you should be able to download the applicable k9w8 image, install it on the AP, and then join ...


4

The easiest way to achieve this would be to separate the clients into different SSIDs/WLANs. Place the clients who need addresses from the Built-In DHCP server in one, and the clients who need addresses from the External DHCP server into another. This way, you could point the Proxy DHCP server IP address wherever you need it to go depeding on which ...


4

I know this is an old post, but the best way I could find to automate the backing up from my controllers was to use SNMP in a script run from cron. snmpset -v2c -c <snmp_RW> <WLC_IP> .1.3.6.1.4.1.14179.1.2.9.1.1.0 i 1 snmpset -v2c -c <snmp_RW> <WLC_IP> .1.3.6.1.4.1.14179.1.2.9.1.2.0 a TFTP_Server_IP snmpset -v2c -c <snmp_RW> &...


3

I do not want users to use their windows credentials (so they do not connect phones) - Users are not allowed to know the password (same reason) As you mentioned Windows and ACS, you can still use user credentials via dot1X and not allow them to connect via phones. As long as you're doing Machine auth in ACS and requiring computer authentication in Windows ...


3

WLCs are NOT Radius Servers, you need an external Radius server and then point the WLCs to it The page you are on right now is to configure credentials to actually be able to query the external radius server: IP Address & Ports, Shared Secret, and other connectivity options. Cisco Radius servers are called ACS (secure Access Control System) and to ...


2

Take one copy of each of your AP models. You DO have one of each in a lab, right? (If not, you need to push to get this budgeted.) Connect them to your WLC so they get the updated code. Console in, download the image for each model. TFTP the appropriate image to each AP worldwide*. Be aware this is going to suck if you don't know how to automate SSHing ...


2

Was looking for some other stuff and ran across this post. A few suggestions/thoughts in case anyone else runs across this. On the DNS issue, agreed, it can be a pain in a larger environment to assign all AP's to one Controller. You could potentially use either IP Anycast for this, if you've set up your management networks for Anycast, or use round-robin ...


2

As @Mike Pennington suggested, Cisco Prime would be the best all-around-solution for monitoring Cisco LWAPs connected to Wireless LAN Controllers as you gain much more than just a simple ping alert mechanism. Wireless requires a systemic view that considers not only individual APs going up and down -- and any good wireless deployment has allowances for that ...


2

You will have difficulties towards configuring dhcp on the dell 5524 which is a layer 2 switch. A good switch in my experience, but it isn't a layer 3 switch. You should use a layer 3 switch that provides the wanted dhcp options and/or relay the dhcp packets from your 5524 to a dedicated dhcp server (*nix dhcpd or window$ dhcp). See this link for some more ...


2

You can connect each AP to the controller directly, because you only have two APs and you happen to have two distribution ports on the controller. If you wanted to connect more than two APs to your WLC4402 you would need a switch. The ports that "are not ethernet" actually are ethernet, but you can't plug any cable directly into them. They're called SFP ...


2

You are both somewhat right. In general, there are two reasons to use a VPN from a remote location: Security. Encrypt traffic over the internet. This is always a good idea. Reachability. If you're still using IPv4 (like everybody else), you're probably using private (RFC1918) addresses at one or both locations. The VPN will tunnel traffic across the ...


2

Looking through the configuration I now see the problem. It was also hinted at in the screenshots you provided, but I missed it until I saw it in your configuration. WLAN 1, your normal production WLAN is not configured as a FlexConnect WLAN. WLAN 4, your -Test WLAN is configured as a FlexConnect WLAN as indicated below: wlan flexconnect local-switching 1 ...


2

While introduced in 8.3, the feature combination does not work until 8.5 code train.


2

Although this seems to be an AP-based rather than WLC-based command, it would appear you can get the info you want from the AP CLI through show controller dot11radio1 The output includes a section called "DFS Blocked Frequencies" which should be what you're looking for. See: http://www.cisco.com/c/en/us/td/docs/wireless/access_point/12-4-25d-JA/...


2

It's right there in the footnote: Arbitrary port number is assigned to every AP from range 1024 - 65535 when the AP joins the WLC. The WLC uses the number as the Destination Port for CAPWAP Ctl/Data as long as the AP is connected.


1

The WLC uses the number as the Destination Port for CAPWAP Ctl/Data [...] In this context "Ctl" (Control) is the management traffic between the A.P. itself and the controller (pushing configuration, gathering information, firmware updates, etc...), and "Data" is the data streams from the wireless clients connected to this A.P. So when ...


1

CAPWAP is an application-layer protocol for wireless management. It's got its own DTLS encryption (in what you may call a sublayer). Usually, CAPWAP runs over the wired network between the wireless controller and the WAPs. If you run it over a (probably separate) 802.11 link, the encapsulating frames are additionally WPA2/3-encrypted on the data link layer.


1

Most of what you are looking for is explained here : http://www.cisco.com/c/en/us/products/collateral/wireless/aironet-1130-ag-series/qa_c67-714540.html There is no HW difference that I'm aware of, however if you buy an -HA version of the controller, it can only ever be an HA controller, you can't convert it to be a primary controller, whereas the reverse ...


1

The WLC should connect to a switch via ethernet. Normally it is configured using a trunk so that you can have multiple VLANs: one for the WLC management address, and one or more for the various SSIDs the LWAPs will use. The LWAPs will connect to switches closest to where they need to be, and they will get their addresses, and the address of the WLC, from ...


1

The redundancy management address is only pingable if the controller is configured in SSO mode.


1

What Avery has said is correct. Assuming you mean NTP Servers for wireless clients, that would have to de bone through DHCP. You could only assign an NTP Server statically for the Wireless LAN Controller itself. Regarding the new WLAN implementation, if you want to use new VLANs, new dynamic interfaces have to be created on the controller in order to ...


1

You can do this with Cisco ISE. The idea is that your users get assigned different guest types, and ISE will return an ACL name to the WLC depending on the guest type. You would then tune the ACL on the WLC to allow access to whatever resources are appropriate. Nevertheless, I would tend to agree with Ron Maupin's answer, in that you probably want to ...


1

I think you are looking at this incorrectly. Typically, you would have multiple SSIDs, including one for guests. The VLAN for the guest SSID would only be allowed to be routed to the Internet, while other SSIDs would be on networks which have various internal access restrictions, or not. Often, 802.1X is used for such authentication, but there are other ...


1

To get the RSSI of connected clients, you will need this OID: .1.3.6.1.4.1.9.9.273.1.3.1.1.3 In regards to graphing the information every 5 or 10 seconds, you could use monitoring software like Cacti to achieve this. References: Cacti Forum - Client Table RSSI value for your clients. Cisco Forum - Signal Strength (dBm) ipswitch - Signal Strength Cisco ...


1

If you're open to a commercial solution, SolarWinds has a fairly good wireless monitoring portion in its Network Performance Monitor product that includes a pre-built alert for thin AP's going down. Some information on its wireless monitoring is here.


Only top voted, non community-wiki answers of a minimum length are eligible