Cisco :: 5508 / NCS Prime 1.3 Controller Audit Status Mismatch?
May 14, 2013
When performing an audit from NCS Prime 1.3 on our 5508 controllers (500 lic) we are getting mismatch messages from many of our 3602i AP's that say the following...
(Type)Configuration Name Audit Status Attribute Prime Infrastructure Value Controller Value
(AP APname, Interface) 802.11a/n Mismatch Spectrum Intelligence true false
These AP's are not configured as Spectrum Intelligence on the controllers, rather as local. It seems that NCS believes that they are supposed to be SI. We have refreshed the config from controller many times but this does not change. The 5508's run v.7.2.111.3 Is there a change I can make on NCS or otherwise to make this mismatch go away? Is this a bug? It is not causing any problems (that we can see) but as most would rather not have these mismatches.
ive just installed Cisco Prime LMS 4.1 on a Windows Server 2008 machine. when i try to open some features. like topology or the VLANs configuration options in the configuration menu i get the error HTTP STATUS -500 and this:
type Exception report message description The server encountered an internal error () that prevented it from fulfilling this request. exception javax.servlet.ServletException: Servlet execution threw an exception
Seen Duplex MisMatch errors on a N7k with a LAG going to the 5508 WLC? WLC code is 7.0.203.0. I found a BUG that is private to Cisco ( CSCth11041 ) that looks like it, but I want to make sure.
I have a customer with two WLC 5508's running 7.0.116.0. When I look at the RF Grouping I see both controllers in the 802.11b/g/n section (802.11b>RRM>RF Grouping). However, when I check the 802.11a/n RF Grouping, I only see one controller.Both are in Group Mode = Auto.
I also made sure they had the same NDP settings, and they are both in Transparent mode.
Default 802.11a AP monitoring 802.11a Monitor Mode........................... enable 802.11a Monitor Mode for Mesh AP Backhaul...... disable 802.11a Monitor Channels....................... Country channels 802.11a RRM Neighbor Discover Type............. Transparent 802.11a AP Coverage Interval................... 180 seconds
For guest clients , we have configured guest vlan and applied external web authenication on WLC 5508 , the session timeout value is 2700secons . When a client open a browser to internet page , wlc will redirect to URL and get the login page . After completed the login , he can go to internet page . We find the iPhone and ipad clients will get the login page again ahfter ~ 5 mins , it is mismatch with session timeout value 2700 sec (45 mins) .
I know that the 3600 series APs are not supported on the 4404 WLC. However, would the following scenario be supported? I would like to use the 4404 (software rel. 7.0) as a guest anchor with a 5508 (software release 7.2) as the foreign controller supporting series 3600 APs. I ask because the APs do not need to join the guest anchor.
We have a customer that have 2 5508 as primary and backup controller and a 4400 as an anchor controller. We plan to upgrade the 5508 to 7.3.112.0 and the 4400 is already 7.0.116.0. Will there be any issue if the anchor controller is not the same code as the foreign controller? Do I also have to upgrade the acnhor controller to 7.0.240.0?
I can't find any information that the AP1231G-A-K9 AP is supported in a 5508 Controller Based environment with Prime NCS.Could one of the experts confirm or deny?
I want to set up AP 1552 as outdoor access point so serve clients. This AP is connected to 3750X switch and recieving power over ethernet.Now, by default AP 1552 come with bridge mode and it cannot be changed to local mode. I read on one of the post and made it ROOTAP but still the OPER STATUS is down. This device is already registered to my WLC.
what needs to be done to bring the AP in operational status.[code]
I have Prime 1.3, two WLC 5508 and 8 switches 2960s I try update my devices through Prime, but I can't.
When I start "Upgrade Analysis" and select switch (Catalyst WS-C2960S-24PS-L) and image (c2960s-universalk9-mz.150-2.SE2.bin) then click to "Run report"
Prime shows me that "Image not Applicable for this Device" I try different images, but it does not work.
And with WLC 5508 the same trouble. Why Prime can't do right analysis and updates devices?
I have newly deployed a Prime Infrastructure (PI) in my network, and i want to add my wirless controller in it. I get an error SNMP time out whenever i add my controller to PI through SNMP.
There are default SNMP configurations in the controller and i am simply adding them in PI with their private/public SNMP string.
WLC 5508 is connected to my core switch and PI is connected to another switch which is directly connected to core switch via Layer 3.
Is there any configuration required to be done on the switch side.?
We are going to implement high availabilty in 5508 WLC with version of 7.3.101 . We will be using Prime infrastructure 1.2 for monitoring purpose.With Prime, whether we can monitor and manage redundant WLC also or only active WLC?.
I am looking for a "no marketing babble" explanation of what exactly Cisco Prime Infrastructure does, that the built in 5508 Wifi administration console and Cisco Network Assitant does not do.I already use the "Cisco UC560 Configuration Assistant", the "Cisco Network Assistant" for our switches, and the "Wifi 5508 web admin console", and I am fine with that.At another site where I work, that is now going with Cisco Wifi, it is suggested that "Cisco Prime Infrastructure" be purchased.Is it important to me to have a "single pane of glass" view of the entire network? NO IT IS NOT.
All this marketing babble about having everything converged and accessible for mobile BYOD users. Yeah, that's great, but what is Cisco Prime Infrastructure actually going to do about all the mobile wifi devices coming in to the network that MUST use a web proxy to get out of our network? Many don't deal with proxy.pac correctly or don't read it at all, unless that function is explicitly turned on, by the individual device owner, in an often hidden location in their device settings. I am mainly looking at the $3000 a year price for Prime Infrastructure and going, no way, the Cisco Network Assistant and 5508 Wifi web console that are thrown in for free with the new hardware is fine with me.
I'm looking for getting a Cisco prime NCS appliance (PRIME-NCS-APL-K9). I'm a little bit confused regarding to the license scheme:
1. Does the appliance has any license coming with it or we need to order the license separately? 2. If I have an WLC 5508 (license support 12 APs) & 12 3500 APs, then number of devices counted will be 1 (WLC) or 12 (APs) or 13 (WLC + APs) ?
Is there a way to change the timeout for the Client Excluded: MACAddress status? It seems like the exclusion is rather short. I'd like to have the ability to control the exclusion time. Using WLC-5508 7.0.116.0.
We are currently running WCS but have built a new Prime Infrastructure 1.3 system from scratch on a brand new server, we have sucessfully migrated the old WCS database on to the new Prime server and as a test I have pointed 1 anchor controller to it. Possible to point the WLC's to both WCS and Prime Infrastructure concurrently - I was thinking that it would be a quick fallback if we has any problems with Prime (I know there have been some!) We are not running MSE but we do have mobility groups, the WLC's are 5508 running 7.0.235.3 .
I'm trying to do configuration archiving in Prime Infrastructure 1.2 with a 5508 WLC (7.4).The job always fails (Admin -> Background Jobs) with the following error (see attachement):"SNMP: Failed to establish SNMP connection xxxx - Cause: Device is Unreachable. Check the ReadOnly community string." I double checked the SNMP credentials, they do match. For testing I also added a Public community just for the PI. Same result.Am I missing something?Is this not intended for Wireless Controllers?
I want to use a 5508 as an anchor controller for a wireless guest deployment....but the client has internal 4402's controllers, with software version 7.0.235.0...is it possible tu mix these two controllers for a Wireless Guest Access Deployment??
A wlan on my controller is configured for WPA2, AES encryption and a PSK. A vendor will supply me with a wireless device for this wlan. The vendor asks if we use AES 128 or AES 256. I had always believed we use AES256 but I can't verify this. How can I verify this to the vendor?
Seems that all solutions are null and void for us because we are not using SNMP v3 or H.
We are using SNMP v2, We have upgraded our WCS to latest version as well as the controllers. I have 6 controllers currently added although they are on WiSM blades.
We are unable to add the 5508 Controllers, we keep recieving this error -
No response from device, check SNMP communities, version or network for issues.
I have confirmed all connectivity is working, even with a debug on the controller you can see it sending SNMP packets to the WCS, although still same error.
I have a wireless controller 5508 and all my interfaces can be accessed via https or ssh from a wireless client. Management access from a wireless client is disabled so I don't understand why this is happening.
We have a customer that is looking to allow only static IP addresses onto the wireless network via the new 5508 we are putting into place. I can see where to require DHCP but not the opposite.
I have a 5508 controller at our headquarters and am installing some 3502 AP's at a remote branch. Unfortunatly, the remote branch has a different Vlan setup for some reason and the vlan that is used for the WLC (90) is designated for telephony at this branch. Can I put the AP's on a different VLAN (10) without having any issues? I will still use DHCP option 43 to point them back to the controller. Below are the configs for the WLC interfaces and what I am proposing for the AP interfaces:
Issue 1: I have been trying to configured Webauth bundle however it seems that is not working.
1. login.tar created use picozip contains 3 files: login.html, terms.html, and logo.jpg. 2, uploaded via FTP to controller successfully.. 3, no issue when i tried to preview on the controller
However users unable to see the login page when connected to guest wifi. when the user tried to connect cisco.com, on the browser address shows that the page redirected to url... however internet explorer / firefox display "Connection reset error".During this time, if i ask the user to type url... they can see the default login page, so no issue on connectivity to the service port.
Issue 2: Since i couldnt make that work, i have use default webauth internal. its all good. then when i tried to upload customlogo.jpg (18k size). User able to see the login page however not the logo. it shows broken image icon on the web browser. --> i can see the logo when i did preview on the controller.
Issue 3: last resort if i couldnt get the answer by sunday, how do i delete or remove the customlogo ?? so by monday users will not be seeing any errors on the page.
Cisco 5508 Series Wireless Controller for up to 100 APs 802.11a/g/n Ctrlr-based AP w/CleanAir; Ext Ant; E Reg Domain..For Mobility i want to settup the device such that the SSID would be the same with thesame security key and in different subnet.
I can not get our 3602i AP's to register with our 5508 controller which is running 7.2.103.0 code. We keep seeing an error in the log on the WLC "AAA Authentication Failure for UserName:c46413c08e92 User Type: WLAN USER" and on the Access Point we are seeing [code]
I entered the CAPWAP ap controller ip address directly into the AP so it shouldn't be an option 43 DHCP issue
I use WLC 5508 (ver 7.0.116.0) with aironet 1140. I need to connect my APs to different controller .After log in via ssh to AP i am trying to do:
capwap ap controller ip add x.x.x.x reset
But after reload, AP is still joined to the old WLC. So another idea was to log to that WLC and put:
config ap primary-base WLC2 AP_NAME x.x.x.x
and after that:
config ap reset AP_NAME
But still nothing, it's joined to another controller although "show ap client config" shows that primary-base switch is x.x.x.x ?How can i force it to join to other controller?
We are looking to upgrade our 5508 wireless controller from 7.0.98.0 to 7.0.220.0. Reason being, we have experienced a lot of access points disassociating from the controller as well as client authentication issues. Upgraded from 7.0.98.0 to 7.0.220.0 and any issues during the upgrade or after the upgrade?
We have a WLC (5508) in our main office in Brisbane that is hosting two WLANs. One provides wireless access to our internal network and the second provides wireless guest access. The guest WLAN is anchored to a controller sitting in the DMZ at our Data Centre.
In the DMZ the anchor controller has a management interface and an interface in the DMZ for the wireless guest access. I am using the DHCP server on the anchor DMZ to provide IPs etc to wireless guest clients. The default gateway is 10.8.144.1 which is a VIP or a pair of firewalls.
Initially everything works fine. Guests connect to the guest network, have to authenticate via a web portal (Cisco ISE server) and then can go on an use the internet. Works perfectly until the firewalls fail over and the secondary firewall takes over the VIP address. All access to the internet is lost at that point. If I try to disconnect and then reconnect a wireless client it connects, as in it will get an IP address, but DNS resolution stops and I do not get redirected to the web auth portal. If the firewalls are failed back to the primary then everything works again, no issues. However, if I reboot the WLC while the secondary firewall has the VIP IP everything will work fine as it did on the primary. If the firewalls now fail over to the primary again everything goes to ****. Until either the firewalls are failed back or the anchor WLC is rebooted.
Initially I thought this was an issue on the firewall, but this doesn't appear to be the case. When the firewall fails over it sends out a gratuitous ARP advising of the change in MAC address for the 10.8.144.1 IP address. The WLC seems to update its ARP table because if I run the command "show arp switch" it has the 10.8.144.1 IP address with the MAC address of the active firewall. From the client perspective I have run a wireshark and captured packets on the wireless interface when trying to connect. The laptop is continuously send ARP requests for 10.8.144.1 but gets not reply. Without this the client cannot send an ethernet frame to the gateway and hence get to the DNS server and WEB portal. Internet access breaks. Doing a TCP dump on the active firewall shows it receiving and then sending a reply to the ARP request. It just never gets to the wireless client. Debugging ARP packets on the anchor WLC seems to indicate that the controller is receiving the ARP replies from the firewall. So I'm at a loss as to why things should break when the firewalls fail over.
I have a 3750 switch in the DMZ with SVI of 10.8.144.4. I thought I could get a work around where I would make this the default gateway. The theory being that this interface MAC address would never change. However I was wrong. Even with this IP set as the gateway address for the wireless clients I see the exact same bahaviour when the firewalls fail over. I can't explain it other than to say that the gratuitous ARP sent by the firewalls seems to kill the ability of ARP replies to be sent back to the wireless client.
I'm a trainee in Network and Telecommunication, and I have to do a "model" with a controller, an AP, and a RADIUS server. Communication and configuration of the lightweight AP has been done.
I use an autonomous access point 1220 as the RADIUS server (no considering it as an AP), and I'm a beginner in RADIUS configuration. I get a "Processing AAA Error 'No Server' (-7) for mobile 00:24:d6:8f:2c:7e" when I launch a debug targetting my PC, connecting to the LAP.
Precursory : 10.137.125.71 is the IP address of the ap1220, working as the RADIUS server 10.137.125.15 is the IP address of the controller. 00:24:d6:8f:2c:7e is the MAC address of my PC, connecting to the Wi-Fi. ping works to the RADIUS, to the controller. Each devices are connected by a layer 3 Switch, and ping each others. The Wi-Fi works when I don't use 802.1X (or when I don't use RADIUS authentication at all)
What I did on the RADIUS server (ap1220 autonomous) :
aaa new-model radius-server local nas 10.137.125.15 key password
Have a controller based depolyment with (2) 5508s and an 1121 ACS appliance running 5.1 code. Controllers are setup identically and we are radius authenticating users to AD via the ACS. Everything works great on the primary controller, but when I test failover to the secondary controller, my authentication fails and I get the following error message in my ACS logs:
12126 EAP-FAST cryptobinding verification passed 12147 Machine Authentication is disabled 12161 Cannot provision Authorization PAC when the stateless session resume is disabled 12106 EAP-FAST authentication phase finished successfully 11503 Prepared EAP-Success
