Cisco :: Client Looking To Segment Traffic Via SSID Using 2504
Nov 28, 2012
I have a client with a WLC 2504 that wants to route "guest" users through a gateway appliance "radiusgateway.com" and all others through the network. It appears to me this would require the use of two fa ports on the WLC. One directly connected to the radiusgateway (which is connected to a switchport) and the other fa interface connected directly to a switchport bypassing the proxy server.
My issue is, "how do you segment the ssid traffic via the WLC". The interfaces cia the gui aren't that intelligent, there's an enable and logging drop down. Via the command line, I didn't see any methods of routing traffic.
I am currently working on a project which purpose is to establish a TCP connection between a PC and a microcontroler.I configured (in C language) the µC as the server, and the PC as the client (in C#, using the TCPClient class).While running the codes, I capture the frames on the network with Wireshark.The client's ISN is chosen randomly by the TCPClient.Connect method.Since there will be only one TCP connection at a time, the server's ISN is always 0.The server's port is 0xC0C0 (49344) and the client's port is also chosen randomly by the TCPClient.Connect method.find the screenshot of the Wireshark's capture attached.In compliance with RFC793, the three-way-handshake should conclude with an ACK segment from the client.In my exemple, the client tries to connect three times, and then drops : the client sends no ACK segment.The µC's SYN-ACK reply may be bad configured .What kind of information did I miss ? Are there special data the client is expecting ? Why don't I get back an ACK segment from the client?
I was asked to enable netflow in an ASA Firewall for Orion/Solarwinds server monitoration. Firewall is a 5550, with 4G RAM, and no extra modules but SSM-4GE. This firewall has 5 DMZ segments and ans specific segment for internet traffic.There are segments as unique subinterfaces in physical interfaces. Other segments as individual subinterfaces in the same physical interface (but individual VLANs)Usually firewall CPU flows between 30% to 40%. Rarely to 50%.
1 - How dangerous or risky could be implement netflow in this firewall?...This firewall is very critical for the customer. My concern is regrading CPU, traffic generated, memory, etc
2 - In a month, firewall will be migrated from 8.2 software version to 8.4 software version. Is there any incompatibility in some commands?...Would be recommended to perform netflow configuration after software upgrade?
3 - How could it be implemented for Orion monitoring, regarding each individual sub-interface (and so, each VLAN assigned)?I there any recommendation regarding configuration, best practices?
I am using Cisco WLC 2504 for provisioning Wireless Connectivity over my Wired Environment. Have deployed 4 Access Points spanning my entire campus as per Customer Requirements. Created 10 SSIDs for Different Networks. Would like to know if there is any possibility of Broadcasting say a particular SSID XYZ on only two or 3 Access Points and keep broadcast disabled on Others.
integrating the authentication on these SSIDs using Active Directory Domain Credentials.
My customer need creates some separately web portal for some SSID (Guest and Staff), 01 web portal for Guest and 01 Web portal for Staff. Can WLC2504 can support this features ?
Both locations are routable using network 1 at each location. However, I need to configure several access points and send them to location 2. These access points will communicate with the controller at location 1 on network 1. Two SSIDs will need to be on network 1 at location 1. The other SSID will be on Network 2 at location 1. This network is not routable.
We are deploying 3600 AP's with a 2504 and would like to create multiple SSID's that are mapped to unique VLANs so we can control the traffic at the Firewall. We have the 2504 up and running with AP's but there appears to be no where in the 2504 controller Web GUI to configure a VLAN mapping to an SSID. Any pointers to documentation on how to configure?
I am seeing a lot of client has joined profile XXX in the logs, and the customer has been saying the PC's are dropping constantly and take up to 5 minutes to reconnect.
I found a lot of Auth flood signiture hits, and disabled the signature as a temp test. I also had one WPA WIC error on one AP. The Auth sig was deteced on several AP's at one time.
Now the question, is it normal to see Clients joining like this, and does the auth flood disable the AP for a short period?
Is it possible to use this feature on WLC 2504 ? ( Passive client feature). I found just this note :" The passive client feature is supported on Cisco 5500 and Cisco 2100 Series Controllers. "
I have Issues with Wifi radius Autentication.we uses cisco 1140AG access point, which is used in Standalone mode issue we face is,only Several Laptops not able to connect to wifi , But in all laptops SSID "wether" is broadcasting. signal strength is full. But it was not able to connect,If AP settings are wrong then all clients should not connect, since few clients connected it ruled out AP config errors,We uses ( WPA - Enterprise + tkip ) settings , clients mostly windows 7.Windows 7 settings also cannot be wrong, since it is globally pushed via GPO for same Wifi settings.i totally cant understand this scenario.when i checked the radius logs, i am not able to see any logs for the client since it is not associating, SSID is fully broadcasting in Laptop with full coverage. but just not connecting..
I recently setup a 2504 WLC that has two primary WLANs (internal and guest) which get their IP addresses from a central DHCP server using the local router's broadcast forwarding. Things seem to be working well for the internal wlan, but clients on the guest wlan don't seem to be getting IP addresses. If I give the client a static IP they are able to communicate across the wlan okay.
It is worth noting that I am using LAG between the controller and router and this guest wlan is really just a regular wlan (with PSK) that has an access-list applied to force it to the internet only. The access-list should be allowing dhcp requests through, but in any case, I removed the access-list and it made no difference.
Here is a debug client for a machine connected to the guest vlan (vlan 33). The internal wlan is on the 10.10.10.0/24 network (same as wired and same that the AP's are connected to) and the guest wlan is 10.33.0.0/16. I don't understand why I am seeing the dhcp request come from the internal vlan/ wlan first and it gets an IP address on this network. I then see a request on the guest wlan/vlan at which point it appears to get a valid IP address on the guest network (10.33.0.0), but the client never sees this. [code]
i've been looking for a way to isolate clients on a Cisco Aironet 1121 on a certain SSID, and i cant find anything, tried pretty much everything i coudl remember, but since im no expert on Cisco wireless.
Quote:
Cisco IOS Software, C1100 Software (C1100-K9W7-M), Version 12.3(7)JA1, RELEASE SOFTWARE (fc1) Technical Support: [URL] Copyright (c) 1986-2005 by Cisco Systems, Inc.
I use two wlc 4400 (4.2.x version) with a mobility domain and one ssid, both wlc are connected to a cisco l2 switch infrastructure. On the wlc I use the p2p blocking action 'drop' [URL] to isolate the clients from each other. Does only unicast traffic is blocked or also multicast and broadcast traffic like arp requests?Concerning blocking p2p traffic of clients connected to the same ssid but different controllers I found the following statement in the LAP FAQs [URL]
Q. In autonomous APs, Public Secure Packet Forwarding (PSPF) is used to avoid client devices associated to this AP from inadvertently sharing files with other client devices on the wireless network. Is there any equivalent feature in Lightweight APs?
A. The feature or the mode that performs the similar function of PSPF in lightweight architecture is called peer-to-peer blocking mode. Peer-to-peer blocking mode is actually available with the controllers that manage the LAP. If this mode is disabled on the controller (which is the default setting), it allows the wireless clients to communicate with each other through the controller. If the mode is enabled, it blocks the communication between clients through the controller. It only works among the APs that have joined to the same controller. When enabled, this mode does not block wireless clients terminated on one controller from the ability to get to wireless clients terminated on a different controller, even in the same mobility group.
what's the best practise to prevent this inter wlc client traffic? I already read about using acls on the wlc dynamic interfaces, or private vlans on the l2 switch vlans where the dynamic interfaces are connected to. Is it allowed to completely isolate the wlc from each other on these dynamic interfaces with acls or private vlans or do the wlc need to see each other on this interfaces (e.g. heart beat)?
I have been trying to conect a Cisco VPN client through an ASA and it makes the connection but doesn't allow any traffic through. The ASA does have a site to site VPN attached to the outside interface.I suppose the first question is it possible to allow VPN client to connect through an ASA 5500 from the inside network when there are Site to Site VPN's already attached to the outside interfaces?If possible then what have I missed. I have tried adding NAT exempt for the traffic between the internal networks and "an IPSEC pass thru Inspect Map".
I have a few ASAs with L2Ls in a hub-and-spoke fashion, works great. All ASAs are 8.2(1). I've tried to add remote-vpn to the HQ ASA. I have this working on a PIX 6.3 box at HQ, but have not been able to make it work completely on the ASA.
Just to check, I also set up remote client vpn access on one of the spoke ASAs, and that actually did go well. Applying the equivalent config on the HQ ASA - won't function.
The problem with the HQ ASA remote client vpn is that after completed phase 1 & 2, the traffic goes one way only, from client side towards the ASA. I e remote side only encaps, no decaps; ASA side only decaps, no encaps. If the remote client pings a host on the inside (i e behind the HQ ASA) the packets arrive, and are returned towards the ASA (a correct route for the remote vpn network is in place on the inside host). However, it seems as if the ASA doesn't send that traffic back into the tunnel, but rather sends it unencrypted through the default route (doing a traceroute from the inside host for instance suggests this).
The ONLY way I can pass traffic towards the remote client is by initiating a ping from within the HQ ASA, it's the only time I get encaps on the ASA side and decaps on the remote side of the tunnel. Interestingly, it's actually the "ping outside 192.168..." that works, doing an "inside" ping fails. Compare this to the spoke ASA and its remote vpn client, there an inside ping is succesful, but not a outside ping, i e the spoke ASA functions as expected with its remote vpn. Given that the configs on the two ASAs are the same for remote client access, I would have expected both to work, not only one of them. But then, the HQ ASA has more lines of code, and I guess that something there gets in the way. [code]
i already created a vpn server on my 878 router.. so that i can connect with ip-sec (cisco vpn client) to this router and network..
all working great... however... when i also want to allow multicast traffic over my vpn connection. do i then need a GRE vpn? or what?or is this only needed when you use a site to site vpn..?And how can i enable this?
We are in middle of deploying WiSM2s on our network, from a design point of view i am confused on where to position the WiSM2s. We have 2 DCs and from best practice architecture view WLC should not be placed on the Data Center segment, but it seems that is the only option i have.
DCs host 6509s, i am planning to host 1 WiSM in each DC, all clients will be on seperate subnet. Do you foresee any issues with this deployment or any security issues? authentications are followed as per cisco recommendation, clients authenticated against AD through ACS so it is fairly secure.
I have a standard switch with a server two routers one for data one for VoIP Server is dhcp and dns, all clients are auto configured from the server - all is good.I want to share my internet with anouther business - in the same building I have added a Ethernet router with a different ip range and this router is their dhcp server with its own private LAN This router has been connected to our LAN via the the Ethernet router wan port Works fine, but all clients on the new private lan can ping and see the LAN behind the wan port of the Ethernet router and can ping them, in some cases certain files can be seen?
The default Gateway and DHCP server is connected to port 1 of the switch. I have various other devices on the network plugged into other ports on the switch.I want port 1 to communicate with every port on the switch, but don't want the other ports to be able to see eachother unless I specifically allow them to. For example, port 5 should see port 1, and 7, but nothing else.Everything needs to be in the same subnet. With the older Dlink switches I am used to this feature is called "Port Segmentation" but I see no such option in this switch. I have been playing with the VLAN settings but so far I have not been able to achieve this.
I have been having a heck of a time trying to configure my 5505 to allow the second segment on my network to use the internet. Office 1 has a fiber internet connection, and all traffic flows fine. Office 2 had gotten it's internet from AT&T, via a network based firewall injecting a default route into the mpls cloud. both offices connunicate to each other through the mpls.
When we added the fiber to office 1, we had the mpls people change the default internet route to the inside address of the 5505 and things worked fine. when AT&T attempted to remove the NBF defaut route, and inject the 5505's address as default, things didn't go so well.
AT&T claims that it is within my nat cmmands on the 5505, but won't tell me anything else. I assume that they are correct, and I assume that I am not good enough with the 5505 ASDM to tell it what to do.
Office 1 uses 10.10.30.xx addresses and Office 2 uses 10.10.10.xx - the 5505 inside interface is 10.10.30.2 the internal interfaces of the mpls are 10.10.30.1 and 10.10.10.1
I have ASA 5510 8.4 Firewall where more than 20 Site to Site VPN Clients are configured on it. how to see the traffic for one Specific Site to Site VPN.Actually this site to site vpn is always keep dropping for every minute. I'm sure its a problem at the other end.The remaining 19 VPNS are UP and working without any problem. How to see the traffic for specific vlan.More over we dont have any syslog server in our network. Is their any chance we can check the traffic on the firewall?
I have an ASa 5510 and setup remote dial in users.
I wanted to use the windows 7 built in client and also the draytek site to site VPN options however when they connect VPN traffic will not work however when i use the cisco VPN client then everything works fine.
All the VPN's connect pretty quickly.In the syslog I a getting errors when i try and ping something: [code]
I am using a RV110W as a VPN client to establish a VPN conection since some months. So far everything works fine. But all traffic is routet thru the VPN tunnel. Now I try only to route specific adresses thru the tunnel but not the internet acess.
RV110W is in Gateway mode WAN interface is connected with internet I am using PPTP with PAP and MPPE for VPN so far no static routes (I could not set e.g. a route to 0.0.0.0 because web-interface says its not a valid adress)
Goal is to route only traffic for the target network thru tunnel and the rest direct via WAN interface.
I have a web application behind a SSL-offloading CSS 11506 that may require the server to be able to use a SSL connection as soon as it is established. At least I'm troubleshooting a problem that is starting to look like this is a possibility.
The default behavior seems to be to not start the SYN/SYN-ACK sequence with the real server until the client starts talking first (such as send an http get request), even though the SSL termination part is done and ready.
Any way to change this behavior? The scenario is a webapp. Client side starts more than one SSL session to the server, but only uses one immediately. The client knows it has more than one connection and may have told the server so. Like a control plus data channel(s) arrangement. The client opens all the connections (full SSL handshake on all channels), starts using the control channel, and expects the server to start talking on the data channel. However, since the client hasn't sent anything down that TCP connection first... the server doesn't have it.
I don't think this would occur when the server is doing the SSL... as it should have all the TCP connections as soon as the SSL handshakes are done.
WAN link plugs into a 2821 Router with an switch module in it. About 8 clients are plugged in to the 2821.2821 connects to super cheap netgear switch (I'm 99% sure it's stripping dot1q headers) via one of the ports in the switch module. About 4 people are connected to the netgear.Now, I sent a catalyst 3560g to the branch because they wanted to extend into a new building. Someone decided to run a single cable from the netgear to the 3560. On the 3560, I have about 5 clients and a couple of APs.
So it goes 2821 -> Netgear -> 3560. All of these are single connections.When the 3560 gets plugged in, all clients on the netgear lose their connection, and nothing on the 3560 works. It happens almost instantly. I can't figure out why connections are dropping. The APs have about 4 VLANs onn them, and the PCs are on their own VLAN (the native VLAN).
We have an OSPF network with four 6500 Distribution Switches. They are fully meshed and see each other as peers and are sharing routes. Off of one pair (Border) there is a setup of 3750G siwtches that go off to another network and they do not run OSPF. Between the Border Dist and the 3750G Switches we run HSRP. The 3750G side uses HSRP GP 192 and the Dist Side uses HSRP 192.There are static routes on the 3750G pointing to the Dist HSRP address to get back to network.Pings fail from the OSPF side to the HSRP address on the 3750G side.If I do a trace from the OSPF side to the HSRP address it hits one border dist switch then the other and fails.If I have static routes on both border dist switches pointing to the HSRP on the 3750side, do we need to change the metric on one dist so that it is preferred over the other or should the router Id take care of that?
i have a strange issue with an HSRP Setup. I have two (S1+S2) 3560 as Core/Distribution Layer. Inter-vlan routing are enabled on both Switches. S1 and S2 are connected with an ether channel over four fibre ports. S3 -S5 are the (L2) access layer.
Gi0/1 on S1 and S2 are L3 ports, connect to a Linux Firewall.
HSRP is enabled, S1 is the active router and the STP root bridge.
But, my monitoring via cacti show me, that the Gi0/1 on S2 is active, too! But it should not be active? Only if S1 fails, should S2 the active switch.A client from the access ports on S3 - 5 gets traffic from the Internet via Gi0/1 from S2. Gi0/1 on S1 is active too, but will send mostly traffic to the Internet. Why is S2 active and why route it traffic from the Internet to the client?