Cisco :: New WLC2112 Can't Authenticate Anything
Mar 17, 2011
We replaced a WLC2106 with a WLC2112 and the 2112 can't authenticate anything. Both WLCs have the exact same configuration on them. We are using a RADIUS server to do MAC authentication. Both WLCs have been set to use no delimiter in the MAC filtering.
When the 2106 is in place, we have no issues and all allowed devices can authenticate without issue. However, when the 2106 is removed and the 2112 is powered up, every single device fails authentication and is put on the exclusion list. When we check RADIUS, it tells us the devices fail because they are locked. We unlock the device's account, and 5 minutes later the 2112 has screwed something up and they are locked again.
View 3 Replies
ADVERTISEMENT
Oct 11, 2011
Recently I purchased AIR-WLC2112-K9, but when I logged in I saw that system shows only 6 APs supported (I made print screen in addition). I'm running IOS v. 7.0.116.0 and I saw that there was some problems with earlier versions of IOS, but not this one.
View 5 Replies
View Related
May 29, 2013
I'm in the process of trying to get a used LAP1142N access point connected to my already established WLAN. We currently have 7 active LAP1142N, our controller is a AIR-WLC2112-K9, and I am only trying to add one additional access point. I say this access point is used because we purchased it used, given it's not out of the box and hasn't ever been active in my environment. So far what I've tried is initially connecting the access point on to my network (powered over Ethernet) and consoled in from my desktop. With this, I was able to see the previous configuration so I ran a write erase/ reload. The AP shows a solid green light, but doesn't receive any configuration from the controller even when plugged directly in to the controller (on ports 7 and 8). I'm new to wireless, but familiar with Cisco CLI and web interfaces. I can't necessarily tell if this AP is set to autonomous as opposed to lightweight, but that could be the problem. Otherwise I'm lost. I've attached text files with the boot from CLI and show run from CLI.Let me know any additional information you may need. End note, I'm recieving DHCP (you can tell from boot), but it's not the same subnet as my controller or other active access points.
View 5 Replies
View Related
Mar 16, 2013
I have a wlc2112-k9. I have succesfully setup a WLAN with 802.1x authentication and dynamic VLAN assignment. The issue I have (and maybe it isn't an issue and just the way the controller works) is that if the vlan interfaces I have defined are connected to different ports from which the default interface for the WLAN it doesn't work.So for instance, I create my WLAN and set the interface to the management interface (which is connected to port 1). I then define all my other vlan interfaces that could be returned by my radius server.[code]
Port 1 is configured on the switch on vlan 21. If the radius server returns a VLAN ID of 102, 104 or 106 my client successfully connects to the WLAN but it gets put on VLAN 21. However if I move the vlan interfaces above over to port 1 the client correctly gets put on the correct VLAN.All ports on the switch are configured as trunk with the native vlan set to the corresponding value that is set on the WLC.
Is this just the way the controller functions? That it can't assign a client to a different interface that is connected to a different port from the default one setup when the WLAN is created? I would have just though that if the radius server returned VLAN 102 that it would find that interface and connect the user session via that interface regardless of the port it is configured on.
View 11 Replies
View Related
Oct 11, 2009
I'm having a problem configuring local EAP Authentication using CA (Windows Server) and LDAP server. I followed the URL:
[URL]
but it seems that CA has no effect. Any wireless client who has his own LDAP account can access to the network.What I want is just allow some wireless clients to access if they have approved CA before.
View 2 Replies
View Related
Sep 8, 2012
I am implementing wireless lan controller for a customer's site. This site uses Cisco WLC2112 and AIR-LAP1041. I configure via start-up wizard and WLAN security configuration. The client joining via WLAN seems to work fine, able to browse Internet. But when adding a shared printer or sharing files, the machine's unable to find the computer name. When test pinging, it replies when pinging by IP only. This is not happened when using a LAN wire.
View 3 Replies
View Related
May 22, 2013
I have Cisco Access point AIR-CAP1602I-N-K9 ,My doubt is,is this AP support on WLC AIR-WLC2112-K9
View 1 Replies
View Related
Aug 30, 2012
Having an issue with Macbook authentication. All Macbooks at this one site, on same switch, going to same RADIUS server, work except for one. Looking at logs it appears server and client never exchange certificates. Attached is log for failed Macbook authentication.
View 4 Replies
View Related
Jan 30, 2013
I have been trying to set this up for like 4 hours. What a waste of time. This should be as easy as punching in the IP and password for the radius server. It isn't.I have a brand new SG-300-10. LATEST firmwawre, I just updated it about 5 minutes ago. 1.2.7.6 I think.This is what I have done so far in the GUI: (I have CLI access too if necessary)
Security > RADIUS and entered my radius IP/secret there.
Security > Access Management Profiles > Create new template called ALL that permits access to all applications. Set it as active also.
Security > Management Access Authentication > For HTTP and SSH
I put RADIUS first then Local second.My radius server works. As I type this message I am logging in via radius with OpenBSD/Centos even Fedora. (If OpenBSD can do it, these switches can do it.)But whenever I try to login with RADIUS credentials to my switch, I get no logs or any connectivity reports on my radius server? Is the switch even attempting to contact the server? The logs dont show anything regarding RADIUS. I am trying a reboot now, but I don't think that should be necessary.Is there a step I missed? When first looking at this I expected it to be done in 5 minutes. I have been on this for lik 4 hours. Isimply want to login to the administration console (web gui) using RADIUS credentials.
View 5 Replies
View Related
May 24, 2011
I think i've got everything set up to authenticate against AD for Tacacs+ device logins. When i check the logs, i see:"24408 User authentication against Active Directory failed since user has entered the wrong password". This leads me to believe that it is checking AD correctly, however if i enter the password correctly for the same AD user, there is no log at all...no pass, no fail.
If i look at the Tacacs debugs on the switch, i see the following:May 25 10:55:07.927 CDT: TAC+: ver=192 id=874699084 received AUTHEN status = ERRORMay 25 10:55:09.932 CDT: TAC+: send abort reason=Unknown
Obviously the switch is communicating to ACS, and ACS is passing info back to the switch. ACS also appears to be communicating effectively with AD since it knows when i put in an incorrect password for the specific user.
View 2 Replies
View Related
Feb 14, 2012
I am trying to connect using officeextend but couldn't . I have managed to connect the officeextend AP to the DMZ WLC however i cant get the users to authenticte to the ACS (although there is a rule to access the access on ports 1813 and 1812). Should the DMZ WLC need the ACS servers (i thought they wouldnt require as they are anchored back to the Internal WLC that the ACS server address
oon a side note, i have'nt created dhcp for hte officeedxtend users - will this cause an issue - (just deciding on to it on WLC or windows server)In-fact i cant even see myself authenticating on the ACS server
View 25 Replies
View Related
Aug 20, 2012
we have deployed L3 in-band scenario for wireless 2 years ago and the solution was working without any problem. we have upgrade wireless controller to 5508, since then, when users login to the first page and certified, and they want to browse to the internet, NAC redirects the web page and ask for authenticatin again, despite the users' devices are being shown as certified devices in the list.
View 6 Replies
View Related
Feb 9, 2012
We have remote users that dial-in over ISDN to a Cisco 2911. We have configured AAA to pass the authentication off to a RADIUS server. Once successfully authenticated, the router permits the users to access a single web server. However, we need to do some testing in our test environment, but unfortunately we don't have an ISDN line to test with. We have created a little environment in our LAB using a 2911, a switch, a RADIUS server & web server. I was hoping that we could simply create a "user" VLAN off the back of the 2911 to simulate our remote users, and access the web site from the test usr PC's over the LAN. I was hoping that the 2911 would be able to intercept the connection and pass the authentication off to the RADIUS server (as it does with the PPP ISDN traffic). But I cannot find anyway to do this, because I can only configure AAA to offload either PPP traffic or telnet/ssh connections to the router itself.
In summary what I want is for a user to access an internal web site over a LAN interface of a 2911 - but have the 2911 authenticate the user via a remote RADIUS server first. Is there a way to configure a 2911 (or any router!) to do this?Is the answer to configure port-based authentication (802.1X) on the switch?
View 3 Replies
View Related
Jul 30, 2012
I have setup Cisco Identity Service Engine (1.1.1) with Wireless LAN Controller (7.2.110)Everything is complete unless the URL redirect. My guest client can join the Guest SSID and also can authenticate to ISE.But after they success to authenticate with ISE, the URL in the browser doesn't change to the pre-configure. It still be something like [URL]. Anyway the content in the browser is changed to the URL that being configured such as url...How can I do with this situation cause everything is working fine but only the browser URL that is not change to the preconfigure one.
View 5 Replies
View Related
Apr 12, 2013
I have 1142 with W7 (c1140-k9w7-mx.152-2.JB)I have it configured WPA2+AES on the 2.4GHZ interface (Config below)I have my PC and Mac and phoens connected, all good.However I also have a Wi-Fi radio (url...), when I try to connect the radio to the wireless net, I keep authentication failed.If I configure my old Linksys router as the network, also using WPA2/AES, all works.Just something do to with Cisco pass and this radio.I tried TKIP > same but when I tried Tried WEP > working good!.
[code]....
View 21 Replies
View Related
Sep 8, 2011
I am transitioning from RADIUS auth to local auth and i don't want to hassle everyone to change in one hit.If i can get auth requests to look in the WLC local net db first and if not found try RADIUS then this is what i am after! You can easily do it with web auth but doesnt seem so easy via WPA2 method.
View 1 Replies
View Related
Jun 3, 2012
Have set up a pair of ACS 5.3 servers and have set up device administration authentication be passed through to an RSA server via RADIUS. All works great.
What we want to do is go a step further and set the system up so that ACS Administrators also have to authenticate to the ACS system by RSA via RADIUS (the same as the Device Authentication we've set up) for ACS administration tasks.
Looking at the options available in the ACS Administration setup (administrator accounts etc) there doesn't seem to be an option to authenticate via another method apart from a local administrator account on the ACS.
Is it possible to do this?
View 1 Replies
View Related
Aug 21, 2012
I have seen couple of people with win7 cannot authenticate to ISE: 12520 EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate.I've thought of this: Maybe get a 3rd party cert (go daddy) and have that installed in ISE.I know i do have to make a CSR Cert.Sign.Request that matches cn=primary.ise.mydomain, would I also need a cert for secondary?
If I use LEAP as a preferred protocol then it doesn't ask for cert and users are authenticated successfully.I know they have to say do not validate cert and all that but sometimes it doesn't popupt to them they just can't get on.Again maybe going wtih 3rd party certs will make it easier while benefiting from using PEAP?
View 5 Replies
View Related
May 19, 2011
I am trying to configure my ACS to allow 802.11 phones to authenticate. I have searched high and low for documentation on doing this with no luck. We are using unified wireless with a mix of 5508 and wism controllers. I am able to authenticate windows devices against active directory via the acs but can't seem to get anything working with the phones.
View 3 Replies
View Related
Jul 12, 2011
On an ASA5520 v7.2 I can only seem to authenticate to the console when using telnet and not ssh. I can connect using both methods, but just have trouble authenticating with ssh. Here are relevent lines related to the issue:
username user1 password ***** encrypted privilege 15username user2 password ***** encrypted privilege 15
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
telnet <my subnet> 255.255.255.0 Inside
ssh <my subnet> 255.255.255.0 Inside
View 2 Replies
View Related
Jun 9, 2011
I have an issue with an implementation, I had a ACS R5.1 that I'm using to authenticate the wireless users with 802.1x, that's OK and working fine. Now I want to use the same ACS to authenticate wired users using MAB (for IP phones, printers, servers, and other devices) and 802.1x (for corporate users). I already configured the authentication services (MAB and 802.1x) on ACS, but when I'm doing tests I can see that for example the phones are trying to authenticate using the 802.1x rules of wireless connection, not using the MAB rules. [code]
You could also see an screen from the ACS in the attached file. On the picture remark you could see a IP Phone trying to authenticate using the wireless Access Services insted of using MAB.
View 1 Replies
View Related
Sep 25, 2011
Having an issue with Cisco ACS v5.1.0.44 and the Cisco WLC 5508. Cannot get users to authenticate and keep getting error messages referring to EAP session timeouts from WLC filling our logs. Seems to be with this model WLC because we have Cisco 4400 WLCs pointing to the same ACS with no issues. Is there a bug or special configuration that is necessary to marry the 5508 with ACS v5.1.0.44?
View 9 Replies
View Related
Dec 7, 2010
We have a customer with ACS 4.2 Appliances who currently uses the Layer 3 web-redirect guest function to authenticate users against AD via ACS and LDAP to the AD, its a mixture of un-managed Windows, Mac & linux clients.
They want to move to an 802.1x solution.
Now MS-CHAPv2 is proably the obvoius choice (maybe it isnt considering Linux and MAC clients ... comments???). However the only option to integrate with AD is LDAP i.e remote agents or an upgrade to 5.x is out of the question.
View 9 Replies
View Related
Jul 30, 2011
The user "shreedhar" is getting authenticated locally and not through TACACS+ (Cisco ACS 1121 appliance running ACS 5.1).
In the switch, after entering credentials, the switch says, "Authentication failed - login using local mode". (Not the exact message but close enough!).
In ACS 5.1 -> Monitoring and Reports->Dashboard->My Favorite Reports->Authentications-TACACS+, I am getting the following error, "13011 Invalid TACACS+ request packet - possibly mismatched Shared Secrets".
Configuration in switch is as follows:
feature tacacs+
username admin password 5 $1$joEvYokP$5wZ1mtpBlxuoKMEWbFzRY1 role network-adminusername shreedhar password 5 $1$x8u5N4IR$NbVcY1u6CuoXYkMgXs60l/ role network-admin
tacacs-server key 7 "Ti!23456"ip tacacs source-interface loopback0acacs-server test username demo password demo123 idle-time 3 tacacs-server timeout 10tacacs-server deadtime 5tacacs-server host 192.168.31.11 key 7
[code]....
Is #the encrypted TACACS+ shared secret key from switch not being decrypted by ACS 5.1 as it requires a clear-text password? Could it be the reason for the above error?
View 1 Replies
View Related
Dec 9, 2012
We are doing a new installation of a Cisco ACS 5.4 replacing a Microsoft NPS.
Recently I ran into issues with Lexmark wireless printers authenticating against the ACS 5.4.
While these printers work against the old Microsoft NPS we want to replace, I get "11500 Invalid or unexpected EAP payload received" on the ACS.
Windows/Android/iDevices authenticate against the same SSID using PEAP. I suspect, we ran into
CSCtq46211 Bug Details
Lexmark Printers work with ACS 4 but not ACS 5 Symptom: Lexmark printers uzed to work with ACS 4.2 but they produce "internal error" on acs 5.1 or 5.2
Conditions: Not known exactly
Workaround:1st Found-In 5.2(0.26.3)
Fixed-In 5.3(0.40.7)
setting up a new VM with ACS 5.3 patching it to P7, reconfiguring and retest all the stuff we implemented during several days ist not an option.
The Cisco TAC refuses to open a SR because the product is under warranty only, and claims warranty only covers HARDWARE replacement... (and we ordered ACS is a VM,,,) Maybe I should burn the ISO image to a DVD and RMA it for repair .
Maybe Cisco could verify whether the fix for CSCtq46211 has been integrated to ACS Version 5.4.0.46-B.221 already or not ?
View 1 Replies
View Related
Jul 22, 2012
Is it possible for ACS 5.1 to only allow specific AD users to authenticate the switches and routers? Currently What I have configured is only for all AD users. I can't seem to find a way to be selective.
View 9 Replies
View Related
Mar 12, 2013
we are using ACS4.2 to authenticate wireless users for ssid : copr-wireless. the acs authenticate users via windows database (acs is a member of the windows doamin) no local user defined in acs. there is a mapping between all windows users and a local group in acs (wireless_group) in wireless group i defined the vlan as 80 so that corp-wireless clients will be in vlan 80 and they can take an ip address from one DHCP server in the network. vlan 80 is in our core switch. the dhcp also.
now we added a guest anchor WC with ssid: guest-wireless. we need to auth guests also via ACS/Windows. guests are the same users as corp-wireless but corp for lan only and guest for internet only my prob is that ACS will map guests to vlan 80 because they are member of the domain, however guest users should not have any vlan. it is like if they are in DMZ. they will take ip address from the anchor WC.
View 4 Replies
View Related
Aug 26, 2012
i have configured acs 5.3. i integrated wth active directory also it got suceeded in test connection.but when am trying to conncet ssid its not getting authenticate, wat r the users i created on acs they can able to login on wifi ssid
View 6 Replies
View Related
Oct 20, 2011
I have two tunnel groups using WEBVPN , I have local users at ASA 5510 version 7.2.
How can I authenticate one user in only one group?Now with local users I can loggin in both tunnel groups
View 1 Replies
View Related
Oct 13, 2011
I got error message when I convert to certificate authencate via tunnel group.
error message: "certificate validation failure"
client prompte me that "your client certificate will be used for authenticate" but none certificate list popup even i disabled "autpmatic certificate selection" preferences.
some information about my configuration :
ASA 8.2(2)4
Anyconnect VPN 2.5.1025
authentication against aaa is working
some key point:
ASA:
ssl trust-point remote.apac outside
tunnel-group APAC_AnyConnect webvpn-attributes
authentication certificate
View 12 Replies
View Related
Mar 5, 2013
Summary of setup Internal Network --------Cisco 881-(PPPOE)------------------------(CHAP)---ISP Mikrotik Router -----------internet
Basically it was working then there was a power outage and now it wont authenticate against the Mikrotik router. Strange thing is CHAP seams happy with the username and password. Then just terminates the connection.I've also tried PAP but not joy. Nothing appears to have changed. I have access to the Mikrotik and it looks the same as before also.
interface Dialer1
description Internet
bandwidth 7500
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
[code]....
View 6 Replies
View Related
Jan 16, 2013
I'm having an issue with a cloned vm of our ACS. We are moving it to a different location. I was able to clone it and get it back on the network, but I can't authenticate to it from any of my switches. I do have an older version:5.2.0.26
View 2 Replies
View Related
Apr 17, 2013
We looking into options for using VPN to allow users to work from home at our company. We already run Windows Active Directory and have a Cisco RV042G router. We would like to set up a VPN that will authenicate user through AD. Is this possible with the RV042G?
View 2 Replies
View Related
