WLC Model
---------
WLC 4402
Software Version
----------------
5.2.178
Problem Statement
-----------------
Do we have any Cisco WLC MIB to get WLAN profile (Order in which WLAN profiles are added inside an AP Group) information present in an AP group?
Customer has a WLC 4402 and 21 AP's LAP1131AG, there is a PDA wlan created to give PDA's and wireless Phones access to the webmail. This is done by access lists and firewalls. Now the customer wants more access to the internet in this PDA wlan, maybe in a later phase to the other vlans, can we use an ISE server and make profiles, is this the only additional server that we need or is an upgrade of the WLC and ÄP's also needed.
View 1 Replies View RelatedIs there way to group APs to get different profiles. I need to have some that have the 2.4GHz turned down and some wiht the 2.4 and 5.0 GHz on.
View 7 Replies View RelatedIn my ACS 5.4 I want to have same useranme to use two shell profiles. Here is the requirement.One shell profile with privelege 15 for IOS device admin and other one with different privelege for WCS admin.As there can't have two shell profiles on the same authroization profile, I created two different profiles, and match with the ACS local group name. However whenever user tries to access it always hits the 1st profiles.
View 3 Replies View RelatedWe are starting to deploy SSL VPN in our company and we recently purchased two ASA 5510 firewalls. I have already completed the initial configuration but I do have some inquiry on how to have it configured properly.
1. Employees and clients will access the URL
2. They will select the appropriate group on where they should login.
3. Enter credentials, etc.
4. Username/Password authentication is via RADIUS. The usernames were all created in Cisco ACS 5.3.
My challenge is, we have several clients and all their usernames were created in ACS5.3. Meaning if the configuration is just being differentiated by group settings, clientA can select the profile of clientB and still get authenticated. If that happens, they will be able to access the resources of each other. Also in the future, we will be deploying 2-Factor authentication for some of our clients.
Is there a way to customize the order of the Groups in the drop down page on the login page?
Want to use a different group as default. Read over docs and not seeing a way to configure the login box dropdown order.
If it is not configurable, is it alphabetical on group name or the order they are configured ?
I am currently running a Cisco 4402 Lan controller, I have a Wlan that is running unsecured and i wanted to add a simple web policy log in, so i set up an NPS server on a local DC. I have the two talking . when i go to login at the web login page I get the Error Login Error. When i look at the NPS logs it says: "Network Policy Server granted full access to a user because the host met the defined health policy" . So it has to be in my Cisco set up somewhere seems pretty simple
View 2 Replies View RelatedWe currently have a cisco 4402 with firmware version 6.0.182.0 and 4 WLANs currently running on it, we found the need to add an additional WLAN and after the configuration was completed and I tried to connect to it I found that we are not getting an address. If i connect a laptop to the VLAN I can get an IP and am able to browse. If i hard code an IP into a device and connect to the wireless i am able to connect and browse.
View 7 Replies View RelatedRecently (within the past 2 months) I've been having some issues with my 4402 wLAN controller.
The issue is thus:
1) New wireless clients (those without exsisting DHCP leases) are unable to properly connect to our wireless network.
2) Those same systems (and other systems) have no issue getting online via a wired connection (where available).
3) Devices like iPad, tablets, laptops partially connect but do not get a valid IP address.
Our config:
1) DHCP is handled by a seperate server (NOT the 4402 - it's DHCP setting is disabled)
2) Our wLan is not on a seperate network than our wired LAN
3) Wireless devices attempting to connect include iPads and laptops mostly.
4) We're a school with about 300 systems (primarily Windows XP machines).
5) 25 access points controlled by the 4402 (our only wLAN controller)
Important Notes:
1) No configuration changes have been made to DHCP or the 4402 device in a couple years.
2) 4402 Software Version = 4.0.217.0
The problem first showed up a bit over a month ago. I first thought the issue was DHCP server related , so I started there and didn't find any obvious issues. I did restart the DHCP server (which at that point had an uptime of somewhere over 700 days).
I then also checked the web interface of the 4402 to see what it was reporting. I noticed a somthing:A) As shown in the "WLAN_Issue_EDIT.png" the client count on the controller is showing 628 current clients. We don't have many devices in our entire campus.
I rebooted the controller after hours and that seemed to allievete the issue. Since then, the current client count hasn't ever gone above 60.
Now today I'm having the same issue regarding new clients getting IP addresses. The client count isn't real high on the WLAN controller and I don't see any other obvious issues. I'm torn between this being a DHCP issue or the controller issue (or a combination of the two).
The reason I don't think it's directly DHCP related is that all wired clients seem to be getting address fine.Plus, I've set my tablet device to a static address and it still cannot connect via wifi.
**Update** I've now rebooted the controller and the problem persists (at least on the nearby iPad - Will confirm other devices shortly).
Have a cisco 4402 manage. console and 1131AG WAPs I have a specific test LAN for one WAP but shows up on others WAPs too.
View 2 Replies View RelatedI have a Cisco 4402 Wireless LAN Controller and 4 x AIR-LAP1131AG-A-K9 access points.We run a combination of [WPA +WPA2]Auth(802.1x) as well as [WPA2]Auth(PSK), most people have their own login credentials...The primary client devices are MacBooks and iPhones, with some Windows and other mobile manufacturer being the minority.
The Issue I have one user (using a recent MacBook Air, latest OS, using Auth(802.1X) ), that keeps getting disconnected for no apparent reason, the user account has been setup exactly the same as every other user and his laptop doesn't have this issue when connected to other WiFi networks.It's worth noting: I noticed this particular user has a lot of "Decrypt Failed" (currently 213) associated with his MAC address, no other user on our network has a single "Decrypt Failed" associated with their MAC...
Moblie WLAN range 192.168.1.0/24.Default Gateway: 192.168.1.1 - Firewall..Next available range to add more addresses are 192.168.11.0/24..Current range is having IP address issues..I have seen a feature in 4402 controller that I can assigne second address range to exisgint SSID Mobile.What should I set the default gateway for 192.168.11.0/24 range?How can I point all mobile users traffic to the firewall as default gateway without creating additional interface on the firewall?I really do not want to create another vlan and interface in the network to just add another 255 addresses if tehre is any option?
View 3 Replies View Relatedwe use wlc 4402 (Software Version 7.0.98.0) and want to allow only several wlan nic vendors to connect to a wlan ssid.According to this, is it possible to configure MAC Filtering with wildcards, e.g. aa:bb:cc:* ?
View 1 Replies View RelatedI try to map LDAP Group to ASA Group policy following documentation:
[URL]
This is a config for ASA 8.0. I would have expected it to work on 8.4 as well but I do run into problems. The mapping as shown in LDAP Debug and ASA Log will actually happen but it is overwritten by the "GPnoAccess" Group Policy configured locally in the Tunnel Group. From earlier works with RADIUS I would have expected the user specific Attribute to be "stronger"?
ASA Log:
AAA retrieved user specific group policy (correct Policy) for user = XXX
AAA retrieved default group policy (GPnoAccess) for user = XXX
I've searched the release notes for 7.2+, but I haven't found a documented number of how many active RF Profiles a 5508 can support. Any limitation of how many RF Profiles they can have?
View 3 Replies View RelatedI need to disable approxematly 40 different VPN profiles in our ASA5550`s without deleting them (need the ability to quickly activate them again if needed). I thought maybe i could disable IPSec for those profiles, but since the IPSec is an attribute for Group Policy, i cant do it - as many other profiles are sharing the same policy.
View 2 Replies View RelatedI have a question about ACS 5.3 and ASA VPN profile authorization. I am not sure if it is possible to allow one single user for a set of VPN profiles on ASA, let's make an example:ACS 5.3 group hierarchy:VPN users global should have access to VPN profiles A, B and Z (here we create an authorization profile with no class an no lock attributes, so the group is allowed for all VPN profiles),VPN users A should have access to VPN profile A (here we create a authorization profile with class and lock attributes for profile A),VPN users B should have access to VPN profiles B and Z (is this possible and how does the authorization profile have to look like?)
View 3 Replies View RelatedWe've set our WCS up to do AAA through our ACS 5.3 which works great. So in order to log into the WCS for Administration or as a Lobby Ambassador (to create guest users etc) the AAA is all done by the ACS, GREAT!
I have assigned a set of users the Lobby Ambassador role as passed that back through TACACS to the WCS, so those users have their role setup as Lobby Ambassador and are limited from doing anything else, as expected.
What I want to know is: With normal local AAA on the WCS, when you created a Lobby Ambassador account, you could give the account a set of defaults for any guests accounts created by that Lobby Ambassador account, which was good, so Lobby Ambassadors couldn't set up unlimited time accounts and stuff like that.
What I want to know now is that since I'm now doing all the AAA on the ACS, is there an attribute I can pass to the WCS in the Shell Profile, along with the roles etc telling the WCS what the guest user creation defaults for the Lobby Ambassador account is, so that we can continue to limit the defaults of any guest account that the Lobby Ambassador accounts create, as it used to be? We'd really like different lobby ambassadors to be able to do different things as well. i.e., Lobby Ambassador X can only create accounts for one region. Lobby Ambassador Y can create Unlimited time accounts where the others can not. We used to do this by assigning different guest user creation defaults to different lobby ambassador accounts on the WCS.
Is there a way that i can associate one user with two VPN profiles. Now here is the scenario.Our company has bought a win 7 64 bit pc for some of the employees , so i had to create anyconnect. But the same users are also connecting via normal cisco vpn client. they will give away these old pc but for the time being my need is that both users shall connect to anyconnect profile and ipsec profile.
I tried ti to assign same profile with both ipsec and svc so that they could use single profile but anyconnect didn't work. I am having cisco ASA 5510 as VPN gateway.And How many licenses does cisco asa have by default for anyconnect users. Here is the configuration for anyconnect
group-policy Broad_Anyconnet internalgroup-policy Broad_Anyconnet attributes dns-server value 4.2.2.2 vpn-tunnel-protocol svc webvpn split-tunnel-policy tunnelspecified split-tunnel-network-list value Nit_Broadcast_Network_Tunn_ACL address-pools value Broadcast_AnyPool webvpn svc ask none default svc
[Code]...
In regards to QoS profiles on the WLC. I have applied a profile to a newly created WLAN and set the Per User Bandwidth to 512k and it seems to be kicking in on the ingress only, this is supposed to work ingress AND egress or is it just designed to work one way? I have a 4402-25 with Cisco 3500 AP's and am running the 7.0.98 code. If it is designed to work one way only is there a different way to apply it ingress and egress simultaneously off the WLC?
View 3 Replies View RelatedI recently upgraded to Windows 7 in my company and the OS came bundled with Anyconnect VPN client version 2.5.
In the earlier version I used to add user profile using a .pcf file by importing it into the client to access customer LAN.
But in the Anyconnect VPN client I dint find any option to import the file. The IT support has told to edit the xml file to add it. The problem is I even after i edit the anyconnect-cert.xml with changes in host name and host address tags I am not able to start a connection. I dont knw know exactly what address must be given in Host address tag. I copied the host address from .pcf file which i used earlier.
Whether I will be able to add a user profile in this way or any correction is to be done in the whole process of adding the user profile,
I just bought new 942L (HW Rev3, 1.12 FW) and the only profile which is used to stream to iPhone or Web browser in mydlink is profile 3 which is limited to JPEG. Is there some way how to change the profile to be used for streams or is there a way how to make to profile 3 something else then JPEG?
View 1 Replies View RelatedI would like to setup a 2504 to have one Guest WLAN and one Staff WLAN with a controller port for each WLAN connected to different devices.
I would prefer to connect the WLC Guest port to an ASA 5510 and the WLC Staff port to an internal 2960S switch. Will this work? I haven't setup a 2500 series controller previously.
For ACS 5.4: In Network Access -> Authorization Profiles there is a Permit Access profile. If you try to edit it a message pop's up that says: "The profile you have selected is reserved and cannot be deleted or modified". What this profile contains in its rule base? If I wanted to create a similar profile what Common Tasks, or Radius Attributes would I need to use? The same would go for a Deny Access profile. I have looked at the Common Tasks and Radius Attributes for a new profile and it doesn't seem very intuitive.
View 2 Replies View RelatedI use a Cisco ASA 5510 with the AnyConnect VPN for remote workers. Now we want to give access to a select group of consultants who only need access to one sever and block everything else.
I was thinking this could be done by creating a separate AnyConnect Connection Profile on the ASA. From that new connection will come a new GroupPolicy with a ACL to only allow access to the one system. That GroupPolicy will point to the Radius Server looking for an account in a specific MemberOf group.
My question is - Could you explain how the ASA knows what Connection Profile to use when a user tries to authenticate? Does it automatically hunt down each Connection Profile until there is a username match via RADIUS in the Connect Profile?
I have a server connected to my router with a CAT5. I usually manage the server from my laptop connected to the router via WLAN. I often need to add files to a public folder on the server so it can be dowloaded by my clients when they need them. I can access my personal laptop from the server, but I cannot access the server's files from my laptop. This is recent and used to work fine. I also cannot acces other personal computers on my network that I often connect to
View 11 Replies View RelatedI have an ASA running 8.2.x code with AnyConnect 2.4.x.I have both Radius and LDAP (AD) AAA available.If a user connects from a company owned laptop, I want to push down AnyConnect client ProfileA (with scripts to map drives etc...) and network ACL's set A.
If a user connects from any other computer, I want to push down AnyConnect client ProfileB (no scripts etc...) and network ACL's set B.
What I would like to do is CSD to do a machine certificate check (for presence of a cert from my private CA) and to assign a EndPoint Policy attribute (Managed on successful check or Unmanaged on failure). I can then use DAP to tailor the ACL's that get set.
It seems like the only way to handle AnyConnect client profiles is with Group-Policy. Using LDAP I can assign a user to a Group-Policy, but I have no way of determining is they are coming in from a company laptop or not when assigning the Group-Policy. DAP can not assign an AnyConnect client profile.
If at all possible, I do not users to have to pick a conenction profile or use different URL's.
i have recently added to a domain. The initial setup is a server running windows 2003 and several xp machines which logon to the domain using mandatory profiles. However, after adding windows 7 machines and logging them on to the system it doesnt load the profiles. (which is fine as I understand you cannot use the same profiles with windows 7+xp)The problem is it automatically creates a roaming profile when logging off and saves it back to the same path as the other profiles under user.V2 which is growing considerably and causing huge logoff and logon times.How can I get the windows 7 machines to not attempt roaming profiles back to the server and instead to just save the profiles locally when logging off.
View 14 Replies View RelatedWe have 2 ASA 5510's running in a Active/Standby configuration. It appears that most of the changes we make on the active unit are replicated to the standby unit. However, there are 3 AnyConnect Client Profiles on the active unit and none of them show up on the standby, the standby has no AnyConnect Profiles. We also have 1 OnConnect script on the active unit and it does not appear on the standby unit either.
I was under the assumption that all config items on the active unit would replicate to the standby. Is this not correct? Do I need to do something extra to get everything replicated? Are there other items that do not replicate?
I have recently installed acs5.2 evaluation on a vmware and i can't launch common task on authorization profiles when i click on it i have the bellow message javascript:cuesToggleTab('NetworkAccess',1,false,false
View 4 Replies View RelatedIs it possible to have one netflow export profile (may not be the right word...) to send all the flow information to one collector and another profile to only send traffic to and from centain IP addresses to another collector? If it is possible on the hardware and software, any quick sample config?
#sh ver
Cisco IOS Software, s72033_rp Software (s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(33)SXH4,
#sho module 7
Mod Ports Card Type Model Serial No.
--- ----- -------------------------------------- ------------------ -----------
7 2 Supervisor Engine 720 (Active) WS-SUP720-3B SAL1115LJBR
Mod MAC addresses Hw Fw Sw Status
--- ---------------------------------- ------ ------------ ------------ -------
7 0017.9444.9814 to 0017.9444.9817 5.3 8.4(2) 12.2(33)SXH4 Ok
Mod Sub-Module Model Serial Hw Status
---- --------------------------- ------------------ ----------- ------- -------
7 Policy Feature Card 3 WS-F6K-PFC3B SAL1115L2NH 2.3 Ok
7 MSFC3 Daughterboard WS-SUP720 SAL1115LH7W 2.6 Ok
Mod Online Diag Status
---- -------------------
7 Pass
I have a question about the new nat implementation in an ASA 8.4. when I perform a "show nat" I get the following result:
1 (outside) to (inside) source dynamic any NAT-SSL-VPN_172.30.100.250 destination static 00B_172.30.100.0_24 00B_172.30.100.0_24
translate_hits = 26, untranslate_hits = 0
2 (inside) to (outside) source static LAN-HOST_172.30.100.11_LNX01 WAN-HOST_84.199.44.2_32_LNX01 service TCP-80-HTTP TCP-80-HTTP
translate_hits = 0, untranslate_hits = 0
Is it possible to change the order of the nat rules without removing and reapplying the rule on position 1 ? (both rules have to stay in section 1)
In what order the 8 cables go into the octal plug.The cable is a X.21.DTE 8 LEAD OCTAL part No 72-1100-01. The cables are not in numerical order (as in 0 to 7 as per the serial ports). I'm trying to trace cables and don't have a spare cable to examine. So far I think the order is 0,4,5,1, 2,6,7,3?
View 2 Replies View Related