Cisco :: WLC 4402 / Can Use ISE Server And Make Profiles
Jun 13, 2012
Customer has a WLC 4402 and 21 AP's LAP1131AG, there is a PDA wlan created to give PDA's and wireless Phones access to the webmail. This is done by access lists and firewalls. Now the customer wants more access to the internet in this PDA wlan, maybe in a later phase to the other vlans, can we use an ISE server and make profiles, is this the only additional server that we need or is an upgrade of the WLC and ÄP's also needed.
i have recently added to a domain. The initial setup is a server running windows 2003 and several xp machines which logon to the domain using mandatory profiles. However, after adding windows 7 machines and logging them on to the system it doesnt load the profiles. (which is fine as I understand you cannot use the same profiles with windows 7+xp)The problem is it automatically creates a roaming profile when logging off and saves it back to the same path as the other profiles under user.V2 which is growing considerably and causing huge logoff and logon times.How can I get the windows 7 machines to not attempt roaming profiles back to the server and instead to just save the profiles locally when logging off.
I have successfully implemented wireless guest access using 4402 WLC as the Anchor and 5508 as Foreign. The Anchor controller also provides dhcp services to guest clients. The 5508 is LAGged and there is no issue with the guests traffic separated from corporate. At a remote site, there is a 4402 WLC using LAG and also acting as a Foreign controller. But when a client connects to the guest WLAN, it obtains a corporate dhcp address instead of the dhcp address assigned from the Anchor controller. The guest WLAN setting is the same as with the 5508 controller i.e. DHCP server override is ticked and the management IP address of the Anchor controller is specfied. Also DHCP Addr required is ticked. Why the 4400 controller is not forwarding dhcp requests to the anchor controller and instead sending to the corporate dhcp server.
I have a 4402 (version 7.0.235) working with 10 units of 1121 APs connected to it. The WLC is not configured to work in LAG mode. Physical portt #1 is connected to the Main Switch (trunk). I have 3 WLAN mapped to 3 Different VLAN and Everything (security and internal, external DHCP) is working swell...Now- I have connected Physical port #2 directly to an ADSL Router (giga port), Configured Port 2 as untaggedwith the proper IP details.I have configured this interface to receive DHCP from the ADSL Router and for some reason, Clients are not getting addresses.When I assign a Static address to my laptop I get internet access and all is nice. I tried configuring The WLC internal DHCP server (instead of the ADSL router) and that didn't work. It seems like a DHCP problem but I dont understand the source of the problem of think of the solution.When turning off the proxy settings I noticed that it worked. Is there anything to do with that? The problem was that after a while the other WLANs starting causing DHCP issues as well.
I follow step by step the link bellow to configure web-auth with external RADIUS server but I receive a error on console debug of the WLC "Returning AAA Error No Server (-7) for mobile"My Radius Server is fine, because I can authenticate on WLC Web page with RADIUS user. WLC 4402 version 4.1.171.0 [URL]
I am trying to setup a guest vlan. I set up an interface for the guest vlan on my 4402 controller. I assigned the guest vlan interface an IP of 192.168.2.10 with a 24 bit subnet mask.
This vlan will go to my DMZ where there is no DHCP server so I need to setup the internal DHCP server. I created a new scope but I'm having trouble with what to put in the Network field for the DHCP scope. The pool addresses are 192.168.2.100-200. with a 24 bit subnet mask.
Every time I try to apply the configuration I get an "error in setting DHCP scope network and netmask".
I've tried using:
192.168.2.10 192.168.2.255 192.168.2.254
as entries for the Network setting but no go. The docs say to enter the IP address used by the management interface with subnet mask applied.
I was assuming they meant the interface for the guest vlan.
We have WLC-4402 and LWAP-1510, we have issue when users trying to connect to pppoe server with pppoe connection from wireless network. On LAN, pppoe connection work properly and everything is normal. Also I enable broadcast fowarding on GUI but he problem still exist.
I have a ASA5505 in a branch connected to the head office via L2L-VPN. The clients at the inside of the ASA can use the DNS servers in the head office through the VPN tunnel. The ASA is configured to use these DNS servers, too.
The VPN ist connecting the networks behind interfaces inside and ADM to the network at the head office.
When the ASA is resolving a hostname it tires to use these servers. But it does via outside interface.
gw700# ping heise.deMar 30 2011 07:58:49: %ASA-6-302015: Built outbound UDP connection 35360 for outside:172.17.6.225/53 (172.17.6.225/53) to identity:117.135.114.78/2117 (117.135.114.78/2117)DNS: get global group DefaultDNS
I want to learn how to make application server?I have Windows server 2008 enterprise edition and it is connected to 10 Client Machines. I want to install software programes only on server and use them on client machines without knowing server password.
I have to make a live chat (web based using ASP.NET) , like a customer service chat when the client click to start chat , the server will repsond with checking any operators that is available to chat with the client.the operator must be login to the site as active operator .how can i make the server to check the available operator ? is there a syntax or codes that can be applied in this condition?
My problem is that i want to make an srcds server to css (counter strike source) but i cant get it online beacuse i need to port forward i got a Thomson router (or what it's called) now to the problem when i write my ip and logs in i can acces some features and some i can't acces.
I have a question that�s been bugging me and that internet searches didn�t quite explain and that is how do I make a resource available publicly e.g. web serverAll I hear so far is register a domain name but that doesn�t quite answer the full question. Id like to know exactly what happens when a user types in the url of my web site and how their traffic gets to me. Is it.. get a static ip from my isp then provide this to the domain name registrar and that it now every one can access my site?? Seems to simple.
i want to stream movies to my nexus 7 in my room only but i dont want to buy a nas. can i connect my external to a router [URL] and use that to stream movies. i dont need to be able to connect to it all over campus but mainly in my room would be nice. i read that w/o root you cant connect to adhoc with the nexus 7?
I have an old computer that is currently running XP at 2.1GHz Athlon AMD with 1.5 DDR RAM, would I be able to turn it into a dedicated server? More importantly, should I? all I have is a small home network running a couple desktops and a printer off one and connected by a wireless router to the internet, would it make a difference at all in processing speed or connectivity on any of them?
I have an DLINK-dir 815 router.. I have tried for 10 hours to get broadcast IP to work, no luck.. All html/javascript modifications = no luck..The WOL works on LAN, but not over internet, so I figure it's the broadcast IP that needs to be virtual servered?
I'm running Ubuntu Server in VirtualBox. When I select the internal network option for the network adapter and start up the VM, I only get IPv6 address. I need an IPv4 address as well. My host (running Windows 7) gets has both an IPv4 and IPv6 address listed when I run ipconfig. When I run ifconfig on the guest (running Ubuntu Server), it only lists IPv6.
i now learning about SSLVPN, and i already install license in 1941 with SSL and security9 License, i learning how to make a gateway for SSLVPN full tunnel, but i meet an obstacles, when i go to my wan ip address https://wan ip address, the browser give this
SSL connection error Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have.
i live in a dorm and i want to stream movies to my nexus 7 but i dont want to buy a nas. can i connect my external to a router [URL] and use that to stream movies. i dont need to be able to connect to it all over campus (i know that involves hacking the proxy) but mainly in my room would be nice.
I currently have DCHP server set up on my new 1141N. Everything works great, but I wanted to know if it were possible to make the DHCP server only hand out ip addresses on the wireless connection? Currently the AP is giving out ip addresses from the pool to wired and wireless pc's.
I have a computer named server and it ip is 192.168.0.5 and a live ip xxxxxxxx which is a private ip. on this system my oracle middle wear is running.I just want that people may access my application which is running on 'server' through public ip. Is it possible. If it is. then how.=]
I am using Solawinds syslog and trying to get our Cisco routers send syslogs to our syslog server. I followed the procedure on Configuring Cisco Devices to Use a Syslog Server from [URL] Our Cisco swtches are all sending syslog messages but not the routers. I compared the config with our access switches but can't seem to find the problem:
I've searched the release notes for 7.2+, but I haven't found a documented number of how many active RF Profiles a 5508 can support. Any limitation of how many RF Profiles they can have?
I need to disable approxematly 40 different VPN profiles in our ASA5550`s without deleting them (need the ability to quickly activate them again if needed). I thought maybe i could disable IPSec for those profiles, but since the IPSec is an attribute for Group Policy, i cant do it - as many other profiles are sharing the same policy.
I have a question about ACS 5.3 and ASA VPN profile authorization. I am not sure if it is possible to allow one single user for a set of VPN profiles on ASA, let's make an example:ACS 5.3 group hierarchy:VPN users global should have access to VPN profiles A, B and Z (here we create an authorization profile with no class an no lock attributes, so the group is allowed for all VPN profiles),VPN users A should have access to VPN profile A (here we create a authorization profile with class and lock attributes for profile A),VPN users B should have access to VPN profiles B and Z (is this possible and how does the authorization profile have to look like?)
We've set our WCS up to do AAA through our ACS 5.3 which works great. So in order to log into the WCS for Administration or as a Lobby Ambassador (to create guest users etc) the AAA is all done by the ACS, GREAT!
I have assigned a set of users the Lobby Ambassador role as passed that back through TACACS to the WCS, so those users have their role setup as Lobby Ambassador and are limited from doing anything else, as expected.
What I want to know is: With normal local AAA on the WCS, when you created a Lobby Ambassador account, you could give the account a set of defaults for any guests accounts created by that Lobby Ambassador account, which was good, so Lobby Ambassadors couldn't set up unlimited time accounts and stuff like that.
What I want to know now is that since I'm now doing all the AAA on the ACS, is there an attribute I can pass to the WCS in the Shell Profile, along with the roles etc telling the WCS what the guest user creation defaults for the Lobby Ambassador account is, so that we can continue to limit the defaults of any guest account that the Lobby Ambassador accounts create, as it used to be? We'd really like different lobby ambassadors to be able to do different things as well. i.e., Lobby Ambassador X can only create accounts for one region. Lobby Ambassador Y can create Unlimited time accounts where the others can not. We used to do this by assigning different guest user creation defaults to different lobby ambassador accounts on the WCS.
Is there a way that i can associate one user with two VPN profiles. Now here is the scenario.Our company has bought a win 7 64 bit pc for some of the employees , so i had to create anyconnect. But the same users are also connecting via normal cisco vpn client. they will give away these old pc but for the time being my need is that both users shall connect to anyconnect profile and ipsec profile.
I tried ti to assign same profile with both ipsec and svc so that they could use single profile but anyconnect didn't work. I am having cisco ASA 5510 as VPN gateway.And How many licenses does cisco asa have by default for anyconnect users. Here is the configuration for anyconnect
group-policy Broad_Anyconnet internalgroup-policy Broad_Anyconnet attributes dns-server value 4.2.2.2 vpn-tunnel-protocol svc webvpn split-tunnel-policy tunnelspecified split-tunnel-network-list value Nit_Broadcast_Network_Tunn_ACL address-pools value Broadcast_AnyPool webvpn svc ask none default svc [Code]...
In regards to QoS profiles on the WLC. I have applied a profile to a newly created WLAN and set the Per User Bandwidth to 512k and it seems to be kicking in on the ingress only, this is supposed to work ingress AND egress or is it just designed to work one way? I have a 4402-25 with Cisco 3500 AP's and am running the 7.0.98 code. If it is designed to work one way only is there a different way to apply it ingress and egress simultaneously off the WLC?
I recently upgraded to Windows 7 in my company and the OS came bundled with Anyconnect VPN client version 2.5.
In the earlier version I used to add user profile using a .pcf file by importing it into the client to access customer LAN.
But in the Anyconnect VPN client I dint find any option to import the file. The IT support has told to edit the xml file to add it. The problem is I even after i edit the anyconnect-cert.xml with changes in host name and host address tags I am not able to start a connection. I dont knw know exactly what address must be given in Host address tag. I copied the host address from .pcf file which i used earlier.
Whether I will be able to add a user profile in this way or any correction is to be done in the whole process of adding the user profile,
I just bought new 942L (HW Rev3, 1.12 FW) and the only profile which is used to stream to iPhone or Web browser in mydlink is profile 3 which is limited to JPEG. Is there some way how to change the profile to be used for streams or is there a way how to make to profile 3 something else then JPEG?
