I'm trying to find a document in Design Zone about configuring a Wireless AP and I wasn't able to find it. I have a good experience configuring switches, routers and firewalls in CLI and this is the first that I have my hands on APs (1240 AG).
View 2 RepliesAny sample configuration of c1310 as a work group bridge.
View 2 Replies View RelatedI'm having trouble getting Tacacs+ to work correctly with ACS5.1 and a simple catalyst 3750 switch.I can authenticate with AAA, however i cannot get a single command to work once i'm in; "Command authorization failed" even on "enable".
Any useful resource that will walk me through the process?
I have a /25 block of public ips from my ISP which I'd like to subnet into two /26 blocks. I have a Cisco 2600 with 2 ethernet ports in it. What are the commands I'd need to take my 200.180.200.0 255.255.255.128, gateway 200.180.200.1 and turn it into 200.180.200.0 255.255.255.192, gateway 200.180.200.1 and 200.180.200.64 255.255.255.192, gateway 200.180.200.65? One of the interfaces will be connected to the ISP & the other to a switch, and then we could access the two subnets through the switch.
View 6 Replies View Relatedsample configuration for internet failover . i have 2 ISPs with one coming in thought a serial cable and another through internet and would wish one take over after the other has failed .The router is Cisco 1921 .
View 4 Replies View RelatedAny sample qos configuration that is enabled on a 6509 for voip ? it would be nice if its a auto-qos . I do not have an available 6509 to try this.
View 2 Replies View RelatedWhere can I find a sample working configuration of (HP rebadged) 3120 Blade Switch?
I have the Cisco 6500 end configured as follows:
interface Port-channel1
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,300,304,310,320,560-562,600,740,770,950
switchport mode trunk
load-interval 30
[code]....
I will be connecting 9/5 and 9/6 to Cisco 3120G (HP rebadged) Blade Switch in c-Class Enclosure tomorrow.It would be nice to have a rough sample configuration of the above 3120G switch.
Soon to be working on a design for a Wireless installation across one of our buildings. The wireless survery has been completed, and we'll be installing 175 APs, across the 3 floors of the building.
With regards to the back-end WLC setup, I have a few queries around the WLC configuration. We're looking at implementing the 4400 series of devices, and due to us having nearly 200 APs, we'll need at least 2 x 4404 or 4 x 4402 - I'm assuming its simpler to have fewer devices to make management simpler.Also, looking at the Cisco reference material, they recommend that a 4404 can support up to 100 APs, with regards configuring the ports on the box, would I need to configure LAG across the WLC
ports in order for it to accommodate all of the Access Points. If we were to go with a scenario of using 2 x 4404 devices, would we be in a position whereby if we lost a Controller, we'd lose
all of the Access Points associated with that Controller? In order for us to have full resiliency, we'd need an additional 4404 controller for the APs to failover on too? From a licensing perspective, we'll be purchasing a licence to cover 200 APs.
I have disabled the internal DHCP/DNS server in the routers firmware. I have enabled the wireless guest access SSID. A client associating with the Guest Wireless Access will obtain a DHCP address from the server in the LAN zone, but cannot resolve DNS as the firewall prevents traffic to flow from the Guest zone to the LAN zone, as it should.Is there a way to enable the DHCP server and DNS server in the routers firmware, but only on the Guest Zone? Is it possible to get the Guest Zone to have a different subnet?Tech support has hung up on me twice now.
View 5 Replies View RelatedI am thinking of getting the DAP-1522 access point but I wondered. Can I set it to broadcast on 5GHz for my laptop and ipad, so they can stream video. Then set the guest zone to broadcast on 2.4GHz just for my lame printer, my printer does not have LAN and only wireless b & g. If I do put the printer on the guest zone and I enable routing between zones, will my laptop be able to print to my printer?
View 1 Replies View RelatedI have a Cisco 2901 which terminates a Class C address pool. I have split the Class C address pool into 3 sub-nets and 2 zones and created a non-addressable pool (private pool):
dmz-zone : x.x.x.0 TO x.x.x.127 (x.x.x.0/25)
in-zone: x.x.x.128 TO x.x.x.159 (x.x.x.128/27) & x.x.x.160 TO x.x.x.191 (x.x.x.160/27)
private-zone: 192.168.x.0 TO 192.168.x.255 (192.168.x.0/24)
I have configured private-zone NAT to use address pool x.x.x.161 TO x.x.x.189 within the in-zone.
Within the:
dmz-zone - are servers for : DNS, Syslog, SIP & HTTP/HTTPS in-zone - is a SMTP mail server which is behind VPN Gateway/NAT, TomCat (Application Server) and PostgreSQL Server private-zone - is where all standard users are operating from and they can access the SIP & HTTP/HTTPS servers within dmz-zone My problem is that I cannot seem to configure the ZBFW to allow the dmz-zone HTTP/HTTP server to redirect to in-zone TomCat server.
I do not want to make the TomCat server generally visible and am instead using the Apache proxy/ajp13 to connect from dmz-zone server to in-zone server.However I cannot seem to get anything (including icmp) to work from dmz-zone to in-zone.
I have Policy:
POLICY-DMZ-IN (dmz-zone to in-zone) which has:
any any udp/tcp inspect
any any icmp inspect
unmatched traffic DROP/LOG
But I still cannot get anything from dmz-zone to in-zone...Could the POLICY-DMZ-IN be being overridden by other dmz-zone to out-zone policies?
NOTE: I have routing rules for each of various sub-nets and all out-zone to dmz-zone, out-zone to in-zone and private-zone to out-zone, in-zone and dmz-zone routing works ok, so it appears problem is with ZBFW not routing table.
I'm new to routing and cisco in general. I'm inheriting a rather simple setup but would like to approach the next steps with a good strategy. Currently we have a 2901 router with public IP's on bother interfaces. The internal facing interface is our gateway for some webservers and a firewall. Not we are looking to add a colocation site and establish a site to site VPN using another 2901. My goal is to have the colocation use the same internal 10.100.0.0/23 network. My question is what is the best way of going about this since the router at the main site has public IP's on both interfaces? Do I need to multi-home the internal facing interface? If so, what else needs to be done?
View 1 Replies View Relatedi have two Cisco 3845 routers connected to 3 different ISPs ,
-ISP 1 with link bandwidth of 24 Mbps
-ISP 2 with link bandwidth of 16 Mbps
-ISP 3 with link bandwidth of 8 Mbps
i have a public AS from a ripe along with 2 Class Address (Public independent)
1) what is the best design and configuration to utilize the 3 Links ,outbound and inbound (since we have our public address along with AS) my boss told me,all These 3 links must be active
2)what is the recommended design and configuration for the whole topology , pls share the best gotchas
3)what is the need of iBGP?why we need it when we run bgp?
I have Cisco 6500 with FWSM and ACE module which are in one central DC. Also we have four different Datacenter (Hub & spoke) and in our FWSM we have configured four contexts in central DC FWSM for each DC. Each DC servers are different VLAN and IP subnet. Now we have to configure ACE module for load balancing among those different subnet servers. What will be the design and configuration for this solution? Like routed or one-arm mode design.
Scenario Example:
1. App Server01
IP:192.168.11.5/24
GW: 192.168.11.1 in FWSM
FWSM Context: DC1
Physical Location:DC1
VLAN:11
[code].....
Now customer requirement is we have to load balance using ACE between these App Servers which are in different context s in FWSM and one Server is not FWSM. how to configure or design or placement of ACE and FWSM for above scenario.
One of our clients is replacing some of their aging network components with 4 Cisco 2960S switches. Unfortunately in this case, my skills of switch configuration are greater than my skills of network design. I have a really crude network diagram of their basic network layout (4 servers, 4 switches, and a number of endpoints).
How would you experts design the physical connections in such a way as to facilitate some redundancy?
im having a problem on my DIR-655, i just recently updated my DIR 655 2.03NA(which is no problem at all) to 2.10NA, & im having problem on my GUEST ZONE wireless network everytime i connect my Iphone 4 to it every second 10 seconds it goes on & off & i try to connect to the main wireless network it was working fine any causes to this?
View 14 Replies View RelatedI'm wondering if there is a way to prioritize traffic on the router's main WiFi over the guest zone or if there is a way to limit the bandwidth on the guest zone.
Ideally, I'd like to keep a locked primary WiFi for high-speed usage (I know, nothing it really ever secure) and an open guest zone for low-speed usage to whomever wants it. As far as I can tell, the DIR-655 doesn't support this kind of configuration.
I recently picked up a 655 with hardware version A2 and flashed to the latest firmware. I have a HotBrick router. I only want to use the 655 as an access point AND especially to use the Guest Access or Guest Zone feature to allow visitors to bring their laptops and not virus up my network. My home network is open among a few computers for things like SageTV, file serving, etc.I can get the 655 to function just fine as a standard access point by following the instructions to turn off UPNP, DHCP, etc. as outlined in the manual. I then enable the Guest Access/Zone feature, and of course give it a different SSID name, make sure it's on 24 hours a day, that it is enabled, etc.
But, none of my computers can access the internet via the Guest Account feature, just the regular wireless portion. They show connecting to the Guest Account name, etc. but no internet. I've disabled every security feature I know of to test this. Again, the "regular" WAP tests great, but no Guest Account, which is really important and one of the main reasons I bought the unit.I'm wondering - does the Guest Account feature only work if the 655 is the main router, has DHCP enabled, etc.? Does it have to be the one and only router? If so, I'm in trouble, because I can't really give up my HotBrick due to failover features, etc.
AP not booting and am not able to boot. Xmodem file system is available.flashfs[0]: unable to allocate available block.
The system has been interrupted, or encountered an errorduring initializion of the flash filesystem. The followingcommands will initialize the flash filesystem, and
[Code]....
I have two 1811's connected in a lab using a ipsec vpn tunnel (using a switch to simulate an internet connection between them).I am trying to configure one of the routers as a ZBPF just to allow a remote windows login (DC on the firewalled side, workstations on the other side).I'm trying to verify that the zbpf is working, but it doesn't seem to stop anything. I had match icmp added to the class-map, but took it out to test if icmp would fail. It didn't. Basically, I don't think the firewall is working at all. Any thoughts on how I can configure this so that the policies will work between zone-pairs?
Here's an quick drawing:
Here are the configurations:
Local router:
hostname sdc-1811-LocalLab
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
resource policy
[code]....
I recently changed my ssid name from the default "dlink" to a more unique one. The problem is that the router is still broadcasting the default ssid along with the new one. Guest zone is disabled and the new ssid is hidden. But the default ssid is not hidded. Using wpa2 with aes, hardware ver. A1/A2 Firmware ver 1.21. How to remove the "dlink" ssid?
View 4 Replies View RelatedHave DIR-655, HW A3, F/W 1.10. On the Advanced tab, there is no Guest Zone option. Can this be fixed with a firmware update? If so, which one?
View 2 Replies View Related207.NA Firmware, B1 Hardware in use on a DIR-655, Time Warner Cable setup. Nothing to do with Revision, cordless phones,I saw this asked once before specifically here, but it was never answered.After several attacks via our cable network and neighbors, we've HAD to turn on MAC filtering. There are TONS of devices attached normally so two situations popped up:
#1: What happens when you max out the authorized MAC address listings? Does the page get longer when you save/reboot it? Do I have to do it manually from there forward and where can I get down to the core programming level to edit the code and put the MAC's that are around and on 100% of the time to open up the plug-in list on the GUI?
#2: Guest Zone - we NEED a way to have random guests get on our Network with a different password we can randomly change to prevent the outside abuse, etc. but am I understanding what little else has been posted that the MAC filtering also covers the Guest Zone and therefore I have to stick them in there before they could simply log on with the current password? Is there any way to change/stop that without eliminating MAC filtration as a whole?
I am fortunate enough to have unlimited interwebs through my DSL ISP, and I occasionally have guests that come by who would like to use it on their mobile devices.My problem is that when my Guest Zone is enabled there is no internet access. Otherwise the Zone functions 'normally' devices within the zone can view each other, but not outside.It is important for me that the Guest Zone doesn't see any of the devices within my Host Zone.
DIR-655 - Rev B 2.03NA
Connection: PPoE
Reconnect mode: On Demand
Wireless Mode: Mixed G/N
I am looking into upgrading a customers wireless network and they are looking at using a few 1240 access points for both internal and external connections. Their question is can one access point support both channels simultaneously? They would like to connect an antenna on the inside of the building on the 5ghz channel and another externally on the 2.4ghz channel.
View 3 Replies View RelatedWe have four VLANs that need to be accessible to wireless devices. The VLANs serve the following groups: staff, student, guest, phone
We are currently using a WEP/MAC authentication for staff and phone wireless networks.
I am looking for what your recommendation would be to provide reasonable level of wireless security, particularly with the staff network, but at the same time not require a high level of management, ex. managing active and inactive MAC addresses for MAC authentication. We have the following components available - 1240 APS, Windows AD, a 4402 WLC, and 6 campuses, and outdated Cisco ACS.We need to provide connectivity to Cisco wireless phones, laptops, iPads, cell phones.
Cisco 4404 WLC
AP 1240 - LWAP
Wireless client receives a DHCP address from central DHCP server fine. Unable to route outside of own subnet . Continuous ARP WHO HAS (Default Gateway addr) TELL (client IP) messages being received. WLC running OS 4.2.99.0.
I have set up a zone-based policy firewall with HA on two 2911 routers as per the Cisco security configuration guide, for an active/passive LAN-LAN cluster. All works as expected, but there is one problem I find: when the control link between the two devices fails, they go into an active/active state as each member assumes it's the last surviving member. The ARP entries for the Virtual IPs on the neighboring devices point to the device that last claimed the active role (usually the standby device). This works in a way, just sessions don't get synched anymore (control link is the same as data link). Now when the link comes back up, the preemtion works and the active, former standby device goes back to standby. But the ARP entries on the neighboring devices still point to the standby device and nothing goes (also sessions established during the active/active state are lost due to resync with the now active member).
This is a single point of failure and what I need is a way to mitigate that. Under:
redundancy
application redundancy
group 1
control <interface> protocol 1
only one control interface is allowed. Other manufacturers with similar functionality provide for the possibilty of a backup control link, for example the internal LAN interface or a dedicated backup link.
How would I go about that? Maybe use a port-channel for the control/data link (but I'm out of interfaces)?
We successfully use this oid on our Aironet 1240 series AP's to list the dot11 associations to the AP:1.3.6.1.4.1.9.9.273.1.2.1.1.18 (cDot11ClientSubIfIndex).However, that oid does not work on our Aironet 1140 series AP's. Any equivalent oid?
View 0 Replies View RelatedI just started a project to make a guest wireless network available at every site in my enterprise. Guest wireless networks are currently available at some sites. Two key goals of this project is to enable WPA/WPA2 encryption and to develop a web based registration/autentication solution. All of the sites have a mixture of 1230, 1240, and 1250 autonomous access points. What do I need to do/get in order to make this happen?
View 3 Replies View RelatedWe are using WLC4402 for our Aironet 1240AG access points. The clients are connecting to the access points and are authenticating to the RADIUS server. I am seeing the logs in Server 2008 but they are being rejected due to Network Policy on the NPS server.
Where do I see the Authentication Type on the WLC4400 or the 1240's? In order for the clients (authenticated via Active Directory user) I have to set the Authentication in the NPS Connection Request Policy to "Allow clients to connect without negotiating an authentication method".
I do not have a certificate on the server and my method options are MS-CHAP-v2, MS-CHAP, CHAP, PAP, SPAP, and allow without negotiating. This RADIUS server was moved from Server 2003 IAS to Server 2008 NPS and there were no issues in Server 2003 IAS. I have all authentication methods allowed and it still gives me the error below. Only when I check "Allow clients to connect without negotiating an authentication method" it allows the authentication to proceed.
Client Machine:
Security ID: NULL SID Account Name: Fully Qualified Account Name: OS-Version:
Called Station Identifier: 00-17-a2-87-54-00: SSID NAME
Calling Station Identifier: 00-41-96-b6-e3-27
NAS:
NAS IPv4 Address: 192.168.90.24
NAS IPv6 Address: -
[code]...
Reason: The user attempted to use an authentication method that is not enabled on the matching network policy.
I have several autonomous 1240ag AP's that I need to enable a second ssid(Guest and VLAN2) for guest access and while I have configured the AP's according to the driections, I am not able to connect to the second ssid(Guest), but it is broadcasting. When I check the logs, I do not even see my laptop or any other device for that matter, trying to authenticate, what am I missing? I can see, connect and get an IP from the first ssid(Production and VLAN1), which is on the native VLAN and my 3COM 3C17203 switch port(14) is tagged for both VLAN's. Although I am sure that this would work better with a Catalyst switch, but it is not in my budget to replace all 4 of these, but I need this to work.
View 3 Replies View RelatedIn a multiple SSID setup, can Aironet 1240 & 1250 series AP supports different WEP key for different SSID
View 3 Replies View Related