The wireless client can't get the DHCP address when I enable the On-MAC-Filter-failure, MAC Filtering and Web Auth. Client can get the DHCP address when I only enable the Web Auth in the same WLAN SSID. The WiSM verion is v7.0.235.0. [code]
View 1 Replies
Currently we're providing DHCP to wireless clients from a dhcp pool on a cisco 6500. Due to new requirements we need to move to windows 2008 dhcp and when I test this on an unused WLC (7.0.235.0) the client doesn't get an address.
When I do a packet capture on the client I see it requesting dhcp but not getting any response from the server. When I do a dhcp debug on the client I see the same (see attached file).
This seems to me to be a server issue but the same server is supplying addresses to wired clients.
I have 2 units Cisco WLC 5508 running software version 7.0.220 with 70 over units Cisco AP 1262N and 1242AG. Some of wireless clients having problem to get the correct IP address from the DHCP server. There are 2 units of Microsoft DHCP. Both DHCP server ip have been configured on the Interface at the WLC. The core switch also being configured with ip helper. I've attached the debug output of one of the wireless client during the problem.
View 12 Replies View RelatedI have implemented a Guest WLAN solution as per the recommended design from Cisco. We have two internal WiSM2 controllers providing services for Internal secure SSIDs. Both these controllers are members of a Mobility and RF management group.
Two 5508 controllers have been installed in our DMZ for resilience and have been placed into a separate Mobility group. All controllers (internal and external) have been linked together as mobility neighbours in a full mesh and a new SSID for Web Guest traffic has been anchored to the controllers in the DMZ.
Web page authentication works perfectly fine, but I cannot for the life of me get the MAC filtering override to work, i.e. if a MAC address is present, do not redirect to the splash page for web auth. I know I can get around this by just creating two separate SSIDs. But the business is used to just having the one SSID for all guest traffic. Is this a known limitation when anchoring SSIDs to controllers in the DMZ ?
I have implemented a Guest WLAN solution as per the recommended design from Cisco. We have two internal WiSM2 controllers providing services for Internal secure SSIDs. Both these controllers are members of a Mobility and RF management group.
Two 5508 controllers have been installed in our DMZ for resilience and have been placed into a separate Mobility group. All controllers (internal and external) have been linked together as mobility neighbours in a full mesh and a new SSID for Web Guest traffic has been anchored to the controllers in the DMZ.
Web page authentication works perfectly fine, but I cannot for the life of me get the MAC filtering override to work, i.e. if a MAC address is present, do not redirect to the splash page for web auth.
I have DHCP server running in windows 2003. Presently its unable to provide Ip address for VPN clients who connect remotely. What I should do / reconfigure in DHCP, so that the DHCP server provides address for VPN clients.
View 4 Replies View RelatedI keep getting some additional IP addresses logging onto my home network that have an address outside what should be allowed by the router. The server is running at 192.168.2.1 and is set to only allow clients from 192.168.2.2 - 192.168.2.10 so a total of 9 clients should be allowed on.The problem is that something keeps logging in with an address of 192.168.169.2 or 3 etc. Sometimes more than one device at a time.I have assumed that it is some automated or virtual client as I'm pretty certain my network has not been breached. I have a 9 character password with a relatively random alphanumeric combination, although I haven't tried changing the password (I live in a share house with with a bunch of devices using wireless, so I haven't yet bothered). What I don't understand is how it has connected with the xx.xx.169.xx range at all. I have a Belkin 'Share' Wireless N Modem Router and at some stage there was a 'guest' network but that has since been disabled and I still am seeing the extra address. I have attached a screen shot of the DHCP client list on the router.The following is a list of devices that may be on the network at times, I'm thinking one of these may be responsible for the problem:
Windows Vista Desktop - Only LAN device
PS3
Macbook
Epson wireless printer
Android HTC Desire Mobile Phone
Laptops running various Windows versions (XP, Vista and 7)
A few thoughts I had:
- the android phone is capable of running a wireless hotspot, may have to look into it to see if if has been operating as an access point into the Belkin router, but assumed this wouldn't bring up clients connected to the phone on the home router.
- The desktop has PS3 Media server installed to stream video to the PS3 over the network (not that I have ever managed to get it to work), however this is not ever open on the desktop.
DHCP enabled with default settings. Dynamic IP range from 192.168.0.100 - 192.168.0.199.Router shows laptop with 192.168.0.199 however when I check the IP on laptop I have 192.168.100.10 and both laptops are connected on my SSID with 90% signal strenght.
View 4 Replies View RelatedIm using my upstairs neighbors wifi with permission. It has no protection whatsoever but recently i havent been able to use it anymore, and they both just went on vacation yesterday. Their dad was there for a day or two before they all left, my assumption is he thought i didnt have permission and did something to prevent me from connecting without mentioning it before they left.Its full bars (its directly above me) but the router almost instantly doesn't respond when i try to connect. Did he mac filter my wireless adapters adress? I tried changing my mac address on my wireless adapter (aka, desktop, as it doesn't have a nic) but Tmac cant change it successfully. Tmac is able to change my laptops mac though, but even after doing so i still cant connect to the network.
Other issue - right now im using a crappy 2 bar connection called ddrtvap on my laptop. The laptop sitting right where my wireless adapter for the desktop would be and it connects fine, but my desktop cant connect to this network (it connects to the network, but no internet) while the laptop does just fine. Windows repair is super usefull as it tells me something is wrong with my adapters settings but gives no clue as to what.
I have gone through the data sheet of WAP4410N,bu have got nothing about the scalability of MAC address filter on WAP4410N?
View 1 Replies View RelatedI've been working with a client's integrated 3750 WLC running 4.0.179.11. I want to upgrade the code because it is old plus I am having DHCP trouble. I have a couple of questions:
1. Is it OK to upgrade to SWLC3750K9-5-2-193-0.aes ? or do I need to go through 4.2 first ?
2. Will that code upgrade the bootloader at the same time?
3. How can I make sure there is enough flash space on the WLC?
4. Are there any special considerations to plan/prepare for?
The DHCP issue is failure of associated clients to get an IP address with this message found in WLC debugging:
[Code]...
I have been noticing in my trap logs that there are an excessive amount of Client Association/Authentication Failures. I cannot figure out why. I have a Cisco 5508 WLC with 81 AP's (1131ag, 1142abgn, 1262N) models. The wireless devices are on a Windows Domain and use 802.1x EAP authentication, authenticating the user and computer info with a RADIUS Server. I look at the logs and all it can tell me is Reason:Unspecified ReasonCode:1. I read that the Reason Code is due to "Client associated but no longer authorized" but to be honest I am not sure what that means.
View 9 Replies View RelatedI want to add more than 40 mac address filter into my WRT54GL with firm version V4.30.7 but the form to enter the mac address list just limited to 40 mac address register. How do I can add more than 40 mac address list in my WRT54GL ? perhaps we can add the list into WRT54GL like XML file or somehow that can make me add more than 40 mac address register list.
View 2 Replies View RelatedI have a Cisco/Linksys E2500 router. I connected to it through one of the Ethernet ports with a Microsoft Windows XP Pro machine and installed and ran the setup software. Windows was able to connect to the router and to the internet through the Siemens Gigaset 4300 DSL modem to my internet provider, Windstream.I cannot get my Dell GX620 which is running Linux Debian 6 (Squeeze) to connect to the router through the Ethernet ports.It appears that I receive no reply to the DHCP requests made by Linux.
I have only one monitor, keyboard and mouse and no KVM switch to run both the machines at once. I do have Windows XP Pro running in a VirtualBox virtual machine on the Debian machine,I can configure Debian to a static IP if I knew all of the IP configuration that the E2500 would assign. I would also need to know what reconfiguration the router requires if I use a static IP.
I have noticed that changes in MAC address filter list are applied only after reboot of router. It is inconvenient.
Router Linksys E4200
Firmware Version: 1.0.03
Operation system on client computer is Windows 7.Can it be resolved in the next version of firmware?
I have Cisco 2821 with NM-AIR-WLC6-K9 installed. And number of AIR-AP1131AG-E-K9. Now I set up trivial task to make WLC6 to work as bridge between on of WLANs and one of VLANs on a network segment. I have already attained the following: all is working fine while I use on my test notebook statically assgned IP-address. Broadcasts as ARP-requests are going through the network free. But as soon as I change IP assigning method I hear nothing on DHCP's side. Notebook is unable to acquire address through DHCP. But when I assing IP-address to vlan20 interface on WLC6 and set up correct DHCP-server all works fine again. Now with DHCP. But I don't want use IP on vlan20! [code]
View 8 Replies View Relateda power analyzer in my network is sending some packets that are unexpected and incorrectly recognized as DHCPOFFERS. As a workaround, I would like to filter those packets with my Cisco switch 3750.Suppose IP_POWER_ANALYZER is the ip address, what could be the best choice
1. deny udp any IP_POWER_ANALYZER eq bootpc
2. deny udp any IP_POWER_ANALYZER eq bootpc; deny udp IP_POWER_ANALYZER any eq bootps
3. deny udp any eq bootpc IP_POWER_ANALYZER eq bootps
Do the problem caused by the modems itself or it just sign of faulty Ethernet switch (using 20 port Allied Telesis ethernet switch).
Sometimes I cannot connect to internet due to "unidentified network" buy i can resolve this problem by restarting my modem + switch.
Using ACS 5.2, under Network Resources>Network Devices and AAA Clients>, I can only filter by:
Name
NDG:Location
NDG:Device Type
Description
How can I find a device by its IP Address? or how can I enable this option?
On this link:[URL] I read the following: ''Network Device Filters—Based on the AAA client that processes the request. A network device can be identified by its IP address, by the device name that is defined in the network device repository, or by the NDG'.....
How could I do this on my ACS server?
I am running WLC 5508 and WCS version 7.0.98. We are noticing with some of our handheld devices that have Sychip Wireless cards that they constantly have issues communicating. The error I see on the WCS side is shown below:
Client '00:0b:6c:2f:d0:32 (0.0.0.0)' failed to associate with interface '802.11b/g' of AP 'HO-BRSales'. The reason code is '0(null)'.
I am using an ASA 5510 firewall in routed mode.How can I filter incoming traffic by mac address on the AS 5510 ? I have already setup a static access rule for rdp users on the outside to access a terminal server on the inside.Now, i would like to further limit access from specific computers only.
View 7 Replies View RelatedI have a ACE4710 setup to load balance a couple of web servers. The real servers all show as inservice as do the propbes and serverfarms/virtual servers. If I ping the Virtuual server ip address I get a reply but it I try to access VIP via telnet or web browser. I get a connection could not be open error on the client.The question is how do i determine where the error is comming from so far I can not tell if the client is getting through the acl or not.I have used the trouble shooting guide and nothing has worked to determine the cause so far. show service-policy int479 detail does not show an increase in the hit count when I try to connect.show stats conn does not show an increase in failed or timed out connections when i try to connect. [code]
View 3 Replies View RelatedIs it possible to configure cisco router like C3800 or catalyst switches like C4500 or C2960 to filter traffic based on allowable mac addresses only? I would like only to allow those devices that belongs to the domain, meaning if a user connects a computer or any devices that concerns network which I have not allowed the mac addresses, it will be denied access to the network. However, any of the allowable devices could able to use any port of the switch, meaning I dont want to associate an allowable Mac Address to a physical port on the switch.
View 2 Replies View RelatedWe have a wifi router RV220W and we need to filter the mac address. The problem is that the number of the "allowed" devices is around 50 (not all connected at the same time), but the maximum number of mac address which can be listed in this router for each VLAN is 20, so for the moment we set 3 VLAN, each one with a different mac adderss list. This is very awkward because the area to be covered by the wifi network is large and we need repeaters, but having 3 VLAN we should put 3 repeaters for each point. Is there any way to configure this router in order to have a single VLAN but with a mac address filter list of 3 x 20 mac address?
View 1 Replies View Relatedi need to add a lot of mac addresses in mac addr filter table. many routers do not allow me to add a note for each mac address. that makes management a bit difficult.
eg.
field 1, field 2, enable
xx:xx:xx:xx:xx:xx , peter pc, y
xx:xx:xx:xx:xx:xx, mary pc, n
I installed the 2.06NA on my DIR-655 router and now I'm having problems adding mac addresses to the network filter. The message is "Invalid MAC address". Of course, it doesn't tell me which entry is invalid and I have a number of them. After further checking.. I noticed that one of the MAC addresses is indeed invalid and when I remove it I still get the error message?
View 1 Replies View RelatedI had no problem running both 2.4 and 5.0 Bandwidth. With WiFi password and without. It does it's job. The 2.4Ghz Range Plus works. I have set up the router on the 2nd floor at the highest it can go. And everyone get's full bars all over the house. I even get 4-5 bars outside in my car on my phone.
The only issue I have with this thing is a damn new netbook I got for Christmas with a Mac Address starting with 0C-EE-E6-XX-XX-XX. The Router finds the Mac Address invalid. In which I can come to understand cause seeing a Mac Address starting like that is completely new to me. Every Mac Address I have, started with 00 except the netbook. So now, I spent days trying to find firmware updates, patches, anything! I even attempted to spoof the Mac Address on the netbook but Microsoft has a bug on Windows 7. (I have the Starter Edition that came with the netbook)
Windows 7 Mac Spoofing works with WIRED Connection. But it does not work with WIRELESS Connection. I used 3rd Party Tools: SMAC and etc... I attempted Registry Edits, I changed even the value key to the "Orginal Mac Address" and it just wont change [New Strings/Network Address Edits included]. I have been banging my head about this for a week now. The Internets has many answers but they did not work. So Spoofing the Mac Address is out of the question. Until Microsoft fixes this bug.
Anyway: Did D-Link release any sort of beta update/driver/firmware or anything to resolve this at all? Is there a modded firmware to force the Router to take this stupid paradox of a Mac Address?
Currently: I have the Router's WiFi Password-ed with Default Factory Settings
{Hardware Version: B1
Firmware Version: 2.02NA}.
ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src outside:192.168.13.50 dst DMZ2:192.168.13.15 (type 8, code 0) denied due to NAT reverse path failure
Cant seem to get around this one yet. I have a remote ASA that I can VPN into. It has 2 dmz's, outside and inside interface configured.
Inside subnet is 192.168.11.0 / 24
DMZ2 is 192.168.13.0 / 24
VPN client pool is 192.168.15.0 /24
I login in fine. But have no access to the DMZ2 subnet. I get the failure listed above.
I tried to configure my wifi router recently to secure my internet connection. I wanted to add a MAC adress filter, but I had to leave before I could enter them all. I thought that I wouldn't have to enter my own MAC adress since I'm directly connected to the router with a wire, but it looks like I should have entered my MAC adress, because now I can't get access to my router by typing the IP adress, as usual. I tried to reset it, but it doesn't work.
View 2 Replies View RelatedI have a Linksys WRT54G router.I am trying to set up my internet connection so only my approved MAC Addresses can connect.I set everything up. I purposely excluded my laptop from the list to see if I did it right and I guess I didn't because my laptop is still able to connect to my network.
View 7 Replies View RelatedI have a WLC5508 , we are using external DHCP for WLANs
one WLAN is able to get IP from DHCP server but another WLAN not , the DHCP server is same , only 2 different scopes.
This is debug
*DHCP Socket Task: Feb 05 21:26:43.106: e8:06:88:9b:a8:04 DHCP received op BOOTREQUEST (1) (len 308,vlan 1, port 1, encap 0xec03)
*DHCP Socket Task: Feb 05 21:26:43.106: e8:06:88:9b:a8:04 DHCP processing DHCP
[Code].....
I have intergrated wlc module in 2800 series cisco router, switch, cisco 1130 lightweight access point, i configured dhcp on router for wireless client, deal is that AP taking ip address from router its ok, but client cannot take dhcp, what im doing wrong? here is configuration of wlc router and switch
wlc configs/
config interface address management 172.16.1.10 255.255.255.0 172.16.1.250
config interface address ap-manager 172.16.1.11 255.255.255.0 172.16.1.250
[Code].....
Using Cisco ASA5510 Security Plus (Post May 2010) with 8.2(1)
I was trying to limit the number of internet IP Address that can initiate Remote Access VPN connection to the firewall. I have plan to only allow internet IP Address from few ISPs for control.
However, blocking AHP, ESP, ISAKMP, NON500-ISAKMP, and IPSec Over TCP Port Assigned in the firewall outside interface doesn't work. But it works by putting the ACL in the router before the firewall. It seems that the firewall have a "hidden" process VPN first before user entered ACL (or explicit rule), similar to Checkpoint FW's implied rule. How to get around it?
