Cisco Wireless :: New 5508 WLC And 3602i Access Points / Client De-authentication
Jan 25, 2013
Installed a new 5508 WLC last week, and finished bringing 68 new 3602i access points online in our College Dorms. We are seeing a lot of "Client De-authenticated" errors "Reason: Unspecified Reason: Code 1. Years ago I asked about error code 1. The reply from Cisco was: "The programers put the code in. It basically means we don't know what the problem is."Got a call from one of the dorms stating that students were getting knocked off the network while going to sites. If a student is wired, network is solid.Walked the dorm in question and was getting full bars of signals at all times, and was able to stream a movie from my Ultraviolet account without any break or slowdown as I moved from access point to access point. So.. my device, an iPad, was fully mobile and did not experience any disconnects.Did observe one student using a MacBook Pro. This student was constantly loosing connection to the access point. Checked the controller for the MAC of the student's computer. I did find deauthentication errors. BUT... this student's error was the computer was receiving an IP address from the DHCP that was already in use. At the computer the error message was a timeout issue.I am just learning the ropes on the 5508. Have used 3 4404s for the past six years.
I am trying to setup EAP-TLS authentication for my wireless access points, but I can't sign my ACS certificate with my enterprise CA certificate.If I generate a self-signed certificate on the ACS server, and try to sign it on my CA, I get an ASN tag error. It looks like that is because the ACS server is not in the certificate path of the CA server.If I generate a certificate on the CA and try to import it into ACS, I get a "unable to parse certificate" error. Is there a way to edit the Certificate Trust List in 5.2? It looks like that was possible with 4.2, but not with the latest version.
My boss just asked me if there was a way for him to move from point A to Point B with his wireless laptop and NOT have to reauthenticate at point B if I install another access point there. Right now I have us setup on a Cisco WAP4410N Access Point that works well when he's within range of the antenna. The point B location is upstairs and while it's only about 50-70 feet away from the Point A access point the signal he's getting there is very weak so he wants me to install another AP there.
IOW he wants to authenticate once at point A and when he walks up to point B he wants the laptop to pickup the newer hotter signal when I put another AP point in.
I have been noticing in my trap logs that there are an excessive amount of Client Association/Authentication Failures. I cannot figure out why. I have a Cisco 5508 WLC with 81 AP's (1131ag, 1142abgn, 1262N) models. The wireless devices are on a Windows Domain and use 802.1x EAP authentication, authenticating the user and computer info with a RADIUS Server. I look at the logs and all it can tell me is Reason:Unspecified ReasonCode:1. I read that the Reason Code is due to "Client associated but no longer authorized" but to be honest I am not sure what that means.
I have setup the WLC to authenticate to a MS Server2008 NPS for a WPA2/AES SSID. The connection is successful, but client authentication fails for wrong EAP-type. I believe this indicates a Windows7 client issue. What is the required client setup to satisfy the MS NPS?
I am having an issue here. I have 2x 5508 that each have 100 AP license and a little under 200 access points. Basically all of the access points are using DNS to connect to the primary controller that has the DNS entry. Basically half of my access points need to be on the second controller and in order to do this I have been using the high availability mode of each access point to push them to the second controller IP address.It was working perfectly until now. I have pushed 28 access points to the second controller and the last two I need to push at this location just keep resetting on the primary controller. Neither controller is configured as master controller.
I have access points deployed across several buildings that each have a different IP scheme and their own T1 line. Is it possible to configure the 5508 controller to allow these access points to use the IP scheme assigned for that particular building or will dhcp always assign an IP address to the connecting client based on the IP scheme of the building that the controller resides in?
I need an official document from Cisco saying the APs models supported by the WLC 5508. Specially, I need to know if the AIR-AP1242AG-T-K9, converted from standalone, will be supported by the 5508.
I would like to start setting up a Cisco Wireless Lan Controller 5508 with some Cisco 1262n AP's. How to start setting this to take advantage of having this wireless lan controller? I have a DHCP server, a Cisco 6509, and Cisco 3750g that connects the access points. I have Vlan 50 for wireless access points.
Access points 1142 controller 5508 running code 6.0.196.0 When you set the access point port speed with "config ap duplex full speed 1000 all" the access points leave the controlle and do not rejoin. I have had to reset the the access points manually with a power down and hold the reset button.
I'm having an issue in one open space area with a wifi network.I currently have 5 access points and around 100 users connected to the WiFi.There are desktops, Ipads and Mobile users connected to it.13,24,16,41,9 are the associated users to each access point. The one with 41 and 9 are only 10meters away from each other.
I read on some posts before having issues with APPLE and WIFI so cisco advised to disable the load balancing.I setup the client windown size to 10.On the networks the client roaming is with the default value.On the WLAN the Client Load Balancing is not checked.
We have an MPLS (layer 3) network 4 offices and a Data center. We are planning to install about 10 Access Points(3600 series) per office and have a controller(5508 series) in the Data center.
Questions:
1- Is this design possible, in other words, just one controller centralizing all Access point traffic in one controller in the Data center?
2- We would like to accomplish this in two phases: A- install access points without controller handling authentication thru Microsoft IAS servers (current configuration with 1200 series) B- Deploy wireless Controller in Data center and start migrating orphan AP to Controllers one office at a time.
We are having 5508 controller with Lightweight access points 1142, IS it possible to disable 802.11a on certain access points before turning it off completely on the controllers?? Could you provide steps for doing so on WCS?
I have Cisco 1131 & 1300 Light Weight Acces Points and I have 5508 WLAN controller. If i enable the wlan controller internal DHCP Server can this access points will work with this internal DHCP server or do i need to configure DHCP option 43 for these access points? Can these access points works with LWAPP or do i need to configure CAPWAP?
Wireless client connected to a 3602i AP running on 2500 series WLC with a latest 7.2 code. Client will now connect to AT&T vpn client - success.Client will connect to SAP application using netweaver gui - failed.With the same scenario, except for the access point being used, client will connect to SAP application using netweaver gui
We are evaluating the 5508 WLC Series controller. When trying to associate the 3602i/e wireless access points we have no success. However the 1131 and 1242 legacy AP's will associate.....LWAP Vs CAWAP ?
We've reloaded the 7.2.130 code and it didn't work.
I need to configure WPA or WPA2 authentication on cisco 1042N access points. But I believe that for this requirement I need to have either an internal or external RADIUS server, but my customer want to just a normal WPA/WPA2 authentication like what we configure on cisco WAP200 or WAP4410 accesspoints, is there any work arounds to configure WPA/WPA2 authentication in a simpler manner rather than configuring RADIUS server option?
I have NCS 1.1 appliance and added a 5508 WLC running 6.0.199.4 code using snmpv3. Controller is added to NCS, but it doesnt show any AP's which are there on the controller. AP count is zero. I have another controller with code 7.0.230 added and showing AP's though. AP model is 1252.
i have deployed WLC 5508 in head office with current 56 access points (mix of 1262N, 1141N and 1242) are regist ered and working fine, recently we extended to our remote office (connected over Layer 3 MPLS with OSPF Protocol) were none of the access points are not registering, i am able to reach to the controller from the specific VLAN and native VLAN without any issues. @remote site i have enabled option 43 and option 60 with the controller IP.
Number of APs.................................... 56 Global AP User Name.............................. ciscoGlobal AP Dot1x User Name........................ Not Configured
I'm planning to create a network of wifi access points all in different locations. Those locations all have different wifi routers and networks. I'm looking for a easy solution that let easily setup those networks to ask authentication credentials (in a browser page, once a user is inside the wifi and wants access the internet) by an external server possibly without overloading too much that server.
I can not get our 3602i AP's to register with our 5508 controller which is running 7.2.103.0 code. We keep seeing an error in the log on the WLC "AAA Authentication Failure for UserName:c46413c08e92 User Type: WLAN USER" and on the Access Point we are seeing [code]
I entered the CAPWAP ap controller ip address directly into the AP so it shouldn't be an option 43 DHCP issue
Access point gives all junk vlaues in console. I am getting all outputs while booting up and executing commands. But To say, it is as simple as printing with spelling mistakes
If laptop/desktop goes on sleep mode or keep connected with interface configured for 802.1X for more than 12 hours it does not work or not connect to Exchange server, Cisco ISE console, office communicator..for re authentication i need to restart PC/ Laptop or unplug and replug lan cable from it!but before restarting i am able to ping all DNS, DHCP, OCS, everything..[code]
I am designing wireless controller solution for one of our customer network with Cisco 5500 series controller, wireless client authentication part.
1. There are 25 departments around the campus, each will be given one or two access points. 2. One Cisco AIR-CT5508-50-K9 Controller shall be used. 3. Single SSID/ VLAN shall be used for entire campus. 4. Wireless Authentication credentials used by one department shouldn’t work for other department
We've recently boughten new equipment to upgrade/replace some of our aging wireless hardware. We're moving to a pair of 5508 controllers and changing over to ACS 5.4. Currently we're just doing MAC filtering with ACS 4.2 and local users. I'd like to move most of our SSIDs to some type of AD authentication. Are there any all encompassing guides that layout the design behind that? So far I haven't had much luck finding one!
Also, would it be possible to maintain some of the local ACS users/MAC filtering? We have some mechanical equipment that connects to our network (separate SSID) but cannot join a domain.
I having some troubles with Web Authentication in a WLC 5508 version 7.2 to make authentication with the corporative phones, ANDROID GingerBread 2.3.6 model SAMSUNG GT-S7500L. When I try to connect to the VisitorsWirelessLAN in order to authenticate with web authentication the page never comes, in fact the phone never gets the IP. I have an iPhone and I have not problems, I have a Samsung Galaxy S2 with ICS 4.0.1 and works perfect, is only with gingerbread
I've set up several local network users (Security > Local Net Users) on the WLC (5508 running 7.0.98.0). Whenever I try to connect with one of these user accounts (I'm testing this out for now), the attempt is unsuccessful and I see an "AAA Authentication Failure for UserName: xxxxxxx User Type: WLAN USER" in the Trap Log. I thought that after trying to authenticate through a RADIUS server, the local user database would be polled and then a user account in that database would be able to authenticate.
Can we configure the wireless controller 5508 to authenticate the clients using both of MAC address Filtering (layer 2 security) and Web authentication (layer 3 security). and what is the difference between (Web policy --> authentication) and (Web policy --> on MAC filter failure)
We just got a new 5508 wireless controller and the question we have is : can we get wireless users to authenticate to an Active Directory server to get access to the network? I know we can get the authentication done with an RSA server, but what about plain AD?
