Cisco Wireless :: Several Remote Sites And Centralized WLC5508
Nov 8, 2011
I have been asked to setup wireless and we have purchased WLC 5508 and 1142 APs.We have several remote sites and a centralized WLC. The requirement are to have a common SSID (Corporate) advertised across all the remote sites and have that SSID locally switched, and have another two SSID Guest and Mobile tunneled back to the central site (WLC).I want all the wireless (Corporate) clients to use the same subnet as the wired clients at each remote site, the IP assigment will be done by a DHCP server at the central site. The Guest and Mobile users will use a common subnet each across all the site and this will also be handled by the DHCP server at the central site.
I have enabled H-REAP with Centralized Authentication and Local switching but I'm not sure about the second part which is to have a common SSID (Corporate) across the remote sites and localy switched whilst having the other two SSIDs tunneled back to the WLC. Cisco TAC told me to configure dynamic interfaces for each of the remote site but then he said I still wouldn't be able to switch the Corporate traffic localy if I use a different subnet to the wired subnet for the wireless clients.
I have the attached diagram and I followed the instructions from another posts / forum cases and the Apple TV is still not working.
My questions are:
1.-The WLC controller and AP must be in the same subnet?. This is not my case, the AP 3500 is operating in a remote location and I have a centralized WLC 5508. 2.- I already configured the Controller --- > General --- > Broadcast forwarding (enable) + AP Multicast Mode (Multicast / IP: 239.20.226.197). 3.-I already configured the Controller --- > Multicast ---- > Enable Global Multicast Mode (selected) + Enable IGMP Snooping (selected) + Enable MLD Snooping (selected). Please see the attachment. 4.-Do I have to configure something in the Mobility Management --- > Multicast Messaging --- > (Enable Multicast Messaging + Local Group Multicast IP Address) ?????
The Apple TV Device and Ipad are authenticated in the ISE using certificates with no issues and both got IP's from the DHCP for the WLAN Vlan assigned to the SSID activated (see pictures attached).
we are in the midst of designing a wireless Mesh AP solution for our customer.
Customer Requirement:-
1. Customer wants to deploy REmote MEsh APs (1500 Series) with a centralized 4404 Controller at HQ site.
2. The Remote and HQ site is linked thru a leased line with 2 routers in between
Based on cisco's document REAP and HREAP is not supported in LWAPP Mesh APs. So if the Mesh APs were to be deployed at Remote sites (3 total). How this be achieved?
Our organization has multiple controllers at regional sites (one per region) & want to implement redundancy by placing one controller at headquarter's datacentre as a backup in case the site's failed.All our controllers are 5508 with 7.0.116.0 loaded I did a search around and found multiple documentations of how to do it but all related to creating a mobility group?Is it possbile to implement this scenario without creating mobility group ? (As in Cisco docs for software release 7.0 June 2010 - quoted "Centralized and regional controllers do not need to be in the same mobility group" )
I would like to know if there is a possibility to create 2 Remote access VPNs for 2 ASA situated in different sites and using only one PCF file.Is set up a tunnel between the 2 ASA the only way to reach the 2 destinations with the same PCF file?
I'm looking to put together a solution for a customer that wants to "bridge" between their current office and a new office space they have rented. I know how to set up a site-to-site VPN between two sites with different private IP ranges. For example, site A is 192.168.1.0/24 and site B is 192.168.2.0/24. But is it possible to make both sites appear as a single IP block? This way, systems could be moved one by one without renumbering.I am guessing there might be a way to tunnel the layer 2 traffic and make it work, but I am concerned about broadcast services being broken. I am using non-cisco platforms so I am just looking for pointers on the protocols that might be used so I can do further research.
We have a Main ASA 5520 and two remote site ASA 5505's that connect to each other via S2S VPN tunnels. Currently they are doing split tunneling, so only local traffic goes over the tunnel. We have are local LAN (10.0.0.0/16) and our DMZ (10.3.0.0/24) network at the main site. The DMZ hosts our external sharepoint, but we have access to it internally The problem is site A (10.1.0.0/24) and site B (10.2.0.0/24) have no idea of it, and when attempting to go to the site, it fails. You can access it via the external site address, but that's the only way. Normally the external address is blocked when you are internal.What i'm stuck at is even when we had all traffic sent from Site A to our main hub, it still wouldn't find it. Would i have to make a separate vpn tunnel purely for that DMZ traffic?
I have inherited a sbs 2008 network where they have a SBS2008 server and Server2008 running as a terminal sever at the main office and they have 2 satellite offices. These offices all connect through router to router vpn tunnels. The main site is on 10.0.0 and dhcp is done by the sbs. Satellite site a is on 10.0.10 and dhcp is done by the vpn router and Satellite site b is on 10.0.5 and dhcp is also done by the vpn router. All client computers can run rdp to access shares / programs etc on the two servers but when trying to push out group policy, antivirus updates or even using remote control through the SBS2008 server it is hit or miss. DHCP records on the SBS server do not seem to update correctly, manually changing the ip address in DNS records results in warnings that the PTR record cannot be created.
So I am wondering if the configuration they currently have setup is correct. What might be stopping some but not all computers from updating, why I can connect to some but not all computers at site "a" but I am not able to remotely connect to any computers at site "b".Why I can do remote installs of Eset Endpoint Security on roughly 10% of the clients but the other 90% fail.
I am installing 2 ASA 5505s at home offices with dynamic IPs. The EasyVPN server is a ASA585x. I am using the 5505s in NEM mode. I configured a unique DHCP scope on each 5505. I have a dynamic crpto map on the server. I configured unique tunnel groups, group policies and usernames for each site on the server. This seems to work fine. Is it normal to configure unique tunnel groups, group policies and usernames for each remote site?
We have a Cisco 2921 router at the head office (Easy VPN Server) and been deploying Cisco 887VA (EasyVPN remote - Network Extension) for remote offices using EasyVPN. We are allowing Voice and Data traffic over VPN. Everything has been working great until this issue was discovered today:
When a remote user behind Cisco 887VA calls another remote user also behind Cisco 887VA, the call connects and Avaya IP phone rings but no voice in either direction.
Calls to/from head office and external mobiles/landlines are fine. Only calls between two remote sites are affected. As there is no need for DATA connection between Remote office, our only concern is Voice support.
I think "hair-pinning" of traffic over VPN interface is needed. (Examples configs etc).
I have got two 878 integrated services routers and I need to configure them as transparent bridges in order to connect 2 remote sites over ATM.
As I'm testing the topology, I configured two switches (representing the sites) at each end with a VTP domain. VTP works while the switches are connected directly with eachother, but it won't work with the bridges in the middle. [code]
I have been working with my ASA 5505 VPN Concentrator to maintain a connection with one of my remote sites. I have several tunnels that work fine and dont have any issues at all, but one tunnel with outside IP ending in 146 and inside LAN 192.168.3.0 goes down every 24 hours. Attached is the config from the concentrator. I changed around the Security Association Lifetime Settings and the tunnel would drop after that amount of time expired. If I set it to 24 hours, the tunnel would drop every 24 hours. If I set it to 8 hours it would go down every 8 hours.
I have swapped the router a few times, double and triple checked my key settings, disabled keep alives on both ends, and this problem just started happening a few weeks ago after working fine for years. I also get the following e-mail error every time it goes down:
<161>Jul 10 2011 16:19:47: %ASA-1-713900: Group = xxx.xxx.xxx.146, IP = xxx.xxx.xxx.146, construct_ipsec_delete(): No SPI to identify Phase 2 SA!
5 - Remote sites (no static IP there) 3 - Remote users (comercial) 1 - Central building (using static ip address)
Is it possible to establish a permanent vpn tunnel between each one of my remote sites to the main building, even if I have no static IP address in the remote sites?
Do you think that RV180 is the best choice to mannage vpn connection between remote sites and the central building securely and faster?
for example, there are 3 sites, A, B and C. A and B are 1.5 km apart and both are separate LAN(mixture of wireless and wired). C is 35 km apart from A and B. I have to connect A, B and C so that they can communicate with each other. Security is required.
MY ISP installed one router in my lab.for internet connectivity they mail me steps :connect your Laptop directly to gi0/3 port to check internet connectivity with public ip 1.1.1.x and Gateway 1.1.1.1 with subnet mask 255.255.255.240 after connection I surprised because I am able to access only google sites like gmail,google search etc. but I am able to ping/traceroute all sites.from browser I am able to access only google sites only.In Router no firewall no such access list.
Currently we have 20 remote sites, each with 2-5 AP's each. They all connect back to our Main Data Site in the US and register on a single WLC5508.
We do not have a backup WLC, but are looking to purchase one. What I would like to know is, are there any problems with the secondary WLC being installed in our Main Data Site in Europe? These two main sites are connected via a 10M MPLS WAN.
So all the remote sites could still connect to the WLC in the US, but in the event of a WLC failure in the US, they would need to fail over to the site in Europe
I'm using WLC5508 /w 7.0..My client do not get its IP. Status shown "DHCP_REQD".I found in (Cisco Live) Troubleshooting Wireless LANs with Centralized Controllers This related with Enable/Disable DHCP Proxy checkbox. I solved. with Enabling this.But,
1) Why this box have been working correctly for longtime? No one did diable/enable this feature on my box.
2) I guest, ver7.0 Disables this chechbox by default. Or not? I also have others two 7.2 boxes. Those are all Enabled.
I have some problem about dhcp via VMware 7.1. My client connect the wifi and get ip address well, then, i turn on VMware (inside my computer) and set as the bridge mode. I found that my VM cannot get the ip-address from dhcp server and I using WLC5508 version 7.2. I try to connect via Switch, my VM get the ip address well.
looking at doing the site survey before detailed implementation. we plan to use a wlc5508, AP3602, a good tripod/stand, PoE switch and AirMagnet to conduct the site survey. i'm inclined to use a single AP and just a guest SSID and let AirMagnet merge the readings on where i 'locate' the AP (on 1 VLAN)
A customer have a bad coverage in a corner of his branch office. He like to add a mesh AP (MAP) in the near of that corner.
I checked allready the documention about Mesh but i'm not sure if Flexconnect and Mesh works togheter. This MAP is in a branch office and the WLC is in the head quarter therefore he likes to uses Flexconnect togheter with Mesh.
I have a customer who is going to deploy a WLC HA AP SSO setup. I have recommended them to have 4 Gigabit SFP modules in each WLC5508.The customer now asks if it is possible to only have one or two SFP modules in the standby unit ? As he says it is properly not going to go in service one time within the next five years if he is unlucky.
We have five cisco WLC 5508 and one WCS .The WLC is running on 7.0.116.0 version at present but we want to upgrade it to 7.4.100.0 but on cisco site at download location , the below thing is mentioned...
WLC Version 7.4.100.0 will need Prime Infrastructure Version 1.3 to be managed, Version 1.3 is not yet available to download at this point of time
Access Point Model----Cisco 3501i Series
So i want to know, can i upgrade it to this version when we are having the WCS in our network ?
In one week I need to import the config from my 4404 WLC to my new 5508, then I just want to change the mgnt IP address of the 5508 and then bring it into the same mobility group.How do I import the config when the 5508 is straight out of the box?
I have a WLC5508 and 25 LAP 1041. I use two wifi, one with RADIUS for data and other with wpa-psk for voip. The problem is the voip conectivity is broken.How can i improve the handover?
I have WLC 5508 with 6.0 software and kept in main office and 10 sites are connected . I created Group and hreap for the sites AP.Now customer wants the secondary WLC to keep on one another site. And the customer is asking all the configuration like ap group and all should come to secondary wlc automatically . In future also if he create any new group in primary it should come in secondary wlc.And if primary goes down the secondary should controll all the sites and when comes up primary should taken care.Active standbye mode.
My problem ist that i have 4 air-cap-1552e APs witch are powerde trugh Power Injectors. They worked fine for a few days but then the controller (7.2.111.3) lose connection to them. Right now i have only one Joined AP. The other 3 are status not joined. I can Ping all 4 Aps and wifi clients are connected through them.
I tried to implement WLC5508 in my network but when I came to connect it to the switch core which is a Catalyst 4000 the link didn't get up. This switch module is a fastethernet, I wonder if that might be the problem since I also tried connecting my laptop to the WLC and the link got up.
If that might be the cause, is it possible to get WLC to 100 Mbps?
I have on my desk a WLC-5508 that I need to setup to ship to a remote location. Normally we configure 4402 model and this model/version appears to be much different. I am trying to configure just enough via the command line to access the GUI via a laptop directly connected to the device. I’ve gone through the Wizard Configuration Tool where you set the hostname, admin account, and management interface (among other things). We use LAG and tagged VLAN on the management interface. I’ve been told in the past this is how we configured the 4402 models via laptop directly connected once the GUI is accessible, but with LAG enabled I don’t understand how a laptop could communicate via trunk, so I've disabled LAG and set the VLAN to untagged. In either case the laptop does not communicate with the WLC. Skipping ahead to my current setup I see the following information via the CLI:
we have a cisco WLC 5508 on which few SSIDs are configured, and two kinds of APs: AIR-LAP1142N-E-K9 and converted AIR-AP1141N-E-K9.
When in WLAN settings we leave WPA2 policy and AES encryption, iPads2 can connect without any problems to AIR-LAP1142N-E-K9, but there is no connection to converted AIR-AP1141N-E-K9. MacBooks, iPhones are connecting without questions.
When we set WPA2+TKIP everything is cool, but other Apple devices can't rich 802.11n speeds((
With only WPA2+AES or both WPA2+AES+TKIP enabled on a WLAN the WLC gets such messages :
Decrypt errors occurred for client xx:xx:xx:xx:xx:xx using WPA2 key on 802.11b/g interface of AP xx:xx:xx:xx:xx:xx
But I know that it can happen when you offer funny encryption combinations that client doesn't like (wpa1+aes, wpa2+tkip). But the advise to try to only enable wpa2/aes for some reason doesn't work.
how to set up support 802.11n on WLC4404 or WLC5508 in the 2.4Ghz? WLC4404 supports 802.11n? or support this protocol only in the brochures? I spent a few days, but did not get the result. I'm connected at speeds 65/130Mbit, but the real speed tests never exceeded 45Mbit. The AP from the test laptop is 7-10 meters.I tested the laptops with a Linksys AP E1200-EE ( 40Mhz, FastEthernet uplink port...)and received nearly 100Mbit!
At WLC5508 able to connect at speeds 150/300Mbit/c but only in the 5GHz band, but real speed tests never exceeded 70Mbit.In 2.4Ghz range I connected at speeds of 130/144Mbit/c, but actual measurements showed no more than the 45Mbit.
All tested with iperf and with site speedtest.net. iperf -w64K -s iperf -w64K -i 2 -t 300 -c x.x.x.x
Laptops: Asus (Atheros AR9002WB-1NG) and Sony (Advanced-N 6230).
My tests AP: 3501I-E and 1252AG-A SW on WLC5508 7.2.110.0
AP tested in different variants - open system and WPA2+AES.
