I have two WLC 2504 controllers. These controllers are for two different buildings. But they share a VLAN, and network address range. How can I control the access points to the register selected only at a specific controller.
Example:
AP 1 -> WLC 1
AP 2 -> WLC 2
AP 3 -> WLC 1
Since the buildings also broadcast in different SSID. The two controllers are in a mobility group.
Our current way of configuration for this is standalone ap's with multiple ssid's. The main network ssid's are on the 10.0.0.0 networks. The internet only ssid is on the 192.168.1.0 network. ( this is a wireless network only,no wired) They all get there dhcp address from a layer 3 switch. To prevent the wireless 192.168.1.0 intenet only network from getting to the 10.0.0.0 networks, we just put a simple source & destination deny acl on the in vlan interface of the 192.168.1.0 network on the layer 3 switch.Now that we are impementing a Cisco 2504 controller, the management and ap manger are both on the 10.0.0.0 network.( both on port 1 with dynamic ap manager enabled) I can setup as many ssid's on the 10.0.0.0 network and they all work fine. But when I setup the 192.168.1.0 internet only ssid it will not connect. I'm assuming that its because the 192.168.1.0 network or anyone trying to connect and use that network has to go through the controller located on the 10.0.0.0 network. I'm thinking that the acl on the vlan interafce is the problem.So, if I'm correct, what is the best way to setup a separate internet only network through the private networks?
View 7 Replies View RelatedCisco 2504 wlc, 1142n ap, windows radius server.
When I click on Network, the only computer that shows up is mine. If I am hardwired then everything shows up (Servers, other workstations). Is this a problem with the radius server or something on the controller?
I recently got my Cisco wireless system working a few days ago and am back with a guest network. Our wireless system includes one 2504 controller and 2 2602i access points. So, I want a wireless guest network completely isolated from the LAN.
Here is what I have done.
I have created a new internal network and assigned 192.168.2.1 to an unused port on the firewall and 2.2 to a new controller interface with vlan 10. I can ping both 2.1 and 2.2 from the firewall and the controller. Basic network connectivity is working. The DHCP server is setup on this same firewall and configured only for this port. This address is referenced in the controllers interface.
A new w lan was setup and enabled. The proper interface group was selected on the w lan. I have left the default layer2 security.
As far as AAA servers tab in this wlan, this is where I am a little confused. I wish to just have a single log in for this guest network. I wasn't sure what to do so I went over to the Security tab and created a "local net users" account. I do not know how to reference the use of this under wlan, security, aaa servers. Should I check the box that says "local eap authentication"?? If so, I don't have a profile name in the drop down. What I'm looking for is the username/password to be stored locally on the controller itself since there will be only 1 account.
Under wlan, advanced tab, I do not have "Allow AAA override" checked. Should I?
Lastly, when I try to connect the client, it is not pulling a dhcp address. I wasn't sure if authentication was required before dhcp or the other way around so I'm not sure what to trouble shoot first, authentication or dhcp.
I have recently deployed a wireless network using a WLC 2504 with 21 Light APs. All seems fine except that Apple Devices drop their connections every 15 minutes or so. A couple of minutes later they can reconnect but obviously something is wrong.
View 2 Replies View RelatedIs there any way to configure a wired guest network with a combination of 5508 and 2504 wireless controllers? I am aware that the 2504 does not have wired guest functionality, however is it possible to set up a wired guest on the 5508 and using mobility anchors, transmit the l2 information through eoip to communicate with the remote vlan?Home built NAC solution, using 802.1x authentication on switchports for public areas. If user is an employee, communicates with the supplicant on their machine, and places them on an internal vlan.If user is a guest, user fails 802.1x check and is placed on a "guest" vlan with an ACL and external DNS.If placed on the guest vlan, the user has to accept a terms of use form.This is working currently with our 5508s without any issue, however we have some remote offices we'd like to roll this out to that are using 2504 controllers. I'm hoping there's a way that I can use the 5508 as an anchor or vice versa to make this work.
View 1 Replies View RelatedWe are planning for a modest expansion of our wifi network. Here is what we currently have, and what we are doing:
-2 1100 B/G AP's; a "primary" and a repeater. Both have a single SSID.
-1 1142 B/G/N; autonomous, with a different SSID
What we would like to do:
-Purchase a 2504 WLC and two more AP. Looking at a 3602 simply for future growth, but are not sold on the idea of such an AP. Would consider two more 1142. At any rate, we are looking for two more AP.
-Still keep our current AP's in use.
-Is a 5 access point wifi network, all controlled by a 2504 feasible?
-Will our existing investment of older 1100's and the single 1142 play nice with eiither a pair of 3600 (or 3500 or even 1142)?
-Can we go to a single SSID using all of this equipment, and clients connect at whatever speed is possible with whatever AP they are joined with?
I am new in networking. All my knowledge is based on books and no real life experience.At my job I am required to set up the network and configure all apparatus I never worked,before with.We have regular cable internet in the office. Modem is connected to Apple router (time capsule). No trouble. Now we are getting fibre optic in the office. Mngmnt has abought the following Cisco:
Cisco Wireless Controller 2504
Cisco 3501 AP 802.11g/n Ctrlr based AP
Cisco ASA 5510 Firewall appliance
Cisco Power Injector AP3500 Series
I have a 2504 WLC with a 1042 AP and I have it placed on my edge Cisco 3750 switch. I have the management interface of the WLC set on my WAN IP 71.x.x.x subnet range, and I have the WLC doing DHCP duties with a DHCP scope of 192.168.X.0. I have my DNS servers set on external DNS servers out on the Internet.I have two Cisco 3845 Routers on my edge network - one for each ISP with BGP protocol.
Since my native VLAN is 71.x.x.x, I added a sub interface on my main core router and gave it a 192.168.x.1 255.255.255.0 address for the gateway. Also, I added ip prefix-list iBGP seq 10 permit 192.168.x.0/24 le 32 to my main core router. On my secondary ISP router I added ip prefix-list iBGP seq 10 permit 192.168.X.0/24 le 32, and ip prefix-list OUT seq 10 permit 192.168.x.0/24 statements.
I added VLAN 10 to my edge switch and gave it IP 192.168.x.2 255.255.255.0, and the switchports that my core router and my WLC are connected to the edge switch, are in trunk mode with encapsulation dot1q 10. The switchport on my edge switch that the AP is connected to is in switchport access mode.
I can connect to the wifi with a 192.168.x.x IP address on my laptop, but I cannot get any Internet access. Is it possible to have the DHCP scope be in a different subnet than my WAN IP subnet, and allow guests to get to the external Internet only? Do I need to put the WLC somewhere internal on my network i.e. the DMZ and then tunnel the traffic out to the Internet with no Internal network access?
i must configure a secured wireless network with access restriction based on SSID. the equipements are : cisco wlc 2504 (soft 7.3) cisco secure acs aplliance 1121 (soft 5.4) . the users that will connect to the network are regrouped by identity groups, each identity group having it's own SSID. Clearly each group of users must access only one SSID. i followed the procedure below to configure it:
-- creating user identity groups;
-- creating users and assigning them to the groups;
--- creating authorization profiles for each SSID under policy element/ authorization and permission/network access/authorization profiles and putting the Airespace-Wlan-Id(the SSID number) in the radius tab.
--- assigning the authorization profiles to the identity groups under access policies.
after all these config the users can access the network using there userid/password configured. But the problem is Every user can access every SSID, seems like the restriction is so not very well configured.
i found some documentation on this kind of config but the version of ACS used seems older than the one that i use, so menu are very different.
I have a 2504 WLC and x6 1142 AP's and currently have this working on our corporate network (still in test phase). So far so good and looking at authentication via radius next for this.
We have a separate ADSL connection that is external to the corporate network and what i would like to do is based on SSID (in this case i'll use "Guest Access") i would like any clients etc that visit to be able to connect to our wireless but not be able to connect to our corporate network.
Why a 2504 Poe? If it can not be used for AP.
View 10 Replies View RelatedI'm planning to upgrade our WLC 2504 from 7.2.111.3 to 7.4.100.0 but the cisco site says "WLC Version 7.4.100.0 will need Prime Infrastructure Version 1.3 to be managed, Version 1.3 is not yet available to download at this point of time" Is it something about NCS? we have only 1 cisco WLC 2504 and 6 1142APs.. Also let me know is it possible to go directly from 7.2 to 7.4 ?
View 8 Replies View Relatedwhat is the maximum number of APs supported on Cisco 2504 WLC?According to the Data Sheet it is 75:
[URL]
But according to the config guide it is 50:
[URL]
I believe the correct number is 50, but I just want to be sure.Is this a software limitation?
I've problem with a WLC 2504. Some Clients like phones and Thin Clients get an IP 0.0.0.0.Software Version is 7.0.235.0. Test with a Laptop seams to be OK. Some printers also got an 0.0.0.0.Around 30% are not OK. also had the log: Impersonation of AP with Base Radio MAC 00:yy:yy:yy:yy:yyusing source address of 00:xx:xx:xx:xx:xx has been detected by the AP with MAC Address: 00:yy:yy:yy:yy:yy on its 802.11b/g radio whose slot ID is 0 The problem is, I cannot go to 7.2 version because I have 2 x AP 1231 and 2 x 1242 AP's.1231 AP's are not anymore supported in 7.2 Version.
View 14 Replies View RelatedIf we update our ios on WLC do we have to add the certificate for AP's again or we don't need to do that.
View 4 Replies View RelatedSome time ago I updated a WLC, model 2504, from version 7.3 to 7.4.100.0. I also update the FUS (Field Upgrade Software) to the latest release, 1.8.0.0. Now I need to downgrade the WLC back to 7.3 version.
My doubt is: Can I just take the normal processes and downgrade the WLC back to 7.3, even with the FUS in version 1.8.0.0?
I'm new in installing WIFI, I have WLC 2504 using 7.4.100.0. I have AP 1600 (AIR-CAP1602E-E-K9)
I installed the WLC and AP in a cisco poe switch, wlc and ap are in the same subnet and can ping ap from WLC, but the AP cannot join the wlc. i have this error message
(Cisco Controller) >show ap join stats detailed 00:06:f6:d6:03:f0
Sync phase statistics
- Time at sync request received............................ Not applicable
- Time at sync completed................................... Not applicable
I currently have a single 2504 Controller managing 50 AP's. I am adding a Second 2504 AP Controller with 15 Lic to manage an additional 10 AP's. My current 2504 has each port configured for my four subnets that and it is managing AP's in 4 buildings. Should I configure the new 2504 the same way so that it can see all four sites? All so if the main 2504 goes down can the second 2504 take over even thou we will be out of lic?
View 7 Replies View RelatedI have a problem in join my ap1130ag in my wlc 2504 i activate dhcp internel (172.19.1.50 ----> 172.19.1.60) in wlc and this wlc affected address for ap1130ag (172.19.1.51) wlc and ap1130ag is connected with switch 2960 (port 17,18) this port the switche is configured in trunk mod allowed all vlan then my wlc not detected ap1130ag?
View 4 Replies View RelatedI've got a 1524 ap and it wont join my 2540 WLC. The messages I see in the WLC is RADIUS authorization is pending for the AP. I've added the MAC address of the ap under AP Policies using MIC. I dont have a radius server either so not sure how to tackle this one.When I run debug capwap events enale under the wlc I see the following messages:Discarding discovery request in LWAPP from AP supporting CAPWAP.
View 35 Replies View RelatedWe have a 2504 on version 7.2.103.0 and 15 of the 1131 AG's.In short we cannot get the access points to register against the WLC, they seem to be caught up in a boot loop. They are seen on the WLC with a status of downloading, then once they have downloaded (Seen via CLI) I get an error message things I can confirm are The Country code is set to GB All ports are in Native VLAN Access points are ETSI type. It stops and restarts at syslog output DTLS-3-BAD-RECORD: Erroneous record recieved from x.x.x.x: Duplicate (replayed) record.
View 26 Replies View RelatedCan a 2504 WLC on a remote site provide guest access on one SSID, drop taht out locally on that site and provide corporate access on a second WLC that it then tunnls to a 5508 at the main corporate site ?
View 4 Replies View Relatedupgrade on the wireless controller 2504 from 7.0 to 7.4 is direct upgrade.My customer faced problem by upgrading the software 7.0 to 7.4 directly and the image hang.how should proceed recover the image 7.4/
View 7 Replies View RelatedI would like to get it clarified, that Cisco WLC 2504 running the code ( 7.2.110.0 ) does support IPv6 or not ?
From Cisco Documents they are asking to enable IPv6 support under WLAN > Edit Page, and Enabling mulicast on Ethernet Multicast Mode under Controller > General.
But from the GUI am not able to find the above two field, Even in Interface i created under Controller > interface is not accepting IPv6 address. I am able to configure IPv6 ACL .
Is any deployment document is available to show different scenarios with configuration.
Note - Am using Access point AIR-LAP1262N-N-k9
Currently I am using WLC 2504 with Software version 7.0.220.0. I am having some issues with Windows 8 clients they can't connect and I read on couple of review that wlc needs upgrade software.
I checked and latest versin is 7.4. Can I go to this version directly or I have to jump step by step.
I am trying to TFTP an image to a Cisco 2504 WLC. The management interface is 10.1.1.1 /24 and I have my PC connected to a port on the WLC with the IP address 10.1.1.10. However, I still do not have connectivity between the PC and WLC.
View 3 Replies View RelatedI am about to deploy a load of Aironet LWAPs into my organization. I've configured the WLC 2504 and have a couple of the APs working at our main site. I just needed to plug them in, and they worked perfectly, straight out the box. But I just want to know the following:
1 - will the same apply if I connect an AP at a remote site? Remote sites are on different subnets and connected via IPSEC. Will the remote APs just find the WLC?
2 - is there anything I need to set up especially on the WLC in order to make this work?
3 - what happens if the IPSEC connection drops?
My customer is seeing these Errors coming up on one of his 2504 WLC's (ver7.3) The MAC's and IP addresses Mentioned seem to be completely fictitious as the customers IP plan is way off these subnets and the vendor lookup tool cant resolve the MAC addresses.I can confirm that there is no conflict.I've seen them appear on other 2504's across his network on seperate occasions.
View 4 Replies View RelatedI have a 2504 WLC and 1042 ap's. Everything worked great in my test enviroment (of course). Now when I want to deploy the wireless, the ap's are not getting and ip for the windows dhcp server.
I have option 43 configured in dhcp, sub option 241>ip address of the controller
I have my A record in dns, cisco-capwap-controller.
*Mar 1 00:03:17.050: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
Not in Bound state.
*Mar 1 00:03:27.050: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
*Mar 1 00:03:27.054: %CAPWAP-3-DHCP_RENEW: Could not discover WLC using DHCP IP. Renewing DHCP IP.
*Mar 1 00:03:37.054: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
*Mar 1 00:03:47.054: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
*Mar 1 00:03:57.054: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
*Mar 1 00:04:07.054: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does not have an Ip !!
Not in Bound state.
We have a WLC 2504, since a few months, it was working fine, we have a guest Wlan configure with web authentication and the DHCP scope for this in the WLC. The problem today is that its no redirecting the web browser to 1.1.1.1, we try it with 3 laptops and they recieve a correct IP from the DHCP but still can not get redirect to the web authentication portal. Have the default configuration Internal (Default).
In laptops we check the firewall, dont have a proxy activate and have google DNS.. 4.2.2.2 8.8.8.8. In fact this laptops connected to this ssid before.
Can I set up a guest wifi connection on my Cisco WLC 2504 if I already have WLANs set up inside my corporate network? I want to use port 4 and connect it directly to my ISP so that it is outside of the corporate network. I set up an interface with a valid IP from the ISP and created a "Contractor" WLAN to use that interface.
View 6 Replies View RelatedI am trying to configure WLC 2504 with the following setup:
- three WLAN SSIDs
- management/ap-manager interface on VLAN 10
- guest WLAN on dynamic interface VLAN 20
- main WLAN on dynamic interface VLAN 30
- WLAN for tablet and smartphone devices VLAN 40
At this point switch trunking is configured and three WLANs are mapped to three dynamic different interfaces. I can see all associated APs (which are on the same subnet as management interface on VLAN 10), and can ping each of the APs as well as gateways on L3 switch Catalyst 3750-x. Also, on the WLC interface I see that all WLANs are enabled and SSIDs are set to broadcast, all AP radio is in 'up' mode. DHCPs are configured on management interface and on all dynamic interfaces. L3 switch gateways all have ip helper-address pointing to main DHCP. 'sh vlan' and 'sh int trunk' commands on the connected switches show correct settings.
However, I see absolutely no any SSIDs to connect to on any PC or Mac computer I tested.