Cisco Wireless :: WAP4410N 802.1x Dynamic VLAN Assignment?
Nov 27, 2012
Does the WAP4410N support Dynamic VLAN assignment by means of 802.1x authentication?
The reason why I ask this; I am able to configure a SSID on a WAP4410N with WPA2-Enterprise, in combination with 802.1x PEAP network authentication. I can succesfully connect Windows, Windows RT, Windows Phone, iOS and Android devices. But.. I am unable to designate them to another VLAN based on access/connection policies. For example; I want mobile devices such as iPhone and Windows Phone to be assigned to a specific VLAN. The Wireless Access Point (authenticator) must be able to support that.
This is my setup:
Spplicants: Windows 8 / iPad / ...
Authenticator: WAP4410N
Authentication Server: Microsoft NPS (Network Policy Server)
I used 802.1x PEAP (Protected EAP) with password (domain user) authentication. In fact, the suplicants communicate with 802.1x to the authenticator. The authenticator communicates with RADIUS to the authentication server. NAP is not in between. It's just plain 802.1x authentication.
wether dynamic VLAN assignment is supported?
View 5 Replies
ADVERTISEMENT
Jan 16, 2011
I have just upgraded our WLC from 4.0 to 7.0 (via 4.2). Before the upgrade we had our ACS returning a VLAN based on user group. This seemed to be working without an issue. Now that the WLC is on version 7 this is no longer working correctly. The ACS is returning a VLAN and passing the user but the client can not get an IP from the DHCP server configured.
Example configuration:
SSID-----VLAN
PN-CSC-----CSCVlan: Works
PN-Others------OthersVlan: Works
PN-Others-----CSCVlan: No DHCP
When users are trying to be allocated to a vlan that is different from the native one the DHCP fails however both WLANs are configured to point to the management interface so dont have any real connection to the vlan other than by name.
Have there been any changes I haven't seen in the way the dynamic vlan allocation works in version 7?
View 8 Replies
View Related
Dec 13, 2012
I'm having trouble getting the dynamic vlan assignment to work on my 1242AG Cisco Aironet APs. I've seen multiple cases with a similar setup and configuration where it works just fine. I've tried everything I can think of. IAS and AD is running on Windows Server 2003.Everything works fine except the vlan assignment. Wireless clients successfully authenticate through IAS and Active Directory, but instead of being switched to the appropriate vlan the client stays in whichever vlan/ssid it originally connected to.PEAP is the authentication method, using MS-CHAP v2. Naturally I have the attributes in the policy set appropriately,[code] I've attached the config for the AP, which shows that I have two vlans/SSIDs set to cipher, aes, network eap, wpa, etc. I noticed that if the Tunnel-Pvt-Group-ID attribute is set to a vlan id that doesn't exist on the AP then the AP makes an event log saying so.
View 16 Replies
View Related
Jan 28, 2013
When the users connect their laptop they are getting a authentication prompt but the switch is not changing the VLANs on the port after successful authentication.Below are the logs on the switch
Jan 28 2013 17:21:32.417 CST: RADIUS: Framed-MTU [12] 6 1500
Jan 28 2013 17:21:32.417 CST: RADIUS: Called-Station-Id [30] 19 "E4-D3-F1-0B-C6-0A"
Jan 28 2013 17:21:32.417 CST: RADIUS: Calling-Station-Id [31] 19 "84-8F-69-A8-BD-1D"
Jan 28 2013 17:21:32.417 CST: RADIUS: EAP-Message [79] 45
[code]....
View 1 Replies
View Related
Jul 11, 2012
I have a SG300-28P switch. I just read in the Administration Guide that, when in Layer 3 mode, the switch doesn't support MAC-based VLAN or Dynamic VLAN Assignment.
So, in order to assign a client to a VLAN based on their MAC or based on the response of a RADIUS server, we have to disable layer 3 features. Without layer 3 switching, the switch is unable to act as a default gateway and forward packets between VLANs. As a result, the VLANs can't communicate in any way, or access the internet, unless a separate router is connected to every VLAN. Right? Doesn't this limitation significantly reduce the usefulness of the DVA feature?
View 2 Replies
View Related
Nov 23, 2012
I`m working on Dynamic Vlan Assigmenton the basis of end user authenticatedwhoc are part of specific AD Group in c ampus enviorment.Objective: Need to assign the vlan on switch port on the basis of authenticated users OU Group in Active Directory. Eg: There are 2 OU groups in AD, Sales and Administration. Authenticated user in Sales group should get Vlan 10 and user in Admininstration Group shoudl get Vlan 20.
Components:
Cisco 3750x/Cisco 4500
ACS Version 5.2
Microsoft AD
View 1 Replies
View Related
Apr 11, 2013
I'm trying to use 802.1x to authenticate clients on my network with dynamic VLAN assignment from RADIUS. We have IP-Phones(powered by PoE) that only supports EAP-MD5, and we would rather use MAB(it also uses LLDP-MED for some settings) to authenticate the phones using the MAC-range from the phones vendor. The following scenario works perfect:Connect the phone and let it boot up(takes a while) and authenticate with MAB.Connect a computer in the phones data-port and let it authenticate with 802.1x(or fail and reach guest-vlan) However, the following scenario doesn't work:The computer is already connected to the phoneThe phone is then connected to the switch What happends now is that the computer is authenticated using 802.1x before the phone boots up and get's authenticated with MAB. When the phone is ready, it's authenticated with MAB and everything works. However, after a short period(let's say a minute), using `debug authentication all`, we see a "NEW LL MAC: phones mac" message(which is weird since the mac has already been MAB-authenticated), and then we are unable to contact the phone using ping. When I check `show mac address-table` it has now moved the mac from `Port Gi 0/12` to `Port Drop`. However, if I check `show mab interface Gi 0/12` or `show authentication sessions` it lists the phones-mac as `mab auth sucess `.why the first scenario works, and not the second?
The switch is a 3560E PoE 24p with IOS 12.2.58SE2. Sample of the switch-config: network-policy profile 1voice vlan 90!interface GigabitEthernet0/12switchport mode accessnetwork-policy 1authentication control-direction inauthentication event fail retry 1 action authorize vlan 60authentication event server dead action authorize vlan 60authentication event no-response action authorize vlan 60authentication event server alive action reinitializeauthentication host-mode multi-domainauthentication order mab dot1xauthentication priority mab dot1xauthentication port-control autoauthentication periodicauthentication violation replacemabdot1x pae authenticatordot1x timeout tx-period 5dot1x max-reauth-req 1spanning-tree portfast!Btw, when we tried authenticating the phones using 802.1x too (EAP-MD5), there are NO problems in any of the scenarios. However, we want to use MAB instead of 802.1x to avoid the requirement of configuring the phones with a username and password. The RADIUS response was the same when using 802.1x as it is with MAB for the phones (including device-traffic-class=voice AV-pair).
View 2 Replies
View Related
Aug 7, 2011
I have Remote Access VPN users (IPsec) who are terminated on Cisco ASA 5520 (v8.2). For those users, AAA is done on the ACS. Group-policies and tunnel groups are defined on ASA. Initialy I had all VPN users defined on ASA and group policies were associated with each user. Each group policy had it’s own IP pool for users. Now, I moved users to ACS. How can I associate group policy, defined on ASA, with users group defined on ACS? Is it possible that ACS send to ASA information about IP pool for different group policy? Users will use ONE vpn profile BUT based on the Active Directory group they belong to they obtain a different IP address for each group.Can it be done ? ACS version is 5.2.
View 1 Replies
View Related
Jan 6, 2013
Is it possible to disable DCA for a couple of APs and manually force the channels assignment ?
View 3 Replies
View Related
Apr 8, 2013
I was wondering if it is possible to do dynamic VLAN assignment on the Cisco Wireless Controller 5508 without using Cisco ACS but use Microsoft NPS server instead?
View 3 Replies
View Related
Sep 10, 2012
The Wireless_Employees authorization profile,assign vlan 666 for wireless employees.ISE is passing VLAN 666 to the WLC - see attachement Radius Auth-VLAN666.jpg then I look on the WLC at a wireless employee who has successuflly connected to the network, WLC is still placing him in the pre-configured VLAN 7.
1. can VLAN be pushed from ISE to the WLC (code 7.2.103) for specific user session?
View 3 Replies
View Related
May 18, 2013
I am configuring 802.1X in a 3560 Switch, my Radius server is a Microsoft IAS, when I connect a station of a guest user, the guest-vlan is not assigned in the port, and I have these logs:
May 8 21:23:02: dot1x-ev:Received an EAP Timeout on FastEthernet0/8 for mac 0000.0000.0000
May 8 21:23:02: dot1x-ev:dot1x_guest_vlan_applicable: Guest VLAN not
[Code].....
View 7 Replies
View Related
Oct 17, 2012
I have one L3 Switch which is connected to three L2 switches and then three WAP4410N devices are connected to L2 switch. I configured three diffrent VLANs for my users. i want to configure like this:- one VLAN for wired user, one VLAN for Wireless and one another wireless VLAN for the Guest user. guest user must have limited access. how can i configured wi-fi VLANs to my Wi-Fi device.
View 2 Replies
View Related
Mar 6, 2012
We are trying to setup a WAP4410N with 2 SSID's. One SSID for our private network and the other for guest internet access. On the VLAN and QoS page there is a setting for priority. What would be the suggested values for this setting? We obviously want our private network to receive priority over our guest network.Also, does VLAN Tag setting need to be on Tagged to determine private from guest traffic?
View 2 Replies
View Related
Jun 26, 2011
I have some 1130AG access point and I'd like to have :
- Multiple broadcasted SSIDs (because most of my clients are OSX and OSX doesn't deal with hidden SSID at all ! the clients have to enter the data each time which for WPA2 enterprise is really annoying)
- Dynamic VLAN assignement (so my clients don't have to know to which VLAN they belong and so I can easily change them from one to another).
As it turns out, it's apparently not supported to have both. But I can't understand WHY ? What exactly is the relation between those features ? What's the underlying technical constraint ?
I can understand the cipher suite must match between all the dynamic vlan because of the way wlan works, but for this, I really don't see what the problem is ... (Especially since I only have one of the SSID that needs dynamic assignement, the other is really the 'guest' one).
View 4 Replies
View Related
Aug 21, 2012
I am using several SG300-28 Switches with firmware version 1.1.2.0.I have dynamic VLAN enabled. As RADIUS server I am using free radius 2.1.12.Authentication is only based on the MAC address. (I configured that on the switches)On the switches I created three VLANs. VLAN100 for the authenticated clients, VLAN200 for Management interface and VLAN300 as Guest VLAN. After a wrong authentication the clients should be put into this Guest VLAN immediately (I configured this on the switches). I am using Windows XP and Windows 7 clients in my network. I did not configure any EAP settings because I just wnat to use the MAC address.
In most cases the dynamic VLAN assignment and authentication is working fine. The switch log says that the client is authenticated and the same I can see on free radius log. But in some (rare) cases the client is rejected. The CISCO log says "MAC aa:bb:cc:dd:ee:ff was rejected on port ge17" but when I look at the free radius log then this MAC address was successfully authorized.
The problem is that the client gets an IP address based on the Guest VLAN300 but after that the switch seems to "switch" the VLAN on the port and then the client is authenticated correctly on the right VLAN but the client does not request a new IP on the new VLAN. If I unplug and re-plug the LAN cable in most cases the client get the correct VLAN and the correct IP. This is happening randomly on nearly all my PCs.
Do I have to set some timers higher ? I don't think it is a problem between switch and RADIUS but a problem between communication of the host and the switch.
View 14 Replies
View Related
Apr 22, 2013
I have enabled IP DHCP snooping on a 24 port 3560 switch (v small office) and let the database fill up, now I have added dynamic arp inspection on the single vlan and I amd getting these errors.
Apr 23 16:15:34: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Fa0/5, vlan 1.([5835.d9b0.b9d1/172.30.5.2/0000.0000.0000/172.30.5.3/16:15:33 BST Tue Apr 23 2013])
Apr 23 16:15:39: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Fa0/8, vlan 1.([0004.f2be.55e4/172.30.5.5/0000.0000.0000/172.30.5.8/16:15:39 BST Tue Apr 23 2013])
Apr 23 16:15:40: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Fa0/8, vlan 1.([0004.f2be.55e4/172.30.5.5/0000.0000.0000/172.30.5.8/16:15:40 BST Tue Apr 23 2013])
[Code] .....
View 2 Replies
View Related
Feb 6, 2012
We have Cisco Cat4503 series L3 Switch and Cisco L2 2560 Series Switches, some of the users want to have a dynamic VLAN membership, and connecting with the network as mobile users,
can it possible and create dynamic VLAN for specific group of users.
View 6 Replies
View Related
Apr 30, 2011
I have the following equipment:
Cisco 871W router
2x WAP 4410N APs running 2.0.3.3
I currently have 1 AP connected to the router via copper. The AP to AP link is over 802.11. I have attached a diagram reflecting the current topology.
The AP-to-AP link will come up utilizing B/G/N mixed mode; however, the connection is basically unusable. About 30% of the traffic is dropped, while the packets that do make it have a consistently volatile latency, anywhere from 15 to 1500 ms. I have had success using G-only and B/G mixed. The link is stable (I have had the best results with B/G). The problem is, I didn't buy the 2nd 4410N to run the G protocol. I would like to connect the APs running either B/G/N (hopefully negotiating to N) or N only. I am wondering if there is a certain configuration I can utilize (perhaps using WDS repeater or bridge versus Wireless Client/Repeater?), or a firmware upgrade set for release that can make this happen for me.
View 1 Replies
View Related
Feb 12, 2012
I have a Cisco SG200 26 Port Switch, 2 Cisco WAP4410N Access points, and a VLAN aware Router. I have created 4 VLAN's. For the sake of this conversation lets call them.
98 - Intel Vpro
99 - Management
100 - General
101 - Guest
The Access points are capable of doing V LAN tagging so I plan on having them tag a guest network as V LAN 101. That can get sent to the V LAN aware router and out. No problem. I have some devices, or management pages that I don't want accessible from the general network. (Intel V pro KVM, Remote Management Cards, AP Config Menus, Switch config menu...) . I need to be able to take a V LAN unaware device, plug it into port 1, and have it communicate with V LAN 98, 99 and 100.
View 1 Replies
View Related
Sep 1, 2011
We are using WiSM WLCs and WCS to control a variety of 1131,1142 and 1252 APs utilising AP groups.
I've noticed on WCS that the power of certain APs is at a low setting, even though the APs surrounding them are also at a low setting. This is causing some gaps to appear on the heatmaps. I was under the impression that the WLCs would regulate the AP power to compensate for any gaps. Currently the global TX power level assignment method algorithm is set to automatic every 600 sec.
Now, obviously I could change this to fixed (not ideal as I may not want all my APs to run at max power all the time) or to on demand (also not ideal due to the increased admin).
Is there a way I can verify that the automatic power levels are adjusting as they should? Why are there gaps appearing in my heatmaps?
*NB It's not just the gaps on the heatmaps, I'm getting reports of dropping wireless signals from users hence me looking at the heatmaps and they just happen to correspond.
WLC version 6.0.199.4
WCS version 7.0.172.0
View 4 Replies
View Related
May 1, 2012
I have a deployment of AIR-CAP35021 APs. They are in 2 buildings with multiple floors. They are installed in a row down the hallways. I want to increase the power levels by using the controller and not configuring the APs individually. I have set the TPC value to -50 but I still do not reach the outer walls of the floors in some areas. I need to know what to set the Max Power Level Assignment or Min Power Level Assignment to to get the APs to power up some more. If the MAX value is 30 and the default is 30 then how to adjust that value?
View 5 Replies
View Related
Dec 1, 2011
We have a WLC 4402 controlling 40+ LWAPs. Is there a way to keep Tx power level assignment dynamic, but set the time of day it does it? I'd like to minimize user impact. (Firmware v. is 7.0.116.0)
View 2 Replies
View Related
Apr 1, 2012
In the settings, there is a spot in which you can set the range of IPs to assign to connected computers and other devices. This particular option is available under the "LAN" options. What I am seeing is that the only IP that is assigned within the range is the one and only device hardwired to the router. Everything else is being assigned IP addresses outside of the range. Am I missing something? I was under the assumption that any IP addresses assigned dynamically would be within the range whether they were wired or wireless
View 10 Replies
View Related
Sep 24, 2011
is it possible to use the asa dhcp server function to assign based on mac address (yet)? I have read numerous places that it was not possible (as of 8.2) at least, but I am workin in 8.4. I should have mentioned that I've already tried commands (asa 5510 btw)
View 4 Replies
View Related
Mar 5, 2013
I have gotten the assignment of constructing a fictional network for my school.. and i cannot quite agree with myself upon which equipment i should choose.. its supposed to be all cisco. i need to supply 5000 users all in all, but only 300 on this site. i need to know which connections would be the most reasonable to use and of course which routers "if any" and switches i need.. (+ additional modules if needed) i have tried to make a visio representation, but i just think something is way off.
View 6 Replies
View Related
Mar 29, 2011
I'm having a strange issue with a Cisco 3845 ISR router. I am setting up basic ACL and NAT but 2 issues occur. When using pat (overload) and a static nat assignment on the same subnet, the host with the static assignment has no wan connectivity except for icmp. The host is not reachable via the wan and the static public ip. Running show ip nat translations show the correct inside local and inside global addresses. The other issue is when applying an extended ACL to the outside or WAN interface coming in. No host on the inside has connectivity (icmp, tcp etc.) even to the gateway. I've cleared out all the ACL's as well as the ipsec tunnel settings and created only the nat overload and a single static assignment with the same results.I'm posting the running config below.
version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
[Code]...
View 13 Replies
View Related
Mar 3, 2011
I have a home desktop, home laptop, and work laptop that I use. I have Ultra VNC setup on my work laptop that allows me to remote into that machine when I am traveling for work. I have always been able to use the external IP address (not private) to login into the machine with no problem. This week, for some reason, I can no longer do that. When I started doing some discovery, I noticed that when I have all 3 machines booted up at home that the exact same external IP address is assigned to all 3 machines. The internal IP addresses are all different as they should be.Shouldn't each machine have a seperate external IP address assigned as well? Or is this working the way it should? I didn't change any setting on my router or DSL model. But I think the conflict that VNC is having on my work laptop is that it has the exact same IP as the destination computer and it fails. I can remote in if I use the private IP address (192.168.x.x) just fine.
View 1 Replies
View Related
Jan 13, 2013
I want to use RADIUS (of Secure ACS 5.3) to authenticate users within an ISP environment. Users log connect to a network using a point to point connection (L2) and then they are sending a RADIUS request to get IP adresses. Secure ACS is not quite easy to look through in that case.
View 3 Replies
View Related
Dec 1, 2011
my admin user is still being assigned privilege level 1, as shown in AAA Protocol > TACACS+ Authentication Details report.The report seems to show that the user is getting the right shell profile (Selected Shell Profile: Net-Admin -- is the one I setup for this user's group with both Default Privilege and Maximum Privilege set to Static 15). But still not the right privilege (Privilege Level: 1).Also, I found this document via Google: [URL] The router configuration examples all show this "aaa authorization exec tacacs+|radius local" command, which my device does not have.So I am wondering if I am not reading the ACS report right, or the device actually was assigned the correct privilge but that does not work without the "aaa authorization exec" command in the configuration?
View 1 Replies
View Related
Jun 7, 2011
how I can assign a static IP to a user in ACS 5.2. I am able to do it in ACS 4.2, but I don't see the same options under 5.2. General idea is that users authenticate from our VPN appliance via RADIUS, and upon authentication, their static IP is passed back to the VPN device. I can attach an arbitrary field to my local users by going to System Administration -> Configuration -> Dictionaries -> Identity -> Internal Users, but how do I get that IP address passed back when the user is authenticated via Radius?
View 1 Replies
View Related
Feb 8, 2011
I've got a network of several AIR-LAP-1242G LWAPP access points controlled by a 2112 WLC. I assign static IP addresses to each LWAPP, but every few weeks, a couple of them (at random) revert back to grabbing a DHCP-assigned dynamic address for themselves, despite the fact that they're supposedly solidy configured to have static IPs. What's going on here? Is this a bug in their firmware or the WLC's firmware? If I reboot the APs, then they come up with their static IPs, but after running some random number of days/weeks, will spontaneously change their own management IP addresses and grab a DHCP address for themselves.
The 1242G APs version numbers reported by the WLC's web GUI are:
"Software version" 5.2.193.0
"Boot version" 12.4.13.0
"IOS version" 12.4(18a)JA2
"Mini IOS version" 3.0.51.0
The 2112 WLC is running software version 5.2.193.0
View 2 Replies
View Related
Jul 19, 2011
is it possible with LMS 4.0 and VLAN Port Assignment also to configure auxiliary vlans?
1. I selected Configuration > Workflows > VLAN > Configure Port Assignment.
2. Selected my device (a test switch WS-C3560-8PC-S)
3. Clicked List Ports
All ports were listed, port Fa0/1 has only a native vlan, the ports Fa0/2 - 8 have native and voice vlans (auxiliary) configured manually.
So when I want to configure the voice vlan for Fa0/1 the voice vlan is set as the native one.
Is it only possible to configure the native vlans with the VLAN Port Assignment of LMS 4.0 ?
View 2 Replies
View Related
