Cisco Wireless :: WLC 2504 / Group APs To Get Different Profiles?
Aug 21, 2012Is there way to group APs to get different profiles. I need to have some that have the 2.4GHz turned down and some wiht the 2.4 and 5.0 GHz on.
View 7 Replies
ADVERTISEMENT
AAA/Identity/Nac :: ACS 5.41 Same Username With Two Different Group / Shell Profiles
Mar 23, 2013In my ACS 5.4 I want to have same useranme to use two shell profiles. Here is the requirement.One shell profile with privelege 15 for IOS device admin and other one with different privelege for WCS admin.As there can't have two shell profiles on the same authroization profile, I created two different profiles, and match with the ACS local group name. However whenever user tries to access it always hits the 1st profiles.
View 3 Replies View RelatedCisco :: WLC 4402 / Order Of WLAN Profiles In AP Group From MIB Files
May 19, 2009WLC Model
---------
WLC 4402
Software Version
----------------
5.2.178
Problem Statement
-----------------
Do we have any Cisco WLC MIB to get WLAN profile (Order in which WLAN profiles are added inside an AP Group) information present in an AP group?
Cisco VPN :: 5510 - Separate RADIUS Profiles For SSLVPN Group
Sep 11, 2012We are starting to deploy SSL VPN in our company and we recently purchased two ASA 5510 firewalls. I have already completed the initial configuration but I do have some inquiry on how to have it configured properly.
1. Employees and clients will access the URL
2. They will select the appropriate group on where they should login.
3. Enter credentials, etc.
4. Username/Password authentication is via RADIUS. The usernames were all created in Cisco ACS 5.3.
My challenge is, we have several clients and all their usernames were created in ACS5.3. Meaning if the configuration is just being differentiated by group settings, clientA can select the profile of clientB and still get authenticated. If that happens, they will be able to access the resources of each other. Also in the future, we will be deploying 2-Factor authentication for some of our clients.
Cisco Wireless :: Multicast Group Range 2504 WLC
Jun 16, 20132504 wlc,When I open Controller and on the General page, if I make a change and apply it that change does work. But I get a popup message say Multicast Group address should be in range of 224.0.0.0 - 239.255.225.255.
Do I need to but something in there?
Cisco VPN :: ASA 8.4 LDAP Group To ASA Group Policy Mapping?
Jul 31, 2012I try to map LDAP Group to ASA Group policy following documentation:
[URL]
This is a config for ASA 8.0. I would have expected it to work on 8.4 as well but I do run into problems. The mapping as shown in LDAP Debug and ASA Log will actually happen but it is overwritten by the "GPnoAccess" Group Policy configured locally in the Tunnel Group. From earlier works with RADIUS I would have expected the user specific Attribute to be "stronger"?
ASA Log:
AAA retrieved user specific group policy (correct Policy) for user = XXX
AAA retrieved default group policy (GPnoAccess) for user = XXX
Cisco :: Number Of RF Profiles On 5508?
Feb 17, 2013I've searched the release notes for 7.2+, but I haven't found a documented number of how many active RF Profiles a 5508 can support. Any limitation of how many RF Profiles they can have?
View 3 Replies View RelatedCisco VPN :: Disable VPN Profiles In ASA 5550
Feb 11, 2010I need to disable approxematly 40 different VPN profiles in our ASA5550`s without deleting them (need the ability to quickly activate them again if needed). I thought maybe i could disable IPSec for those profiles, but since the IPSec is an attribute for Group Policy, i cant do it - as many other profiles are sharing the same policy.
View 2 Replies View RelatedCisco VPN :: ASA And ACS 5.3 Multiple VPN Profiles For One User
May 21, 2012I have a question about ACS 5.3 and ASA VPN profile authorization. I am not sure if it is possible to allow one single user for a set of VPN profiles on ASA, let's make an example:ACS 5.3 group hierarchy:VPN users global should have access to VPN profiles A, B and Z (here we create an authorization profile with no class an no lock attributes, so the group is allowed for all VPN profiles),VPN users A should have access to VPN profile A (here we create a authorization profile with class and lock attributes for profile A),VPN users B should have access to VPN profiles B and Z (is this possible and how does the authorization profile have to look like?)
View 3 Replies View RelatedCisco :: Lobby Ambassador Profiles In ACS 5.3
Jul 14, 2012We've set our WCS up to do AAA through our ACS 5.3 which works great. So in order to log into the WCS for Administration or as a Lobby Ambassador (to create guest users etc) the AAA is all done by the ACS, GREAT!
I have assigned a set of users the Lobby Ambassador role as passed that back through TACACS to the WCS, so those users have their role setup as Lobby Ambassador and are limited from doing anything else, as expected.
What I want to know is: With normal local AAA on the WCS, when you created a Lobby Ambassador account, you could give the account a set of defaults for any guests accounts created by that Lobby Ambassador account, which was good, so Lobby Ambassadors couldn't set up unlimited time accounts and stuff like that.
What I want to know now is that since I'm now doing all the AAA on the ACS, is there an attribute I can pass to the WCS in the Shell Profile, along with the roles etc telling the WCS what the guest user creation defaults for the Lobby Ambassador account is, so that we can continue to limit the defaults of any guest account that the Lobby Ambassador accounts create, as it used to be? We'd really like different lobby ambassadors to be able to do different things as well. i.e., Lobby Ambassador X can only create accounts for one region. Lobby Ambassador Y can create Unlimited time accounts where the others can not. We used to do this by assigning different guest user creation defaults to different lobby ambassador accounts on the WCS.
Cisco VPN :: One User Associated With Two VPN Profiles ASA 5510
Apr 3, 2011Is there a way that i can associate one user with two VPN profiles. Now here is the scenario.Our company has bought a win 7 64 bit pc for some of the employees , so i had to create anyconnect. But the same users are also connecting via normal cisco vpn client. they will give away these old pc but for the time being my need is that both users shall connect to anyconnect profile and ipsec profile.
I tried ti to assign same profile with both ipsec and svc so that they could use single profile but anyconnect didn't work. I am having cisco ASA 5510 as VPN gateway.And How many licenses does cisco asa have by default for anyconnect users. Here is the configuration for anyconnect
group-policy Broad_Anyconnet internalgroup-policy Broad_Anyconnet attributes dns-server value 4.2.2.2 vpn-tunnel-protocol svc webvpn split-tunnel-policy tunnelspecified split-tunnel-network-list value Nit_Broadcast_Network_Tunn_ACL address-pools value Broadcast_AnyPool webvpn svc ask none default svc
[Code]...
Cisco :: 3500 - WLC QoS Profiles Not Applying Egress
Sep 8, 2011In regards to QoS profiles on the WLC. I have applied a profile to a newly created WLAN and set the Per User Bandwidth to 512k and it seems to be kicking in on the ingress only, this is supposed to work ingress AND egress or is it just designed to work one way? I have a 4402-25 with Cisco 3500 AP's and am running the 7.0.98 code. If it is designed to work one way only is there a different way to apply it ingress and egress simultaneously off the WLC?
View 3 Replies View RelatedCisco VPN :: Adding User Profiles In AnyConnect VPN 2.5
Feb 15, 2012I recently upgraded to Windows 7 in my company and the OS came bundled with Anyconnect VPN client version 2.5.
In the earlier version I used to add user profile using a .pcf file by importing it into the client to access customer LAN.
But in the Anyconnect VPN client I dint find any option to import the file. The IT support has told to edit the xml file to add it. The problem is I even after i edit the anyconnect-cert.xml with changes in host name and host address tags I am not able to start a connection. I dont knw know exactly what address must be given in Host address tag. I copied the host address from .pcf file which i used earlier.
Whether I will be able to add a user profile in this way or any correction is to be done in the whole process of adding the user profile,
Cisco :: WLC 4402 / Can Use ISE Server And Make Profiles
Jun 13, 2012Customer has a WLC 4402 and 21 AP's LAP1131AG, there is a PDA wlan created to give PDA's and wireless Phones access to the webmail. This is done by access lists and firewalls. Now the customer wants more access to the internet in this PDA wlan, maybe in a later phase to the other vlans, can we use an ISE server and make profiles, is this the only additional server that we need or is an upgrade of the WLC and ÄP's also needed.
View 1 Replies View RelatedD-Link DCS-942L :: How To Switch Profiles
Dec 18, 2012I just bought new 942L (HW Rev3, 1.12 FW) and the only profile which is used to stream to iPhone or Web browser in mydlink is profile 3 which is limited to JPEG. Is there some way how to change the profile to be used for streams or is there a way how to make to profile 3 something else then JPEG?
View 1 Replies View RelatedCisco AAA/Identity/Nac :: Network Access / Authorization Profiles ACS 5.4
Apr 17, 2013For ACS 5.4: In Network Access -> Authorization Profiles there is a Permit Access profile. If you try to edit it a message pop's up that says: "The profile you have selected is reserved and cannot be deleted or modified". What this profile contains in its rule base? If I wanted to create a similar profile what Common Tasks, or Radius Attributes would I need to use? The same would go for a Deny Access profile. I have looked at the Common Tasks and Radius Attributes for a new profile and it doesn't seem very intuitive.
View 2 Replies View RelatedCisco VPN :: ASA 5510 - AnyConnect VPN Multiple Connection Profiles?
Nov 9, 2011I use a Cisco ASA 5510 with the AnyConnect VPN for remote workers. Now we want to give access to a select group of consultants who only need access to one sever and block everything else.
I was thinking this could be done by creating a separate AnyConnect Connection Profile on the ASA. From that new connection will come a new GroupPolicy with a ACL to only allow access to the one system. That GroupPolicy will point to the Radius Server looking for an account in a specific MemberOf group.
My question is - Could you explain how the ASA knows what Connection Profile to use when a user tries to authenticate? Does it automatically hunt down each Connection Profile until there is a username match via RADIUS in the Connect Profile?
Cisco VPN :: ASA 8.2.x / Assigning AnyConnect Client Profiles Based On The Machine?
Mar 3, 2010I have an ASA running 8.2.x code with AnyConnect 2.4.x.I have both Radius and LDAP (AD) AAA available.If a user connects from a company owned laptop, I want to push down AnyConnect client ProfileA (with scripts to map drives etc...) and network ACL's set A.
If a user connects from any other computer, I want to push down AnyConnect client ProfileB (no scripts etc...) and network ACL's set B.
What I would like to do is CSD to do a machine certificate check (for presence of a cert from my private CA) and to assign a EndPoint Policy attribute (Managed on successful check or Unmanaged on failure). I can then use DAP to tailor the ACL's that get set.
It seems like the only way to handle AnyConnect client profiles is with Group-Policy. Using LDAP I can assign a user to a Group-Policy, but I have no way of determining is they are coming in from a company laptop or not when assigning the Group-Policy. DAP can not assign an AnyConnect client profile.
If at all possible, I do not users to have to pick a conenction profile or use different URL's.
Pending - Windows 7 And XP Profiles On Server 2003 Environment?
May 16, 2011i have recently added to a domain. The initial setup is a server running windows 2003 and several xp machines which logon to the domain using mandatory profiles. However, after adding windows 7 machines and logging them on to the system it doesnt load the profiles. (which is fine as I understand you cannot use the same profiles with windows 7+xp)The problem is it automatically creates a roaming profile when logging off and saves it back to the same path as the other profiles under user.V2 which is growing considerably and causing huge logoff and logon times.How can I get the windows 7 machines to not attempt roaming profiles back to the server and instead to just save the profiles locally when logging off.
View 14 Replies View RelatedCisco Firewall :: 5510 - AnyConnect Client Profiles Not Replicating To Standby ASA
Jan 18, 2012We have 2 ASA 5510's running in a Active/Standby configuration. It appears that most of the changes we make on the active unit are replicated to the standby unit. However, there are 3 AnyConnect Client Profiles on the active unit and none of them show up on the standby, the standby has no AnyConnect Profiles. We also have 1 OnConnect script on the active unit and it does not appear on the standby unit either.
I was under the assumption that all config items on the active unit would replicate to the standby. Is this not correct? Do I need to do something extra to get everything replicated? Are there other items that do not replicate?
Cisco AAA/Identity/Nac :: Acs 5.2 Unable To Launch Common Task On Authorization Profiles?
Feb 15, 2013I have recently installed acs5.2 evaluation on a vmware and i can't launch common task on authorization profiles when i click on it i have the bellow message javascript:cuesToggleTab('NetworkAccess',1,false,false
View 4 Replies View RelatedCisco Switching/Routing :: Different Netflow Export Profiles On Cat 6513 With Sup720
Aug 28, 2012Is it possible to have one netflow export profile (may not be the right word...) to send all the flow information to one collector and another profile to only send traffic to and from centain IP addresses to another collector? If it is possible on the hardware and software, any quick sample config?
#sh ver
Cisco IOS Software, s72033_rp Software (s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(33)SXH4,
#sho module 7
Mod Ports Card Type Model Serial No.
--- ----- -------------------------------------- ------------------ -----------
7 2 Supervisor Engine 720 (Active) WS-SUP720-3B SAL1115LJBR
Mod MAC addresses Hw Fw Sw Status
--- ---------------------------------- ------ ------------ ------------ -------
7 0017.9444.9814 to 0017.9444.9817 5.3 8.4(2) 12.2(33)SXH4 Ok
Mod Sub-Module Model Serial Hw Status
---- --------------------------- ------------------ ----------- ------- -------
7 Policy Feature Card 3 WS-F6K-PFC3B SAL1115L2NH 2.3 Ok
7 MSFC3 Daughterboard WS-SUP720 SAL1115LH7W 2.6 Ok
Mod Online Diag Status
---- -------------------
7 Pass
Cisco AAA/Identity/Nac :: ACS 5.3 - How To Associate Identity Group With AD Group
May 1, 2012how to associate an AD group - which i have defined in users and identity stores/external identity stores/Active Directory/Directory attributes to associate with the relevant identity groups - Users and identity stores/identity groups Is there an example of this being done somewhere as i am having problems understanding how to do this from the user guide.All i want to do is associate identity groups with ad groups.
View 3 Replies View RelatedCisco Wireless :: Why POE In 2504 - Cannot Be Used For AP
Mar 2, 2013Why a 2504 Poe? If it can not be used for AP.
View 10 Replies View RelatedCisco Wireless :: WLC 2504 - Upgrade From 7.2. To 7.4?
Jan 22, 2013I'm planning to upgrade our WLC 2504 from 7.2.111.3 to 7.4.100.0 but the cisco site says "WLC Version 7.4.100.0 will need Prime Infrastructure Version 1.3 to be managed, Version 1.3 is not yet available to download at this point of time" Is it something about NCS? we have only 1 cisco WLC 2504 and 6 1142APs.. Also let me know is it possible to go directly from 7.2 to 7.4 ?
View 8 Replies View RelatedCisco Wireless :: WLC 2504 Max AP Support?
Nov 28, 2012what is the maximum number of APs supported on Cisco 2504 WLC?According to the Data Sheet it is 75:
[URL]
But according to the config guide it is 50:
[URL]
I believe the correct number is 50, but I just want to be sure.Is this a software limitation?
Cisco Wireless :: WLC 2504 - Some Clients Gets IP As Zero
Aug 29, 2012I've problem with a WLC 2504. Some Clients like phones and Thin Clients get an IP 0.0.0.0.Software Version is 7.0.235.0. Test with a Laptop seams to be OK. Some printers also got an 0.0.0.0.Around 30% are not OK. also had the log: Impersonation of AP with Base Radio MAC 00:yy:yy:yy:yy:yyusing source address of 00:xx:xx:xx:xx:xx has been detected by the AP with MAC Address: 00:yy:yy:yy:yy:yy on its 802.11b/g radio whose slot ID is 0 The problem is, I cannot go to 7.2 version because I have 2 x AP 1231 and 2 x 1242 AP's.1231 AP's are not anymore supported in 7.2 Version.
View 14 Replies View RelatedCisco Wireless :: Two WLC 2504 In Same Network?
Aug 15, 2012I have two WLC 2504 controllers. These controllers are for two different buildings. But they share a VLAN, and network address range. How can I control the access points to the register selected only at a specific controller.
Example:
AP 1 -> WLC 1
AP 2 -> WLC 2
AP 3 -> WLC 1
Since the buildings also broadcast in different SSID. The two controllers are in a mobility group.
Cisco Wireless :: WLC 2504 IOS Update?
Jul 12, 2012If we update our ios on WLC do we have to add the certificate for AP's again or we don't need to do that.
View 4 Replies View RelatedCisco Wireless :: 2504 - WLC 7.4.100.0 Downgrade
Mar 13, 2013Some time ago I updated a WLC, model 2504, from version 7.3 to 7.4.100.0. I also update the FUS (Field Upgrade Software) to the latest release, 1.8.0.0. Now I need to downgrade the WLC back to 7.3 version.
My doubt is: Can I just take the normal processes and downgrade the WLC back to 7.3, even with the FUS in version 1.8.0.0?
Cisco Wireless :: 2504 - AP Cannot Join WLC
Jun 10, 2013I'm new in installing WIFI, I have WLC 2504 using 7.4.100.0. I have AP 1600 (AIR-CAP1602E-E-K9)
I installed the WLC and AP in a cisco poe switch, wlc and ap are in the same subnet and can ping ap from WLC, but the AP cannot join the wlc. i have this error message
(Cisco Controller) >show ap join stats detailed 00:06:f6:d6:03:f0
Sync phase statistics
- Time at sync request received............................ Not applicable
- Time at sync completed................................... Not applicable
Cisco Wireless :: CT5508 / RF Group Members Not Seeing Each-other
Nov 28, 2011I've two wlc model CT5508 version 7.0.116.0. They are working fine except for the RF grouping part. When I look at the RF Group members part in the configuration, I can see only one wlc (the one I'm connected to). If I connect to the second one, in the same part, I've just one controller (so the second one..). I tried to restart the algorithm but no change. Each controller is configured with Group Mode set to auto, and their respective role are auto-leader...I tried to change the RF group name on both wlcs, but it didn't fix the problem. When I look at the logs, there is one which appear quite often:
*emWeb: Nov 29 10:32:07.764: %LOG-6-Q_IND: dtl_arp.c:2581 ARP input q exceeds limit. Current val = 50 [...It occurred 38 times.!]
Cisco Wireless :: WLC 4400 - AP Group Information
Aug 26, 2012We have 4 x 4xxx WLCs setup in our Core. I just created an AP group in one of WLC and in theory I should see that AP group in the other 3 x WLCs
For some reason, I do not see that AP group appear in other 3 x WLCs. Very much appreciated if someone could point me to the right information or trouble shooting steps.