Cisco Wireless :: WLC 5508 AP 1142 - SSIDs Segregation
Dec 26, 2012
Doing segregation of SSIDs Base on AP , I have the following scenario:
Head Office :
2 SSIDs (HO_WiFi , Guest) , Access Points which are working in connected mode and grouped on the default ap group .
Remote site:
2 SSIDs (Branch_Wifi , Guest) , Access Points working in flex connected mode and locally switching the traffic .
As shown above , I will be having Head Office , and other 20 Remote Sites with Access Points working in Flex connected mode. What is the best way to group AP and segregate SSID base on location. Above Scenario are build base on WLC 5508 and AP 1142.
I am trying to provision three 1142 AP's so they broadcast multiple SSIDs. I have set the following commands, but I am not able to get more than one SSID to broadcast. As you can see I added the "guest-mode" command to one of the SSIDs which took it without problems. That other SSID does not accept the command.
We recently received our WLC 5508, AP and switches to setup our WLAN but I'm having trouble getting it all to work. It's been months since the course and I'm having trouble troubleshooting the problem.I've setup the WLC, AP and switches and I have network connectivity to all. The WLC see's my AP and I have all my WLAN and interfaces configured (SSID broadcast is enabled) but I still don't see any SSID coming from the AP.
I am running a WiFi network built on Cisco 1262 APs and Cisco WLC 5508. My APs broadcast two SSIDs, let call them "WiFi_Pay" and "WiFi_Free". I have a problem: when users migrate from "WiFi_Pay" to "WiFi_Free" (not moving, connecting to the same AP), the connection fails. If they try for second time, it is always successful. My task is to ensure that such migrations run smoothly and be successful from the first attempt.
We have a 5508 controller with about 40 LAPs, running AIR-CT5500-K9-7-2-103-0-FUS software.The need has arose to have LAPs in various locations that only broadcast specific SSIDs.
I've got seperate dyanmic interfaces already created.We have 3 "Normal" SSIDs that we broadcast to the LAPs already associated with the 5508.2 more SSIDs were created (2 different purposes).
I just can't figure out how to get it to certain LAPs to only broadcast the specific SSIDs, while the rest broadcast the normal 3, but not those 2 new ones.
We have deployed a WLC 5508 w/ SW version 6.0.199.4, 1142 AP's & open authentication w/ MAC filtering. Clients are randomly getting dropped with "Limited Access" shown in Win 7. In this state, the client machine is unable to ping the gateway and sometimes lose their DHCP assigned IP as well. A manual disconnect/re-connect to the SSID is required everytime.I ran a debug on one the clients stuck in the "Limited Access" state (debug client xx:xx:xx:xx):
*Apr 15 16:59:23.205: e0:91:53:60:1f:e4 Adding mobile on LWAPP AP 3c:ce:73:c5:1e:b0(0) *Apr 15 16:59:23.205: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station: (callerId: 23) in 5 seconds *Apr 15 16:59:23.205: e0:91:53:60:1f:e4 apfProcessProbeReq (apf_80211.c:4722) Changing state for mobile e0:91:53:60:1f:e4 on AP 3c:ce:73:c5:1e:b0 from Idle to Probe
We did wireless coverage testing using some 1142 units in autonomous mode, and got a satisfactory result, but upon converting these test units to Lightweight and adding them to our WLC5508 controller, the coverage has decreased noticeably.
Any tips or tricks to getting lightweight 1142 APs to have a range as far as the same hardware with autonomous firmware?
Access points 1142 controller 5508 running code 6.0.196.0 When you set the access point port speed with "config ap duplex full speed 1000 all" the access points leave the controlle and do not rejoin. I have had to reset the the access points manually with a power down and hold the reset button.
After the upgrade of the WLC 5508 to version 7.4 the 1142 access-points LED blinking rapidly cycling through blue, green, and red. I found the following information to this behavior: "Access point location command invoked"
The configuration didn't change. How can I switch this function?
This first started when a user said they were getting disconnected and reconnected a few times a day to our wireless network. He is in a remote office with a 1142 which is set to H-Reap talking back to our 5508. Our WLC is running 7.0.166 The laptop has an intel ulitmate 6300agn wireless card with the latest 15.x drivers.
We are using an SSID with wpa2 and 802.1x auth back to our ACS server using PEAP with our windows credentials.attached is what i am seeing on the wcs troubleshooting page.When i do a debug client on the WLC i see many reauthentications coming from the client on the different radio.
*apfMsConnTask_2: Aug 22 12:59:36.762: 00:24:d7:d1:16:6c Reassociation received from mobile on AP 0c:85:25:f3:7d:40 *apfMsConnTask_2: Aug 22 12:59:36.762: 00:24:d7:d1:16:6c 10.24.8.108 RUN (20) Changing ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1621) *apfMsConnTask_2: Aug 22 12:59:36.762: 00:24:d7:d1:16:6c Applying site-specific IPv6 override for station 00:24:d7:d1:16:6c - vapId 512, site 'VH-GasWorks', interface 'management' *apfMsConnTask_2: Aug 22 12:59:36.762: 00:24:d7:d1:16:6c Applying IPv6 Interface Policy for station 00:24:d7:d1:16:6c - vlan 2, interface id 0, interface 'management' *apfMsConnTask_2: Aug 22 12:59:36.762: 00:24:d7:d1:16:6c Applying site-specific override for station 00:24:d7:d1:16:6c - vapId 512, site 'VH-GasWorks', interface 'management' *apfMsConnTask_2: Aug 22 12:59:36.762: 00:24:d7:d1:16:6c 10.24.8.108 RUN (20) Changing ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1621) *apfMsConnTask_2: Aug 22 12:59:36.762: 00:24:d7:d1:16:6c STA - rates (8): 140 18 24 36 48 72 96 108 48 72 96 108 0 0 0 0 *apfMsConnTask_2: Aug 22 12:59:36.762: 00:24:d7:d1:16:6c Processing RSN IE type 48, length 38 for mobile 00:24:d7:d1:16:6c
[code]....
Now this may be not be the issue thats causing our dropouts a couple times a day as this is happening every 5 mins.
I have a customer that wants to restrict SSIDs that groups get based on their AD credentials. Currently, he is using Windows 2008 Radius Server and AD with Cisco 5508 WLCs. I found examples that shows this is possible but my question is if I have 2 user groups (teachers and students) in AD and apply a policy for the Radius to send SSID x to teachers and SSID y to students. Upon successfully authentication, would this deny teachers access to SSID y and students access to SSID x?
I am trying to build a new network from scratch, I have the WLC 5508 w/ Aironet 3600e APs connected to my Netgear Smart Switches and a Linksys RV082 router that I'm using as my DHCP server with several VLANs for several stuff on my Switches.
I have 2 questions:
1. Can I have 5 Interfaces configured on 5 different VLANs, each SSID on each a different Port:
Port 1: Controller management only=> 192.168.x.x /24 Port 2: SSID 1: WiFi Internal=> 172.16.x.x/12 (Radius Auth with no sharing) Port 3: SSID 2: WiFi Internal w/ sharing=> 192.168.x.x/24 (Radius Auth with sharing) Port 4 :SSID 3: WiFi Guest=> 10.0.x.x/8 (Web Auth) Port 5: SSID 4: WiFi IT=> 192.168.x.x/24 ( Radius or certificate Auth with access to the controller management interface)
2. How can I use the Controller as the DHCP server for all the WiFi traffic, and how should that be configured to work with my other DHCP server?
- 5508/1142 - heterogenous Client with WZC, XP, SP3, SSO - ACS 5.2, MS AD
Target is Songle Sign On wih Machine Cerificates against AD. For testing purpose we tested with EAP-PEAP/MS Chapv2 and Machine Auth, works fine. Now we installed a Machine cert in the Machine cert Store (no User Cert) and reconfigured the WZC for using certs and Machin Auth. What we see is an Error Message in the System Tray that there is no certificate available. We checked it again, the MMC shows us a Machine cert in the Store.
We recently had a power outage where most of our AP's were down as well as our controller. When everything came back up most of the AP's didn't rejoin the controller without me resetting all of them. It seems as if the AP's might have booted up before the controller was up, but shouldn't they just try to rejoin at a later time? They didn't rejoin for 48+ hours on there own so I'm assuming that they were not ever going to re-join. All I had to do to fix it was power them off and back on and everything worked.
DHCP is on the local switch where the AP's are powered from so that's not a problem, and they had connectivity to the controller the whole time.
5508, and 1142's.Software version 7.2.103.0 on the controller.
I'm in a shop that requires our workstations to have two NICs. One attaches to a router and through to a DCHP internet connection. The other is a static IP via crossover to our instrumentation system. The issue is that these systems can be extremely remote and rely on satellite or 3G Network connections and are not overly reliable. Every time our net connection drops, BOTH NICs reset, causing us data loss from our instrumentation. Any way to separate the connections so that if one drops, the other is left unmolested?
I want to configure my Cisco 1811 router for 1 Internet link, The router is already connected to my main site via site to site vpn . Voice + VPN + Internet traffic is going through only 1 WAN interface,
I want to dedicate 512 kbps for VPN and voice traffic. I want to dedicate 512 kbps for Internet traffic.
I have a requirement where 3 Branch locations of an organization is connected to their hub location via MPLS.They have an internet connection only at HUB as shown in the diagram (Attached)Now all spoke locations should access internet via hub.At spoke locations is there a way that I can have Cisco 2900 router and dedicate only 30% of the WAN bandwidth for internet browsing traffic.Remaining 70% should be used for accessing applications at hub.
For example if i have 5 Mbps Mpls port at spoke I want to dedicate only 1 Mbps for internet browsing traffic remaining should be dedicated for accessing the application at hub.How can we acheive this? Can it be done by using PBR and rate limiting?
I just installed a brand new AP541N-A-K9 (running AP541N-K9-2.0(1) software) and cannot seem to add a SSID. I've tried both from CCA and directly from the Web interface (Wireless:Wireless Network Setup menu). The Add Another button doesn't seem to do anything. I've even tried multiple browser versions.
I have a 4404 with 3 SSID's configured on it. I only want all SSID's to be available on one floor in one building and not on any other AP's in any other building or floor.I thought the way to do it was via AP group but have not had any luck getting that to work. I setup a group for the AP's that I do not want all SSID's and then assigned those AP's to that group. However, I can still see all three SSID's where I only want to see 2 SSID's.
I want to split the usage of the AP so that visitors are on their own wireless connnection and VLAN.We have 2 WAP4410N APs. One AP acts as a repeater for the another AP.They are both in 4.0.4.2 firmware.We are using WPA2 RADIUS authentication, and would like for visitors to use WPA2 PSK. Under Wireless tab, I have 1 SSID, but the other 3 available boxes for SSIDs are greyed out.When I click in them, they will not allow me to type an ID.I watched a video of how to add SSIDs and VLANs, and it looked simple enough.He just clicked in the box and was able to add more IDs.Could my current config be preventing me from adding additional SSIDs?
I am trying to configure WLC 2504 with the following setup:
- three WLAN SSIDs - management/ap-manager interface on VLAN 10 - guest WLAN on dynamic interface VLAN 20 - main WLAN on dynamic interface VLAN 30 - WLAN for tablet and smartphone devices VLAN 40
At this point switch trunking is configured and three WLANs are mapped to three dynamic different interfaces. I can see all associated APs (which are on the same subnet as management interface on VLAN 10), and can ping each of the APs as well as gateways on L3 switch Catalyst 3750-x. Also, on the WLC interface I see that all WLANs are enabled and SSIDs are set to broadcast, all AP radio is in 'up' mode. DHCPs are configured on management interface and on all dynamic interfaces. L3 switch gateways all have ip helper-address pointing to main DHCP. 'sh vlan' and 'sh int trunk' commands on the connected switches show correct settings.
However, I see absolutely no any SSIDs to connect to on any PC or Mac computer I tested.
Is it possible to configure two SSIDs with same valn (default VLAN) with same IP addressing subnet on an autonomous 1240AG access point ios ver is 12.4 21a ja1.
I need to configure a WAP4410N for use on a small, very simple business network. There should be a corporate WLAN and a guest WLAN. The corporate WLAN should allow anyone connectd to it to access resources on the domain.
In front of the WAP is a cable modem/router and a basic Level 2 (web managed) switch. What do i have to do to segregate the corporate and guest networks.
I thought I would add the corporate WLAN to VLAN1 (assuming the default VLAN in the switch is VLAN1). Then I figured I could create the guest WLAN and assign it to VLAN2 which which will be controlled entirely by the 4410N (DHCP, DNS, etc.) Does this sound like the right way of going about things?
I have several Aironet 1231 APs most running 12.3(8)JEA software. There are 4 SSIDs on (each in separate VLAN), with only one broadcasting (called pubwifi). The broadcasting one is an open, unencrypted network: [code] After adding another braodcasting SSID (encrypted, separate VLAN), I encountered weird situation: my WiFi clients are unable to connect to pubwifi. It is not showing in the available networks or is showing as an "unknow" network. New encrypted/bradcasting ssid is advertaising just fine.
Currently my company has 1 primary SSID that is used throughout both floors of the building. We have 1252 LAPs which have 2.4 and 5Ghz antennas. I'm not sure if this issue is only with XP or perhaps it's the computer's drivers but we run into problems with end users going to a different location and having a very weak signal or nothing at all, yet coverage is fine. I believe the problem is the end user's machine selecting the strongest signal and it I have the feeling that switching bands isn't being done as it should when it's in range. So my question,
Should I split up our 1 SSID and created multiple SSIDs according to the location and include 5Ghz or 2.4Ghz in the SSID name so it's easier to ensure that users are connected to the proper signal? I want to ask if multiple SSIDs would still enable users to freely roam (as long as the ssids are configured) throughout the building without noticing a loss of signal but currently just having 1 SSID isn't really enabling people to freely roam around without connection issues.I don't believe having multiple SSIDs will be useful for the computer's choose their connection any more efficiently but allowing the user to manually see what they're connected to and pick something better according to their location.
I found a few older forum posts and documents online discussing how to create multiple SSIDs on 1 1252 AP using the WLC and they state that VLANs are needed for the interface and then I've read that multiple SSIDs on 1 interface are also possible. I'm not sure on how to actually configure this. I would like my 2.4Ghz radio on the 1252 to be associated with the current SSID in production and the 5Ghz band associated with another SSID that's in production. I couldn't find an option in the WLC or anything stated in the documents I've read about how to associate the radio band with the SSID.
I am trying to setup a RV180 and 3 wireless access points. I want the AP's to have 2 ssids that are isolated from each other. IE guest network and main network. I have setup VLAN's and my AP's support 802.1q and have ssid's with matching VID's. I was able to get this to work basically, but things seem to have gotten confusing when I plug the AP's into a POE switch instead of directly into the rv180. At this point I'm not sure exactly waht to ask. Maybe start by providing basic info on how I'm supposed to do this. I was under the impression that since both devices support 802.1q I could configure the VLANs on the router, and tell the AP's to apply a VID to the SSID and thing would work. This isn't the case unfortunately.
We have a Cisco 2505 WLC which can support 5 Ap's based on license. Is there any limitation on the no. of ssid's that can be configured on a wlc, how to determine that detail.
I have the need to run a few autonomous APs (1262) for some sites on satellite links. At a bare minimum I need to run two WLANs. One is wide open, and the other with an ACL that heavily restricts access. Is there any way to tie two WLANs to a single VLAN, while applying an ACL to just one WLAN?
I have two buildings that I'm trying to configure a bridge in between them using 2 1242AG APs.
Building A PCOFFICE SSID on VLAN 200 Radio G ROOT_1 SSID on Native VLAN 1 Radio A Root Bridge
Building B FDAPC SSID on Native VLAN 1 Radio G ROOT_1 SSID on Native VLAN 1 Radio A
We are using directional antenna. I know they are lined up properly because I have them both down and in front of me. I'm getting an error on the Building B AP that says " No SSID with VLAN configured. Dot11Radio1 not started." and I'm unable to get this to work. The bridge was working before I added the VLAN and encryption/WPA information for the PCOFFICE and FDAPC SSIDs
I have 2 cisco 1242Ag APs in one building and 7 in other building installed in my infrastructure. All these 9 APs are connected to WLC and all of them are added to default ap group to broadcast all the ssid... But 7 in the second bulding are working properly, but the 2 in the other building are not broadcasting the ssids. I checked the configuration in both APs and WLC as well... All the 9 APs are having the same configuration.
