I am planning to move our WLC's (5508) from a branch site to HQ so that all branch site APs will just report centrally in the HQ. There are two WLCs working as Active/Standby. Plan is to move one then the other. I am not really inclined with wireless.
View 9 RepliesOur controller get freezing every week at least twice, and do not know what is the reason. I am attaching the log for you to look at it. Last time happened was yesterday at around 13.00 pm.
View 15 Replies View RelatedI am setting up two 5508 controllers, one in HA mode, and one the primary for the remote sites in question. I plan to have these units service wireless for MPLS conected regional sites (each with their own local subnet). I was planning on using the cabled hosts network in each site for the wifi addressing and was thinking a different addressing for Guest Access, is this common? I'm obviously concerned with guest access clients but don't know enough how their trafiic is segregated from normal wifi traffic.
Also, when I stand up the controllers the management interface and ap-manager won't be in the same network as where the hosts or LWAP's will reside (routing access will exist though).
We have 2 Cisco 5508 WLCs, each wtih 50 licenses. What I would like to do is split the 50 odd APs between the 2 controllers load balancing the traffic. If a controller goes down or there is a break in the path all APs would failover to their configured secondary controller. So far so good.
However there seems to be no way to 'replicate' the configurations between controllers unless I setup HA , but as I understand it HA is Active /Passive, so essentially, unless you get a failover situaltion, completely 'redundant'.
Is there a way or either replicating between controllers automatically with out HA, or is there a way of making HA Active / Active?
I have two 5508 and one WCS server, the controllers are in one mobility group.Now I have to change the management IP addresses on the controllers. What are the correct steps to do this?
View 9 Replies View RelatedI'm looking into upgrading our 4400 series controller to 5508's. Currently we have a few sites that have 8-9 4404 100AP controllers and I'm looking to condense these down to either 3 5508-500 or 5 5508-250 depending on cost. I'm wondering what a good port to AP ratio is for controllers with licenses that can handle over 100 AP's. I know the general rule of thumb is 25 AP's per port, but that seems to me to be 4400 way of thinking. I'm trying to also reduce the controllers overall footprint, i.e. ports on the uplink switch, power consumption, rack space etc.
View 5 Replies View Related--- I have 2 WLC's 5500 that I have to set up on my network with the same configuration except I am not sure that they can be load balanced.
-- My only thought is to take a full class C and on each WLC set up a /25, thus each device can provision 120 IP's
--- This seems a bit archaeic, but is there anything else smarter to do? Can they be load balanced?
We are installing a set of 5508 controllers at one site in Tennessee. At another divisional site we have another controller that covers that division.
Both sites utilize the same DNS structure and would like to use the DNS entry CISCO- CAPWAP- CONTROLLER entry for bringing new AP onto the controllers at their sites, how would we go about configuring this?
I have two 5508 WLCs. Both have APs attached to them. If I create a guest account with the lobby administrator on one, will that user account be able to log in to the network if the client is attached to the ohter WLC? So far, I have found that I need to create the same user on both WLC's, in order to have the user login.
View 2 Replies View RelatedJust recently upgrade our 2 5508 controllers from 6.0.199.0 to 7.0.116.0. Since that upgrade, I have a handful (8 to 10) of wireless laptops that now refuse to associate to any access points. The thing these laptops all have in common is some variation of the Intel Wifi Link AGN cards. I have about 200 other clients out there working just fine.
I've tried everything under the sun that I can think of. Patches, drivers, the whole sh'bang.
Is there a known issue with 7.0.116.0 and these particular cards?
Is there any way to configure a wired guest network with a combination of 5508 and 2504 wireless controllers? I am aware that the 2504 does not have wired guest functionality, however is it possible to set up a wired guest on the 5508 and using mobility anchors, transmit the l2 information through eoip to communicate with the remote vlan?Home built NAC solution, using 802.1x authentication on switchports for public areas. If user is an employee, communicates with the supplicant on their machine, and places them on an internal vlan.If user is a guest, user fails 802.1x check and is placed on a "guest" vlan with an ACL and external DNS.If placed on the guest vlan, the user has to accept a terms of use form.This is working currently with our 5508s without any issue, however we have some remote offices we'd like to roll this out to that are using 2504 controllers. I'm hoping there's a way that I can use the 5508 as an anchor or vice versa to make this work.
View 1 Replies View RelatedAt the main site, I have 3 5508 WLCs each part of a mobility group (wlcMain-MG). In NCS, under "System/Mobility Groups" for each controller, I see each controller listed as "local" with the other Controllers listed with the group name "wlcMain-MG". None of the SSIDs are "anchored".
I have a new site with a 2500 series WLC that I would like to push out 2 SSIDs. This site contains two customers. One customer is the Main customer with the second customer leasing space.
I have the Cust2 WLAN at the remote site set to have traffic egress out of a local interface on the 2500 WLC (this traffic is then tunnelled back to their Main location via an ASA which houses the DHCP scope for that vlan). I can connect to this SSID, obtain an IP Address off the ASA and am tunnelling without issue.
For the Cust1 WLAN at the remote site, I would like to broadcast an SSID from the Main location on those same APs which are registered to the 2500. It is my understanding, that I anchor the SSID at the Main site and identically configure the SSID at the remote site. This will allow the end user to authenticate to the RADIUS server at the Main site and be placed upon the correct vlan (we are using DOT1x and dynamic vlans).
For my test, I am starting simple. I have created a test WLAN with no authentication. At the main site, on 5508 WLC3, I have created the test WLAN, and placed the interface into a low security vlan (call it VLAN-low). I have anchored this test WLAN to that controller. At the remote site, I have created the same WLAN (but placed it into the management interface for now - the VLAN-low does not exist at the remote site) and configured that WLAN to anchor back to the WLC3 at the main site. I am unable to obtain an IP address from the remote site. I have placed the remote site WLC in the wlcMain-MG as well. How close does the code need to be on the controllers - the 5508s are at 7.0.116.0 and the 2500 is at 7.0.220.0? What could I be missing?
Currently in the process of migrating from psk to 802.1x radius environment using a mix of 4400 and 5508 controllers with WCS using Microsoft ias. The problem I have is there is a lot of shared iPads and tablets in the environment. Is there a way to force these user to relogin to radius after a certain time period so they are not sharing unames and passwords?
View 1 Replies View RelatedPlease find attached a simple BYOD/ISE document I uploaded to kick start my new Wireless setup. Its all configured on my ISE sever and Controller as per doc.My setup:
-3600 AP's
-Internal 5508 Controller
-DMZ 5508 Controller (acts as a DHCP server for wireless clients)
Controllers have established connectivity (mobility acnhors), as a client I can connect fine to my new SSID get a DHCP IP address back from DMZ WLC and at the moment can connect out to the Internet fine (using no WLAN Security as a test). So this part is working.I have now followed the document configured ISE, enabled AAA on the Internal WLC only and used the AAA override setting on WLAN as in the attached document.I connect to SSID expecting to be redirected to my ISE Guest Portal, nothing happens other than connecting to Internet WebPages.My question is, if I have followed this document correctly why is the Internal WLC not redirecting client requests to ISE, is this because my mobility anchors need to be re-configured, perhaps the AAA/ISE config needs to be applied to my DMZ WLC not internal WLC?
I would prefer the Internal WLC to redirect the login to ISE, doesn't make sense to traverse through the DMZ Firewall onto DMZ WLC back into the Internal Network again to the ISE to authenticate.Or am I missing something additionally to this document to make sure clients are directed to the ISE Guest portal login.
I have 2 x Redundant Guest Anchor Controllers (5508) located in 2 separate Data Centers with all the management and guest user VLAN spanned between two. Everything is working fine with the Guest WiFi access except the DHCP functionality as the Controllers are acting themselves as the internal DHCP Servers.
This is how I tried to distribute :
network. 10.1.0.0/23
gateway: 10.1.1.254
Controller 1, DHCP Server pool: 10.1.0.2 - 10.1.0.254 Gw: 10.1.1.254
Controller 2, DHCP Server pool: 10.1.1.2 - 10.1.1.254 Gw: 10.1.1.254
As the user load balancing between the Anchor Controllers cannot be controlled (i.e. they are active/active), the same client sometime getting 2 different IP addresses from both the Controllers (as they do not talk to each other in terms of DHCP) hence depleting the pool addresses.
I guess one way of solving this is to just run 1 DHCP server in one of the controllers but that defeats the purpose of having N+1 Controllers. Is there a better way of doing the DHCP load balancing and having full redundancy at the same time?
I have a setup like this:
A central WLC 5508 running code 7.2 with management vlan 10 ( range 10.10.10.0/24), corp-user vlan 100 (10.11.10.0/24) with WPA2 key, guest vlan 200 (192.168.0.0/24, on local dsl modem) with WPA2 key...
A remote WLC 5508 with code 7.2 with management vlan 10 (range 10.20.10.0/24), corp-user vlan 101 (10.21.10.0/24) with WPA2 key and guest vlan 201 ( 192.168.0.0/24, on local dsl modem) with WPA2 key
corp ssid "Corp-user" on both sites
Guest ssid "Guest" on both sites
Intention is that the AP's (3500) on the remote site should fail over to the central WLC in case of any failure on the remote WLC and that the users could remain in their local vlan.
What kind of configuration would make this work?
I work at a campus and use the WCS to control access to my network for staff and only internet access for students. The Staff are assigned Username/password thru active directory and the student uses another SSID with only WPA --a password for all. I was tasked with adding more securing for students -- by adding a user/password. I do not want them connecting to my Active Directory for two reason--security risk and I have too many to input (over 1000). So, I wanted to use our internal database to validate users. I create a webpage with "WebAuth" that opens my logon page from my site and validates the login fields against the database. It works and this allows the user to navigate thru my website but not outside the site. If they try an outside url it redirect them to my logon script. I now understand why, so I'm looking for code I can add to my logon page that would allow me to redirect me to the controller's (once users are authenticated by my database) to call the WCS controller so I can enter a preset username/password so the policy management file would allow them access. I presently use "External" and don't know if "Custom" would work. Finding a way in using a database instead of adding one person at a time?
View 3 Replies View RelatedWe have a 5508 controller in main site.Which has two ports connected to local network.Management VLAN 500 is untagged and mapped to Port 1.All other interfaces are including 501 to 507 are mapped to Port 2.We have a SSID that is mapped to VLAN 501 interface , which successfully can be joined in main site.We connect an AP to remote site ;We have a remote site VLAN 115 which can be reached from main site.We connect an AP to access vlan 115 port on the remote site , we had described option 43 , so AP can successfully finds controller in local mode.
AP gets ip from VLAN 115 , can setup connection / ping controller successfully.There is a wide area connection between remote and main site.No trunk setup , the whole remote site is vlan 115.However when the client is trying to connect the test SSID , client cant get connected nor get ip address.Local switching is disabled.For this setup , client comes to AP as a requested , AP tunnels traffic to controller from vlan 500 , controller lets the client get into wired platform from VLAN 501.
I want to prevent guest from doing peer - peer communication on my Guest (5508) controllers. Is this a feature on the WLC or only by applying an ACL on the router interface?
View 2 Replies View RelatedI had a home network with 2 laptops (one XP and one Vista) and 1 desktop (XP) configured through a Lynksys wireless router. There was already a Canon wireless network printer (with the Vista laptop set up as the "host" pc). This Vista laptop had to be on in order to print from any of the other 2 computers on the network. I then added another laptop (this one with Windows 7 64-bit OS) to the same home network (using workgroup), and I can print wirelessly from it in the same way (the older Vista laptop has to be on). The Vista laptop is hardly ever used since adding the new Win 7, and I would like to be able to print without having the Vista laptop on. How would I go about this? Do I have to delete the printer from the Vista laptop and re-install on the Win 7? It seems like there should be a way to let the router be the "print server," but I have no idea how to accomplish this. The WLAN settings on the printer all indicate the proper router settings from the initial setup. The printer is a Canon MX860.
View 8 Replies View RelatedI've typed this question 4 times and keep losing signal so sorry if it appears multiple times, i have moved rooms and my laptop, toshiba satellite is now getting very weak signal. i bought a netgear usb adapter but it doesnt solve the problem much.
View 9 Replies View RelatedMoving into a new spot and some of the computer will be forced to go wireless. Is it better to have an adapter or an actual built-in PCi card?We play a lot of games, so that is my main concern, will we notice a big difference? The router that I am using is a WND3700 with latest firmware update.
View 3 Replies View RelatedI have been tasked by my boss of finding out and implementing a solution of building GRE tunnels from 2 4408 Wireless controllers system for a guest wireless network. I am but a low CCNA wireless, working on getting motivated for CCNP wireless, but I didn't even know if this was possible and if it was where to begin. I have been reading configuration guides but figure I should ask the wireless experts of the world of Cisco.
View 7 Replies View RelatedI am read this cisco document Cisco Catalyst 3850 Switch Services Guide
[URL]...
which describe that
L2 roam occurs when the user roams from an access point connected to its controller to a different access point connected to another controller, where the two controllers are L2 adjacent to each other.
L3 roam occurs when the user roams from an access point connected to its controller to a different access point connected to another controller, where the two controllers are L3 adjacent to each other.
so what exactly this mean the two controllers are L2/L3 adjacent to each other , what is the different between them.
I am configuring two 2504 controllers, which I ordered together, however they run different software versions and I don't have a contract/ login to download wlan controller software from the Cisco website. The one with the newest version runs 7.2.103.0 while the other one runs 7.0.220.0 I want to run them together in the same subnet and use them for redundancy (10 AP's will connect).
Is there a way I can download the software from the controller, just like I am able to do with an ASA firewall? Then I can upload it to the controller with the older software version.
Actually we have a 4402 controller with 1120 APs both of which are marked as EoL products, we want to jump over the new 2600 APs and 5508 Controller for increase signal coverage but we have the following deals:Last firmware for 4402 controller is 7.0.Firmware needed for 5508 to support 2600 APs is 7.3.Is it possible to configure mobility between 4402 and 5508 even with different firmware branch?
View 3 Replies View RelatedIf we have 2 Cisco 2504 series wlcs and use multicast features in both and both are primary and secondary for LAPs. what about of we use multicast ip address let's say 255.239.1.60 can we use the same ip address for the secondary controller too or we should use any other ip ?
View 7 Replies View RelatedI purchased a Dell Studio 1737 about 2 years ago, and have not had any problems with my wireless service until about a week ago. Now my wireless connects, but is extremely slow. I am using a Dell wireless 1397 WLAN mini-card. I ran a hardware diagnostic and nothing is wrong with the hardware. I also ran a connection diagnostic, and it continually fails when it gets to either Gateway IP, or Internet IP. The driver is fully upgraded, and I have ran Malwarebytes and have not found any malware problems. how to get my wireless working properly again.
View 1 Replies View RelatedI have a requirement to create a site to site vpn tunnel on ASA 5510 from a remote site to my HO, ihave already other site-to-site tunnels are up and running on the ASA.The issue is my remote site has got the network address which falls in one of the subnet used in HO(192.168.10.0/24).My requirement is only My remote site need to accees couple of my servers in HO which is in 192.168.200.0/24 subnet.
View 2 Replies View RelatedI have 2 WLAN controllers, a 4400 series and 5500 series controller. The 4400 series has 100 seat limit on it, with 74 Access Points currently connected. The 5500 series has a 250 max, but we bought it with only 50 licenses, and it is max'd out at 50.The 5500 controller is the controller that has a DNS entry so that the Access Points will know to find that controller as they're being added. BUT, because we've reached our limit of 50 licenses, I'd like to be able to set the 4400 series controller to be the controller that new Access Points try to connect to. By going back to the 4400 as the controller that new Access Points connect to buys me time to plan for more licenses on next years budget for the 5500 controller.
View 29 Replies View RelatedEvery time I power down my WLC2504 controller and then back up, the time reverts back to the year 2000.The APs can't join the controller, due to certificate errors, until I reset the clock. This problem just started recently.
View 6 Replies View RelatedHaving performance issues running two 5508 controllers on the same network? One is running 7.3.101.0, the other is running 7.0.98.0. The legacy APs are connected to the WLC on the older code to support older hardware. The new WLC is accepting all the new 3600 APs. Once all legacy APs are replaced, the 5508 on old code will be disabled.
View 3 Replies View RelatedI want to download the Cisco 2500 Series Wireless Controllers Release 7.3 Software AIR-CT2500-K9-7-3-112-0.aes.I have CON-SMB for it, when I try to download it I am not to download it. I have mentioned the message given by Cisco" The category for this contract does not include the feature or the benefit for software download that you are requesting at the moment, this means that even if the contract is a support assistant (8X5XNBD) does not support the the mentioned feature for you to update the device you need, please refer to your partner directly to be able to acquired a Cisco Service Contract that supports and include the software download feature to be able to upgrade and update your device as you need."Is there any seprate contract for downloading the Software.
View 2 Replies View Related