ACS Failure VLAN or similar possible on wireless?

I have around 16k wireless clients at peek on my WLAN, all doing 802.1x with latest ACS and things are generally fine. But also have hundreds of misconfigured smartphones where WiFi is on, but users don't really care if they hit my wireless network and these can Frequently overwhelm ACS with hundreds of thousands of auth failures that have to b processed. Is there any way between controllers and ACS to say after X failed auth attempts that a client is moved to another vlan ( dead end) or auth attempts get suspended for a while, or that client device is forcibly blocked at L2, or anything that could tame the condition automatically?

after 3 bad attempts client gets blacklisted, enable client exclusion globally and also on the affected wlan from advanced tab. down side is, if geniune client gets excluded then need to remove them manually -not so good option.
dont broadcast the ssid. so no client can accidentally connect to it. try this.

Similar Messages

Is it possible to wireless connect my macbook air to my tv?

I have a 13 inch 128gb macbook air with the latest mavericks (10.9.1) and a VIZIO 42” Class LED Smart TV E-Series. Is it possible to wireless connect them so i can see my macbook air's screen on my tv? or do i have to get a hdmi to thunderbolt cable?

Welcome to Apple Support Communities
You can only connect your MacBook Air to your TV wirelessly if you have got an Apple TV. AirPlay Mirroring allows you to mirror your MacBook Air display onto your Apple TV.
If you have not got one, you need to connect your Mac through a cable. If your TV has got a HDMI port, get a Mini DisplayPort to HDMI adapter and a HDMI cable. See > http://support.apple.com/kb/HT4241?viewlocale=en_US

Is it possible to wireless connect 2 routers?

Hello, I have the WRT54GS wireless router and it works fine. It is installed upstairs in a family room.
Now, I want to install downstairs a LAN device (Squeezebox) which doesn't work wireless.
I know I can throw a cat5 cable from the WRT54GS router to another router or switch downstairs and connect the Squeezebox to one of the LAN ports. But is there a possible way to connect the routers wirelessly?
Basically I want to extend my network, but have the capability of using lan ports not only wireless.
Is that possible?
Thanks!
Martin

sorry, wireless communication between 2 routers is not possible.Not way to configure them to do so either . Best thing will be to pull a cable and hook them physically.

ACS 4.2 - is it possible to change replication port?

Hi,
trying to find out if it some tweek to change the ACS replication port TCP/2000 to something else.
I know it's possible to make a different policy-map or to not inspect the Skinny protocol to avoid conflict, but that not the solution I'm looking for. Wondering if anybody knows of a different way to change the replication port in ACS 4.2.

Hi,
what is the version of ACS you are running?
If you are running ACS 4.2.1.15 then,
Problem :
=========
ACS replication port re-configuration.
Resolution :
============
Please follow the following steps:
1. Interface configuration > Advanced Options > Check the checkbox ACS
Communication Port Configuration.
2. System Configuration > service control > Configure the Port to be
used for the ACS Internal Communication (choose any port between 2010 to
2025)
Regards,
Anisha
P.S.: please mark this thread as resolved if you think your query is answered.

ACS- Dynamic VLANS for different ACS groups with AD

Hi all,
How do I tied diff Active Directory domain groups to diff ACS defined groups? Each domain group will be tied to an ACS defined group with a diff vlan. I read about the option in help but don't see the option to actually do it.
using ACS 3.3.
JT

You could refer to the document 'User Group Mapping and Specification' at http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs32/user02/qg.htm#.

Initial configuration of ACS 5.1 for EAP authentication for Wireless clients

Hi,
I have set-up with below devices :
Wireless LAN controller 5508
LAP 3302i
and ACS 5.1
since i am new in ACS 5.1 configuration , I need so information to go ahead to configure ACS 5.1.
which EAP method to use for wireless client authentication ? what is the best practice ?
I have gone through some cisco documents and it shows that best practice is to configure PEAP but for the same , I need to install certificate in ACS server as well in client PC. is that so ?
I have no clear picture for this certificate ?
from where i can get this certificate or do i need to purchase this certificate separately from cisco. how to install it in ACS server ?
I will be obliged to get atleast initial configuration for ACS 5.1 to enable the EAP method,
I need GUI based initial configuration for ACS 5.1
This mentioned ACS 5.1 is installed on ACS 1121 hardware appliance.

Hi,
which EAP method to use for wireless client authentication ? what is the best practice ?
-> I would advise the most widely spread EAP method, which has the best ratio security/easy to deploy: PEAP with MSCHAPv2, which is available by default by all windows machines.
I have gone through some cisco documents and it shows that best practice is to configure PEAP but for the same , I need to install certificate in ACS server as well in client PC. is that so ?
-> You will always need to install a server certificate, however, there is no need for client certificate because the authentication is based on the MSCHAP credentials exchange, not certificate based. The only requirement on the client regarding certificates is the following.
If you want to validate the server certificate, you have to install the server certificate under the trusted CAs of the clients.
If you do not require to trust the server certificate, you can simply disable the option of server certificate validation.
I have no clear picture for this certificate ?
from where i can get this certificate or do i need to purchase this certificate separately from cisco. how to install it in ACS server ?
-> The server certificate can be a simple self signed certificate that you generate and install on the ACS GUI.
Please feel free to follow this step-by-step guide on
PEAP under Unified Wireless Networks with ACS 5.1 and Windows 2003 Server:
http://www.cisco.com/en/US/partner/products/ps10315/products_configuration_example09186a0080b4cdb9.shtml or in pdf
http://www.cisco.com/image/gif/paws/112175/acs51-peap-deployment-00.pdf.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Using ACS for VLAN assignment

Hi Guys, I have been looking at the use of Cisco ACS server for VLAN assignment. So far I have searched through a number of threads and no found what I am looking for specifically so here it goes.
1) When the RADIUS attributes have been configured in ACS (64, 65 + 81), and in my case I have them in the group configuration. For the VLANs to be assigned to the various users at their ports will every VLAN name in the RADIUS settings have to in the switches which are used for access?
2) Is there a limit to the number of VLANs that can be assigned by the RADIUS(IETF) portion of ACS or would it be better to use RADIUS(IOS/PIX)? I am thinking of about 15 VLANS.
I am using a Catalyst 4500 (IOS supervisor) and 2950s and 2970s at the closets.
Thanks for any help...
Kelvin

Access Control Lists..I am thinking it is better to apply the ACLs at the closet (access) switches where I can specify the servers that should be reached by the hosts my test VLAN and deny those which they should not.
I used a named extended ACL for my tests however, it did not go well. With the ACL below applied I cannot reach anything including the server I actually want to reach. My intention was to allow the hosts in the test VLAN 172.16.12.0/24 to reach 2 particular servers and their gateway however with the list applied I cannot reach anything at all. The setup is one 2950 connected to a 4507 the 2 VLANs I am working with are trunked to the 2950 and dhcp is running. I have IP routing enable on the 4507 and it is the server for the VTP domain.
ip access-list extended guest
permit ip 172.16.12.0 255.255.255.0 host 172.16.12.1
permit ip 172.16.12.0 255.255.255.0 host 172.16.2.254
permit udp 172.16.12.0 255.255.255.0 host 172.16.2.245 eq 53
deny ip any any
Any advice on how I can restrict the hosts which will be on this VLAN from accessing the rest of the network?

How Do VLANs Map to SSIDs in Wireless?

So the title really says it all. I'm working on my CCDA and I can't really find anything on this in the official book. Does the LWAP just broadcast multiple SSIDs and depending on which one you connect to it maps the user to a different VLAN?
I also saw a best practice statement that said, "Each wireless client authentication type should map to a unique SSID which in turn maps to a unique VLAN"
I thought that was a bit confusing? How can you authenticate if you aren't already connected to a specific SSID?

So I dug through Cisco's official text and found the answer to my own question.
For the first part, yes, you just broadcast multiple SSIDs and they each map back to a specific VLAN.
The statement I read was misleading. The user first selects an SSID and then authenticates based on that SSID's chosen authentication type. The SSID isn't selected based on the authentication type used by the mobile device.

2nd AirPort Express possible as wireless adapter?

For months I tried getting to work AE with D-Link USB wireless DWL-122 for internet and AirTunes.
Read (almost) every topic and tried everything, it's clear: D-Link USB isn't good, whatever I tried (thanks for all the good posts/answers) especially AirTunes isn't working.
Is it possible, AirPort cards are not available in Belgium anymore(only some expensive ones via internet), to use a second AE to wire from my G4 and then connect it as a 'extension' to my first AE?
Any help is very much appreciated, I'ld love to hear music after 3 months!
G4/450MP 768/120Gb+30Gb Mac OS X (10.4.3) Cable modem + AirPort Express

Thanks for your answer!
'Are you sure' AirTunes will work, with a wired AE(instead of an AirPort card) connecting wireless to a 2nd AE > to stereo? Is there a difference with the d-link usb adapter?
Just to be sure, because it 'll cost an extra € 130,-!
Tnx again!

Is it possible to wirelessly extend a signal from my Airport Express A1264 to my basement without sacrificing speed?

I have a Mac, using OS X, version 10.8.4. My Airport Express A1264 has worked very well. However,
we would like to extend a signal to our basement for PS 3 and movies. I am sure it would be better
using ethernet, but that will not be possible. Is there a way to do it without sacrificing speed, and
if so, what would I need to do? Thanks.

Is there a way to do it without sacrificing speed,
No, not using wireless to extend.
The reason.....the wireless signal loses speed and strength the further that it moves away from a wireless router....and/or....it encounters any obstruction(s) in the signal path.
So, the wireless signal has probably already lost a good deal of strength and speed at the point where you add an AirPort Express. The Express can only extend the quality of signal and speed that it receives. In simple terms, the Express cannot make a slow signal go faster.
You lose no speed in a wire up to 100 meters. Easy to understand why this is a much better way to extend a network.
You can certainly try the wireless approach first....it might be OK....but if not, you will need to run the wire to obtain the performance that you need.
A wire guy can probably do this more quickly and less expensively than you might think. Whatever the cost might be, it will be best investment that you can make if you desire reliable wireless network performance.

Native VLAN on wired switch and wireless AP

On our 3560g switch we have g0/15 set up as a trunk to connect our wireless AP.
Port Mode Encapsulation Status Native vlan
Gi0/15 on 802.1q trunking 35
Port Vlans allowed on trunk
Gi0/15 1-4094
Port Vlans allowed and active in management domain
Gi0/15 1,10-14,18,20,22,30,35
Port Vlans in spanning tree forwarding state and not pruned
Gi0/15 1,10-14,18,20,22,30,35
On my AP I have the native VLAN as 1.
From my reading I found that the AP and the switch port should have the same Native vlan on both ends of the trunk. Well my access point will not work unless the AP trunk is on 1 and the switch is on 35. Any ideas?

dot11 ssid guestwifi
vlan 20
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa
dot11 ssid nwifi
vlan 35
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa
guest-mode
dot11 arp-cache optional
c
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption mode ciphers aes-ccm tkip
encryption vlan 35 mode ciphers aes-ccm tkip
encryption vlan 1 mode ciphers aes-ccm tkip
encryption vlan 20 mode ciphers aes-ccm tkip
ssid guestwifi
ssid raydonwifi
mbssid
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
channel 2462
station-role root
no dot11 extension aironet
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio0.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
bridge-group 20 block-unknown-source
no bridge-group 20 source-learning
no bridge-group 20 unicast-flooding
bridge-group 20 spanning-disabled
interface Dot11Radio0.35
encapsulation dot1Q 35
no ip route-cache
bridge-group 35
bridge-group 35 block-unknown-source
no bridge-group 35 source-learning
no bridge-group 35 unicast-flooding
bridge-group 35 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
encryption mode ciphers tkip
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
channel 5200
station-role root bridge
antenna receive right
antenna transmit right
bridge-group 1
bridge-group 1 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
interface FastEthernet0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
interface FastEthernet0.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
bridge-group 20 spanning-disabled
interface FastEthernet0.35
encapsulation dot1Q 35
no ip route-cache
bridge-group 35
bridge-group 35 spanning-disabled
interface BVI1
ip address 192.168.35.12 255.255.255.0
no ip route-cache
ip default-gateway 192.168.35.1
no ip http server
ip http authentication aaa
ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
access-list 111 permit tcp any any neq telnet
snmp-server community home RO
snmp-server enable traps tty
control-plane
bridge 1 route ip
line con 0
access-class 111 in
transport preferred all
transport output all
line vty 0 4
access-class 111 in
transport preferred all
transport input all
transport output all
line vty 5 15
access-class 111 in
transport preferred all
transport input all
transport output all
end

Possible to wirelessly extend network and connect xbox360 to ethernet?

I needed a backup drive and also some way of connecting my xbox 360 to my wireless network because the router is in a different room. The apple employees said it was possible to extend my existing network with time capsule and to connect my xbox to the time capsule to connect it (xbox) to my network. I was able to get my time capsule connected, but am having problems getting the internet to the 360, is this possible? If so, does anyone know how to do it?

Certain versions of the Linksys WRT54G are known to be WDS-compatible with the AirPorts.
Check out some of the following articles to see if any will help you configuring the WDS:
o Topic : How to extend your Linksys WRT54G with AE
o Topic : kair: Linksys WRT54G and WDS
o Using Airport Express as a range extender/repeater for Linksys Cable/DSL router WRT54G
Note: If you perform a Google-search with the search words: WRT54G AirPort WDS, you'll find at least a dozen articles related to this subject.

2 client vlan for CSM - possible?

Hi,
Is it possible that CSM has two client side vlans? The reason why i need to configure 2 client-side vlans is the ip address of the first client-side vlan is running out.
Thanks.
J.W.

Yes you can definitely use mulitiple client vlans with CSM.
CSM keeps track of the MAC address from where it recieves the flow
and send the reponse from reals back there.
If you define two default gateways then you will face some routing issues. With multiple
gateways defined, CSM randomly picks one gateway. This random selection can hurt you if your reals intiate coonections.
To tackle server initiated connection issue you can use following workaround
vserver Server-side
virtual 0.0.0.0 0.0.0.0 any
vlan 100 <------- server vlan where real exist
serverfarm RealX-out
inservice
serverfarm RealX-out
no nat server
real 192.168.1.1 <---- Gateway that you want to use for this traffic
inservice
Hope it helps
Syed Iftekhar Ahmed

IOS7 update failure w/ error "Not Connected to Wireless", but I am connected- How can I update?

My iPad has the defective "gotofailure" bug in iOS7, but there is only 1 pending update which describes a completely unrelated issue. I am connected to my Wireless LAN, and that connection works fine. But, when I try to download and install the pending update (Which may or may not have the major security hole fixed), the update fails with the error message "not connected to wireless". How can I get someone at Apple support to tell me how to get around this problem?
What am I supposed to do when the fix for a major bug is blocked by another (apparently minor) update?
(note: I am over the 30 day warranty, but within the 1 year warranty. However, Apple support wants me to pay $20 to have them tell me how to fix their defective software...
I expect that the 1 year warranty should apply to defective software, especially this major security bug!
This bug completely compromises browser and internet security... it is a HUGE deal!
see: http://www.wired.com/threatlevel/2014/02/gotofail/ ).
This is my first Apple product since the Apple 2E. If this is the level of customer support and warranty for defects, hardware or software, that Apple provides, it may well be my last apple product.
I have worked in customer support at another major computer company, and this type of policy is the surest way to send customers to your competitors that I know of. Tim Cook, are you listening?
(P.S. Don't bother trying to get the attention of any Apple Executive - they don't want to hear from customers to provide feedback on their products or policies - not by phone nor by email.)
Any workarounds for the problem or a way to update the iOS7 to fix the security hole will be greatly appreciated.

Hi...
I think here the issue may be that the utility and the internet connection are not getting synchronised. The operating system on your computer is it win XP? If it is win xp, u can use the windows wireless software to manage to your wireless network. In order to use the windows wireless zero configuration, right click on the linksys icon at the bottom right hand corner of the task bar, select the option that says "use windows wireless ....".
The linksys icon will be grayed and windows will be managing the wireless network. Connect to your wireless network and you should be able to go online.

Is it possible to wirelessly sync Pages documents ?

I need something that would sync my files between my Mac and iPad.
I intend to use Pages as well of the rest of the iWork suite for iPad to do my typing and note taking.
The thing is, I know that Pages will only sync with WebDAV or MobileMe servers. (I know that it's a case of download, edit, upload and replace)
I could use a service such as box.net as a WebDAV server, but this doesn't give me any syncing abilities to have a folder on my Mac where I save all my work and it gets uploaded to the server, and likewise, be able to download new copies from the server into my work folder. It would give me the upload and download options for Pages for iPad though.
MobileMe would allow me to sync my documents with my Mac, the iPad and be able to access them from iDisk on iPhone. It would also give me storage space and the ability to upload things for my family at home to see The calendar and mail are useless to me as I use Google. I use Things on iPad for To Dos and although I use iCal, this is done through syncing which I do everyday anyway.
Are there any other services that would offer what I want that are either free or much less expensive?
To reiterate - Compatibility with Pages on iPad, Syncing with a folder on Mac, use over the web not just a local network.
Thanks,
George

As far as I know, this is already integrated in iCloud. iCloud works for iWork and syncs wirelessly and seamlessly between your iPad, iPhone and Mac. Free of charge.
Cheers

ACS Failure VLAN or similar possible on wireless?

Similar Messages

Maybe you are looking for