Adding (dynamic) interfaces to WLC 2504 causes loss of network

I'm trying to add a new dynamic interface, that I will tie a specific WLAN to so that clients on that WLAN is in the correct vlan. After adding it I loose connectivity both to the main management address (10.99.0.60) and to the ip address of the dynamic interface (10.99.12.4). In fact, the dynamic interface address responds and prompts me to login, but after doing so all I get is a blank page. Here's the two interfaces pulled from the CLI - what am I doing wrong?
And oh, not adding an IP to the dynamic interface makes it impossible to use within a WLAN.
Interface Name................................... management
MAC Address...................................... c0:8c:60:c7:99:00
IP Address....................................... 10.99.0.60
IP Netmask....................................... 255.255.255.0
IP Gateway....................................... 10.99.0.1
External NAT IP State............................ Disabled
External NAT IP Address.......................... 0.0.0.0
VLAN............................................. 31        
Quarantine-vlan.................................. 0
Active Physical Port............................. 1         
Primary Physical Port............................ 1         
Backup Physical Port............................. Unconfigured
DHCP Proxy Mode.................................. Global
Primary DHCP Server.............................. 10.99.0.1
Secondary DHCP Server............................ Unconfigured
DHCP Option 82................................... Disabled
IPv4 ACL......................................... Unconfigured
mDNS Profile Name................................ Unconfigured
AP Manager....................................... Yes
Guest Interface.................................. No
L2 Multicast..................................... Enabled
Interface Name................................... lan
MAC Address...................................... c0:8c:60:c7:99:04
IP Address....................................... 10.99.12.4
IP Netmask....................................... 255.255.252.0
IP Gateway....................................... 10.99.12.1
External NAT IP State............................ Disabled
External NAT IP Address.......................... 0.0.0.0
VLAN............................................. 33        
Quarantine-vlan.................................. 0
NAS-Identifier................................... mob-wlc
Active Physical Port............................. 1         
Primary Physical Port............................ 1         
Backup Physical Port............................. Unconfigured
DHCP Proxy Mode.................................. Global
Primary DHCP Server.............................. Unconfigured
Secondary DHCP Server............................ Unconfigured
DHCP Option 82................................... Disabled
IPv4 ACL......................................... Unconfigured
mDNS Profile Name................................ Unconfigured
AP Manager....................................... No
Guest Interface.................................. No

So take a look at this. I have the dynamic interface used in wlan 2 (mytestssid as shown above). Now the management address, 10.99.0.60 cant be reached:
Nmap scan report for 10.99.0.60
Host is up.
PORT    STATE    SERVICE
22/tcp  filtered ssh
443/tcp filtered https
After removing wlan 2 and the dynamic interface, mgmt access starts to work again:
config wlan disable 2
config wlan delete wlan 2
config interface delete lan
Nmap scan report for 10.99.0.60
Host is up (0.0037s latency).
PORT    STATE SERVICE
22/tcp  open  ssh
443/tcp open  https
So... here's me adding the dynamic interface in cli AGAIN:
WLAN ID  WLAN Profile Name / SSID               Status    Interface Name
1        someotherssid / someotherssid              Enabled   management  
(Cisco Controller) config> interface create lan 33
(Cisco Controller) config> interface address dynamic-interface lan 10.99.12.4 255.255.252.0 10.99.12.1
(Cisco Controller) >config wlan disable 1
(Cisco Controller) >config wlan interface 1 lan
(Cisco Controller) >config wlan enable 1
Voila, management access lost again:
Nmap scan report for 10.99.0.60
Host is up.
PORT    STATE    SERVICE
22/tcp  filtered ssh
443/tcp filtered https
This time, there's no physical port assigned to the dynamic interface 'lan':
Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest
lan                              -    33       10.99.12.4      Dynamic No     No   
management                       1    31       10.99.0.60      Static  Yes    No   
virtual                          N/A  N/A      1.1.1.1         Static  No     No   
Adding that:
(Cisco Controller) config interface port lan 1
Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest
lan                              1    33       10.99.12.4      Dynamic No     No   
Still no management access..:
Nmap scan report for 10.99.0.60
Host is up.
PORT    STATE    SERVICE
22/tcp  filtered ssh
443/tcp filtered https
For reference, the detailed interface config (which clearly shows that 'management' should be ap mgmt.. and dynamic interface 'lan' shouldn't (and thus shouldn't affect it - RIGHT?)):
Interface Name................................... lan
MAC Address...................................... c0:8c:60:c7:99:04
IP Address....................................... 10.99.12.4
IP Netmask....................................... 255.255.252.0
IP Gateway....................................... 10.99.12.1
External NAT IP State............................ Disabled
External NAT IP Address.......................... 0.0.0.0
VLAN............................................. 33        
Quarantine-vlan.................................. 0
NAS-Identifier................................... mob-wlc
Active Physical Port............................. 1         
Primary Physical Port............................ 1         
Backup Physical Port............................. Unconfigured
DHCP Proxy Mode.................................. Global
Primary DHCP Server.............................. Unconfigured
Secondary DHCP Server............................ Unconfigured
DHCP Option 82................................... Disabled
IPv4 ACL......................................... Unconfigured
mDNS Profile Name................................ Unconfigured
AP Manager....................................... No
Guest Interface.................................. No
Interface Name................................... management
MAC Address...................................... c0:8c:60:c7:99:00
IP Address....................................... 10.99.0.60
IP Netmask....................................... 255.255.255.0
IP Gateway....................................... 10.99.0.1
External NAT IP State............................ Disabled
External NAT IP Address.......................... 0.0.0.0
VLAN............................................. 31        
Quarantine-vlan.................................. 0
Active Physical Port............................. 1         
Primary Physical Port............................ 1         
Backup Physical Port............................. Unconfigured
DHCP Proxy Mode.................................. Global
Primary DHCP Server.............................. 10.99.0.1
Secondary DHCP Server............................ Unconfigured
DHCP Option 82................................... Disabled
IPv4 ACL......................................... Unconfigured
mDNS Profile Name................................ Unconfigured
AP Manager....................................... Yes
Guest Interface.................................. No
L2 Multicast..................................... Enabled
By the way, the switchport of my (C3560G) doesnt specifically allow some VLANs - meaning they allow all vlans:
interface GigabitEthernet0/28
 description cisco_wlc
 switchport trunk encapsulation dot1q
 switchport mode trunk
And the vlans in question are present:
31   enet  100031     1500  -      -      -        -    -        0      0   
32   enet  100032     1500  -      -      -        -    -        0      0   
33   enet  100033     1500  -      -      -        -    -        0      0   
34   enet  100034     1500  -      -      -        -    -        0      0   

Similar Messages

  • Cannot contact Non-native dynamic interfaces on WLC 4402

    Hi,
              In my company we are recently planning to get a DMZ anchor for Guest WLAN. Our setup is as following
    We have two 5508 WLCs in inside corporate network which serves for the corporate wlan. Recently we put one 4402 in DMZ in LAG mode. Two SSID has been created in 4402 namely guest and consultant. We have mobility configured perfect between these three. For the the two ssids the 4402 is the anchor.   We have created sub interfaces in ASA for management and two WLANs. The port channel is also configured proper with the native vlan for management and allowing all three vlans through it. The concern is that we cannot ping the untagged dynamic interface of WLC. The WLAN clients are getting DHCP ip perfectly on each ssid, I mean in different networks. But the clients cannot reach the gateway which is the subinterface of ASA. If I am using the webauth I am not getting redirected to the authentication page. but if I set the security to none (both L2 and L3) I can reach up to the corresponding dynamic interface and not beyond that.
    Below are my configuration details
    At switch side
    interface Port-channel1
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 177
    switchport trunk allowed vlan 177-180
    switchport mode trunk
    interface GigabitEthernet2/0/26
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 177
    switchport trunk allowed vlan 177-180
    switchport mode trunk
    channel-group 1 mode on
    interface GigabitEthernet1/0/26
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 177
    switchport trunk allowed vlan 177-180
    switchport mode trunk
    channel-group 1 mode on
    WLC configurations
    (Cisco Controller) >show interface summary
    Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest
    ap-manager                        LAG  untagged 192.168.7.3     Static  Yes    No
    management                      LAG  untagged 192.168.7.2     Static  No     No
    qd-consultant                     LAG  179      192.168.9.254   Dynamic No     No
    qd-guest                            LAG  178      192.168.8.254   Dynamic No     No
    qd-test                              LAG  180      192.168.10.254  Dynamic No     No
    service-port                         N/A  N/A      0.0.0.0               DHCP    No     No
    virtual                                 N/A  N/A      192.0.2.1           Static  No     No

    Your configuration looks good except you should assign an ip address to the service port. Never leave that at 0.0.0.0. Change that to an ip address that is non routable in your network.
    Now for your issue. Have you tried plugging in a laptop to the dmz switch in those vlans to see if it works wired. Since these are new subnets, are you sure they are being NAT'd to your public address. Check that first and let us know. The WLC should be able to ping the gateway and out into the Internet if things are setup right in the dmz.
    Sent from my iPhone

  • Acs 5.3 and wlc 2504 config with restricted network access

    Hello,
    i submit you the following issue that i'm actually facing:
    i must configure a secured wireless network with access restriction based on SSID. the equipements are : cisco wlc 2504 (soft 7.3) cisco secure acs aplliance 1121 (soft 5.4) .
    the users that will connect to the network are regrouped by identity groups, each identity group having it's own SSID. Clearly each group of users must access only one SSID.
    i followed the procedure below to configure it:
    -- creating user identity groups;
    -- creating users and assigning them to the groups;
    --- creating authorization profiles for each SSID under policy element/ authorization and permission/network access/authorization profiles and putting the Airespace-Wlan-Id(the SSID number) in the radius tab.
    --- assigning the authorization profiles to the identity groups under access policies.
    after all these config the users can access the network using there userid/password configured. But the problem is Every user can access every SSID, seems like the restriction is so not very well configured.
    i found some documentation on this kind of config but the version of ACS used seems older than the one that i use, so menu are very different.
    Please can someone provide with the right steps to follow to achieve this kind of config.
    tkx in advance

    Yes.. you only have to add the end filter like what I posted... as far as the calling station id in the WLC security tab, it doesn't matter because that is not used when using 802.1x.  I would also try to not enable everything that you have just to start from the basic and make sure it works first.  The WAP Authentication Method might or might not work for you.  Uncheck that for now and when you have a successful authentication, look at the monitor log and see what radius attributes are being sent, because those attributes is what you can use to build your policies.
    Thanks,
    Scott
    Help out other by using the rating system and marking answered questions as "Answered"

  • WLC Dynamic Interface

    I wonder why we need Dynamic Interfaces. I have created two WLANs. One is WPA2-Enterprise obtaining vlan id's per user from Radius server and the other WEP wlan for guest users whose traffic should go to a specific guest vlan. I am using an external DHCP server and configured WLC not to proxy dhcp requests and to act as a bridge.
    I had to create dynamic interfaces on WLC (we are using 5508 with software version 7) for all the VLANs which radius server returns. I could make it with only defining the dynamic interfaces and entering 0.0.0.0 for ip addresses.
    For the other WLAN with WEP, I have to enter and IP for the dynamic interface to work. I am not sure if this is a requirement or my misconfiguration, but I do want a way not to set an IP address for the dynamic interface. I do not want to waste addresses and also do not want the clients to be able to access wlc through that IP address.
    I appreciate any comment on why I need IP addresses for dynamic interfaces.

    Vadood... The WLC does use that IP address as it needs to have layer 2 connection to any subnet it will place users on. Even is your doing AAA override, the radius tell the WLC that that device needs to be on vlan x and the WLC will put that device on vlan x, but if the WLC has no IP address on that subnet, well then the communication stops there. The user will never get an IP address if using dhcp or if the device has a static, the WLC has no way to communicate to that subnet.
    By the way, users can't access the dynamic interface by default. You have to enable that. But then again, they can try to access the management interface also, unless you disable globally management over wireless.
    Sent from Cisco Technical Support iPhone App

  • 2125 WLC Dynamic interfaces and their physical interface

    I'm trying to broadcast multiple SSIDs per AP. I would like the new second SSID to be on a different VLAN. I have been reading this article http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00805e7a24.shtml#dyn-interface and it looks like you create a trunk port on the switch that the WLC is connected to, which makes sense to me. A friend however told me to use a seperate physical interface on the WLC and assign the dynamic interface to it and connect it to the desired VLAN, instead of using the interface that is currently in production. I liked this idea because I would have downtime trying to reconfigure the port as a trunk that's in production.
    So I guess my question is, if I use a secondary port on the WLC to connect to a different network than what the AP is on how will communication work? When the AP sends data to the WLC will everything be encapsulated in CAPWAP? How about the primary link connecting the WLC to the primary production network? Will this data to and from the WLC on the switch retain it's CAPWP encapsulation? Now that I'm thinking about it I guess it would have to since the WLC is what decapsulates the CAPWAP data and not the switch...
    I would just like some advice on if I'm doing this correctly. Thanks a lot!  -Mark

    We generally recomment one trunk port to be configured for different VLAN (for management and AP inetreface) but we can use other ethernet port also on WLC for any differnt VLAN config.
    For all your port related queries please find the attach link with the diagramme.:-
    http://www.cisco.com/en/US/docs/wireless/controller/7.0/configuration/guide/c70mint.html
    Q. How does a WLC switch packets?
        A. All the client (802.11) packets are encapsulated in a LWAPP packet by the LAP and sent to the WLC. WLC descapsulates the LWAPP packet and acts based on the destination IP address in the 802.11 packet. If the destination is one of the wireless clients associated to the WLC, it encapsulates the packet again with the LWAPP and sends it to the LAP of the client, where it is decapsulated and sent to the wireless client. If the destination is on the wired side of the network, it removes the 802.11 header, adds the Ethernet header, and forwards the packet to the connected switch, from where it is sent to the wired client. When a packet comes from the wired side, WLC removes the Ethernet header, adds the 802.11 header, encapsulates it with LWAPP, and sends it to the LAP, where it is decapsulated, and the 802.11 packet is delivered to the wireless client. For more information about this, refer to the LWAPP Fundamentals section of the document Deploying Cisco 440X Series Wireless LAN Controllers.
    Q. What are the various options available to access the WLC?
        A. This is the list of options available to access the WLC:
            GUI access with HTTP or HTTPS
            CLI access with Telnet, SSH, or console access
            Access through service port
        For more information on how to enable these modes, refer to the Using the Web-Browser and CLI Interfaces section of the document Cisco Wireless LAN Controller Configuration Guide, Release 5.1. Usually, the management interface IP address is used for GUI and CLI access. Wireless clients can access the WLC only when the optionEnable Controller Management to be accessible from Wireless Clients is checked. In order to enable this option, click the Management menu of the WLC, and click Mgmt via Wireless on the left-hand side. WLC can also be accessed with one of its dynamic interface IP addresses. Use the config network mgmt-via-dynamic-interface command to enable this feature. Wired computers can have only CLI access with the dynamic interface of the WLC. Wireless clients have both CLI and GUI access with the dynamic interface.

  • Force WLAN client to renew ip on WLC with dynamic interfaces

    Hi there
    we would like to have a "two tier" authentication for the corporate WLAN clients:
    Requirements
    1. Machine Authentication
    The client gets machine authenticated based on the machine account in the Active Directory with PEAP. At this stage, the client will get a IP from VLAN A. VLAN A has limited access to the corporate infrastructure (DNS, AD, some volumes / shares, and so on). The filtering is done with an IP access list on the layer 3 VLAN interface on the core switches.
    2. User Authentication
    The users logs in on the client and gets user authenticated based on his user account in the Active Directory with PEAP - only users with a valid Machine Access Restriction (MAR) are allowed to login. Now the client is moved to another VLAN B. VLAN B has full access to the corporate infrastructure, here is no IP access list.
    Infrastructure
    We have the following:
    2 x WLC 5508 with 7.3.101.0
    2 x ACS 5.3.0.40.6
    Problem
    Now we have the problem, that the Windows client sometimes takes up to 3 minutes to connect to the WLAN after the users loggs in. In the debug, I can see that this happens because the client is stuck in DHCP renewal:
    1. After the machine has been authenticated it has an IP assigned from VLAN A. This works pretty well if the client gets rebooted.
    2. If the user loggs in the first time after the reboot, the users gets connected within 10 seconds, what is pretty good. The client has now an IP in VLAN B.
    3. Now the user logs out of Windows and I can see in the debug, that the client is putted into VLAN A (machine authentication) again, but the client still tries to DHCPREQUEST the IP address from VLAN B (user authentication). Because this request is sent out on the wrong dynamic interface on WLC, the DHCPREQUEST is not acknowleged an the client get stuck in this situation.
    4. If the user or another users logs in again shortly after the logout, the client still tries to DHCPREQUEST the IP of VLAN B and now the "3 times DHCP failure on WLC" comes into play, because WLC thinks that the DHCP server is not reachable -> but it only does not answer a wrong DHCPREQUEST.
    Question
    On ISE there is a way to force the client to renew the DHCP address (via CoA, but this has its limitations too --> need to install Active X or Java applet). I think there is now way to force the client to renew its IP with ACS, but my question is, is there a workaround and are there any others, that maybe already solved this problem?
    Alternative
    If there is now way to bring this to work with two different VLAN's, I could try to realize this with only one VLAN. After the machine authentication I could apply a WLC ACL to restrict access to the corporate infrastructure. If the user authentication happens, I could "remove" this ACL to grant full access for this user / client. But I am still interested in the other solution ;-)
    Thanks in advance for any advise and best regards
    Dominic

    Your second option is what you should do. Changing the vlan on a client that already has an IP address especially on wireless will not know it has been put in a different vlan and that's why it breaks. If There was a way to change the vlan and send something to the WLC to disassociate the client, that might work.
    Sent from Cisco Technical Support iPhone App

  • Dynamic interface do not obtain IP.

    we created a dynamic interface on WLC and associated a one ssid using dhcp but this interface do not obtain IP
    could you help me to resolve this case on wlc?
    regards,

    The dynaminc interface is configure to be static.Then from the GUI goto CONTROLLER----INTERNAL DHCP SERVER----DHCP SCOPE
    But the dynamic interface must be in the same ip subnet with the dhcp scope you created. You then need to tie it with the SSID u want. STEP click WLAN-----then the wlan id no---------GENERAL----Inteface u and put the dynamic inteface u just created.

  • AP1121 can'T join WLC 2504

    Hi there,
    It's me again... same devices which making trouble.
    I have an allready configured WLC 2504 running in the network. Every LAP i add to the network joins imidiatly to the Controller.
    But not the AP1121G AP.
    It fails the Handshake everytime and the Controller shows me an failmessage at the statistics in the GUI.
    GUI Message:
    RADIUS authorization is pending for the AP
    CLI Debug:
    *spamApTask0: May 23 17:29:18.258: 00:11:20:6e:2b:14 Allocated index from main list, Index: 16
    *spamApTask0: May 23 17:29:18.259: 00:11:20:6e:2b:14 DTLS keys for Control Plane are plumbed successfully for AP 192.168.1.100. Index 17
    *spamApTask0: May 23 17:29:18.259: 00:11:20:6e:2b:14 DTLS Session established server (192.168.1.10:5246), client (192.168.1.100:1716)
    *spamApTask0: May 23 17:29:18.260: 00:11:20:6e:2b:14 Starting wait join timer for AP: 192.168.1.100:1716
    *spamApTask0: May 23 17:29:18.263: 00:11:20:6e:2b:14 Join Request from 192.168.1.100:1716
    *spamApTask0: May 23 17:29:18.264: 00:11:20:6e:2b:14 Deleting AP entry 192.168.1.100:1716 from temporary database.
    *spamApTask0: May 23 17:29:18.264: 00:11:20:6e:2b:14 AP with same name AP0011.206e.2b14 exist. Using default name AP0011.206e.2b14 for this AP.
    *spamApTask0: May 23 17:29:18.265: 00:11:20:6e:2b:14 In AAA state 'Idle' for AP 00:11:20:6e:2b:14
    *spamApTask0: May 23 17:29:18.266: 00:11:20:6e:2b:14 State machine handler: Failed to process  msg type = 3 state = 0 from 192.168.1.100:1716
    *spamApTask0: May 23 17:29:18.267: 00:11:20:6e:2b:14 Failed to parse CAPWAP packet from 192.168.1.100:1716
    *spamApTask0: May 23 17:29:18.267:
    *spamApTask0: May 23 17:29:18.267: 00:11:20:6e:2b:14 Finding DTLS connection to delete for AP (192.168.1.100/1716)
    *spamApTask0: May 23 17:29:18.268: 00:11:20:6e:2b:14 Disconnecting DTLS Capwap-Ctrl session 0x1458bd60 for AP (192.168.1.100/1716)
    *spamApTask0: May 23 17:29:18.268: 00:11:20:6e:2b:14 CAPWAP State: Dtls tear down
    *spamApTask0: May 23 17:29:18.268: 00:11:20:6e:2b:14 DTLS keys for Control Plane deleted successfully for AP 192.168.1.100
    *spamApTask0: May 23 17:29:18.270: 00:11:20:6e:2b:14 DTLS connection closed event receivedserver (172:16:58:250/5246) client (192.168.1.100/1716)
    *spamApTask0: May 23 17:29:18.270: 00:11:20:6e:2b:14 Entry exists for AP (192.168.1.100/1716)
    *spamApTask0: May 23 17:29:18.272: 00:11:20:6e:2b:14 No AP entry exist in temporary database for 192.168.1.100:1716
    *spamApTask0: May 23 17:29:18.272: 00:11:20:6e:2b:14 Discarding non-ClientHello Handshake OR DTLS encrypted packet from  192.168.1.100:1716)since DTLS session is not established
    *spamApTask0: May 23 17:29:18.277: 00:11:20:6e:2b:14 Received LWAPP JOIN REQUEST from AP 00:11:20:6e:2b:14 to 84:78:ac:b3:73:c0 on port '1'
    *spamApTask0: May 23 17:29:18.278: 00:11:20:6e:2b:14 incomingRadJoinPriority = 1

    Problem solved
    Hey guys, i solved the problem. It wasn't the firmwareversion. I downgraded the WLC and the problem still exists.
    Problem reason: The AP1121G series doesn't  has a MIC - Manufactured Installed Certificate - which is compatible/ accpeted by the WLC 2504 and it's parameters for the RADIUS server. Maybe it has no MIC, i don't know.
    So you need the SSC - Self Signed Certificate - for the join authentication.
    Solution:
    1. Logon to GUI or CLI of the WLC.
    2. Enable "Accpet Self Signed Certificate"
              GUI: Security > AP policy
              CLI: (Cisco Controller) >config auth-list ap-policy ssc enable
    3. Look for the SSC Hash of the AP:
              CLI: (Cisco Controller) >debug CAPWAP events enable
              There you'll find an event which is called e.g.:
         Mon May 22 06:34:14 2006: sshpmGetIssuerHandles: SSC Key Hash is 9e4ddd8dfcdd8458ba7b273fc37284b31a384eb9
    4.Add the ap manually to the controller
              GUI Security> AP policy > Add               There you have to set the right parameters, ap MAC, Cert. type: "SSC"           and the Key.
              CLI:    
              (Cisco Controller) >config auth-list add ssc 00:0e:84:32:04:f09e4ddd8dfcdd8458ba7b273fc37284b31a384eb9
    5. Maybe you should reboot the ap.
    And it's done

  • WLC, mapping new dynamic interface to an already used port

    This is my question
    We have a multiple wlc deployment and a wlan which is running dhcp issues (scopes exhausted)
    The main Wlan is mapped to a dynamic interface group (2 vlans), both vlans are mapped to a single physical port
    adding a new dynamic interface (vlan) to the interface group is needed,
    - a new dynamic interface will be created and mapped to the same physical port of the other two (3 vlans)
    - the new interface will be addad to the interface group
    the question is:
    does this operation will require some network downtime (controller reboot,ap reboot... etc.) or will it be a seamless operation?
    thank you

    Does this mean, when utilizing an 802.1x WLAN in an AP Group, you can  not dynamically assign an interface via radius because itw ill be  ignored due to the AP Group settings?  If so, that seems short sited to  me?
    AAA override get priority when AAA override and AP group is used. the debug client output should show site specific over-ride for AP group initially and once it goes into .1x auth it will return the overrided vlan.

  • ISE and WLC dynamic interface group assignment ?

    I have a somewhat large deployment coming up with several WLC dynamic interfaces assigned to an interface group, replicated across for multiple sites.  I understand that ISE can return the VLAN ID to the WLC to place the client in, but if I'm using interface groups, this seems to negate the usefulness of the interface group to load clients across multiple VLANs.  Not only that, but with the number of dynamic interfaces (VLAN ID's), multiplied by the number of sites, would seem to be overwhelming on the ISE side policy configuration.
    Is it possible for ISE to return an Interface name/group to the WLC instead of just a VLAN ID ?
    TIA

    I understand that WLC 7.2 code can now accept the interface group name as a AAA override, which is great, but it doesn't specify the AAA source (ISE vs. ACS).
    This is the example I'm questioning: (they use the VLAN ID only, instead of an interface name)
    http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080bba10d.shtml#topic17
    Edit:
    Found the correct Attribute Under "Adv. Attribute Settings" in the Airspace Authorization Profiles (Airespace:Airespace-Interface-Name).

  • WLC DHCP Settings - Under Dynamic Interface configuration

    Hi Guys,
    If I have a dynamic interface that is connected to a subnet where the router interfaces have DHCP servers configured under the helper address commands, do I need to configure the DHCP fields under the dynamic interface configuration?
    I have helper address configured on the connected routers AND these fields configured with the same DHCP servers.
    Just wondering if I can take the IPs out of the WLC configuration?
    Many thx indeed,
    Ken

    Ken, the DHCP address under the dynamic interface, is the address the WLC will unicast the DHCP request to when a client tries to use that interface. Under normal operation this address is needed. There is a way to get the WLC to bridge the packet to the wire so that it is a broadcast instead of a unicast packet. CLI command is config dhcp proxy disable.
    But I do believe that even if you issue the CLI command, the software wants the DHCP address listed under the dynamic interface.
    HTH,
    Steve

  • WLC dynamic interface limit

    Hi,
    I have a WISM with sw version 4.0.179.11 wich I try to add more dynamic interfaces on. However I get the message " Can't create more than 64 entries".
    I find in the deployment guide for WLC - quote: "Dynamic Interfaces are created by users and are designed to be analogous to VLANs for wireless LAN client device. The WLC will support up to 512 Dynamic Interface instances. "
    Has anybody encountered this limitation before?
    How can I add more than 64 interfaces ?
    regards rolf

    Hi.
    I have a customer wth a WLC which has DHCP Proxy disabled and Primary & Secondary DHCP servers configured (external to the WLC).
    The problem I've just started looking at is...if the Primary has run out of leasable IP addresses, the WLC doesn't appear to request one from the Secondary server.
    It looks like (without any real investigation) the "I've run out of addresses" response from the Primary server is sufficient for the WLC to believe that the Primary is still on the network and it doesn't need to go to the Secondary.
    I'll add more as and when I do more testing.

  • 4402 WLC Dynamic Interfaces- More than 1 Gateway Possible?

    I am configuring a guest access solution with multiple guest access gateways associated with a single VLAN. Each gateway will have its own /24 network, and obviously it own gateway. The interface configuration page requires a single gateway in the IP config section.
    Does anyone know the purpose of this IP config?
    Will command line config of the dynamic interface permit no gateway and a netmask big enough to encompass all gateways?
    Thanks

    Thanks for your replies.
    2 Coova gateways each with web authentication and a dhcp server plugged into each layer2 vlan works great with IOS APs, which do no require IP config per (vlan) subinterface.
    The objective is to loadbalance, provide redundancy and handle the total number of guests. The DHCP servers race to provide the client with IP config which then causes the client subsequently use that gateway.

  • Max # of dynamic interfaces on 4404 WLC

    Can anyone tell me if there is a limit to how many dynamic interfaces I can create on a 4404 WLC?
    I know that I can only have 16 SSIDs, so I have set up one SSID for my private network and am using AAA Override and configured my radius server to assign the different VLANs for each group. I have to create a dynamic interface for each individual VLAN and I just want to know if there is any kind of hard limit for the number of dynamic interfaces I can have so I don't run into a potential problem down the road.
    TIA,
    Deanna

    I was able to verify that you only can create up to 513 dymanic interfaces. This of course does not include your management, ap-manager or VIP.
    Hope this answers your question... it did for me... now I know!

  • Guest wireless with WLC 2504, Catalyst 4510R+E and ASA 5510

    I need to add guest (internet only) wireless to our existing internal wireless and am looking for advice as to the best practice configuration. Existing infrastructure as follows:
    WLC 2504
    1142 LAPs
    4510R+E
    ASA 5510
    Existing configuration as follows:
    WLC management interface and APs addressed on the 192.168.126.0 /25 network
    Internal WLAN mapped to the management interface
    Management interface VLAN ID 0 (untagged) and dynamic AP management enabled
    WLC port 1 (only) connected to 4510 via trunk with native VLAN set to 7 and allowed VLAN set to 7
    4510 connected to ASA inside interface (security level 100)
    Switchport on 4510 connected to ASA configured as switchport access VLAN 99 (our internet VLAN)
    ASA inside interface NOT configured for subinterfaces and is addressed on the 192.168.121.0 /25 network
    What is the best way to add guest wireless to our existing configuration?
    Note: I need the guest wireless to be filtered by Websense as our internal wireless is
    Any advice would be greatly appreciated!

    Thank for the reply Scott. The configuration recommendations from Yahya did not work. I set up as he recommended and also added a dhcp scope on the wlc. Client gets dhcp but cannot even ping the wlc much less anything else. Yahya stated above to configure port 2 on the wlc to an access port on my 4510. Aren't all connections from the wlc supposed to be trunk links to the switch? Shouldn't I just leave the management interface on the wlc untagged and add a dynamic interface for each wlan and tag it with the approriate vlan id? And then leave the (one) physical connection on the wlc (port 1) connected to a trunk link on the 4510 that allows the required vlans?
    Any input would be greatly appreciated...
    JW

Maybe you are looking for