AP1231G and guest ssid
standalone AP1231G running c1200-k9w7-mx.123-8.JEC2 setup with internal SSID (VLAN 24)and guest SSID (VLAN 124). Here's the problem
Both SSID picks up the native VLAN 1 dhcp address and not it's respective VLAN. I verify that dhcp server is working on vlan 24 and 124 on the switch but on the AP it always stays with Vlan 1. The AP can ping all vlan interface on the router. DHCP server hangs off the router.
topology is 3725(with NMD-36-ESW port 2/2) trunk to AP. Below is the relevant configs:
*************3725***************
interface FastEthernet2/2
switchport trunk native vlan 9
switchport mode trunk
interface Vlan1
description Data
ip address 10.7.1.254 255.255.255.0
interface Vlan9
description MANAGEMENT
ip address 10.7.9.1 255.255.255.0
ip helper-address 10.7.1.10
ip helper-address 10.7.1.11
interface Vlan24
description WIRELESS
ip address 10.7.24.1 255.255.255.0
ip helper-address 10.7.1.10
ip helper-address 10.7.1.11
interface Vlan124
description *****WIRELESS GUEST*****
ip address 10.7.124.1 255.255.255.0
ip helper-address 10.7.1.10
ip helper-address 10.7.1.11
**************AP CONFIGS***********
aaa group server radius rad_eap
server 10.0.21.121 auth-port 1812 acct-port 1813
aaa group server radius rad_acct
server 10.0.21.121 auth-port 1812 acct-port 1813
aaa authentication login eap_methods group rad_eap
aaa accounting network acct_methods start-stop group rad_acct
dot11 vlan-name rms-guest vlan 124
dot11 vlan-name wavenet vlan 24
dot11 ssid rms-guest
vlan 124
authentication open
authentication key-management wpa
guest-mode
wpa-psk ascii 7 <removed>
dot11 ssid wavenet
vlan 24
authentication open eap eap_methods
authentication network-eap eap_methods
accounting acct_methods
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption vlan 124 mode ciphers tkip
encryption vlan 24 mode wep mandatory
broadcast-key vlan 124 change 360
ssid rms-guest
ssid wavenet
interface Dot11Radio0.1
description MANAGEMENT AND NATIVE
encapsulation dot1Q 9 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio0.24
description WAVENET SSID
encapsulation dot1Q 24
no ip route-cache
bridge-group 24
bridge-group 24 subscriber-loop-control
bridge-group 24 block-unknown-source
no bridge-group 24 source-learning
no bridge-group 24 unicast-flooding
bridge-group 24 spanning-disabled
interface Dot11Radio0.124
description RMS-GUEST SSID
encapsulation dot1Q 124
no ip route-cache
bridge-group 124
bridge-group 124 subscriber-loop-control
bridge-group 124 block-unknown-source
no bridge-group 124 source-learning
no bridge-group 124 unicast-flooding
bridge-group 124 spanning-disabled
interface FastEthernet0.1
description MANAGEMENT AND NATIVE
encapsulation dot1Q 9 native
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface FastEthernet0.24
description WAVENET SSID
encapsulation dot1Q 24
no ip route-cache
bridge-group 24
no bridge-group 24 source-learning
bridge-group 24 spanning-disabled
interface FastEthernet0.124
description RMS-GUEST SSID
encapsulation dot1Q 124
no ip route-cache
bridge-group 124
no bridge-group 124 source-learning
bridge-group 124 spanning-disabled
interface BVI1
ip address 10.7.9.10 255.255.255.0
no ip route-cache
ip default-gateway 10.7.9.1
ip radius source-interface BVI1
radius-server host 10.0.21.121 auth-port 1812 acct-port 1813 key 7 <removed>
bridge 1 route ip
Is it possible that you're VLAN hopping? VLAN 1 is normally the native VLAN, and you have VLAN 9 configured. Check your config carefully and make sure that your native VLAN on all your uplinks is consistent, assuming there are any uplinks. What you posted appears correct, though.
Honestly, I don't see a problem with the configuration your posted. You might want to reset the device to factory defaults or upgrade the IOS to ensure it's not a bug.
You aren't using dynamic VLAN assignment, are you?
Let us know if you figure it out, I'm curious what's going on here :D
Similar Messages
-
Guest ssid with anchor controller and Web policy
We have a WLC4404 and and anchor controller WLC4402 to provide guest access to the wifi net. We configured both in the same mobility group, and the guest ssid to attach to the mobility anchor 4402. All is working fine until we enable the web policy authentication on the 4402. In this case the client join the guest ssid but neither get an ip address from the dhcp server nor go anywhere. Is we disable the web authentication all works fine again. We are runnig 4.0.206.0 on both WLC. Anyone can help us?
Two things you might check. (1) The 4404's mobility anchor should point to the 4402, and the 4402 should anchor to itself. (2) Make sure you are configuring the same security policy for the SSID on both the 4402 and 4404. So if the SSID is "guest" and you turn on web authentication on the 4402, make sure "guest" is on the 4404 with web authentication. We are using a similar setup for guest access at several sites.
-
NAC Guest Server and Multiple Guest SSID's/Splashpages
Hi All,
If I have multiple guest SSID's on a single controller and I use NGS as the Radius. How do I configure NGS to "send" the clients to differnet login pages corresponding to the SSID they came from.
I can configure different splash pages in HotSpots section but how do I map the different SSID's from the controller to the different splash pages. Then I guess that raises the question when I generate guest users on NGS is it possile to only allow them associate to a specific SSID.
TIA,
Eoin.Hi Nicolas,
Thanks for the reply. I can see that config on the WLC and have used it before where there is only a single guest SSID. What I dont know is if the NAC Guest server sees radius requests coming from different guest SSID's on the same WLC. How does the NAC Guest server apply the correct guest policy to that user. And when sponsors genereate guest accounts how do they specific which policy is to be applied to that guest so it can only get access to a specfic guest network/SSID I'm not sure where the "mapping" of accounts/splash pages/policies takes place on the NAC guest server. I've only ever set up NAC Guest when there has been a single guest SSID.
Regards,
Eoin. -
AIR-AP1142N-A-K9 configuration issue for guest ssid
I'm trying to get the guest ssid working. I was frustrated so saved my old config and wiped out everything on this AP. Now my bvi1 does not come online.
ap#sh ip int bri
Interface IP-Address OK? Method Status Protocol
BVI1 192.168.2.249 YES NVRAM down down
Dot11Radio0 unassigned YES NVRAM up up
Dot11Radio0.50 unassigned YES unset up up
Dot11Radio0.51 unassigned YES unset up up
Dot11Radio1 unassigned YES NVRAM administratively down down
GigabitEthernet0 unassigned YES NVRAM up up
GigabitEthernet0.50 unassigned YES unset up up
GigabitEthernet0.51 unassigned YES unset up up
ap#
ap#sh int bvi
*May 6 15:05:24.611: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 847a.8835.4f22 Associated KEY_MGMT[WPAv2 PSK]1
BVI1 is down, line protocol is down
Hardware is BVI, address is 003a.99eb.8d00 (bia b862.1fe9.9af0)
Internet address is 192.168.2.249/24
MTU 1500 bytes, BW 54000 Kbit, DLY 5000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
3 packets output, 180 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
ap#
I have a private vlan 50 and the public vlan 51. The private ssid seems to work and allow connectivity to the internet but I don't understand with the same configuration the Public ssid doesn't seem to work.
I get this output when trying to connect with my cell phone.
*May 6 15:00:37.288: %DOT11-6-DISASSOC: Interface Dot11Radio0, Deauthenticating Station 847a.8835.4f22 Reason: Sending station has left the BSS
*May 6 15:00:38.432: %DOT11-6-ASSOC: Interface Dot11Radio0, Station TYLOR-NB 9c4e.3617.483c Reassociated KEY_MGMT[WPAv2 PSK]
*May 6 15:00:42.935: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 847a.8835.4f22 Associated KEY_MGMT[WPAv2 PSK]
*May 6 15:00:54.320: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 2c44.01c3.70a6 Associated KEY_MGMT[WPAv2 PSK]
*May 6 15:01:13.913: %DOT11-6-DISASSOC: Interface Dot11Radio0, Deauthenticating Station 847a.8835.4f22 Reason: Sending station has left the BSS
*May 6 15:01:17.281: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 847a.8835.4f22 Associated KEY_MGMT[WPAv2 PSK]
*May 6 15:01:48.181: %DOT11-6-DISASSOC: Interface Dot11Radio0, Deauthenticating Station 847a.8835.4f22 Reason: Sending station has left the BSS
*May 6 15:01:51.583: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 847a.8835.4f22 Associated KEY_MGMT[WPAv2 PSK]
*May 6 15:02:22.500: %DOT11-6-DISASSOC: Interface Dot11Radio0, Deauthenticating Station 847a.8835.4f22 Reason: Sending station has left the BSS
*May 6 15:03:41.852: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 847a.8835.4f22 Associated KEY_MGMT[WPAv2 PSK]
SSID [PUBLIC] :
MAC Address IP address Device Name Parent State
847a.8835.4f22 0.0.0.0 ccx-client - self Assoc
ap#
ap#show run
Building configuration...
Current configuration : 2746 bytes
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname ap
enable secret 5 $1$4jEJ$ajpjBvSx3DUhxyvLADj.91
aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa session-id common
dot11 syslog
dot11 ssid PRIVATE
vlan 50
authentication open
authentication key-management wpa version 2
mbssid guest-mode
wpa-psk ascii 7 01150F035E050E0A2D
dot11 ssid PUBLIC
vlan 51
authentication open
authentication key-management wpa version 2
mbssid guest-mode
wpa-psk ascii 7 045D02010A2F444B05
username Admin privilege 15 password 7 0526071D3545175840
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption vlan 50 mode ciphers aes-ccm
encryption vlan 51 mode ciphers aes-ccm
encryption mode ciphers aes-ccm tkip
ssid PRIVATE
ssid PUBLIC
antenna gain 0
mbssid
station-role root
interface Dot11Radio0.50
encapsulation dot1Q 50 native
no ip route-cache
bridge-group 50
bridge-group 50 subscriber-loop-control
bridge-group 50 block-unknown-source
no bridge-group 50 source-learning
no bridge-group 50 unicast-flooding
bridge-group 50 spanning-disabled
interface Dot11Radio0.51
encapsulation dot1Q 51
no ip route-cache
bridge-group 51
bridge-group 51 subscriber-loop-control
bridge-group 51 block-unknown-source
no bridge-group 51 source-learning
no bridge-group 51 unicast-flooding
bridge-group 51 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
antenna gain 0
dfs band 3 block
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
no keepalive
interface GigabitEthernet0.50
encapsulation dot1Q 50 native
no ip route-cache
bridge-group 50
no bridge-group 50 source-learning
bridge-group 50 spanning-disabled
interface GigabitEthernet0.51
encapsulation dot1Q 51
no ip route-cache
bridge-group 51
no bridge-group 51 source-learning
bridge-group 51 spanning-disabled
interface BVI1
ip address 192.168.2.249 255.255.255.0
no ip route-cache
ip default-gateway 192.168.2.1
ip http server
ip http authentication aaa
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
bridge 1 route ip
line con 0
line vty 0 4
end
switch config:
interface FastEthernet1/0/46
switchport trunk encapsulation dot1q
switchport trunk native vlan 50
switchport trunk allowed vlan 50,51
switchport mode trunkHi
I know the bridge-group have to be identical to the sub interface number and vlan number
This is true for all other vlans except for native vlan. For native vlan sub-interfaces bridge group number always should be 1. In your case, if vlan 50 is the native vlan (192.168.2.x/24 belong vlan) then configure bridge-group 1 under those .50 sub-interfaces. Then everything should work :)
It is ideal if you could put AP management (BVI IP) into separate vlan & two user groups put vlan 50 & 51. Here is a sample configuration where vlan 110 is Mgmt & vlan 12,13 for user vlans.
http://mrncciew.com/2012/10/24/multiple-ssid-config-on-autonomous-ap/
HTH
Rasika
**** Pls rate all useful responses **** -
Wireless and guest network and HREAP
Hi,
I have inherited a wireless infrastructure which comprises of a head office with WCS and WLC plus LWAPP access points.
There is a sub office in another town who wishes to deploy a wireless infrastrucure and it struck me that as they only want to deploy a couple of AP's that HREAP would be good to use in this senario.
However they want to also use the guest wireless network that we have in the head office but I dont want their guest traffic to come to our DSL modem that we have set up for the HO guest wireless. The two offices are connected via an MPLS link which doesnt need anymore traffic on it.
Is there a way of configuring the HREAP and the WLC and WCS so that the sub office breaks out locally for guest and yet the lobby admin at HO can control the password?
Many thanks,Hi Nell,
the feature you are looking for is "H-REAP local switching".
So you can set the remote AP to H-REAP mode (which optimizes it for "behind a WAN link") and from there you can set several ssids as "local switching".
this means that everything about the authentication phase is handled by WLC but after authentication, the traffic is dropped locally at the AP and doesn't transit through the WLC.
The guest SSID has to be enabled for local switching and then, on the H-REAP APs, go in the AP configuration (from WLC "wireless" tab, then click on ap) and in the hreap tab, you can configure the vlan where the guest traffic will be dropped on the remote site. It must be a vlan that exists on the remote site and users will get a DHCP address on that vlan.
Regards,
Nicolas -
Clients not receiving DHCP IP address from HREAP centrally Switched Guest SSID
Hi All,
I am facing a problem in a newly deployed branch site where the Clients are not receiving DHCP IP address from a centrally switched Guest SSID. I see the client status is associated but the policy manager state is in DHCP_REQD.
The dhcp pool is configured on the controller itself. The local guest clients are able to get DHCP and all works fine, the issue is only with the clients in the remote site. The Hreap APs are in connected mode. Could you please suggest what could be the problem. Below is the out of the debug client.
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 Adding mobile on LWAPP AP 3c:ce:73:6d:37:00(1)
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 Reassociation received from mobile on AP 3c:ce:73:6d:37:00
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 0.0.0.0 START (0) Changing ACL 'Guest-ACL' (ACL ID 0) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1393)
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 Applying site-specific IPv6 override for station 10:40:f3:91:7e:24 - vapId 17, site 'APG-MONZA', interface 'vlan_81'
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 0.0.0.0 START (0) Changing ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1393)
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 Applying IPv6 Interface Policy for station 10:40:f3:91:7e:24 - vlan 81, interface id 13, interface 'vlan_81'
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 Applying site-specific override for station 10:40:f3:91:7e:24 - vapId 17, site 'APG-MONZA', interface 'vlan_81'
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 0.0.0.0 START (0) Changing ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1393)
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 STA - rates (8): 140 18 152 36 176 72 96 108 0 0 0 0 0 0 0 0
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 0.0.0.0 START (0) Initializing policy
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state AUTHCHECK (2)
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 0.0.0.0 AUTHCHECK (2) Change state to L2AUTHCOMPLETE (4) last state L2AUTHCOMPLETE (4)
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 0.0.0.0 L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP 3c:ce:73:6d:37:00 vapId 17 apVapId 1
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 0.0.0.0 L2AUTHCOMPLETE (4) Change state to DHCP_REQD (7) last state DHCP_REQD (7)
*apfMsConnTask_3: May 24 13:26:49.372: 10:40:f3:91:7e:24 apfMsAssoStateInc
*apfMsConnTask_3: May 24 13:26:49.373: 10:40:f3:91:7e:24 apfPemAddUser2 (apf_policy.c:222) Changing state for mobile 10:40:f3:91:7e:24 on AP 3c:ce:73:6d:37:00 from Idle to Associated
*apfMsConnTask_3: May 24 13:26:49.373: 10:40:f3:91:7e:24 Scheduling deletion of Mobile Station: (callerId: 49) in 28800 seconds
*apfMsConnTask_3: May 24 13:26:49.373: 10:40:f3:91:7e:24 Sending Assoc Response to station on BSSID 3c:ce:73:6d:37:00 (status 0) ApVapId 1 Slot 1
*apfMsConnTask_3: May 24 13:26:49.373: 10:40:f3:91:7e:24 apfProcessAssocReq (apf_80211.c:4672) Changing state for mobile 10:40:f3:91:7e:24 on AP 3c:ce:73:6d:37:00 from Associated to Associated
*apfReceiveTask: May 24 13:26:49.373: 10:40:f3:91:7e:24 0.0.0.0 DHCP_REQD (7) State Update from Mobility-Incomplete to Mobility-Complete, mobility role=Local, client state=APF_MS_STATE_ASSOCIATED
*apfReceiveTask: May 24 13:26:49.373: 10:40:f3:91:7e:24 0.0.0.0 DHCP_REQD (7) pemAdvanceState2 4183, Adding TMP rule
*apfReceiveTask: May 24 11:35:53.373: 10:40:f3:91:7e:24 0.0.0.0 DHCP_REQD (7) Adding Fast Path rule
type = Airespace AP - Learn IP address
on AP 3c:ce:73:6d:37:00, slot 1, interface = 13, QOS = 3
ACL Id = 255, Jumbo F
*apfReceiveTask: May 24 13:26:49.373: 10:40:f3:91:7e:24 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 7006 IPv6 Vlan = 81, IPv6 intf id = 13
*apfReceiveTask: May 24 13:26:49.373: 10:40:f3:91:7e:24 0.0.0.0 DHCP_REQD (7) Successfully plumbed mobile rule (ACL ID 255)
*pemReceiveTask: May 24 13:26:49.373: 10:40:f3:91:7e:24 0.0.0.0 Added NPU entry of type 9, dtlFlags 0x0
*pemReceiveTask: May 24 13:26:49.373: 10:40:f3:91:7e:24 Sent an XID frame
*apfMsConnTask_3: May 24 13:26:49.401: 10:40:f3:91:7e:24 Updating AID for REAP AP Client 3c:ce:73:6d:37:00 - AID ===> 1
*apfReceiveTask: May 24 13:28:49.315: 10:40:f3:91:7e:24 0.0.0.0 DHCP_REQD (7) DHCP Policy timeout
*apfReceiveTask: May 24 13:28:49.315: 10:40:f3:91:7e:24 0.0.0.0 DHCP_REQD (7) Pem timed out, Try to delete client in 10 secs.
*apfReceiveTask: May 24 13:28:49.315: 10:40:f3:91:7e:24 Scheduling deletion of Mobile Station: (callerId: 12) in 10 seconds
*osapiBsnTimer: May 24 13:28:59.315: 10:40:f3:91:7e:24 apfMsExpireCallback (apf_ms.c:599) Expiring Mobile!
*apfReceiveTask: May 24 13:28:59.315: 10:40:f3:91:7e:24 apfMsExpireMobileStation (apf_ms.c:4897) Changing state for mobile 10:40:f3:91:7e:24 on AP 3c:ce:73:6d:37:00 from Associated to Disassociated
*apfReceiveTask: May 24 13:28:59.315: 10:40:f3:91:7e:24 Scheduling deletion of Mobile Station: (callerId: 45) in 10 seconds
*osapiBsnTimer: May 24 13:29:09.315: 10:40:f3:91:7e:24 apfMsExpireCallback (apf_ms.c:599) Expiring Mobile!
*apfReceiveTask: May 24 13:29:09.316: 10:40:f3:91:7e:24 Sent Deauthenticate to mobile on BSSID 3c:ce:73:6d:37:00 slot 1(caller apf_ms.c:4981)
*apfReceiveTask: May 24 13:29:09.316: 10:40:f3:91:7e:24 apfMsAssoStateDec
*apfReceiveTask: May 24 13:29:09.316: 10:40:f3:91:7e:24 apfMsExpireMobileStation (apf_ms.c:5018) Changing state for mobile 10:40:f3:91:7e:24 on AP 3c:ce:73:6d:37:00 from Disassociated to Idle
*apfReceiveTask: May 24 13:29:09.316: 10:40:f3:91:7e:24 0.0.0.0 DHCP_REQD (7) Deleted mobile LWAPP rule on AP [3c:ce:73:6d:37:00]
*apfReceiveTask: May 24 13:29:09.316: 10:40:f3:91:7e:24 Deleting mobile on AP 3c:ce:73:6d:37:00(1)
*pemReceiveTask: May 24 13:29:09.317: 10:40:f3:91:7e:24 0.0.0.0 Removed NPU entry.#does the client at the remote site roams between AP that connects to different WLC?
#type 9 is not good.
*pemReceiveTask: May 24 13:26:49.373: 10:40:f3:91:7e:24 0.0.0.0 Added NPU entry of type 9, dtlFlags 0x0
#Does your dhcp server getting hits.
#Also, get debug dhcp message & packet.
#Dhcp server is not responding.
*apfReceiveTask: May 24 13:28:49.315: 10:40:f3:91:7e:24 0.0.0.0 DHCP_REQD (7) DHCP Policy timeout
*apfReceiveTask: May 24 13:28:49.315: 10:40:f3:91:7e:24 0.0.0.0 DHCP_REQD (7) Pem timed out, Try to delete client in 10 secs. -
WLC - 7.2.110.0
ISE - 1.1.1
I'm new to ISE. I want to set up a very basic method for BYOD users to access our wireless network. I've set up an SSID for external Web Auth, where users get redirected to the ISE Guest Portal: https://1.2.3.4:8443/guestportal/Login.action
At that screen, users can enter their Active Directory credentials and login. Although the authentcation shows as successful under Operations -> Authentications, the user is redirected to the device registration page. On that page they see the message "We are unable to determine access privileges in order to access the network. Please contact your administrator." Their device MAC is listed, and they can enter a description but the "Register" button is greyed out.
I'm getting overwhelmed with the amount of documentation available as well as the new terminology. I'm familiar with using Windows RADIUS servers, but ISE is very foreign to me now. Is there any documentation to help me understand how access requests are processed?As you asked the documents related to ISE and Guest Portal. I am sending you two docs which will help you in this case. Please find the below documents:
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_guest_pol.html
http://www.cisco.com/en/US/docs/security/ise/1.0.4/user_guide/ise10_guest_pol.pdf -
3850 WLC - 5760 Anchor: Multiple Guest SSIDs issue
Hi,
I have configured a 3850 Foreign WLC and a 5760 as anchor WLC in a DMZ behind an ASA FW. The Anchor Controller is configured to advertise 3 GUEST Wireless:
(INSIDE) ---- ASA FW (guest in interface) -------------------------- (Te1/0/1) 5760 ANCHOR (Te1/0/2) -------------------- L3 Link-------------------- (guest out interface) ASA FW ---- (OUTSIDE)
GUEST1: 10.9.65.0/24 – VLAN 11
GUEST2: 10.9.66.0/24 – VLAN 12
GUEST3: 10.9.67.0/24 – VLAN 13
Management VLAN 1: 10.8.252.1 (Anchor Management VLAN – Mobility)
The link between the WLC and the Guest OUT Interface on the ASA Firewall is a L3 Link, NOT a Trunk.
The 5760 WLC is also a DHCP server for the three client VLANs above. I have also configured 3 SVIs as default gateways for these VLANs:
Interface vlan 11 – 10.9.65.1
Interface vlan 12 – 10.9.66.1
Interface vlan 13 – 10.9.67.1
wgh-anchorwlc5760-primary#show ip interface brief
Interface IP-Address OK? Method Status Protocol
Vlan1 10.8.252.1 YES NVRAM up up
Vlan11 10.9.65.1 YES manual up up
Vlan12 10.9.66.1 YES manual up up
Vlan13 10.9.67.1 YES manual up up
GigabitEthernet0/0 10.8.252.85 YES NVRAM down down
Te1/0/1 unassigned YES unset up up
Te1/0/2 10.8.253.1 YES NVRAM up up
Capwap0 unassigned YES unset up up
If a client connects to GUEST1 SSID it gets an IP address in VLAN 11 and its default gateway is 10.9.65.1.
If a client connects to GUEST2 SSID it gets an IP address in VLAN 12 and its default gateway is 10.9.66.1.
If a client connects to GUEST3 SSID it gets an IP address in VLAN 13 and its default gateway is 10.9.67.1.
Mobility is UP and I can see clients connected to the Anchor WLC either in IPLEARN or WEBAUTH_PEND state. DHCP is working fine, clients get an IP and the right default gateway and DNS servers when connect, for example, to GUEST1.
anchorwlc5760-primary#show wireless client summary
Number of Local Clients : 3
MAC Address AP Name WLAN State Protocol
04f7.e482.b21c N/A 2 IPLEARN Mobile
bc3e.6d32.17f6 N/A 2 IPLEARN Mobile
a826.d5b3.5ae8 N/A 2 WEBAUTH_PEND Mobile
However, they are not able to ping the default gateway – SVI VLAN 11: 10.9.65.1, so I can not see any traffic leaving the Anchor WLC to continue with the Web Authentication Process (cwa) using ISE. I can see that the authorization policy (“unkown” and the URL to ISE) has been pushed to the clients but I am not redirected to ISE Web Authentication Portal when I open my web browser. I have done some captures on the FW interfaces but I cannot see any traffic coming from the clients.
I know that usually there is a Trunk (that allows client VLANs) between a WLC and L3 Switch when you configure multiples SSIDs and then configure the SVIs on the L3 Switch. However, I think this design with a L3 Link should work too because 5760 is a WLC+L3Switch.
My question is: Why clients are not able to ping their default gateway?
I hope it makes sense.
I appreciate any thoughts and help. Thanks in advance.
Joana.Hi,
I couldn't get it working (I doubt if it is really possible). I had to add a switch between the 5760 Anchor Controller and the ASA Firewall:
(INSIDE) ---- ASA FW (guest in interface) -------------------------- (Te1/0/1) 5760 ANCHOR (Te1/0/2) -------------------- SWITCH-------------------- (guest out interface) ASA FW ---- (OUTSIDE)
The link between the 5760 and the Switch is configured as a Trunk and it allows the 3 Guest SSIDs (VLANs). The link between the Switch and the ASA FW is configured as a Layer 3 link. I also set up the default gateways for the 3 GUEST VLANs in the Switch (3 vlan interfaces) and the 5760 as DHCP Server.
I hope it helps.
Joana. -
1242AG Bridge, VLAN and Multiple SSIDs
I have two buildings that I'm trying to configure a bridge in between them using 2 1242AG APs.
Building A
PCOFFICE SSID on VLAN 200 Radio G
ROOT_1 SSID on Native VLAN 1 Radio A
Root Bridge
Building B
FDAPC SSID on Native VLAN 1 Radio G
ROOT_1 SSID on Native VLAN 1 Radio A
We are using directional antenna. I know they are lined up properly because I have them both down and in front of me. I'm getting an error on the Building B AP that says "
No SSID with VLAN configured. Dot11Radio1 not started." and I'm unable to get this to work. The bridge was working before I added the VLAN and encryption/WPA information for the PCOFFICE and FDAPC SSIDs
Any assistance would be amazing. Thanks! Please see attached files for configurations. I know the switch is configured properly because I had this working before and forgot to save the damn configuration off the devices. I'm not having to do it over from scratch.That did not work.
I've managed to fix the ROOT_1 and FDAPC... now I'm having an issue where I can attempt to connect to the PCOFFICE SSID but I'm unable to get a DHCP address from the server.
Here is the config for the AP with PCOFFICE on it and the switch.
SWITCH
interface GigabitEthernet3/2
switchport trunk allowed vlan 1,200
switchport mode trunk
interface Vlan1
ip address 192.168.3.4 255.255.255.0
interface Vlan200
ip address 192.168.30.2 255.255.255.0
ip helper-address 192.168.3.98
ip default-network 192.168.3.0
ip route 0.0.0.0 0.0.0.0 192.168.3.1
no ip http server
ACCESS POINT
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname AP1_ROOT_AP
enable secret 5 REMOVED
ip subnet-zero
no aaa new-model
dot11 vlan-name VLAN1 vlan 1
dot11 vlan-name pcCopper vlan 200
dot11 ssid PCOFFICE
vlan 200
authentication open
authentication key-management wpa
guest-mode
wpa-psk ascii 7 REMOVED
dot11 ssid ROOT_1
vlan 1
authentication open
authentication key-management wpa
infrastructure-ssid optional
wpa-psk ascii 7 REMOVED
dot11 network-map
dot11 arp-cache optional
power inline negotiation prestandard source
username Cisco password 7 REMOVED
username admin privilege 15 password 7 REMOVED
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption mode ciphers tkip
encryption vlan 200 mode ciphers tkip
ssid PCOFFICE
speed basic-2.0 5.5 11.0 12.0 18.0 24.0 36.0 48.0 54.0
no power client local
power client 17
power local cck 17
power local ofdm 17
channel 2462
station-role root access-point
antenna receive right
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 port-protected
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface Dot11Radio0.200
encapsulation dot1Q 200
no ip route-cache
bridge-group 200
bridge-group 200 subscriber-loop-control
bridge-group 200 block-unknown-source
no bridge-group 200 source-learning
no bridge-group 200 unicast-flooding
bridge-group 200 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
encryption mode ciphers tkip
encryption vlan 1 mode ciphers tkip
ssid ROOT_1
dfs band 3 block
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
no power client local
power client 11
power local 11
channel 5180
station-role root bridge
antenna receive right
antenna transmit right
interface Dot11Radio1.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
hold-queue 160 in
interface FastEthernet0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 spanning-disabled
interface FastEthernet0.200
encapsulation dot1Q 200
no ip route-cache
bridge-group 200
bridge-group 200 spanning-disabled
interface BVI1
ip address 192.168.3.241 255.255.255.0
no ip route-cache
ip default-gateway 192.168.3.1
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
control-plane
bridge 1 route ip
line con 0
line vty 0 4
login local -
WAP321 - Guest SSID not working
I have a WAP321 with 2 SSID's. One is for local access and another for guest. The WAP connects to a 3550 and it's port is set to
description Cisco Wireless
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,20
switchport mode trunk
no ip address
spanning-tree portfast
My ASA 5505 is set with both VLANs and I'm using DHCP to dishout the guest IP. MyWAP has both networks setup. VAP 0 is setup for VLAN 1 and VAP 1 is for VLAN 20. Both are enabled.
When connecting to my local wireless, I have no problem getting local access and Internet connection. When I connect to Guest I get an IP from my ASA's DHCP, but I cannot ping my gateway, which is my ASA. I know my guest VLAN is ok, because if I put a port on that VLAN, I can connect to the Internet.
When I do packet captures from the WAP (Administration-Packet Capture), I can't see any ICMP attempts either from the eth0 or VAP 1. When I capture my machines wireless interface I see ICMP attempts with no reposnds. It makes me think I missed something in the WAP321 setup.
Any ideas where to check?Hi, My name is Eric Moyers. I am a Network Support Engineer in the Cisco Small Business Support Center. Thank you for using the Cisco Community Post Forums.
While what I am fixing to share is not in any way a great solution, It can be utilized as a workaround.
With the WAP321, after trying a few different scenarios that didn’t work. I simply created two vlans, left the Untagged vlan as main vlan and changed the Management vlan to the second. I then attached the guest SSID to the Management VLAN. This allowed me to authenticate to my guest captive portal and get an IP and get out to the internet. The Main SSID still worked normally.
Now for some caveats:
Problem: If a wireless client knows the IP of the WAP and the username and password they could get into the WAP.
Solution: Setup Management Access Control to an IP outside the DHCP scope for that VLAN and have a Strong Password.
Problem: Management of the WAP321 can only be from an IP on the Management VLAN. (In my case 2)
Solution: Setup Management Access Control to an IP outside the DHCP scope for that VLAN and have a Strong Password.
Not the very best solution, but the only workaround I can come up with for now.
Thanks
Eric Moyers .:|:.:|:.
Cisco Small Business US STAC Advanced Support Engineer
Wireless Subject Matter Expert
CCNA, CCNA-Wireless
866-606-1866
Mon - Fri 09:30 - 18:30 (UTC - 05:00)
*Please rate the Post so other will know when an answer has been found. -
VLAN Configuration for Internal and Guest Wireless
Hello,
We are using the following hardware…
SG300-52MP switch -- latest firmware
ASA 5512-X firewall -- 9.1
Aironet AP1131AG WAP
We have the following networks…
10.252.4.0/24 = Internal = ASA-01 interface = VLAN1
10.252.6.0/24 = Guest = ASA-02 interface = VLAN6
10.252.6.0/24 = VOIP = ASA-03 interface = VLAN3
The Aironet supports two SSIDs, Secure (RADIUS) and Guest (WPA2), which are supposed to provide access to the appropriate interface on the ASA.
Relevant parts of the WAP configuration are…
dot11 ssid GUEST
vlan 6
dot11 ssid SECURE
vlan 1
interface Dot11Radio0
no ip address
ssid GUEST
ssid SECURE
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
interface Dot11Radio0.6
encapsulation dot1Q 6
no ip route-cache
bridge-group 255
interface Dot11Radio1
no ip address
no ip route-cache
ssid GUEST
ssid SECURE
interface Dot11Radio1.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
interface Dot11Radio1.6
encapsulation dot1Q 6
no ip route-cache
bridge-group 255
interface FastEthernet0
no ip address
no ip route-cache
interface FastEthernet0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
interface FastEthernet0.6
encapsulation dot1Q 6
no ip route-cache
bridge-group 255
interface BVI1
ip address 10.252.4.4 255.255.255.0
no ip route-cache
ip default-gateway 10.252.4.1
We can manage the WAP through it’s Internal IP address (10.252.4.4).
And the “Guest” wireless network is working -- connecting to that SSID provides the client with the correct IP addressing (10.242.6.X from VLAN6/ASA-02). [Note: the VOIP DHCP and network access also works correctly.]
The “Secure” wireless network is not working however -- the client never receives an Internal DHCP address from ASA-01, and even if you hard-code the client’s IP, no IP4 traffic ever passes.
[Note: connecting a device to a SG300 port with the “Default” configuration provides the client with an Internal DHCP configuration, and it works as intended.]
While this may be a problem with the WAP configuration, I would like to confirm that it is not an issue with the switch not passing traffic correctly.
I have a feeling that I have configured the VLANs on the ports incorrectly.
Relevant parts of the SG300 configuration are...
v1.3.0.62 / R750_NIK_1_3_647_260
vlan database
vlan 3,6
ip dhcp snooping
ip dhcp relay address 10.252.4.1
ip dhcp relay enable
bonjour interface range vlan 1
interface vlan 1
ip address 10.252.4.2 255.255.255.0
no ip address dhcp
interface vlan 3
name VOIP
interface vlan 6
name Guest
interface gigabitethernet45 -- Access mode, Untagged VLAN6
description ASA-Guest
ip dhcp snooping trust
switchport mode access
switchport access vlan 6
interface gigabitethernet46 -- Access mode, Untagged VLAN3
description ASA-VOIP
ip dhcp snooping trust
switchport mode access
switchport access vlan 3
interface gigabitethernet47 -- Trunk mode, Untagged VLAN1 and Tagged VLAN6
description WAP1
switchport trunk allowed vlan add 6
interface gigabitethernet48 -- Trunk mode
description ASA-Internal
ip dhcp snooping trust
ip dhcp relay enable
Can someone who understands this switch better than I do please confirm the VLAN configuration? THANK YOU!Welcome to the discussion area!
+PCI regulations do not consider VLAN a secure way of keeping the data isolated. Does anyone have any technical information on how the device creates the guest wireless network ?+
I spoke to Apple Support some time ago and was told that Apple uses VLAN to create the Guest network, and also that formal documentation was not available on this topic. I was referred to the AirPort Extreme Specifications for available information.
This was some time ago, so if you need more up to date info, you might want to try to contact Apple to see if they are willing to share more information about this feature. Although, since VLAN is used, your question may already be answered.
FWIW, to use the Guest Network feature in a home situation, the AirPort Extreme must be set up as the main router controlling DHCP and NAT on the network. If you were thinking of installing the AirPort Extreme behind another router, the Guest Network feature would not be available in this type of configuration. -
Hi Experts ,
Need help with the respect to understand the best practice to place/create the DHCP scope for remote site Guest SSID which will be connected to HQ Foeign-Anchor controller set-up.
how about internet traffic for Guest SSID , which one will be recommanded :
1) Guest SSID gets authenticated from HQ ISE and exposed to the local internet
2) Guest SSID gets authenticated from HQ ISE and exposed to the HQ internet
ThanksHi George ,
Thanks for your reply ...So you mean, best design would be to create the DHCP scope into DMZ for guest and let it get exposed to HQ internet ...
how about if I have another anchor controller in lets say in other office and I need to anchor the traffic or load balance from HQ foreign controller , in that case if I create DHCP scope into HQ anchor controller and if its down , I will loose the connectivity , how do I achieve fail-over to another anchor ?
Do I need to create secondary scope into another anchor controller and let the client get reauthenticated from other location ISE and get ip address as well from another anchor controller . Is it what you are proposing ? -
WLC user rate limit on guest ssid anchor controller
Hi,
I have been looking through the forums & some cisco documents but not found a good example similar to what I am seeking to do so now I am turning to the expertise of my peers.
We have been deploying 3502 APs remotely to locations with full T1s that backhaul to where I sit at HQ.
Both the foreign and anchor controller are here at my location.
I am seeking to rate limit per user the bandwidth each client will get on the guest internet ssid.
As you know this traffic is encapsulated in capwap between the AP and the controller so I cant use a standard ACL on the switch or router.
We are trying to keep the guest internet access usage in check on the T1 at any given site so the other ssid's & local lan traffic is not overly competing for the bandwidth.
I found the place to edit the default profiles in the controller but the documentation really isnt clear on best practices.
So I put it to you my fellow wireless engineers to suggest how you are implementing bandwidth management on your wireless guest internet.
Thanks guys!
Oh and here is my hardware & software levels.
5508wlc - forgeign
4402wlc - anchor
Software Version
7.0.230.0Amjad,
Thank you for taking the time to respond as well as the document link.
It was pretty clear on the steps and what it would impact.
Two things that push me for a different solution (assuming their is one).
Note The values that you configure for the per-user bandwidth contracts affect only the amount of bandwidth going downstream (from the access point to the wireless client). They do not affect the bandwidth for upstream traffic (from the client to the access point).
As you can see from the above note taken out of the linked document the roll based rate limit doesnt really rate limit the T1 traffic any guest user consumes it only limits usage from the AP down to the client.
#1 I am looking for a solution that limits the users up & down streams (if possible) & also before it leaves the AP for the T1.
The idea is to limit WAN utilization.
#2 I read in the forums here others asking about the "user role" and saw some comments saying it is not considered "best practice" to use user roles.
Let me clarify that our guest ssid's are using the http webpage pass through for authentication and it is really only the tic mark to indicate they understand the terms and conditions of using our internet as a guest service. No actual user accounts are used on the guest ssid's.
***One last question about this and any other changes***
Will any change I make be on the "Foreign, Anchor" or both Controllers? -
E4200 Guest SSID Login page fails
Config:
Netgear ProSafe Gigabit Router is my DHCP Server -- The entire home net work is on the same subnet (192.168.15.xxx)
Linksys E4200 configured as an access point ONLY -- wired connection -- static IP assigned -- DHCP server turned off
Linksys WRT610N configured as an access point ONLY -- wired connection -- static IP assigned -- DHCP server turned off
3 -- 5 port gigabit switches
1 -- 8 port gigabit switch
No more than two switches between any two wired devices
Both Linksys access points have the same SSID and WPA2 security phrase -- total of 4 radios
Nonoverlapping channels are selected on both the 2.4Ghz and 5.0Ghz radio to minimize interference
All computers are running Windows 7 Professional 64bit with all the latest updates
Two iPhones and one iPad also access the network
All LAN and WAN connectivity is working as designed
Problem:
guest SSID is turned on
password is established
All devices will connect to the guest SSID and the E4200 is assigning an ip address to the device in the 192.168.33.xxx range which is what it's supposed to do.
When I open a web browser, I am not automatically redirected to the Cisco Login Page. If I enter 192.168.33.1 as the URL, the login screen is presented. I enter the password I have created in the guest admin page on the wireless guest tab. I then see a blank page and a URL of 192.168.33.1/guestnetwork.asp. THIS IS WHERE I GET STUCK. THE ONLY WAY TO EVER SEE THE LOGIN PAGE AGAIN IS TO REBOOT THE E4200, otherwise you just get unable to connect messages when opening web browsers and the wireless status icon in the system tray shows a yellow exclamation mark.
I successfully connect to the guest SSID but I do not get access to the internet. When I type ipconfig, I see that the DNS is set to 192.168.33.1 which does not exist on my network. I assume there's some internal NAT magic that is supposed to happen in the E4200 to bridge me over to my 192.168.15.xxx network but it doesn't seem to be happening.
At the beginning of the call I specifically asked them if the E4200 must be the DHCP server in order for the guest SSID feature to work and they said no. 1.5 hours later they had no answers so they told me that it wasn't working because the E4200 was not the DHCP server. The documentation says nothing about a DHCP requirement for guest AP service. Linksys support further could not answer what you would do if you needed more than one AP with guest service enabled.
It seems like this is a firmware issue but it may be the guest SSID service requires the E4200 to also act as the DHCP server. Can anyone shed any light on whether this is a bug or if the router/AP is working as designed?
Thanks,
(Mod note: Edited for guideline compliance.)Yes the E4200 must have DHCP turned on in order to pass out IP's to your Guest Network. No DHCP, no Guest Network.
-
Anchoring multiple Guest SSIDs to the same WLC
Hi All,
I've currently got a typical 'anchored' Guest WLAN solution where several WLCs tunnel guest traffic back to an isolated WLC for WebAuth - this all works fine using a mix of 5508 / 4400, all on v7.0.98.0 code.
The question is, can I add a second Guest SSID to the estate and anchor it back to the same Guest Anchor WLC that I'm already using?
I can't find anything to say it won't work and have found this that says it should, but none of this is very concrete... Does anybody know of any better references and/or have you done this in the wild?
https://supportforums.cisco.com/message/1276785
Cheers,
RichardHi,
yes it's totally ok.
On the foreign, just create a second WLAN and anchor it to the other WLC. On the anchor, create the same second WLAN that you anchor to itself ...
Nothing speciali in order to configure it.
Nicolas
===
Don't forget to rate answers that you find useful
Maybe you are looking for
-
Hi Viewers, I would like to know how to take the GR/IR balances at the cutover in the FICO. It's needed, since I am in very close to Go-Live date 5th Jan. Thanks & Regards Aswin
-
Hello, My we site is using a lot of ajax, and I have a function transformDocument that it doesn't works in version 6. Please help!!!
-
GetVersionCollection - passing multiple fields
Hi, Is it possible to use multiple fields in the "GetVersionCollection"? I have currently the code as : FetchListVersion.Lists listsservice = new FetchListVersion.Lists(); listsservice.UseDefaultCredentials = true; XmlNode ndVersionsRecID = listsserv
-
Okay... I have an unusual multicam with an even more unusual problem. We are making short videos for a Spanish class. These are mostly three cameras with additional, non-sync audio for each of the main actors. Each video is shot in short takes wit
-
I just got an apple tv and it dosen't work at all. I tried to use the home share feature with my iMac and both devices don't see each other, yet they are o the same network. I am not using a apple router. I tried updating the apple tv to see if that