Auto anchor mobility WLAN interface

Hello, I'm in doubt if I can associate the mgmt interface to my GUEST WLAN in anchor controller also. I know that must do it on foreign controller. Since my mgmt interface on ANCHOR CONTROLLER are configured in my DMZ if I realy need to configure the GUEST WLAN with a dynamic interface, I will need to create other Vlan and this make no sense.

Hi a.azambuja,
Yes - you can associate your guest WLAN to your management interface - however I would not recommend this.
You would be much better off creating a new VLAN that will manage the guest user traffic so that it is segmented away from any managemnt traffic.
Cheers,

Similar Messages

Layer 2 security with WLAN auto-anchor mobility

Hello,
I was wondering if Layer 2 security can be used with auto-anchored WLANs.
I need to deploy two new isolated WLANs which will terminate in two DMZ environments.
I was hoping to use the existing WCS-managed infrastructure with 4404 and 4402 WLCs and just throw on a couple more WLANs.
However, I've built a little test environment and while I can get the new VLAN traffic tunneled and origininating from the correct anchor controller with no layer 2 security - as soon as I turn on WEP or WPA security options it stops working. I can't find anything in documents or this forum to show auto-anchor mobility with anyhing other than unsecured guest WLANs.
Am I trying to do somethng unsupported or is it just an error on my part?

Hi Greg,
no, the users are internal so I only want to use L2 security. I can't see that L3 should be a problem to add on though. I'm using 3.2.x of the WLC code - so there is no "Guest LAN" mode - I was playing with the new versions and it looks like L2 security is disabled in that mode?
If you want to see how I got my bit working I would be happy to share my doco when I'm done.
regards,
Aaron

WLC Mobility Auto-Anchor Code Matrix

Hi guys,
I am involved with a project where I will be upgrading WiSM1s with WiSM2s and moving to the 7.2 code to support the funky new 3600 APs
The question I have is that there are some other foreign controllers of differing flavours 5508/4402 and maybe others that are tunnelled back to the WiSM1s and using these as an auto-anchor - So what are the compatibility options I have here for code support please?
I have been told there is a compatibility matrix but all I can find is the software compatibility matrix, but this does not have anchor specific code details. Maybe this means it dosen't matter but I know it had certain limitations in the past and is now opened up to differing code support since 5.2 (I think), but just not sure now whether things may change again given the next generation 7.2 code now being out.
Thanks
Rocky

Hi Scott,
Thanks for that, I was hoping someone had already set it up!
I was looking at that matrix earlier but it didn't look right to me as according to the table it is supported back to 4.2? I am positive I read this feature only kicked in at 5.2.
Thanks again
Rocky
Sent from my BlackBerry® wireless device

Guest tunnel/auto-anchor from 2100 to 4400 WLC

We’d like to extend our current Guest LAN from a 4400 WLC in our data center to a 2100 WLC located at a remote facility. However, we cannot get the foreign controller to pass traffic to the anchor controller – or so it seems. The catch is that we’re not actually trying to extend the SSID itself to provide wireless access, but instead flub it so that we can provide local wired access tunneled to the Guest LAN on the anchor WLC. I’m not entirely sure if this is possible, because I’ve read that before the EoIP tunnel will come up a guest client must associate to the foreign WLC.
We’ve followed the instructions we could find that go over setting up this type of scenario, but unfortunately they only cover setting up back-to-back 4400 controllers and as such, some functions described (notably being able to create a Guest LAN) are not possible on the 2100. We haven’t been able to find a clear and concise guide on the scenario we want to set up.
Here’s some detail:
Mobility group is up/up between both WLCs. Both WLCs are running 6.0.x code.
Anchor WLC – 3750G-24WS-S25 (a 4400 WLC w/ integrated 3750G-24)
Guest LAN WLAN “wired-guest” created; Ingress is “none” and Egress is our existing “dirtnet” – i.e. outside access. The “dirtnet” interface is *not* a Guest LAN interface. Mobility anchor is set as local.
Remote WLC – WLC2106
WLAN “wired-guest” created; Interface is “wired” w/ an IP address on the same subnet as the anchor “dirtnet” and associated with port 2. Mobility anchor is set to the anchor WLC and is up/up. I have a laptop connected to port 2 with a statically assigned IP address on the same subnet as “dirtnet.” I am able to ping the local port 2 address, but I can’t ping across the tunnel to the anchor WLC. I also cannot ping the anchor WLC "dirtnet" interface from the foreign WLC’s Ping tool.
Are we missing something?

Sean,
Wired guest access is not supported on WLC2106.
Reference:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00808ed026.shtml#configs
Please consider using a WISM, WLC4400, 3750 integrated WLC or a WLC5500

WLC2x06 auto-anchor to 4400 appears to fail

Hi, has anyone seen this problem, or is this a bug:
Auto-anchor is configured for guest mobility and has been working fine on a number of 4400 controllers in a mobility group. Guests get auto-anchored to a 4400 with access to the guest DMZ
we have now introduced both 2006 and 2106 controllers into the mobility group, however clients are net getting DHCP when coming through these controllers.
debugs show an apparent disinterest on the part of the 4400 to respond to mobility anchor requests from the 2x06, and mobility statistics report increase in 'ignored' requests
mobility debug on 4400 for unsuccessful request from 2106:
Wed May 23 15:31:34 2007: Mobility packet received from:
Wed May 23 15:31:34 2007: 192.168.156.2, port 16666, Switch IP: 192.168.156.2
Wed May 23 15:31:34 2007: type: 3(MobileAnnounce) subtype: 0 version: 1 xid: 200 seq: 200 len 120
Wed May 23 15:31:34 2007: group id: dedbb34b 687b56c2 633f1d4d 73ed6709
Wed May 23 15:31:34 2007: mobile MAC: 00:19:d2:d5:eb:39, IP: 0.0.0.0, instance: 0
Wed May 23 15:31:34 2007: VLAN IP: 192.168.156.2, netmask: 255.255.255.0
Wed May 23 15:31:35 2007: Mobility packet received from:
Wed May 23 15:31:35 2007: 192.168.156.2, port 16666, Switch IP: 192.168.156.2
Wed May 23 15:31:35 2007: type: 3(MobileAnnounce) subtype: 0 version: 1 xid: 200 seq: 200 len 120
Wed May 23 15:31:35 2007: group id: dedbb34b 687b56c2 633f1d4d 73ed6709
Wed May 23 15:31:35 2007: mobile MAC: 00:19:d2:d5:eb:39, IP: 0.0.0.0, instance: 0
Wed May 23 15:31:35 2007: VLAN IP: 192.168.156.2, netmask: 255.255.255.0
Wed May 23 15:31:36 2007: Mobility packet received from:
Wed May 23 15:31:36 2007: 192.168.156.2, port 16666, Switch IP: 192.168.156.2
Wed May 23 15:31:36 2007: type: 16(MobileAnchorExport) subtype: 0 version: 1 xid: 201 seq: 201 len 244
Wed May 23 15:31:36 2007: group id: dedbb34b 687b56c2 633f1d4d 73ed6709
Wed May 23 15:31:36 2007: mobile MAC: 00:19:d2:d5:eb:39, IP: 0.0.0.0, instance: 0
Wed May 23 15:31:36 2007: VLAN IP: 192.168.156.2, netmask: 255.255.255.0
Wed May 23 15:31:36 2007: Received Anchor Export request: 00:19:d2:d5:eb:39
from Switch IP: 192.168.156.2
Mobility debug on 4400 with successful request/resonse from another controller:
Wed May 23 15:31:41 2007: Mobility packet received from:
Wed May 23 15:31:41 2007: 192.168.160.13, port 16666, Switch IP: 192.168.160.13
Wed May 23 15:31:41 2007: type: 16(MobileAnchorExport) subtype: 0 version: 1 xid: 243028 seq: 29509 len 244
Wed May 23 15:31:41 2007: group id: dedbb34b 687b56c2 633f1d4d 73ed6709
Wed May 23 15:31:41 2007: mobile MAC: 00:12:f0:82:57:00, IP: 0.0.0.0, instance: 0
Wed May 23 15:31:41 2007: VLAN IP: 192.168.160.13, netmask: 255.255.255.0
Wed May 23 15:31:41 2007: Received Anchor Export request: 00:12:f0:82:57:00
from Switch IP: 192.168.160.13
Wed May 23 15:31:41 2007: Received Anchor Export policy update, valid mask 0x0:
Qos Level: 3, DSCP: 0, dot1p: 0 Interface Name: , ACL Name:
Wed May 23 15:31:41 2007: Mobility packet sent to:
Wed May 23 15:31:41 2007: 192.168.160.13, port 16666, Switch IP: 192.168.160.12
Wed May 23 15:31:41 2007: type: 17(MobileAnchorExportAck) subtype: 0 version: 1 xid: 243028 seq: 40918 len 272
Wed May 23 15:31:41 2007: group id: dedbb34b 687b56c2 633f1d4d 73ed6709
Wed May 23 15:31:41 2007: mobile MAC: 00:12:f0:82:57:00, IP: 192.168.191.16, instance: 1
Wed May 23 15:31:41 2007: VLAN IP: 192.168.191.2, netmask: 255.255.255.192
Wed May 23 15:31:41 2007: 00:12:f0:82:57:00 192.168.191.16 WEBAUTH_REQD (8) Plumbing duplex mobility tunnel to 192.168.160.13
as Export Anchor (VLAN 191)
all help appreciated!
Graeme

Hello
I don?t think the 20x6 controller support that.
http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn40216.html#wp44028
These software features are not supported on 2000 and 2100 series controllers:
?Termination of guest controller tunnels (origination of guest controller tunnels is supported)

WLC 4404 Anchor mobility

Hi,
i've 2 wlc lan controller 4404
1 wlc is in the DMZ area. On This controller i've configured the SSID named TEST (for the internet), that is connected at the cisco switch (id vlan 120)
If i try connect and work very well.
i must use this SSID over DMZ , in the other WLC in the other LAN SEGMENT.
I configured the anchor mobility.
i following the explain that i find on cisco. I don't understand if i must create che vlan also in the other LAN Segment.
I had configured this:
I created on the remote wlc the SSID TEST (= at the WLC in the DMZ)
I created the vlan 120 on the remote switch , and also i created this vlan in the remote WLC. In the Wlan SSID TEST i set the interface TEST(vlan120)
After this step, I created the anchor mobility (that is up) in the DMZ site and in the Remote site.
If i connected my pc on the SSID TEST in the remote wlc , the connection don't work.
is ok my configuration or i don't understand how to configure the anchor feature?
thanks for your help
fcostalunga

Take a look at this doc. You have to have the guest ssid configured the same for the foreign (inside) and anchor controller. The only difference is that you have to map the ssid to the management interface on both controllers. This is where the tunnel is created from. Ports have to be opened up on the dmz for the foreign and anchor controller to communicate:
http://www.cisco.com/en/US/docs/wireless/technology/guest_access/technical/reference/4.1/GAccess_41.html

Cisco Auto Anchor Web Authentication - NAS IP Address

Hi,
I've setup auto anchor web authentication for my guest network. I want my Web Authentication requests to be authenticated by ISE however need the authenticating device to be the Anchor Controller.
I setup the WLAN to authenticate against ACS4.2 and it works correctly, the NAS IP address is the Anchor controller. When changing the WLAN to auth again my ISE 1.2 server, authentications are sourced from the foreign controller.
Has anyone come across this or know why ISE is seeing the NAS IP Address as the foreign wireless controller?
Thanks,

Hi,
I've setup auto anchor web authentication for my guest network. I want my Web Authentication requests to be authenticated by ISE however need the authenticating device to be the Anchor Controller.
I setup the WLAN to authenticate against ACS4.2 and it works correctly, the NAS IP address is the Anchor controller. When changing the WLAN to auth again my ISE 1.2 server, authentications are sourced from the foreign controller.
Has anyone come across this or know why ISE is seeing the NAS IP Address as the foreign wireless controller?
Thanks,

Anchor mobility configuration getting lost in wlc 5508 ios code 7.4.100.0

It is observed that in WLC 5508 , ios 7.4.100.0 , mobility anchor configuration on wlan is getting lost . we configure anchor ip address on guest wlan > mobility anchor > Switch IP Address (Anchor).
We have configured the template on NCS 2.0 to push the anchor mobility ip address on all WLC
Has anyone oberved this behavoiur. We have more than 100 WLC , and everyweek mobility anchor configuration is lost on some WLC having code 7.4.100.0.

I am having this exact same problem. I am running 7.3 on 5508 WLC. My remote site LAP's are using Flex (HREAP). The initial access point that my laptop associates to connects with no problem, as soon as I wander out of range of the initial LAP and into the area of another access point, I lose data connectivity. The was validated like the original post as I start a constant ping on the LAN and watch as the ping latency increases and then ping replies stop. The only way to correct the problem is resetting of the wireless adapter on the laptop. Side note my DroidX has no problem wandering from AP to AP.
Laptop: Windows 7 32bit
I then returned to my home site and test where I have a secondary controller and the LAP's are configured for local mode, no problems roaming from access point to access point. Validated with constant ping test. The pings drop for a second and re-
continues as the laptop reconnects.
**Edit: I am going to try the removing the DHCP Addr. Assignment required option, and report that back to the TAC engineer.
Message was edited by: Michael Dunki-Jacobs
**Edit Solved:***
The problem is in deed solved by turning the "DHCP Address Required" but why?

Anchor mobility between WLC 5508 and Aruba/Clearpass

Hello. I have a question regarding the abiltiy to configure anchor mobility between a 5508 WLC and an Aruba controller. To date, my understanding is it has never been possible and I have never found any documentation that says it can be done.
Scenario: My organization and a partner organization co-own a hospital. We coexist on a large campus, with each org having a number of buildings that the owning org maintains the network presence in. We also maintain back-to-back firewalls between us and do not hand-off any direct layer 2 interfaces to each other. However, the two orgs do partner to provide each others business SSID's in each other's WiFi networks using anchor mobility. Our current solution utilizes an A/M tunnel between my org's 5508 controllers and the partner orgs 2504 controller and we explicitly permit the tunnel traffic between partner controllers for A/M to work. Last year, the partner org retired some old WiSM's and changed their wireless solution to Aruba and recently implemented Clearpass. In order to maintain A/M with us they left a 4404 operational, but due to the newer code we were running they were forced to purchase a 2504. So now they are only maintaining a limited footprint in their network with a few Cisco AP's and the rest of their coverage areas use Aruba AP's and they have indicated that they want to completely retire their Cisco WLC's. Because we host some of their SSID's on our controllers and can tunnel them to their 2504, they get all of their WiFi traffic coming from our network, however my org can only connect to our SSIDs on their campus in certain areas.
The solution I have been asked to provide is to find a way to continue providing some sort of anchor mobility services between our WLC's and their Aruba controllers. My org maintains that we do not want to simply hand them a layer 2 interface for security reasons, but they want our SSIDs to be available in all areas of the partner org's campus and vice versa. So far I have stalled the partner org's plans to retire their WLC's by telling them that retiring their WLC's will completely break WiFi between orgs, but they are adamant that some sort of A/M solution must be found.
Is there any way to do some sort of A/M between a WLC and Aruba controller and if so, is there any documentation showing configuration examples etc?
Thanks,
John

Hi John,
I do not think it will work. Even if it get working somehow, it will be operation nightmare to troubleshoot & fix a issue since both vendor will say it is NOT supported solution.
What about if you ask them to advertise your SSID (assuming it is dot1x) on their APs as another SSID on their network, but pointing it to your RADIUS & DHCP for IP connectivity (you do not have layer 2 requiremnt for this & can do this as long as you have L3 communication between each other)
HTH
Rasika
**** Pls rate all useful responses ****

!! Warning !! Guest anchor mobility fails in 5.0.48, Single Foreign

Finally some 5.0 chat showing up so I'll add this nugget. All controllers migrated from 4.2 to 5.0.48. All site (foreign) controllers = MOBGRP-CORP, anchor controller in central dmz = MOBGRP-DMZ..
Found that my first site where I implemented Guest via anchor mobility worked ok. Tried to bring up 2 new sites with their own foreign controller against same (working) anchor. NO GO. All debugs & shows indicate mobgroup, mobgroup anchor, etc all good. Debugs reveal mobility anchoring messages never being initated by foreign to anchor.
Reviewed with TAC for 3 hours last night. Finally found a bugID that related against 5.0.48.
Bottom line is that our site that was working had 2 foreign controllers. Site that wouldn't come up only had 1 foreign. Weird bug that if site has only 1 mobility member (beside anchor definition) then mob anchor plumbing messages won't exchange from foreign to anchor. Instead, debugs show foreign as anchor. Workaround = move anchor controller into same mobility group as the internal (foreign) controllers. All good now.
Hope this helps someone avoid 3 hrs w/ TAC. (And I felt I had a GOOD tac guy).
Now if I could just figure out how to have multiple profile/wlan definitions on anchor controller but have the same ssid on them all so that our guest ssid @ sites can be uniform. Currently won't let me define multiple wlans on anchor with same ssid, even if profile name is unique. Guess despite it not running APs it's still checking wlans for uniqueness. Not very 'enterprise' as we want to have each site a) Have standard guest ssid and b) Have their own IP address space for firewall log purposes, etc. A & B seemingly mutually exclusive in current situation, assuming central anchor controllers of course.

Well I guess now I need to follow up on my own post. After moving dmz anchor controller into "internal' mobility group, we ran into some weird issues.
1) New APs at the site we were bringing on were somehow getting joined up to another site's controller. Only thing in common between sites was mobgrp name and the fact that they both anchored guest to the same central anchor controller.
2) At the new site, guest seemed to work OK now but we were experiencing problems with hosts on one of the controllers internal wlans. They were not getting IPs. Debugs revealed that foreign (site) controller was bringing up guest tunnel to itself for this local, non-anchored wlan.
Opened another tac case. This tac engineer advises that while bug CSCsm71840 exists, the other engineer should not have told us the workaround was to put dmz anchor controller into internal mobility group. Rather, he advised, we should go into any controller (on dmz anchor end or internal foreign end) where there was only 1 controller in the mobility group and add a 'dummy' entry into the mobility group.
We changed the dmz anchor back to his own mobility group and then made the dummy entries and the mobility anchor worked correctly & so far appears that previously problematic internal wlan also works correctly.
This whole thing should make for some 'interesting' conversation with the BU shortly.

Anchor Mobility

Hi
I have created SSID's that remote users can log onto to that point to thier own Radius servers. Someone suggested that I need to use Anchor Mobility. Can you please tell me what this is in WLC and where I can find this.
Thank you

You only use anchor if you have another WLC and its part of the design. Here is a document that will explain auto anchor.
http://www.cisco.com/en/US/docs/wireless/controller/7.0MR1/configuration/guide/cg_mobility.html
Sent from Cisco Technical Support iPhone App

FlexConnect (aka H-REAP) and Auto-Anchor functionality

Hi Board,
I never did H-REAP on my wireless deployments. Now, I have an H-REAP (FlexConnect) requirement for branch offices.
Also there is the requirement for guest access at the same time.
From my understanding those features (FlexConnect and Auto-Anchor) should work together.
Please refer to the following exibit:
There is a FlexConnect AP at my branch office. The traffic from internal users (SSID "Internal") should be switches locally at the LAP (Lightweight Access Point). At the same time the guest SSID (SSID "Guest") should be tunneled back via CAPWAP to the controller to which the LAP is associated ("Central Controller"). The guest traffic should not emerge (switched) at the "Central Controller", instead it should be tunneled to an anchor controller in a DMZ via an "Ethernet Over IP tunnel" (Auto-Anchor functionality).
First question: Does this work (FlexConnect in conjunction with Auto-Anchor functionality)?
If this works, where's the web portal for guest authentication hosted (if using the internal web auth on WLC)? On the "central controller" or the Anchor controller? (I guess at the Anchor Controller in the DMZ, right?)
Is it possible to leave the guest SSID "open" with no webauth and still using the Anchor Controller? This would be needed if I have an external web authentication service, which would be hosted by a provider.
Thanks in advance for all your replies!
Johannes

The Flex 7500 deployment guide ("
http://www.cisco.com/en/US/products/ps11635/products_tech_note09186a0080b7f141.shtml
") states:
"The Cisco FlexConnect Solution also supports Central Client Data Traffic, but it should be limited to Guest data traffic only."
later in the document there is a section about Guest access that states "Flex 7500 will allow and continue to support creation of EoIP tunnel to your guest anchor controller in DMZ."
Hope that helps.

802.1x anchor mobility

Hi,
We are using the anchor mobility feature to authenticate 802.1x/WPA2 clients. We see that dhcp/data traffic traverses the Eth/IP tunnel, but do not see the authentication/radius packets. We see the authentication sourcing from the local controller. Is this how anchor mobility works or are we missing something ?
Thanx....

The below link is a good explanation of the Anchor-Mobility function within Mobility Groups.
http://www.cisco.com/en/US/docs/wireless/controller/4.0/configuration/guide/c40mobil.html#wp1002608
HTH.

FCP 10.0.5 won't recognize external keyboard. Izotope Iris plugged in to mobile pre interface

Have current FCP. I have an external keyboard running into Izoptope Iris synth... all through my mobile pre interface. When I select "record audio" from the FCP window menu the dialogue box comes up. I select mobile pre and no sound. I get audio for a voice over if I select the internal microphone option so I know the record function in FCP is working... Ideas anyone?? Thanks

Finally got it working.. Ok so First read this
http://support.apple.com/kb/TS1538?viewlocale=en_US&locale=en_US
Just start with verifying the Apple Mobile Device Support is up and working, Just follow the steps here:
http://support.apple.com/kb/TS1567
After Stopping it and Restarting and it is still not reconizing your device Then start uninstalling
Start with: Itunes, Quicktime, Bonjour, Apple Software Update, Apple Mobile Device.
I had an issue uninstalling Apple Software Update, and was unable to get it off my computer.
But after all that download and reinstall itunes.
After doing all that i was able to get mine to show up in itunes
Hope it helps

Is local EAP + Web Authentication possible in Auto Anchor Configuration

Hi,
I have a wireless network setup in an auto-anchor configuration with the foreign and anchor controllers. Due to the foreign controller being owned and managed by another company, I have an interesting authentication scenerio I would like to acheive. We can't implement full EAP-TLS as we would have to allow authentications from the foreign controller which is owned and managed by another company.
Currently Web Authentication is working correctly for the Wireless Network. As another layer of security, I want to know if its possible for the wireless clients to trust a certificate installed on the foreign controller? If so, are you able to point me in the direction of a user guide to implement.
I found the following document which describes local EAP configuration . Would this work with Web Authentication?
Thanks

so, kinda but no. EAP is a layer 2 authentication that uses encryption as well.
WebAuth is a layer3 authentication only.
Now the kinda....you can create guest/network users on the WLC local database, and if someone logins to the webauth portal with those credentials they will be able to get on.
I'm not really sure what you are looking to do based on your post.
Personally, if I had users that were going to roam to this controller, I'd work with that companies IT and get it linked to my AAA server and keep the EAP-TLS that I had working already going. Just because that WLC would be able to communicate to your AAA doesn't mean their users would be able to get on, as they wouldn't have the machine or client certificate nor the Root CA cert on their machines.
HTH,
Steve

Auto anchor mobility WLAN interface

Similar Messages

Maybe you are looking for