Cisco 5508 HA VS Primary/Secondary- Feedback

Anyone having issues with 5508 HA switching between the pair? Would you say that the Primary/secondary fail over is good enough?

Hi Leo, Scott
So I was doing a bit more reading on this http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/69639-wlc-failover.html it is an old document but working through it the document suggested that you didn't need to specify the IP address of the Primary or Secondary controller in the Wireless -> All AP -> AP_NAME -> High Availability. I removed this from one of the APs that was at the time serving no clients and tried to move it to the secondary and it worked. I then moved it back to the primary and it worked again.
Any reason why this would happen? The IP addresses I was using were 100% correct. The only difference I see for this controller as opposed to others we manage is the introduction of new interface types i.e. 'redundancy management' , 'redundancy port' ,etc. I do not have redundancy enabled so I'm guessing not, but having trawled through the configuration this is the only difference I can see?

Similar Messages

Cisco ASA - Invert primary/secondary

Hello
This is my first post in this forum.
I haven't found an answear to my issue, so I decided to open a new discussion
We take care of 2 Cisco ASA 5580 (primary/secondary) working as usual (active/standby). Image version 8.2.5.
Today I found that the firewall that has been supposed to rule as primary, actually has been the secondary and vice-versa.
How can I configure (and what's the impact, as they are active im customer/business environment) to invert the situation: the primary become the secondary and the secondary become the primary.
I'm not talking about to perform a failover, but a config to fix that confusion with roles.
Regards
Christian

Hi,
Welcome to the CSC
Since we are talking about an Active/Standby ASA Failover environment then configuring the "primary" and "secondary" in the "failover" configurations of the ASAs doesnt to my understanding have much meaning to the firewall operation other than deciding which becomes Active WHEN they BOTH boot at the same time.
If we for example have the below situation
We have ASA1 and ASA2 in Active/Standby Failover
ASA1 is configured as "primary" and ASA2 is configured as "secondary"
ASA1 is originally the Active unit and ASA2 the Standby unit
Now lets assume that either ASA1 boots or becomes Standby because of one of its interfaces failing THEN to my understanding there is NO mechanism in the Active/Standby Failover that would return the Active role back to the ASA1 when it becomes operational.
However in the case of Active/Active Failover its possible to configure a "preempt" parameter that defines that the unit that you have decided as the Active unit will return to Active role after network outage after a configured perioid of time. This is NOT possible on Active/Standby.
So in normal networking operation to my understanding the only way to really keep the preferred physical ASA as Active is to monitor the Failover and manually set the original physical ASA Active if there has been a failover.
There doesnt seem to be any automatic mechanism for the Active role to return to the original Active physical ASA.
IF you are just talking about changing the commands "failover lan unit primary" and "failover lan unit secondary" to the correct physical ASAs THEN sadly I can't say for sure (without testing) what effect configuring those commands have (when changing them around). I'd presume that changing these wont have any effect on the operation of the firewall as in production they DONT actually decide which unit STAYS Active
According to the Command Reference of 8.2 software the default setting is Secondary
I imagine you could possibly do the following (But cant say for 100% certainty without testing it myself)
remove the possible configuration "failover lan unit secondary" from the other unit
remove the "failover lan unit primary" from the other unit
configure the "failover lan unit primary" on the correct unit
And finally if you want configure the other unit with the "secondary" option (even though the default setting should be secondary according to the command reference)
Maybe I'll try to check if I have a identical Failover pair of ASA (physical) to test this out for you.
Heres link to the Command Reference for 8.2 software and the command "failover lan unit"
http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/ef.html#wp1930580
Hope the information was helpfull.
- Jouni

Cisco 5508 external web authentication

Hi all,
Firstly, I do apologise as this question has been posted in another forum, I believe it is the wrong one though hence me posting here.
I am running with a pair of Cisco 5508 controllers with 7.4.121.0 installed. We offer a guest Internet service to our user base and guests. To access the guest service a user must first authenticate via an externally hosted server, I won't go into the specifics but it is a secure service will a valid, signed cert for the login page. The issue I am hitting is that when a user logs into the portal the controller cert is then displayed (2.2.2.2) which returns a cert error. It kind of makes the service look insecure when it isn't. I've read numerous articles about creating CSRs, etc and loading certificates on the controller, but the issue we have is that we use externally hosted DNS servers for the service and they are refusing to create a DNS record. We can't use internally hosted DNS servers as this breaks our security policy. Is there any other way around this or do I just have to have the user accept the cert error?
Thanks

I hear you and I was under the same impression. If I go through the steps I followed maybe it can be explained..
Upgraded the primary controller from 6.0.x to 7.0.x a, APs upgraded. Upgraded FUS to 1.9. Upgraded controller to 7.4.121.0, upgraded APs. APs joined the controller. Disabled WebAuth Secure Web. Followed same steps for secondary controller. Shutdown primary controller to test failover to secondary. APs did not failover. Waited 15 mins, debugged CAPWAP and saw nothing coming in. Brought primary back online, waited 15 mins, debugged CAPWAP and saw nothing coming in. Waited a further 15 mins. Still no APs joining. Enabled WebAuth Secure on the primary, and boom, all the APs joined the primary. Not sure if this was just a coincidence, but this was the behaviour I witnessed. I'm running a pair of 5508's.
I've not witnessed this before, but this is the first time I've disabled this setting. Understand it has nothing to do with APs joining and may just be a coincidence, but this is what I experienced. I ran out of time during the change window so couldn't test this further and try to simulate again, will try again when the next window becomes available.

Cisco 5508-WLC using MS NPS as RADIUS Server for EAP-TLS

Has anyone experienced a problem getting a Cisco WLC to work with MS NPS server? We've done it before albeit with differnt code versions.
I have a Cisco 5508 WLC running 7.0.116.0 code hosting a WLAN configured for WPA2 with 802.1x for authentication. I have two Windows NPS servers configured as the RADIUS servers for EAP-TLS authentication. Via debug info on the WLC I can see the 802.1x handshake take place with the wireless client and the WLC as well as a successful transmission of an Authentication Packet from the WLC to one of the RADIUS servers. However on the WLC I see repeated RADIUS server x.x.x.x:1812 deactivated in global list and on the NPS server I'm seeing event log errors indicating "The Network Policy Server discarded the request for a user" along with the pertinent auth request info that I would expect the NPS server to receive from the WLC.
Based on the WLC debug info I'm never actually getting to the EAP-TLS certificate authentication part. It seems the NPS servers don't like the format of the initial RADIUS authentication request coming from the WLC and so don't respond whcih in turn casues to WLC to switch to the other NPS server which produces the same issue.
Any ideas of what might be the issue or misconfiguration?

Jim,
I wanted to know if you can setup wireshark on both of the boxes and see if your are hitting the following bug:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCti91044
It looks as if the WLC is retransmitting the client traffic from one radius session with primary over to the secondary in which the radius state attribute that was assigned from the primary server is probably hitting the secondary server. Therefore if the state attribute isnt assigned from the secondary server it will discard the packet.
May need to open a TAC case to see if this issue is on the 550x controllers also.
Thanks,
Tarik

Cisco 5508 HA

Hi all,
We recently installed a pair of Cisco 5508 controllers running 7.6.110.0. Right now I don't want to use the 'Redundancy' / 'HA' features, preferring instead to run with an Active/Standby pair controller through the HA tab configured in all APs.
As part of the upgrade to 7.6.110.0 we upgraded the secondary controller first, moved APs over one by one, then upgraded the primary. Right now I am having an issue moving the APs back to the primary. To confirm:
- the mobility group is the same on both devices
- mobility is up
- I am allowing MIC certificates
- AP fallback is enabled
- device names, etc all match as I appreciate there can be issues as this is case sensitive
As far as I was aware that was all that needed to match for this to work. One thing I have noticed however is that if I go into Redundancy -> Global Configuration both the Primary and Seconday are defined as the 'Primary' redundant unit. I've not activated, at least I thought I had not activated, this level of redundancy. Could this be what is causing it? I'm a bit wary of changing this value as I believe the controller will reboot.
Can anybody shed any light on this. The intention was to eventually enable the redundancy and SSO, etc but not right now.
Thanks

Hi Leo, Scott
So I was doing a bit more reading on this http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/69639-wlc-failover.html it is an old document but working through it the document suggested that you didn't need to specify the IP address of the Primary or Secondary controller in the Wireless -> All AP -> AP_NAME -> High Availability. I removed this from one of the APs that was at the time serving no clients and tried to move it to the secondary and it worked. I then moved it back to the primary and it worked again.
Any reason why this would happen? The IP addresses I was using were 100% correct. The only difference I see for this controller as opposed to others we manage is the introduction of new interface types i.e. 'redundancy management' , 'redundancy port' ,etc. I do not have redundancy enabled so I'm guessing not, but having trawled through the configuration this is the only difference I can see?

Cisco 5508 Firmware update 6.x 7.0.98 Questions

Hi guys,
Have not done an update on any cisco gear since about 2001
We have a cisco services contract with IBM that supplies us access to the usb drivers, firmwares etc, and we have a Cisco 5508 6.x running ~30 Cisco 1252's, some 1231's and (potentially) some 1262's once the firmware update is done.
We have a base-count license(permanent) of 50AP's, no expiry
So I guess my questions are:
1) When flashing the new firmware - do the licenses require any sort of modification, or will they work as per normal
2) Are any serial numbers or codes required to be entered once the 7.0.98 firmware is installed?
3) I assume that the old firmware/config becomes 2nd in line to the primary boot option of the firmware during boot process?
Thanks

7.0.98.0 is deferred code.
Browse to deferred release on bottom:-
http://www.cisco.com/cisco/software/release.html?mdfid=282600534&flowid=7012&softwareid=280926587&release=7.2.110.0&relind=AVAILABLE&rellifecycle=ED&reltype=latest
Deferral Notice:-
Wireless Lan Controller (WLC) software version 7.0.98.0 is being deferred due to the following issue :
CSCtj21464 - WLC data plane core crashes, causing WLC reboot
http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn7_2.html
5500 supports 7.2 code but AP 123X is not supported on 7.2, And 126x supported from 7.0.116.0 code. it is suggested to update to 7.0.235.0.

Cisco 5508 HA - Webauth Bundle for multiple SSID/multiple web pages

Hi Guys,
I have 2* cisco 5508 WLC in HA mode . Both are running IOS 7.5.102.0 . Everything is working perfectly fine.
I need to Creat 3 differnet SSID and Creat 3 different login Pages for them . Each user from respective SSID will get specified login Page. like
I have few questions :
1) I have downloaded webauth bundle from cisco Support Site and in that itself so many files are there. So based on my scenario , in which folder do i need to copy my login and logo file.
2) i have used Picozip to convert the file in .tar format but its giving me following error "
% Error: Webauth Bundle file transfer failed - No reply from the TFTP serve" but i can ping my tftp server easliy.
3) As Controllers are in HA mode , so once i am successful in uploading webauth bundle then it will be replicated on secondary controller or do i have to turn off SSO and upload in both one by one.
Please help me out in this.
Cheers

Hello Sandeep,
i have uploaded the tar which you have sent to me. When i supply my username and pwd, after that it keeps on going and not showing any end result. so it stays on same page and nothing happening after that.
Are there any more radius ACL's to be defined ? 10.10.13.x is wireless client network , 192.168.10.21 is Radius Server , 192.168.10.215 is proxy server. Is there any other ACL need to be defined ??
                       Source                         Destination                 Source Port Dest Port
Index Dir       IP Address/Netmask               IP Address/Netmask       Prot    Range       Range    DSCP Action      Counter
     1 Any      10.10.13.0/255.255.255.0     192.168.10.21/255.255.255.255 Any     0-65535     0-65535 Any Permit           0
     2 Any   192.168.10.21/255.255.255.255      10.10.13.0/255.255.255.0    Any     0-65535     0-65535 Any Permit           0
     3 Out      10.10.13.0/255.255.255.0           1.1.1.1/255.255.255.255 Any     0-65535     0-65535 Any Permit           0
     4 In         1.1.1.1/255.255.255.255      10.10.13.0/255.255.255.0    Any     0-65535     0-65535 Any Permit           0
     5 Any      10.10.13.0/255.255.255.0    192.168.10.215/255.255.255.255 Any     0-65535     0-65535 Any Permit          98
     6 Any 192.168.10.215/255.255.255.255      10.10.13.0/255.255.255.0    Any     0-65535     0-65535 Any Permit          98
DenyCounter : 12

Generating license for ISE high availability primary/secondary nodes

We have two ISE servers that will act as primary/secondary in a high availability setup.
The ISE 1.0.4 installation guide, page 93, mentions that "If you have two Cisco ISE nodes configured for high availability, then you must include both the primary and secondary Administration ISE node hardware and IDs in the license file."
However, after entering the PAK in the licensing page, the only required fields are:
- Primary Product ID
- Primary Version ID
- Primary Serial No
In this case, how can i include both primary and secondry HW and IDs?
Thanks in advance.

I am refering you a Cisco ISE Nodes for High Availability configuration guide, Please check:
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html#wp1128454

Configuring Secondary Feedback for Position Control

Hi,
I am using PXI7340 Motion Control card with RT Controller. I am using servo motor with 35:1 gear to increase the output torque. I have two encoders (One at the motor side and the other at the load side). If I want to control motor position based on the second encoder feedback then what is the procedure for that.
Now I connected Motor side encoder as Primary feedback and load side encoder as secondary feedback. But there is no option to enter gear ratio in MAX.

Venkat wrote:
Hi,
I am using PXI7340 Motion Control card with RT Controller. I am using servo motor with 35:1 gear to increase the output torque. I have two encoders (One at the motor side and the other at the load side). If I want to control motor position based on the second encoder feedback then what is the procedure for that.
Now I connected Motor side encoder as Primary feedback and load side encoder as secondary feedback. But there is no option to enter gear ratio in MAX.
Hello Venkat,
Thank you for contacting National Instruments. It is advised to use secondary feedback in situations like yours to overcome backlash due to gearing. Backlash is the delay there can be in the motion from the motor to transfer over to the load. If the encoder connected to the load is used to close the velocity loop it can lead to a delayed response in terms of correcting the velocity. Secondary feedback is used to compensate for the backlash and is used to complete the velocity loop. Secondary feedback comes from the encoder connected to the motor. Primary feedback in this case is used to correct position errors and needs to come from an encoder connected to the load.
When using secondary feedback the Kd term of the PID is set to 0 and the Kv term is used instead. You will not need to set the gearing ratio or the encoder counts per revolution for the secondary feedback since the velocity loop is only interested in the difference in steps. More information about this procedure can be found in the NI-Motion User Manual installed on your machine with the NI-Motion drivers. You can find it under Start>>Programs>>National Instruments>>NI-Motion>>Documentation>>NI-Motion User Manual or "C:\Program Files\National Instruments\Motion\Documentation\NI-Motion User Manual.pdf". Dual Loop Feedback on page 4-30 goes into more details about this procedure. Hope this helps your out. Have a nice day!
Regards,
Nipun M.
Applications Engineer
National Instruments

How can I set up 3 different VLANs on Cisco 5508

Dear Community Members,
I have a need to setup three (3) VLANs with different SSID's for students , staff and visitors in a College.
The controller is Cisco 5508 with Cisco 3502E-E-K9 AP
presently the wireless network is flat with just one VLAN
NB.
Staff would log in using active directory user name and password.
Student would log in using username and Registration number Possibly using RADIUS SERVER
How best can i achieve this.

Scenes you are using single vlan so the point of have multiple SSID is useless and the better approach will be using the AD for both authentication and managing the Group policy for both. In this way you can manage both students and Staff Kindly see the following link for step by step config and understand Group policy
Server 2008/2012
http://jackstromberg.com/2013/05/tutorial-802-1x-authentication-via-wifi-active-directory-network-policy-server-cisco-wlan-group-policy/
cisco document server 2003 (another explaining in detail the flow)
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080921f67.shtml

Redirect to web authentication not working on Cisco 5508 Wireless Controller

Hi,
I have a wlan with web authentication:
http://i55.tinypic.com/w145zk.png
and
http://i51.tinypic.com/344sfm0.png
When I connect to the SSID (I get correct IP from the Cisco 5508 Controller) and try to surf, I do not get redirected to the web authentication page (https://1.1.1.1/login.html), when I manually insert the URL I get "cannot display the webpage". Any idea?
The virtual interface is 1.1.1.1.
Here is a screenshot of interface and internal dhcp:
http://i52.tinypic.com/2vkm1d2.png
Any idea why clients are not redirecting?
Thanks!

Thanks for the reply dmantil!
When I changed the Virtual DNS name to 1.1.1.1 (the same as the IP) I get redirected if I use http://198.133.219.25, but not with http://cisco.com, I get redirected only if I use IP.
I forgot to mention that the controller is in a lab with no access to DNS server. Does the controller check if the domain is valid before redirecting users? I cant find any documentation on how the controller redirect users.

OPS에서 PRIMARY/SECONDARY INSTANCE 개념 및 구성

제품 : ORACLE SERVER
작성날짜 : 2004-08-13
OPS에서 PRIMARY/SECONDARY INSTANCE 개념 및 구성
========================================
PURPOSE
OPS를 이용하는 고객 중에는 OPS를 primary와 secondary 형태로 사용하는 경우가
종종 있다. 즉 OPS 2 node로 구성하여 평상 시에는 한쪽 node만을 사용하다가,
사용하던 node나 instance에 fail이 발생하면 문제가 없는 다른 node의 instance를
이용하는 것이다.
이러한 경우의 고객의 입장에서는 평소 한쪽 instance만을 사용하기 때문에,
다른 쪽 instance에는 memory 등의 접근이 전혀 없을 것으로 생각한다. 그러나
실제 OPS에서 각 resource의 master node는 hash 형태로 고정된 것으로 node 별로
균등하게 나누어진다. 그러므로 data block 절반은 사용하지 않은 다른 node가
master node가 되어 해당 block buffer의 lock 정보 등을 위해 master 정보를
확인할 때 backup 형태로 standby하고 있는 다른 node를 계속해서 접근하게 된다.
이러한 문제점을 보완하기 위해서 Oracle 8.1.6부터는 Primary/Secondary 형태로
OPS를 구성하여 primary node에 모든 resource의 master 정보를 유지하는 것이
가능하도록 하였다.
SCOPE
Oracle Parallel Server(OPS) Option은 8~9i Standard Edition에서는
지원하지 않는다.
Explanation
Primary/Secondary 구성은 기본적으로 각 node의 initSID.ora file에
active_transaction_count=1을 지정함으로써 이루어진다.
이렇게 지정한 상태에서 먼저 start시키는 instance가 primary가 되는 것이다.
primary instance가 fail이 되면 secondary instnace가 다시 primary가 된다.
client의 접속은 listener를 통해 primary instance로 접속되어진다.
MTS와 dedicated mode 둘 다 구성 가능하며, dedicated인 경우는 dynamic
registration 형태로 구성되어야 한다.
이 예에서는 mts의 경우는 특별히 주의할 점이 없기 때문에 dynamic registration
형태로 구성된 dedicated mode에서 test하였다.
client에서는 primary instance fail 후 secondary instance 접속 시에도, primary
접속 시 이용한 동일한 tnsnames.ora 내의 service 명을 이용하면 된다.
단, 이와 같이 active_instance_count가 1로 설정된 상태에서는, session의 끊김없이
다른 instance로 fail-over되는 TAF(Transparent Failover)가 현재 test 결과 불가능
하였다.
TAF 구성이 반드시 필요한 환경에서는 OPS의 한 node를 backup 용으로 사용하고자
할 때에도 active_instance_count 지정없이 사용하도록 권한다.
이러한 구성에서 secondary node의 경우 standby db처럼 단지 backup 용으로
대기만 하고 있어야 하는 것은 아니고 직접 server에서 접속하여 batch 성
transaction같은 것을 수행하여도 문제가 없다. 단 telnet 등을 이용해 server로
직접 login 후 instance로 접속하여야 한다.
Example
이 test는 Oracle 8.1.7.4/Sun solaris 2.8에서 test되었다.
(1) initSID.ora
- A node의 initSID.ora
active_instance_count = 1
service_names=INS1, DB1
local_listener="(address=(protocol=TCP)(host=krtest1)(port=1521))"
- B node의 initSID.ora
active_instance_count = 1
service_names=INS2, DB1
local_listener="(address=(protocol=TCP)(host=krtest2)(port=1521))"
service_names는 여러 개를 지정 가능한데, 중요한 것은 두 node가 공통으로
사용할 service name 한 가지는 반드시 지정하여야 한다.
일반적으로 db_name을 지정하면 된다.
host= 부분은 hostname이나 ip address를 지정하면 된다.
(2) listener.ora
LISTENER =
(DESCRIPTION =
(ADDRESS =
(PROTOCOL = tcp)
(HOST = krtest1)(PORT= 1521)))
B node에서는 krtest1 대신 b node의 hostname 혹은 ip address를 지정하면
된다.
MTS라면 뒤에 sid_list_listener를 적으셔도 상관없는데, dedicate인 경우는
반드시 이와 같이 sid_list_listener없이 지정하여 dynamic registration이
되도록 해야 한다.
(3) tnsnames.ora
ops =
(description =
(load_balance=off)
(address=(protocol=tcp)(host=krtest1) (port=1521))
(address=(protocol=tcp)(host=krtest2) (port=1521))
(connect_data = (service_name = DB1)))
ops라는 service 명은 임의의 이름으로 지정하여 사용하면 된다.
primary instance가 fail이 되면 같은 ops라는 service 명을 이용하여 다시
접속을 시도하면 이번에는 secondary instance가 primary로 변경되어
접속이 이루어진다.
Reference Documents
none

Cisco 5508 Memory Usage

What is the average memory usage for a Cisco 5508 with 500 APs (mostly 3502s) running 7.0.116.0 code? I am currently at 450 access points and have 80% memory usage should I be concerned?

Tom,
I just had a 5508 in production hit 89% memory usage and crash… I have opened a TAC case and I will update once more information is available. The controller rebooted and came right back online at 56% memory usage; I suggest rebooting it during downtime.
Bill

Cisco 5508 and Ipads

We have cisco 5508.
We had problems with the connection of the first and second iPad version. Firmware: 7.0.235.3. Putting firmware 7.x. we can not because we have a point of 1310. But we put the firmware 7.2 ipad still have not get wireless. Then we rolled back. It is interesting that not only work the first and second iPads. All the above works. Played with TKIP instead of AES, did not help ...
P.s. iphone works.

(Cisco Controller) >show wlan 45
WLAN Identifier.................................. 45
Profile Name..................................... Test
Network Name (SSID).............................. Test
Status........................................... Disabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Number of Active Clients......................... 0
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 6400 seconds
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ guestwifi
Multicast Interface.............................. Not Configured
--More-- or (q)uit
WLAN ACL......................................... unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Quality of Service............................... Silver (best effort)
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
IPv6 Support..................................... Disabled
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... 802.11g only
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
   Authentication................................ Global Servers
--More-- or (q)uit
   Accounting.................................... Global Servers
   Dynamic Interface............................. Disabled
Local EAP Authentication......................... Disabled
Security
   802.11 Authentication:........................ Open System
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Disabled
   CKIP ......................................... Disabled
   Web Based Authentication...................... Disabled
   Web-Passthrough............................... Disabled
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   H-REAP Local Switching........................ Disabled
   H-REAP Local Authentication................... Disabled
   H-REAP Learn IP Address....................... Enabled
   Client MFP.................................... Optional but inactive (WPA2 not configured)
   Tkip MIC Countermeasure Hold-down Timer....... 60
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
--More-- or (q)uit
SIP CAC Fail Send Dis-Association Policy......... Disabled
Band Select...................................... Disabled
Load Balancing................................... Disabled
Mobility Anchor List
WLAN ID     IP Address            Status

Cisco 5508 interface design problem

Cisco 5508 interface design
now i have connect wlc into infra same picture but ap can't register into wlc. How create interface for this diagram. please help me because access switch is unmanage switch i can't config trunk on this.i can install for this solution this isn't ?
thank you for best support.
samy

Why are your AP's on different Vlans?
If you plan to create SSID's on different Vlans then you will need a trunk port to the WLC as the switch needs to pass tagged frames to it and the WLC needs to pass tagged frames back.
Out of interest, you are using a 5508 which is a fairly expensive piece of kit yet you are connecting it to an unmanaged switch. Why?

Cisco 5508 HA VS Primary/Secondary- Feedback

Similar Messages

Maybe you are looking for