Cisco 5508 HA
Hi all,
We recently installed a pair of Cisco 5508 controllers running 7.6.110.0. Right now I don't want to use the 'Redundancy' / 'HA' features, preferring instead to run with an Active/Standby pair controller through the HA tab configured in all APs.
As part of the upgrade to 7.6.110.0 we upgraded the secondary controller first, moved APs over one by one, then upgraded the primary. Right now I am having an issue moving the APs back to the primary. To confirm:
- the mobility group is the same on both devices
- mobility is up
- I am allowing MIC certificates
- AP fallback is enabled
- device names, etc all match as I appreciate there can be issues as this is case sensitive
As far as I was aware that was all that needed to match for this to work. One thing I have noticed however is that if I go into Redundancy -> Global Configuration both the Primary and Seconday are defined as the 'Primary' redundant unit. I've not activated, at least I thought I had not activated, this level of redundancy. Could this be what is causing it? I'm a bit wary of changing this value as I believe the controller will reboot.
Can anybody shed any light on this. The intention was to eventually enable the redundancy and SSO, etc but not right now.
Thanks
Hi Leo, Scott
So I was doing a bit more reading on this http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/69639-wlc-failover.html it is an old document but working through it the document suggested that you didn't need to specify the IP address of the Primary or Secondary controller in the Wireless -> All AP -> AP_NAME -> High Availability. I removed this from one of the APs that was at the time serving no clients and tried to move it to the secondary and it worked. I then moved it back to the primary and it worked again.
Any reason why this would happen? The IP addresses I was using were 100% correct. The only difference I see for this controller as opposed to others we manage is the introduction of new interface types i.e. 'redundancy management' , 'redundancy port' ,etc. I do not have redundancy enabled so I'm guessing not, but having trawled through the configuration this is the only difference I can see?
Similar Messages
-
How can I set up 3 different VLANs on Cisco 5508
Dear Community Members,
I have a need to setup three (3) VLANs with different SSID's for students , staff and visitors in a College.
The controller is Cisco 5508 with Cisco 3502E-E-K9 AP
presently the wireless network is flat with just one VLAN
NB.
Staff would log in using active directory user name and password.
Student would log in using username and Registration number Possibly using RADIUS SERVER
How best can i achieve this.Scenes you are using single vlan so the point of have multiple SSID is useless and the better approach will be using the AD for both authentication and managing the Group policy for both. In this way you can manage both students and Staff Kindly see the following link for step by step config and understand Group policy
Server 2008/2012
http://jackstromberg.com/2013/05/tutorial-802-1x-authentication-via-wifi-active-directory-network-policy-server-cisco-wlan-group-policy/
cisco document server 2003 (another explaining in detail the flow)
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080921f67.shtml -
Redirect to web authentication not working on Cisco 5508 Wireless Controller
Hi,
I have a wlan with web authentication:
http://i55.tinypic.com/w145zk.png
and
http://i51.tinypic.com/344sfm0.png
When I connect to the SSID (I get correct IP from the Cisco 5508 Controller) and try to surf, I do not get redirected to the web authentication page (https://1.1.1.1/login.html), when I manually insert the URL I get "cannot display the webpage". Any idea?
The virtual interface is 1.1.1.1.
Here is a screenshot of interface and internal dhcp:
http://i52.tinypic.com/2vkm1d2.png
Any idea why clients are not redirecting?
Thanks!Thanks for the reply dmantil!
When I changed the Virtual DNS name to 1.1.1.1 (the same as the IP) I get redirected if I use http://198.133.219.25, but not with http://cisco.com, I get redirected only if I use IP.
I forgot to mention that the controller is in a lab with no access to DNS server. Does the controller check if the domain is valid before redirecting users? I cant find any documentation on how the controller redirect users. -
Cisco 5508 external web authentication
Hi all,
Firstly, I do apologise as this question has been posted in another forum, I believe it is the wrong one though hence me posting here.
I am running with a pair of Cisco 5508 controllers with 7.4.121.0 installed. We offer a guest Internet service to our user base and guests. To access the guest service a user must first authenticate via an externally hosted server, I won't go into the specifics but it is a secure service will a valid, signed cert for the login page. The issue I am hitting is that when a user logs into the portal the controller cert is then displayed (2.2.2.2) which returns a cert error. It kind of makes the service look insecure when it isn't. I've read numerous articles about creating CSRs, etc and loading certificates on the controller, but the issue we have is that we use externally hosted DNS servers for the service and they are refusing to create a DNS record. We can't use internally hosted DNS servers as this breaks our security policy. Is there any other way around this or do I just have to have the user accept the cert error?
ThanksI hear you and I was under the same impression. If I go through the steps I followed maybe it can be explained..
Upgraded the primary controller from 6.0.x to 7.0.x a, APs upgraded. Upgraded FUS to 1.9. Upgraded controller to 7.4.121.0, upgraded APs. APs joined the controller. Disabled WebAuth Secure Web. Followed same steps for secondary controller. Shutdown primary controller to test failover to secondary. APs did not failover. Waited 15 mins, debugged CAPWAP and saw nothing coming in. Brought primary back online, waited 15 mins, debugged CAPWAP and saw nothing coming in. Waited a further 15 mins. Still no APs joining. Enabled WebAuth Secure on the primary, and boom, all the APs joined the primary. Not sure if this was just a coincidence, but this was the behaviour I witnessed. I'm running a pair of 5508's.
I've not witnessed this before, but this is the first time I've disabled this setting. Understand it has nothing to do with APs joining and may just be a coincidence, but this is what I experienced. I ran out of time during the change window so couldn't test this further and try to simulate again, will try again when the next window becomes available. -
Cisco 5508-WLC using MS NPS as RADIUS Server for EAP-TLS
Has anyone experienced a problem getting a Cisco WLC to work with MS NPS server? We've done it before albeit with differnt code versions.
I have a Cisco 5508 WLC running 7.0.116.0 code hosting a WLAN configured for WPA2 with 802.1x for authentication. I have two Windows NPS servers configured as the RADIUS servers for EAP-TLS authentication. Via debug info on the WLC I can see the 802.1x handshake take place with the wireless client and the WLC as well as a successful transmission of an Authentication Packet from the WLC to one of the RADIUS servers. However on the WLC I see repeated RADIUS server x.x.x.x:1812 deactivated in global list and on the NPS server I'm seeing event log errors indicating "The Network Policy Server discarded the request for a user" along with the pertinent auth request info that I would expect the NPS server to receive from the WLC.
Based on the WLC debug info I'm never actually getting to the EAP-TLS certificate authentication part. It seems the NPS servers don't like the format of the initial RADIUS authentication request coming from the WLC and so don't respond whcih in turn casues to WLC to switch to the other NPS server which produces the same issue.
Any ideas of what might be the issue or misconfiguration?Jim,
I wanted to know if you can setup wireshark on both of the boxes and see if your are hitting the following bug:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCti91044
It looks as if the WLC is retransmitting the client traffic from one radius session with primary over to the secondary in which the radius state attribute that was assigned from the primary server is probably hitting the secondary server. Therefore if the state attribute isnt assigned from the secondary server it will discard the packet.
May need to open a TAC case to see if this issue is on the 550x controllers also.
Thanks,
Tarik -
Cisco 5508 Firmware update 6.x 7.0.98 Questions
Hi guys,
Have not done an update on any cisco gear since about 2001
We have a cisco services contract with IBM that supplies us access to the usb drivers, firmwares etc, and we have a Cisco 5508 6.x running ~30 Cisco 1252's, some 1231's and (potentially) some 1262's once the firmware update is done.
We have a base-count license(permanent) of 50AP's, no expiry
So I guess my questions are:
1) When flashing the new firmware - do the licenses require any sort of modification, or will they work as per normal
2) Are any serial numbers or codes required to be entered once the 7.0.98 firmware is installed?
3) I assume that the old firmware/config becomes 2nd in line to the primary boot option of the firmware during boot process?
Thanks7.0.98.0 is deferred code.
Browse to deferred release on bottom:-
http://www.cisco.com/cisco/software/release.html?mdfid=282600534&flowid=7012&softwareid=280926587&release=7.2.110.0&relind=AVAILABLE&rellifecycle=ED&reltype=latest
Deferral Notice:-
Wireless Lan Controller (WLC) software version 7.0.98.0 is being deferred due to the following issue :
CSCtj21464 - WLC data plane core crashes, causing WLC reboot
http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn7_2.html
5500 supports 7.2 code but AP 123X is not supported on 7.2, And 126x supported from 7.0.116.0 code. it is suggested to update to 7.0.235.0. -
Cisco 5508 HA - Webauth Bundle for multiple SSID/multiple web pages
Hi Guys,
I have 2* cisco 5508 WLC in HA mode . Both are running IOS 7.5.102.0 . Everything is working perfectly fine.
I need to Creat 3 differnet SSID and Creat 3 different login Pages for them . Each user from respective SSID will get specified login Page. like
I have few questions :
1) I have downloaded webauth bundle from cisco Support Site and in that itself so many files are there. So based on my scenario , in which folder do i need to copy my login and logo file.
2) i have used Picozip to convert the file in .tar format but its giving me following error "
% Error: Webauth Bundle file transfer failed - No reply from the TFTP serve" but i can ping my tftp server easliy.
3) As Controllers are in HA mode , so once i am successful in uploading webauth bundle then it will be replicated on secondary controller or do i have to turn off SSO and upload in both one by one.
Please help me out in this.
CheersHello Sandeep,
i have uploaded the tar which you have sent to me. When i supply my username and pwd, after that it keeps on going and not showing any end result. so it stays on same page and nothing happening after that.
Are there any more radius ACL's to be defined ? 10.10.13.x is wireless client network , 192.168.10.21 is Radius Server , 192.168.10.215 is proxy server. Is there any other ACL need to be defined ??
Source Destination Source Port Dest Port
Index Dir IP Address/Netmask IP Address/Netmask Prot Range Range DSCP Action Counter
1 Any 10.10.13.0/255.255.255.0 192.168.10.21/255.255.255.255 Any 0-65535 0-65535 Any Permit 0
2 Any 192.168.10.21/255.255.255.255 10.10.13.0/255.255.255.0 Any 0-65535 0-65535 Any Permit 0
3 Out 10.10.13.0/255.255.255.0 1.1.1.1/255.255.255.255 Any 0-65535 0-65535 Any Permit 0
4 In 1.1.1.1/255.255.255.255 10.10.13.0/255.255.255.0 Any 0-65535 0-65535 Any Permit 0
5 Any 10.10.13.0/255.255.255.0 192.168.10.215/255.255.255.255 Any 0-65535 0-65535 Any Permit 98
6 Any 192.168.10.215/255.255.255.255 10.10.13.0/255.255.255.0 Any 0-65535 0-65535 Any Permit 98
DenyCounter : 12 -
What is the average memory usage for a Cisco 5508 with 500 APs (mostly 3502s) running 7.0.116.0 code? I am currently at 450 access points and have 80% memory usage should I be concerned?
Tom,
I just had a 5508 in production hit 89% memory usage and crash… I have opened a TAC case and I will update once more information is available. The controller rebooted and came right back online at 56% memory usage; I suggest rebooting it during downtime.
Bill -
We have cisco 5508.
We had problems with the connection of the first and second iPad version. Firmware: 7.0.235.3. Putting firmware 7.x. we can not because we have a point of 1310. But we put the firmware 7.2 ipad still have not get wireless. Then we rolled back. It is interesting that not only work the first and second iPads. All the above works. Played with TKIP instead of AES, did not help ...
P.s. iphone works.(Cisco Controller) >show wlan 45
WLAN Identifier.................................. 45
Profile Name..................................... Test
Network Name (SSID).............................. Test
Status........................................... Disabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Number of Active Clients......................... 0
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 6400 seconds
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ guestwifi
Multicast Interface.............................. Not Configured
--More-- or (q)uit
WLAN ACL......................................... unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Quality of Service............................... Silver (best effort)
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
IPv6 Support..................................... Disabled
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... 802.11g only
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
Authentication................................ Global Servers
--More-- or (q)uit
Accounting.................................... Global Servers
Dynamic Interface............................. Disabled
Local EAP Authentication......................... Disabled
Security
802.11 Authentication:........................ Open System
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2)............. Disabled
CKIP ......................................... Disabled
Web Based Authentication...................... Disabled
Web-Passthrough............................... Disabled
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled
Auto Anchor................................... Disabled
H-REAP Local Switching........................ Disabled
H-REAP Local Authentication................... Disabled
H-REAP Learn IP Address....................... Enabled
Client MFP.................................... Optional but inactive (WPA2 not configured)
Tkip MIC Countermeasure Hold-down Timer....... 60
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
--More-- or (q)uit
SIP CAC Fail Send Dis-Association Policy......... Disabled
Band Select...................................... Disabled
Load Balancing................................... Disabled
Mobility Anchor List
WLAN ID IP Address Status -
Cisco 5508 interface design problem
Cisco 5508 interface design
now i have connect wlc into infra same picture but ap can't register into wlc. How create interface for this diagram. please help me because access switch is unmanage switch i can't config trunk on this.i can install for this solution this isn't ?
thank you for best support.
samyWhy are your AP's on different Vlans?
If you plan to create SSID's on different Vlans then you will need a trunk port to the WLC as the switch needs to pass tagged frames to it and the WLC needs to pass tagged frames back.
Out of interest, you are using a 5508 which is a fairly expensive piece of kit yet you are connecting it to an unmanaged switch. Why? -
I have 2 Cisco 5508 Wireless LAN Controllers.
They are NOT connected to a WCS.
Is there a way to confiure the 5508's to send email notifications when an AP drops off line?
Is not is this functionality available with either a WCS or new NCS?Hi,
You can't send SMTP alerts directly from the controllers.
The options you have are
to configure a Syslog server under the Management tab of the controller to enable logging of alarms to the Syslog server. When the alarm arrives at the syslog server, there needs to be an event configured to email the particular alarm to SMTP recipients
Install WCS at version 7.x providing support for the 5508 controllers and 350x WAPs. Via WCS, with the controllers and WAPs managed by the application, the alarms will be emailed to the configured SMTP recipients
Hope this is of help
Regards
David -
Cisco 5508 Hreap - slow wireless throughput
I have a Cisco 5508 setup at a host site with 3 other sites connected using hreap on 1252APs. When doing testing of network speed I find that the throughput from the wireless to wired network is at about 18mbps yet the same test on wired side is 85-100mbps and wireless to wireless is 18mbps
Any ideas what could cause thisHm, just guessing is hard. So ...
Can you upload the configuration?
Which standard do you use? .11n? Encryption method?
Where you the only one on ap while taking the tests?
Have you tried some tests at various daytimes?
Any chances to check for interference or change channels?
Sebastian
Sent from Cisco Technical Support iPad App -
I have Cisco 5508 controller in our high school. I changed the password for one of our WLANs yesterday.(WLANs>WLANs>WLAN in question (in my case OBSD-Internal)>Security>Layer 2. For some reason it reverted back to the previous password ( this was confirmed by a client attempting to connect). What could possibly cause this?
Hi Sean,
May be you did not saved the config on WLC(After changing the password).
Regards -
Creating new Bridge Group names in Cisco 5508 WLC??
How do we Create new Bridge Group names on Cisco 5508 WLC, with 1552E Access Point??
You create it on the 1552 once the AP joins. One it joins, you will have to choose that AP and then set the AP mode to Bridge and then apply. This will reboot the AP. Once the AP comes back, you will have a MESH tab on that specific AP or any AP that you have set to Bridge mode. You then set the AP role and the bridge group name there. Here is an older MESH deployment guide to follow.
http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-0/configuration/guide/c70/c70mesh.html
Scott -
Cisco 5508 Controller 5GHz band selection
hi,
today i installed one Cisco 5508 Controller with 1262 APs only with 5GHz antennas. all radios are came up excpet 5ghz band, i tried all my level of best to get it UP. can anybody tell me if there is anything we need to really inspect to enable 5 GHz band.
Anvarhi Nocolas,
please find below answers, and attached snapshot
1) what is your AP exact model ? -A ? -E ?
Ans:- AP Model No - AIR-LAP1262N-A-K9
2) What country did you configure your WLC for ?
Ans:- Saudi Arabia
3) did you enable 802.11a network on the "wireless" tab ?
Ans:- Yes
4) if you go to the AP radio list on the WLC, what does it say for your AP ? up ? down ?
Ans:- 802.11a/n Radios DOWN
802.11 b/g/n Radios UP
Thanks,
Anvar
Maybe you are looking for
-
Summary fields in the JSP report
I created a JSP report using Oracle 9i Reports Developer using report wizard. It has a %Total field on one of the columns. It is running good for the first time. But when I am closing and reopening the report the Summary column is showing a null valu
-
I actually cannot open any applications now. Does this computer need to be reset?
-
Certain PDF documents not spotlight-indexed nor copy/paste to TextEdit
Hello, I've got a problem with certain PDF documents and Preview.app. I can read them perfectly by eye (I understand there's an overlying image?) but the text characters, when copied and pasted into TextEdit, are little rectangles with a tiny alien f
-
11g - is it possible to deploy multiple repositories?
One of our clients was under the impression that deploying multiple RPDs in 11g would be simpler than it was in 10g, where we needed to deploy multiple copies of the BI Presentation Server and point each one to its own repository. A quick RTFM of all
-
Iweb/ pages won't update to add new pics+info.
Does anyone know why iweb will only update pages when it feels like it? I have tried clearing the cache, updating one page at a time, deleting pages... but it does't seem to work!