Cisco AP 700w as a Work Group Bridge with a WLAN Controller

I am trying to setup an AP 700w as a Work Group Bridge as it would be interesting to have this running, because it has the built-in 4 port switch.
I have WiSM based WLCs running the version 7.0.240.0. I converted a 700w to an autonomous AP and on the AP I installed the IOS Version 15.3(3)JA1.
When I use an autonmous based AP to connect the 700w as a WGB everything works fine. I can connect clients through the 4 port switch.
If I try to use a Controller based WLAN environment it does not work. The config is simple:
ap#sh run
Building configuration...
Current configuration : 1805 bytes
! Last configuration change at 18:37:11 UTC Thu Mar 5 2015
version 15.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname ap
logging rate-limit console 9
enable secret 5 $1$b5Da$QTI6Geq7ARZud34ZqA45.0
no aaa new-model
led display off
no ip source-route
no ip cef
dot11 syslog
dot11 ssid LAGERWPA
   authentication open
   authentication key-management wpa
   wpa-psk ascii 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
username CISCO password 7 14341B180F0B
bridge irb
interface Dot11Radio0
no ip address
encryption mode ciphers aes-ccm tkip
ssid LAGERWPA
antenna gain 0
packet retries 64 drop-packet
station-role workgroup-bridge
bridge-group 1
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
shutdown
antenna gain 0
peakdetect
no dfs band block
packet retries 64 drop-packet
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface GigabitEthernet0
no ip address
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
interface BVI1
mac-address 18e7.2801.9610
ip address dhcp client-id GigabitEthernet0
ipv6 address dhcp
ipv6 address autoconfig
ipv6 enable
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
lan-port port-id 1
no shutdown
lan-port port-id 2
shutdown
lan-port port-id 3
shutdown
lan-port port-id 4
shutdown
bridge 1 route ip
line con 0
line vty 0 4
login local
transport input all
end
The association is OK, it is seen as a WGB, I can reach resources on our network from the AP, ping works, I can use a telnet from client to access the AP 700w etc.:

20... Here is an old post for reference.
https://supportforums.cisco.com/thread/2119996
Sent from Cisco Technical Support iPhone App

Similar Messages

Work group bridge with cisco 3500

Hi,
We have few cisco 3500 ap's which is to be used as work group bridge. I am not very sure but i think we need the ap to be in autonomous mode to make it a work group bridge. Currently it is running lwapp/capwap image.
Is this correct, please help with suggestions.

sh ip int brie
Interface                  IP-Address      OK? Method Status                Prot
ocol
BVI1                       10.82.6.247     YES DHCP   up                    up
Dot11Radio0                unassigned      NO unset up                    up
Dot11Radio1                unassigned      NO unset up                    up
GigabitEthernet0           192.168.1.2     YES manual up                    up
AP-OF#sh ver
Cisco IOS Software, C3500 Software (AP3G1-K9W8-M), Version 12.4(23c)JA7, RELEASE
SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Tue 29-Jan-13 05:19 by prod_rel_team
ROM: Bootstrap program is C3500 boot loader
BOOTLDR: C3500 Boot Loader (AP3G1-BOOT-M), Version 12.4 [mpleso-ap_jmr3_esc_0514
116]
AP_OF uptime is 3 minutes
System returned to ROM by power-on
System image file is "flash:/ap3g1-k9w8-mx.124-23c.JA7/ap3g1-k9w8-xx.124-23c.JA7
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
[email protected].
cisco AIR-CAP3502E-S-K9    (PowerPC460exr) processor (revision B0) with 81910K/4
9152K bytes of memory.
Processor board ID FGL1721S5G0
PowerPC460exr CPU at 666Mhz, revision number 0x18A8
Last reset from power-on
LWAPP image version 7.0.240.0
1 Gigabit Ethernet interface
2 802.11 Radio(s)
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: BC:16:65:77:D9:93
Part Number                          : 73-12175-06
PCA Assembly Number                  : 800-32268-06
PCA Revision Number                  : B0
PCB Serial Number                    : FOC171622Y6
Top Assembly Part Number             : 800-32904-02
Top Assembly Serial Number           : FGL1721S5G0
Top Revision Number                  : A0
Product/Model Number                 : AIR-CAP3502E-S-K9
Configuration register is 0xF
sh run | i def
aaa authentication login default local
ip default-gateway 192.168.1.55

I can't get Dr Browns Image Processor Pro to work from Bridge with Photoshop CC 2014

We use the wonderful DR Browns Image Processor Pro script a lot, but cannot get it to work from Bridge with PS CC 2014. When I select files in Bridge CC and then go to Tools> Dr Browns Services 2.3.1 > Image Processor Pro it just pops up an error message that says ReferenceError: photoshop is undefined.
The actual script works fine if I launch it from Photoshop CC 2014 - just not if I load it from Bridge CC.
I have unistalled it and re installed a few times, both manually and through the Extension Manager CC.
I am using a Win 7 64bit computer.
I assume there is some change in the scripting part that loads Photoshop from bridge but not sure. It worked fine in CC. Just not CC 2014.
I opened the Dr Browns Services .jsx file but don't see anything obvious. This is the section related to the Image Processor Pro part:
// This routine takes an array of files. If called by Photoshop,
// it will invoke Dr. Brown's Process 1-2-3 with the files. If called by
// any other app, it will send a BridgeTalk message to Photoshop
// to invoke this routine with the same arguments.
drbrownserv.process123 = function (files) {
// Bring Photoshop to the foreground.
BridgeTalk.bringToFront ("photoshop");
// Create a new BridgeTalk message for Photoshop to invoke
// Image Processor with the selected files
var btMessage = new BridgeTalk;
btMessage.target = "photoshop";
btMessage.body = "drbrownserv.process123 (" + files.toSource () + ");";
btMessage.send ();
} else {
photoshop.runActionCommand ('611736f0-9c46-11e0-aa82-0800200c9a66', files);
catch (error) {
if (error.number != 8007) // Don't report user cancelled errors.
drbrownserv.alert (error);

I copied that .jsx file to a new name "Xbytor Image Processor Pro.jsx" edit that file changed the string Dr Browns services to "Xbytor Image Processor Pro" then commented out all the code that added tools menu items but "Image Processor Pro" and I put that file into
"C:\Program Files (x86)\Common Files\Adobe\Startup Scripts CC\Adobe Bridge" even though Bridge CC is 64Bit seems to use theat location.
Bridge CC was updated by the creative clouds update and opens Photoshop CC 2014 now

How to restrict users working on Windows 7 clients from accessing Windows Explorer and other systems in the network through Group Policy with a domain controller running on Windows Server 2008 r2

Dear All,
We are having an infrastructure setup of around 500 client computers managed through group policy.
Recently the domain controllers have been migrated from Windows Server 2003 to Server 2008 R2.
Since this account requires extremely strict environment, we need to figure the solution for restricting the users from access anything locally.
It would be great if you can assist me with the following query.
How to restrict users logged on Windows 7 clients from accessing Windows Explorer and browsing other systems in the network through Group Policy with a domain controller running on Windows Server 2008 r2 ?
Can we disable Network Tab on the left hand pane ?
explorer.exe is blocked already, but users are able to enter the Windows Explorer by clicking on the name which is visible on the Start Menu.

>   * explorer.exe is blocked already, but users are able to enter the
>    Windows Explorer by clicking on the name which is visible on the
>    Start Menu.
You cannot block explorer.exe when you do not replace the shell - the
desktop you see effectively IS explorer.exe...
Your requirement sounds like you need a custom shell:
http://gpsearch.azurewebsites.net/#2812
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Work Group Bridge - Which Mode to Use?

We have some rolling carts used for telemedicine and are currently using Linksys WET610N wireless bridges. I haven't been very impressed with them - I have to reboot them at least once a week and figure it's a roaming issue. Since they are a residential product they probably weren't designed to do a lot of roaming.
I started playing around with WGB and setup an 1142 AP and got it to work. Unfortunately, the only place I can put the AP is inside the cart and the metal top seems to be interfering with the wireless signal.
Which Cisco indoor APs have external antennae mounts and are capable of performing as a WGB?
Our infrastructure is 4400 controllers and 1142 APs.
Thanks.

Look at the 1242's to use as WGB.
Sent from Cisco Technical Support iPhone App

Work Group Bridge

I have a cisco AIR-CAP3602E-EK9 and I want to configure it as WGB, I am trying to run dot11 ssid command to conifgure SSID but its not working. Can anybody tell me the command reference to configure AIR-CAP3602E-EK9 as WGB?

Do you have autonomous image on your 3602 ? If not you have to convert Lightweigh image to Autonomous using one of the below methods before configuring it as WGB.
http://mrncciew.com/2012/10/20/lightweight-to-autonomous-conversion/
http://mrncciew.com/2013/12/13/ap-conversion-using-mode-button/
Then you can configure WGB like below.
http://mrncciew.com/2013/07/02/wgb-config-example/
HTH
Rasika
**** Pls rate all useful responses ****

Problem with work group bridge authentication with ACS 5.x

EAP-TLS authentication for workgoup brdige fails.
Folloing is the log on ACS
Authentication failed 12514 EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain
12811 Extracted TLS Certificate message containing client certificate.
12814 Prepared TLS Alert message.12817 TLS handshake failed.
12514 EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain
12507 EAP-TLS authentication failed12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
11504 Prepared EAP-Failure11003 Returned RADIUS Access-Reject

I have seen this issue before, the AP is present an old PAC and doesnt update until after you reboot. You can open a wireless TAC case and they will get you the right image as to when this was fixed. As a workaround you can extend the lifetime of the PAC in your authentication settings for EAP-FAST.
Thanks,
Sent from Cisco Technical Support iPad App

How many clients on etehrnet lan when config as work-group bridge?

I am considering configuring a 1242ag as either a WGB / non-root bridge, I have read that a WGB can have only 8 clients on its ethernet lan side, and does not associate with wireless clients other then the root-bridge/AP. Can someone confirm this for me?

WGB acts only in Non-Root Bridge w/o clients mode.It is right that Workgroup bridge can accosiate to either Root AP or Root Bridge.

Convert to DNG doesn't work in Bridge with 5D mark III

I'm using CS6 and the 'Convert to DNG" option doesn't work when I download my Canon 5D Mark III files, but it works with my 5D Mark II files. HOW can I get this to work. I've had to convert using the DNG converter.

Update ACR to 8.7.1 and you won't have to convert to DNG at all. the 8.7.1 DNG converter also supports the Mark 3.

Bridging with AP1030 and Controller

Hi
I have a test enviroment with 2 ap1030 and i want to make a 5ghz bridge link with these two aps. this should be possilbe. but im not able to get it worked. i also didnt found a good documenation for this configuration.
do i need to make both aps in BRIDGE mode?
in the debugging i always get: LWAPP Join-Request AUTH_STRING_PAYLOAD, invalid BRIDGE key hash AP 00:0b:85:71:cd:a0
when i connect the "BRIDGE" ap to the lan. i set a key under zero touch config, and also tried to RESET the ap. doesnt work
anybody can help?
regards

It's pretty simple, just not well documented.
1. First, write down the macs of each AP, and connect them so they are both assoicated to the controller.
2. Enable Zero Touch Config on your controller
3. Goto the Security Page, under AAA on the left side, click on MAC Filtering.
4. Add a Mac Filter for each of the AP's Macs (Which you already wrote down)
5. Goto the Wireless Page. Select Detail on one of the APs. Change it from Local Mode to Bridge AP
and hit APPLY. The AP should reboot.
6. Repeat this step with the Other AP.
7. Once both AP's have rebooted, and reassoiated, and you have confirmed they are both in Bridge AP mode, you can unpluge one of them. Just apply power, and it should setup the AP bridge.
8 IMPORTANT You cannot do this from WCS (I've never seen the option there)
From the AP details screen, select Ethernet Bridging (check the checkbox) on BOTH of the bridges.
You should be able to plug a client into the RJ45 of your remote bridge, and pass traffic now.
THIS Step is only nessacary if you entend to use the ethenet interface on the remote AP.
If you continue to have problems, you can try this: (Try the above first, since I don't think you created the MAC Filter, which YOU MUST do)
From controller CLI "config network allow-old-bridge-aps enable"

GT784WNV not working in Bridge Mode! Fed up with lack of Customer Service

I don't even know where to start but I am this close to just cancelling Verizon and switching to cable internet. If you want to skip the rant, jump down a paragraph.
I recently moved from a house a few miles away in which I had a solid DSL connection with a Westell 7500 in routed bridge mode that worked just fine with my Asus RT-N56U that I use for browsing, streaming, and online gaming. When I moved, the technician insisted I take the newer Actiontec GT784WNV. Needless to say, Verizon support was unsuccessful in getting it set up in bridge mode. After about 4 hours of unsuccessful troubleshooting, I suggested swapping it back out with my 7500 which worked fine just 4 days prior in my old house. Surprise! It miraculously started working just as it had previously. As I began to use it more, I noticed the connection was unstable. I would get dropped from Xbox Live and lose connection temporarily on my iPad. I ran the Verizon speed test and it would drop to about 0 and spike back up 3 or 4 times during the download test (don't think this is normal but could be). Every day I would talk to Verizon who escalated it to a supervisor about 4 times. They would then close the ticket without calling me. When i would follow up, I was told the supervisor talked to me and I verified the connection was good. Lying makes me livid and there is no accountability whatsoever at Verizon and it happened more than once. It appears to be a way for them to pass the problem on to someone else. I can go on and on about being put on hold for 40 minutes before disconnected, the 20+ hours I have spent re-telling my account info and story to every Tier 1 technician on their payroll for the past week, or the lack of competent customer service supervisors. This weekend, I finally got a call from someone local who said my line had some faults on it and that the problem was somewhere between my jack and the central office and they would send someone out today. Well....today the tech showed up and said "your problem is this old modem" and plugged in the Actiontec that I started with a week ago. I asked if he tested my line or the jack as the lady on the phone told me, and he said no. The problem is the modem. I said, I don't want a modem/router, I just want a regular modem and he said he had one, but it would cost me. How on earth is a plain modem going to cost me when they just installed an 802.11n router/modem combo for free? Absolutely terrible. I told him I want it in bridge mode because I don't want to use the wireless or the routing capabilities of the Actiontec. He said I have to do that and people normally just call Best Buy to have the Geek Squad come out. This really **bleep** me off as I used to run a network shop and configure Cisco routers and switches for a living. Once again, I have spent the past 6 hours tonight on the phone with Verizon only to end up back where I started.
At this point, I need to make this Actiontec GT784WNV a dummy (bridge) and let my Asus Rt-N56U do the work on my network. My Asus has all the port forwarding in place that I need for Xbox Live, etc. I have tried releasing the IP, changing the modem to RFC 1483 Transparent Bridging, disabling DHCP, changing the LAN IP to 192.168.99.1, etc. and it just will NOT get an internet connection. My router is configured correctly, unless there is something different between the Westell and the Actiontec that would require a setting change. Verizon is stumped, Asus hasn't called me back yet, and I am ready to just switch to Cable unless someone can help with a solution. I've been at this for a week. I have spent WAYY too much time fighting with a company that has no desire to deliver or to follow through and with absolutely zero accountability or business sense. Westell 7500 + Asus RT-N56U in old house worked fine. Move houses, change modem, doesn't work, switch back to old modem, works but unstable, tech claims old modem is my problem, plugs in new modem, doesn't work. I just want to use my router. How hard can that be? Can anyone please help?

Unfortunately that didn't work. I ended up putting my router in the DMZ as a workaround but it still had it's share of issues. After another week of trying to get Verizon to fix my connection (constant dropped connections forcing reboots of modem and router multiple times daily) I had Cable Internet installed today. Went from an unstable 6Mb/s to a stable 30Mb/s with Cable. I should have done this weeks ago. I wasted over 50 hours of my time with Verizon bouncing my issue around to others hoping someone else would be willing to fix it. Still no accountability with everyone tinkering with my setup taking a stab in the dark. The last person I spoke with set up a technician to come to my house later this week...AGAIN because he said there is something wrong on the line. I've known that for weeks but the tech that refused to fix my issue when he was in my house last week instead tried blaming it on something completely irrelevant because he had no clue what to do. One would think someone from Verizon would have reached out to me from this thread but they did not. In fact, the last tech's supervisor called me when i wasn't home, said "hello, this is XXX from Verizon......hello?" and hung up. Never a follow up as I was left once again to solve the problem myself. Well...I did. The incompetence of Verizon, it's poor training, and awful follow up procedures has cost them a customer. I am truly disappointed.

Bridge with two Cisco AP's

Hello Everyone,
So I have a scenario here and I’m wondering if this plan I have will work flawlessly or is there anything I have to lookout for?
So I'm going to bridge two Cisco AP's 1260 and 3500, which have an 880 router on each side.
(Currently I have a VPN set-up through the internet for the two locations to communicate)
(Naturally they are currently in different subnets)
Will absolutely change this and set up as one subnet.
There is VLANs setup on each router (same VLANs)
VLAN 1
And
VLAN 10
Everything is configured on the Routers and AP's for these VLANs (works flawlessly over the VPN).
So now since I’m going to get rid of the VPN and set-up a bridge with two AP's, will having same VLANs across both routers be a problem?
Will VLANs work OK through the bridge?
Besides using (IP helper address DHCP-IP) command on the non-root bridge side router to forward DHCP requests to the root bridge side router,
Is there anything else I have to consider?
Also I want to be able to route internet traffic on the non-root bridge side through the WAN port, and only route LAN traffic through the bridge...
Will I have to use Access list for this?
Sorry everyone...
I know this is a lot I'm throwing out there...
Thanks in Advance
Regards,
Ed

Also, if the IP Helper command is used to relay DHCP request to the root bridge side router.....
will the VLAN settings (trunks) on non-root bridge side router work ok since I will need to remove the DHCP pools configured there...... Or is it a better idea to keep it there and just exclude addressees that are available to the other side, and vice versa???
I say this because the non-root bride is also going to serve for wireless clients as well, and has VLANs setup on it so I'm guessing the non-root bridge side router needs the DHCP pools for both VLANs intact, for VLANs to operate correctly.
Please give me your insight on this....

Cisco secure ACS - RDBMS Rename a Group-

Hi,
I'm currently working with Cisco secure ACS 3.1 and I'm trying to use RDBMS synchronisation with a csv file. I create a accountactions.csv file where I create a new user.
1,0,TESTuser,,100,,,,,,0,,,0
2,0,TESTuser,,102,,test,,,,0,,,0
Until here, all is working fine. But now, I would like to put this user into a Group. This should be done with :
3,0,TESTuser,Group 30,106,,,,,,0,,,0
But I would like to know if it's possible to rename or create one Group (e.g rename Group 30 with Group TEST) directly in my csv file ?
Thank you
Regards
Pascal TOURNIER

Here is what i found works for renaming a default group, as you cannot create more groups beyond what is there.
SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status
1,1,,Group 100,210,,BPM,,,,0,,,0
2,2,,Group 101,210,,CHANNEL SECURE OPS,,,,0,,,0
3,3,,Group 102,210,,CISCO CNC,,,,0,,,0
4,4,,Group 103,210,,CISCO NOS,,,,0,,,0
5,5,,Group 104,210,,CTS,,,,0,,,0
6,6,,Group 105,210,,DCI,,,,0,,,0
line 1
Rename "Group 100" to named group "BPM" using code 210 to perform the Action
Gerald

Scroll not working in Bridge 5

Is there some setting that I have to tickle to get the scroll on my mouse to work in Bridge 5? It does fine in Photoshop 5. Thanks, Bernie

Hi,
I'm running the following:
Adobe master CS5
Windows 7 64bit
Logitech keyboard MX5000
Logitech Performance MX mouse
The setpoint software version 6.2 that came with the Performance MX mouse would make CS5 bridge not scroll as described. I uninstalled setpoint 6.2 x64 and installed setpoint 4.8 x64, which is the most current driver for the MX5000 keyboard. Evereything is working now...

Can I make "Catagories" or such so I can have a family group and a friends group and a work group etc And if so, can I synch it to gmail?

First, I use T'bird and love it. Thanks to everyone who makes this possible.
Now to my questions: I want to group my contacts as "Family", Friends", "Work" etc. How do I do it? Then, i synch T;bird with my gmail account. Will the groups translate? And finally, my gmail syncs with my Android phone (the only reason I have gmail). Will the groups sync with my phone? (Okay, Okay, the phone isn't a T'bird issue. Still, if anybody has an answer????) Actually, can I sync my phone with T'bird without getting gmail in the middle?
Thanks in advance.

To synchronize your address books, you need to use an add-on in Thunderbird. I like gContactSync; others speak highly of Google Contacts.
Both will allow whatever groups you set up in Google's Contacts to be echoed as Lists in Thunderbird.
And your Android phone will be more than happy to sync with Google's Contacts.
I consider it worthwhile to run a gmail account purely for the purpose of managing an address book shared between my phone and Thunderbird. I didn't want my whole TB Address Book on my phone; most of it is made up of Contacts for whom I know an email address, but no phone number, so they wouldn't be especially useful on the phone. Hence a separate address book can be populated just with Contacts chosen carefully for their relevance to the use of a phone. Of course it can store email addresses too.
To attend to your last question, probably not. Few phone manufacturers offer support for Thunderbird in their synch programs. Most of them are dire IMHO. Nokia's PC Suite was OK but they have been trying for years to roll out an inferior substitute program, Ovi Suite. Samsung devices come with Kies which is near useless.

Cisco AP 700w as a Work Group Bridge with a WLAN Controller

Similar Messages

Maybe you are looking for