Cisco WLC PSK Scheduled for Autogeneration

Hi All,
Is there a way to schedule Auto Generation of PSK for Guest WLAN in WLC or PI for every week/month?
We want to use WPA+WPA2 layer2 security with PSK on our Guest WLAN with just a splash screen acknowledging our policy without user/name password.
Are you aware of any way to automate PSK key creation. We would like to be able to change it weekly or monthly.
Thanks and Regards,
CJ

HI Jaganmohan,
I never tried with solarwinds but u can try it and let us know.
Here is the commnds :
config wlan security wpa akm psk set-key {ascii | hex} psk-key wlan_id
Note: keys must contain 8 to 63 ASCII text characters or 64 hexadecimal characters.
Regards
Dont forget to rate helpful posts

Similar Messages

Cisco WLC 2504 webportal for Server 2008 R2 DC LDAP or RADIUS

HI,Friends.
I want to get my mobile or Notebook clients connecting to wireless and use my Domain users ,Cisco WLC 2504 to authenticate via LDAP or RADIUS to our Windows Server 2008 Domain Controllers
question:
one,i can use my domain one Organizational Unit ,such as cn=use01,ou=test,dc=lzh,dc=com. now, noly user01 can logon on web, But how I make all my domain users can use web log it ?
I was using radius authentication or ldap certification to do web authentication ?which is good. ？？？
I specified child ou, ou its users superiors can not be landed on

hi ,Scott Fella
Thank you,I am very happy to receive your reply, I finally binding domain user authentication LDAP authentication done successfully. but You say the combination of nps I did not do the radius authentication is successful, I do not know where the problems.
the err:
<Event><Timestamp data_type="4">07/27/2014 18:33:36.845</Timestamp><Computer-Name data_type="1">PDC-CQ</Computer-Name><Event-Source data_type="1">IAS</Event-Source><User-Name data_type="1">11</User-Name><Service-Type data_type="0">1</Service-Type><NAS-IP-Address data_type="3">10.10.10.253</NAS-IP-Address><NAS-Port data_type="0">1</NAS-Port><NAS-Identifier data_type="1">WLC-CNNEWCITY</NAS-Identifier><NAS-Port-Type data_type="0">19</NAS-Port-Type><Vendor-Specific data_type="2">00003763010600000001</Vendor-Specific><Calling-Station-Id data_type="1">10.12.0.11</Calling-Station-Id><Called-Station-Id data_type="1">10.10.10.253</Called-Station-Id><Client-IP-Address data_type="3">10.10.10.253</Client-IP-Address><Client-Vendor data_type="0">0</Client-Vendor><Client-Friendly-Name data_type="1">WLC</Client-Friendly-Name><Proxy-Policy-Name data_type="1">Use Windows authentication for all users</Proxy-Policy-Name><Provider-Type data_type="0">1</Provider-Type><SAM-Account-Name data_type="1">CNNEWCITY\11</SAM-Account-Name><Class data_type="1">311 1 10.10.10.1 07/27/2014 09:41:28 5</Class><Authentication-Type data_type="0">1</Authentication-Type><NP-Policy-Name data_type="1">Connections to other access servers</NP-Policy-Name><Quarantine-Update-Non-Compliant data_type="0">1</Quarantine-Update-Non-Compliant><Fully-Qualifed-User-Name data_type="1">cnnewcity.com/user/test/11</Fully-Qualifed-User-Name><Packet-Type data_type="0">1</Packet-Type><Reason-Code data_type="0">0</Reason-Code></Event>
<Event><Timestamp data_type="4">07/27/2014 18:33:36.845</Timestamp><Computer-Name data_type="1">PDC-CQ</Computer-Name><Event-Source data_type="1">IAS</Event-Source><Class data_type="1">311 1 10.10.10.1 07/27/2014 09:41:28 5</Class><Fully-Qualifed-User-Name data_type="1">cnnewcity.com/user/test/11</Fully-Qualifed-User-Name><Quarantine-Update-Non-Compliant data_type="0">1</Quarantine-Update-Non-Compliant><Client-IP-Address data_type="3">10.10.10.253</Client-IP-Address><Client-Vendor data_type="0">0</Client-Vendor><Client-Friendly-Name data_type="1">WLC</Client-Friendly-Name><Proxy-Policy-Name data_type="1">Use Windows authentication for all users</Proxy-Policy-Name><Provider-Type data_type="0">1</Provider-Type><SAM-Account-Name data_type="1">CNNEWCITY\11</SAM-Account-Name><NP-Policy-Name data_type="1">Connections to other access servers</NP-Policy-Name><Authentication-Type data_type="0">1</Authentication-Type><Packet-Type data_type="0">3</Packet-Type><Reason-Code data_type="0">66</Reason-Code></Event>
then,You gave two figures is that what you mean? what's the meaning it that services-type =login ?

Cisco WLC + ACS + AD for Machine AND User auth...

So I am trying to implement an SSID that requires a machine to be a domain member, AND require the user to provide username/password credentials before being allowed on that SSID.
I am reading that it is possible, but can't find a clear config on how it is supposed to be setup... read about Machine Access Restrictions as being part of the config.
Any help here?
WLC 7.6 and ACS 5.5
-g

We are testing ISE with EAP chaining. It allows you to validate the company device (laptop) is joined to the domain and then the user credentials. However this requires EAP-FAST and the Cisco Anyconnect client. There is a group set up to look at EAP-TEAP. This will allow for standardize "chaining"
http://tools.ietf.org/html/draft-ietf-emu-eap-tunnel-method-01#page-5

Generate one time authentication for Guest on Cisco WLC

Hi All
Sorry for my question, because I just started to work with Cisco WLC.
I have created some WLAN for local users with authentication by 802.1x + Radius by certificate.
For Guest I used PSK with MAC-filtering.
But I see that is not comfortable for Guests, each time they come and want to access our wireless, we have to come and get their MAC.
I checked on Internet and find that the wireless solution for Hotel, Resorts are very easy.
I also googled and see that Cisco WLC support Lobby Ambassador to generate Guest username/password. But as I checked, this username/password might only use with Web-Auth, this method is not comfortable for Guest who don't know they have to go to Web-Auth to do authentication (e.g: when they only get pop3 email, or vpn, ... not use browsers)
Could I use this method (or another method) for creating one time Guest wireless username/password or Guest PSK that can be used for authentication when Guests click to Wireless-SSID name only (no need to open web browser to do Web-Auth).
Regards
Hai

Hi Choudhary
Thank you much for your information
Could I reconfirm about my concern.
With Cisco WLC, I can use WebAuth with Guest user only
If I want to use Guest user for authentication when guests connect to SSID (not by WebAuth, I means use Layer 2 security only, not Layer 3), I will have to use additional Radius Server.
And if I understand right, could you please recommend me software based Radius Server with support generate one time username/password for Guest, because I checked IAS/NPS on windows server may not have this function (ISE is not appropriate for us at this time, due to high expense)
Regards
Hai

Cisco WLC 5508 with 3702APs - mobile hotspot for 2000 Guest users

Cisco WLC 5508 with 3702APs - mobile hotspot for 2000 Guest users
I've been given a fantastic "opportunity" by my boss to use our existing wireless infrastructure to provide internet access to potentially upto 2000 VIP guests arriving with BYOD devices, in a very densely populated area for a 3 day event. We are talking an area of approx 200m x 15m. Think of it as an awards ceremony/concert. The solution will also be mobile so we will be using internet breakout from different telcos as it will move to approx 20 countries. The area is also incredibly densely populated with other wifi APs. I did a brief site survey and AirMagnet could detect over 2500 other 'rogue' APs from where I was stood! I hope CleanAir works!
We need a simple authentication method for them to connect with zero admin from our side. We don't want to just offer up a rolling daily PSK as that's a bit amateur and we don't really want the VIP guests sharing the PSK with others during their stay. Ideally they could self-provision by providing an email address.
I know the WLC can handle webauth for local users but I don't think it scales very well. ie I don't think I can offer the account to several hundred people.
Cisco ISE looks a very expansive (and expensive) product but I don't think we need all it's capabilities (do I?). It would be nice to just ask a potential user for their email address and grant them access and email them next year. I've seen Cisco NAC but that looks over the top too for just guest users who will only be accessing a shared internet connection.
I've seen 3rd party supposed software solutions from Kiosk Antamedia etc do they work with Cisco Enterprise WLC solutions?
We'd like to limit users to a certain (low) bandwidth and block (say) torrent traffic to keep the general user experience worthwhile.
Does anybody have any case study documents or experience of such a project? As well as the authentication it's how well the APs will handle the dense potential number of clients trying to connect in such a confined space.
Any suggestions would be gratefully appreciated from the knowledgeable community.
Cheers,
Mike

Hi Rasika,
We are having WLC 5508 model with software version running 7.4.121.0. AP Models are AIR-CAP2602I.
Normally our WAN links are good even while the issue pertains. We are connected to remote offices over ipsec site to site vpn for WAN. The link latency in WLC between the AP and the controller shows <1ms.
currently the Guest network is using WPA2-PSK auth given in the controller. we are trying to find a option to make the Guest wireless auth local to the office, and see if this solves the problem.
any suggestions,
Thank you,
Arjun

Configure cisco wlc for rsa authentication

                   Hi,
I wanted to find out if it is possible to authenticate wireless networks using rsa. Currently we have a cisco wlc 2504, rsa authentication manager 7.1
Do we require a cisco ACS device to make this work. Please advise.
Thanks

Yes it is possible. The below is the list of items which you require to configure RSA authentication on WLC
•1.       RSA Authentication Manager 6.1
•2.       RSA Authentication Agent 6.1 for Microsoft Windows
•3.       Cisco Secure ACS 4.0(1) Build 27
    Note: The RADIUS server that is included can be used in place of the Cisco ACS. See the RADIUS documentation that was included with the RSA Authentication Manager on how to configure the server.
•4.       Cisco WLCs and Lightweight Access Points for Release 4.0 (version 4.0.155.0)
For more information you can go through this link:
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a008090399a.shtml

Compatible APs for Cisco WLC 2504

Is the cisco wlc 2504 compatible with the AIR-CAP-3602l and if so what firmware would i need to be running on the WLC ? My firm rushed out and bought a mesh solution without doing their homework

Hi Doug,
Data sheet for 3602 access point shows it support 2500 series WLC. Please refer to the link below.
http://www.cisco.com/en/US/prod/collateral/wireless/ps5678/ps11983/data_sheet_c78-686782.html
You may need firmware version above 7.2 to support 3602.
http://www.cisco.com/en/US/docs/wireless/controller/5500/tech_notes/Wireless_Software_Compatibility_Matrix.html
Hope that helps
Regards
Najaf
Please rate when applicable or helpful !!!

Cisco WLC : AP automatic configuration for flexconnect parameters and ap group

Hello !
Is there a way to configure cisco WLC to automatically set flexconnect parameters such as Vlan support and Native Vlan ID when an access point join the controller ?
Same question to assign the access point to a specific AP Group ?
PS: The access points are set with usine parameters and the WLC is in version 7.4
Thank you for your answers !
Stephane

To my knowledge these features are not available in 7.4, but from what I understand 8.0 will have similar features. I can say that 7.6 has global commands, not sure if its part of 7.4.
If it is you can navigate there Wireless>Access Points>Global Configuration you can do things like configure your primary and backup controllers, set login credentials, pre-download images to AP's.
Please rate if you find the information helpful.
HTH

HA in Cisco WLC

Hi friends,
I am planning to have a wireless environment for a corporate company. I would like to have a Cisco wireless LAN controller 2100 series and 15 numbers of cisco aironet 1142 n access point. Since wireless is gonna be a very important medium for the premises, I am planning to have high availability for the 2100 series WLC.
With this scenario I am having the following of queries?
1. Does high availability is supported with WLC 2100 series or need to go for an hihger end WLC's? It would be great if I am guided with some documents on this?
2. My wired switching infrastructure at the core is running with GLBP. Can I connect the both WLC in each switch in an dual home architecture?
3. Is there any pre-requistes for doing the high availability for the WLc's?
4. Yet another company that is close to me do have the same architecture for wireless infrastructure, except that they have cisco WLC as 5508 and Cisco aironet 1142n access point. All the end points NIC adapters that they have support a/b/g standard. But with an n series they continously report low signal strength, the reason for this still unknown?
     But the tech documents of 'n' series access point claims that they support, 300Mbps within 33 feet and 200 Mbps within 66 feet.
They are having 2 nos of Cisco 1142n access point for every 30 feet but still they are facing low signal strength. Also there workspace are all cubicles and without any interference.
It would be great if I am guided on this issue also?
Regards,
Karthik Anbumani

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
Hi Karthik,
You can build this HA solution based on the 2100 controllers. And if you want HA for 15 access points you need two 2125 controllers. But I will suggest that you consider the 5508 controller since that is a more future proof hardware and will give you more features that you might want to use such as Office Extend.
Right now there is a bundle available for one 5508 with 10 x AIR-LAP1142 and the GPL price for that bundle is USD 31,424. And you should consider if you need the HA solution or if you are covered by the onsite support. In the product list below I have used the regulatory domain E and power cable for Europe. Make sure that you get this correct for your country. This is a limited offer ending August 1st 2010. You also need the additional 5 access points or more if you want Office Extend.
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
Also consider that the 2100 series only have FastEthernet interfaces so you will not be able to utilize the full 11n throughput.
1 x 5508 with 10 x 1142:
Product
Description
Quantity
Price
Lead Time
AIR-CT25-1140E10
802.11a/g/n ESTI Cfg5508-25 10AP WCS Demo Promo ends 8/1/10
1
24,595.00
14 Days
AIR-CT5508-25-K9Z
5508 Series Controller for up to 25 APs
1
0.00
14 Days
AIR-PWR-5500-AC
Cisco 5500 Series Wireless Controller Redundant Power Supply
1
1,495.00
14 Days
SWC5500K9-70
Cisco Unified Wireless Controller SW Release 7.0
1
0.00
14 Days
AIR-PWR-CORD-CE
AIR Line Cord Central Europe
1
0.00
14 Days
AIR-LAP1142N-E-K9Z
Manufacturing Level PID - AIR-LAP1142N-E-K9
10
0.00
14 Days
S114RK9W-12421JA
Cisco 1140 Series IOS WIRELESS LAN LWAPP RECOVERY
10
0.00
LIC-CT5508-25
25 AP Base license
1
0.00
14 Days
LIC-CT5508-BASE
Base Software License
1
0.00
14 Days
WCS-CD-K9Z
CD With Windows And Linux. No License.
1
0.00
14 Days
CON-OSP-CT25E10
ONSITE 24X7X4 802.11a/g/n ESTI Cfg: 5508-25; 10APs;
1
0.00
CON-OSP-CT0825
ONSITE 24X7X4 Cisco 5508 Series
1
2,944.00
CON-OSP-1142EK9Z
ONSITE 24X7X4 802.11a/g/n Fixed AP
10
2,390.00
Total   LeadTime: 14 Days Total Price: USD   31,424.00
Total LeadTime: 14 Days Total Price: USD 31,424.00
2 x 2125 with 10 x 1142:
Product
Description
Quantity
Price
Lead Time
AIR-WLC2125-K9
2100 Series WLAN Controller for up to 25 Lightweight APs
1
8,995.00
21-35 Days
CAB-AC-C5-EUR
AC Power Cord, Type C5, Europe
1
0.00
14 Days
SWLC2100K9-70
Cisco Unified Wireless Controller SW Release 7.0
1
0.00
14 Days
ASA5505-PWR-AC
ASA 5505 AC Power Supply Adapter
1
0.00
14 Days
SSC-BLANK
ASA 5505 SSC Blank Slot Cover
1
0.00
14 Days
CON-OSP-AC2125K9
ONSITE 24X7X4 WLAN Controller for for Retail
1
1,656.00
Total   LeadTime: 21 - 35 Days   Total Price:   USD 10,651.00
Product
Description
Quantity
Price
Lead Time
AIR-WLC2125-K9
2100 Series WLAN Controller for up to 25 Lightweight APs
1
8,995.00
21-35 Days
CAB-AC-C5-EUR
AC Power Cord, Type C5, Europe
1
0.00
14 Days
SWLC2100K9-70
Cisco Unified Wireless Controller SW Release 7.0
1
0.00
14 Days
ASA5505-PWR-AC
ASA 5505 AC Power Supply Adapter
1
0.00
14 Days
SSC-BLANK
ASA 5505 SSC Blank Slot Cover
1
0.00
14 Days
CON-OSP-AC2125K9
ONSITE 24X7X4 WLAN Controller for for Retail
1
1,656.00
Total   LeadTime: 21 - 35 Days   Total Price:   USD 10,651.00
Product
Description
Quantity
Price
Lead Time
AIR-LAP1142-EK9-PR
LAP1142 Controller Based E Reg Domain
1
9,950.00
14 Days
S114RK9W-12421JA
Cisco 1140 Series IOS WIRELESS LAN LWAPP RECOVERY
1
0.00
AIR-LAP1142-EBULK
BOM LEVEL PID FOR BULK PACK
10
0.00
14 Days
CON-OSP-LAP1142E
ONSITE 24X7X4 802.11a/g/n Fixed Unified AP; ETSI
10
2,390.00
CON-OSP-L1142E0P
ONSITE 24X7X4 802.11a/g/n LWAPP AP EU Cnfg-Promo Pk
1
0.00
Total   LeadTime: 14 Days Total Price: USD   12,340.00
Total LeadTime: 21 - 35 Days   Total Price: USD 33,542.00
Regards,
André

Certificate based authentication with Cisco WLC and Juniper IC

Hi
I have a cisco WLC 4400 and Juniper IC which works as the external Radius server.
I want the wireless clients to be authenticated using certificates. I know the Juniper IC can understand certificates.
My question is can cisco WLC understand that the information being presented to it by the client is not username/pwd but a user certificate.
i have also looked at this article :
http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/100590-ldap-eapfast-config.html
What i don't understand here is the need of WLC authenticating the user with his credentials by LDAP when it has authenticated the user cert.
All your help is appreciated.

Hi,
Since you use an external radius server you don't have to worry for this.
The only config that you need to do on WLC is to define the radius server under Security-AAA-Radius-Authentication and on your WLAN-Security-AAA.
The doc you refer is only for Local Radius on WLC.
Hope this helps
Regards,
Christos

Deauthenticate User on WLC w/ ISE for Testing

ISE v1.1.1.268
WLC v7.2.110.0
We have a wireless deployment using ISE and WLC's configure for LWA. Seeing that CWA has fewer "moving parts" I was trying to migrate to that. When testing my deployment under LWA, I could de-authenticate a user simply by finding the association on the WLC and removing it. Then, when that device would reconnect to the WLAN, it would prompt them for credentials through the WebAuth pages.
After configuring a WLAN for CWA I noticed that when I remove an association from the WLC in the same manner that the upon reconnecting to the WLNA the user never gets redirected to the WebAuth pages. I'm assuming this is because since the authentication takes places on the ISE server, rather than on the WLC (in LWA mode) that the authentication is still active (since I only removed the association on the WLC).
I looked around on ISE, but couldn't find a place to view active user authentications let alone remove those authentications. Can this be done? It'd be great for testing to make sure the WebAuth pages function as I need them to.
I used this guide to set up CWA: https://supportforums.cisco.com/docs/DOC-26442. The only exception to following that guide is that I used an authorization profile that sets the auth timeout to 36000 seconds.

I don't have profiler.
I can see all of the profiled endpoints, however. I've tried removing the endpoint I was testing with, but it doesn't help. When the client reassociates, the Policy Manager State goes straight to run even though ISE has only responded with the initial Authorization profile and not the CoA.

Cisco WLC 2500 - 802.1x with Vasco Radius SMS OTP

Hello folks,
I have what seems to be a complex implementation with many things that need to be done on a customers network and I wanted to be pointed in the right direction.
The current scenario is such, the customer has a Cisco WLC 2500 device that has 3 access points(these are in the same AP group) connected to it. There is one SSID that I will call PRODUCTION here that some domain users use to connect to the local network. The customer has requested to have a GUEST SSID added to the WLC where guest users will connect to and recieve a SMS OTP for authentication.
Correct me if I am wrong, but I will obviously need to segment the SSIDs to have them running on different subnets to ensure that guest users do not have access to the production network once they authenticate. In order to do this I will need to configure Dynamic VLAN assignment for the Cisco WLC and connect it to a 802.1x port on the switch.
Now what is not clear is I am not interested in authenticating the users that connect via "Production SSID" and want to bypass authentication for those users and have them assigned to the default vlan (or maybe perhaps have them authenticate via LDAP on the AD), however I want to force the "GUEST" SSID users to authenticate so that they may recieve an SMS OTP (reason for this is to force guests to register their phone numbers to use the internet so that Illegal activity may be tracked).
1)So would it be possible to bypass authentication(or authenticate them via LDAP) for the PRODUCTION SSID as only domain users would know the SSID password to log on and have them by default assigned to the production subnet (default vlan) but force the GUEST SSID users to another VLAN via 802.1x sms otp?
2)*Important* Another issue that is not clear is will I be able to directly configure AAA Radius settings on the Cisco WLC to directly authenticate with the VASCO Radius OTP and recieve a challenge-response(required for OTP) during authentication? As I have seen from Ciscos Dynamic VLAN assignment docuementation (http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml) additional IETF Radius Perimeters are used such as Tunnel-Private-Group-ID etc are used which I can't seem to configure on the Vasco.
I do beileve this is a great project in helping me understand the INs and OUTs of CISCO WLC as well as Wireless NAC, If anyone could enlighten me and point me in the right direction I would be forever in debt. Much appreciated.
Best Regards
Sinan Barghouthi - JNCIA-FWV , JNCIA-IDP , CCA-NS , TCSM-8.0

On your WLAN you can enable AES and TKIP. Just know that some clients mau have issue when they see both TKIP and AES. Ive had pretty good success with this in the past. Dont forget, you also need to enable WMM allowed to get N rates.
But you will need to configure AES on the client as well to support N rates.
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Cisco WLC 5508 - NPS Radius

Cisco WLC 5508
Software Version: 7.4.100.0
Windows Server 2008R2
I've got everything setup on the Windows Server 2008 side of things (certificates, radius clients, etc)
I added the radius server on the WLC, and configured a new WLAN to use it.
Both are on the same subnet.
When trying to conect to the WLAN it kept failing. I installed wireshark on the server to monitor the radius traffic, and to my surprise there was no radius traffic showing up on the server. The radius statistics on the WLC are at 0 as well, so it's like the WLC isn't even attempting Radius.
I reverified that the server was enabled on both the security tab and the WLAN itself on the WLC. Rebooted the controller and the server, all to no avail. I used a radius test client, and can successfully send radius commands to the server using that utility.
Frustrated, I just kept trying to reconnect on my wireless device, and after about the 15th try, finally I saw radius activity on wireshark. It rejected my access, but at least I saw activity. It also registerd radius statistcs on the WLC as well.
So now if I keep trying to connect repeatedly, about every dozen or so times the WLC actually will send a radius request to the server.
What in the world is going on here?

I do have local management users on the controller.
Some hours later I added the option of authenticating management users, for the NPS server. Then logged inn to the management GUI using NPS radius, worked just fine.
However, these commands have been useful to me several times, to make sure unsuccessful requests appear in the Windows Event log:
auditpol /get /subcategory:"Network Policy Server"
If it shows ‘No auditing’ or just "Success", you can run this command to enable it:
auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
So now I know that the NPS radius server works, for management access. I will go to the customer's site some other day to test it for 802.1x authentication. If not, I'll do some debugging to decide wihich to blame - the WLC or NPS.

Cisco WLC 5508 not sending SNMP Traps

Hello Everyone.
I'm having a weird error on our WLC environment. We have an HA with two cisco WLC 5508 and i cannot get SNMP Traps working on a Windows PC running Kiwi Syslog server (free ed.).
I can receive correctly Syslog messages, but not traps.
I Tried also to send SNMP Traps from WLC to a different PC using Linux with snmptrapd and it works fine.
I tried then to send from my Linux box a snmp trap to my Windows PC, and it works fine, but i still cannot receive anything from WLC.
Using Wireshark to detect traffic, i cannot see any packet on udp port 162.
I cannot figure out any problem with my scenario, but i can see the following errors on syslog:
*rmgrTrasport: Mar 30 16:08:22.602: #RMGR-3-INVALID_PING_RESPONSE: rmgr_utils.c:270 Ping response from <my_windows_PC> is invalid. Ip address do not match.
My WLC Version is 7.6.130.0
Thank you for your support.

I have gone through your query and found the following fruitful links ,please let me know if it helps and mark it correct answer if it is.
https://www.manageengine.com/network-monitoring/help/userguide/processing_traps.html
https://rscciew.wordpress.com/2014/10/12/snmp-configuration-on-wlc/
Thanks :)

Cisco WLC 5508 and LACP

Hi Fellows,
I wanna know if 5508 Cisco WLC support LACP or not. Actually i work in a project where i must
connect WLC 5508 in Enterasys Switches with Link Aggregation.
Enterasys Switches support LACP 802.3ad but when i learn Cisco Books i see that WLC 5508
doesn't support LACP.
Can you help please ?
Sincerely
Joseph

Hi,
Please take a look into the config guide:
http://www.cisco.com/en/US/docs/wireless/controller/7.0/configuration/guide/c70mint.html#wp1277652.
You can read there:
Once the EtherChannel is configured as on at both ends of the link, it does not matter if the Catalyst switch is configured for either Link Aggregation Control Protocol (LACP) or Cisco proprietary Port Aggregation Protocol (PAgP) because no channel negotiation is done between the controller and the switch. Additionally, LACP and PAgP are not supported on the controller.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Cisco WLC PSK Scheduled for Autogeneration

Similar Messages

Maybe you are looking for