DHCP issues for Wired Guest LAN

Hi Everyone,
I've a 1751 acting as a DHCP server for client PCs on a guest network A.B.8.x (using an Anchor controller) on the DMZ of my firewall. The 1751 reports the following
Nov 30 15:35:45: DHCPD: DHCPDISCOVER received from client 0100.1708.37a3.55 through relay A.B.7.y.
Nov 30 15:42:41: DHCPD: there is no address pool for A.B.7.y.
I'd tied my guest vlan and corresponding DHCP scope on the router to A.B.8.x, but as A.B.7.x is the DHCP relay for the Anchor controller I don't understand why the DHCP server on the router is not doing what I expected it to.
As ever any help will be appreciated.
Many Thanks
Scott

Hi Cristian,
After much pulling of hair and gnashing of teeth I have got it working - what was not clear to me, and it looks as though you've fallen into the same trap, is that the egress interface on the anchor controller (ie the management port) defines the addresses given to the clients. The dhcp scope on your server has to be from the same network as the address of the management interface (so my guest clients get a A.B.7.x address). In fact the ingress interface addresses have no bearing (as I'm sure I read somewhere afterwards!) on how the guest access operates and can (should?) be dummy addresses.
I tried creating another vlan (with A.B.8.x) on the anchor controller and assigning that to the egress of the guest WLAN on the anchor and I could get A.B.8.x addresses from my DHCP server as I had planned, but, and this is a big but, web authentication just will not instigate. So it would seem that guest access is reliant on using the management interface as the egress on the anchor of the guest WLAN.
I hope this is helpful,
Regards
Scott

Similar Messages

  • Preauth ACL for Wired guest not working

    Hi Guys,
    I have 5508 wireless lan controller running code 7.2. We recently implemented Wired guest access on the WLC and configured necessary changes on the switch. We also have wireless guest profile as well configured on the WLC. We have some people who usually use Jabber client for video conferencing so what we have done is we have configured a preauth acl so that if any users connect to the wireless guest profile they automatically connect to the Jabber server without going through the Web auth. We have applied the same ACL in the Wired guest profile as well but the problem is that Jabber is not able to connect unless we manually go through web browser and then authenticate, but it is working normally for wireless guest access without the web authentication. Let me know if this is some kind of bug or a known issue which can fixed in some way. Thanks in advance
    - Krishna

    Krishna:
    Can you please confirm if other type of traffic (other than jabber traffic) is allowed by the pre-auth ACL?
    try - for testing - to allow traffic -by same ACL -  to some other destination and try via normal user to ping to open whatever session with that destination.
    let me know if that works or not.
    Regards,
    Amjad
    Rating useful replies is more useful than saying "Thank you"

  • Wired guest lan authentication through NGS

    Hello Guys,
    We have 5508 controller running ver 7.2.110.0.We have configured wireless guest and wired guest WLAN profiles and assosicated necessary dynamic interfaces to it. The authentication for both wireless and wired guest is through Cisco NGS[NAC]. I have configured Webauth and added the server in the security tab for authentication. I have guest user accounts created in NGS, if I use wirless guest the auth works perfect. But the same credentials is not working with wired guest. Any advice on this issue would be really helpful
    Regards
    Krishna

    Hey Scott,
    Yes NGS is working as Radius. However I haven't checked on WLC neither NGS log to see if there is any but let me look into that. No other names also doesn't work. I did run a debug on WLC while the user was authenticating below is the output
    Output of debug for wireless user where I am getting Accept message for auth at the end
    User IP ADDR - 172.22.207.157
    *aaaQueueReader: Aug 20 09:44:29.940: 00:23:14:ec:3d:38 Successful transmission of Authentication Packet (id 190) to 194.156.169.111:1812, proxy state 00:23:14:ec:3d:38-00:01
    *aaaQueueReader: Aug 20 09:44:29.940: 00000000: 01 be 00 a2 cd 8f 91 44  a2 4f 85 f1 04 f7 14 9a  .......D.O......
    *aaaQueueReader: Aug 20 09:44:29.940: 00000010: d0 3e 42 94 01 1b 6d 61  68 65 62 6f 6f 62 2e 6b  .>B...maheboob.k
    *aaaQueueReader: Aug 20 09:44:29.940: 00000020: 68 61 6e 40 61 6d 61 64  65 75 73 2e 63 6f 6d 02  [email protected].
    *aaaQueueReader: Aug 20 09:44:29.940: 00000030: 12 34 fc 96 01 47 ed 5e  d3 8d 08 4e 72 ce 1d b5  .4...G.^...Nr...
    *aaaQueueReader: Aug 20 09:44:29.940: 00000040: da 06 06 00 00 00 01 04  06 ac 16 cf 83 05 06 00  ................
    *aaaQueueReader: Aug 20 09:44:29.940: 00000050: 00 00 0d 20 0b 42 4c 52  57 4c 43 4f 30 31 3d 06  .....BLRWLCO01=.
    *aaaQueueReader: Aug 20 09:44:29.940: 00000060: 00 00 00 13 1a 0c 00 00  37 63 01 06 00 00 00 01  ........7c......
    *aaaQueueReader: Aug 20 09:44:29.940: 00000070: 1f 10 31 37 32 2e 32 32  2e 32 30 37 2e 31 35 37  ..172.22.207.157
    *aaaQueueReader: Aug 20 09:44:29.940: 00000080: 1e 10 31 37 32 2e 32 32  2e 32 30 37 2e 31 33 31  ..172.22.207.131
    *aaaQueueReader: Aug 20 09:44:29.940: 00000090: 50 12 ef 00 53 8b 39 31  14 93 b3 82 1c f5 b5 51  P...S.91.......Q
    *aaaQueueReader: Aug 20 09:44:29.940: 000000a0: 82 45                                             .E
    *radiusTransportThread: Aug 20 09:44:30.516: 00000000: 02 be 00 1a 0c 8e d4 54  91 55 d6 ae b2 91 05 6e  .......T.U.....n
    *radiusTransportThread: Aug 20 09:44:30.516: 00000010: 93 f9 4b 7e 1b 06 00 21  70 70                    ..K~...!pp
    *radiusTransportThread: Aug 20 09:44:30.517: ****Enter processIncomingMessages: response code=2
    *radiusTransportThread: Aug 20 09:44:30.517: ****Enter processRadiusResponse: response code=2
    *radiusTransportThread: Aug 20 09:44:30.517: 00:23:14:ec:3d:38 Access-Accept received from RADIUS server 194.156.169.111 for mobile 00:23:14:ec:3d:38 receiveId = 0
    But for wired user below is the output
    User IP ADDR - 172.22.207.151
    5.338: 00:26:b9:e0:36:a6 Successful transmission of Authentication Packet (id 188) to 194.156.169.111:1812, proxy state 00:26:b9:e0:36:a6-00:01
    *aaaQueueReader: Aug 20 09:35:15.338: 00000000: 01 bc 00 a2 2c fe c1 97  a7 d1 25 a0 59 34 89 38  ....,.....%.Y4.8
    *aaaQueueReader: Aug 20 09:35:15.338: 00000010: c1 be 59 f3 01 1b 6d 61  68 65 62 6f 6f 62 2e 6b  ..Y...maheboob.k
    *aaaQueueReader: Aug 20 09:35:15.338: 00000020: 68 61 6e 40 61 6d 61 64  65 75 73 2e 63 6f 6d 02  [email protected].
    *aaaQueueReader: Aug 20 09:35:15.338: 00000030: 12 37 c7 5c 52 27 41 5b  0d 60 98 70 76 3b b3 ba  .7.\R'A[.`.pv;..
    *aaaQueueReader: Aug 20 09:35:15.338: 00000040: f5 06 06 00 00 00 01 04  06 ac 16 cd 74 05 06 00  ............t...
    *aaaQueueReader: Aug 20 09:35:15.338: 00000050: 00 00 0d 20 0b 42 4c 52  57 4c 43 4f 30 31 3d 06  .....BLRWLCO01=.
    *aaaQueueReader: Aug 20 09:35:15.338: 00000060: 00 00 00 0f 1a 0c 00 00  37 63 01 06 00 00 02 02  ........7c......
    *aaaQueueReader: Aug 20 09:35:15.338: 00000070: 1f 10 31 37 32 2e 32 32  2e 32 30 37 2e 31 35 31  ..172.22.207.151
    *aaaQueueReader: Aug 20 09:35:15.338: 00000080: 1e 10 31 37 32 2e 32 32  2e 32 30 35 2e 31 31 36  ..172.22.205.116
    *aaaQueueReader: Aug 20 09:35:15.338: 00000090: 50 12 36 60 54 47 0b 84  02 5c 0b da 19 a1 05 eb  P.6`TG...\......
    *aaaQueueReader: Aug 20 09:35:15.338: 000000a0: af 2b                                             .+
    *aaaQueueReader: Aug 20 09:35:17.053: AuthenticationRequest: 0x2ab12b50

  • Foreign controller functionality for wired guest on Cat 3850s

    Cat 3850s provide unified access and WLC functionality. However, I would like to know if they can act as foreign controllers. In other words, can we host a wired guest VLAN on 3850 and tunnel its traffic over EoIP tunnels to a guest anchor WLC (5500/4400) in DMZ? The following WLC comparison page says 3850 supports Guest services (wireless) and Guest services (wired). Has anyone tried this or has more insights into this?
    http://www.cisco.com/en/US/products/hw/wireless/products_category_buyers_guide.html#~controllers
    Thanks,
    Vijay

    Switch 3850 can act as a foreign controller. See the link below.
    http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/release_notes/OL_30562_01.html
    The following features are not supported in Cisco IOS XE Release 3.3.0SE:
    – Wireless Guest Anchor Controller (The Catalyst 3850 switch can be configured as a foreign controller.)

  • WLC - Layer 3 Wired guest lan ?

    Hello
    Has anyone been able to do this with a WLC, configuration guidlines say :"
    "Wired guest access ports must be in the same Layer 2 network as the foreign controller."
    Anyone know if Cisco is working on making this solution work on L3 aswell ?
    Regards,
    Gk

    Hi gudmundurk,
    I'm not sure if they would consider it worth developing as you would have to create a tunnel between the guest vlan's gateway and the subnet that the controller is on to keep your network secure anyway. Unless someone out there knows..........
    Regards
    Scott

  • Possible to use Airport Extr and Express for WIRED Guest Network?

    Situation and landscape:
    My house has a Comcast cable-modem, which is connected to an Airport Extreme (AEx).
    The AEx is running WPA WiFi, and this is all good.
    There is one ethernet wire running out of the AEx, which goes 150 feet to the rear of my house, across a short corridor (protected from weather with insulated pipe) and into my garage apartment, where it terminates into an Airport Express (APress.)   This garage apartment is frequently used as part of a rental property.  The APress is extending the same WiFi SSID/settings.
    When guests arrive, they are able to plug-in their notebook computers to the APress ethernet port, or use the WiFi.
    Well, the problem with that, obviously, is that they can "see" the other computers on the network, and printers, etc.
    It would be perfect to set configure the AEx and APress to the WiFi "guest network."  However, there are problems with this:
    1)  Believe it or not, many guests still use direct-plug and do not have nor know how to set up their WiFi -- so they MUST have a direct ethernet wire.
    2)  When I use Airport Utility for the APress, it does not show any WiFi guest network option -- maybe because another dependent setting is not allowing this (i.e. Bridge Mode?")
    3)  The distance between the AEx and this garage apartment is too long between them to shoot a WiFi guest network from AEx and to be picked-up by the Airport Express... and there's a center core in my old house that is impervious to all radio frequencies and could block a nuclear blast.  Well, it causes a degradation of wireless.   And this brings us back to #1 above...in that I need a cable ethernet option.
    Picture attached of current landscape:
    So, maybe....
    I've spent the better part of a couple of hours searching here, particularly for the terms "access point" but the terminology isn't what I need.  What I wonder if perhaps I need to place an APress beside the AEx, turn on Guest Network at the AEx, then "pick it up" with a second APress, and carry the ethernet signal to the garage apartment and allow guest WiFi and wired.  (see second picture)   Will this work?

    OK, here how to set this up.
    Open up AirPort Utility 5.6.1, select the Express, and click Manual Setup
    Click the Wireless tab located below the icons
    If you want the Guest Network to have a different SSID (recommended), then change the name of the wireless network, adjust the security settings if needed, and change the Wireless Password and Verify
    Click the Internet icon up at the top of the window
    Click the Internet Connection tab just below the icons
    Change the setting for Connection Sharing to Share a public IP address
    Click the DHCP tab located under the icons
    Change the DHCP Beginning Address to read something different.....like 10.0.5.2
    Click Update and give the Express a full minute to restart
    At this point, the Express indicator light will be slowly blinking amber
    Open up AirPort Utility again, select the Express and click directly on the word Status (2nd line)
    You should see a Double NAT notice with an option to "ignore" the item
    There may also be an Setup over WAN notice with an option to "ignore" the item
    Click in the boxes to ignore both items, then click Update again and the Express will restart and display a green light
    Try things out to verify that the Guest Network cannot "see" any devices on the main network...and vice versa.

  • SA 540 and DMZ Issue for Wireless Guest Access

    I have hooked up a Wireless AP into the Optional Port setup as DMZ on the SA 540.  My goal is to provide internet access to wireless guest users without giving them access to the entire LAN.     The internet access for the wireless guest users is painfully slow.   It takes 5 minutes to access Google.   Has anybody else had issues with slowness.    I am able to successfully ping websites and retrieve their IP address, but it won't connect to any websites via web browsers.   Just to humor myself,  I configured firewall rules to allow DMZ full access to the LAN and WAN.   I am still having the same results.   Any thoughts and suggestions?

    Hi,
    I'm not the one with the AP problem, I just have the same issue with the DMZ port. I think you have to forget about the whole AP issue here since the problem is with the DMZ port on the SA500.
    I have my Web and Mail server set up on the DMZ port, I can ping and resolve Domain names to the outside world, but trying to reach anything with a browser takes foreeever. On, eg. www.apple.com I just get a few lines from their web page (so there is a connection) and then it halts to a stop (takes about 5 min).
    I also tried to move my laptop to the DMZ, just to make sure there is no problem with the server, and it has the same issue.
    To summarize, I have about 16 Mb connection on my LAN and on my DMZ i can't even load a full web page.
    Firmware 1.0.39
    BTW, when I upgraded the firmware it wiped my configuration, but it kept my firewall rules in place, even though they weren't shown in the Firewall table. e.g. I could still access my DMZ from my LAN. I had to hard reset the router from the hardware reset button on the router before that changed and the router was completely reset.

  • Https redirection issue for Wireless Guest CWA - ISE 1.3

    Our Setup is
    ISE 1.3 (Patch level 2) running on ACS 1121
    2 nodes clustered with Admin, monitoring, policy service enabled ( Primary and Secondary ).
    Configured SSID Guest for Centralized web authentication with ISE.
    We have issues in web redirection with chrome . It is not redirecting to the ISE page but rather showing " Page cannot be displayed".
    By default chrome is pointing to https. For example if we type https://google.com it is not redirecting to ISE page. But when I specify the same as http://google.com it works.
    There is no issue with IE, Firefox as it is redirecting to ISE page with default https and i can see it is hitting our rule.
    Please advice.

    Hi Neno
    They are using a third party certificate (digi cert) for client auth. They have confirmed even if they use a self-signed-cert the result is same.
    So basically none of the https page is not loading. If we manually browse some https site from Firefox, IE the result is same showing " page cannot be displayed".
    Redirection to https is the problem which i have never faced with my other customer. This is the upgraded version of ISE from 1.2 to 1.3.

  • Finding DHCP addresses for LAN connected devices

    i am suffering from information overwhelm!
    can anyone tell me how I can find out the DHCP assigned addresses for devices that are connected to my airport extreme via wired connections to the lan?
    i have a voip box connected to the base station and i need to know it's 10.0.1.x address so that i can work with the voip company to check why that box is currently having problems.
    tia for any and all help!
    iMac G5 (PowerPC) & MacBook   Mac OS X (10.4.8)  

    You should be able to choose Logs and Statistics from
    the Base station menu and then choose the DHCP
    clients tab. That will show you all of the DHCP
    leases currently in use.
    It appears that there is a problem displaying DHCP information for wired clients.
    I discovered that if you disable the wireless (I'm only running wired clients), the Logs and Statistics tab only shows "Logs". The other tabs are not even displayed.
    When I turn the Wireless back on, the other tabs re-appear but are empty (no entries). This appears to be a bug that will hopefully be corrected in the next update
    PowerMac G5   Mac OS X (10.4.8)  
    PowerMac G5   Mac OS X (10.4.8)  

  • Anyone seen strange behavior with wired guest access on WLAN Controller?

    Cisco Doc ID 99470 spells out how to deploy wired guest access over wireless LAN Controllers.
    That said, everything has been up and working for almost a year.  Guest wireless uses anchor controller in DMZ - no issues.
    Recently configured two wired ports for wired guest networking.  The desktops get the correct IP address via DHCP.  A wireless client (on the table right next to the wired clients) on the guest wireless gets an IP address as expected as well.
    Open a continuous ping to the gateway 172.16.16.1 on all three machines.
    The two desktops will ping for a few minutes and then stop for 30 seconds or longer.  Wireless client will keep its connection.  (you might think it would be the other way around)
    I understand there is a 65,535 second inactivity timeout, but I am only sitting here for minutes, not 18 hours when this happens.
    On the wired desktops, you have to bring up a browser and log back in just as you do on a wireless client ever few minutes.  After debugging the client, I found a "failed to find scb" message in the output.
    The other trick here is that the wired clients are miles away from where I can actually get on the CLI of the controller.  This makes it difficult to run a debug and bring up a browser since I am not local to the machines when running debugs.
    Has anyone ever see this behavior?  Has anyone see the "failed to find scb" message?
    Thanks in advance!
    Succ
    essfully plumbed mobile rule (ACL ID 255)
    *pemReceiveTask: Dec 30 11:33:15.735: 00:25:b3:ce:cb:ef 0.0.0.0 tokenID = 5
    *pemReceiveTask: Dec 30 11:33:15.735: 00:25:b3:ce:cb:ef Set bi-dir guest tunn
    el for 00:25:b3:ce:cb:ef as in Export Foreign role
    *pemReceiveTask: Dec 30 11:33:15.735: 00:25:b3:ce:cb:ef 0.0.0.0 Added NPU ent
    ry of type 1, dtlFlags 0x4
    *spamReceiveTask: Dec 30 11:34:54.569: CCKM: Send CCKM cache entry
    FP08:(33207772)[cmdSendNodeInfo:3787]failed to find scb 0023.2422.c6eb
    *mmListen: Dec 30 11:35:58.539: 00:25:b3:ce:cb:ef Scheduling deletion of Mobi
    le Station: (callerId: 73) in 1 seconds
    *mmListen: Dec 30 11:35:59.471: 00:25:b3:ce:cb:ef Scheduling deletion of Mobi

    I found it in the document
    B.1 How Logout Works
    The WebGate logs a user out when it receives a URL containing "logout." (including the "."), with the exceptions of logout.gif and logout.jpg, for example, logout.html or logout.pl. When the WebGate receives a URL with this string, the value of the ObSSOCookie is set to "logout."
    The Access System sets an obSSOCookie for each user or application that accesses a resource protected by a WebGate. The obSSOCookie enables users to access resources that are protected by the Access System that have the same or a lower authentication level. Removing the ObSSOcookie causes the WebGate to log the user out and requires the user to re-authenticate the next time he or she requests a resource that is protected by the Access System.
    Well, I havn't got that far in the document:)
    Thanks a lot for your help.
    -Wei

  • Wired guest

    Respected members of this community... :) I need help.
    The last couple of days i spend implementing unified wireless at a customers site.
    We used the latest versions of the controller and WCS software.
    This new software offers a new feature, wired guest.
    Since we already implemented 802.1x with a guest VLAN on the wired network last year, we wanted to offer the guest access functionality on the wired LAN as well.
    So first we implemented wireless guest access, which worked fairly quickly.
    Then we added another interface on the controllers, which matched the already existing wired guest VLAN. First we wanted to use that VLAN for wireless guests as well as wired, but we found out that is not possible (so we created a new wireless guest VLAN). Then we added a new WLAN wich we marked for wired guest.
    Anyway, we followed the documentation and...could not get it to work.
    The network is a layer 3 routed network with 40 or so VLANs. The controllers are connected to the core switch (with nicely configured trunks), which does all the routing.
    DHCP is the first thing that didn't work. The interfaces we created on the controllers have the guest lan checkbox checked, ingress interface is the guest VLAN, egress interface is the mngt interface.
    The DHCP relay function did not work.
    DHCP will work with IP-helper configured on the VLAN interface on the core router, but this al goes outside of the controllers.
    This is by the way the major thing i do not understand. With wireless, all traffic goes via de controller through the LWAPP tunel. But with wired, my layer 2 VLAN ends on the core switch, not on the controller.
    So what should the default gateway be for that VLAN? The interface VLAN of the coreswitch or one of the controller IP adresses?
    Traffic should be directed to the controllers (i guess?) to enable them to catch HTTP and send the redirect to the webauth page.
    But if you set the default gateway to the controllers, DNS does not work because the controllers do not forward traffic untill after authentication, but for this to work, you need DNS for the client to start the HTTP session.
    Is there anyone out there who has this working, including DHCP?
    The customers network is flexible, we can build almost anything we want there, so iw we need to change something, we can.
    Wireless guest was no problem at all, and de data WLAN, including 802.1x, auth on AD and dynamic VLAN assignment worked perfectly. So we did get something to work actually... :)

    Does this help?
    <http://www.cisco.com/warp/public/102/wired_guest_access.pdf>
    Also keep in mind that the clients and the controller needs L2 adjacency (i.e. the Guest-VLANs would need to be trunked directly to the controller where you define the Guest-WLAN).
    I assume you have already deployed an anchor controller for wireless Guest traffic. So, the idea is to leverage the same EoIP tunnel infrastructure also for wired guest traffic. DHCP/DNS traffic should be blindly tunneled across this infrastructure, so your network services should be deployed in the anchor controller location (i.e. DMZ). Keep in mind again, that this design implements a logical L2 connection from the endpoints to the anchor controller.
    Hope this helps,

  • Ask the Experts: Wired Guest Access

    Sharath K.P.
    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions on wired guest access with expert Sharath K.P. Wired guest access enables guest users to connect to the guest access network from a wired Ethernet connection designated and configured for guest access. Sharath K.P. is a Customer Support Engineer specialized in wireless and switching technologies at the Technical Assistance Center in Cisco Bangalore. He has been troubleshooting wireless and switching networks and management tools since 2009. Sharath has a bachelor's degree in Electrical Electronics Engineering from P.E.S College of Engineering (PESCE), VTU at Belgaum. India. He holds CCNP certifications in R&S and Wireless.
    Remember to use the rating system to let Sharath know if you have received an adequate response. 
    Sharath might not be able to answer each question due to the volume expected during this event.
    Remember that you can continue the conversation on the Wireless and Mobility sub-community discussion forum shortly after the event. This event lasts
    through January 27, 2012. Visit this forum often to view responses to your questions and the questions
    of other community members.

    Hi Daniel ,
    Wonderful observation and great question .
    Yes, we dont find any recommendation or inputs in Cisco Docs on scenarios  where  we  have multiple foriegn WLC's present .When we go through the Cisco Doc available for Wired Guest Access
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00808ed026.shtml
    Two separate solutions are available to the customers:
    A single WLAN controller (VLAN Translation mode) - the access switch  trunks the wired guest traffic in the guest VLAN to the WLAN controller  that provides the wired guest access solution. This controller carries  out the VLAN translation from the ingress wired guest VLAN to the egress  VLAN.
    Two WLAN controllers (Auto Anchor mode) - the access switch trunks  the wired guest traffic to a local WLAN controller (the controller  nearest to the access switch). This local WLAN controller anchors the  client onto a DMZ Anchor WLAN controller that is configured for wired  and wireless guest access. After a successful handoff of the client to  the DMZ anchor controller, the DHCP IP address assignment,  authentication of the client, etc. are handled in the DMZ WLC. After it  completes the authentication, the client is allowed to send/receive  traffic.
    So  as per Cisco best pratices using multiple foreign controllers for the same wired guest VLAN is not supported and the results will be unpredictable
    I do understand the confusion regarding such scenario's as this( Multiple foriegn WLC's) is a very general setup which customer would like to deploy .
    We have already opened a bug for the same (Little late though )
    BUG ID :CSCtw44999
    The WLC Config Guide should clarify our support for redundancy options for wired guest
    Symptom:
    Do not trunk a wired guest VLAN to multiple foreign controllers.  This is not supported, and will
    generate unpredictable results.
    Some of the other tthat changes we will be making as a part of doc correction would be
    http://www.cisco.com/en/US/docs/wireless/controller/7.0MR1/configuration/guide/cg_user_accts.html#wp1066125
    1. The WiSM2 needs to be added as a supported controller.  (Not sure about the 7500, check with PM)
    2. Where it says "Do not attempt to trunk a guest VLAN on the Catalyst 3750G ...", this should read:
    "Do not trunk a wired guest VLAN to multiple foreign controllers.  This is not supported, and will
    generate unpredictable results."
    3. Add at least a line mentioning support for multiple anchors for a guest wired LAN.
    Now  if you already have such deployments , ther criteria would be that nearest WLC on the broadcast domain (Layer 2) would  respond to the client associtation request .
    Cisco Controller) >Tue Sep 11 13:27:42 2007: 00:0d:60:5e:ca:62 Adding mobile on Wired Guest 00:00:00:00:00:00(0)
    Tue Sep 11 13:27:42 2007: 00:0d:60:5e:ca:62 apfHandleWiredGuestMobileStation (apf_wired_guest.c:121) Changing state for mobile
    00:0d:60:5e:ca:62 on AP 00:00:00: 00:00:00 from Idle to Associated .
    I hope the above explanation could clarify your doubts to certain extent and also keep you
    informed on Cisco's  roadmap on this feature .
    Regards ,
    Sharath K.P.

  • ISE with CWA and wired guest access via WLC Anchor

    Can an Anchor WLC (WLCa) provide a wired guest LAN service if the wlan guest access is using CWA?
    We are deploying a WLAN only ISE solution (it is a full license ISE though) but they just want a few wired guest ports.  I was hoping to add L2 switch to the DMZ where the WLCa is and that the L2 switch wouldnt need any other config as the WLCa just bridges the wired to the wlan vlan.  This Im sure i have done before.
    So now I have set wiredguest the same as i have done before ISE and my wired clients get an IP address, but when they redirect, the URL they get is different, and the redirect just doesnt work.
    It comes out as:
    https://my_ise_ip:8443/guestportal/Login.action?switch_url=https://my_ise_host/login.html&wlan=my_wired_guest_lan&redirect=www.google.co.uk
    So does my simple L2 only switch need an ISE config on it or should the WLCa be handling or the redirection just as it would for a wlan device.

    The ISE never receives an auth entry, so i dont believe the redirect is working for the wired client.  So even though the clients browser gets a redirect url which fails connection, the client info in the WLCa doesnt have a redirect ACL listed like a wlan client would

  • Guest LAN and WLAN on Controller

    Hi,
    While creating new ssid, i can see the option guest lan and wlan, whats the difference? which one is preffered?
    Thanks in advance..

    Hi,
    I remember answering this few days and also George joined the thread.. or max week back..
    Guest LAN WLAN =
    1> The clients connecting to the WLAN will have a time limit on the connectivity, for example you can configure the Guest WLAN for 24 hours or something which you want..
    2> I guess George pointed this in the previous thread.. Can be used for Wired Guest Users configuration as well , here is the link..
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008070ba8f.shtml
    WLAN =
    Just nothing but a SSID with security which doesnt have any time limit.
    which one is preffered? =
    Its your network and what ever meets your requirements you can use that.. however both of them does its job with different features involved.
    lemme know if this answered your question..
    Regards
    Surendra
    ====
    Please dont forget to rate the posts which answered your question and mark it as answered or was helpfull

  • Wired guest access support on SRE G2

    I have been trying to find info on support for wired guest access on SRE wireless module. Is it supported? Also, does 2100 wlc support it? I am running into sizing issues as I am seeing in documentation that it is supported on WiSM, 4400 (end of life), 5500, and 3750G (end of life). So, Am I only left with 5500? These are bunch of branch offices and do not know if having 5500 in each site is financially feasible. There is a requirement to have all these networks separate so we cannnot share controllers. Thank you in advance.

    It's more like "all WLCs support what is in config guide unless stated otherwise".
    http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps7206/ps7221/product_data_sheet0900aecd805aaab9.html
    the Cisco 2100 Series enables administrators to  securely manage WLANs and mobility services, such as enhanced security,  voice, guest access, and location services."
    It says nowhere that the SRE can't do wired/wireless. So it does the same as other WLCs from that point of view

Maybe you are looking for