Enabling TLS for management access in WLC

Hi all,
We want to disable to SSL v2 and SSL v3 for WLC web management . And we want to enable TLS version for web gui access. I have seen the below command to disable SSL v2
config network secureweb cipher-option sslv2 {enable | disable}
But i havent found for SSLv3 and TLS
Thanks,
Vijay

Yeah.. Even we tried with chained for that coz we got that oly form our CA. It was not working as expected.
What i need is to know about the unchained certificate..?

Similar Messages

Enabling TLS for tcp_submit

Hi, I'd like to enable tls capability for tcp_submit channel. Trying to submit using Thunderbird and setting outgoing smtp to use TLS I get an error saying my MTA doesn't offer this capability. Same error for SSL. Per Msg ref guide notls is default
http://docs.sun.com/source/819-0106/mta_config.html#wp1025975
but tcp_submit has maytlsserver keyword. What change is needed to allow tls?
Sun Java(tm) System Messaging Server 6.2-4.03 (built Sep 22 2005)
libimta.so 6.2-4.03 (built 04:37:42, Sep 22 2005)
SunOS mmp 5.10 Generic_118822-11 sun4u sparc SUNW,UltraAX-i2
! tcp_submit
tcp_submit slave_debug master_debug submit smtp mx single_sys mustsaslserver maytlsserver missingrecipientpolicy 4
tcp_submit-daemon
Thanks,
d.

likely, your client is talking on port 25, so you'll
need to put your "maytlsserver" in your tcp_local
channelI can confirm it talks to tcp_submit, I can see it in tcp_submit_slave.log.
14:41:54.83: Listing available SASL mechanisms
14:41:54.83: SASL mechanism list status = 0
14:41:54.83: Sending : "250-AUTH PLAIN LOGIN"
14:41:54.83: Sending : "250-AUTH=LOGIN"
14:41:54.83: Sending : "250-NO-SOLICITING"
14:41:54.83: Sending : "250 SIZE 0"
My client complains STARTTLS is not offered in EHLO responce.
Another bit of information, this is what I get while connecting to smtp or submit port and issuing
STARTTLS
454 4.7.1 TLS library initialization failure.
pop/imap works fine with ssl. I think all permissions are ok.

Wake for network access keeps getting enabled by something

10.7.2 on a mac mini
Under prefs > Energy Saver I set checked on all the checkboxes except Wake for network access
It's also scheduled to turn "Shut down" early evening and Start up or wake early morning.
However - when I check back later in the day - they are all checked including the Wake for network access.
I thought I was imagining this - so I ran thru it several times today - and yes - it's disabled - and then later its enabled.
Can't find out any pattern in the duration between but it keeps turning on.
(I'll also note that the scheduled shutdown does not work when a user is logged in - but I've read elsewhere that this is known).
All of this behaved on 10.6 - so it's a bit of a step back right now.
Any hints as to what is enabling wake for network access would be gratefully received

Do you connect via WiFi but still have an ethernet cable plugged in? I do... I'm wondering if this is the problem...
Try this (it's what I'm doing) - go to Preferences>Network
Make sure WiFi is at the top of the list (click the cog to reorder them)
See if that fixes it.
It's soooo annoying!

WLC as a Mobility Anchor for guest access - Management on DMZ or not DMZ

When using Guest Access Cisco recommend a Mobility Anchor Controller be placed on a DMZ and the guest access wireless Lan is tunneled to this controller. This means that 2 DMZ subnetworks are required - one for the management interface and one for the wireless lan's dynamic interface itself.
I am trying to see if there are any disadvantages/security risks using 2 physical ports on the controller (no LAG) and placing one on a corporate network inside the firewall for management and to terminate the mobility anchor tunnel, and one outside the firewall on a DMZ for the wireless lan's dynamic interface.
Advantages that I see are that no tunnels need to go though a firewall, management of the WLC is kept completely inside the corporate network, protected by the firewall and not left on the DMZ.
Thanks.

OK, so to recap;
- place the 2nd WLC in the DMZ with only 1 port (set for dynamic AP management)?
- Then Anchor the guest SSID (on it's DMZ IP instead of management IP as is now)
And to make that kind of anchoring work, I have to open ports below on the firewall.. right?
UDP port 16666 for inter-WLC communication, and IP protocol ID 97 Ethernet in IP for client traffic.
and:
•TCP 161 and 162 for SNMP
•UDP 69 for TFTP
•TCP 80 or 443 for HTTP, or HTTPS for GUI access
•TCP 23 or 22 for Telnet, or SSH for CLI access
Thanks to confirm that

2504 with new-architecture enabled breaks MAC auth for guest access

Hello,
We have (2) 2504 WLC running version 7.6.120. WLC1 is the local controller and WLC2 is an achor controller for guest-access. We need to incorporate a 3850 for use with the WLC2 anchor. The guest access is currently working with Mac-Auth and Mac-Auth-Fail to Web-Auth.
When converged access is enabled on the WLC1 and WLC2, the MAc-Auth no longer works. That is, the previously authenticated user is now redirected to the Web-Auth page. The local controller shows the user as authenticated but the Anchor controller shows the state as WEb-Auth-REQD.
Rolling back using "config mobility new-architecture disable" and rebooting resolves the issue.
Does anyone what changes from the old to the new that would break this mac-auth/web-auth configuration?

You should reach TAC for these sort of issues. Not many people deploying this CA setup yet & you may not get direct feedback immediately.
HTH
Rasika

***WLC AAA for admin access***

I am trynig to set up radius authentication for access onto the WLC for management, ssh/telnet and GUI. The RADIUS settings are correct to the IAS server, and the management tab is selected within the RADIUS properties page.
The provider order was changed to include radius before local, and the admin account was created in AD. When I now tried to telnet/SSH onto the command line of the WLC, i could see from the radius log that i was been succesfully authenticated, but it would not let me onto the cmd line??? it just returns me to the username prompt?
Any isead what im missing?

Complete these steps in order to add the WLC as an AAA client in the ACS.
From the ACS GUI, choose the Network Configuration tab.
Under AAA Clients, click Add Entry.
In the Add AAA Client window, enter the WLC host name, the IP address of the WLC, and a shared secret key. See the example diagram under step 5.
From the Authenticate Using drop-down menu, choose RADIUS .
Click Submit + Restart in order to save the configuration.

Snmp error for guest access ticket on two WLC

Hi,
I have one wcs (5.0.56.2) and two wlc 4400 ( 5.0.148.2). When i try to create a ticket for guest access on the two wlc without time restriction, it works well. But when I defined time restriction for the ticket, i have a snmp error on the passive wlc (snmp operation to device failed, attempt to set conflicting attribute value) and not on the active xlc.
Thks.

The lobby ambassador can specify the amount of time that the guest user accounts remain active. After the specified time elapses, the guest user accounts expire automatically.
The local user database is limited to a maximum of 2048 entries and is set to a default value of 512 entries (on the Security > General page). This database is shared by local management users (including lobby ambassadors), net users (including guest users), MAC filter entries, and disabled clients. Together these cannot exceed the configured database size.
For the configuration following URL may help you
http://www.cisco.com/en/US/docs/wireless/controller/5.0/configuration/guide/c5users.html

E4200v2: Local Management Access via Wireless *ALWAYS* Enabled

I just found a slightly unsettling bug in the E4200v2 (running the latest firmware 2.0.36 build 126507).
Administration > Local Management Access > Access via Wireless ... set to DISABLED.
HOWEVER, when I attempted to access the web interface on a handy iPAD I had absolutely no problem getting through to the web interface (after providing username and passsword).
Limiting access to wired clients seems like a simple a prudent measure ... which is why this option is there for the paranoid among us.
This seems like a black-and-white bug. Comments welcome. Fix in the next firmware revisio even more welcome.

It was mentioned in another thread that disabling wireless management does indeed disable http access over port 80. However, if you're using https access--which uses port 443, that access is not blocked. So for anyone who wants to disable wireless management access, you need to enable management access via http only, and then disable the wireless access. That combination will indeed work.
I have confirmed this on my own router and can now only manage via wired connections over http.
Strange bug/oversight!

Enabling SSL for Oracle Enterprise Manager 10.1.3.1 is Failing!!!

Hi All,
I have followed the steps described in
http://download-uk.oracle.com/docs/cd/B31017_01//core.1013/b28940/em_app.htm#BABCEEAH.
However when I am trying to start the application server using 'opmnctl startall' the server is not starting and some timeout is getting generated in the log file.
Is it that enabling SSL will only make the EM console secured? Then how to enable SSL for other soa components like - BPEL,ESB,OWSM? Are there any documentations available?
Also please let me know how can I enable SSL for Oracle Application server console?
Please any advice will be appreciated. I am in the middle of a project delivery.
Thanks

Hi,
Let me first highlight the installation that I have done. I have installed SOA components with 'basic installation' mode.
The log file under <ORACLE_SOA_HOME>/opmn/config/ has generated the following stack:-
08/07/25 11:03:34 Start process
08/07/25 11:03:37 WARNING: XMLApplicationServerConfig.overwriteSiteConfigPort Port assignment is ignored: web-site not found in the server OC4JServiceInfo id: default-web-site protocol: http hostname: null port: 8890 description: null
08/07/25 11:03:37 WARNING: XMLApplicationServerConfig.overwriteSiteConfigPort Port assignment is ignored: web-site not found in the server OC4JServiceInfo id: secure-web-site protocol: https hostname: null port: 1156 description: null
08/07/25 11:03:47 log4j:WARN No appenders could be found for logger (wsif).
08/07/25 11:03:47 log4j:WARN Please initialize the log4j system properly.
08/07/25 11:03:53 WARNING: OC4J Service: ascontrol-web-site with protocol: https and port: 1156 was not declared in opmn.xml
08/07/25 11:03:53 Oracle Containers for J2EE 10g (10.1.3.1.0) initialized
08/07/25 11:03:53 WARNING: OC4J will not send ONS ProcReadyPort messages to opmn for service: OC4JServiceInfo id: default-web-site protocol: http hostname: null port: 8890 description: null
08/07/25 11:03:53 default-web-site hostname was null
08/07/25 11:03:53 WARNING: OC4J will not send ONS ProcReadyPort messages to opmn for service: OC4JServiceInfo id: secure-web-site protocol: https hostname: null port: 1156 description: null
08/07/25 11:03:53 secure-web-site hostname was null
On the command prompt I am getting the following error:-
opmn id=CALTP8BB32:6203
0 of 1 processes started.
ias-instance id=home.CALTP8BB32.cts.com
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
ias-component/process-type/process-set:
default_group/home/default_group/
Error
--> Process (index=1,uid=301928631,pid=2944)
failed to start a managed process after the maximum retry limit
Log:
D:\product\SOASuite\opmn\logs\\default_group~home~default_group~1.log
--------------------------------------------------------------+---------
ias-component | process-type | pid | status
--------------------------------------------------------------+---------
OC4JGroup:default_group | OC4J:home | N/A | Down
ASG | ASG | N/A | Down
Please let me know where am I going wrong?
Thanks,
Mandrita.

Username and password for Sun Access Manager 7.1

Hi
Thank you for reading my post
I ge the new Java Application Platform SDK Update 2 which has access manager and portlet management inside it.
Can you tell me what is username and password for Sun access Manager 7.1 administration cosole?
thanks

with me it was amadmin : admin123
in the readme file in the addons directory:
Done! Access the AM server URL and see if the Access Manager is working or not -
<amserver_protocol>://<amserver_host>:<amserver_port>/amserver
user : 'amadmin', password : <admin password>
in a config file i found the password was admin123

H-reap AP user access to WLC management IP?

I know that H-Reap AP and the users connected to that AP are not able to access WLC management IP, but is that any official documentation saying that? Because i'm not really understand the H-reap concept and why can't access WLC management IP, is there any work around so that H-reap ap users are able to access it?

it works.. clients will be able to access the wlc GUI, telnet and SSH.. this bug is the proof..
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtq57406
please dont forget to rate the usefull posts!!
Regards
Surendra

Need to change the Certificate in ACE that is using for HTTPS Management access

Dear Team,
Currently we are getting certificate cannot be trusted error in web browser while we are accessing the ACE through https. So we need to installed the new https certificate for https management connection to ACE for removing this error. We do not want to use the self signed certificate for https access to ACEmanagement. We have done the below configuration but there no luck, still its showing the previous self signed certificate in browser.
parameter-map type ssl MNGMT_SSL
cipher RSA_WITH_AES_128_CBC_SHA priority 2
ssl-proxy service PSERVICE_SERVER
key ACEKEY.key
cert ACECERT.cert
ssl advanced-options MNGMT_SSL
Kindly suggest how we can installed the certificate on ACE for only https management access.
Thanks in advance.
Regrads,
Ranjith

Ranjith,
You may want to see the details and recommendation relatedo to this situation and this bug:
CSCte42757
Jorge

Simple file server accessible remotely with managed access. Do I need ML Server for this?

Hello,
I have a Mac Mini that will be dedicated to serving 15 folders of documents to 7 people. It would be great if each person had their own password and I'd like to be able to decide what folders each user will have access to. The people need to be able to access the files from home and on the office network.
Do I NEED to run OS X server for this Or can i accomplish this in OS X?
I have to get this running quickly and I may not have time for the ML Server learning curve (even though it has been simplified).
I tried to get ML server running on my machine a few weeks ago but got stuck. If setting up ML server with JUST the file server is dramatically easier I will try again. Can anyone please suggest a tutorial that takes me through simply setting up a remotely accessible file server with managed access with ML Server?
V

OS X client can serve files to remote clients, via both SMB/CIFS and AFS; via the Windows and OS X fiel services. That's cheap, uses hardware you already have, and works fine.
Most NAS boxes don't do distributed authentication. Typically, you have credentials for the box at most. Some of the mid- and upper-end boxes do offer distributed authentication, but that means having that authentication around. At the low end, an Apple Time Capsule is a reasonable NAS box, and you can add an external disk. And can be used for backups via Time Machine, too. The mid- and upper-end boxes from Synology have a reputation for capabilities and flexibility. There are (many) other vendors.
I'm not a huge fan of LogMeIn for various reasons that I won't get into here, but that service does work for accessing hosts. I don't know if that allows access to NAS directly, but I'd tend to doubt it. You'd need to check with both LogMeIn and with the specs for whatever NAS box you're using.
Given the choice, I'd use a VPN.
Using a VPN does mean you can control — at the VPN level — who can access your private network, so that can provide a broad-brush form of access control to your NAS device or your OS X client or your OS X Server box, if you go that route.
I don't prefer to openly serve files to the internet, as the underlying protocols have occasionally had security issues and vulnerabilities, and the internet gremlins will find and will poke at any open ports and any accessible file servers. I prefer to configure these services via VPN.
VPNs are also more involved to set up, where LogMeIn can be simple.
As mentioned previously, I'm also not a huge fan of the host-based VPN servers in OS X, though those do work. The gateway boxes I've been using in the last year or so are probably not a good choice for a user that isn't familiar with networking — the boxes provide a user interface that very definitely expect the user to understand IP and routing and related, but is both self-consistent and quite powerful — and they're cheap for what they can do, and they do work nicely. ZyXEL ZyWALL USG series. If you are evaluating any of these firewall boxes, then I'd definitely encourage downloading the manuals and making sure you can understand the available information. The server-grade firewall boxes are almost inherently flexible and thus complex devices.
One of the easiest ways is to work with somebody that does this sort of thing to sort through the options and requirements and trade-offs available here, and potentially to set up your VPN or NAS or server configuration for you. (Disclosure: I offer this.)

Does sun provide a training for sun access manager customizations

Hi,
Is there any training available from sun for sun access manager customizations.
I am aware of the following training from sun AM-3480
TIA,
Suresh

Hi, Suresh,
There's some material about customization in AM-3480. What areas are you interested in?
Regards,.
David

WLC 5508 AD authentication for management

Hi,
I was wondering if it is possible to set up a 5508 to authenticate to AD for management. Currently, all of our Cisco devices authenticate to AD through NPS running on a windows 2008 server and if the server is unavailable, they failover to local authentication. I'd like to do this on our new controller but I can't seem to find the correct info on how to do this, if it can. All my searches result in instructions on how to authenticate wireless users.
Thanks

Yes, you can via NPS (Radius) which then ties into AD. Here is a Cisco exmaple document:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080782507.shtml
I hope this helps...

Enabling TLS for management access in WLC

Similar Messages

Maybe you are looking for