How do I configure a cisco 1131 AP to use WPA2 enterprise and authenticate to Active Directory

I have a Win2008 server set up as a radius server (192.168.32.71) and a stand alone AP (192.168.201.9) The AP is config is below:
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname ap
enable secret 5 $1$IdUV$UvE2IJTNzHX6mW6Mmh3At0
ip subnet-zero
ip domain name TKGCORP.local
ip name-server 192.168.32.71
aaa new-model
aaa group server radius rad_eap
aaa group server radius rad_mac
aaa group server radius rad_acct
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa group server radius rad_eap1
server 192.168.201.9 auth-port 1812 acct-port 1813
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authentication login eap_methods1 group rad_eap1
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
dot11 ssid ka_test
   vlan 201
   authentication open eap eap_methods1
   authentication network-eap eap_methods1
   guest-mode
power inline negotiation prestandard source
username Cisco password 7 112A1016141D
username tkgadmin privilege 15 password 7 022D167B06551D60
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption vlan 201 mode ciphers aes-ccm tkip
encryption key 1 size 128bit 7 673B0AA56FCB4E630D8E4856427E transmit-key
encryption mode wep mandatory
broadcast-key change 150
ssid ka_test
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio0.201
encapsulation dot1Q 201
no ip route-cache
bridge-group 201
bridge-group 201 subscriber-loop-control
bridge-group 201 block-unknown-source
no bridge-group 201 source-learning
no bridge-group 201 unicast-flooding
bridge-group 201 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
encryption key 1 size 128bit 7 B711059074E30B1E1D4E3EC038BB transmit-key
encryption mode wep mandatory
broadcast-key change 150
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
hold-queue 160 in
interface FastEthernet0.201
encapsulation dot1Q 201
no ip route-cache
bridge-group 201
no bridge-group 201 source-learning
bridge-group 201 spanning-disabled
interface BVI1
ip address 192.168.201.9 255.255.255.0
no ip route-cache
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
radius-server local
  no authentication eapfast
  no authentication mac
  nas 192.168.201.9 key 7 010703174F
radius-server attribute 32 include-in-access-req format %h
radius-server host 192.168.32.71 auth-port 1645 acct-port 1646 key 7 0835495D1D
radius-server host 192.168.201.9 auth-port 1812 acct-port 1813 key 7 0010161510
radius-server vsa send accounting
control-plane
bridge 1 route ip
line con 0
line vty 0 4
end

Sorry for the late reply Steve. The link you provided was extremely helpful here is what my config  looks like now:
ersion 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname ap
enable secret 5 $1$7vHS$YWCMbrlAgDUayKlOHhMlF1
ip subnet-zero
ip domain name TKGCORP.local
ip name-server 192.168.32.71
aaa new-model
aaa group server radius rad_eap
server 192.168.32.71 auth-port 1645 acct-port 1646
aaa group server radius rad_mac
aaa group server radius rad_acct
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
dot11 ssid wap_test
   authentication open eap eap_methods
   authentication network-eap eap_methods
   authentication key-management wpa
   guest-mode
   infrastructure-ssid optional
power inline negotiation prestandard source
username Cisco password 7 047802150C2E
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption mode ciphers tkip
ssid wap_test
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
hold-queue 160 in
interface BVI1
ip address 192.168.201.9 255.255.255.0
no ip route-cache
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
radius-server attribute 32 include-in-access-req format %h
radius-server host 192.168.32.71 auth-port 1645 acct-port 1646 key 7 071B245F5A
radius-server vsa send accounting
control-plane
bridge 1 route ip
line con 0
line vty 0 4
end
I get a login screen but it will not let me connect, on my radius server I have it set to allow a group that my username is in. Here are some debugs from when I try to connect to the AP:
ap#debug aaa  authentication
AAA Authentication debugging is on
ap#
*Mar  2 01:11:53.284: AAA/BIND(00000006): Bind i/f 
*Mar  2 01:11:53.355: AAA/AUTHEN/PPP (00000006): Pick method list 'eap_methods'
*Mar  2 01:11:54.556: %DOT11-7-AUTH_FAILED: Station c0cb.3835.a102 Authentication failed
*Mar  2 01:11:55.280: AAA/BIND(00000007): Bind i/f 
*Mar  2 01:11:55.404: AAA/AUTHEN/PPP (00000007): Pick method list 'eap_methods'
*Mar  2 01:11:56.349: AAA/BIND(00000008): Bind i/f 
*Mar  2 01:11:56.525: AAA/AUTHEN/PPP (00000008): Pick method list 'eap_methods'
*Mar  2 01:11:57.300: AAA/BIND(00000009): Bind i/f 
*Mar  2 01:11:58.070: AAA/BIND(0000000A): Bind i/f 
*Mar  2 01:11:58.812: AAA/BIND(0000000B): Bind i/f 
*Mar  2 01:12:15.470: AAA/AUTHEN/PPP (0000000B): Pick method list 'eap_methods'
*Mar  2 01:12:15.492: %DOT11-7-AUTH_FAILED: Station c0cb.3835.a102 Authentication failed
ap#undebug all
All possible debugging has been turned off

Similar Messages

  • How do I configure a counter to generate pulses using DAQmx?

    How do I configure a counter to generate pulses using DAQmx?
    Is says in the DAQmx C reference help
    "CtrnInternalOutput—The signal at this internal terminal is where the pulsed or toggled output of the counter appears. The output of a counter pulses or toggles when the counter reaches terminal count. When counting down, the counter reaches terminal count when the count reaches zero. When counting up, the counter reaches terminal count when the counter rolls over. To configure the counter to toggle or generate pulses, use the Export Signal function/VI with Counter Output Event as the signal name."
    I've tried this but can't get it to work, I may have the parameters wrong or something. The DAQmxExportSignal() function is very unintuitive to me. Here is my counter config code...
    int ret = 0;
    ret = DAQmxCreateTask("",&task_);
    errorMsg(ret);
    if (ret != 0)
    throw ret;
    // Configure the counter
    ret = DAQmxCreateCOPulseChanTicks( task_, "Dev1/ctr0", "", "/Dev1/PFI8", DAQmx_Val_Low, 0, divider, divider );
    errorMsg(ret);
    ret = DAQmxCfgImplicitTiming( task_, DAQmx_Val_ContSamps, 1000 );
    errorMsg(ret);
    // Change to pulse mode
    ret = DAQmxExportSignal( task_, DAQmx_Val_CounterOutputEvent, "/Dev1/Ctr0InternalOutput" );
    errorMsg(ret);
    // Start the counter
    ret = DAQmxStartTask(task_);
    errorMsg(ret);
    The above code works fine, in toggle mode, if I just comment out the DAQmxExportSignal() part.
    HELP!!!
    Stefan

    The problem is due to the DAQmxExportSignal call.  By default, when you create a counter output pulse train task, the driver will automatically set the output of the counter to toggle when the count for each high ticks and low ticks expire.  The driver also automatically routes the signal present at Ctr0InternalOutput terminal (the output of the counter internal to the device) to the Ctr0Out terminal (the I/O pin available externally).  Using the line
     ret = DAQmxExportSignal( task_, DAQmx_Val_CounterOutputEvent, "/Dev1/Ctr0InternalOutput" );
    will tell the driver to tristate the Ctr0Out terminal and not output the signal to the external I/O pin.  Using the DAQmxExportSignal function is generally only useful if you want to route the signal to some other terminal internal to the board without having the output show up on the external connector, route the signal to some other external pin other than the default pin, or if you want to have the output show up at multiple locations. 
    If you want to change the output behavior from toggle to pulse, you need to use the DAQmxSetExportedCtrOutEventOutputBehavior function.  However, this is generally only useful if all you care about are edges (not the duty cycle of the pulse train), and you want to generate higher frequency signals.  For example, with a 20 MHz timebase as the source of your counter, you can only generate a 5 MHz pulse train by default.  This is because the minimum value for the low and high ticks parameter is 2 (20 MHz / 4 = 5 MHz).  By changing the output behavior form toggle to pulse, you can generate a pulse train at 10 MHz since the output is now pulsing instead of toggling.  However, the width of each pulse is not programmable so you will no longer have a 50% duty cycle signal.  I don't remember exactly what the width of each pulse is, but I believe it's in the neighborhood of 50 - 100 nanoseconds in width.  I hope this information helps.

  • How do I configure Soundtrack Pro2 to play audio using Digidesign 002 Rack?

    How do I configure Soundtrack Pro2 to play audio using Digidesign 002 Rack? I have no problem using Logic 8 with the 002 Rack?
    Can somebody explain the necessary process to make this work. Thanks

    Add is probably not the best choice of terminology.
    Going from memory (since I'm at home), you need to launch digiCoreAudio, then select your output in the System prefs as your digi hardware. After that you would see the digi hardware as an output in STP.

  • Cisco 1140AP using WPA2-enterprise with radius

    All,
    I am trying to configure an1140 AP to use WPA2-enterprise & radius. Ultimately I want to be able to connect to the SSID using my active directory credentials. I would like the AP to send authentication requests to our Network Policy Server. Here is a copy of the config; any help is appreciated.
    version 12.4
    no service pad
    aaa new-model
    aaa group server radius rad_eap
    server 172.16.16.101 auth-port 1812 acct-port 1813
    aaa group server radius rad_mac
    aaa group server radius rad_acct
    aaa group server radius rad_admin
    aaa group server tacacs+ tac_admin
    aaa group server radius rad_pmip
    aaa group server radius dummy
    aaa group server radius rad_eap1
    aaa authentication login myLogin local
    aaa authentication login eap_methods group rad_eap
    aaa authentication login mac_methods local
    aaa authentication dot1x rad_eap group radius
    aaa authorization exec default local
    aaa accounting network acct_methods start-stop group rad_acct
    aaa session-id common
    dot11 syslog
    dot11 ssid ITWireless
       authentication open eap rad_eap
       authentication key-management wpa version 2
       guest-mode
    username admin password 7 XXXXXXXXXXXXXXXXXXXXX
    bridge irb
    interface Dot11Radio0
    no ip address
    no ip route-cache
    encryption mode ciphers aes-ccm
    ssid ITWireless
    antenna gain 0
    interface Dot11Radio1
    no ip address
    no ip route-cache
    encryption mode ciphers aes-ccm
    ssid ITWireless
    interface BVI1
    ip address 172.16.42.21 255.255.0.0
    no ip route-cache
    ip default-gateway 172.16.16.198
    ip http server
    no ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip radius source-interface BVI1
    radius-server attribute 32 include-in-access-req format %h
    radius-server host 172.16.16.101 auth-port 1812 acct-port 1813 key 7 1427321938572903
    radius-server vsa send accounting
    bridge 1 route ip

    I did see those screenshots however that settings screen comes from selecting the Configure button next to the Authentication Method in the User Authentication section under Users.  In each of your screenshots, the RADIUS Server ID number is 1 so I would also ensure that I've configured RADIUS Server ID 1 which can only be configured by going to Users -> RADIUS Servers.
    All that said, I did see that your tests succeeded and I also don't understand the point of having RADIUS settings on the other screens and then having RADIUS ID info.  My thinking is that you would be able to configure RADIUS once in the Users -> RADIUS Servers screen and then select the RADIUS Server ID in all the remaining screens without having to enter the RADIUS info over and over again.  It would also think that you could skip the Users -> RADIUS Server screen and enter the RADIUS information over and over again and it should work...just like you set it up originally.  However, based on past experience of programmatic errors, I would recommend configuring the RADIUS Server ID 1 under Users -> RADIUS Servers if you haven't already...just in case. 
    Shawn Eftink
    CCNA/CCDA
    Please rate all helpful posts and mark correct answers to assist others searching for solutions in the community.

  • How i use OEM 12c to monitor Microsoft Active directory.

    Hi,
    How i use OEM 12c to monitor Microsoft Active directory.Please assist me on this.
    Thanks,
    Sagar

    Hi,
    The fundamental problem with this scenario is that you have non-failover capable modules in a failover chassis - think of the ASA failover pair as one device and the IPS modules as two completely separate devices.
    Then, as already mentioned, add only the primary ASA. (The secondary will never be passing traffic in standby mode so it's not actually needed in MARS) Then, with the first IPS module you can add it as a module of the ASA or as a standalone device (MARS doesn't care). With the second IPS module the only option is to add it as a separate device anyway.
    In a failover scenario the ASA's swap IP's but the IPS's don't so whereas you'll only ever get messages from the active ASA you'll get messages from both IPS IP's depending on which one happens to be in the active ASA at the time.
    Don't forget that you have to manually replicate all IPS configuration every time you make a change.
    HTH
    Andrew.

  • I bought an iphone 4 used. I installed ios7 before I realized that the previous owners e mail and password are still in the phone. How can I remove this so that I can use the cloud and "find my phone " features?l an

    I bought a used iphone. I installed ios 7 before I realized that the previous owner's email and password are still in the phone. How can I remove them so that I can use the icloud and "find my phone" feature?

    Thanks so much! It will be kinda weird to contact the person directly, but I guess I will give it a try. Is there anything that I can refer her to in this discussion to let her know I am legit, and not a creeper? Also, I don't know if you can answer this or not. When I plug my phone into itunes, and it says that it is backing up, does that mean that it is going into the other person's cloud, since I cannot access it?

  • HT4623 How do I update to IOS 7.0.2 using my computer and Itunes?  I have upated to V 11.1. and have my Iphone attached to tower but I am unable to install.  "Download and Install" is still grayed out.

    How do I update to IOS 7.0.2 using my computer and Itunes?  I have upated to V 11.1. and have my Iphone attached to tower but I am unable to install.  "Download and Install" is still grayed out.

    This is a concern amoung many corporate users.  It's going to take somekind of policy change with apple.
    Enterprise support:
    Call enterprise support  (866) 752-7753  to create  a case ID number

  • How can I set up a guest WiFi network using Time Capsule and Airport Express extension?

    How can I set up a guest WiFi network using Time Capsule and Airport Express extension?

    Sorry, but it is not possible to "extend" the Guest Network using either wireless or an Ethernet connection.

  • My power button doesnt work, jammed. How can i reset my phone if i cant use power button and home key to reset?

    my power button doesnt work, jammed. How can i reset my phone if i cant use power button and home key to reset?

    snystrom wrote:
    my power button doesnt work, jammed.
    Is this an iPhone 5?
    If so, see this -> iPhone 5 Sleep/Wake Button Replacement Program

  • How we archieve configuration for Cisco ASA 5500 series appliances

    Hi,
    We need to archieve configuration for Cisco ASA 5500 series appliances.
    We have Cisco works LMS 3.0.1.
    Device package installed is 4.2
    Any help would be appricated.
    Thanks in advance.
    Samir

    Hi ,
    Thanks for your answer.
    Right now we are using TACAS to login in to the ASA. That means we need single username and password to login via
    Cisoworks. Am I correct ?
    Waiting for your reply.
    thanks,
    Samir

  • How to properly configure a graphics card for Adobe Premiere Pro, SpeedGrade, and After Effects?

    Alright, so I have the following system configuration:
    2 NVIDIA Geforce GTX 970s
    5960X CPU
    MSI X99 Gaming 7 Motherboard
    32 GB DDR4 RAM
    256 GB and 1TB Samsung 850 Pro SSDs
    Basically, although I have the whole system built together, I'm unsure how to check and know whether or not Adobe Premiere Pro is actually using the graphics card or not.  I know that it has to be using some of it, otherwise it wouldn't launch properly (as I discovered from a recent experience.)  However, I don't know if there are, perhaps, certain settings within the NVIDIA control panel that should be configured so that Premiere Pro can use the card to its full potential.  Here is an example of what I'm talking about:
    In other words, these are (I'm pretty sure) all of the default settings that the control panel applies to Premiere Pro.  However, I'm not sure if there are any settings in here that I need to change or not.  So what I'm looking for in a response to this question:
    What settings, if any, should I change for Premiere Pro (as well as other adobe applications that can utilize all the strength of the GTX 970)?
    How can I check the GPU activity to know that it's being used during a render?  (For example, I can check the CPU utilization with the Task Manager while I render to see that it's being utilized to 100%).
    If, perhaps, something else goes wrong and even with the right settings, let's say the card still isn't being fully utilized, what other settings might I have to change to make sure that the GTX 970 is being fully used by Adobe Premiere Pro/After Effects/SpeedGrade CC 2014?

    If you want a benchmark to measure the performance of Premiere Pro's utilization of  your: disk system, GPU and CPU use our Premiere Pro BenchMark (PPBM)
    When you finish running the test and then run the script, you will get this report
    This happens to be the result of my laptop (with SSD drives and a GTX 765M GPU)
    The disk performance is self explanatory.
    Number 2 is a seven layer very complex timeline with heavy CPU and GPU assistance, without GPU hardware acceleration (CPU only) it would take greater than 1350 seconds.
    Three above is a measure of a exaggerated timeline using many, many GPU MPE accelerated effects and features that will use a GPU at 99% load (54 seconds above) and a CPU only export of the same timeline (802 seconds).
    If you want to compare your results to others you have to register on the PPBM7 site to see the results.
    EDIT! I corrected the number in 2 above originally I said 900 seconds but really it was greater than 1350 seconds

  • HT3529 How can I get dictation for my iPad for use with email and messaging

    How can I get dictation to use with messaging and email?

    Apple's dictation requires Siri, which requires a 3rd or 4th generation iPad (or iPad Mini).  See:
    http://support.apple.com/kb/HT5457
    Your post says you have a second generation iPad, so it will not have dictation.
    There are third party apps available that might help you.

  • How do I configure my Airport Extreme to work in Bridge Mode and provide specific IP addresses to clients

    My Airport Extreme is working with an Airport Express to wirelessly extend my wireless network.  Both Airports are configured in Bridge Mode per the instructions I found on Apple's support site.  I want to assign a specific DHCP address to a wireless camera that is in range of the Extreme, but I understand that the Extreme needs to be in DHCP Only mode to do this.  But if I change the mode to DHCP Only, the Extreme will lose contact with the Express.  How can I get both functions to work - wireless network extension and specific DHCP addresses?

    Then what device is providing DHCP? Only once device per subnet should be the DHCP server. One should be DHCP and NAT and the other in Bridge mode for most home setups. The unit with DHCP and NAT should be the one connected to your cable or DSL and the other set in Bridge mode only extends your network.
    On the wireless config page set whichever you're using to extend your network to "Extend a wireless network" and give it the details of the network to which you're attaching it.

  • How do you configure the set of port to use for FTP passive data connection

    I was able to start the ftp server xml db and connect to it locally. When I tried to connect to it from home, I was able to log in but when i do a "get" command the sessions hangs. I also tried passive mode and do a "get" command and it gives me a connection refused error. I am using the default port 2100. I think this might be a firewall issue with the data connection port. I am not sure which range of ports to open for the passive ftp connection on the server side or where to go and set them for for the ftp server to use? Or this issue might not be firewall related??? Any thoughts. Thanks.

    This is a typical problem with VPN/Firewall software and FTP on ports other than 21.
    When you open the FTP data connection the FTP Server identifies which port the data will be sent on using the PORT command which is sent on the command port (typically 21 with a normal FTP server, 2100 by default with XDB). THe client then opens that PORT to accept the data (file, output of an ls etc).
    As I understand it most VPN/Firewall are configured to monitor 21 for 'PORT' requests. They then understand to allow connection on the PORT number passed on the command PORT. Hence with Port 21 firewall / VPN software is not a problem. However since the XDB command PORT is something other than 21 they do not see / honour the PORT commands from the server and hence the client cannot open the data connection on the specified PORT
    As to how to solve it, I wish I knew (After 5 years I still can't use XDB FTP from home to a machine in the office once the VPN tunnel is open :( ). I'm sure it's going to be firewall / VPN software specific and may need the VPN servers to be configured.
    The best bet would be to run the FTP server on 21...
    Add the following line to your listener.ora file
    (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP) (HOST = hostname) (PORT = 21))
    (PROTOCOL_STACK = (PRESENTATION = FTP) (SESSION = RAW)))
    and then restart the listener as root
    Start the listener as root.
    At the operating system prompt, enter tnslsnr with optional command line arguments. The usage is as follows:
    tnslsnr [listener_name] [-user user] [-group group]
    where:
    Table 4-3 tnslsnr Utility Options
    Option Description
    listener_name
    Specify the name of the listener. If omitted, the default name LISTENER will be used.
    -user user
    Specify the user whose privileges the listener will use when super user (root) privileges are not needed. After performing the privileged operations, the listener will give up root privileges irreversibly.
    -group group
    Specify the group whose privileges the listener will use when super user (root) group privileges are not needed. After performing the privileged operations, the listener will give up root group privileges irreversibly.
    The listener will temporarily switch to the provided user and group immediately after startup. All subsequent operations will be done with the specified user and group privileges, except the system calls necessary to listen on configured endpoints. The listener will revert to super user (root) for a short period of time to listen on reserved addresses, such as TCP ports less than 1024. After the listener starts listening on all of its endpoints configured in listener.ora, it will switch to the specified user and group irreversibly. Therefore, the listener will give up the root privilege that it initially had. In the current release, -user and -group command line arguments only accept user and group identifiers specified in numeric form.
    For example, to execute a root listener called mylsnr and have it use privileges of a user identified

  • HT5697 How do i configure os x server wiki to use the external web server?

    I have a Mac mini Server with OS X 10.10 and Server 4.0 running in a DMZ behind a firewall. The firewall passes a select few ports through to this server, exposing services to the Internet.
    I use two domains, one dummy domain only available on my local networks, and one proper domain available globally. Lets call them «example.lan» and «example.com». These domains are not hosted on the Mac mini, btw.
    In the external domain, I have «server.example.com» registered on my firewalls official IP address.
    In my internal domain, I have «server.example.lan» registered to my Mac mini internal (rfc1918) IP address.
    Server 4.0 -> Websites seem to work as expected. I have three servers configured: «Server Website - All IP addresses», port 80 + 443. These serve the local networks. Then there is «server.example.com», port 443, serving the internet.
    Now to my question: How to I control which of these websites we Wiki uses?
    When I activate the Wiki, it is published on «server.example.lan/wiki», which seems rather pointless. In order for the wiki to be available to the internet, it needs to be published on «server.example.com/wiki», but I see no way of doing this. What am I missing here?
    Regards,
    Gakke

    it does look like you can add virtual domains in the GUI of Server.app on at least some versions, but I don't have an OS X Server 10.8 version handy to check.
    I'd encourage spending some time to learn the command line.  In general, the payoff for learning the command line will be worth the effort expended.  You're running a mail server here and sooner or later the capabilities of the GUI will fail you.  This whether due to a configuration omission in the GUI itself, or due to the need to troubleshoot a malfunctioning mail server, a need to automate one or more of the Postfix-related sequences, or some other IT-related task.  Entirely FWIW, of course.
    Here's a cut-and-paste of the sequence just used to test the command line access to the Postfix configuration, first fetching the current value, appending example.com as the second domain, then displaying the new value, then restarting the Postfix server.  Don't enter the dollar signs; just the postconf command and following.  Adjust example.com to match your domain...
    $ postconf mydestination
    mydestination = $myhostname, localhost.$mydomain, localhost
    $ sudo postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost, example.com'
    Password: {your admin password here}
    $ postconf mydestination
    mydestination = $myhostname, localhost.$mydomain, localhost, example.com
    $ sudo postfix reload
    The Postfix and Postconf commands work irrespective of the OS X Server version; the tools reference the data files as needed.

Maybe you are looking for