Two SSIDs one ACS

Hello,
how do I authenticate two SSIDs against one ACS. Users from SSID A should not be able to log onto SSID B and the other way around.
The proble here seems to be that for the ACS both SSIDs are authenticated by the same NAC/WiSM/Source IP address. I already tried to do something via the CallerID (IP address ranges of both SSIDs are different) but it does not work. It seems that in this CID field wildcards like 192.168.115.* and 192.168.117.* are ignored?
Who know more?
Thanks.
--Joerg

Joerg,
Please check this link,
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00807669af.shtml
Regards,
~JG
Do rate helpful posts

Similar Messages

Running two SSIDs, one with WPA2 and one with WEP

Hi,
I have a WRT610N.
How isolated are the two SSIDs that I can run?
I know one is running at 5GHz and the other at 2.4GHz. I've given each an SSID and a different security policy: I run "sensitive" stuff under WPA2, and I run the other for legacy hardware that supports only WEP (eg my son's Nintento DS).
But are these two keys to the same house, so to speak? If someone cracks my WEP network, can they access the machines on the WPA network? Or are they completely isolated?
Does this make sense?
Thanks for any enlightenment.
-- Mike
Solved!
Go to Solution.

Yes, they are "two keys to the same house". The "house" is your LAN. If someone cracks your WEP, and wirelessly breaks into your router, then they have access to your LAN. This would be like allowing a hacker to wire his computer directly to your router. Being on your LAN, puts the hacker in a very good position to break into any other computer on your network. Your WPA2 encryption does not give you any protection from someone who is already on your LAN.
The solution to your problem is to run two separate wireless routers:
modem ---- router1 --- router2
router1 is set to "Local IP address" 192.168.1.1 , WEP encryption , set "AP isolation" to "enabled" , (note: no printers on router1)
router2 is set to "Local IP address" 192.168.2.1 , WPA2 encryption, use a strong password (and not anything similar to the WEP password).
modem is wired to Internet port of router1
LAN port of router1 is wired to Internet port of router2
The wireless 2.4 GHz channels on the two routers must be different, and are preferably at least 5 channels apart. Usually channels 1, 6, or 11 work best.
With the above two router setup, the Internet port of router2 should protect you from any intruders on router1.

Aironet - Two SSIDs, One with WPA, One Without

I have an AP that I want to have two SSIDs on, let's say, "Admin" and "User."
The User SSID should be wide open, unsecure, etc.
The Admin SSID, should not be broadcasted, and be protected via a passwrd, preferably WPA pre-shared key.
Is this possible? If so, how?
So far I have both SSIDs working, in an open/unsecure mode. My VLANs are working great, and when I tried the suggestion in the help, it looks like it turned on WPA, but now I cannot see the SSID for Admin.
If you need a copy of the config, let me know.
Thanks,
Anthony

version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname ap
enable secret 5 $1$zH.z$lhh9AqT3HXXU2WxXSd2f20
ip subnet-zero
no aaa new-model
dot11 ssid faculty
vlan 100
authentication open
dot11 ssid students
vlan 400
authentication open
guest-mode
username x password x
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
ssid faculty
ssid students
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
antenna receive right
antenna transmit right
interface Dot11Radio0.100
encapsulation dot1Q 100
no ip route-cache
bridge-group 100
bridge-group 100 subscriber-loop-control
bridge-group 100 block-unknown-source
no bridge-group 100 source-learning
no bridge-group 100 unicast-flooding
bridge-group 100 spanning-disabled
interface Dot11Radio0.400
encapsulation dot1Q 400 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
ssid students
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
station-role root
interface Dot11Radio1.400
encapsulation dot1Q 400 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
interface FastEthernet0.100
encapsulation dot1Q 100
no ip route-cache
bridge-group 100
no bridge-group 100 source-learning
bridge-group 100 spanning-disabled
interface FastEthernet0.400
encapsulation dot1Q 400 native
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface BVI1
ip address dhcp client-id FastEthernet0
no ip route-cache
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
control-plane
bridge 1 route ip
line con 0
transport preferred all
transport output all
line vty 0 4
login local
transport preferred all
transport input all
transport output all
line vty 5 15
login
transport preferred all
transport input all
transport output all
end

[WRV200] Two SSID and remote control?

Hi,
I have a WRV200 and need to setup a wifi access for a place that is shared. So two questions:
1. How can I have two SSIDs, one for me, one for visitors with my router? Is it by setting up a VLAN ?
If yes, would those persons be able to access the Internet using a separate WPA2 key?
2. I will need to remotely configure that shared wifi by replacing the WAP key now and then, not the
main key for my private access, only the one for visitors. Is it possible to remotely connect to my
router (dynamic IP address, not static) and configure it remotely so each time a new visitor shows
up, I can change her/his WPA2 key ?
If yes, what do I need? Some kind of OpenDNS service?
The idea is for a house that is rented during vacation time. Each time a new visitor would show up,
I'd have to set a new key so the renter can access the Internet for the rental time, and then change
the key remotely to disable access until the next visitor.
Thanks for any clarification.
Steve

Hi Steve,
Yep I have to admit I have for some time personally used DynamicDNS because I am too thrifty to buy a fixed IP.
I guess for the silly reason Dyndns was the first in the list of choices in the management gui. .
Next time you buy a Small Business Wireless Router, move away from the End of Life WRV200 product have a look at the new RV120W or RV220W wireless routers,
But the older WRV200 allow for remote management, if you know it's IP address or domain name (via DYNDNS or TZO).
Have fun.
regards Dave

Two ssids in one Dot11Radio interface

Hello,
Whilst configuring CISCO867-W router I have encoutered the following problem.
On built-in access point I have one Dot11Radio interface. Is it possible to have two ssids associated with two different vlans on one interface? If yes, how to do it? If no, is there any solution to have two separated wlans on an access-point with one Dot11Radio?

Of course you can have two wlans associated with two different vlans on the same radio interface.
Here is a simple example on how to it?
on the router the most important thing you have to make sure that the interface
Wlan-GigabitEthernet0 is configured as trunk and allowing the vlans mapped on the ssids defined under the radio interface of the embedded AP. Also you have to make sure that dhcp pools have been defined for both vlans.
Assuming that you have two ssids:
ssid1 & ssid2 mapped to vlans 1 and 2 consecutively. vlan 1 has been defined as the native on the trunk defined on
Wlan-GigabitEthernet0
AP(config)#dot11 ssid ssid1
                #authentication open
                #vlan 1
               #exit
AP(config)#dot11 ssid ssid2
               #authentication open
               #vlan 2
               #exit
AP(config)#interface dot11radio 0
              #ssid ssid1
              #ssid ssid2
              # no shut
              # exit
AP(config)#int dot11radio 0.1
               #encapsulation dot1q 1 native
               #bridge-group 1
               #exit
AP(config)#int dot11radio 0.2
               #encapsulation dot1q 2
               #bridge-group 2
               #exit
AP(config)#int gig 0.1
               #encapsulation dot1q 1 native
               #bridge-group 1
               #exit
AP(config)#int gig 0.2
               #encapsulation dot1q 2
               #bridge-group 2
               #exit
Please Don't forget to mark the question as answered once having the right response

Two SSIDs; different VLANs; second VLAN can't talk to Internet

I've got an ASA 5505 firewall with internal interface 192.168.65.1 on port 1 and a WAP connected to port 5 with the address 10.10.1.1. The WAP has two SSIDs configured; one is on VLAN 1 and the other on VLAN 14. The firewall has port 5 configured as a trunk for VLAN 1,14 and the interface was configured a VLAN 14.
If I connect to the WAP using the SSID on VLAN 1 I get an address of 192.168.x.x from our internal DHCP server and have full connectivity to the internal and external networks. If I connect to the SSID on VLAN 14 I get an address of 10.10.1.x from the firewall DHCP server but am unable to connect to anything.
When connecting to the SSID on VLAN 14 I want to be able to access the external interface but not anything internally. I have configured a firewall access rule to allow 10.10.1.0/24 to outside and deny 10.10.1.0/24 to 192.168.0.0/16 but this hasn't worked.
Any ideas?

You need to configure an IP helper on the appropriate VLAN interface(s). Routers, by default, will not forward broadcast packets. Since DHCP client messages use the destination IP address of 255.255.255.255 (all Nets Broadcast), DHCP clients will not be able to send requests to a DHCP server on a different subnet unless the DHCP/BootP Relay Agent is configured on the router. The DHCP/BootP Relay Agent will forward DHCP requests on behalf of a DHCP client to the DHCP server. The DHCP/BootP Relay Agent will append its own IP address to the source IP address of the DHCP frames going to the DHCP server. This allows the DHCP server to respond via unicast to the DHCP/BootP Relay Agent. The DHCP/BootP Relay Agent will also populate the Gateway IP address field with the IP address of the interface on which the DHCP message is received from the client. The DHCP server uses the Gateway ip address field to determine the subnet from which the DHCPDISCOVER, DHCPREQUEST, or DHCPINFORM message originates.
See more at the following document, with configuration steps and examples:
http://www.cisco.com/warp/public/473/100.html#configdhcpbootpciscoios

Wireless SSID in ACS

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin-top:0in;
mso-para-margin-right:0in;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0in;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
Hi,
I want to do the restriction on the bases of SSID. I have two SSID on Wireless LAN controller and all authentications are happing through Active directory through ACS. ACS is integrated with Active directory.
Objective is to restrict the users, I want that GROUP-A users can only login on SSID-A and GROUP-B user only login on SSID-B.
GROUP-A users could not login to SSID-B and GROUP-B users could not login to SSID-A
Is it possible in ACS to apply the restriction on the basis on SSID or any other workaround?
Regrds,
Vashdev

Vashdev,
Yes, SSID base restriction is possible with Cisco acs, please configured the GROUP-A and GROUP-B with their respective SSID like (*ssid) as mentioned in the below listed configuration example.
Restrict WLAN Access based on SSID with WLC and Cisco Secure ACS Configuration Example
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00807669af.shtml
Regds,
JK
Do rate helpful posts-

5508- Internal DHCP - Two SSID

Hi,
We have something strange...
We created the management interface, an internal DHCP scope in same subnet, and Two SSID tied to the same management interface:
- when we connect to the first SSID we have and IP address
- but when we connect to the secone SSID: impossible to get an ip address - auth and association are OK
Is this a limitation or do you have a clue to solve this problem ?
Thanks,
Regards,

Hello,
Thanks for your reply,
In fact different clients can't connect to this SSID. But they can connect on another SSID from same WLC, so it doesnt seem to be a driver problem.
It's mapped on the correct interface, and the MFP is optionnal.
You wil find below the two WLANS configs, the first is OK, clients (laptops, iphone) can connect, on the second one the clients can't connect:
SSID OK:
WLAN Identifier.................................. 3
Profile Name..................................... DATA
Network Name (SSID).............................. XXX_UTILISATEURS
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Number of Active Clients......................... 5
Exclusionlist Timeout............................ 30 seconds
Session Timeout.................................. 1800 seconds
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ management
Multicast Interface.............................. Not Configured
WLAN ACL......................................... unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Quality of Service............................... Silver (best effort)
Scan Defer Priority.............................. 5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
IPv6 Support..................................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
   Authentication................................ Global Servers
   Accounting.................................... Global Servers
   Dynamic Interface............................. Disabled
Local EAP Authentication......................... Disabled
Security
   802.11 Authentication:........................ Open System
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Enabled
         TKIP Cipher............................. Enabled
         AES Cipher.............................. Enabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Enabled
         AES Cipher.............................. Enabled
      Auth Key Management
         802.1x.................................. Disabled
         PSK..................................... Enabled
         CCKM.................................... Disabled
         FT(802.11r)............................. Disabled
         FT-PSK(802.11r)......................... Disabled
FT Reassociation Timeout......................... 20
FT Over-The-Air mode............................. Enabled
FT Over-The-Ds mode.............................. Enabled
CCKM tsf Tolerance............................... 1000
   CKIP ......................................... Disabled
   IP Security................................... Disabled
   IP Security Passthru.......................... Disabled
   Web Based Authentication...................... Disabled
   Web-Passthrough............................... Disabled
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   H-REAP Local Switching........................ Disabled
   H-REAP Local Authentication................... Disabled
   H-REAP Learn IP Address....................... Enabled
   Client MFP.................................... Optional
   Tkip MIC Countermeasure Hold-down Timer....... 60
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
Band Select...................................... Disabled
Load Balancing................................... Disabled
SSID NOT OK:
Note that we tried to force dhcp server ip address as we thought that the problem came from the dhcp server...
WLAN Identifier.................................. 7
Profile Name..................................... Iphone
Network Name (SSID).............................. XXX_Smartphone
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Number of Active Clients......................... 0
Exclusionlist.................................... Disabled
Session Timeout.................................. Infinity
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ management
Multicast Interface.............................. Not Configured
WLAN ACL......................................... unconfigured
DHCP Server...................................... 128.10.1.20
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Quality of Service............................... Silver (best effort)
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
IPv6 Support..................................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
   Authentication................................ Global Servers
   Accounting.................................... Global Servers
   Dynamic Interface............................. Disabled
Local EAP Authentication......................... Disabled
Security
   802.11 Authentication:........................ Open System
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Disabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
      Auth Key Management
         802.1x.................................. Disabled
         PSK..................................... Enabled
         CCKM.................................... Disabled
         FT(802.11r)............................. Disabled
         FT-PSK(802.11r)......................... Disabled
FT Reassociation Timeout......................... 20
FT Over-The-Air mode............................. Enabled
FT Over-The-Ds mode.............................. Enabled
CCKM tsf Tolerance............................... 1000
   CKIP ......................................... Disabled
   IP Security................................... Disabled
   IP Security Passthru.......................... Disabled
   Web Based Authentication...................... Disabled
   Web-Passthrough............................... Disabled
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   H-REAP Local Switching........................ Disabled
   H-REAP Local Authentication................... Disabled
   H-REAP Learn IP Address....................... Enabled
   Client MFP.................................... Optional
   Tkip MIC Countermeasure Hold-down Timer....... 60
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
Band Select...................................... Disabled
Load Balancing................................... Disabled
I begin to believe that there is a mismatch with the WPA2-PSK key > the client has setup the WLC and SSID and gave me the WPA2-PSK...
Thanks a lot,
Best Regards,
Gerald

How to migrate multiple ACS database into one ACS database ?

Hey All,
we just purchased several companies and as IT/network department, we need to consolidate all the ACS from the HQ and the purchased company into one ACS, I read the cisco docs. mentioned, I can export the migration file from the old acs and upload it into the new acs serve.
but my concern is we have multiple acs server, will the the muliple acs migration files overwrite each other during the upload into the new server.
thanks

Raghavender -
I am not an expert on MySQL migration, but you would look to migrate the database to a local Oracle Database and then move that to your Database Cloud Service. However, keep in mind that at this time you can only access the Database Cloud Service from outside the Cloud via RESTful Web Services, so you might have to modify the application that accesses the database. Hope this helps.
- Rick Greenwald

We have two iPhones, one iMac, and one iTunes account. Can someone tell me an yeast way to manage each iPhone separately- that is -- when we connect each iPhone how do we keep our contacts separated? this is a real problem. Thanks

We have two iphones , one imac , and one itunes account. Hope someone can tell me an easy way to synch each iphone so that our contacts stay separate. I would like to share itunes music etc but not synch the same contacts to each phone...major problem... Thanks!

You have a few options which are detailed here:
http://support.apple.com/kb/ht1495

Two phones one apple account how do I stop imessage from one going automatically to the other?

two phones one apple account how do I stop imessage from one going automatically to the other?

You need to setup iMessage on one of the two phones using a different AppleID.

Two iphones, one iTunes account, two icloud accounts

Hi,
I have two iPhones, one privat, one from my company.
I would like ...
... to have all music, apps, books bought via iTunes to be on both iPhones - use same Apple ID for iTunes account?
... seperate calender, contacts, todos - use different Apple IDs for iCloud?
Is there still a way to have all pictures taken in one common photo stream?

I have the same question. My daughter and I share an apple account which is fine, but now I am getting some of her texts and each time I send her one I get a duplicate? I thought I messed this up when we tried to Facetime each other and I have deleted all those options. How do I fix it so I have my own texts and she has her own texts, I don't get duplicate texts but she can still access our I tunes account? Please help

Two apple ids, two computers, one phone#-how to sync messages on on both computers

Okay apple world, I'm a bit stumped with this one: I have two macbooks, one for work (a 2009 15" macbook pro) and a personal one (2014 13" macbook air) and two apple ids, one for work and one personal one. I also have a 5S iPhone, which I use for both work and personal use. The iPhone has been set up with my personal apple id and my iMessages sync perfectly with my personal macbook air. Now what I would like to do is sync my iMessages through my phone number with my work macbook pro. But when I try to add an additional account, I am only given the option to add a google account or I am told that my (personal) apple id is already in use. Has anyone encountered this issue and do you have any tips on how to trouble shoot through this?

Sync is about synchronisation to Lightroom Mobile, the iPad/iPhone app, not about synchronising from one computer to another. There isn't really a way to sync two computers automatically, but you can use methods such as File>Export/import as Catalog, Dropbox, or copying through the operating system.

I have two iphone one is iphone 5 and othere is iphone 4 . can i use same id for both ? And do i have to purchase the application again for iphone 4 which i have buyed for iphone 5.??

i have two iphone one is iphone 5 and othere is iphone 4 . can i use same id for both ? And do i have to purchase the application again for iphone 4 which i have buyed for iphone 5.??

You can use the same Apple ID for both phones, you would then be able to use the purchased Apps/Content on both phones without having to pay again.

I have set up two users, one for myself and one for children. The computer automatically logs in for the children with no password required. When the children go to spotlight and type in a search criteria all of my files show up. How do I prevent this?

I have set up two users, one for myself and one for children. The computer automatically logs in for the children with no password required. When the children go to spotlight and type in a search criteria all of my files show and open up. How do I prevent this?

Log in to your account, and move all your files to your home folder. No other users should be able to access them there and they won't show up with a Spotlight search.
Make sure your kids' account(s) do not have admin privileges.

Two SSIDs one ACS

Similar Messages

Maybe you are looking for