Unchained certificate for WLC management interface

Hi all ,
I want to know , how to generate unchained certificate for the managemetn interface of WLC ? . Whether Root CA will be giving this unchained certificate ?
Because WLC management wont support chained certificate..
Thanks,
Vijay.

Hello Vijay,
Just go through this short cisco doc regarding generating CSR for Third-Party Certificates and Download Unchained Certificates to the WLC:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00806e367a.shtml

Similar Messages

Standard Asynchronous ES for Quality Management interface

Hi,
Synchronous standard ES is available for Quality Management interfaces under ES bundle.
Could you please suggest if there is any standard Asynchronous ES available for above QM interfaces like Inspection plan, Inspection results and Usage Decision.
Br,
Madan

Dear Hummel
This link required SAP ID and use less for those who do not have S User ID's.
further more.... could you please differentiate Stand SAP QM process compare to QM process in RDS?

Generate Certificates for WLC and clients

Hi Guys
I've been working acording the following document to integrate my WLC 5508 with LDAP for internal users:
http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/100590-ldap-eapfast-config.html
However when I try to generate the device certificate on Windows Server 2012, I see the steps are different, for example when I reach the step 4 (of Generate a Device Certificate for the WLC section), the CA ask me for a Certificate Signing Request instead of Create and submit request to this CA option, as appears in the document.
How do I get this?
Thanks in advance for your support!
Marcelo

Hi,
If you are trying to get a device certificate for WLC, then you may need to use 3rd party software like openSSL for this.
Below post may help you to see how you can do this
http://mrncciew.com/2013/04/22/configuring-eap-tls-on-wlc/
HTH
Rasika
*** Pls rate all useful responses ****

WLC Duplicate IP address detected for AP-Manager Interface

I am getting an error log in the WLC saying, its IP address is duplicate by another machine with MAC address A.B.C.D
But this MAC address A.B.C.D is the MAC address of the AP-Manager Interface in the same controller.
Model No.                   AIR-WLC2106-K9
Software Version                 7.0.116.0
%LWAPP-3-DUP_IP: spam_lrad.c:27626 Adding client 58:b0:35:83:72:86 to exclusion list due to IP Address conflict with AP 'AP_DUXO_3'
%LWAPP-3-DUP_AP_IP: spam_lrad.c:27612 Duplicate IP address detected for AP AP_DUXO_3, IP address of AP 10.184.1.224, this is a duplicate of IP on another machine (MAC address 58:b0:35:83:72:86)
Cisco AP Identifier.............................. 1
Cisco AP Name.................................... AP_DUXO_3
Country code..................................... US - United States
Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
AP Country code.................................. US - United States
AP Regulatory Domain............................. 802.11bg:-A    802.11a:-N
Switch Port Number .............................. 1
MAC Address...................................... cc:ef:48:1a:e4:af
IP Address Configuration......................... Static IP assigned
IP Address....................................... 10.184.1.224
IP NetMask....................................... 255.255.0.0
Gateway IP Addr.................................. 10.184.20.2
Domain...........................................
Name Server......................................
NAT External IP Address.......................... None
CAPWAP Path MTU.................................. 1485
Telnet State..................................... Enabled
Ssh State........................................ Disabled
Cisco AP Location................................ DUXO_BOX
Cisco AP Group Name.............................. default-group
Does anyone have an issue like this ?

Are you sure this MAC address 58:b0:35:83:72:86 isn't some type of Apple device? Its OUI is registered to apple. How do clients get ip addresses DHCP? It appears that the IP 10.184.1.224 is statically assigned to your ap-manager and that this client 58:b0:35:83:72:86 is either getting that same IP from DHCP or the client is statically assigning it themselves.

How to replace self-signed certificate for enterprise manager console

Does anyone know how to change self-signed certificate for https access to Enterprise Manager console, which is issued during installation of Oracle 11g?

Well, this might not be much help, but for 10g, on AIX, docID 1171558.1 describes how to create a new certificate.
Not sure how relevant it will be for 11g, sorry :(

Certificate for WLC web auth - HELP

Hi all
I need to buy a cert for my WLC web authentication
I have read the document below
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080a77592.shtml
However, I want to fill in the details and generate the CSR via the provider im buying the cert from, thawte
Am I ok doing all this via the provider, or do I need to use open SSL to generate the CSR?
Can anyone post the steps in here I need to take when purchasing and installing a chained certificate on my WLC.
The WLC has the latest version of code.
cheers
Carl

Here are the instructions for a chained certificate.
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080a77592.shtml
It's simple enough, copy and paste the chanin below the certificate when you generate the final.pem.
Main thing to remember when compiling the final.pem use a version of OpenSSL < 1.0 as it won't install.
If your provider will generate the CSR for you it should be fine, but you will need the private key to recompile the certificate.
As you'll be using OpenSSL to recompile the certificate you may as well use it to generate the CSR, there's not much to it.
Thanks
Chris

WLC: which software-version support SHA2 certificates for Web Authentification and Web Management ?

Hello,
I tried to install new SHA2 3th-Party certificates on our WLCs. There are old WiSM1-Boards and 2504 to support our old 1230 Access Points, running 7.0.251.2, which didn't install it, although the config manual for 7.6 and 8.0 say that SHA2 certificates are supported since 7.0.250.0. When I tried to install the SHA2-certificates I get the message "File transfer failed" an the log says:
*TransferTask: Dec 12 13:22:14.394: #UPDATE-3-CERT_INST_FAIL: updcode.c:1869 Failed to install Webauth certificate. rc = 1
*TransferTask: Dec 12 13:22:14.394: #SSHPM-3-KEYED_PEM_DECODE_FAILED: sshpmcert.c:4085 Cannot PEM decode private key
I tried to install the same certificates on our WiSM2-Boards, running 7.4.121.0 and I failed too. The same certificates could be installed on a 2504 running 8.0.100 without any problems.
In all 3 cases I tried to install unchained certificates for web management and Level 3 chained certificates for web authentication. I used the following guides to get the certificates (e.g. taken from the config manual 8.0.100):
http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html
http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/70584-csr-wlc-00.pdf
Which software versions support SHA2 certificates and which didn't ? Is the a list for it ?
Regards

Hello,
I solved the problem. First I used a Debian Linux system with Openssl 1.0.1. After I searched the internet using one of the log messages above I found sites which mentioned to use Openssl 0.9.x. So I tried a productive and security fixes Debian Linux System running Openssl 0.9.8 and I succeeded. The wlcs accepted the certificate files and used it after a reboot. The Web GUI still shows a SHA1 Fingerprint, but the certificate signature Algorithm is SHA2:
Signature Algorithm: sha256WithRSAEncryption
When you check the openssl.org homepage Openssl 0.9.8 is still one of the actual version of openssl and is still available and fixed. But the Openssl Roadmap says:
"We don't want to have to maintain too many branches. This is likely to include a timescale for the EOL of version 0.9.8"
I don't know the differences between certificates made with openssl 0.9.8 and 1.0.1. Is there anybody who can explain it to me ?
Regards

WLC to use Management Interface & Few more getting started Questions

Hello,
I'm yet to implement the Wireless LAN in one of our client's corporate office. There 40 x 1130AG LWAPP AP's and 4404 WLC with ACS 4.x for the Authentication of the Wireless Clients who is trying to access the LAN.
For the WLC to connect to the Dual Core Switch, i need to use only one Management Interface with Distribution System port 1 being the Primary and mapping the DS Port 2 as the Backup port for the Management Interface. Is this Right? or do i have configure Dynamic Interfaces as well. Is management interface for accessing / management and configuration only? Management Interface will communicate with ACS for AAA and AP's who would like to associate with the WLC, is this Right?
Note: WLC, AP's, Wireless Clients & AP's are in the same IP Subnet.
Few other question of WLAN's so it helps me during implementation -
â¢ Can I use the 802.1x Authentication application found in the Windows XP for the Wireless Interface; instead of Cisco Client Application. For this; I have to configure the WLC / Wireless Client to use EAP algorithm; is this Right?
â¢ With the help of RRM, the channel interference between multiple AP's (3 - 4 AP's) in the same area is controlled by the WLC by changing the Channels used by the AP which is not same on all the AP's. Is this right?
â¢ How many Client Users will connect per Channels. 802.11 a / g will provide 11 Channels, is this Right?.
â¢ I'm trying to set in the WLC to limit the Client connections per AP to 25, can this be achieved?
Please, can anyone help me in calrifying the above points.
Regards,
Keshava Raju

Many Thanks Mr. Dennis for your help & Clarification.
With ref to your reply point no# 1. I have actually planned to connect one Gig port of the controller to each of the Dual Cisco Core Switch setup. Can i use all 4 Controller Interfaces configured as LAG and Port 1 & 2 connecting to Core Switch 01 and Port 3 & 4 connecting to Core Switch 02?
I have Final two more questions, Request you to help me calrifying this?
â¢ I'm willing to configure Multicast communication between the WLC & AP's. For this configuration is it necessary to Connect the WLC in a different VLAN than the VLAN of the AP's. Is it necessary that I have to set the controller to LWAPP Layer 3 mode to support the Multicast communication?
â¢ Though I do not have implementation experience of the WLAN. My understanding of the Interface settings on the WLC - is I will have to configure one Management Interface for in-band management. Do I have to configure AP-Manager Interface (to support Multicast communication) and to make the WLC to communicate with ACS for Client Authentication. All of the Wireless Devices including the ACS are in one VLAN / IP Subnet, is only one Management Interface is enough for communicating with AP's (with Multicast) and communicating with ACS for forwarding the Authentication messages between the ACS & Wireless Clients?

Need to change the Certificate in ACE that is using for HTTPS Management access

Dear Team,
Currently we are getting certificate cannot be trusted error in web browser while we are accessing the ACE through https. So we need to installed the new https certificate for https management connection to ACE for removing this error. We do not want to use the self signed certificate for https access to ACEmanagement. We have done the below configuration but there no luck, still its showing the previous self signed certificate in browser.
parameter-map type ssl MNGMT_SSL
cipher RSA_WITH_AES_128_CBC_SHA priority 2
ssl-proxy service PSERVICE_SERVER
key ACEKEY.key
cert ACECERT.cert
ssl advanced-options MNGMT_SSL
Kindly suggest how we can installed the certificate on ACE for only https management access.
Thanks in advance.
Regrads,
Ranjith

Ranjith,
You may want to see the details and recommendation relatedo to this situation and this bug:
CSCte42757
Jorge

Certificates on WLC

Hi all,
Can I able to use the single unchained certificate for both webadmin login and web auth portal in WLC?
Thanks,
Vijay.

Thanks scott for the quick reply . If i am using chained certificate, then i cant use this for manament access?
It is mentioned in the below link .
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080a77592.shtml
Note:
Chained certificates are supported for web authentication only; they are not supported for the management certificate.
Thanks ,
Vijay.

WLC CT2504: Interface IP can not be used as internal DHCP server IP

Hello all,
I've got a new CT2504 controller with software version 7.0.220.0
Regarding to
http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080af5d13.shtml
I've tried to configure the internal DHCP on a dynamic-interface, but this is not possible:
(Cisco Controller) >config interface dhcp dynamic-interface vlan401 primary 172.16.x.3
vlan401 Interface IP can not be used as internal DHCP server IP
It works, if I use another IP (aka DHCP server) in the same subnet or in another subnet. It works also for the management interface.
(Cisco Controller) >show interface detailed management
Interface Name................................... management
MAC Address...................................... d0:c2:82:xx:xx:xx
IP Address....................................... 10.2.x.135
IP Netmask....................................... 255.255.255.240
IP Gateway....................................... 10.2.x.129
External NAT IP State............................ Disabled
External NAT IP Address.......................... 0.0.0.0
VLAN............................................. 400
Quarantine-vlan.................................. 0
Active Physical Port............................. 1
Primary Physical Port............................ 1
Backup Physical Port............................. Unconfigured
Primary DHCP Server.............................. 10.2.x.135
Secondary DHCP Server............................ Unconfigured
DHCP Option 82................................... Disabled
ACL.............................................. Unconfigured
AP Manager....................................... Yes
Guest Interface.................................. No
L2 Multicast..................................... Disabled
Scopes are defined and Proxy is enabled.
(Cisco Controller) >show dhcp summary
Scope Name                   Enabled          Address Range
ap                               Yes      10.2.x.137 -> 10.2.x.140
intern                            Yes      172.16.x.20 -> 172.16.x.30
(Cisco Controller) >show dhcp proxy
DHCP Proxy Behaviour: enabled
Has somebody an explanation for this issue?
Thanks in advance,
Regard,
Robert

You can use the internal dhcp, but you need to set the primary dhcp as the management ip. So in your dynamic interface, your primary dhcp is configure with the wlc management ip address. Dhcp proxy also needs to be enabled and is enabled by default.
Thanks,
Scott Fella
Sent from my iPhone

Clarification regarding WLC 's interfaces

Hi Netpros,
I am about to deploy WLC and LWAPP solution. I have only done Autonomous set up in the past and so would appreciated some clarification regardig the below points:
1.- switch port connected to LWAPP access points must be an access port (not trunk) correct ?
2.- switch port connected to WLC 44+ must be a trunk (assuming I need to map SSID to different vlans) correct ?
3.- WLC 44+ port can only be connected to a gigabit port .. so I can't change its speed in order to connect it to a fastethernet port .. correct ?
4.- What exactly is Management interface, service port, AP manager ..etc so many names I am getting confused.
5.- What is layer 2 and layer 3 mode .. I am also confused here.
6.- If I want all my LWAPP access points on vlan 10 (for argument sake) .. which WLC's interface do I need to place on vlan 10 in order for the access points to register ? I want to have LWAPP and WLC on the same vlan but with so many inteface names I don't know which one I have to use (AP manager ? perhaps )
7.- If I want SSID 1 (vlan 11), SSID 2 (VLAN 22). How do I configure the WLC interfaces (which one do I need to use .. create ..?) so that clients using SSID 1 can communicate on its respective VLAN 11
8.- Microsoft IAS and PEAP .. do I need to set up every access point as radius client ? or do I only need to configure the WLC as radius client .. and if so which WLC interface's IP address do I need to use on the radius server (IAS)
I apologize for so many questions and really appreciate your feedback which - as always - I am sure will make things clear.
Cheers,

1.- switch port connected to LWAPP access points must be an access port (not trunk) correct ?
(A) Correct, Cisco recommends no more then 70 or so APs per VLAN. You can do more then 70 and in fact put all of your APs in the same VLAN. But if the controller ever goes dark it could take a bit longer for the APs to join.
2.- switch port connected to WLC 44+ must be a trunk (assuming I need to map SSID to different vlans) correct ?
(A) Yup yup. You can truck the switch or Echannel it and use LAG on the controller.
3.- WLC 44+ port can only be connected to a gigabit port .. so I can't change its speed in order to connect it to a fastethernet port .. correct ?
(A) Yup yup. again. GIG only. Wont connect otherwise.
4.- What exactly is Management interface, service port, AP manager ..etc so many names I am getting confused.
(A)
Manager is the IP address you will use to manage the controller. Its the way the controller see's the world.
AP Manger is used for the APs to phone home to. This interface is not pingable. Nothing special with this interface.
Service Port ... think about out of service management for the WLC. Suppose you lose network connection to the WLC manager interface. You can jack right into the service port. I have also put this on the network before so you can still access the WLC remotely.
5.- What is layer 2 and layer 3 mode .. I am also confused here.
(A)
Layer 2 --- Think about deploying your entire WLAN on one subet. So your APs and WLC are all in the same subnet.
Layer 3 -- This is used when you have your APs on other subnets ect..
You can actually console into the LWAPP ap during the join process. you will see the AP send a 255.255.255.255. This is a join attempt by the AP to find a controller on its subnet.
6.- If I want all my LWAPP access points on vlan 10 (for argument sake) .. which WLC's interface do I need to place on vlan 10 in order for the access points to register ? I want to have LWAPP and WLC on the same vlan but with so many inteface names I don't know which one I have to use (AP manager ? perhaps )
(A) The beauty of the WLC is you dont have to have the APs on the same VLAN as the controller, unless u are layer 2. The access layer teh APs are on just need to be routable to the AP interface.
7.- If I want SSID 1 (vlan 11), SSID 2 (VLAN 22). How do I configure the WLC interfaces (which one do I need to use .. create ..?) so that clients using SSID 1 can communicate on its respective VLAN 11
(A)
You map the SSID to VLAN under the WLANs tab. You Create the wired side info (VLANS) under the controller tab
8.- Microsoft IAS and PEAP .. do I need to set up every access point as radius client ? or do I only need to configure the WLC as radius client .. and if so which WLC interface's IP address do I need to use on the radius server (IAS)
(A) Advantage of the WLC, you use the WLC as the client to a Raduis server. The management address..
I apologize for so many questions and really appreciate your feedback which - as always - I am sure will make things clear.
Cheers,

Altering VLAN-Konfiguration Controller Management-Interface

Hello
I tried to alter the vlan configuration for the management interface on 4402 controller. The management interface are tagged with the vlan 55.
Now, I d'like to change this vlan 55 definition to a untagged configuration. On the corresponding switchport, I configured the command "sw trunk native vlan 55".
I think with this config the management interface works in the vlan 55 again, but the interface is not reachable after this changes.
Is it possible to do such changes on a working config?
Does anyone know what is wrong with my config?
Regards
Pascal

I know there is a bug on the 5.0 code, which might still be on the 5.1, but I don't have that info. There also was a bug on the 4.1, in which you would have to load the webauth page to the wlc, set the wlc to use the default page and hit apply. Then you would choose to use custom webauth and hit apply and that would fix the issue. You can try that to see if that works, or else if you configurations are correct, then maybe open a TAC case. Like I said earlier, that code is too new.

New SSL certificate for M670 process?

Can someone help me with the current process for installing a new certificate on an M670 running 8.1.0-476? Do I still use OPENSSL to generate the private key, and then get the certificate signed and import the certificate via CLI, pem format?
Can I install a SAN certificate? I have one DNS name spam.domain.com for the two (internal and external) SPAM quarantine interfaces and another name mspam.domain.com for the management interface.
Appreciate the input, I only do this every three years and the process has changed the last two times and I find nothing in the documentation.
Jason

Jason -
You can use a SAN certificate - as long as the machine names are specified and signed off in the cert by your signer.
Had previous saved notes for similar questions in the past --- see if this helps:
For full create and install:
http://tools.cisco.com/squish/39054
Starting with AsyncOS version 7.1 it is possible to generate a self-signing request on the ESA appliance. This can be used as a workaround to create certificates for SMAs.
On an ESA, create a self-signed certificate that will be used for the SMA. This can be done under GUI: Network > Certificates
Detailed description how to generate a certificate can be found within the knowledge base article 1634.
It is important, when creating a certificate, for common name to use the hostname of the SMA (M-Series) and not of the ESA (C-Series), so that the certificate can be properly used. Submit and commit changes.
Use GUI: Network > Certificates > Export Certificates to export certificate.
Give it a file name (e.g. mycert) and password that will be used when converting the certificate. Exported certificate will be in .pfx format. The M-Series only supports .pem format for importing, so this certificate needs to be converted.
To convert certificate from .pfx format to .pem format, please use the following OpenSSL syntax:
openssl pkcs12 -in mycert.pfx -out mycert.pem -nodes
Windows version of OpenSSL can be downloaded from:http://www.slproweb.com/products/Win32OpenSSL.html Make sure Visual C++ 2008 Redistributable is installed first before the OpenSSL Win32.
Versions for Mac, Linux, and other operation systems can be downloaded from http://www.openssl.org/source/
After converting the certificate to the correct format, one should now have available both - the certificate and the corresponding key in .pem format. It is recommended to sign it by a trusted Certification Authority (CA). Cisco doesn't recommend a specific CA, this is up to the choice of the customer.
To have this signed, simply select "Download certificate signing request" in the GUI of the ESA (Network > Certificates >select the corresponding certificate created for the SMA) and submit it to the trusted CA of choice.
The signed certificate or the self-signed certificate, and the key in .pem format, can be imported now in the SMA. To learn how to do it, please use the corresponding Installing Certificates on an IronPort Email Security Appliance.
Let me know!
-Robert

How can I use Windows IAS to validate WLC management users?

I am having a problem using my Windows IAS radius server to validate management users for my 2112 Wireless Lan Controller.
I have defined the radius server and it works ok with the policy for validating wireless clients but not for WLC management users.
The Remote access policy seems to be set up correctly as the event viewer on the server shows:-
Event Type: Information
Event Source: IAS
Event Category: None
Event ID: 1
Date: 09/02/2011
Time: 11:06:06
User: N/A
Computer: UK01DC07
Description:
User xxxxxx was granted access.
Fully-Qualified-User-Name = TRAVEL.OAG.com/Dunstable Admins/xxxxxx
NAS-IP-Address = 10.10.45.210
NAS-Identifier = UK03NM01
Client-Friendly-Name = UK03NM01
Client-IP-Address = 10.10.45.210
Calling-Station-Identifier = <not present>
NAS-Port-Type = <not present>
NAS-Port = <not present>
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = UK03NM01 - login
Authentication-Type = PAP
EAP-Type = <undetermined>
But, the WLC log shows:
*Feb 09 11:06:06.612: %EMWEB-1-LOGIN_FAILED: ews_auth.c:2104 Login failed. User:xxxxxx. Service-Type is not present or it doesn't allow READ/WRITE permission..
The WLC just returns the login screen
Any thoughts?
Thanks in advance
Richard

Event viewer shows :
Event Type: Information
Event Source: IAS
Event Category: None
Event ID: 1
Date: 10/02/2011
Time: 08:49:39
User: N/A
Computer: UK01DC07
Description:
User xxxxxxxx was granted access.
Fully-Qualified-User-Name = TRAVEL.OAG.com/Dunstable Admins/xxxxxxxx
NAS-IP-Address = 10.10.45.210
NAS-Identifier = UK03NM01
Client-Friendly-Name = UK03NM01
Client-IP-Address = 10.10.45.210
Calling-Station-Identifier =
NAS-Port-Type =
NAS-Port =
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server =
Policy-Name = UK03NM01 - login
Authentication-Type = PAP
EAP-Type =
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 ....
and IAS log shows:
"UK01DC07","IAS",02/10/2011,08:49:39,1,"xxxxxxxx","TRAVEL.OAG.com/Dunstable Admins/xxxxxxxx",,,,,"UK03NM01","10.10.45.210",,0,"10.10.45.210","UK03NM01",,,,,,7,1,"UK03NM01 - login",0,"311 1 10.10.45.254 12/04/2010 23:56:59 1987",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"Use Windows authentication for all users",1,,,,
"UK01DC07","IAS",02/10/2011,08:49:39,2,,"TRAVEL.OAG.com/Dunstable Admins/xxxxxxxx",,,,,,,,0,"10.10.45.210","UK03NM01",,,,,,2,1,"UK03NM01 - login",0,"311 1 10.10.45.254 12/04/2010 23:56:59 1987",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"Use Windows authentication for all users",1,,,,
It appears to me that IAS checks and passes the username/password as being valid but this response is ignored by the WLC
Richard

Unchained certificate for WLC management interface

Similar Messages

Maybe you are looking for