VLAN problem with SRW2048

I'm having problem with a setup with multiple SRW2048 connected together.  However, I can see the problem when simplifying my setup and using only two SRW2048 together.
The first SRW2048 receives one connection from many different servers and sends these connections to many other SRW2048.   I have configured one VLAN (untagged) per server for this switch.  The goal is instead of having 4 switches to do this job, I am using only one.
The second SRW2048 receives the server connections from the other switch.  It then distributes these connections to various ports.  I use a different VLANs on this switch to group these connections and the server uplink together).
Everything works fine until a plug the two switches together (i.e. I can verify the VLAN connections are working by connecting directly to each switch).  However, when both switches are connected, I get a flooding of all interfaces (like there is a bypass of the VLANs or a loop in the connections).  This happens as soon as I have two servers connected.  If I connect only one, there is no problem.
If I connect a second server through a dumb switch instead of the first SRW2048, everything works fine, so I don't think that there is a loop.  The problem seems to be with the VLANs (how they "cascade" together). Anybody got an idea of what the problem is?
For those who need a better visual representation:
Server1->Port 1-8 Switch1 (VLAN1 on these ports)->Port 1 (and others) Switch2 (VLAN10 on these ports)
Server2->Port 9-16 Switch1 (VLAN2 on these ports)->Port 2 (and others) Switch2 (VLAN11 on these ports)
Etc for other servers...
All VLANs are using the default settings from the Web Interfaces on the switches (Access mode, Untagged, other ports Excluded, etc.)

1. The SRW switches are standalone devices. Unlike more expensive switches like those from the Cisco Small Business Pro series they don't automatically recognize each other and configure themselves to play nicely together.
2. Generally, if you create a new VLAN on one SRW you have to create the same VLAN on all other switches and also add these to the trunks connecting the switches. Same applies to the ASA if you connect the SRWs to ASA. As long as a switch is not configured for a particular VLAN it won't accept traffic for it.
3. The only thing that you may try is GVRP. I never tried this but I think it may do what you want: add a VLAN on a single switch and then propagate this to the trunks and other switches. I can't tell how well this works and whether the ASA will accept that, too.

Similar Messages

  • VLAN problems with SG200-8P and Cisco ASA 5505 (Sec Plus license)

    Hi,  I've been pulling my hair out trying to get simple vlan trunking working between these devices.
    Basically, no clients on VLAN 99 (guest) will receive DHCP ip addresses when plugged into the SG200.  I have the SG200<>ASA VLAN trunk configured correctly, as I know it, and I've tried numerous variations (set trunk as general tag/untagged, etc., set the ap port to general tag/untag, etc).   Both AP's work properly when connected to the ASA e0/3 port but either will only pull the "inside" VLAN dhcp address when connected to the SG200 switch
    VLAN 1 - inside (has separate dhcp scope assigned by ASA)
    VLAN 99 - guest (has separate dhcp scope assigned by ASA)
    SG200
    purpose
    ASA 5505 (Sec Plus license)
    purpose
    g2
    Trunk 1UP,99T
    Ubiquiti AP (VLAN 1 works, VLAN 99 does not
    g3
    Access port 99T
    vlan 99 does not work
    g8
    Trunk 1UP, 99T
    < Trunk between switch and ASA >
    Int e0/2
    switchport trunk allowed vlan 1,99
     switchport trunk native vlan 1
     switchport mode trunk
    Int e0/3
    switchport trunk allowed vlan 1,99
     switchport trunk native vlan 1
     switchport mode trunk
    Second ubiquiti AP
    Both VLAN 1 and VLAN 99 clients work properly

    Frustrated - yes.  Confused - maybe not as much, but I could have put some more effort into the overall picture.
    There are two VLANs (1 - native) and (99 - guest).   There is a trunk port between the SG200 and the ASA configured as 1-untagged 99 - tagged.    
    No clients connected to the SG200 on VLAN 99  are able to access the ASA VLAN 99 using either a static VLAN IP address or DHCP.   The problem occurs whether I configure the SG200 with an access port 99-tagged or Trunk port 1UP, 99T or general port 1U, 99UP or any combination thereof.
    Anything connected to the SG200 on the native VLAN works properly.
    Anything connected to the ASA VLANs (1 or 99) works properly
    I have not yet tried to see what the switch is doing with the VLAN tags but I suspect I have some mismatch with the Linksys/Cisco SG200 way of setting up a VLAN and how traditional Cisco switches work.
    I was hoping someone with a working SG200 - Cisco ASA setup could share their port/trunk/VLAN settings or perhaps point me in the right direction.
    SG200 g2 - trunk port (1UP, 99T) -- Access Point
    SG200 g2 - access port (99U)
    SG200 g8 - trunk port (1UP, 99T)  connected to ASA5505  e0/3  
    ASA5505 e0/3  (switchport trunk allowed vlan 1,99,  switchport trunk native vlan 1,  switchport mode trunk)
    Thanks,

  • VLAN problem with 3750

    Hello,
    I have configured a new interface vlan, sometimes it work, sometimes not.
    Is there a interface vlan limit on the Cisco 3750?
    Here is my configuration:
    Backbone, 3750 L3.
    vlan 182
    interface Vlan182
    description USERS_EPFL
    ip address 172.16.182.1 255.255.255.0
    ip helper-address 172.16.2.4
    ip helper-address 172.16.2.5
    no ip redirects
    no ip unreachables
    On Cisco 3750 L2
    interface FastEthernet2/0/15
    switchport access vlan 182
    switchport mode access
    no logging event link-status
    srr-queue bandwidth share 10 10 60 20
    srr-queue bandwidth shape 10 0 0 0
    no snmp trap link-status
    mls qos trust cos
    no mdix auto
    auto qos voip trust
    spanning-tree portfast
    spanning-tree bpduguard enable
    When I ping the computer connected to the port 2/0/15, sometime I can reach it, sometime not.
    It work with the other vlan (132, 134...). IP is fix.
    Many thanks if you have any ideas, I've been testing a long time.
    Gael
    PS:
    More config info:
    3750 l2
    interface GigabitEthernet1/0/1
    description Link to NYLMRO0001
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 129
    switchport mode trunk
    srr-queue bandwidth share 10 10 60 20
    srr-queue bandwidth shape 10 0 0 0
    queue-set 2
    mls qos trust cos
    auto qos voip trust
    channel-group 1 mode on
    interface GigabitEthernet1/0/2
    description Link to NYLMSW0002
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 129
    switchport mode trunk
    srr-queue bandwidth share 10 10 60 20
    srr-queue bandwidth shape 10 0 0 0
    queue-set 2
    mls qos trust cos
    auto qos voip trust
    channel-group 2 mode on

    Some more info:
    When I say that simetime it work sometime not, it like I plug the connector, then it work (the ping) if I replug, The ping won't work then maybe after a vary lonmg time, it will work again
    info about show vlan:
    3750 L3
    sh vlan
    VLAN Name Status Ports
    1 default active Gi1/0/6, Gi1/0/10, Gi1/0/11, Gi2/0/6, Gi2/0/10, Gi2/0/11
    129 MGMT active
    130 SERVER active
    132 USERS active
    134 IP_TEL active
    136 WIFI_DATA active
    137 WIFI_IP_TEL active
    138 WIFI_GUEST active
    140 BATIMENT active
    182 USERS_EPFL active
    184 IP_PHONES_EPFL active
    191 DMZ3 active
    1002 fddi-default act/unsup
    1003 trcrf-default act/unsup
    1004 fddinet-default act/unsup
    1005 trbrf-default act/unsup
    3750 L2
    sh vlan
    VLAN Name Status Ports
    1 default active Fa1/0/1, Fa1/0/14, Fa1/0/15, Fa1/0/24, Fa1/0/25, Fa1/0/26, Fa1/0/27, Fa1/0/28
    Fa1/0/29, Fa1/0/30, Fa1/0/31, Fa1/0/32, Gi1/0/2, Gi1/0/3, Gi1/0/4, Fa2/0/2, Fa2/0/7
    Fa2/0/11, Fa2/0/12, Fa2/0/16, Fa2/0/17, Fa2/0/18, Fa2/0/22, Fa2/0/28, Fa2/0/31
    Fa2/0/32, Fa2/0/36, Fa2/0/37, Fa2/0/38, Fa2/0/40, Fa2/0/43, Fa2/0/45, Fa2/0/46
    Gi2/0/2, Gi2/0/3, Gi2/0/4
    129 MGMT active
    130 SERVER active Fa1/0/43, Fa1/0/47, Fa1/0/48, Fa2/0/42
    132 USERS active Fa1/0/33, Fa1/0/34, Fa1/0/35, Fa1/0/36, Fa1/0/37, Fa1/0/38, Fa1/0/40, Fa1/0/42
    Fa1/0/44, Fa1/0/45, Fa1/0/46, Fa2/0/25, Fa2/0/26, Fa2/0/29, Fa2/0/30, Fa2/0/33
    Fa2/0/34, Fa2/0/35, Fa2/0/44
    134 IP_TEL active
    136 WIFI_DATA active
    137 WIFI_IP_TEL active
    138 WIFI_GUEST active
    140 BATIMENT active Fa1/0/39, Fa2/0/41, Fa2/0/47, Fa2/0/48
    182 USERS_EPFL active Fa2/0/15, Fa2/0/27
    184 IP_PHONES_EPFL active
    191 DMZ3 active
    1002 fddi-default act/unsup
    1003 trcrf-default act/unsup
    1004 fddinet-default act/unsup
    1005 trbrf-default act/unsup

  • SG300 voice vlan problem with UC520

    Hi Forumers'
    My problem statement:
    - refere to attached topology.png, this is how my network structure look like
    - the IP phone after boot cannot get connected, so it can't download the XML config file from UC520. suspicious switching problem.
    - my configuration shown at topology.png and my vlan voice config show as voice vlan setting.png
    - My requirement is SG300 switch single switchport to carry vlan data and vlan voice.
    - what is the trunking mode for voice VLAN siwth a IP phone+data should i configure? is it switchport voice vlan vvid, switchport voice vlan dot1p, switchport voice vlan untagged or switchport voice vlan none to suite above requirement?
    thanks
    Noel

    Hello Noel,
    Sorry for the late reply, things have been quite hectic around here lately
    1. Why use trunk? the UC520 only have vlan voice (vlan 20)
    Do you mean that the data VLAN is handled by another device ? Still I would leave it as a trunk in order to be able manage the UC through the data VLAN. (Unless for security or other reasons you would choose otherwise of course)
    2. The UC520 got CUE (voice messaging), how should i design the service module uplink to the core switch?
    Nothing in particular has to be done for this, CUE is handled and routed inside the UC520, the CUE vlan (default ID =90) is only used if you have another CUE in the network
    1. i guess i did this: swithcport tagged vlan 20, untagged vlan 10. is it ok for this setting?
    If the Voice Vlan on the switch and on the UC520 has been defined as VLAN 20 (default = VLAN 100) this is perfect. Verify if both on the UC and on the switch, the voice VLAN ID is set to 20.
    1. so if i just point the phone to vlan 20 (vlan voice), should i create the LLDP network policy?
    If you are ready to configure the VLAN manually on the phone, you don't need the LLDP policy, that is correct.
    The LLDP policy is being used for having the phones automatically choose the VLAN you defined, so you don't need to set it manually.
    Hope this answers your questions ?
    Best regards,
    Nico Muselle
    Sr. Network Engineer - CCNA

  • VLAN Problem with CE500

    We have got a CE500 switch that connected to our backbone switch (2950), we've configured the gigabit port as trunk on native vlan and created two different vlans (vlan21 assigned to port1 and vlan22 assigned to port2. now the trunk port is able to carry only vlan21 not the other vlans. please advice what could be the cause of that?
    For now I’ve configured port 1&2 in the same vlan (vlan21) just to get this link up and running.
    your help is highly appreciated…

    the CE500 can be configured through GUI only (no telnet/CLI). so i've configured the smartport role as switch for the gigabit interface and on the port status tab i can see the port is configured as trunk but there's no space to allow the trunk to carry specific vlans. (just configured as a trunk)
    and all the VLANs are created on the local database as well.
    I've tried creating another vlans but vlan21 is the only one that carried on the trunk port.

  • I have a Problem with Romming Between SSIDs withing the same WLC but with deferent VLAN .

    HI All,
    I have a Problem with Romming Between SSIDs withing the same WLC but with deferent VLAN . the WLC are providing the HQ and one of the Branches the Wireless services .
    Am using all the available 9 SSIDs at the HQ , and am using only 4 of it at the Brnche.
    The problem that i have are happening only at the Branch office as i cant room between the SSIDs within Diferent VLANs but i can do it with the one that pointing to the same VLAN. Once the client ( Laptop/Phone ) connected to one of the SSIDs. it imposiible to have him connected to the other ones with Different VLAN. meanwhile, It says its connected to the other SSID but its not getting IP from that pool.
    here is the Show Run-Config from my WLC .. and the Problem happening between the SSID AMOBILE and ASTAFF. i have the Debug while am switching between the SSIDs if needed .
    =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2013.11.04 10:20:47 =~=~=~=~=~=~=~=~=~=~=~=
    show run-config
    Press Enter to continue...
    System Inventory
    NAME: "Chassis"   , DESCR: "Cisco 5500 Series Wireless LAN Controller"
    PID: AIR-CT5508-K9, VID: V01, SN: FCW1535L01G
    Burned-in MAC Address............................ 30:E4:DB:1B:99:80
    Power Supply 1................................... Present, OK
    Power Supply 2................................... Absent
    Maximum number of APs supported.................. 12
    Press Enter to continue or <ctrl-z> to abort
    System Information
    Manufacturer's Name.............................. Cisco Systems Inc.
    Product Name..................................... Cisco Controller
    Product Version.................................. 7.0.235.0
    Bootloader Version............................... 1.0.1
    Field Recovery Image Version..................... 6.0.182.0
    Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27
    Build Type....................................... DATA + WPS
    System Name...................................... WLAN Controller 5508
    System Location..................................
    System Contact...................................
    System ObjectID.................................. 1.3.6.1.4.1.9.1.1069
    IP Address....................................... 10.125.18.15
    Last Reset....................................... Software reset
    System Up Time................................... 41 days 5 hrs 14 mins 42 secs
    System Timezone Location......................... (GMT -5:00) Eastern Time (US and Canada)
    Current Boot License Level....................... base
    Current Boot License Type........................ Permanent
    Next Boot License Level.......................... base
    Next Boot License Type........................... Permanent
    Configured Country............................... US - United States
    --More or (q)uit current module or <ctrl-z> to abort
    Operating Environment............................ Commercial (0 to 40 C)
    Internal Temp Alarm Limits....................... 0 to 65 C
    Internal Temperature............................. +36 C
    External Temperature............................. +20 C
    Fan Status....................................... OK
    State of 802.11b Network......................... Enabled
    State of 802.11a Network......................... Enabled
    Number of WLANs.................................. 10
    Number of Active Clients......................... 61
    Burned-in MAC Address............................ 30:E4:DB:1B:99:80
    Power Supply 1................................... Present, OK
    Power Supply 2................................... Absent
    Maximum number of APs supported.................. 12
    Press Enter to continue or <ctrl-z> to abort
    AP Bundle Information
    Primary AP Image  Size
    ap3g1             5804
    ap801             5192
    ap802             5232
    c1100             3096
    c1130             4972
    c1140             4992
    c1200             3364
    c1240             4812
    c1250             5512
    c1310             3136
    c1520             6412
    c3201             4324
    c602i             3716
    Secondary AP Image      Size
    ap801             4964
    c1100             3036
    --More or (q)uit current module or <ctrl-z> to abort
    c1130             4884
    c1140             4492
    c1200             3316
    c1240             4712
    c1250             5064
    c1310             3084
    c1520             5244
    c3201             4264
    Press Enter to continue or <ctrl-z> to abort
    Switch Configuration
    802.3x Flow Control Mode......................... Disable
    FIPS prerequisite features....................... Disabled
    secret obfuscation............................... Enabled
    Strong Password Check Features:
           case-check ...........Enabled
           consecutive-check ....Enabled
           default-check .......Enabled
           username-check ......Enabled
    Press Enter to continue or <ctrl-z> to abort
    Network Information
    RF-Network Name............................. OGR
    Web Mode.................................... Disable
    Secure Web Mode............................. Enable
    Secure Web Mode Cipher-Option High.......... Disable
    Secure Web Mode Cipher-Option SSLv2......... Enable
    OCSP........................................ Disabled
    OCSP responder URL..........................
    Secure Shell (ssh).......................... Enable
    Telnet...................................... Disable
    Ethernet Multicast Forwarding............... Disable
    Ethernet Broadcast Forwarding............... Disable
    AP Multicast/Broadcast Mode................. Unicast
    IGMP snooping............................... Disabled
    IGMP timeout................................ 60 seconds
    IGMP Query Interval......................... 20 seconds
    User Idle Timeout........................... 300 seconds
    ARP Idle Timeout............................ 300 seconds
    Cisco AP Default Master..................... Enabled
    AP Join Priority............................ Disable
    Mgmt Via Wireless Interface................. Disable
    Mgmt Via Dynamic Interface.................. Disable
    --More or (q)uit current module or <ctrl-z> to abort
    Bridge MAC filter Config.................... Enable
    Bridge Security Mode........................ EAP
    Mesh Full Sector DFS........................ Enable
    AP Fallback ................................ Enable
    Web Auth Redirect Ports .................... 80
    Web Auth Proxy Redirect ................... Disable
    Fast SSID Change ........................... Enabled
    AP Discovery - NAT IP Only ................. Enabled
    IP/MAC Addr Binding Check .................. Enabled
    Press Enter to continue or <ctrl-z> to abort
    Port Summary
               STP   Admin   Physical   Physical   Link   Link
    Pr Type   Stat   Mode     Mode     Status   Status Trap    POE   SFPType  
    1 Normal Forw Enable Auto       1000 Full Up     Enable N/A     1000BaseTX
    2 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    3 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    4 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    5 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    6 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    7 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    8 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    Press Enter to continue or <ctrl-z> to abort
    AP Summary
    Number of APs.................................... 8
    Global AP User Name.............................. Not Configured
    Global AP Dot1x User Name........................ Not Configured
    AP Name             Slots AP Model             Ethernet MAC       Location         Port Country Priority
    KNOWLOGY_DC01       2     AIR-LAP1131AG-A-K9   00:1d:45:86:ed:4e KNOWLOGY_DC_Serv 1       US       1
    KNOWLOGY_DC02       2     AIR-LAP1131AG-A-K9   00:21:d8:36:c5:c4 KNOWLOGY_DC_Serv 1       US       1
    KN1252_AP01         2     AIR-LAP1252AG-A-K9   00:21:d8:ef:06:50 Knowlogy Confere 1       US       1
    KN1252_AP02         2     AIR-LAP1252AG-A-K9   00:22:55:8e:2e:d4 Server Room Side 1       US       1
    Anham_AP03           2     AIR-LAP1142N-A-K9     70:81:05:88:15:b5 default location 1       US       1
    ANHAM_AP01          2     AIR-LAP1142N-A-K9     70:81:05:b0:e4:62 Small Conference 1       US       1
    ANHAM_AP04           2     AIR-LAP1131AG-A-K9   00:1d:45:86:e1:b8   Conference room 1       US       1
    ANHAM_AP02           2     AIR-LAP1142N-A-K9     70:81:05:96:7a:49         Copy Room 1       US       1
    AP Tcp-Mss-Adjust Info
    AP Name             TCP State MSS Size
    KNOWLOGY_DC01       disabled   -
    KNOWLOGY_DC02       disabled   -
    --More or (q)uit current module or <ctrl-z> to abort
    KN1252_AP01         disabled   -
    KN1252_AP02         disabled   -
    Anham_AP03           disabled   -
    ANHAM_AP01           disabled   -
    ANHAM_AP04           disabled   -
    ANHAM_AP02           disabled   -
    Press Enter to continue or <ctrl-z> to abort
    AP Location
    Total Number of AP Groups........................ 3  
    Site Name........................................ ANHAM8075
    Site Description................................. ANHAM 8075 Location
    WLAN ID         Interface         Network Admission Control         Radio Policy
    1               knowlogy_ogr         Disabled                         None
    6               knowlogy_ogr         Disabled                         None
    9               knowlogy_ogr         Disabled                         None
    7               knowlogy_ogr         Disabled                         None
    AP Name             Slots AP Model             Ethernet MAC       Location         Port Country Priority
    Anham_AP03           2     AIR-LAP1142N-A-K9   70:81:05:88:15:b5 default location 1     US       1
    ANHAM_AP01           2     AIR-LAP1142N-A-K9   70:81:05:b0:e4:62 Small Conference 1     US       1
    ANHAM_AP04           2     AIR-LAP1131AG-A-K9   00:1d:45:86:e1:b8   Conference room 1     US       1
    ANHAM_AP02           2     AIR-LAP1142N-A-K9   70:81:05:96:7a:49         Copy Room 1     US       1
    Site Name........................................ Knowlogy_DC
    --More or (q)uit current module or <ctrl-z> to abort
    Site Description................................. DC Center Access points
    WLAN ID         Interface         Network Admission Control         Radio Policy
    2               knowlogy_ogr         Disabled                         None
    4               knowlogy_ogr         Disabled                         None
    3               knowlogy_ogr         Disabled                         None
    AP Name             Slots AP Model             Ethernet MAC       Location         Port Country Priority
    KNOWLOGY_DC01       2     AIR-LAP1131AG-A-K9   00:1d:45:86:ed:4e KNOWLOGY_DC_Serv 1     US       1
    KNOWLOGY_DC02       2     AIR-LAP1131AG-A-K9   00:21:d8:36:c5:c4 KNOWLOGY_DC_Serv 1     US       1
    Site Name........................................ OGR
    Site Description................................. 1934 OGR Office
    WLAN ID         Interface         Network Admission Control         Radio Policy
    1               knowlogy_ogr         Disabled                         None
    2               knowlogy_ogr         Disabled                        None
    4               knowlogy_ogr         Disabled                         None
    6               knowlogy_ogr         Disabled                         None
    --More or (q)uit current module or <ctrl-z> to abort
    7               knowlogy_ogr        Disabled                         None
    9               knowlogy_ogr         Disabled                         None
    8               knowlogy_ogr         Disabled                         None
    AP Name             Slots AP Model             Ethernet MAC       Location         Port Country Priority
    KN1252_AP01         2     AIR-LAP1252AG-A-K9   00:21:d8:ef:06:50 Knowlogy Confere 1    US       1
    KN1252_AP02         2     AIR-LAP1252AG-A-K9   00:22:55:8e:2e:d4 Server Room Side 1     US       1
    Site Name........................................ default-group
    Site Description................................. <none>
    WLAN ID        Interface         Network Admission Control         Radio Policy
    1               knowlogy_ogr         Disabled                         None
    2               knowlogy_ogr         Disabled                         None
    3               knowlogy_ogr         Disabled                         None
    4               knowlogy_ogr         Disabled                         None
    5               knowlogy_ogr         Disabled                         None
    6               knowlogy_ogr         Disabled                         None
    7               knowlogy_ogr         Disabled                         None
    8               knowlogy_ogr         Disabled                          None
    --More or (q)uit current module or <ctrl-z> to abort
    9               knowlogy_ogr         Disabled                         None
    10             management           Disabled                         None
    AP Name             Slots AP Model             Ethernet MAC       Location         Port Country Priority
    Press Enter to continue or <ctrl-z> to abort
    AP Config
    Cisco AP Identifier.............................. 6
    Cisco AP Name.................................... KNOWLOGY_DC01
    Country code..................................... US - United States
    Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
    AP Country code.................................. US - United States
    AP Regulatory Domain............................. -A
    Switch Port Number .............................. 1
    MAC Address...................................... 00:1d:45:86:ed:4e
    IP Address Configuration......................... DHCP
    IP Address....................................... 10.22.1.100
    Gateway IP Addr.................................. 10.22.1.1
    NAT External IP Address.......................... None
    CAPWAP Path MTU.................................. 1485
    Telnet State..................................... Disabled
    Ssh State........................................ Disabled
    Cisco AP Location................................ KNOWLOGY_DC_ServerRoom
    Cisco AP Group Name.............................. Knowlogy_DC
    Primary Cisco Switch Name........................ wireless.knowlogy.com
    Primary Cisco Switch IP Address.................. 10.125.18.15
    Secondary Cisco Switch Name......................
    Secondary Cisco Switch IP Address................ Not Configured
    --More or (q)uit current module or <ctrl-z> to abortIP Address.................. 10.125.18.15
    Tertiary Cisco Switch Name.......................
    Tertiary Cisco Switch IP Address................. Not Configured
    Administrative State ............................ ADMIN_ENABLED
    Operation State ................................. REGISTERED
    Mirroring Mode .................................. Disabled
    AP Mode ......................................... H-Reap
    Public Safety ................................... Disabled
    AP SubMode ...................................... Not Configured
    Remote AP Debug ................................. Disabled
    Logging trap severity level ..................... informational
    Logging syslog facility ......................... kern
    S/W Version .................................... 7.0.235.0
    Boot Version ................................... 12.3.8.0
    Mini IOS Version ................................ 3.0.51.0
    Stats Reporting Period .......................... 180
    LED State........................................ Enabled
    PoE Pre-Standard Switch.......................... Disabled
    PoE Power Injector MAC Addr...................... Disabled
    Power Type/Mode.................................. Power injector / Normal mode
    Number Of Slots.................................. 2
    AP Model......................................... AIR-LAP1131AG-A-K9
    AP Image......................................... C1130-K9W8-M
    IOS Version...................................... 12.4(23c)JA5
    --More or (q)uit current module or <ctrl-z> to abort
    Reset Button..................................... Enabled
    AP Serial Number................................. FTX1134T0QG
    AP Certificate Type.............................. Manufacture Installed
    H-REAP Vlan mode :............................... Enabled
          Native ID :..................................... 22
          WLAN 2 :........................................ 21
          WLAN 4 :........................................ 25
          WLAN 3 :........................................ 25
    H-REAP Backup Auth Radius Servers :
    Static Primary Radius Server.................... Disabled
    Static Secondary Radius Server.................. Disabled
    Group Primary Radius Server..................... Disabled
    Group Secondary Radius Server................... Disabled
    AP User Mode..................................... AUTOMATIC
    AP User Name..................................... Not Configured
    AP Dot1x User Mode............................... Not Configured
    AP Dot1x User Name............................... Not Configured
    Cisco AP system logging host..................... 255.255.255.255
    AP Up Time....................................... 48 days, 20 h 19 m 18 s
    AP LWAPP Up Time................................. 40 days, 13 h 58 m 18 s
    Join Date and Time............................... Tue Sep 24 21:24:33 2013
    Join Taken Time.................................. 0 days, 00 h 10 m 47 s
    --More or (q)uit current module or <ctrl-z> to abort
    Attributes for Slot 0
        Radio Type................................... RADIO_TYPE_80211b
       Administrative State ........................ ADMIN_ENABLED
       Operation State ............................. UP
       Radio Role .................................. ACCESS
       CellId ...................................... 0
       Station Configuration
         Configuration ............................. AUTOMATIC
         Number Of WLANs ........................... 3
         Medium Occupancy Limit .................... 100
         CFP Period ................................ 4
         CFP MaxDuration ........................... 60
         BSSID ..................................... 00:1d:71:09:8f:90
         Operation Rate Set
           1000 Kilo Bits........................... MANDATORY
           2000 Kilo Bits........................... MANDATORY
           5500 Kilo Bits........................... MANDATORY
           11000 Kilo Bits.......................... MANDATORY
         Beacon Period ............................. 100
         Fragmentation Threshold ................... 2346
         Multi Domain Capability Implemented ....... TRUE
    --More or (q)uit current module or <ctrl-z> to abort
         Multi Domain Capability Enabled ........... TRUE
         Country String ............................ US
        Multi Domain Capability
         Configuration ............................. AUTOMATIC
         First Chan Num ............................ 1
         Number Of Channels ........................ 11
       MAC Operation Parameters
         Configuration ............................. AUTOMATIC
         Fragmentation Threshold ................... 2346
         Packet Retry Limit ........................ 64
       Tx Power
         Num Of Supported Power Levels ............. 8
         Tx Power Level 1 .......................... 20 dBm
         Tx Power Level 2 .......................... 17 dBm
         Tx Power Level 3 .......................... 14 dBm
         Tx Power Level 4 .......................... 11 dBm
         Tx Power Level 5 .......................... 8 dBm
         Tx Power Level 6 .......................... 5 dBm
         Tx Power Level 7 .......................... 2 dBm
         Tx Power Level 8 .......................... -1 dBm
    --More or (q)uit current module or <ctrl-z> to abort
         Tx Power Configuration .................... AUTOMATIC
         Current Tx Power Level .................... 1
       Phy DSSS parameters
         Configuration ............................. AUTOMATIC
         Current Channel ........................... 11
         Extension Channel ......................... NONE
         Channel Width.............................. 20 Mhz
         Allowed Channel List....................... 1,2,3,4,5,6,7,8,9,10,11
         Current CCA Mode .......................... 0
         ED Threshold .............................. -50
         Antenna Type............................... INTERNAL_ANTENNA
         Internal Antenna Gain (in .5 dBi units).... 8
         Diversity.................................. DIVERSITY_ENABLED
       Performance Profile Parameters
         Configuration ............................. AUTOMATIC
         Interference threshold..................... 10 %
         Noise threshold............................ -70 dBm
         RF utilization threshold................... 80 %
         Data-rate threshold........................ 1000000 bps
         Client threshold........................... 12 clients
         Coverage SNR threshold..................... 12 dB
    --More or (q)uit current module or <ctrl-z> to abort
         Coverage exception level................... 25 %
         Client minimum exception level............. 3 clients
       Rogue Containment Information
       Containment Count............................ 0
       CleanAir Management Information
           CleanAir Capable......................... No
    Cisco AP Identifier.............................. 6
    Cisco AP Name.................................... KNOWLOGY_DC01
    Country code..................................... US - United States
    Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
    AP Country code.................................. US - United States
    AP Regulatory Domain............................. -A
    Switch Port Number .............................. 1
    MAC Address...................................... 00:1d:45:86:ed:4e
    IP Address Configuration......................... DHCP
    IP Address....................................... 10.22.1.100
    Gateway IP Addr.................................. 10.22.1.1
    NAT External IP Address.......................... None
    CAPWAP Path MTU.................................. 1485
    Telnet State..................................... Disabled
    Ssh State........................................ Disabled
    --More or (q)uit current module or <ctrl-z> to abort
    Cisco AP Location................................ KNOWLOGY_DC_ServerRoom
    Cisco AP Group Name.............................. Knowlogy_DC
    Primary Cisco Switch Name........................ wireless.knowlogy.com
    Primary Cisco Switch Secondary Cisco Switch Name......................
    Secondary Cisco Switch IP Address................ Not Configured
    Tertiary Cisco Switch Name.......................
    Tertiary Cisco Switch IP Address................. Not Configured
    Administrative State ............................ ADMIN_ENABLED
    Operation State ................................. REGISTERED
    Mirroring Mode .................................. Disabled
    AP Mode ......................................... H-Reap
    Public Safety ................................... Disabled
    AP SubMode ...................................... Not Configured
    Remote AP Debug ................................. Disabled
    Logging trap severity level ..................... informational
    Logging syslog facility ......................... kern
    S/W Version .................................... 7.0.235.0
    Boot Version ................................... 12.3.8.0
    Mini IOS Version ................................ 3.0.51.0
    Stats Reporting Period .......................... 180
    LED State........................................ Enabled
    PoE Pre-Standard Switch.......................... Disabled
    PoE Power Injector MAC Addr...................... Disabled
    --More or (q)uit current module or <ctrl-z> to abort
    Power Type/Mode.................................. Power injector / Normal mode
    Number Of Slots.................................. 2
    AP Model......................................... AIR-LAP1131AG-A-K9
    AP Image......................................... C1130-K9W8-M
    IOS Version...................................... 12.4(23c)JA5
    Reset Button..................................... Enabled
    AP Serial Number................................. FTX1134T0QG
    AP Certificate Type.............................. Manufacture Installed
    H-REAP Vlan mode :............................... Enabled
          Native ID :..................................... 22
          WLAN 2 :........................................ 21
          WLAN 4 :........................................ 25
          WLAN 3 :........................................ 25
    H-REAP Backup Auth Radius Servers :
    Static Primary Radius Server.................... Disabled
    Static Secondary Radius Server.................. Disabled
    Group Primary Radius Server..................... Disabled
    Group Secondary Radius Server................... Disabled
    AP User Mode..................................... AUTOMATIC
    AP User Name..................................... Not Configured
    AP Dot1x User Mode............................... Not Configured
    AP Dot1x User Name............................... Not Configured
    Cisco AP system logging host..................... 255.255.255.255
    --More or (q)uit current module or <ctrl-z> to abort
    AP Up Time....................................... 48 days, 20 h 19 m 18 s
    AP LWAPP Up Time................................. 40 days, 13 h 58 m 18 s
    Join Date and Time............................... Tue Sep 24 21:24:33 2013
    Join Taken Time.................................. 0 days, 00 h 10 m 47 s
    Attributes for Slot 1
       Radio Type................................... RADIO_TYPE_80211a
       Radio Subband................................ RADIO_SUBBAND_ALL
       Administrative State ........................ ADMIN_ENABLED
       Operation State ............................. UP
       Radio Role .................................. ACCESS
       CellId ...................................... 0
       Station Configuration
         Configuration ............................. AUTOMATIC
         Number Of WLANs ........................... 3
         Medium Occupancy Limit .................... 100
         CFP Period ................................ 4
          CFP MaxDuration ........................... 60
         BSSID ..................................... 00:1d:71:09:8f:90
         Operation Rate Set
           6000 Kilo Bits........................... MANDATORY
    --More or (q)uit current module or <ctrl-z> to abort
           9000 Kilo Bits........................... SUPPORTED
           12000 Kilo Bits.......................... MANDATORY
           18000 Kilo Bits.......................... SUPPORTED
           24000 Kilo Bits.......................... MANDATORY
          36000 Kilo Bits.......................... SUPPORTED
           48000 Kilo Bits.......................... SUPPORTED
           54000 Kilo Bits.......................... SUPPORTED
         Beacon Period ............................. 100
         Fragmentation Threshold ................... 2346
         Multi Domain Capability Implemented ....... TRUE
         Multi Domain Capability Enabled ........... TRUE
         Country String ............................ US
       Multi Domain Capability
         Configuration ............................. AUTOMATIC
         First Chan Num ............................ 36
         Number Of Channels ........................ 20
       MAC Operation Parameters
         Configuration ............................. AUTOMATIC
         Fragmentation Threshold ................... 2346
         Packet Retry Limit ........................ 64
    --More or (q)uit current module or <ctrl-z> to abort
       Tx Power
         Num Of Supported Power Levels ............. 7
         Tx Power Level 1 .......................... 15 dBm
         Tx Power Level 2 .......................... 14 dBm
         Tx Power Level 3 .......................... 11 dBm
         Tx Power Level 4 .......................... 8 dBm
         Tx Power Level 5 .......................... 5 dBm
         Tx Power Level 6 .......................... 2 dBm
         Tx Power Level 7 .......................... -1 dBm
         Tx Power Configuration .................... AUTOMATIC
         Current Tx Power Level .................... 1
       Phy OFDM parameters
         Configuration ............................. AUTOMATIC
         Current Channel ........................... 44
         Extension Channel ......................... NONE
         Channel Width.............................. 20 Mhz
         Allowed Channel List....................... 36,40,44,48,52,56,60,64,100,
           ......................................... 104,108,112,116,132,136,140,
           ......................................... 149,153,157,161
         TI Threshold .............................. -50
         Antenna Type............................... INTERNAL_ANTENNA
         Internal Antenna Gain (in .5 dBi units).... 8
    --More or (q)uit current module or <ctrl-z> to abort
         Diversity.................................. DIVERSITY_ENABLED
       Performance Profile Parameters
         Configuration ............................. AUTOMATIC
         Interference threshold..................... 10 %
         Noise threshold............................ -70 dBm
         RF utilization threshold................... 80 %
          Data-rate threshold........................ 1000000 bps
         Client threshold........................... 12 clients
         Coverage SNR threshold..................... 16 dB
         Coverage exception level................... 25 %
         Client minimum exception level............. 3 clients
       Rogue Containment Information
       Containment Count............................ 0
       CleanAir Management Information
           CleanAir Capable......................... No
    Press Enter to continue or <ctrl-z> to abort
    Cisco AP Identifier.............................. 3
    Cisco AP Name.................................... KNOWLOGY_DC02
    Country code..................................... US - United States
    Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
    AP Country code.................................. US - United States
    AP Regulatory Domain............................. -A
    Switch Port Number .............................. 1
    MAC Address...................................... 00:21:d8:36:c5:c4
    IP Address Configuration......................... DHCP
    IP Address....................................... 10.22.1.101
    Gateway IP Addr.................................. 10.22.1.1
    NAT External IP Address.......................... None
    CAPWAP Path MTU.................................. 1485
    Telnet State..................................... Disabled
    Ssh State........................................ Disabled
    Cisco AP Location................................ KNOWLOGY_DC_ServerRoom
    Cisco AP Group Name.............................. Knowlogy_DC
    Primary Cisco Switch Name........................
    Primary Cisco Switch IP Address.................. Not Configured
    Secondary Cisco Switch Name......................
    Secondary Cisco Switch IP Address................ Not Configured
    Tertiary Cisco Switch Name.......................
    --More or (q)uit current module or <ctrl-z> to abort
    Tertiary Cisco Switch IP Address................. Not Configured
    Administrative State ............................ ADMIN_ENABLED
    Operation State ................................. REGISTERED
    Mirroring Mode .................................. Disabled
    AP Mode ......................................... H-Reap
    Public Safety ................................... Disabled
    AP SubMode ...................................... Not Configured
    Remote AP Debug ................................. Disabled
    Logging trap severity level ..................... informational
    Logging syslog facility ......................... kern
    S/W  Version .................................... 7.0.235.0
    Boot Version ................................... 12.3.8.0
    Mini IOS Version ................................ 3.0.51.0
    Stats Reporting Period .......................... 180
    LED State........................................ Enabled
    PoE Pre-Standard Switch.......................... Enabled
    PoE Power Injector MAC Addr...................... Disabled
    Power Type/Mode.................................. Power injector / Normal mode
    Number Of Slots.................................. 2
    AP Model......................................... AIR-LAP1131AG-A-K9
    AP Image......................................... C1130-K9W8-M
    IOS Version...................................... 12.4(23c)JA5
    Reset Button..................................... Enabled
    --More or (q)uit current module or <ctrl-z> to abort
    AP Serial Number................................. FTX1230T24F
    AP Certificate Type.............................. Manufacture Installed
    H-REAP Vlan mode :............................... Enabled
          Native ID :..................................... 22
          WLAN 2 :........................................ 21
          WLAN 4 :........................................ 25
          WLAN 3 :........................................ 25
    H-REAP Backup Auth Radius Servers :
    Static Primary Radius Server.................... Disabled
    Static Secondary Radius Server.................. Disabled
    Group Primary Radius Server..................... Disabled
    Group Secondary Radius Server................... Disabled
    AP User Mode..................................... AUTOMATIC
    AP User Name..................................... Not Configured
    AP Dot1x User Mode............................... Not Configured
    AP Dot1x User Name............................... Not Configured
    Cisco AP system logging host..................... 255.255.255.255
    AP Up Time....................................... 48 days, 20 h 24 m 41 s
    AP LWAPP Up Time................................. 40 days, 13 h 58 m 18 s
    Join Date and Time............................... Tue Sep 24 21:24:35 2013
    Join Taken Time.................................. 0 days, 00 h 10 m 48 s
    --More or (q)uit current module or <ctrl-z> to abort
    Attributes for Slot 0
       Radio Type................................... RADIO_TYPE_80211b
       Administrative State ........................ ADMIN_ENABLED
       Operation State ............................. UP
       Radio Role .................................. ACCESS
       CellId ...................................... 0
        Station Configuration
         Configuration ............................. AUTOMATIC
         Number Of WLANs ........................... 3
         Medium Occupancy Limit .................... 100
         CFP Period ................................ 4
         CFP MaxDuration ........................... 60
         BSSID ..................................... 00:22:55:a5:0c:30
         Operation Rate Set
           1000 Kilo Bits........................... MANDATORY
           2000 Kilo Bits........................... MANDATORY
           5500 Kilo Bits........................... MANDATORY
           11000 Kilo Bits.......................... MANDATORY
         Beacon Period ............................. 100
         Fragmentation Threshold ................... 2346
         Multi Domain Capability Implemented ....... TRUE
         Multi Domain Capability Enabled ........... TRUE
    --More or (q)uit current module or <ctrl-z> to abort
         Country String ............................ US
       Multi Domain Capability
         Configuration ............................. AUTOMATIC
         First Chan Num ............................ 1
         Number Of Channels ........................ 11
       MAC Operation Parameters
         Configuration ............................. AUTOMATIC
         Fragmentation Threshold ................... 2346
         Packet Retry Limit ........................ 64
       Tx Power
         Num Of Supported Power Levels ............. 8
         Tx Power Level 1 .......................... 20 dBm
         Tx Power Level 2 .......................... 17 dBm
         Tx Power Level 3 .......................... 14 dBm
         Tx Power Level 4 .......................... 11 dBm
         Tx Power Level 5 .......................... 8 dBm
         Tx Power Level 6 .......................... 5 dBm
         Tx Power Level 7 .......................... 2 dBm
         Tx Power Level 8 .......................... -1 dBm
         Tx Power Configuration .................... AUTOMATIC
    --More or (q)uit current module or <ctrl-z> to abort
         Current Tx Power Level .................... 1
       Phy DSSS parameters
         Configuration ............................. AUTOMATIC
         Current Channel ........................... 1
         Extension Channel ......................... NONE
         Channel Width.............................. 20 Mhz
         Allowed Channel List....................... 1,2,3,4,5,6,7,8,9,10,11
         Current CCA Mode .......................... 0
         ED Threshold .............................. -50
         Antenna Type............................... INTERNAL_ANTENNA
         Internal Antenna Gain (in .5 dBi units).... 8
         Diversity.................................. DIVERSITY_ENABLED
       Performance Profile Parameters
         Configuration ............................. AUTOMATIC
         Interference threshold..................... 10 %
         Noise threshold............................ -70 dBm
         RF utilization threshold................... 80 %
         Data-rate threshold........................ 1000000 bps
         Client threshold........................... 12 clients
         Coverage SNR threshold..................... 12 dB
         Coverage exception level................... 25 %
    --More or (q)uit current module or <ctrl-z> to abort
         Client minimum exception level............. 3 clients
       Rogue Containment Information
       Containment Count............................ 0
       CleanAir Management Information
           CleanAir Capable......................... No
    Cisco AP Identifier.............................. 3
    Cisco AP Name.................................... KNOWLOGY_DC02
    Country code..................................... US - United States
    Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
    AP Country code.................................. US - United States
    AP Regulatory Domain............................. -A
    Switch Port Number .............................. 1
    MAC Address...................................... 00:21:d8:36:c5:c4
    IP Address Configuration......................... DHCP
    IP Address....................................... 10.22.1.101
    Gateway IP Addr.................................. 10.22.1.1
    NAT External IP Address.......................... None
    CAPWAP Path MTU.................................. 1485
    Telnet State..................................... Disabled
    Ssh State........................................ Disabled
    Cisco AP Location................................ KNOWLOGY_DC_ServerRoom
    --More or (q)uit current module or <ctrl-z> to abort
    Cisco AP Group Name.............................. Knowlogy_DC
    Primary Cisco Switch Name........................
    Primary Cisco Switch IP Address.................. Not Configured
    Secondary Cisco Switch Name......................
    Secondary Cisco Switch IP Address................ Not Configured
    Tertiary Cisco Switch Name.......................
    Tertiary Cisco Switch IP Address................. Not Configured
    Administrative State ............................ ADMIN_ENABLED
    Operation State ................................. REGISTERED
    Mirroring Mode .................................. Disabled
    AP Mode ......................................... H-Reap
    Public Safety ................................... Disabled
    AP SubMode ...................................... Not Configured
    Remote AP Debug ................................. Disabled
    Logging trap severity level ..................... informational
    Logging syslog facility ......................... kern
    S/W Version .................................... 7.0.235.0
    Boot Version ................................... 12.3.8.0
    Mini IOS Version ................................ 3.0.51.0
    Stats Reporting Period .......................... 180
    LED State........................................ Enabled
    PoE Pre-Standard Switch.......................... Enabled
    PoE Power Injector MAC Addr...................... Disabled
    --More or (q)uit current module or <ctrl-z> to abort
    Power Type/Mode.................................. Power injector / Normal mode
    Number Of Slots.................................. 2
    AP Model......................................... AIR-LAP1131AG-A-K9
    AP Image......................................... C1130-K9W8-M
    IOS Version...................................... 12.4(23c)JA5
    Reset Button..................................... Enabled
    AP Serial Number................................. FTX1230T24F
    AP Certificate Type.............................. Manufacture Installed
    H-REAP Vlan mode :............................... Enabled
          Native ID :..................................... 22
          WLAN 2 :........................................ 21
          WLAN 4 :........................................ 25
          WLAN 3 :........................................ 25
    H-REAP Backup Auth Radius Servers :
    Static Primary Radius Server.................... Disabled
    Static Secondary Radius Server.................. Disabled
    Group Primary Radius Server..................... Disabled
    Group Secondary Radius Server................... Disabled
    AP User Mode..................................... AUTOMATIC
    AP User Name..................................... Not Configured
    AP Dot1x User Mode............................... Not Configured
    AP Dot1x User Name............................... Not Configured
    Cisco AP system logging host..................... 255.255.255.255
    --More or (q)uit current module or <ctrl-z> to abort
    AP Up Time....................................... 48 days, 20 h 24 m 41 s
    AP LWAPP Up Time................................. 40 days, 13 h 58 m 18 s
    Join Date and Time............................... Tue Sep 24 21:24:35 2013
    Join Taken Time.................................. 0 days, 00 h 10 m 48 s
    Attributes for Slot 1
       Radio Type................................... RADIO_TYPE_80211a
       Radio Subband................................ RADIO_SUBBAND_ALL
       Administrative State ........................ ADMIN_ENABLED
       Operation State ............................. UP
       Radio Role .................................. ACCESS
       CellId ...................................... 0
       Station Configuration
         Configuration ............................. AUTOMATIC
         Number Of WLANs ........................... 3
         Medium Occupancy Limit .................... 100
         CFP Period ................................ 4
         CFP MaxDuration ........................... 60
         BSSID ..................................... 00:22:55:a5:0c:30
         Operation Rate Set
           6000 Kilo Bits........................... MANDATORY
    --More or (q)uit current module or <ctrl-z> to abort
           9000 Kilo Bits........................... SUPPORTED
           12000 Kilo Bits.......................... MANDATORY
           18000 Kilo Bits.......................... SUPPORTED
           24000 Kilo Bits.......................... MANDATORY
           36000 Kilo Bits.......................... SUPPORTED
           48000 Kilo Bits.......................... SUPPORTED
           54000 Kilo Bits.......................... SUPPORTED
         Beacon Period ............................. 100
         Fragmentation Threshold ................... 2346
         Multi Domain Capability Implemented ....... TRUE
         Multi Domain Capability Enabled ........... TRUE
         Country String ............................ US
       Multi Domain Capability
         Configuration ............................. AUTOMATIC
         First Chan Num ............................ 36
         Number Of Channels ........................ 20
       MAC Operation Parameters
         Configuration ............................. AUTOMATIC
         Fragmentation Threshold ................... 2346
         Packet Retry Limit ........................ 64
    --More or (q)uit current module or <ctrl-z> to abort
       Tx Power
         Num Of Supported Power Levels ............. 7
         Tx Power Level 1 .......................... 15 dBm
        Tx Power Level 2 .......................... 14 dBm
         Tx Power Level 3 .......................... 11 dBm
         Tx Power Level 4 .......................... 8 dBm
         Tx Power Level 5 .......................... 5 dBm
         Tx Power Level 6 .......................... 2 dBm
         Tx Power Level 7 .......................... -1 dBm
         Tx Power Configuration .................... AUTOMATIC
         Current Tx Power Level .................... 1
       Phy OFDM parameters
         Configuration ............................. AUTOMATIC
         Current Channel ........................... 36
         Extension Channel ......................... NONE
         Channel Width.............................. 20 Mhz
         Allowed Channel List....................... 36,40,44,48,52,56,60,64,100,
           ......................................... 104,108,112,116,132,136,140,
           ......................................... 149,153,157,161
         TI Threshold .............................. -50
         Antenna Type............................... INTERNAL_ANTENNA
         Internal Antenna Gain (in .5 dBi units).... 8
    --More or (q)uit current module or <ctrl-z> to abort
         Diversity.................................. DIVERSITY_ENABLED
       Performance Profile Parameters
          Configuration ............................. AUTOMATIC
         Interference threshold..................... 10 %
         Noise threshold............................ -70 dBm
         RF utilization threshold................... 80 %
         Data-rate threshold........................ 1000000 bps
         Client threshold........................... 12 clients
         Coverage SNR threshold..................... 16 dB
         Coverage exception level................... 25 %
         Client minimum exception level............. 3 clients
       Rogue Containment Information
       Containment Count............................ 0
       CleanAir Management Information
           CleanAir Capable......................... No
    Press Enter to continue or <ctrl-z> to abort
    Cisco AP Identifier.............................. 5
    Cisco AP Name.................................... KN1252_AP01
    Country code..................................... US - United States
    Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
    AP Country code.................................. US - United States
    AP Regulatory Domain............................. -A
    Switch Port Number .............................. 1
    MAC Address...................................... 00:21:d8:ef:06:50
    IP Address Configuration......................... DHCP
    IP Address....................................... 10.125.18.101
    IP NetMask....................................... 255.255.255.0
    Gateway IP Addr.................................. 10.125.18.1
    NAT External IP Address.......................... None
    CAPWAP Path MTU.................................. 1485
    Telnet State..................................... Enabled
    Ssh State........................................ Disabled
    Cisco AP Location................................ Knowlogy Conference Rooms Side
    Cisco AP Group Name.............................. OGR
    Primary Cisco Switch Name........................
    Primary Cisco Switch IP Address.................. Not Configured
    Secondary Cisco Switch Name......................
    Secondary Cisco Switch IP Address................ Not Configured
    --More or (q)uit current module or <ctrl-z> to abort
    Tertiary Cisco Switch Name.......................
    Tertiary Cisco Switch IP Address................. Not Configured
    Administrative State ............................ ADMIN_ENABLED
    Operation State ................................. REGISTERED
    Mirroring Mode .................................. Disabled
    AP Mode ......................................... H-Reap
    Public Safety ................................... Disabled
    AP SubMode ...................................... Not Configured
    Remote AP Debug ................................. Disabled
    Logging trap severity level ..................... informational
    Logging syslog facility ......................... kern
    S/W Version .................................... 7.0.235.0
    Boot Version ................................... 12.4.10.0
    Mini IOS Version ................................ 3.0.51.0
    Stats Reporting Period .......................... 180
    LED State........................................ Enabled
    PoE Pre-Standard Switch.......................... Disabled
    PoE Power Injector MAC Addr...................... Disabled
    Power Type/Mode.................................. PoE/Medium Power (15.4 W)
    Number Of Slots.................................. 2
    AP Model......................................... AIR-LAP1252AG-A-K9
    AP Image......................................... C1250-K9W8-M
    IOS Version...................................... 12.4(23c)JA5
    --More or (q)uit current module or <ctrl-z> to abort
    Reset Button..................................... Enabled
    AP Serial Number................................. FTX122990L5
    AP Certificate Type.............................. Manufacture Installed
    H-REAP Vlan mode :............................... Enabled
          Native ID :..................................... 118
          WLAN 1 :........................................ 111
          WLAN 2 :........................................ 111
          WLAN 4 :........................................ 112
          WLAN 6 :........................................ 112
          WLAN 7 :........................................ 111
          WLAN 9 :........................................ 112
          WLAN 8 :........................................ 112
    H-REAP Backup Auth Radius Servers :
    Static Primary Radius Server.................... Disabled
    Static Secondary Radius Server.................. Disabled
    Group Primary Radius Server..................... Disabled
    Group Secondary Radius Server................... Disabled
    AP User Mode..................................... AUTOMATIC
    AP User Name..................................... Not Configured
    AP Dot1x User Mode............................... Not Configured
    AP Dot1x User Name............................... Not Configured
    Cisco AP system logging host..................... 255.255.255.255
    AP Up Time....................................... 26 days, 00 h 24 m 39 s
    --More or (q)uit current module or <ctrl-z> to abort
    AP LWAPP Up Time................................. 26 days, 00 h 23 m 48 s
    Join Date and Time............................... Wed Oct 9 10:59:07 2013
    Join Taken Time.................................. 0 days, 00 h 00 m 50 s
    Attributes for Slot 0
       Radio Type................................... RADIO_TYPE_80211n-2.4
       Administrative State ........................ ADMIN_ENABLED
       Operation State ............................. UP
       Radio Role .................................. ACCESS
       CellId ...................................... 0
       Station Configuration
         Configuration ............................. AUTOMATIC
         Number Of WLANs ........................... 7
         Medium Occupancy Limit .................... 100
         CFP Period ................................ 4
         CFP MaxDuration ........................... 60
         BSSID ..................................... 00:22:55:df:a5:90
         Operation Rate Set
           1000 Kilo Bits........................... MANDATORY
           2000 Kilo Bits........................... MANDATORY
           5500 Kilo Bits........................... MANDATORY
    --More or (q)uit current module or <ctrl-z> to abort
           11000 Kilo Bits.......................... MANDATORY
         MCS Set
           MCS 0.................................... SUPPORTED
           MCS 1.................................... SUPPORTED
           MCS 2.................................... SUPPORTED
           MCS 3.................................... SUPPORTED
           MCS 4.................................... SUPPORTED
           MCS 5.................................... SUPPORTED
           MCS 6.................................... SUPPORTED
           MCS 7.................................... SUPPORTED
           MCS 8.................................... SUPPORTED
            MCS 9.................................... SUPPORTED
           MCS 10................................... SUPPORTED
           MCS 11................................... SUPPORTED
           MCS 12................................... SUPPORTED
           MCS 13................................... SUPPORTED
           MCS 14................................... SUPPORTED
           MCS 15................................... SUPPORTED
         Beacon Period ............................. 100
         Fragmentation Threshold ................... 2346
         Multi Domain Capability Implemented ....... TRUE
         Multi Domain Capability Enabled ........... TRUE
         Country String ............................ US
    --More or (q)uit current module or <ctrl-z> to abort
       Multi Domain Capability
         Configuration ............................. AUTOMATIC
         First Chan Num ............................ 1
         Number Of Channels ........................ 11
       MAC Operation Parameters
         Configuration ............................. AUTOMATIC
         Fragmentation Threshold ................... 2346
         Packet Retry Limit ........................ 64
       Tx Power
         Num Of Supported Power Levels ............. 8
         Tx Power Level 1 .......................... 20 dBm
         Tx Power Level 2 .......................... 17 dBm
         Tx Power Level 3 .......................... 14 dBm
         Tx Power Level 4 ..........

    Well you need to understand the behavior of h-reap or what it's called now, FlexConnect. In this mode, the clients are still remembers on the WLC until the session timer/idle timer expires. So switching between SSID's in h-reap will not be the same when switching when the AP's are in local mode.
    Take a look at the client when connected in FlexConnect in the WLC GUI monitor tab. Thus will show you what ssid and vlan the client is on. Now switch to a different ssid and compare this. It's probably the same because the client has not timed out. Now go back to the other ssid and look again. Now on the WLC, remove or delete the client and then switch to the other ssid at the same time. Or switch SSID's and then remove the client. The client will join the new ssid and in the monitor tab, you should see the info.
    There is no need to have clients have multiple SSID's unless your testing. Devices should only have one ssid profile configured to eliminate any connectivity issues from the device wanting to switch SSID's.
    Sent from Cisco Technical Support iPhone App

  • A problem with vlan.dat retrieval in the RME

    Hello,
    the customer has LMS 3.1 and he uses RME for the backup of config files and vlan.dat files from netwrok devices. It is working fine, but he has problem with backuping vlan.dat files from the following switches: Cat2960-8TC,-24TC, Cat2960G-24TC,-48TC,-8TC and Cat3560E-24TD-E,S. I downloaded the latest packages for these devices into RME. I changed the telnet timeout value from 32s to 70s. But this issue still exist:-( The running and startup config from these switches is downloaded without any problem. Is it a bug?
    Thank you
    Best Regards
    Roman

    Hello,
    I tried it manually and the copy is working ( i had to create empty file in the tftp directory under CSCOpx):-( The error mesage is that ssh and telnet is not available and tftp doesn't support fetching of vlan.dat. But ssh is working on the switches (the running and startup config is fetched by RME without any problem from these switches). The credentials verifications is done with OK for ssh and enable secret for these switches.
    Roman

  • Problems with vlan and dot1q trunking port

    Dear Folks,
    i have problems with my AccessPoint Konfiguration.
    Even when i set the Catalyst Port to trunk, i can only connect to VLAN 1 but not to VLAN 10.
    and if i change the port to statik vlan 10 i can not connect to the ap but it works...
    config below:
    User Access Verification
    version 12.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    hostname 1200_PP_1
    logging queue-limit 100
    enable secret xxxx
    clock timezone A 1
    ip subnet-zero
    bridge irb
    interface Dot11Radio0
    no ip address
    no ip route-cache
    ssid DEPACNGLW0HS
    vlan 10
    authentication shared
    infrastructure-ssid
    mobility network-id 10
    speed basic-1.0 2.0 5.5 11.0
    rts threshold 2312
    channel 2412
    antenna receive right
    antenna transmit right
    station-role root
    interface Dot11Radio0.1
    no ip route-cache
    interface Dot11Radio0.10
    encapsulation dot1Q 10 native
    no ip route-cache
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 port-protected
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    bridge-group 1 spanning-disabled
    interface FastEthernet0
    no ip address
    no ip route-cache
    speed 100
    full-duplex
    ntp broadcast client
    interface FastEthernet0.1
    encapsulation dot1Q 1
    no ip route-cache
    bridge-group 254
    no bridge-group 254 source-learning
    bridge-group 254 spanning-disabled
    interface FastEthernet0.10
    encapsulation dot1Q 10 native
    no ip route-cache
    bridge-group 1
    no bridge-group 1 source-learning
    bridge-group 1 spanning-disabled
    interface BVI1
    ip address 10.2.2.222 255.255.255.0
    no ip route-cache
    ip default-gateway 10.2.2.2
    ip http server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag/122-15.JA/1100
    ip radius source-interface BVI1
    bridge 1 route ip
    line con 0
    line vty 0 4
    login local
    line vty 5 15
    login
    end
    it would be fine if anyone could help me....

    You configure Layer 3 Mobility with WLSM. No trunking is required on the CAT switch. However, you need to set the switch port on the CAT switch as access port in VLAN 10.
    Please post the WLSM and SUP720 configuration. Also, which VLAN do you want to access the AP?
    The following URL may be useful for you to verify the configuration:
    http://www.cisco.com/en/US/partner/products/hw/wireless/ps430/prod_technical_reference09186a00802a86a7.html

  • Bridging problem with multiple vlans

    Hello Everyone, I am using two 1310 bridges in a root / non-root setup. The switches on both sides of the wireless bridge were setup to trunk native vlan 253. Each wireless bridge also had vlan 253 setup as a Radio and Ethernet Interface. In this config, the wireless bridges could associate and ping each other, but the switches on each side could not ping each other?s management vlan interface (Vlan 25). The only way to get traffic to pass to the corresponding switches on each side of the wireless bridge was to use vlan 253 for everything. We also see this problem with some of our other 1310 bridge connections at other plants. Has anyone seen this problem or a similar problem before?

    Hi Craig,
    Er, dunno if you have any insight on my issue. I'm trying to get 2 AP1231s (12.3-8) in bridge mode (root/non-root, antennas transmit/receive right) that have 4 VLANs going across the airwaves. Now, the bridges are associated, they can see each other's IP address, but will they ping? Absolutely not! VLAN20 is the native assigned to bridge-group 1, I've tried IP addresses on the BVI1, dot11Radio 0.20 and fa0.20 interfaces with no luck. There's no other fancy configuration options applied, just 4 VLANs going across two associated bridges. Any ideas? Appreciate any assistance you can offer.
    I'd already found the document that Rob recommended beforehand and that proved useful in getting the units to associate. Now I just need a ping! A PC connected to the non-root bridge's Ethernet port via a Xover cable is able to ping the non-root bridge but that's as far as it goes.
    Root bridge config attached. No IP assigned on this copy but as advised, tried a few scenarios!
    Thanks, Paul

  • Problems with IP Phones registration to CUCME on SG200-50P

    Problems with IP Phones registration to CUCME on SG200-50P
    System setup:
    - Router Cisco 2811 with IOS 12.4(24)T5 Advanced IP Services, CUCME 7.1, DHCP Server
       with HWIC-4ESW
    - Switches:
       - old - SLM224P
       - new - SG200-50P (SLM2048PT), OS v1.3.2.02
    - IP Phones 7911 and 7931, OS v8.4.2
    One VLAN (for desktops and IP Phones) and one IP subnet, no voice VLAN.
    Network diagram:
    C2811---HWIC-4ESW---SWITCH---IPPhones
    Problem description:
    1. In the old setup with SLM224P everything works fine.
       Connected phones almost immediately (1-2 sec. after power up) get ip address, configuration and registers to CUCME.
    2. When switch is changed to new SG200-50G:
       - ip phones get their ip address and tftp configuration very slowly - about 10-20 seconds
       - ip phones cant register to CUCME at all. On the router with SCCP debugging turned on there is no sing of registration attempt
       - after reconnecting the old SLM224P situation backs to normal
    Things that have been checked or tried without success:
    - ports speed and duplex auto, correct detection - although not tested with manual settings
    - CDP/LLDP on/off
    - smartport mode auto and most static settings, also with disabled smartport
    - power cycle / reset
    - spanning tree and port security settings
    - solutions from that post - https://supportforums.cisco.com/thread/2232161
    None of the above methods worked.
    The only action that allowed ip phones to register was changing smartport role to static IPPhone + Desktop.
    After that when phone was disconnected and then reconnected the problem exists again - no registration (IP Phone status DECEASED in CUCME). Same with power cycle/reset.
    Please advice.
    Thanks in advance.

    1 - You have created the voice vlan?
    Nope, flat network, one ip subnet (10 hosts and 10 phones)
    2 - Have you set a phone on an untagged access port for the voice vlan to see if it works?
    Yep, phones are connected to untagged access ports of the one and only vlan
    3 - Have you tried to set the auto voice vlan on the switch so it dynamically assigns the role for ip phone + desktop?
    Not sure about auto voice vlan setting, although there was no triggers to AVV - no static voice vlan, no CDP/VSDP advertisements of voice vlan.
    We've tested static and auto smartport roles (independently of auto voice vlan feature) with successful auto-detection.
    The switch was pretty much in default out-of-the-box config (beside management parameters).
    4 - When rebooting the switch, you did ensure to save the start up to running config?
    Yes, running to startup
    5 - Have you manually set spanning tree PORT FAST for the phone ports?
    No, we haven't tested that. But portfast should be set automatically for the desktop and ip phone smartport roles.

  • Cisco ASA 5505 - problem with negotiating IP address from PPPoE

    Hi all,
    I have problem with negotiating IP address from PPPoE. There is following design: ISP providing vDSL ending on VDSL modem in bridge mode. Behind brigde modem is ASA 5505 terminting PPPoE on OUTSIDE. Everything works fine except  negotiating IP address from PPPoE server.
    I have configured ASA 5505 with (ASA Version 9.2(2)4) for PPPoE like this [1.]. But If i try to "show" IP address on OUTSIDE interface a get this [2.], ok strange but let's continue. If list "show vpdn pppinterface id 1"  i get this [3.]. Seems that I got public IP addres what was right, but this IP address was not associated with interface OUTSIDE?
    Well, if I set IP address manually like this [4.] and also set a default route everything works fine but what will happen when ISP change reservation for my IP address or default gateway. 
    I have tried different version of ASA OS like 8.4, 9.1 but without luck. 
    Can anybody help me. Thanks a lot.
    Regards
    Karel
    [1.]
    interface Vlan100
    description >>VLAN pro pripojeni do internetu<<
    nameif OUTSIDE
    security-level 0
    pppoe client vpdn group O2
    ip address pppoe setroute
    vpdn group O2 request dialout pppoe
    vpdn group O2 localname O2
    vpdn group O2 ppp authentication chap
    vpdn username O2 password *****
    interface Ethernet0/0
    description >>uplink O2 vDSL<<
    switchport access vlan 100
    [2.]
    ciscoasa(config-if)# show ip address vlan 100 pppoe
    ciscoasa(config-if)#  0.0.0.0 255.255.255.255 on Interface: OUTSIDE
    ciscoasa(config-if)# show interface vlan 100 detail
    Interface Vlan2 "OUTSIDE", is up, line protocol is up
     Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
            Description: >>VLAN pro pripojeni do internetu<<
            MAC address f44e.05d0.6c17, MTU 1492
            IP address unassigned
      Traffic Statistics for "OUTSIDE":
            28 packets input, 1307 bytes
            31 packets output, 721 bytes
            0 packets dropped
          1 minute input rate 0 pkts/sec,  3 bytes/sec
          1 minute output rate 0 pkts/sec,  1 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
      Control Point Interface States:
            Interface number is 15
            Interface config status is active
            Interface state is active
    [3.]
    ciscoasa(config-if)# show vpdn pppinterface id 1
    PPP virtual interface id = 1
    PPP authentication protocol is CHAP
    Server ip address is 88.103.200.41
    Our ip address is 85.71.188.158
    Transmitted Pkts: 20, Received Pkts: 16, Error Pkts: 0
    MPPE key strength is None
      MPPE_Encrypt_Pkts: 0,  MPPE_Encrypt_Bytes: 0
      MPPE_Decrypt_Pkts: 0,  MPPE_Decrypt_Bytes: 0
      Rcvd_Out_Of_Seq_MPPE_Pkts: 0
    ciscoasa(config-if)# show vpdn session state
    %No active L2TP tunnels
    %No active PPTP tunnels
    PPPoE Session Information (Total tunnels=1 sessions=1)
    SessID TunID Intf     State       Last Chg
    22298      2 OUTSIDE  SESSION_UP  561 secs
    [4.]
    interface Vlan100
     description >>VLAN pro pripojeni do internetu<<
     nameif OUTSIDE
     security-level 0
     pppoe client vpdn group O2
     ip address 85.71.188.158 255.255.255.255 pppoe setroute
     route OUTSIDE 0.0.0.0 0.0.0.0 88.103.200.41 1

    You're right that the ACL should not affect otherwise allowed communications to the interface address.
    Try disabling the ip audit feature on your outside interface.
    no ip audit interface OUTSIDE AP_OUTSIDE_INFO
    no ip audit interface OUTSIDE AP_OUTSIDE_ATTACK

  • HELP!! asa 5505 8.4(5) problem with port forwarding-smtp

    Hi I am having a big problem with port forwarding on my asa. I am trying to forward smtp through the asa  to my mail server.
    my mail server ip is 10.0.0.2 and my outside interface is 80.80.80.80 , the ASA is setup with pppoe (I get internet access no problem and that seems fine)
    When I run a trace i get "(ACL-Drop) - flow is deied by configured rule"
    below is my config file , any help would be appreciated
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.4(5)
    hostname ciscoasa
    domain-name domain.local
    enable password mXa5sNUu4rCZ.t5y encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group ISPDsl
    ip address 80.80.80.80 255.255.255.255 pppoe setroute
    ftp mode passive
    dns server-group DefaultDNS
    domain-name domain.local
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network Server_SMTP
    host 10.0.0.2
    access-list outside_access_in extended permit tcp any object server_SMTP eq smtp
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    object network obj_any
    nat (inside,outside) dynamic interface
    object network server_SMTP
    nat (inside,outside) static interface service tcp smtp smtp
    nat (inside,outside) after-auto source dynamic any interface
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 10.0.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    vpdn group ISP request dialout pppoe
    vpdn group ISP localname [email protected]
    vpdn group ISP ppp authentication chap
    vpdn username [email protected] password *****
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:c5570d7ddffd46c528a76e515e65f366
    : end

    Hi Jennifer
    I have removed that nat line as suggested but still no joy.
    here is my current config
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.4(5)
    hostname ciscoasa
    domain-name domain.local
    enable password mXa5sNUu4rCZ.t5y encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group ISP
    ip address 80.80.80.80 255.255.255.255 pppoe setroute
    ftp mode passive
    dns server-group DefaultDNS
    domain-name domain.local
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network Server_Mail
    host 10.0.0.2
    access-list outside_access_in extended permit tcp any object Server_Mail eq smtp
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    object network obj_any
    nat (inside,outside) dynamic interface
    object network Server_Mail
    nat (inside,outside) static interface service tcp smtp smtp
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 10.0.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    vpdn group ISP request dialout pppoe
    vpdn group ISP localname [email protected]
    vpdn group ISP ppp authentication chap
    vpdn username [email protected] password *****
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:f3bd954d1f9499595aab4f9da8c15795
    : end
    also here is the packet trace
    and my acl
    Thanks

  • Cisco ASA 5505 - problem with ssh, icmp on OUTSIDE interface

    Hi all,
    I have a very strange problem with OUTSIDE interface and remote ssh. Well, I have followed documentation and configure remote access for ssh like this [1.]. If I want to connect from internet to OUTSIDE interface [2.] get no response and in log I can see this message [3.]. I really do not understand why is ssh connection dropped by OUTSIDE access-list [4.]? If I understand documentation correctly there is no impact for remote mangement/access like icmp, ssh, http(s) by interface access-list. So, why?
    When I try ssh connection form internal network to INSIDE interface everything works fine and I can log in to ASA. If I try allow ssh in OUTSIDE access-list still no success and a get this message [5.]? It is strange, isn't?
    The same problem with icmp if I want to "ping" OUTSIDE interface from internet a get thish message in log [6.] and configuration for ICMP like this [7.].
    Full ASA config is in attachment.
    Can anybody help how to fix it and explain what is exactly wrong.Thanks.
    Regards,
    Karel
    [1.]
    ssh stricthostkeycheck
    ssh 10.0.0.0 255.255.255.0 INSIDE
    ssh 0.0.0.0 0.0.0.0 OUTSIDE
    ssh timeout 60
    ssh version 2
    ssh key-exchange group dh-group1-sha1
    ASA-FW01# show ssh
    Timeout: 60 minutes
    Version allowed: 2
    10.0.0.0 255.255.255.0 INSIDE
    0.0.0.0 0.0.0.0 OUTSIDE
     [2.]
    ASA-FW01# show nameif
    Interface                Name                     Security
    Vlan10                   INSIDE                   100
    Vlan20                   EXT-VLAN20                 0
    Vlan30                   EXT-WIFI-VLAN30           10
    Vlan100                  OUTSIDE                    0
    ASA-FW01# show ip
    System IP Addresses:
    Interface                Name                   IP address      Subnet mask     Method
    Vlan10                   INSIDE                 10.0.0.1        255.255.255.0   CONFIG
    Vlan20                   EXT-VLAN20             10.0.1.1        255.255.255.0   CONFIG
    Vlan30                   EXT-WIFI-VLAN30        10.0.2.1        255.255.255.0   CONFIG
    Vlan100                  OUTSIDE                85.71.188.158   255.255.255.255 CONFIG
    Current IP Addresses:
    Interface                Name                   IP address      Subnet mask     Method
    Vlan10                   INSIDE                 10.0.0.1        255.255.255.0   CONFIG
    Vlan20                   EXT-VLAN20             10.0.1.1        255.255.255.0   CONFIG
    Vlan30                   EXT-WIFI-VLAN30        10.0.2.1        255.255.255.0   CONFIG
    Vlan100                  OUTSIDE                85.71.188.158   255.255.255.255 CONFIG
    ASA-FW01# show interface OUTSIDE detail
    Interface Vlan100 "OUTSIDE", is up, line protocol is up
      Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
            Description: >>VLAN pro pripojeni do internetu<<
            MAC address f44e.05d0.6c17, MTU 1480
            IP address 85.71.188.158, subnet mask 255.255.255.255
      Traffic Statistics for "OUTSIDE":
            90008 packets input, 10328084 bytes
            60609 packets output, 13240078 bytes
            1213 packets dropped
          1 minute input rate 15 pkts/sec,  994 bytes/sec
    [3.]
    Jan 13 2015 06:45:30 ASA-FW01 : %ASA-6-106100: access-list OUTSIDE denied tcp OUTSIDE/193.86.236.70(46085) -> OUTSIDE/85.71.188.158(22) hit-cnt 1 first hit [0xb74026ad, 0x0]
    [4.]
    access-list OUTSIDE remark =======================================================================================
    access-list OUTSIDE extended permit icmp any any echo-reply
    access-list OUTSIDE extended deny ip any any log
    access-group OUTSIDE in interface OUTSIDE
    [5.]
    Jan 12 2015 23:00:46 ASA-FW01 : %ASA-2-106016: Deny IP spoof from (193.86.236.70) to 85.71.188.158 on interface OUTSIDE
    [6.]
    Jan 13 2015 06:51:16 ASA-FW01 : %ASA-4-400014: IDS:2004 ICMP echo request from 193.86.236.70 to 85.71.188.158 on interface OUTSIDE
    [7.]
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit 10.0.0.0 255.0.0.0 INSIDE
    icmp permit 10.0.0.0 255.0.0.0 EXT-WIFI-VLAN30
    icmp permit any OUTSIDE

    You're right that the ACL should not affect otherwise allowed communications to the interface address.
    Try disabling the ip audit feature on your outside interface.
    no ip audit interface OUTSIDE AP_OUTSIDE_INFO
    no ip audit interface OUTSIDE AP_OUTSIDE_ATTACK

  • Problem with EAP and RADIUS

    Hi *,
      I have the following problem with RADIUS and EAP authentication.
    Radius server sends an "Access-Accept" packet to my AP, but the station does not authenticate.
    I've tried with different encryption configuration and with different authentication methods under "dot11 essid", but nothing changes...
    What could it be?
    Debug piece and configuration follows:
    *Jan 25 14:23:34.795: RADIUS/ENCODE(00000012): acct_session_id: 17*Jan 25 14:23:34.795: RADIUS(00000012): sending*Jan 25 14:23:34.799: RADIUS:   4E 47 56 7A 78 65 4A 4F 55 31 47 40 77 6C 61 6E  [NGVzxeJOU1G@wlan]*Jan 25 14:23:34.799: RADIUS:   2E 6D 6E 63 30 30 31 2E 6D 63 63 30 30 31 2E 33  [.mnc001.mcc001.3]*Jan 25 14:23:34.799: RADIUS:   67 70 70 6E 65 74 77 6F 72 6B 2E 6F 72 67        [gppnetwork.org]*Jan 25 14:23:34.799: RADIUS:  NAS-Port-Type       [61]  6   802.11 wireless           [19]*Jan 25 14:23:34.799: RADIUS:  NAS-Port            [5]   6   265                       *Jan 25 14:23:34.799: RADIUS:  NAS-Port-Id         [87]  5   "265"*Jan 25 14:23:34.799: RADIUS:  NAS-IP-Address      [4]   6   192.168.173.2             *Jan 25 14:23:34.811: RADIUS/DECODE: EAP-Message fragments, 20, total 20 bytes*Jan 25 14:23:34.831: RADIUS/ENCODE(00000012):Orig. component type = DOT11*Jan 25 14:23:34.831: RADIUS:  AAA Unsupported Attr: ssid              [265] 8   *Jan 25 14:23:34.831: RADIUS:   57 69 66 69 45 41                                [WifiEA]*Jan 25 14:23:34.831: RADIUS:  AAA Unsupported Attr: interface         [157] 3   *Jan 25 14:23:34.831: RADIUS:   32                                               [2]*Jan 25 14:23:34.831: RADIUS(00000012): Config NAS IP: 192.168.173.2*Jan 25 14:23:34.831: RADIUS/ENCODE(00000012): acct_session_id: 17*Jan 25 14:23:34.835: RADIUS(00000012): sending*Jan 25 14:23:34.835: RADIUS:   10 01 00 01 07 05 00 00 D9 37 C3 D9 79 3E 33 EA  [?????????7??y>3?]*Jan 25 14:23:34.835: RADIUS:   F3 7D 73 43 BF BA D0 6A                          [?}sC???j]*Jan 25 14:23:34.835: RADIUS:  NAS-Port-Type       [61]  6   802.11 wireless           [19]*Jan 25 14:23:34.835: RADIUS:  NAS-Port            [5]   6   265                       *Jan 25 14:23:34.835: RADIUS:  NAS-Port-Id         [87]  5   "265"*Jan 25 14:23:34.835: RADIUS:  NAS-IP-Address      [4]   6   192.168.173.2             *Jan 25 14:23:35.035: RADIUS: Received from id 1645/64 192.168.177.158:1812, Access-Challenge, len 304*Jan 25 14:23:35.039: RADIUS:   46 10 78 5F 5F B0 CB 6C 0B 05 00 00 DA C3 BF 28  [F?x__??l???????(]*Jan 25 14:23:35.039: RADIUS:   E0 18 2B 95 97 C2 0A D7 40 53 FE 62              [??+?????@S?b]*Jan 25 14:23:35.039: RADIUS(00000012): Received from id 1645/64*Jan 25 14:23:35.039: RADIUS/DECODE: EAP-Message fragments, 60+220, total 280 bytes*Jan 25 14:23:35.355: RADIUS/ENCODE(00000012):Orig. component type = DOT11*Jan 25 14:23:35.355: RADIUS:  AAA Unsupported Attr: ssid              [265] 8   *Jan 25 14:23:35.355: RADIUS:   57 69 66 69 45 41                                [WifiEA]*Jan 25 14:23:35.355: RADIUS:  AAA Unsupported Attr: interface         [157] 3   *Jan 25 14:23:35.359: RADIUS:   92 DA 5E 26 CF 40 01 22 7A 8E F5 C1              [??^&?@?"z???]*Jan 25 14:23:35.359: RADIUS:  NAS-Port-Type       [61]  6   802.11 wireless           [19]*Jan 25 14:23:35.359: RADIUS:  NAS-Port            [5]   6   265                       *Jan 25 14:23:35.359: RADIUS:  NAS-Port-Id         [87]  5   "265"*Jan 25 14:23:35.359: RADIUS:  NAS-IP-Address      [4]   6   192.168.173.2             *Jan 25 14:23:35.367: RADIUS: Received from id 1645/65 192.168.177.158:1812, Access-Accept, len 30*Jan 25 14:23:35.367: RADIUS:  authenticator 8C 2C 1B 97 82 BB 6C 7F - AA D3 4A AB CA 22 8B B7*Jan 25 14:23:35.367: RADIUS:  EAP-Message         [79]  10  *Jan 25 14:23:35.367: RADIUS:   03 01 00 04 00 00 00 00                          [????????]*Jan 25 14:23:35.371: RADIUS(00000012): Received from id 1645/65*Jan 25 14:23:35.371: RADIUS/DECODE: EAP-Message fragments, 8, total 8 bytes*Jan 25 14:23:35.671: %DOT11-7-AUTH_FAILED: Station d023.dbb8.d6a9 Authentication failed
    Config:
    aaa new-model!aaa group server radius rad_eap server-private 192.168.177.158 auth-port 1812 acct-port 1813 key 7 044803071D2448!aaa authentication login eap_methods group rad_eapaaa authorization exec default if-authenticated aaa authorization network default if-authenticated !         aaa session-id commonip name-server 192.168.177.45!                dot11 ssid WifiEAP1   vlan 10   authentication open eap eap_methods    authentication shared eap eap_methods   authentication key-management wpa optional   guest-mode!         bridge irb!         interface Dot11Radio0 no ip address no ip route-cache !        encryption vlan 10 mode ciphers aes-ccm tkip wep128 !        broadcast-key vlan 10 change 300 !        ssid WifiEAP1 !        antenna gain 0 station-role root!         interface Dot11Radio0.10 encapsulation dot1Q 10 native no ip route-cache bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled!         interface GigabitEthernet0 ip address 192.168.173.3 255.255.255.0 no ip route-cache!         interface GigabitEthernet0.1 encapsulation dot1Q 10 native no ip route-cache bridge-group 1 no bridge-group 1 source-learning bridge-group 1 spanning-disabled!         interface BVI1 ip address 192.168.173.2 255.255.255.0 no ip route-cache!ip radius source-interface BVI1 bridge 1 route ip
    thanks so much!

    Stefano: not sure if related but there is an unsupported attribute in the debugs:
    Jan 25 14:23:35.355: RADIUS:  AAA Unsupported Attr:
    *Jan 25 14:23:35.355: RADIUS:   57 69 66 69 45 41
    *Jan 25 14:23:35.355: RADIUS:  AAA Unsupported Attr: interface
    Try to eliminate any configured attributes on radius except those in IETF radius. Then try again.
    You may also chech by removing the shared eap as suggested above. Let us know if this works.
    Sent from Cisco Technical Support iPad App

  • Problem with vtp on catos-switches

    Problem with vtp on catos-switches
    connected are three switches:
    | vtp |
    | server |
    | cat or ios |
    |
    |
    | vtp | C3750 or C4506
    | client |
    | ios |
    |
    |
    | vtp | C2948-GE-TX or C2980
    | client |
    | catos |
    1) when the ios-vtp-client restarts after power failure, everything works fine.
    2) when the catos-vtp-client restarts after power failure, everything works fine, too.
    3) if both (ios-vtp-client and catos-vtp-client) restart after power failure at the same time the catos-vtp-client-switch loses its connection/vlan database.
    the reason seems to be that the catos-switch is faster in power up and couldn´t connect the vtp-server after booting.
    If you change the vlan-database on the vtp server after both switches are running, the catos-switch learns its vlan database and everything works fine, without change in the vlan database the switch is still out of order.
    workaround: configure every catos-switch behind an ios-switch in vtp-server mode
    is there another solution for my problem?
    thanks and regards
    bjoern

    not sure of the issue, see if the following link helps :
    http://www.cisco.com/en/US/products/hw/switches/ps628/products_configuration_guide_chapter09186a00800d84bf.html

Maybe you are looking for