Wireless Controller & Juniper Netscreen Firewall

I I have a Cisco WLC 4402 plugged into a Cisco Switch 3750 with 10 Access Points connected to this switch.
I have a Juniper Netscreen 5XT Firewall, that I wish to place on this wireless network. Does anyone have any experience with setting up a Juniper FW and Cisco WLC?
First Question would be were would I place the firewall?

NetScreen IDP Device and Server Support
MARS supports multiple versions of NetScreen IDP. How this support is realized within MARS differs based on the version of the sensor that you are running.
•NetScreen IDP-Management Server-The NetScreen IDP Management Server is the management software for IDP version 2.x and 3.x sensors. Usually, the IDP-Management Server is installed on the IDP appliance. However, it can be removed from the IDP appliance an and installed on a Solaris or Linux server. In MARS, IDP v2.1 and 3.x are both supported as agents on a Linux host running IDP-Management Server.
•NetScreen Security Manager- (NSM) provide support for the following NetScreen sensors:
-NetScreen IDP 4.0
-NetScreen IDP 4.1
MARS does not support multiple reporting devices on the same host (as defined by reporting IP address), IDP-Management Server and NSM cannot co-exist on the same host unless they report to MARS via different IP addresses. However, you can define multiple sensors per management server.

Similar Messages

  • Configuring Cisco ACS 5.1 with Juniper Netscreen Firewall wit Radius & Tacacs+

    Hello,
    Can anybody tell me the step-by-step configuration of Cisco ACS 5.1, to configured it with Juniper Netscreen Firewall for radius & tacacs+ authentication and authorization?
    I am able to configure this with Cisco ACS 4.2 with customise VSA file but can't understand how to configure it on ACS 5.1.
    Thanks in Advance.

    Hi Eduardo,
    Can you tell me how to map ACS 4.2?
    service=junos-exec
    local-user-name=Engineering
    Into the new "shell profiles" on ACS 5.2? How do I verify these attributes are passed onto ACS 5.2? I don't have access to a sniffer or tap nor do I have writes on this box. I have to instruct our systems folks to investigate. It has been a back and forth battle.
    Also, I'd like to see where I'd map this on ACS 5.2.  Keep in mind in both cases I have a JUNOS config mapping to a login user Engineer and operations respectively.
    local-user-name=opertions
    allow-commands=((^ping *)|(^mtrace *)|(^traceroute *)|(^monitor *))
    deny-commands= ((^start *)|(^file delete *)|(^file rename *)|(^request *)|(^set cli restart-on-upgrade *)|(^set cli prompt *)|(^set chassis *)|(^set date *)|(^test *)|(^clear *)|(^op *))

  • Cisco C3650 causes "crit - arp req detected an IP conflict" alerts on Juniper Netscreen Firewall.

    Hi All,
    I am posting this issue on the Cisco community site, I've also posted it in the J-net discussion forums.
    I have three Netscreen-25 firewalls on my LAN. Two are configured as a NSRP pair/cluster and the thrid is a standalone firewall. All firewalls were running ScreenOS 5.4.0r27.0 (Firewall+VPN) and they work/worked perfectly, though a few weeks ago I noticed that all the netscreen firewalls were logging critical errors:
    One FW shows this - logged every 30 seconds
    crit - arp req detected an IP conflict (IP 10.2.26.242, MAC 88f0310dba31) on interface ethernet1
    Other FW shows this - logged every 30 seconds
    arp req detected an IP conflict (IP 10.30.235.242, MAC 88f0310dba31) on interface ethernet2
    Both show the same MAC.
    Now I don't appear to have any problems with network services, but the these log entries are causing concern.
    I have a 100% switched cisco network. I was able to track the MAC address down to a new Cisco C3650 48 port switch which i recently installed. As soon as I disconnect the switch, the critical alerts stop. As soon as I plug the C3650 switch back into the network the alerts start coming in. I have not configured this new C3650 in any special way, I have configured it in the same as all my other Cisco switches. If I plug a Cisco 3560, or 2960 (basically any other cisco switch i got) I do not get the alerts on the Netscreen FW's.
    I have upgraded the software on my cisco switch to the latest version (IOS XE 03.03.04SE) and have upgraded one of my Netscreen firewalls to ScreenOS 5.4.0r28a.0 (Firewall+VPN) - the latest version. But still the critical "arp req detected an IP conflict" alerts are coming in every 30 seconds.
    It's got to be something to do with the new Cisco 3650 - though I don't know what it could be. On the networking side of things everything seems to be working OK.
    Please can anybody advise as what the problem might be?
    Thanks in advance.

    Hi All,
    I have updated my post on the juniper forum, so will update this thread too with the same information...
    Firstly thanks for your replies. I have RSTP enabled on all my switches. These new Cisco C3650 series switches are connected to the exsiting switches (in a fibre ring) using a SFP modules /fibre patch leads.
    In the current setup I cannot see how there could be a layer 2 loop because the 3650 is connected via a single physical link, whether that be using a SFP module/fibre patch lead or a single gigabit ethernet port directly connected using a cat5e patch lead into another gigabit ethernet port. So in both cases only 1 link/path exists.
    On the netscreen-25 the critical error reports the MAC address of the connected/trunk link port on the Cisco 3650:
    "arp req detected an IP conflict (IP 10.2.26.242, MAC 88f0310df431) on interface ethernet1"
    On the cisco this is the:
    xxxxxxx-hh1-cat15#sh interfaces gigabitEthernet 1/1/1
    GigabitEthernet1/1/1 is up, line protocol is up (connected)
      Hardware is Gigabit Ethernet, address is 88f0.310d.f431 (bia 88f0.310d.f431)
      MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation ARPA, loopback not set
      Keepalive not set
      Full-duplex, 1000Mb/s, link type is auto, media type is 1000BaseSX SFP
      input flow-control is off, output flow-control is unsupported
      ARP type: ARPA, ARP Timeout 04:00:00
      Last input 00:00:00, output never, output hang never
      Last clearing of "show interface" counters never
      Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
      Queueing strategy: fifo
      Output queue: 0/40 (size/max)
      5 minute input rate 16000 bits/sec, 25 packets/sec
      5 minute output rate 6000 bits/sec, 9 packets/sec
         350837 packets input, 29807313 bytes, 0 no buffer
         Received 234182 broadcasts (156724 multicasts)
         0 runts, 0 giants, 0 throttles
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
         0 watchdog, 156724 multicast, 0 pause input
         0 input packets with dribble condition detected
         119555 packets output, 9923683 bytes, 0 underruns
         0 output errors, 0 collisions, 1 interface resets
         12154 unknown protocol drops
         0 babbles, 0 late collision, 0 deferred
         0 lost carrier, 0 no carrier, 0 pause output
         0 output buffer failures, 0 output buffers swapped out
    xxxxxx-hh1-cat15#
    And second Cisco 3650 also triggers a similar alert:
    on the Netscreen-25
    "arp req detected an IP conflict (IP 10.2.26.242, MAC 88f0310dba31) on interface ethernet1"
    On the Cisco 3650:
    xxxxx-hh1-cat14#sh interfaces gigabitEthernet 1/1/1
    GigabitEthernet1/1/1 is up, line protocol is up (connected)
      Hardware is Gigabit Ethernet, address is 88f0.310d.ba31 (bia 88f0.310d.ba31)
      MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation ARPA, loopback not set
      Keepalive not set
      Full-duplex, 1000Mb/s, link type is auto, media type is 1000BaseSX SFP
      input flow-control is off, output flow-control is unsupported
      ARP type: ARPA, ARP Timeout 04:00:00
      Last input 00:00:00, output never, output hang never
      Last clearing of "show interface" counters never
      Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
      Queueing strategy: fifo
      Output queue: 0/40 (size/max)
      5 minute input rate 1596000 bits/sec, 156 packets/sec
      5 minute output rate 83000 bits/sec, 77 packets/sec
         5236243 packets input, 4667733334 bytes, 0 no buffer
         Received 1400163 broadcasts (930724 multicasts)
         0 runts, 0 giants, 0 throttles
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
         0 watchdog, 930724 multicast, 0 pause input
         0 input packets with dribble condition detected
         2353505 packets output, 204910425 bytes, 0 underruns
         0 output errors, 0 collisions, 1 interface resets
         75948 unknown protocol drops
         0 babbles, 0 late collision, 0 deferred
         0 lost carrier, 0 no carrier, 0 pause output
         0 output buffer failures, 0 output buffers swapped out
    xxxxxx-hh1-cat14#
    As per above if I change the uplink port on the Cisco 3650, all that happens is the MAC address reported on the Netscreen changes to show the MAC of the new physically connected port.
    If I connect the switches redundantly, the STP recalculates and as expected some ports go into the BLK states. But in the end the Netscreen will still report the MAC addresses of the active/FWD'ing trunk link ports. As I have two Cisco 3650's I get alerts for two MAC addresses.
    I must stress that if I replace any of the new Cisco 3650 with the older Cisco 3560, 3560v2, 2960 series switches (connected in exactly the same way) I do NOT get any alerts. I only get alerts when i plug in the Cisco C3650.
    So something definitely to do with new switches, but I can't see what it can be?
    If I can provide anymore info that you need please let me know..
    Regards

  • Converting config from Juniper netscreen to ASA 5585 8.4

    Does anyone know who to convert config form a Juniper Netscreen Firewall  to a ASA? We are trying to get rid of the netscreen firewalls at our  location and replace them with ASA's.

    Here is the new self-service tool that Cisco has released to convert to any vendor firewalls to Cisco ASA.
    Currently it supports Juniper ScreenOS and CheckPoint to Cisco ASA conversion.
    Link to the original post:
    https://supportforums.cisco.com/community/netpro/security/firewall/blog/2013/09/27/conversion-tool-juniper-screenos-to-cisco-asa
    Link to the tool itself:
    https://fwmig.cisco.com

  • Config air-lap1041n-e-k9 with cisco 5500 (5508) series wireless controller. how to?

    Hi!
    I try to configure a Cisco 5508 Wireless controller and 25 Air-lap1041 to use as VoIP and data. I read documents, manuals, etc, but the AP doesn't charge the configuration, or not conect with the Wireless Controller, why? No Radius server present, only WPA security.howto, please...
    I try to put a static ip in the LAP, with lwapp or capwap command, (LWAPP/CAPWAP ap ip address direccion mascara) and the AP returns "You should configure Domain and Name Server from controller CLI/GUI." and i can't change the name of the AP (Command is disabled).
    Log from AP:
    using ÿÿÿÿ ddr static values from serial eeprom
    ddr init done
    Running Normal Memtest...
    Passed.
    IOS Bootloader - Starting system.
    FLASH CHIP:  Numonyx P33
    Checking for Over Erased blocks
    Xmodem file system is available.
    DDR values used from system serial eeprom.
    WRDTR,CLKTR: 0x83000800, 0xc0000000
    RQDC, RFDC : 0x80000037, 0x00000184
    PCIE0: link is up.
    PCIE0: VC0 is active
    PCIE1: link is NOT up.
    PCIE1 port 1 not initialize
    PCIEx: initialization done
    flashfs[0]: 6 files, 2 directories
    flashfs[0]: 0 orphaned files, 0 orphaned directories
    flashfs[0]: Total bytes: 32385024
    flashfs[0]: Bytes used: 2369024
    flashfs[0]: Bytes available: 30016000
    flashfs[0]: flashfs fsck took 21 seconds.
    Reading cookie from system serial eeprom...Done
    Base Ethernet MAC address: 44:2b:03:dc:09:25
    Ethernet speed is 1000 Mb - FULL duplex
    Loading "flash:/c1140-rcvk9w8-mx/c1140-rcvk9w8-mx"...###########################
    File "flash:/c1140-rcvk9w8-mx/c1140-rcvk9w8-mx" uncompressed and installed, entr
    y point: 0x4000
    executing...
    enet halted
                  Restricted Rights Legend
    Use, duplication, or disclosure by the Government is
    subject to restrictions as set forth in subparagraph
    (c) of the Commercial Computer Software - Restricted
    Rights clause at FAR sec. 52.227-19 and subparagraph
    (c) (1) (ii) of the Rights in Technical Data and Computer
    Software clause at DFARS sec. 252.227-7013.
               cisco Systems, Inc.
               170 West Tasman Drive
               San Jose, California 95134-1706
    Cisco IOS Software, C1040 Software (C1140-RCVK9W8-M), Version 12.4(23c)JA, RELEA
    SE SOFTWARE (fc3)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2010 by Cisco Systems, Inc.
    Compiled Tue 01-Jun-10 12:53 by prod_rel_team
    Proceeding with system init
    Proceeding to unmask interrupts
    Initializing flashfs...
    FLASH CHIP:  Numonyx P33
    Checking for Over Erased blocks
    flashfs[1]: 6 files, 2 directories
    flashfs[1]: 0 orphaned files, 0 orphaned directories
    flashfs[1]: Total bytes: 32126976
    flashfs[1]: Bytes used: 2369024
    flashfs[1]: Bytes available: 29757952
    flashfs[1]: flashfs fsck took 7 seconds.
    flashfs[1]: Initialization complete.
    flashfs[2]: 0 files, 1 directories
    flashfs[2]: 0 orphaned files, 0 orphaned directories
    flashfs[2]: Total bytes: 11999232
    flashfs[2]: Bytes used: 1024
    flashfs[2]: Bytes available: 11998208
    flashfs[2]: flashfs fsck took 1 seconds.
    flashfs[2]: Initialization complete....done Initializing flashfs.
    Ethernet speed is 1000 Mb - FULL duplex
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    cisco AIR-LAP1041N-E-K9    (PowerPC405ex) processor (revision B0) with 98294K/32
    768K bytes of memory.
    Processor board ID FCZ1611W414
    PowerPC405ex CPU at 333Mhz, revision number 0x147E
    Last reset from reload
    LWAPP image version 7.0.94.21
    1 Gigabit Ethernet interface
    32K bytes of flash-simulated non-volatile configuration memory.
    Base ethernet MAC Address: 44:2B:03:DC:09:25
    Part Number                          : 73-14034-04
    PCA Assembly Number                  : 800-34273-05
    PCA Revision Number                  : A0
    PCB Serial Number                    : FOC16075VZ3
    Top Assembly Part Number             : 800-34284-03
    Top Assembly Serial Number           : FCZ1611W414
    Top Revision Number                  : A0
    Product/Model Number                 : AIR-LAP1041N-E-K9
    % Please define a domain-name first.
    Press RETURN to get started!
    Translating "CISCO-CAPWAP-CONTROLLER"...domain server (255.255.255.255)
    *Mar  1 00:00:09.574: *** CRASH_LOG = YES
    Base Ethernet MAC address: 44:2B:03:DC:09:25
    *Mar  1 00:00:09.838: %LWAPP-3-CLIENTEVENTLOG: Read and initialized AP event log
    (contains, 1024 messages)
    *Mar  1 00:00:11.848: %LINK-3-UPDOWN: Interface GigabitEthernet0, changed state
    to up
    *Mar  1 00:00:11.892: %SYS-5-RESTART: System restarted --
    Cisco IOS Software, C1040 Software (C1140-RCVK9W8-M), Version 12.4(23c)JA, RELEA
    SE SOFTWARE (fc3)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2010 by Cisco Systems, Inc.
    Compiled Tue 01-Jun-10 12:53 by prod_rel_team
    *Mar  1 00:08:16.954: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEth
    ernet0, changed state to up
    logging facility kern
            ^
    % Invalid input detected at '^' marker.
    *Mar  1 00:08:28.047: %CAPWAP-3-ERRORLOG: Could Not resolve CISCO-CAPWAP-CONTROL
    LER
    *Mar  1 00:08:28.049: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY
    *Mar  1 00:09:08.282: %CDP_PD-2-POWER_LOW: All radios disabled - LOW_POWER_CLASS
    IC_NO_INJECTOR_CONFIGURED AIR-CT5508-K9 (c464.138f.9345)
    *Mar  1 00:09:08.282:  -Verify the required power-injector is installed on this
    port: AIR-CT5508-K9(Gig 0/0/2).
    *Mar  1 00:09:08.282:  -If a power-injector is installed, issue the command:"pow
    er inline negotiation injector installed"
    *Mar  1 00:12:19.976: %CAPWAP-5-STATIC_TO_DHCP_IP: Could not discover WLC using
    static IP. Forcing AP to use DHCP.
    *Mar  1 00:12:29.993: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does
    not have an Ip !!
    *Mar  1 00:12:39.994: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does
    not have an Ip !!
    *Mar  1 00:12:49.993: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does
    not have an Ip !!
    *Mar  1 00:12:59.994: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does
    not have an Ip !!
    *Mar  1 00:13:09.993: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does
    not have an Ip !!
    Not in Bound state.
    *Mar  1 00:13:19.993: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does
    not have an Ip !!
    *Mar  1 00:13:19.993: %CAPWAP-5-DHCP_RENEW: Could not discover WLC using DHCP IP
    . Renewing DHCP IP.
    logs from wireless controller:
    (Cisco Controller) >show interface summary
    Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Gu
    est
    ap-manager                       2    untagged 209.165.200.231 Dynamic Yes    No
    management                       1    untagged 209.165.200.230 Static  Yes    No
    service-port                     N/A  N/A      192.168.1.157   Static  No     No
    virtual                          N/A  N/A      1.1.1.1         Static  No     No
    (Cisco Controller) >
    i conect with service-port ok  and the management port works, i think.
    AP442b.03dc.0925>ping 209.165.200.230
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 209.165.200.230, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
    AP442b.03dc.0925>
    Help, please!
    i write in spanish:
    Hola:
    Tengo que configurar un cisco 5508 wireless controller con 25 air-lap1041n, para usarlo como acceso de datos y voz. ¿Cómo lo hago? He leído manuales, y seguido las instrucciones, pero el punto de acceso parace que no es capaz de cargar el perfil. No hay servidor radius, solo la configuración de una clave wpa. Alguién me puede indicar pasos, Gracias

    Hi!
    I buy a gigabit switch. I connect the service-port to gigabit switch, and laptop to gigabit switch. I used 192.168.1.x ip address (192.168.1.157 to service-port and 192.168.1.233 to wired port on laptop, well, the laptop has two ip adress, 192.168.1.233 and 209.165.200.2, and the laptop works ok. Ping to 209.165.200.230 -ip address of management interface- and ping to 209.165.200.203 -ip address for AP, is assigned by  DHCP of WLC. And i connect the ap to gigabit switch, and the wlc assigns well an ip direction.
    I post the run-config and sysinfo log. The gigabit switch is tp-link model tl-sg1005d, no configuration.
    Before the logs, I see this message from AP:
    *Apr 19 23:10:20.211: %CAPWAP-3-ERRORLOG: This AP is not supported in controller
    version 6.0.199.4  ---->What's mean that? Is it compatible the ap with the WLC? ¿Es compatible el AP con el WLC? 
    Hola:
    He comprado un switch gigabit. Conecto el service-port al switch gigabit y el portátil también (por cable). Uso como direcciones ip el rango 192.168.1.x (192.168.1.157 asignado al service-port y 192, 168.1.233 al portátil, bueno, el portátil tiene dos direcciones, la dicha anteriormente y la 209.165.200.2) El portátil funciona bien, hace ping al 209.165.200.230 - la ip de la management interface, y a 209.165.200.203 - ip asignada al AP por el DHCP del WLC. He conectado el AP al swtich gigabit, y el dhcp del wlc asigna correctamente una dirección ip.
    Añado a continuación los resultados de los comandos "show run-config" y "show sysinfo". El switch es un TP-LINK modelo TL-S1005D, sin necesidad de configuración.
    Antes de mostrar los resultados de los comandos, he visto el siguiente mensaje en el log del AP:
    *Apr 19 23:10:20.211: %CAPWAP-3-ERRORLOG: This AP is not supported in controller
    version 6.0.199.4  ---->What's mean that? Is it compatible the ap with the WLC? ¿Es compatible el AP con el WLC? 
    Un saludo
    Antonio R.
    (Cisco Controller) >show run-config
    Press Enter to continue...
    System Inventory
    NAME: "Chassis"    , DESCR: "Cisco Wireless Controller"
    PID: AIR-CT5508-K9,  VID: V02,  SN: FCW1608L05X
    Burned-in MAC Address............................ C4:64:13:8F:93:40
    Power Supply 1................................... Present, OK
    Power Supply 2................................... Absent
    Maximum number of APs supported.................. 25
    Press Enter to continue or to abort
    System Information
    Manufacturer's Name.............................. Cisco Systems Inc.
    Product Name..................................... Cisco Controller
    Product Version.................................. 6.0.199.4
    Bootloader Version............................... 1.0.1
    Field Recovery Image Version..................... 6.0.182.0
    Firmware Version................................. FPGA 1.3, Env 1.6, USB console
    1.27
    Build Type....................................... DATA + WPS
    System Name...................................... CISCO-CAPWAP-CONTROLLER
    System Location..................................
    System Contact...................................
    System ObjectID.................................. 1.3.6.1.4.1.9.1.1069
    IP Address....................................... 209.165.200.230
    Last Reset....................................... Power on reset
    System Up Time................................... 0 days 0 hrs 17 mins 45 secs
    System Timezone Location......................... (GMT +1:00) Amsterdam, Berlin,
    Rome, Vienna
    Current Boot License Level....................... base
    Current Boot License Type........................ Permanent
    Next Boot License Level.......................... base
    Next Boot License Type........................... Permanent
    Configured Country............................... ES  - Spain
    Operating Environment............................ Commercial (0 to 40 C)
    Internal Temp Alarm Limits....................... 0 to 65 C
    Internal Temperature............................. +36 C
    External Temperature............................. +23 C
    Fan Status....................................... OK
    State of 802.11b Network......................... Enabled
    State of 802.11a Network......................... Disabled
    Number of WLANs.................................. 1
    3rd Party Access Point Support................... Disabled
    Number of Active Clients......................... 0
    Burned-in MAC Address............................ C4:64:13:8F:93:40
    Power Supply 1................................... Present, OK
    Power Supply 2................................... Absent
    Maximum number of APs supported.................. 25
    Press Enter to continue or to abort
    Switch Configuration
    802.3x Flow Control Mode......................... Disable
    FIPS prerequisite features....................... Disabled
    secret obfuscation............................... Enabled
    Network Information
    RF-Network Name............................. hosp
    Web Mode.................................... Disable
    Secure Web Mode............................. Enable
    Secure Web Mode Cipher-Option High.......... Disable
    Secure Web Mode Cipher-Option SSLv2......... Enable
    Secure Shell (ssh).......................... Enable
    Telnet...................................... Disable
    Ethernet Multicast Forwarding............... Disable
    Ethernet Broadcast Forwarding............... Disable
    AP Multicast/Broadcast Mode................. Unicast
    IGMP snooping............................... Disabled
    IGMP timeout................................ 60 seconds
    User Idle Timeout........................... 300 seconds
    ARP Idle Timeout............................ 300 seconds
    Cisco AP Default Master..................... Enabled
    AP Join Priority............................ Disable
    Mgmt Via Wireless Interface................. Disable
    Mgmt Via Dynamic Interface.................. Disable
    Bridge MAC filter Config.................... Enable
    Bridge Security Mode........................ EAP
    Mesh Full Sector DFS........................ Enable
    --More or (q)uit current module or to abort
    --More or (q)uit current module or to abort
    AP Fallback ................................ Enable
    Web Auth Redirect Ports .................... 80
    Fast SSID Change ........................... Disabled
    IP/MAC Addr Binding Check .................. Enabled
    Press Enter to continue or to abort
    Port Summary
               STP   Admin   Physical   Physical   Link   Link
    Pr  Type   Stat   Mode     Mode      Status   Status  Trap     POE    SFPType
    1  Normal  Forw Enable  Auto       1000 Full  Up     Enable  N/A     1000BaseTX
    2  Normal  Disa Enable  Auto       Auto       Down   Enable  N/A     Not Present
    3  Normal  Disa Enable  Auto       Auto       Down   Enable  N/A     Not Present
    4  Normal  Disa Enable  Auto       Auto       Down   Enable  N/A     Not Present
    5  Normal  Disa Enable  Auto       Auto       Down   Enable  N/A     Not Present
    6  Normal  Disa Enable  Auto       Auto       Down   Enable  N/A     Not Present
    7  Normal  Disa Enable  Auto       Auto       Down   Enable  N/A     Not Present
    8  Normal  Disa Enable  Auto       Auto       Down   Enable  N/A     Not Present
    Press Enter to continue or to abort
    AP Summary
    Number of APs.................................... 0
    Global AP User Name.............................. Not Configured
    Global AP Dot1x User Name........................ Not Configured
    AP Name             Slots  AP Model             Ethernet MAC       Location
         Port  Country  Priority
    Press Enter to continue or to abort
    Press Enter to continue or to abort
    AP Location
    Site Name........................................ default-group
    Site Description.................................
    WLAN ID          Interface          Network Admission Control
    1               management           Disabled
    AP Name             Slots  AP Model             Ethernet MAC       Location
         Port  Country  Priority  GroupName
    Press Enter to continue or to abort
    AP Config
    Press Enter to continue or to abort
    Press Enter to continue or to abort
    AP Airewave Director Configuration
    Press Enter to continue or to abort
    802.11a Configuration
    802.11a Network.................................. Disabled
    11nSupport....................................... Enabled
          802.11a Low Band........................... Enabled
          802.11a Mid Band........................... Enabled
          802.11a High Band.......................... Enabled
    802.11a Operational Rates
        802.11a 6M Rate.............................. Mandatory
        802.11a 9M Rate.............................. Supported
        802.11a 12M Rate............................. Mandatory
        802.11a 18M Rate............................. Supported
        802.11a 24M Rate............................. Mandatory
        802.11a 36M Rate............................. Supported
        802.11a 48M Rate............................. Supported
        802.11a 54M Rate............................. Supported
    802.11n MCS Settings:
        MCS 0........................................ Supported
        MCS 1........................................ Supported
        MCS 2........................................ Supported
        MCS 3........................................ Supported
        MCS 4........................................ Supported
        MCS 5........................................ Supported
        MCS 6........................................ Supported
    --More or (q)uit current module or to abort
    --More or (q)uit current module or to abort
        MCS 7........................................ Supported
        MCS 8........................................ Supported
        MCS 9........................................ Supported
        MCS 10....................................... Supported
        MCS 11....................................... Supported
        MCS 12....................................... Supported
        MCS 13....................................... Supported
        MCS 14....................................... Supported
        MCS 15....................................... Supported
    802.11n Status:
        A-MPDU Tx:
            Priority 0............................... Enabled
            Priority 1............................... Disabled
            Priority 2............................... Disabled
            Priority 3............................... Disabled
            Priority 4............................... Disabled
            Priority 5............................... Disabled
            Priority 6............................... Disabled
            Priority 7............................... Disabled
    Beacon Interval.................................. 100
    CF Pollable mandatory............................ Disabled
    CF Poll Request mandatory........................ Disabled
    CFP Period....................................... 4
    --More or (q)uit current module or to abort
    --More or (q)uit current module or to abort
    CFP Maximum Duration............................. 60
    Default Channel.................................. 36
    Default Tx Power Level........................... 0
    DTPC  Status..................................... Enabled
    Fragmentation Threshold.......................... 2346
    TI Threshold..................................... -50
    Legacy Tx Beamforming setting.................... Disabled
    Traffic Stream Metrics Status.................... Disabled
    Expedited BW Request Status...................... Disabled
    World Mode....................................... Enabled
    EDCA profile type................................ default-wmm
    Voice MAC optimization status.................... Disabled
    Call Admision Control (CAC) configuration
    Voice AC:
       Voice AC - Admission control (ACM)............ Disabled
       Voice max RF bandwidth........................ 75
       Voice reserved roaming bandwidth.............. 6
       Voice load-based CAC mode..................... Disabled
       Voice tspec inactivity timeout................ Disabled
       Voice Stream-Size............................. 84000
       Voice Max-Streams............................. 2
    Video AC:
       Video AC - Admission control (ACM)............ Disabled
    --More or (q)uit current module or to abort
    --More or (q)uit current module or to abort
       Video max RF bandwidth........................ Infinite
       Video reserved roaming bandwidth.............. 0
    Press Enter to continue or to abort
    802.11a Advanced Configuration
    Press Enter to continue or to abort
    802.11a Airewave Director Configuration
    RF Event and Performance Logging
      Channel Update Logging......................... Off
      Coverage Profile Logging....................... Off
      Foreign Profile Logging........................ Off
      Load Profile Logging........................... Off
      Noise Profile Logging.......................... Off
      Performance Profile Logging.................... Off
      TxPower Update Logging......................... Off
    Default 802.11a AP performance profiles
      802.11a Global Interference threshold.......... 10 %
      802.11a Global noise threshold................. -70 dBm
      802.11a Global RF utilization threshold........ 80 %
      802.11a Global throughput threshold............ 1000000 bps
      802.11a Global clients threshold............... 12 clients
    Default 802.11a AP monitoring
      802.11a Monitor Mode........................... enable
      802.11a Monitor Mode for Mesh AP Backhaul...... disable
      802.11a Monitor Channels....................... Country channels
      802.11a AP Coverage Interval................... 180 seconds
      802.11a AP Load Interval....................... 60 seconds
      802.11a AP Noise Interval...................... 180 seconds
    --More or (q)uit current module or to abort
    --More or (q)uit current module or to abort
      802.11a AP Signal Strength Interval............ 60 seconds
    Automatic Transmit Power Assignment
      Transmit Power Assignment Mode................. AUTO
      Transmit Power Update Interval................. 600 seconds
      Transmit Power Threshold....................... -70 dBm
      Transmit Power Neighbor Count.................. 3 APs
      Min Transmit Power............................. -10 dBm
      Max Transmit Power............................. 30 dBm
      Transmit Power Update Contribution............. SNI.
      Transmit Power Assignment Leader............... c4:64:13:8f:93:40
      Last Run....................................... 75 seconds ago
    Coverage Hole Detection
      802.11a Coverage Hole Detection Mode........... Enabled
      802.11a Coverage Voice Packet Count............ 100 packets
      802.11a Coverage Voice Packet Percentage....... 50%
      802.11a Coverage Voice RSSI Threshold.......... -80 dBm
      802.11a Coverage Data Packet Count............. 50 packets
      802.11a Coverage Data Packet Percentage........ 50%
      802.11a Coverage Data RSSI Threshold........... -80 dBm
      802.11a Global coverage exception level........ 25 %
      802.11a Global client minimum exception lev.... 3 clients
    Automatic Channel Assignment
      Channel Assignment Mode........................ AUTO
    --More or (q)uit current module or to abort
      Channel Update Interval........................ 600 seconds [startup]
      Anchor time (Hour of the day).................. 0
      Channel Update Contribution.................... SNI.
      Channel Assignment Leader...................... c4:64:13:8f:93:40
      Last Run....................................... 75 seconds ago
      DCA Sensitivity Level.......................... STARTUP (5 dB)
      DCA 802.11n Channel Width...................... 20 MHz
      DCA Minimum Energy Limit....................... -95 dBm
      Channel Energy Levels
        Minimum...................................... unknown
        Average...................................... unknown
        Maximum...................................... unknown
      Channel Dwell Times
        Minimum...................................... unknown
        Average...................................... unknown
        Maximum...................................... unknown
      802.11a 5 GHz Auto-RF Channel List
        Allowed Channel List......................... 36,40,44,48,52,56,60,64
        Unused Channel List.......................... 100,104,108,112,116,120,124,
                                                      128,132,136,140
      DCA Outdoor AP option.......................... Disabled
    Radio RF Grouping
      802.11a Group Mode............................. AUTO
    --More or (q)uit current module or to abort
      802.11a Group Update Interval.................. 600 seconds
      802.11a Group Leader........................... c4:64:13:8f:93:40
        802.11a Group Member......................... c4:64:13:8f:93:40
      802.11a Last Run............................... 75 seconds ago
    802.11b Configuration
    802.11b Network.................................. Enabled
    11gSupport....................................... Enabled
    11nSupport....................................... Enabled
    802.11b/g Operational Rates
        802.11b/g 1M Rate............................ Mandatory
        802.11b/g 2M Rate............................ Mandatory
        802.11b/g 5.5M Rate.......................... Mandatory
        802.11b/g 11M Rate........................... Mandatory
        802.11g 6M Rate.............................. Supported
        802.11g 9M Rate.............................. Supported
        802.11g 12M Rate............................. Supported
        802.11g 18M Rate............................. Supported
        802.11g 24M Rate............................. Supported
        802.11g 36M Rate............................. Supported
        802.11g 48M Rate............................. Supported
        802.11g 54M Rate............................. Supported
    802.11n MCS Settings:
        MCS 0........................................ Supported
        MCS 1........................................ Supported
        MCS 2........................................ Supported
        MCS 3........................................ Supported
        MCS 4........................................ Supported
    --More or (q)uit current module or to abort
        MCS 5........................................ Supported
        MCS 6........................................ Supported
        MCS 7........................................ Supported
        MCS 8........................................ Supported
        MCS 9........................................ Supported
        MCS 10....................................... Supported
        MCS 11....................................... Supported
        MCS 12....................................... Supported
        MCS 13....................................... Supported
        MCS 14....................................... Supported
        MCS 15....................................... Supported
    802.11n Status:
        A-MPDU Tx:
            Priority 0............................... Enabled
            Priority 1............................... Disabled
            Priority 2............................... Disabled
            Priority 3............................... Disabled
            Priority 4............................... Disabled
            Priority 5............................... Disabled
            Priority 6............................... Disabled
            Priority 7............................... Disabled
    Beacon Interval.................................. 100
    CF Pollable mode................................. Disabled
    --More or (q)uit current module or to abort
    CF Poll Request mandatory........................ Disabled
    CFP Period....................................... 4
    CFP Maximum Duration............................. 60
    Default Channel.................................. 1
    Default Tx Power Level........................... 0
    DTPC  Status..................................... Enabled
    Call Admission Limit  ........................... 105
    G711 CU Quantum ................................. 15
    ED Threshold..................................... -50
    Fragmentation Threshold.......................... 2346
    PBCC mandatory................................... Disabled
    RTS Threshold.................................... 2347
    Short Preamble mandatory......................... Enabled
    Short Retry Limit................................ 7
    Legacy Tx Beamforming setting.................... Enabled
    Traffic Stream Metrics Status.................... Disabled
    Expedited BW Request Status...................... Disabled
    World Mode....................................... Enabled
    Faster Carrier Tracking Loop..................... Disabled
    EDCA profile type................................ default-wmm
    Voice MAC optimization status.................... Disabled
    Call Admision Control (CAC) configuration
       Voice AC - Admission control (ACM)............ Disabled
    --More or (q)uit current module or to abort
       Voice Stream-Size............................. 84000
       Voice Max-Streams............................. 2
       Voice max RF bandwidth........................ 75
       Voice reserved roaming bandwidth.............. 6
       Voice load-based CAC mode..................... Disabled
       Voice tspec inactivity timeout................ Disabled
       Video AC - Admission control (ACM)............ Disabled
       Video max RF bandwidth........................ 50
       Video reserved roaming bandwidth.............. 0
    802.11b Advanced Configuration
    Press Enter to continue or to abort
    802.11b Airewave Director Configuration
    RF Event and Performance Logging
      Channel Update Logging......................... Off
      Coverage Profile Logging....................... Off
      Foreign Profile Logging........................ Off
      Load Profile Logging........................... Off
      Noise Profile Logging.......................... Off
      Performance Profile Logging.................... Off
      Transmit Power Update Logging.................. Off
    Default 802.11b AP performance profiles
      802.11b Global Interference threshold.......... 10 %
      802.11b Global noise threshold................. -70 dBm
      802.11b Global RF utilization threshold........ 80 %
      802.11b Global throughput threshold............ 1000000 bps
      802.11b Global clients threshold............... 12 clients
    Default 802.11b AP monitoring
      802.11b Monitor Mode........................... enable
      802.11b Monitor Channels....................... Country channels
      802.11b AP Coverage Interval................... 180 seconds
      802.11b AP Load Interval....................... 60 seconds
      802.11b AP Noise Interval...................... 180 seconds
      802.11b AP Signal Strength Interval............ 60 seconds
    Automatic Transmit Power Assignment
      Transmit Power Assignment Mode................. AUTO
      Transmit Power Update Interval................. 600 seconds
      Transmit Power Threshold....................... -70 dBm
      Transmit Power Neighbor Count.................. 3 APs
      Min Transmit Power............................. -10 dBm
      Max Transmit Power............................. 30 dBm
      Transmit Power Update Contribution............. SNI.
      Transmit Power Assignment Leader............... c4:64:13:8f:93:40
      Last Run....................................... 213 seconds ago
    Coverage Hole Detection
      802.11b Coverage Hole Detection Mode........... Enabled
      802.11b Coverage Voice Packet Count............ 100 packets
      802.11b Coverage Voice Packet Percentage....... 50%
      802.11b Coverage Voice RSSI Threshold.......... -80 dBm
      802.11b Coverage Data Packet Count............. 50 packets
      802.11b Coverage Data Packet Percentage........ 50%
      802.11b Coverage Data RSSI Threshold........... -80 dBm
      802.11b Global coverage exception level........ 25 %
      802.11b Global client minimum exception lev.... 3 clients
    Automatic Channel Assignment
      Channel Assignment Mode........................ AUTO
      Channel Update Interval........................ 600 seconds [startup]
      Anchor time (Hour of the day).................. 0
      Channel Update Contribution.................... SNI.
      Channel Assignment Leader...................... c4:64:13:8f:93:40
      Last Run....................................... 213 seconds ago
      DCA Sensitivity Level: ...................... STARTUP (5 dB)
      DCA Minimum Energy Limit....................... -95 dBm
      Channel Energy Levels
        Minimum...................................... unknown
        Average...................................... unknown
        Maximum...................................... unknown
      Channel Dwell Times
        Minimum...................................... unknown
        Average...................................... unknown
        Maximum...................................... unknown
      802.11b Auto-RF Allowed Channel List........... 1,6,11
      Auto-RF Unused Channel List.................... 2,3,4,5,7,8,9,10,12,13
    Radio RF Grouping
      802.11b Group Mode............................. AUTO
      802.11b Group Update Interval.................. 600 seconds
      802.11b Group Leader........................... c4:64:13:8f:93:40
        802.11b Group Member......................... c4:64:13:8f:93:40
      802.11b Last Run............................... 213 seconds ago
    Mobility Configuration
    Symmetric Mobility Tunneling (current) .......... Enabled
    Symmetric Mobility Tunneling (after reboot) ..... Enabled
    Mobility Protocol Port........................... 16666
    Default Mobility Domain.......................... hosp
    Multicast Mode .................................. Disabled
    Mobility Domain ID for 802.11r................... 0x97e2
    Mobility Keepalive Interval...................... 10
    Mobility Keepalive Count......................... 3
    Mobility Group Members Configured................ 1
    Mobility Control Message DSCP Value.............. 0
    Controllers configured in the Mobility Group
    MAC Address        IP Address       Group Name                        Multicast
    IP     Status
    c4:64:13:8f:93:40  209.165.200.230  hosp                              0.0.0.0
            Up
    Advanced Configuration
    Probe request filtering..........................  Enabled
    Probes fwd to controller per client per radio....  0
    Probe request rate-limiting interval.............  500 msec
    EAP-Identity-Request Timeout (seconds)........... 30
    EAP-Identity-Request Max Retries................. 2
    EAP Key-Index for Dynamic WEP.................... 0
    EAP Max-Login Ignore Identity Response........... enable
    EAP-Request Timeout (seconds).................... 30
    EAP-Request Max Retries.......................... 2
    EAPOL-Key Timeout (milliseconds)................. 1000
    EAPOL-Key Max Retries............................ 2
    dot11-padding.................................... Disabled
    Authentication Response Timeout (seconds)........ 10
    Rogue Entry Timeout (seconds).................... 1200
    AP Heart Beat Timeout (seconds).................. 30
    AP Discovery Timeout (seconds)................... 10
    AP Local mode Fast Heartbeat (seconds)........... disable
    AP Hreap mode Fast Heartbeat (seconds)........... disable
    AP Primary Discovery Timeout (seconds)........... 120
    AP Primed Join Timeout (seconds)................. 0
    Packet Forwarding watchdog timer (seconds)....... 240 (enable)
    Location Configuration
    RFID Tag data Collection......................... Enabled
    RFID  timeout.................................... 1200 seconds
    RFID mobility.................................... Oui:00:14:7e : Vendor:pango  S
    tate:Disabled
    Interface Configuration
    Interface Name................................... management
    MAC Address...................................... c4:64:13:8f:93:40
    IP Address....................................... 209.165.200.230
    IP Netmask....................................... 255.255.255.0
    IP Gateway....................................... 209.165.200.1
    External NAT IP State............................ Disabled
    External NAT IP Address.......................... 192.168.1.1
    VLAN............................................. untagged
    Quarantine-vlan.................................. 0
    Active Physical Port............................. 1
    Primary Physical Port............................ 1
    Backup Physical Port............................. Unconfigured
    Primary DHCP Server.............................. 209.165.200.230
    Secondary DHCP Server............................ Unconfigured
    DHCP Option 82................................... Disabled
    ACL.............................................. Unconfigured
    AP Manager....................................... Yes
    Guest Interface.................................. No
    Interface Name................................... service-port
    MAC Address...................................... c4:64:13:8f:93:41
    IP Address....................................... 192.168.1.157
    IP Netmask....................................... 255.255.255.0
    DHCP Option 82................................... Disabled
    DHCP Protocol.................................... Disabled
    AP Manager....................................... No
    Guest Interface.................................. No
    Interface Name................................... virtual
    MAC Address...................................... c4:64:13:8f:93:40
    IP Address....................................... 1.1.1.1
    DHCP Option 82................................... Disabled
    Virtual DNS Host Name............................ Disabled
    AP Manager....................................... No
    Guest Interface.................................. No
    WLAN Configuration
    WLAN Identifier.................................. 1
    Profile Name..................................... HOSP3C
    Network Name (SSID).............................. HOSP3C
    Status........................................... Enabled
    MAC Filtering.................................... Disabled
    Broadcast SSID................................... Enabled
    AAA Policy Override.............................. Disabled
    Network Admission Control
      NAC-State...................................... Disabled
      Quarantine VLAN................................ 0
    Number of Active Clients......................... 0
    Exclusionlist Timeout............................ 60 seconds
    Session Timeout.................................. 1800 seconds
    CHD per WLAN..................................... Enabled
    Webauth DHCP exclusion........................... Disabled
    Interface........................................ management
    WLAN ACL......................................... unconfigured
    DHCP Server...................................... 209.165.200.230
    DHCP Address Assignment Required................. Enabled
    Quality of Service............................... Platinum (voice)
    Scan Defer Priority.............................. 5,6
    Scan Defer Time.................................. 100 milliseconds
    WMM.............................................. Disabled
    Media Stream Multicast-direct.................... Disabled
    CCX - AironetIe Support.......................... Enabled
    CCX - Gratuitous ProbeResponse (GPR)............. Disabled
    CCX - Diagnostics Channel Capability............. Disabled
    Dot11-Phone Mode (7920).......................... Disabled
    Wired Protocol................................... None
    IPv6 Support..................................... Disabled
    Peer-to-Peer Blocking Action..................... Disabled
    Radio Policy..................................... 802.11b and 802.11g only
    DTIM period for 802.11a radio.................... 1
    DTIM period for 802.11b radio.................... 1
    Radius Servers
       Authentication................................ Disabled
       Accounting.................................... Disabled
       Dynamic Interface............................. Disabled
    Local EAP Authentication......................... Disabled
    Security
       802.11 Authentication:........................ Open System
       Static WEP Keys............................... Disabled
       802.1X........................................ Disabled
       Wi-Fi Protected Access (WPA/WPA2)............. Enabled
          WPA (SSN IE)............................... Disabled
          WPA2 (RSN IE).............................. Enabled
             TKIP Cipher............................. Enabled
             AES Cipher.............................. Enabled
          Auth Key Management
             802.1x.................................. Disabled
             PSK..................................... Enabled
             CCKM.................................... Disabled
             FT(802.11r)............................. Disabled
             FT-PSK(802.11r)......................... Disabled
    FT Reassociation Timeout......................... 20
    FT Over-The-Air mode............................. Enabled
    FT Over-The-Ds mode.............................. Enabled
       CKIP ......................................... Disabled
       Web Based Authentication...................... Disabled
       Web-Passthrough............................... Disabled
       Conditional Web Redirect...................... Disabled
       Splash-Page Web Redirect...................... Disabled
       Auto Anchor................................... Disabled
       H-REAP Local Switching........................ Disabled
       H-REAP Learn IP Address....................... Enabled
       Infrastructure MFP protection................. Enabled
       Client MFP.................................... Optional
       Tkip MIC Countermeasure Hold-down Timer....... 60
    Call Snooping.................................... Disabled
    Band Select...................................... Enabled
    Load Balancing................................... Enabled
    Mobility Anchor List
    WLAN ID     IP Address            Status
    Press Enter to continue or to abort
    Press Enter to continue or to abort
    ACL Configuration
    Press Enter to continue or to abort
    CPU ACL Configuration
    CPU Acl Name................................ NOT CONFIGURED
    Wireless Traffic............................ Disabled
    Wired Traffic............................... Disabled
    RADIUS Configuration
    Vendor Id Backward Compatibility................. Disabled
    Call Station Id Case............................. lower
    Call Station Id Type............................. IP Address
    Aggressive Failover.............................. Enabled
    Keywrap.......................................... Disabled
    Fallback Test:
        Test Mode.................................... Off
        Probe User Name.............................. cisco-probe
        Interval (in seconds)........................ 300
    MAC Delimiter for Authentication Messages........ hyphen
    MAC Delimiter for Accounting Messages............ hyphen
    Authentication Servers
    Idx  Type  Server Address    Port    State     Tout  RFC3576  IPSec - AuthMode/P
    hase1/Group/Lifetime/Auth/Encr
    Accounting Servers
    Idx  Type  Server Address    Port    State     Tout  RFC3576  IPSec - AuthMode/P
    hase1/Group/Lifetime/Auth/Encr
    --More or (q)uit current module or to abort
    TACACS Configuration
    Authentication Servers
    Idx  Server Address    Port    State     Tout
    Authorization Servers
    Idx  Server Address    Port    State     Tout
    Accounting Servers
    Idx  Server Address    Port    State     Tout
    LDAP Configuration
    Press Enter to continue or to abort
    Local EAP Configuration
    User credentials database search order:
        Primary ..................................... Local DB
    Timer:
        Active timeout .............................. 300
    Configured EAP profiles:
    EAP Method configuration:
        EAP-FAST:
          Server key ................................
          TTL for the PAC ........................... 10
          Anonymous provision allowed ............... Yes
          Authority ID .............................. 436973636f00000000000000000000
    00
          Authority Information ..................... Cisco A-ID
    Press Enter to continue or to abort
    HREAP Group Summary
    HREAP Group Summary: Count: 0
    Group Name                # Aps
    Press Enter to continue or to abort
    HREAP Group Detail
    Press Enter to continue or to abort
    Route  Info
    Number of Routes................................. 0
    Destination Network          Netmask               Gateway
    Press Enter to continue or to abort
    Qos Queue Length Info
    Platinum queue length............................ 100
    Gold queue length................................  75
    Silver queue length..............................  50
    Bronze queue length..............................  25
    Press Enter to continue or to abort
    Mac Filter Info
    Press Enter to continue or to abort
    Authorization List
    Authorize MIC APs against AAA ................... disabled
    Authorize LSC APs against Auth-List ............. disabled
    Allow APs with MIC - Manufactured Installed C.... disabled
    Allow APs with SSC - Self-Signed Certificate..... disabled
    Allow APs with LSC - Locally Significant Cert.... disabled
    Load Balancing Info
    Aggressive Load Balancing........................ Disabled
    Aggressive Load Balancing Window................. 5 clients
    Aggressive Load Balancing Denial Count........... 3
    Statistics
    Total Denied Count............................... 0 clients
    Total Denial Sent................................ 0 messages
    Exceeded Denial Max Limit Count.................. 0 times
    None 5G Candidate Count.......................... 0 times
    None 2.4G Candidate Count........................ 0 times
    Press Enter to continue or to abort
    Dhcp Scope Info
    Scope: PUNTOSAP
    Enabled.......................................... Yes
    Lease Time....................................... 86400 (1 day )
    Pool Start....................................... 209.165.200.201
    Pool End......................................... 209.165.200.229
    Network.......................................... 209.165.200.0
    Netmask.......................................... 255.255.255.0
    Default Routers.................................. 0.0.0.0  0.0.0.0  0.0.0.0
    DNS Domain.......................................
    DNS.............................................. 0.0.0.0  0.0.0.0  0.0.0.0
    Netbios Name Servers............................. 0.0.0.0  0.0.0.0  0.0.0.0
    Press Enter to continue or to abort
    Exclusion List ConfigurationUnable to retrieve exclusion-list entry
    Press Enter to continue or to abort
    CDP Configuration
    Press Enter to continue or to abort
    Country Channels Configuration
    Configured Country............................. ES  - Spain
          KEY: * = Channel is legal in this country and may be configured manually.
               A = Channel is the Auto-RF default in this country.
               . = Channel is not legal in this country.
               C = Channel has been configured for use by Auto-RF.
               x = Channel is available to be configured for use by Auto-RF.
             (-,-) = (indoor, outdoor) regulatory doamin allowed by this country.
    -----------------:+-+-+-+-+-+-+-+-+-+-+-+-+-+-
        802.11bg     :
        Channels     :                   1 1 1 1 1
                     : 1 2 3 4 5 6 7 8 9 0 1 2 3 4
    -----------------:+-+-+-+-+-+-+-+-+-+-+-+-+-+-
    ES (-E   ,-E   ): A * * * * A * * * * A * * .
    -----------------:+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
        802.11a      :                         1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
        Channels     : 3 3 3 4 4 4 4 4 5 5 6 6 0 0 0 1 1 2 2 2 3 3 4 4 5 5 6 6
                     : 4 6 8 0 2 4 6 8 2 6 0 4 0 4 8 2 6 0 4 8 2 6 0 9 3 7 1 5
    -----------------:+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
    ES (-E   ,-E   ): . A . A . A . A A A A A * * * * * * * * * * * . . . . .
    Press Enter to continue or to abort
    WPS Configuration Summary
    Auto-Immune
      Auto-Immune.................................... Disabled
    Client Exclusion Policy
      Excessive 802.11-association failures.......... Enabled
      Excessive 802.11-authentication failures....... Enabled
      Excessive 802.1x-authentication................ Enabled
      IP-theft....................................... Enabled
      Excessive Web authentication failure........... Enabled
    Signature Policy
      Signature Processing........................... Enabled
    Press Enter to continue or to abort
    Custom Web Configuration
    Radius Authentication Method..................... PAP
    Cisco Logo....................................... Enabled
    CustomLogo....................................... None
    Custom Title..................................... None
    Custom Message................................... None
    Custom Redirect URL.............................. None
    Web Authentication Type.......................... Internal Default
    External Web Authentication URL.................. None
    Configuration Per Profile:
    Rogue AP Configuration
    Rogue Location Discovery Protocol................ Disabled
    Rogue on wire Auto-Contain....................... Disabled
    Rogue using our SSID Auto-Contain................ Disabled
    Valid client on rogue AP Auto-Contain............ Disabled
    Rogue AP timeout................................. 1200
    MAC Address        Classification     # APs # Clients Last Heard
    Adhoc Rogue Configuration
    Detect and report Ad-Hoc Networks................ Enabled
    Auto-Contain Ad-Hoc Networks..................... Disabled
    Client MAC Address  Adhoc BSSID         State              # APs   Last Heard
    Rogue Client Configuration
    Validate rogue clients against AAA............... Disabled
    Rogue Client Configuration
    Validate rogue clients against AAA............... Disabled
    --More-- or (q)uit
    MAC Address        State              # APs Last Heard
    Ignore List Configuration
    MAC Address
    Rogue Rule Configuration
    Priority Rule Name               State    Type          Match Hit Count
    (Cisco Controller) >show sysinfo
    Manufacturer's Name.............................. Cisco Systems Inc.
    Product Name..................................... Cisco Controller
    Product Version.................................. 6.0.199.4
    Bootloader Version............................... 1.0.1
    Field Recovery Image Version..................... 6.0.182.0
    Firmware Version................................. FPGA 1.3, Env 1.6, USB console
    1.27
    Build Type....................................... DATA + WPS
    System Name...................................... CISCO-CAPWAP-CONTROLLER
    System Location..................................
    System Contact...................................
    System ObjectID.................................. 1.3.6.1.4.1.9.1.1069
    IP Address....................................... 209.165.200.230
    Last Reset....................................... Power on reset
    System Up Time................................... 0 days 0 hrs 41 mins 2 secs
    System Timezone Location......................... (GMT +1:00) Amsterdam, Berlin,
    Rome, Vienna
    Current Boot License Level....................... base
    Current Boot License Type........................ Permanent
    Next Boot License Level.......................... base
    Next Boot License Type........................... Permanent
    Configured Country............................... ES  - Spain
    Operating Environment............................ Commercial (0 to 40 C)
    Internal Temp Alarm Limits....................... 0 to 65 C
    Internal Temperature............................. +39 C
    External Temperature............................. +23 C
    Fan Status....................................... OK
    State of 802.11b Network......................... Enabled
    State of 802.11a Network......................... Disabled
    Number of WLANs.................................. 1
    3rd Party Access Point Support................... Disabled
    Number of Active Clients......................... 0
    Burned-in MAC Address............................ C4:64:13:8F:93:40
    Power Supply 1................................... Present, OK
    Power Supply 2................................... Absent
    Maximum number of APs supported.................. 25
    (Cisco Controller) >
    The AP log
    AP442b.03dc.0925>
    *Apr 19 23:10:18.428: %CAPWAP-3-ERRORLOG: Selected MWAR 'CISCO-CAPWAP-CONTROLLER
    '(index 0).
    *Apr 19 23:10:18.428: %CAPWAP-3-ERRORLOG: Go join a capwap controller
    logging facility kern
            ^
    % Invalid input detected at '^' marker.
    logging facility kern
            ^
    % Invalid input detected at '^' marker.
    *Apr 19 23:10:19.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_i
    p: 209.165.200.230 peer_port: 5246
    *Apr 19 23:10:19.001: %CAPWAP-5-CHANGED: CAPWAP changed state to
    *Apr 19 23:10:20.200: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully
    peer_ip: 209.165.200.230 peer_port: 5246
    *Apr 19 23:10:20.201: %CAPWAP-5-SENDJOIN: sending Join Request to 209.165.200.23
    0
    *Apr 19 23:10:20.201: %CAPWAP-5-CHANGED: CAPWAP changed state to JOIN
    *Apr 19 23:10:20.211: %CAPWAP-3-ERRORLOG: This AP is not supported in controller
    version 6.0.199.4  ---->What's mean that? Is it compatible the ap with the WLC? ¿Es compatible el AP con el WLC?
    *Apr 19 23:10:20.354: %CAPWAP-5-CHANGED: CAPWAP changed state to CFG
    *Apr 19 23:10:20.355: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 209
    .165.200.230:5246
    *Apr 19 23:10:20.356: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY
    *Apr 19 23:10:20.356: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY
    *Apr 19 23:10:20.412: %CAPWAP-3-ERRORLOG: Dropping dtls packet since session is
    not established

  • How do I configure the 2504 Wireless controller with AP?

    I recently purchase the 2504 wireless controller and the 1602i AP. I was able to do the basic setup of the controller and can now access the web interface, but the AP is not being detected and I am unable to add it.

    First of all: 1602 AP need minimum software version on WLC: 7.4.100.0
    paste this info:
    sh sysinfo from WLC
    sh version from AP.
    Did you create a DHCP pool for APs to get IP ?
    Try to to be keep AP and WLC on same subnet.
    regards

  • Problem getting Airprint (Bonjour) to communicate to HP LaserJet CP1525nw printer across a Cisco 5508 Wireless Controller

    I cannot get my IPad2 to print (it cannot find the printer) using a Laserjet CP1525nw color printer across a wireless network using a Cisco 1508 Wireless Controller with 49 wireless access points. HELP!!!!
    What is the secret to getting Bonjour to work on it?
    I can get the IPad2 to locate the HP CP1525nw printer without a hitch using a low budget Netgear WAG102 stand alone wireless access point on the same network.

    If it helps somebody, here is what you need to do.
    It worked for me, but only in Multicast-Unicast mode.
    http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_tech_note09186a0 080bb1d7c.shtml

  • Error in GUI of Cisco 3850 Switch with Wireless Controller.

    Hi,
    I have Configured 3850 switch wireless controller. But while accessing the controller through GUI, I faced following errors while configuring it through GUI.
    Because its complecated to configure it through CLI.
    Attached are the snaps of error faced.
    and if I didnt get this error, and able to configure, I can save it because of this error.
    Please help me on this issue, so that I can easily configure the controller.
    Brgds,
    Ninad Thakare

    Hi Sandeep,
    Here is the configuration which I have did.
    ip http server
    ip http secure-server
    wsma agent exec
    profile httplistener
    profile httpslistener
    wsma agent config
    profile httplistener
    profile httpslistener
    wsma agent filesys
    profile httplistener
    profile httpslistener
    wsma agent notify
    profile httplistener
    profile httpslistener
    wsma profile listener httplistener
    transport http
    wsma profile listener httpslistener
    transport https
    wireless mobility controller
    wireless management interface Vlan4 ( Voice VLAN )
    wlan FG-WiFi 1 FG-WiFi
    client vlan 4
    ip dhcp server 10.106.72.1
    no security wpa akm dot1x
    security wpa akm psk set-key ascii 0 testing1234
    no security wpa wpa2
    no security wpa wpa2 ciphers aes
    no wmm
    no shutdown
    wlan GLOBALACCESSII 2 GLOBALACCESSII
    client vlan 4
    ip dhcp server 10.106.72.1
    no security wpa akm dot1x
    security wpa akm psk set-key ascii 0 testing1234
    no security wpa wpa2
    no security wpa wpa2 ciphers aes
    no wmm
    no shutdown
    ap group default-group
    ap group 3850WLC
    wlan FG-WiFi
      vlan 4
    wlan GLOBALACCESSII
      vlan 4
    end
    Brgds,
    Ninad Thakare

  • Managing remote C800 with the wireless controller

    We have a number of regional offices throughout the country with a C800 as the Internet facing router and it is also our wireless.
    We have a Cisco wireless controller in the Data Center an we need to manage\monitor all the C800, but the problem is that those remote sites
    are not VPN'd nor part of our WAN network.
    Which setup do you
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin:0in;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    recommend:
    1) 1)      WLC to monitor the C800 using its public IP address
    1)  2) Create a VPN tunnel from each of the remote sites to our data center and only allow wireless to go through for mgmt purposes
    anany other options?
    T

    First question is which 800 do you have ? there's like 20 different versions out there.
    If you talk about WLC, I would suppose you have something like the 880 ?
    I'm afraid the WLC will need the internal AP ip address. So you would need to do so reverse nat to direct public ip address tarffic on capwap ports to the internal AP.
    This or the VPN tunnel.
    Nicolas
    ===
    Don't forget to rate answers that you find useful

  • How to change IP adress of wireless controller 2504 . from GUI

    how to change IP adress of wireless controller 2504 . from GUI 

    In the existing setup, does WLC management & APs are on the same vlan ? If that is the case you may have not configured any of the below, as AP L3 broadcast reach WLC & in that way AP will learn about WLC.
    If WLC & APs are on different vlan you may already use one of WLC discovery method listed below.
    1. DHCP Option 43
    2. DNS
    3. UDP broadcast forwarding
    4. Static configuration
    When you change the WLC management IP address, AP need to know what is the new IP & you can modify the configuration of the method you used.
    HTH
    Rasika
    **** Pls rate all useful responses ****

  • Syslog on Cisco Wireless Controller

    Hi everyone
    I have question about syslog on wireless controller. I need to know what is information in the syslog from controller. I had read paper in the community some siad it has not much in the syslog but it has not detial what is the information in the syslog sent. I know that almost information such as client, authentication, and much benefit logging in the SNMP. So, anyone have any idea or information please give me the idea or information.
    Thanks
    V

    You just need to setup the sylog and try different logging levels to see if it gives you the information you need.  YOu might not get what you want or if you find a syslog level that gives you the info you want, you might get a lot of stuff you don't want to see.
    http://www.cisco.com/en/US/products/ps6307/products_configuration_example09186a00809a2d76.shtml
    Thanks,
    Scott
    Help out other by using the rating system and marking answered questions as "Answered"

  • Problems between a Wireless Controller and a Switch.

    I have a Wireless Controller 4402 connected to one sw2960G.
    I configured the controller with LAG and the switch (sw2960G) with etherchanel.
    I connected the controller 2 distribution ports to the 2 ports of the switch (configured with etherchanel).
    It worked like it should work.
    But the problem is like this: if I take one cable that is connected to the switch and unplugged that cable from the switch (if that cable is the one connected to controllers port one) I have connectivity between both machines.
    If I plug in the switch the cable connected to controller port one and take the other cable and unplugged that cable from the switch I stop the connectivity between the two machines.
    I think that was not supposed to happen… because the LAG in the controller should put every AP in the second controller's port, and the connectivity between the machines should not end.
    Can any one help me?
    Can any one tell me what I am doing wrong?
    Thanks in advance,
    Rui

    With LAG enabled in the controller I think I can have only one ap-manager interface.
    The LAG will (it is supposed to) do the load balance automatically.
    I mean, if one of the interfaces is “down” the other will have to coupe with all the AP's.
    I should have always connection between the controller and the switch.
    The STP of the controller is configured by default (STP Mode = OFF).
    In the case of etherchannel load balance… I saw the Cisco documentation and I did not saw any thing about that. I think that The LAG as to do that for the controller… I'm right about that?
    I will see the link that you advised…
    Can you help me?
    Thanks,
    Rui

  • Manually add Access Point to 2504 Wireless Controller

    We have a 2504 Wireless Controller and it works great!
    We currently have 6 Access Points (Aironet 1252) connected.
    We just added the sixth one a few weeks ago and with a properly configured and fully functioning Wireless Controller, it was super easy.
    Now, I have been assigned to add another Access Point, but at a remote site.
    The plan is to have up to three or more APs at this remote location and we want them to talk back to the Wireless Controller.
    We have plenty of licences on our current Wireless Controller.
    Do do not want to spend the funds for another Wireless Controller and more licenses.
    1. How does one manually add a Aironet 1252 to the 2504 Wireless Controller
    2. If the AP is on a different subnet than the Wireless Controller, how does one get it registered?
    3. The best for last: Can a Aironet 1252 talk to a 2504 Wireless Controller over a WAN link?
    If so, how?
    Thank you!
    Bryan Smith

    Here are some links
    AP join
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a00806c9e51.shtml
    FlexConnect
    http://www.cisco.com/en/US/docs/wireless/controller/7.2/configuration/guide/cg_flexconnect.html
    Sent from Cisco Technical Support iPhone App

  • Question about 2504 Wireless Controller

    Hello,
    I am tasked with configuring a 2504 wireless controller.  Is it possible to assign an SSID to an interface that has dynamic ap management enabled?
    Scenario:
    Location1:
    1) 10.0.0.0/24
    2)192.168.0.0/24 DMZ
    Location 2:
    1) 10.0.5.0
    Both locations are routable using network 1 at each location.  However, I need to configure several access points and send them to location 2.  These access points will communicate with the controller at location 1 on network 1.  Two SSIDs will need to be on network 1 at location 1.  The other SSID will be on Network 2 at location 1.  This network is not routable. 
    Thank You for your help.

    So this is how you want this to be setup:
    Scenario:
    Location1:
    1) 10.0.0.0/24
    2)192.168.0.0/24 DMZ
    Location 2:
    1) 10.0.5.0
    Both locations are routable using network 1 at each location. However, I need to configure several access points and send them to location 2. These access points will communicate with the controller at location 1 on network 1. Two SSIDs will need to be on network 1 at location 1. The other SSID will be on Network 2 at location 1. This network is not routable.
    Since location 1 is a flat network with only one subnet (internal) and one in the DMZ, you will configure WLC management/ap-manger port 1 on the 10.0.0.0/24 subnet.  You can then map your SSID#1 to the management interface.  Create a new dynaminc interface on the WLC and assign it an ip in the 192.168.0.0/24 subnet and place that on port 2.  Connect port 2 to the DMZ.  Now since you want everything to tunnel back to the WLC from location 2, you would leave the ap's in local mode.  Devices in location 2 associating on SSID #1 will obtain an ip address in location 1 and tunnel back to the WLC and traffic will egress out of port 1.  Devices that associate in location 1 or location 2 to SSID#2 (Guest) will tunnel back to the WLC in location 1 and traffic will egress out of port 2.
    Since you want to tunnel traffic back to the WLC from location 2, you need to make sure your link has enough bandwidth or else the ap's will be bouncing.
    If you setup the AP's in location 2 in h-reap mode, then you can place devices that associate to SSID #1 on the 10.0.50.0 subnet.  Devices that associate to SSID #2 at location 2 will tunnel back to the WLC and egress out of port 2.

  • Accounting in wireless controller

    Hi everyone!
    I have the question according to accounting of wi-fi users. Does wireless controller support accounting of all connections, sessions(duration,mac, ip address etc) that were made during a predefined ammount of time, for example one month? If controller does not, how can I achieve this?
    Best wishes, Zhomart

    In the Radius configuration part of the document you have provided it says following regarding to acconting functions:
    "Accounting—The process of recording user actions and changes.
    Whenever a user successfully executes an action, the RADIUS accounting server logs the changed attributes, the user ID of the person who made the change, the remote host where the user is logged in, the date and time when the command was executed, the authorization level of the user, and a description of the action performed and the values provided. If the RADIUS accounting server becomes unreachable, users are able to continue their sessions uninterrupted."
    But can it gather the information about the connected devices, like it's type, mac-address, operating system etc? It would be very useful for security reasons to monitor the guest users, who don't have their own login. And if Radius can't do that, then would be your Boardless Network solution with MSE and Prime, proposed by you earlier, be the answer for our needs?

Maybe you are looking for

  • Open PDF in Browser SharePoint

    I wanted my web app to allow opening of PDF files in the browser. I performed the action below which solved the issue. $webApplication = Get-SPWebApplication "http:/yourwebapplicationurl" $webAppApplication.AllowedInlineDownloadedMimeTypes.Add("appli

  • How can I remove a previous iPhone owner's iCloud information from my refurbished iPhone 4S?

    I recently had to submit a claim on my white iPhone 4S that I dropped at the gym. Upon submitting this claim with my phone provider, they shipped me a refurbished iPhone 4S. EVERY TIME that I try to back up, restore, check emails, download apps or un

  • Adjusting Clip/Photo length in iMovie 11

    Hello, I am a new mac user, I am using iMovie 11 on OS lion. Is there a way to adjust clip length/photo duration by simply clicking and dragging? I find it really annoying to have to enter the duration manually for still photos. Equally annoying is t

  • HR_INFOTYPE_OPERATION in insert mode - duplicate records

    Hi, I'm using athe above function to insert a record into IT0015 (Additional Payments) i.e. Operational Mode is 'INS' but when I have a record already in the system for the date specified it is just inserting a new record - is there a parameter I can

  • DHCP server does not assign IP addresses SG500 firmware 1.3.5

    good day collegues has any of you come across the following issue: my switch (after upgrading to the newest firmware 1.3.5) does not assign IP addresses to some of the hosts. after a couple of hours I managed (do not even how) to force my switch to a