WiSM2/WLC design

Hi experts,
We are in middle of deploying WiSM2s on our network, from a design point of view i am confused on where to position the WiSM2s. We have 2 DCs and from best practice architecture view WLCs should not be placed on the Data Centre segment, but it seems that is the only option i have.
DCs host 6509s, i am planning to host 1 WiSM in each DC, all clients will be on seperate subnet. Do you foresee any issues with this deployment or any security issues?
authentications are followed as per cisco recommendation, clients authenticated against AD through ACS so it is fairly secure. Will appreciate any advice.
Cheers
AP

Amar,
Since you are going to install the WISM2 you will be limited to where your chassis is physically installed. If we are operating under the assumption that all, or at least most, of the traffic sent to the WISM2 will eventually hit the data center I do not se a reason to move them. On the other hand if you have a lot of peer to peer wireless traffic such as voice calls and pages you may want to consider some HREAP configuration. Placement of the WISM2 will not have any affect on the authentication/encryption that you will use. Ideally when planning a new WLC/WISM(2) deployment I like to use all local mode APs with a WLC/WISM(2) at each site as well as a WLC in the DMZ to use as a mobility anchor. If you provide more specific details such as client type, traffic path, and number of clients per location I can help you with something more specific to your design.
Thanks,

Similar Messages

WISM1 (WLC 6.0.182) to WISM2 (WLC 7.2.115.1) migration

Hi all,
I plan to replace 2 x WISM1 (WLC 6.0.182) by 2 x WISM2 (WLC 7.2.115.1). One WISM in each Catalyst 6500. I am sorry it is a little long but I have no lab and I need your advice.
Summarized migration plan is the following :
Upgrade of the 4 WLC (WISM1) from 6.0.182 to 7.0.240
AP pre-download from the 4 WLC (WISM1)
Transfert WLC 7.0.240 image to the 4 WLC (last compatible version)
Transfert WLC 7.0.240 image from the 4 WLC to AP and swap AP primary and secondary image
So, AP primary image is 7.0.240, AP secondary image is 6.0.182
Scheduled reboot of the 4 WLC
So, 4 WLC (WISM1) and AP are running WLC 7.0.240
Move AP from the 2 WLC of the1st WISM1 to the 2 WLC of 2sd WISM1 Swap AP primary and secondary controller with NCS
Backup the configuration file
of one WLC of the 1st WISM1
of one WLC of the 2st WISM1
Replace the 1st WISM1 by one WISM2
WISM2 upgrade from the current WLC version to 7.0.240
Import the saved configuration file (WISM1) to WISM2 (7.0.240)
Check the configuration via HTTPS
Move AP from the 2 WLC of the 2sd WISM1 to the 1st WISM2 Swap AP primary and secondary controller with NCS
Replace the 2sd WISM1 by one WISM2
WISM2 upgrade from the current WLC version to 7.0.240
Import the saved configuration file (WISM1) to WISM2 (7.0.240)
Check the configuration via HTTPS
Upgrade WISM2 from 7.0.240 to 7.2.115.1
AP pre-download etc.
etc.
Please, what do you think about this migration plan ?
Do you have a better/simplier solution ?
Thanks

Also you would enable Authorize MIC APs against auth-list to avoid AP's fallback to the WiSM1. So, if I understand you, it would be enable on WISM1. This way AP's trying to fallback to the WISM1 will be refused and reconnect to the WISM2 that's right ?
Yes... this will prevent access point from joining the WiSM1... AP's that are already on WiSM1 will stay, it just prevents any AP's that has already been migrated to WiSM2 to fail to WiSM1.
How can I get the configuration from WiSM1 to the WiSM2 ?
Well you would backup your config and open it up in a text editor... then you would edit the file, by changing the hostname and ip address, etc. Make sure you have a trailing space at the end of each command that you change. This is important or else the config will not take. Also you will have to edit the password for the management since it is encrypted in the backup config. replace it with:
config mgmtuser password
Save the config and do a restore on the WiSM2 and verify that the setting are okay prior to moving all the ap's over. I would move one to test your wlans and make sure its fine before moving more.
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

WiSM2 WLC 7.2 Maximum Allowed Clients under Global Parameters 802.11a/n b/g/n

Hello everyone,
Just loaded the 7.2.103.0 software onto the brand new WiSM2. Going throught the options and have found that under the global parameters for 802.11a/n, 802.11b/g/n radios is now the "Maximum Allowed Clients" option. The allowed setting is from 1 - 200 clients.
Does that mean only 200 clients will be allowed to associate to the WLC on that radio at a maximum?
Doesn't seems to make sense... I have the 500 AP license on this WiSM2... I know this option used to be an optional setting under a WLAN in previous releases.
Any ideas?
Regards,
Sasha.

Does that mean only 200 clients will be allowed to associate to the WLC on that radio at a maximum?
As what Scott has responded, this means 200 clients per WAP.
If you do exceed 200 clients per WAP (or whatever value you put in there) the clients will just get a nag and the system will let you in eventually.

AP SSO WISM2 WLC 7.4.121

HI everyone,
I'm currently doing a proof of concept on the AP SSO feature running on WLC 7.4.121.
The first thing I would like be sure is that client SSO is not avalaible in 7.4.X release, i need to upgarde to 7.5.X, Am I right ?
The second thing I would like to share and investigate with you is about AP SSO not currently working in my topology.
I have 2 seperate C6500 (SUP720-3B) switches with 1 WISM2 in each and both switches interconnected trough a 10G port.
I enable AP SSO on both WLC that synchronize themselves trough the 10G port on a special redundancy VLAN.
They both synchronize, and everything is working (both AP database on primary and standby WLC).
What I can't understand is when forcing switchover on the primary (redundancy force-switchover command), the fallback is doing great to the standby WLC but the AP still get into CAPWAP DISCOVER state because of a timeout with the following logging message
*Feb 14 15:36:37.727: %CAPWAP-3-ERRORLOG: Sequence number (0) mismatch in request messageDeleting clients for centrally switched wlan 1Deleting clients for centrally switched wlan 1Sending hreap clients to wlc on HA eventAP1cdf.0f66.90b4#% Cannot enable CDP on this interface, since CDP is not running% Cannot enable CDP on this interface, since CDP is not running., 5)14 15:37:22.934: %CAPWAP-3-ERRORLOG: Retransmission count for packet exceeded max(CAPWAP_WTP_EVENT_REQUEST*Feb 14 15:37:22.934: %CAPWAP-3-ERRORLOG: GOING BACK TO DISCOVER MODE
So the SSID is unavalaible for a certain period of time as it would be with N+1 redundancy.
I also saw that some documentation said that tle WLC needs to be run on a VSS (
http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113681-high-availability-dg-00.html) and some other say the contrary (http://www.cisco.com/c/en/us/products/collateral/wireless/aironet-1130-ag-series/qa_c67-714540.html)
Did you manage to get AP SSO working and did you ever have this issue ?
Thank for you help !

HI Max,
The first thing I would like be sure is that client SSO is not avalaible in 7.4.X release, i need to upgarde to 7.5.X, Am I right ?The second thing I would like to share and investigate with you is about AP SSO not currently working in my topology.
Yes you need 7.5 version on WLC for Client SSO.
I never seen this tiype of error, You must contatc TAC and tell them about this issue.
Regards
Dont forget to rate helpful posts

Centralized WLC Design Question

Dears,
In my scenario, i am designing CEntralized WLC deployment. I have 30 AP in Buidling X(200 Users) and 20 AP in Buidling Y(150 Users). I am planning to install HA WLC CLuster where Pimary & Secondary WLC will reside in physically different Data Centers A & B.
I have a wireless Design Question and i am not able to get clear answers. Please refer to the attached drawing and answer the following queries:
If Buidling X users want to talk to building Y Users, then how Control & Data Traffic flow will happen between Buidling X & Y. Would all the traffic will go to Primary WLC from Bldg X APs first and then it will be Re Routed back to Buidling Y APs? Can i achieve direct switching between Bldg X&Y APs without going toward WLC?
If Building X & Y Users want to access the internet, how would be traffic flow? Would the traffic from X&Y AP will go tunnel all the traffic towards WLC and then it will be routed to internet gateway?is it possible for Bldg X&Y AP to directly send traffic towards Internet Gateway without going to controllers?
I have planned to put WLC at physically different locations in different DC A & B. Is it recommended to have such a design? What would be the Failver traffic volume if Primary WLC goes down and secondary controller takes over?
My Reason to go for Centralized deployment is that i want to achieve Centralized Authentication with Local Switching. Please give your recommendations and feedback
Regards,
Rameez

If Buidling X users want to talk to building Y Users, then how Control & Data Traffic flow will happen between Buidling X & Y. Would all the traffic will go to Primary WLC from Bldg X APs first and then it will be Re Routed back to Buidling Y APs? Can i achieve direct switching between Bldg X&Y APs without going toward WLC?
Traffic flows to the WLC that is the primary for the AP's, then its routed over your network.
If Building X & Y Users want to access the Internet, how would be traffic flow? Would the traffic from X&Y AP will go tunnel all the traffic towards WLC and then it will be routed to Internet gateway?is it possible for Bldg X&Y AP to directly send traffic towards Internet Gateway without going to controllers?
The WLC isn't a router, so you would have to put the Internet traffic an a subnet and route.
I have planned to put WLC at physically different locations in different DC A & B. Is it recommended to have such a design? What would be the Failover traffic volume if Primary WLC goes down and secondary controller takes over?
Like I mentioned... earlier, the two HA WLC has to be on the same layer 2 subnet in order for you to use HA. The guide mentions an Ethernet cable to connect both the HA ports on the WLC.
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

WLC Design Questions

Looking for a "recommended" design.
Looking at a remote location that contains no Cisco switches or router. 5 AP's total. Seems kinda of pointless to setup a 4402 Controller for 5 AP's. What is the recommended REAP mode implementation (real world) for AP's? Other alternatives?

Hi,
be careful, you don't have infrastructure at the remote site ?
You can directly connect up to 3 APs to a 2006 controller. But I don't know, if you can use 1130/1240 APs because they are LWAPP-converted APs, so they only use L3-LWAPP. I think with L3-LWAPP there must be an L3-Link between AP and controller, but I am not sure. By the way POE is an extra, controller 2006 has no POE enabled Ports.

Cisco WLC design over 2 sites

Hi all
we are looking to deploy 2 wireless controllers, 1 in each of our offices.
We want the site AP's to fail over to the other controller should one of them go down.
My question is, the LAN ip adressing should be different on each site, so they can break out of there local internet etc.
Will this be OK ?
do we have to configure the AP's in HREAP ? So the vlans can break out on the local LAN?
also I gather we would have to have 2 AP groups one per site ?
cheers
Carl

Carl,
If you're going to put WLC in both sites, you need to do a financial review as well as technical.
I don't usually see a WLC fail at the remote end unless the power supply blows up, however, I've seen a lot of cases when the WAN link goes down. This is why I'm asking you to make a financial review. If you plan to move the APs back-and-forth, then you'll need to shell out licenses of both units.
But you also need to consider that if you want to run H-REAP and your WAN link goes down, then the AP needs to have a local authentication at the site to get H-REAP to work fine. You should be asking the bean counters which is cheaper: Have one local authentication server at each site or increase the licenses of the WLC to accommodate HA?

WLC Design

Hello,
I want to install a WLC controller on the central site and 50 Access Point on the remote site.
I have 10 remote site with 5 Access Point per site.
Each remote site is connected to the central site with lan to lan VPN (ASA 5510 at the central and ASA 5505 at the remote site).
1) the WLC must manage Different SSID and Network, is it working ?
2) Is there a lot of traffic between the Access Point and the WLC controler ? ASA 5510 is connected with Internet SDSL 2 Mb and each ASA 5505 with Internet ADSL 8 Mb (only 500 Ko max for upload)
Thanks for your help

What you need to do is setup the AP's in H-REAP mode and not local. This way the AP is locally switched and not have to tunnel the traffic back to the WLC. Anytime you have a centrally managed WLC and multiple remote sites, H-REAP should be used unless you have a big backbone back to the central site.
http://www.cisco.com/en/US/products/ps6521/products_tech_note09186a0080736123.shtml

Wlc 5760 design

I have a new deployement with WLC 5760.
total number of aps are 150 with 4 WLANs.
each WLAN is mapped to a sperate VLAN. I have a couple of design questions:
     - the switchport configuration of the AP will be trunk or access ?
       if access, then port should be memeber of which VLAN ?
     - mobility configuration for single WLC design ?
     - I would like to make two groups in which group 1 will advertise WLAN 1,2 and 3 while the group 2 will advertise only WLAN 4.
       is it possible ?
really apprecite your response.
Regards

Hi,
Here is my responses
   - the switchport configuration of the AP will be trunk or access ?       if access, then port should be memeber of which VLAN ?
5760 only support Local mode APs. So all your AP connected switchports (in access layer) should be configured as access ports. You can put that in a different AP management vlan.
     - mobility configuration for single WLC design ?
You can configure a mobility group name even though no any other controllers.
     - I would like to make two groups in which group 1 will advertise WLAN 1,2 and 3 while the group 2 will advertise only WLAN 4.        is it possible ?
Yes, you can create two AP groups & map these WLANs. Then add APs into these two AP groups according to your requirement.
These posts should give you some reference
http://mrncciew.com/2013/12/16/5760-in-ca-cuwn/
http://mrncciew.com/2013/12/12/getting-started-with-5760/
http://mrncciew.com/2013/12/14/3850ma-with-5760mc/
HTH
Rasika
**** Pls rate all useful responses *****

WLC+Anchor+Guest NAC

Hello all
I have few basic clarifications on these components.. i have a network, with LWAPP's and WLC on one site - say site A. lets consider only the guest SSID, access as of now.. The Anchor guest controller is positioned on a DMZ segment on Site B. Site A & B are connected through a routed network. I also have a NAC guest server, on Site C. Now, i want to integrate all these components. As per my knowledge following is the traffic flow:
1) When guest users access their SSID, they are mapped to the anchor controller in DMZ, throu mobililty groups.. the WLC then initiates a EoIP tunnel to DMZ controller.. Firewall rules allow,all reuired ports (IP 97, 16666 UDP etc), and end to end ip communication happens.
2) Upon the reuest, the Anchor controller provides an Ip address from DHCP configured locally. In this case, will the default gateway of the PC's be Anchor DMZ controller's WLAN IP or will it be local to Site A (say L3 switch) ?
3) Then when the user tries to access any site, he is given a web authentication portal, which is linked to the radius server/nac guest server. during authentication, dmz controller again tries speaking to the nac guest server in site c. hence the firewall has to alow for UDP 1812/1813 radius ports..
4) after authentication, the user browses internet. Now, what will be the ip packet flow in this instance. Will all traffic be first tunneled across LWAPP to the controller, and from there EoIP'ed to the Anchor ? Anchor then forwards it to the internet gateway, through DMZ ? as asked before, will the default gateway of the PC's be the WLAN IP of the anchor ? if there are too many users, will I create many WLAN SSID's for guests, for Site A ?
Sorry for the long post..
Raj

Greg
Thanks again.. that was useful too. One last query.. and this was grilling my head:
1) how does the guest vlan egress work ? I have a WLC on a new DMZ of PIX, with /27 subnet.. This WLAN is used only for EoIP communication.. now, when the guest user gets a DHCP IP, what IP pool should i define here ? since the default route is going to be towards the PIX, it should be one among the 4 interfaces, right now ? or should I have another interface or VLAN dmz for the egress traffic from WLC ? SRND says something about dynamic interfaces, but not been explained at all :(
2) will the foreign WLC talk to the Anchor controller 1 & 2, in load balancing mode ? why i'm asking is, if the dhcp is defined on Anchor 1 and if the request goest to anchor 2, then it will be an issue.. otherwise is it advicible to split up dhcp scopes between the two Anchors ? say 1-127 in one anchor and 128-254 on other ?
3) Lastly.. about guest nac servers.. i have 2 of them in place.. will the guest database be replicated between them , like what ACS does ? if so, is the replication bidirectional ? If lobby admin creates an account, it will be good if he just creates in one box, and the other box replicates it ..
Thanks for all your answers.. it has been really useful to me.. and i think will be useful for anyone who works on Anchor+guest+foreign WLC designs :)
Raj

Wireless AP design for Wireless IPPhone 7921

FOr a client they are asking 40 Wireless IP Phone, with 3 floors, IPT side I am clear in design, but for access point design I am bit confused with standalone and WLC design.
Could please light me on Wireless design for standalone AP and WLC controller with AP , in the design plan to give both as options.
And also how to confirm a AP is a standalone or it wil work only with WLC.
Please light me with wireless design for IPT.

I would suggest you subcontract this to a partner who is familiar with wireless voice designs. There are a lot of details and caveats to make sure it works.
For example: autonomous APs are not viable for voice installations. You need a controller to prevent the roam times from interrupting the call.
At a minimum, you should read the Voice over Wireless LAN Design Guide:
http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns820/landing_voice_wireless.html

WLC 5760 centralized mode Flexconnect support?

Hi all,
I am currently digging through the documentation about the 5760 WLC and converged access mode and found one particular information, which I need more clarification for.
This is the link
http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps12598/qa_c67-726507.html
And here the specific snippet:
Q. What deployment modes can the Cisco 5760 WLC and Cisco Catalyst 3850 support?
A. The Cisco 5760 WLC can operate in centralized mode (also known as local mode) as well as converged access mode, whereas the Cisco Catalyst 3850 operates in converged access mode. At this time, there is no support for office-extend access points, indoor or outdoor mesh, or FlexConnect access points on the Cisco 5760 WLC and Cisco Catalyst 3850.
Now my questions are:
Does this apply to the converged access mode only or also centralized mode?
Do 5508/WiSM2 WLCs still support APs in the specified modes even when using the new mobility architecture?
When is it planned to add support for the new platforms, if at all?
Hoping for some answers!
Regards,
Patrick

Hi Patrick,
Why not post your question here;
https://supportforums.cisco.com/thread/2220448
There's an open forum Converged Access Q&A session on the go direct with Cisco...
Richard

WISM2 7.2

We've recently recieved a couple of WISM2 WLCs and upgraded them to 7.2.110.0 since it increases throughput and maximim APs. I've now checked and each WISM2 has 2 10Gb interfaces and one port channel.
Am I wrong to expect both 10Gb interfaces to be within the port channel (like the WISM1 port channel had 4 1Gb interfaces in it)?
Both 10Gb ports in each WISM2 have traffic going over them with the port not in the port channel having slightly less traffic.

#Initial System Configuration with Sup 720
Complete these steps:
    Upgrade the Cat 65XX with the Cisco IOS® Software Release 12.2(33)SXJ2 provided on Cisco.com.
    Note: If upgrading from WiSM-2 1DP to WiSM-2 2 DP, first you need to upgrade the Cat65XX to 12.2(33)SXJ2 before upgrading the WiSM2 to the 7.2.103.0 code to enable DP2. Also, vice versa if downgrading the Cat 65XX to below 12.2(33)SXJ2 you need to downgrade the WiSM-2 2DP to a WiSM-2 1DP image.
    Only after upgrading the Catalyst IOS software the system will recognize the WiSM-2 2DP blade.
#Initial System Configuration with Sup 2T
Complete these steps:
    Upgrade the Cat 65XX with the Cisco IOS Software Release 15.0(1)SY1 provided on Cisco.com.
    Note: If upgrading from WiSM-2 1DP to WiSM-2 2 DP, first you need to upgrade the Cat65XX to 15.0(1)SY1 before you upgrade the WiSM2 to the 7.2.103.0 code to enable DP2. Also, vice versa if downgrading the Cat 65XX to earlier than 15.0(1)SY1 you need to downgrade the WiSM-2 2DP to a WiSM-2 1DP image.
    Only after upgrading the Catalyst IOS software the system will recognize the WiSM-2 2DP blade.

AP wont change primary WLC w/o re-boot.

Hi all!
I have som problem with a WiSM2-wlc running 7.3.101.0. We have APs that should be moved to an other WLC and we want to to it as smooth as possible. But when changing the primary WLC for an AP, the AP will not move to newly configured WLC. As for moving a AP to the WiSM2, its not a problem, they move to within minutes.
I have tried some different scenarios, move from and to:
WiSM2(7.3.101.0) -> WiSM2 (7.3.101.0)
WiSM2(7.3.101.0) -> WiSM (7.0.240.0)
and also tested with differnt AP-models, AP1142, AP2602 and AP3602, but same "problem" with all AP-models. I thinik that there is something wrong with this WLC, we have re-booted it but there is no differnce.
Anyone have a clue where to continue the trouble shooting?
Thanks!

You´re right! For the 2602 and 3602 I only have tested WiSM2->WiSM2
So what's the problem again?
WiSM2 are running different firmware than the WiSM1.
So when your 1140, 2600 and 3600 falls back from WiSM2 to WiSM1, only the 1140 and 3600 will go across. When the APs go across, they will download the firmware for WiSM1 and reboot.
Same holds true with the APs return back to the WiSM2.
Besides, what you are doing now is about to become obsolete due to High Availability, Stateful Switch Over (AP SSO) for WiSM2.

PKC or OKC ???

What exactly is the difference between PKC and OKC?
Seems to be a lot of confusion out there. What are the cold hard facts?
The WLC FAQ says
"PKC is a feature enabled in Cisco 2006/410x/440x ..."
The Debug Guide says
"The WLC only supports OKC..."
Wireless LAN Controller (WLC) Design and Features FAQ
http://www.cisco.com/en/US/products/ps6366/products_qanda_item09186a00808b4c61.shtml
Q. What is PKC and how does it work with the Wireless LAN Controller (WLC)?
A. PKC stands for Proactive Key Caching. It was designed as an extension to the 802.11i IEEE standard. PKC is a feature enabled in Cisco 2006/410x/440x Series Controllers which permits properly equipped wireless clients to roam without full re-authentication with an AAA server.
WLC Debug and Show Commands
http://www.cisco.com/en/US/partner/products/ps6366/products_tech_note09186a0080b3e118.shtml#pmkid
PMKID Caching Fails
Check if the client supports opportunistic key cache (OKC).
Note: OKC is not the same as proactive key cache (PKC) as specified in 802.11I. The WLC only supports OKC.

I would like to add to this and perhaps add some insight to your question. I know this thread is a bit old...
OKC / PKC are the same thing.
OKC / PKC-- When a supplicant does its first 802.1X authentication a PMK is created. This PMK is cached on the WLC for all the APs to use on that WLC to negate the need of the supplicant having to do a 802.X auth each time a supplicant roams from AP to AP.
Example.
A supplicant and 5 aps. The client roams to the first AP and does a full 802.1X auth. This PMK is then saved on the WLC and is reused for the others APs. The client roams to another AP, the same PMK is used, but a different PTK is generated.
So you can see the client ever hits the radius server 1 time.
With autonomous APs there is PMK caching ... Not supported on the WLCs as I understand but will mention anyway.
Works differently. The supplicant would 802.1X auth to each AP, but it will create a PMKSA (PMKID) for each ap. So should that supplicant roam back to that AP (reassociate) then it would negate the supplicant from having to do a full 802.1X to that specific AP.
Example.
A supplicant roams to 5 access points. For the first time when the client roams to each of the 5 APs the client will do a full 802.1X auth. So thats a total of 5 802.1X auths. Should that client roam back to the otehr APS. There is no full 802.1X auth. Because it is cached in the PMKID.
So you can see the client has to hit the radius server 5 times (atleast once) for each ap.
OKC/PKC needs to be supported by the client as well. 80211.r is a close reletiave to OKC. I understand Apple will support 802.11r in ios5. The WLC will support 802.11r fully in 7.2 code.
I hope this helps ...

WiSM2/WLC design

Similar Messages

Maybe you are looking for