Wlan and ACS

I need create in our campus network wlan network using cisco AP 350 i need authenticate all our users on aur ACS server. Is it possible??? Do you have experience with this????

Yes, this is very possible and not to difficult to accomplish. Here is a URL that will help you through the process. Just do a search in the document for ACS
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_configuration_example09186a00801a90d3.shtml
Scott

Similar Messages

Dynamic VLAN assignment with WLC and ACS for

Currently, using our autonomous APs and ACS, our users get separate VLANs per building based on their security level (students or staff). Basically, the student VLAN in one building is different from that of the student VLANs in other buildings on campus. Currently, we do this by filling the Tunnel-Private-Group-ID IETF RADIUS attribute with the VLAN name. This all works because each individual AP can map VLAN names to different VLANs like this:
dot11 vlan-name STUDENT vlan 2903
dot11 vlan-name FACSTAF vlan 2905
As we are working on our WiSM deployment, we see that the document below shows how to do the dynamic VLAN assignment on our WLAN controllers:
http://www.cisco.com/en/US/customer/products/sw/secursw/ps2086/products_configuration_example09186a00808c9bd1.shtml
However, we haven't figured out if it's possible to still provide our users with different VLANs for each building they're in.
With the instructions above, it looks like ACS uses a Cisco RADIUS Attribute to indicate the Air-Interface-Name, mapping an ACS/AD group to a single WLC interface which can only have one VLAN/subnet associated with it.
Does anybody know if what we're trying to accomplish is possible, or if we're really stuck with only one VLAN/subnet per mapped ACS group?

We only have the one WiSM for all of campus, so it's handling everything. This Cisco docs do indicate how to put differnet users in different Vlans, but we don't currently see a way to also put them in different subnets per building.
This being the case, any suggestions on how best to handle more than a Class C subnet's worth of users? Should we just subnet larger than Class C, or is there a more elegant way of handling this?

Wireless Virtual LAN - SSID and ACS User Mapping

Hi Everybody
We have the following senario:
- WLC 4402 and ACS 3.3
- 2 SSID's , One for Emploies - one for gests
- All users are (guest and emploies) are authentication against the ACS Server.
We would like to only permit Guest users to use the Guest SSID.
I've been reading the Wireless Virtual LAN Deployment Guide :
http://www.cisco.com/warp/public/cc/pd/witc/ao1200ap/prodlit/wvlan_an.pdf
and have tried to use methode 1.
- RADIUS-based SSID access control:
"Upon successful 802.1X or MAC address authentication, the RADIUS server
passes back the allowed SSID list for the WLAN user to the access point or bridge. If the user used an SSID on the allowed SSID list, then the user is allowed to associate to the WLAN. Otherwise, the user is disassociated from the access point or bridge."
"This is configured by enableling the ?[026/009/001] cisco-av-pair? option. On the ACS Server
- Enable and configure Cisco IOS/PIX RADIUS Attribute,
009\001 cisco-av-pair
- Example: ssid=LEAP_WEP"
I've tried this, but regardless of wich SSID the user(-group) has configured, it sill can access all SSID's?
Does anyone have any idea of what I'm doing wrong?
Does this setting only apply to Accesspoint, or is it also valid for the WLC 44xx series?
Greetings
Jarle

Hi I'm sorry but this still does not help.
We have now upgraded ACS to version 4.0 and I'm still having the same problems.
This is what i have configured:
WLC:
- WLAN
- SSID : Public
- WLAN id = 3
- L2 Security : 802.1x
- Interface Name : GuestVLAN
- Controller - Interface
- management - Untagged
- GuestVLAN - VLAN 112
- Security
- RADIUS Servers
When authenticating a Guest(belonging to the proper group in acs) - the right VLAN is used, IP Adresses from DHCP is recieved, and the Guest can access internet.
Switch:
- Port connected to WLC uses Trunking.
- Guests are connected to VLAN 112 and "native VLAN" is used to connect the Private Users.
ACS:
- AAA Client is the WLC, Authenticating using Cisco Airespace
- Guest Users are member of Group 11
- Private Users are member of Group 1
Group 11
- Use Per Group NAR to only allow WLAN Access
- Cisco Airespace RADIUS Attributes
x 14179\001 - Aire-WLAN-ID = 3
- Cisco IOS / PIX RADIUS Attributes
x 009\001 Ciso-av-pair = "ssid=Public"
- IETF Radius Attributes
x 006 Service Type = Login
x 007 Framed-Prot = ppp
x 064 Tunnel-Type = VLAN
x 065 Tunnel-Medium-tye = 802.1x
x 081 Tunnel-Private-Group-ID = 112
Group (default Group)
- Cisco Airespace RADIUS
x 14179\001 Aire-WLAN-ID = 1
- Cisco IOS/PIX Radius Attrib
x 009\001 Cisco-av-pair = "ssid=Private"
- IETF RADIUS
x 008 Service-type = Login
x 064 Tunnel-Type = VLAN
x 065 Tunnel-Medium-tye = 802.1x
x 081 Tunnel-Private-Group-ID = 1
Do you have any idea of what i should change?
Greetings
Jarle

Incompatibility issue - WLC 5508 and ACS 5.4

Hi,
This is my scenario:
Cisco WLC 5508 firmware 7.4.110.20 and ACS 5.4, two WLAN eap/tls, many client can't connect to WLAN and on ACS i receive the following error:
Authentication failed : 11051 RADIUS packet contains invalid state attribute
workaround:
1 -Check the network device or AAA Client for hardware problems.
2-known RADIUS compatibility issues.
3-Check the network that connects the device to ACS for hardware problems
there are some incompatibility issue between WLC and ACS ? the compatibility matrix document for wireless imposes the 7.5 firmware for WLC.
What do you think is possibile ?

Are there any other errors shown in the details of the failed authentication?
We may need to look at service logs in debug mode, opening a TAC case would be the best way to go about this.
Javier Henderson
Cisco Systems

Windows 7 Ultimate (64-Bit) fresh install, only WLAN and video driver installed but EXTREMELY slow internet connection...

I recently checked my internet connection on my Asus G53SW and found that it was extremely slow on both the LAN and WLAN connections. I checked with a different laptop (old HP Pavilion) and I get a steady 74mbps+ connection using the same LAN cable and
also with the WLAN connection. My ISP has checked their side and everything is fine.
To try and resolve the issue I tried uninstalling, disabling and tweaking various software and even tried safe mode with networking, all to no avail. I then decided to do a complete fresh install this afternoon. I have installed Windows 7 Ultimate (64 bit)
successfully onto my SSD and everything went smoothly. I have now only installed Nvidia video drivers and the (only) WLAN driver from the Asus support site.
My WLAN connection remains incredibly slow (amost half what it is on the HP and my MacBook Pro). Clearly this is an issue with either the Asus laptop or Windows but I don't know how to proceed in order to eliminate which it could be other than to try a different
o/s to W7-Ult.
Can anyone help who knows more about this than me? Perhaps someone who has had a similar or the same problem because this is giving me a severe headache!
Thanks in advance to all and for any advice.
<script id="ncoEventScript" type="text/javascript">function DOMContentLoaded(browserID, tabId, isTop, url) { var object = document.getElementById("cosymantecnisbfw"); if(null != object) { object.DOMContentLoaded(browserID,
tabId, isTop, url);} }; function Nav(BrowserID, TabID, isTop, isBool, url) { var object = document.getElementById("cosymantecnisbfw"); if(null != object) object.Nav(BrowserID, TabID, isTop, isBool, url); }; function NavigateComplete(BrowserID, TabID,
isTop, url) { var object = document.getElementById("cosymantecnisbfw"); if(null != object) object.NavigateComplete(BrowserID, TabID, isTop, url); } function Submit(browserID, tabID, target, url) { var object = document.getElementById("cosymantecnisbfw");
if(null != object) object.Submit(browserID, tabID, target, url); }; </script>

Thank you for responding. As I stated in my original post the reason I went through this process was because of an extremely slow internet connection from both the WLAN and LAN connections on my G53SW. At that time I had all of the correct drivers on the
machine. Whilst I would agree that with the machine only having a video and WLAN driver it may well not be working 'optimally', the rationale for doing this was to get the machine working with the minimum of processes to show that it was not anti-virsu software,
Steam or the like causing interference.
I have changed out both of the HDDs this evening (a primary SSD and a secondary 1Tb HDD) for a clean hybrid 1Tb Seagate drive. Once I have installed all of the Asus drivers (and nothing else) I will try the speed test again and report back.
I can now report that with a fresh install of Windows 7 Ultimate SP1 and ONLY Asus drivers as supplied the issue remains. On a connection where I should see around 75mbps I am actually getting around 18mbps, sometimes considerably slower. This only affects
my Asus machine.
<script id="ncoEventScript" type="text/javascript">function DOMContentLoaded(browserID, tabId, isTop, url) { var object = document.getElementById("cosymantecnisbfw"); if(null != object) { object.DOMContentLoaded(browserID,
tabId, isTop, url);} }; function Nav(BrowserID, TabID, isTop, isBool, url) { var object = document.getElementById("cosymantecnisbfw"); if(null != object) object.Nav(BrowserID, TabID, isTop, isBool, url); }; function NavigateComplete(BrowserID, TabID,
isTop, url) { var object = document.getElementById("cosymantecnisbfw"); if(null != object) object.NavigateComplete(BrowserID, TabID, isTop, url); } function Submit(browserID, tabID, target, url) { var object = document.getElementById("cosymantecnisbfw");
if(null != object) object.Submit(browserID, tabID, target, url); }; </script>

I have a dv8t-1000 and the wlan and treble keep going on and off. I loose the wireless connection.

I need to know how to open the laptop to replace the card that controls the wlan and treble. I tried to find a manual to show how to get the laptop open and then be able to get the card number so I can order one. I have removed the screws but can't get it appart. Can you tell me the type of card that I would need to resolve the problem so I don't loose the wireless conection every 5 minutes.
Thanks
highdiver

The Maintenance and Service guide, which you can find here, can show you how to replace your wlan card.
I am an employee of Hewlett Packard.
- - Please mark Accept As Solution if it solves your problem so others can more easily find the answer - -
- - Please click the Kudos star if you would like to say thanks - -

Belle: No WLAN and Packet Data log.Filter options ...

In Nokia N8, with Symbian Anna, WLAN and Packet Data logging wasn't possible, even though there were options in the log filtering settings.
See below:
http://i44.tinypic.com/9kxbfa.png
After updating to Belle, log isn't still working, and both WLAN and Packet Data options were removed from filter options.
http://tinypic.com/r/6dxwgg/5
Will it be implemented in a further time?
Best Regards

Hi,
quick update on this one as we now have a FAQ online.
Q: How can I get a WLAN/Wifi and packet data filter with Nokia Belle?
A: There is no data filter included in Nokia Belle by default, but you can download specific apps from Nokia Store.
BR,
yvonne

802.1x between Switch 3750 and ACS 4.2 Authentication faild --need help

I configured the Switch 3750 and ACS for 802.1x authentication.
when I used the windows as the 802.1x client, it prompted "click here to enter user name and pasword for the network " as normal.
The problem is that after I entered username and password (i am sure i enter the identical username and password as in ACS) the authentication failed,
What is the most possibly problem?
Thx in advance!!!
The configuration is Sw3750 is:
aaa new-model
aaa authentication login default local
aaa authentication enable default line
aaa authentication dot1x default group radius
aaa authorization network default group radius
dot1x system-auth-control
interface GigabitEthernet1/0/18
description Link to test 802.1x
switchport access vlan 119
switchport mode access
dot1x pae authenticator
dot1x port-control auto
spanning-tree portfast
radius-server host 10.1.1.333 auth-port 1645 acct-port 1646
radius-server source-ports 1645-1646
radius-server key keepopen0
In the ACS:
Network Configuration -->aaa client ip address: 10.1.119.1(the vlan 119's ip address), shared secret: keepopen0
user setup -->real name:test1, password: test1.
Attached is the debug information

What do you see in acs failed attempts?

Guest WLAN and Web Auth?

Hi Guys,
Maybe someone can help me out?
I just finished setting up a trial "Cisco Virtual Wireless Controller" with nearly the same configuration as our Physical
"Cisco Wireless Controller" with the exception of having 2 ports. Anyhow, I managed to get everything working except for the WEB AUTH on the Guest WLAN. When a client connects, he gets a DHCP address from our ASA but when we try to get to a website, we never reach the WEB AUTH page.
What I tried so far is..
add a DNS Host Name to the virtual interface and assign it to our internal DNS server.dns name was resolving but we were unable to ping 1.1.1.1
changed the virtual ip from 1.1.1.1 to 2.2.2.2 and modified the DNS entrydns name resoved but still could not ping 2.2.2.2(I think this is normal)
changed the virtual IP to a private address of 192.168.102.1 and modified the dns entrysame result
I've attached some screenshots of our configuration.

Troubleshooting Web Authentication
After you configure web authentication, if the feature does not work as expected, complete these
troubleshooting steps:
Check if the client gets an IP address. If not, users can uncheck
DHCP Required
on the WLAN and
give the wireless client a static IP address. This assumes association with the access point. Refer to
the
IP addressing issues
section of
Troubleshooting Client Issues in the Cisco Unified Wireless
Network for troubleshooting DHCP related issues
1.
On WLC versions earlier than 3.2.150.10, you must manually enter
https://1.1.1.1/login.html
in
order to navigate to the web authentication window.
The next step in the process is DNS resolution of the URL in the web browser. When a WLAN client
connects to a WLAN configured for web authentication, the client obtains an IP address from the
DHCP server. The user opens a web browser and enters a website address. The client then performs
the DNS resolution to obtain the IP address of the website. Now, when the client tries to reach the
website, the WLC intercepts the HTTP Get session of the client and redirects the user to the web
authentication login page.
2.
Therefore, ensure that the client is able to perform DNS resolution for the redirection to work. On
Windows, choose
Start > Run
, enter
CMD
in order to open a command window, and do a nslookup
www.cisco.com" and see if the IP address comes back.
On Macs/Linux: open a terminal window and do a nslookup www.cisco.com" and see if the IP
address comes back.
If you believe the client is not getting DNS resolution, you can either:
Enter either the IP address of the URL (for example, http://www.cisco.com is
http://198.133.219.25)
♦
Try to directly reach the controller's webauth page with
https:///login.html. Typically this is http://1.1.1.1/login.html.
♦
Does entering this URL bring up the web page? If yes, it is most likely a DNS problem. It might also
be a certificate problem. The controller, by default, uses a self−signed certificate and most web
browsers warn against using them.
3.
For web authentication using customized web page, ensure that the HTML code for the customized
web page is appropriate.
You can download a sample Web Authentication script from Cisco Software Downloads. For
example, for the 4400 controllers, choose
Products > Wireless > Wireless LAN Controller >
Standalone Controllers > Cisco 4400 Series Wireless LAN Controllers > Cisco 4404 Wireless
LAN Controller > Software on Chassis > Wireless Lan Controller Web Authentication
Bundle−1.0.1
and download the
webauth_bundle.zip
file.
These parameters are added to the URL when the user's Internet browser is redirected to the
customized login page:
4.
ap_mac The MAC address of the access point to which the wireless user is associated.
♦
switch_url The URL of the controller to which the user credentials should be posted.
♦
redirect The URL to which the user is redirected after authentication is successful.
♦
statusCode The status code returned from the controller's web authentication server.
♦
wlan The WLAN SSID to which the wireless user is associated.
♦
These are the available status codes:
Status Code 1: "You are already logged in. No further action is required on your part."
♦
Status Code 2: "You are not configured to authenticate against web portal. No further action
is required on your part."
♦
Status Code 3: "The username specified cannot be used at this time. Perhaps the username is
already logged into the system?"
♦
Status Code 4: "You have been excluded."
♦
Status Code 5: "The User Name and Password combination you have entered is invalid.
Please try again."
♦
All the files and pictures that need to appear on the Customized web page should be bundled into a
.tar file before uploading to the WLC. Ensure that one of the files included in the tar bundle is
login.html. You receive this error message if you do not include the login.html file:
Refer to the Guidelines for Customized Web Authentication section of Wireless LAN Controller Web
Authentication Configuration Example for more information on how to create a customized web
authentication window.
Note:
Files that are large and files that have long names will result in an extraction error. It is
recommended that pictures are in .jpg format.
5.
Internet Explorer 6.0 SP1 or later is the browser recommended for the use of web authentication.
Other browsers may or may not work.
6.
Ensure that the
Scripting
option is not blocked on the client browser as the customized web page on
the WLC is basically an HTML script. On IE 6.0, this is disabled by default for security purposes.
7.
Note:
The Pop Up blocker needs to be disabled on the browser if you have configured any Pop Up
messages for the user.
Note:
If you browse to an
https
site, redirection does not work. Refer to Cisco bug ID CSCar04580
(registered customers only) for more information.
If you have a
host name
configured for the
virtual interface
of the WLC, make sure that the DNS
resolution is available for the host name of the virtual interface.
Note:
Navigate to the
Controller > Interfaces
menu from the WLC GUI in order to assign a
DNS
hostname
to the virtual interface.
8.
Sometimes the firewall installed on the client computer blocks the web authentication login page.
Disable the firewall before you try to access the login page. The firewall can be enabled again once
the web authentication is completed.
9.
Topology/solution firewall can be placed between the client and web−auth server, which depends on
the network. As for each network design/solution implemented, the end user should make sure these
ports are allowed on the network firewall.
Protocol
Port
HTTP/HTTPS Traffic
TCP port 80/443
CAPWAP Data/Control Traffic
UDP port 5247/5246
LWAPP Data/Control Traffic
(before rel 5.0)
UDP port 12222/12223
EOIP packets
IP protocol 97
Mobility
UDP port 16666 (non
secured) UDP port 16667
(secured IPSEC tunnel)
10.
For web authentication to occur, the client should first associate to the appropriate WLAN on the
WLC. Navigate to the
Monitor > Clients
menu on the WLC GUI in order to see if the client is
associated to the WLC. Check if the client has a valid IP address.
11.
Disable the Proxy Settings on the client browser until web authentication is completed.
12.
The default web authentication method is PAP. Ensure that PAP authentication is allowed on the
RADIUS server for this to work. In order to check the status of client authentication, check the
debugs and log messages from the RADIUS server. You can use the
debug aaa all
command on the
WLC to view the debugs from the RADIUS server.
13.
Update the hardware driver on the computer to the latest code from manufacturer's website.
14.
Verify settings in the supplicant (program on laptop).
15.
When you use the Windows Zero Config supplicant built into Windows:
Verify user has latest patches installed.
♦
Run debugs on supplicant.
♦
16.
On the client, turn on the EAPOL (WPA+WPA2) and RASTLS logs from a command window, Start
> Run > CMD:
netsh ras set tracing eapol enable
netsh ras set tracing rastls enable
In order to disable the logs, run the same command but replace enable with disable. For XP, all logs
will be located in C:\Windows\tracing.
17.
If you still have no login web page, collect and analyze this output from a single client:
debug client
debug dhcp message enable
18.
debug aaa all enable
debug dot1x aaa enable
debug mobility handoff enable
If the issue is not resolved after you complete these steps, collect these debugs and use the TAC
Service Request Tool (registered customers only) in order to open a Service Request.
debug pm ssh−appgw enable
debug pm ssh−tcp enable
debug pm rules enable
debug emweb server enable
debug pm ssh−engine enable packet

Using Active Directory and ACS for Concentrator 3000 VPN

Has anyone gone down the path of using Cisco ACS for network access control AND authenticating it with their W2K Active Directory for VPN 3000 concentrators? I did some research on Google, Cisco web, and this group, I did not find a definite answer on the best practice for the architecture and design, can anyone share your experience how you approached this?
Below is my understanding, I appeciate any help to piece some or all the below together
(1) The end state is once a VPN user is successfully authenticated, it is assigned to certain network access privilege based on its group's policy. How to accomplish this?
(2) AD stores a central user database for user authentication. Each user may belong to one or more groups on the AD; ACS is reponsible for network access control for the specific groups and enforces these controls to the users via the concentrators.
(3) Concentrator is the NAS, and ACS is the RADIUS server
http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00800949b4.shtml
(4) Concentrator can link to the AD as an external database: http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/4_1/gs/gs3mgr.htm
(5) A single "Tunnel Group" is created on the concentrator
(6) Mulpile Groups, per corporate infosec policies are created on the AD
(7) Mulpile Groups, per corporate infosec policies are also created on ACS, need to match with what're in the AD
TIA.

In order to restrict access for a specific AD group to specific SSID this is what you need to perform.
When the WLC sends an authentication request to the ACS, it will include the SSID that the user is connecting to, in the attribute Calling-Station-Id(31). We can use this information to create multiple rules in ACS 5.x in order to take actions based on the information contained in the attribute.
Under the Users and Indetity Stores > click on Directory Groups > select > check the group name you want to add and hit ok. Save the changes.
We just need to create a DNIS rule that includes the name of the SSID and use it as a condition in any rule that we create for authentication. The * is required because the attribute not only contains the SSID but also a MAC address so the * is use as a regular expression.
Now go to access-policies > default-network access > identity should be AD1.
Go to authorization > click on customize > move the AD1:ExternalGroups and end-station filter attribute on the right side and hit ok.
After that slect the appropriate ad group for teachers and end-station filter.
Save changes.
Jatin Katyal
- Do rate helpful posts -

How to create guest access in wireless by WISM and WCS and ACS?

dear sir
i neeed to know the steps of how we can make guest access to our network like hotels by using our WISM v 7.0.220 and wireless control system and ACS ?

You need to define your requirements a little bit. The WLC can do WebAuth and an employee can access either the WLC or WCS to put in the username and password credentials, but you would need to figure out what's best for you.
Here is a support doc that you can reference.
https://supportforums.cisco.com/docs/DOC-13954
Sent from Cisco Technical Support iPhone App

GPS not available only WLAN and Basestations

Hello,
in my iPhone 4s GPS is not available, only WLAN and Basestations are used to show location on Maps. On my iPhone 4 everything works fine. Both on iOS 6.0.1
Device already reseted.
What else do I have to do.
Best regards
Reiner

I've had limited success using G spot (App from the Apple store) which seems to find my location by using my WIFI which is also registered with Skyhook and then using it to launch maps. Even though G spot works, google maps still doesn't locate me, but luckily G spot will place a pin drop on your location within maps at the touch of a button.
Thus this may be a workaround for now. G spot also seems seems to work with my wifi off, but I don't know if it's just using a cache of my last known location. I haven't tested in places aside from my flat yet, but will do so very shortly and I will report back whether using a third party app, such as G spot works at obtaining your location which can then be feed into google maps.
Gspot is not free (though it's not expensive). Luckily I had it due to the compass it provides. However one can test whether 3rd party apps work for you or not in obtaining your location for free by downloading either of the 'here i am' apps from iTunes and having it email your location to yourself and then opening the link from the email, which launches maps and pin drops your location. Though this will not provide live GPS on the 3G, but it will atleast give you a general location and a map if you're lost until Apple sorts out their ****!

Guest WLAN and a Office WLAN on 1242AG

Hi All,
I have managed to add two WLANS, one for the Office Wireless clients(Staff laptops) and another one for Guests. I have bassicaly created two SSIDs, one broadcasting, other one not(Staff one).
The AP is a 1242AG and is going to connect to a Catalyst 3750 48T, which is connected to Cisco 877. How can I make the DHCP assignments to both Guest WLAN and Staff WLAN and also do I have to create trunk port in the Switch ( I am thinking like this as I got Two VLANs.)
Does anyone know or got a sample running config ( in a Switch and in a similar AP)...really appriciate it. Time is running out for me!!!
Reg
ND

Hi,
here is a config example for exactly you are looking for:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080665ceb.shtml.
HTH,
Tiago

Vista x64 drivers for Broadcom BCM4311 wlan and touchpad

Hello!
Where to download a Vista x64 driver for a Broadcom BCM4311 wlan and touchpad for a Lenovo 3000 G410m-mm? A Windows update wlan driver allows a two times slower speed.
Regards,
Dmitry

Try this.
//help will save the world

No wlan and bluetooth after recovery

WLAN and Bluetooth is lost after I took my ipod touch through a receovery procedure

Here is Apple's article for that symptom. You may end up making an appointment at the Genius Bar of an Apple store since sometime the steps do not fix the problem.
Unable to use Wi-Fi or Bluetooth with iPhone or iPod touch because there's no address listed for the device

Wlan and ACS

Similar Messages

Maybe you are looking for