WLAN controller redundancy over IP VPN

Customer currently has a Cisco 5500 WLAN controller at one of our datacenters. They want to add a WLAN controller as redundancy at their local site which shall be used as a secondary failover controller. This site is reachable over VPN. Which redundancy options do I have here? As i understand with HA functions the controllers has to be within the same L2 network and have low latency. Is my only option here to manually configure a new controller, buy double the AP licenses and copy the config from the old one? And if the first fail the APs would need to reboot and reassociate with the secondary controller?
Would be really greatful if someone could point me in the right direction :)

You have a few options ..
1. Buy two fully licensed controllers. One primary one secondary and configure as such.
2. HA N+1 where you buy one fully licensed controller and one HA controller or a controller with a minimum of 50 licenses. Put the secondary controller into ha mode and it will go to max licenses.
http://www.cisco.com/c/en/us/td/docs/wireless/technology/hi_avail/N1_High_Availability_Deployment_Guide/Licensing.html
3. APSSO AND CLIENT SSO this is where you need layer 2. There is a data base that syncs between the
http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/7-5/High_Availability_DG.pdf

Similar Messages

WLAN controller redundancy

We have a site with 3 controllers it's serveral miles between them. And have think about to deploy a N+1 solution. My question is if the controllers must have same RF group. I know they must have same mobility group!. Can you have several mobilty groups on one controller?

Hi Klas,
Have a look at this good doc for RRM Management. Hopefully this will clear things up;
In a scenario where multiple controllers are configured with the same RF Group Name, but their respective APs cannot hear each other's neighbor messages, two separate, top-level RF Groups are formed.
RF Grouping happens at the controller level. This means that once APs report information to their controllers on the other APs they hear, and the controllers to which those APs are connected, each respective WLC communicates directly with the other WLCs to form a system-wide grouping. Within a single system-wide group, or RF Group, many subsets of APs can have their RF parameters set independently of each other. For instance, consider a scenario where one central WLC has individual APs at remote sites. In this case, each AP has its RF parameters set separately of the others. While each AP belongs to the same controller RF Grouping, each individual AP in this example is in its own logical RF sub-Group.
APs each compile and maintain a list of up to 34 neighboring APs per radio. This list is then reported up to their respective controllers. Each WLC maintains a list of 24 neighbors per AP radio from the neighbor messages sent by each AP. Once at the controller level, this per-AP, per-radio neighbor list of up to 34 APs is pruned. The ten APs with the weakest signals are dropped. WLCs then forward each AP neighbor list up to the RF Group Leader, the WLC elected by the RF Group in order to perform all RRM configuration decision-making.
From this good doc;
Radio Resource Management under Unified Wireless Networks
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a008072c759.shtml
These are the Group settings available through the WLC GUI:
Group Mode The Group Mode setting allows RF Grouping to be disabled. When this feature is disabled, the WLC cannot group with other controllers in order to perform system-wide RRM functionality. Disabled, all RRM features are implemented locally on each controller. RF Grouping is enabled by default and the MAC addresses of other WLCs in the same RF Group are listed to the right of the Group Mode checkbox.
Group Update Interval The group update interval value indicates how often the RF Grouping algorithm is run. This is a display-only field and cannot be modified.
Group Leader This field displays the MAC Address of the WLC that is currently the RF Group Leader. Because RF Grouping is performed per-AP, per-radio, this value can be different for the 802.11a and 802.11b/g networks.
Is this controller a Group Leader When the controller is the RF Group Leader, the value of this field is yes. If the WLC is not the leader, the previous field indicates which WLC in the group is the leader.
Last Group Update The RF Grouping algorithm runs every 600 seconds (ten minutes). This field only indicates the time (in seconds) since the algorithm last ran and not necessarily the last time a new RF Group Leader was elected.
Hope this helps!
Rob
Please remember to rate helpful posts.....

Communication between : AP and WLAN controller

Hi,
The communication between AP and WLAN Controller is ( Data and Control ) UDP.
Source port 1024 and destination port 12222 and 12223. Actually which device listen to which port or both should listen as control and data can be generated from both the devices.
How does the user ( wireless client) traffic is switched - if user traffic is a TCP traffic. It will be sent to WLANC and then WLANC forwards it to respective VLAN or default gateway ( depending upon the destination in the packet ).
Please explain / share the experience.
any link on cisco.com
Thanka in advance
Subodh

"the LWAPP Control and Data messages are encapsulated in UDP packets that are carried over the IP network. The only requirement is established IP connectivity between the access points and the WLC. The LWAPP tunnel uses the access point's IP address and the WLC's AP Manager interface IP address as endpoints. The AP Manager interface is explained in further detail in the
implementation section. On the access point side, both LWAPP Control and Data messages use an ephemeral port that is derived from a hash of the access point MAC address as the UDP port. On the WLC side, LWAPP Data messages always use UDP port 12222. On the WLC side, LWAPP Control messages always use UDP port 12223.
The mechanics and sequencing of Layer 3 LWAPP are similar to Layer 2 LWAPP except that the packets are carried in UDP packets instead of being encapsulated in Ethernet frames."
Taken from "Cisco 440X Series Wireless LAN Controllers Deployment Guide"

WLC Redundancy over L3 link

Hi All,
Is it possible to deploy WLC redundancy over L3 link???
In our scenario we have 2 controllers located in 2 different sites, the link between the site is L3. AP's are deployed across four other locations, two are coming to site 1 and rest two are coming to site 2 . How can i make redundancy on this setup , Please advice
Controller is 4404 and AP's are 1231G series .
Regards
Aslam ...

What is your link between each site? Also, I suppose your ap's are running in H-REAP mode? If you don't have enough bandwidth, then you shouldn't try it. You can always try to move the ap's to either wlc and see if users have any issues or not, before you try to deploy redundancy in this matter.

Single WLAN Controller Limitations

Aside from redundancy, are there any other limitations to deploying a single Cisco 5508 WLAN Controller that I should be aware of? The configuration guide states you need multiple controllers for the following:
A multiple-controller system has the following additional features:
•Autodetecting and autoconfiguring RF parameters as the controllers are added to the network.
•Same-subnet (Layer 2) roaming and inter-subnet (Layer 3) roaming.
•Automatic access point failover to any redundant controller with a reduced
Is it true you can't have those roaming capabilities with a single controller?

No... You have all those except for redundancy.
Sent from my iPhone

WLAN Controller Required?

Currently developing a solution to convert simple Windows wired domain to wireless.
Considering using ten Aironet 1100 APs for 200 Windows XP clients on a single network/domain. Clients will authenticate using certificates with RADIUS (IAS) over EAP-TLS. Each Aironet will support 20 clients and will be wired back to the RADIUS server.
What Cisco software is required on the 1100s and what WLAN controller (if any) is required?
Thanks!

If you plan on using the Cisco Unified Wireless Solution, you would require a controller. Different models supports different number of AP's. For 10 Ap's which would be required in your place, a 4402 controller which supports 12 AP's should be a good choice.
The AP's download the code from the controller and hence just need a recovery image. The controller would come preloaded with the software required and you can upgrade to th latest code. Please refer toe the documentation below.
http://cisco.com/en/US/prod/collateral/wireless/ps5678/ps6521/product_at_a_glance0900aecd805df476.pdf
Pushkar

WLAN controller 4400 series, use service-port for initial configuration, IP address?

Hi, Everyone,
I just got a new Cisco Wlan controller 4402 from somebody else but I can't find a suitable console cable( DB-9 console on the controller) , I googled everywhere and I read I could use service port to do the initial configuration, the CISCO FAQ says initial IP for service port is 192.168.1.1, I tried use Cross-over cable to connect a PC to the service port directly and use a normal cable with a switch to connect the service port and a PC, both of the connections do not work out: from the PC, I can't ping 192.168.1.1 ( PC IP changed to 192.168.1.20) , nor can I go http://192.168.1.1 . The service port Link is solid GREEN and ACT is solid GREEN, the PC NIC says Connected with 100 Mbps , so I'm wondering the IP address of service port is not 192.168.1.1? Please help.
Any sussgestions and advices are greatly appreciated.

Hi,
plz connect service port to the switch port that should be configured as access.
connect a pc (ip address - as u mentioned) to the other port of the switch. both wlc and pc should be in same vlan (create a temperary vlan).
try https to access the wlc.
Thanks

Wlan controller connections

I have two options when connecting wlan controller 4404:
1) to a 2600 router (outside internal lan)
2) to a 2900 catalyst (inside lan)
Which one should I take as the best one ?

By default, controllers block Telnet sessions. You must use a local connection to the serial port to enable Telnet sessions.
direct ASCII serial connection to the controller console port
A remote console session over Ethernet through the pre-configured Service Port or through Distribution System Ports
Before you log into the CLI, configure your connectivity and environment variables based on the type of connection you use

WLAN Controller can configure as ACTIVE-ACTIVE

Customer is looking for two numbers WLAN Controller (AIR-AP1242AG-E-K9). And they want to configure as ACTIVE-ACTIVE. I would like to know whether it can be configuring as ACTIVE-ACTIVE.
And Is really require WLAN Controller for AIR-AP1242AG-E-K9 access point ? or it can be configure without WLAN controller ?
Please revert me ASAP
Regards,
Manoj

Hi Manoj,
Although WLC Controllers can be configured in an Active-Active type redundancy, you don't need the WLC for small deployments. The AIR-AP1242AG-E-K9 access point can be setup in Autonomous or Stand-alone mode as well :)
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points 12.3(7)JA
http://www.cisco.com/en/US/docs/wireless/access_point/12.3_7_JA/configuration/guide/i1237sc.html
Cisco Aironet 1200 Series Access Point Hardware Installation Guide
http://www.cisco.com/en/US/docs/wireless/access_point/1200/installation/guide/1200-TD-Book-Wrapper.html
Hope this helps!
Rob

Troubleshooting RPC issue over ASA VPN

Hello,
I have a IPSec VPN Tunnel between my corporate data center and a satellite service provider. I also have 2 trucks, A & B, with networks on them. These truck networks communicate via satellite to the provider base station, and then across the VPN tunnel to our corp. data center. The A & B truck networks each have a Windows Domain Controller that communicates to our DCs in the data center, for Active Directory replication. They are using RPC for this.
Both truck networks and servers were tested and worked perfectly when first tested and deployed.
ASA 5510 running IOS ver 8.2(1)
About a month ago, truck B lost it's ability to communicate via RPC to the DCs in the data center. Nothing has changed on the network on my side as well as the satellite provider side. I've looked through my VPN logs and firewall logs, but don't see anything that indicates a probable cause. There is no evidence of requests being denied on my firewall, and the VPN ACLS.
The one strange thing I've noticed when doing some tests is that I don't see interesting traffic hitting the ACL on the ASA when trying to PING or traceroute from the truck B server, or when the RPC request is being run. BTW, the truck B server can PING and traceroute over the VPN tunnel to servers in the data center just fine. And the reverse it also true. Just the RPC doesn't work.
Here's the RPC error output:
NtFrsApi Version Information
   NtFrsApi Major      : 0
   NtFrsApi Minor      : 0
   NtFrsApi Compiled on: Feb 16 2007 20:10:33
ERROR - Cannot RPC to computer, odyssey; 00000721 (1825)
Below is a traceroute from the truck B server to the data center server. Notice the multiple entries for server accord?
I seem to remember that this kind of behavior occurs whent an IP Address is being Natted. Is that correct?
Any suggestions are greatly appreciated.

Thanks Pranesh,
I haven't checked IPsec tunnel but I assumed that since I get successful connection to the VPN tunnel, the tunnel is up. I have very limited knowledge about this; still learning the basics for CCNA certification.    The wiered thing is when I swap out ASA-5505 with home netgear router (at home), I don't have any problem accessing inside network at the temple. Therefore, my assumption is something is wrong on my ASA-5505 config at home (the confg is pasted in intitial post.). Please advise.
Again thank yo so much for your help.

How can I see shared review comments in a PDF when connected to a SharePoint server over a VPN?

I am using Acrobat Pro XI on Windows 7.
When I issue a shared review, hosted on our work SharePoint server, I always encounter problems when accessing my work network from home, over a VPN. My comments do not get published, and I cannot see comments that reviewers have published.
I issue the review PDF as an attachment when I open the review, and all reviewers save a local copy of this file. When I open the PDF, the "Welcome back to shared review..." screen is never updated with the number of comments. The server status always seems to show green, but the comment reporting mechanisms do not behave as they do at work. When I click Publish comments, I am usually asked if I wish to take ownership of unpublished comments by other reviewers (to which I click No). When I return to the office, everything seems to "just work" again. But this is hugely inconvenient if I am out of office for days on end.
I had this problem with my previous version of Acrobat, and no satisfactory solution was ever reached. I am most dismayed to find it is still present in version XI.
Please can anyone advise?

I don't know if you solved this issue yet. But we have the same issue in the pass, and clean the log files under "\Synchronizer\resources\" folder seems to be a solution. Here is the thread talking about it.
https://forums.adobe.com/thread/1426298?start=0&tstart=0

AIR-LAP1310G-E-K9 acces point not joining to 5508 wlan controller

Hi,
I have Cisco AIR-LAP1310G-E-K9 access point and 5508 wlan controller with version 7.0.220 and it is joining to the WLAN controller. I have enabled dhcp in the lan controller and i dont have external dns server. How to fix this issue? Can this LAN controller version will support this access point?
My Lan Controller Management IP Address is 10.10.10.5
Please find the below configuration of 1300 access point.
AP001d.4513.dd68#reload
Proceed with reload? [confirm]
%SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload Command.
%LWAPP-5-CHANGED: LWAPP changed state to DOWNXmodem file system is available.
flashfs[0]: 4 files, 2 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 7741440
flashfs[0]: Bytes used: 2052608
flashfs[0]: Bytes available: 5688832
flashfs[0]: flashfs fsck took 14 seconds.
Base ethernet MAC Address: 00:1d:45:13:dd:68
Initializing ethernet port 0...
Reset ethernet port 0...
Reset done!
ethernet link up, 100 mbps, full-duplex
Ethernet port 0 initialized: link is up
Unable to get our ip address: no "IP_ADDR" variable set
The system has been encountered and error initializing
tftp file system. The system is ignoring the error and
continuing boot. If you interrupt the system boot process,
the following commands will set IP_ADDR, DEFAULT_ROUTER
and NETMASK environment variables, initializing tftp file
system, and finish loading the operating system software:
    set IP_ADDR
    set DEFAULT_ROUTER
    set NETMASK
    tftp_init
    boot
Loading "flash:/c1310-rcvk9w8-mx/c1310-rcvk9w8-mx"...############################################################################################################################################################################################
File "flash:/c1310-rcvk9w8-mx/c1310-rcvk9w8-mx" uncompressed and installed, entry point: 0x3000
executing...
              Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706
Cisco IOS Software, C1310 Software (C1310-RCVK9W8-M), Version 12.4(10b)JA3, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Wed 19-Mar-08 19:09 by prod_rel_team
Image text-base: 0x00003000, data-base: 0x003BE9E0
Initializing flashfs...
flashfs[1]: 4 files, 2 directories
flashfs[1]: 0 orphaned files, 0 orphaned directories
flashfs[1]: Total bytes: 7741440
flashfs[1]: Bytes used: 2052608
flashfs[1]: Bytes available: 5688832
flashfs[1]: flashfs fsck took 2 seconds.
flashfs[1]: Initialization complete....done Initializing flashfs.
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
[email protected].
cisco AIR-LAP1310G-E-K9R   (PowerPCElvis) processor (revision A0) with 24566K/8192K bytes of memory.
Processor board ID FHK1133E002
PowerPCElvis CPU at 262Mhz, revision number 0x0950
Last reset from reload
LWAPP image version 3.0.51.0
1 FastEthernet interface
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:1D:45:13:DD:68
Part Number                          : 73-8960-09
PCA Assembly Number                  : 800-24963-06
PCA Revision Number                  : A0
PCB Serial Number                    : FOC113000V7
Top Assembly Part Number             : 800-28479-05
Top Assembly Serial Number           : FHK1133E002
Top Revision Number                  : B0
Product/Model Number                 : AIR-LAP1310G-E-K9R
The name for the keys will be: ap.cisco.com
% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
ip ssh version 2
    ^
% Invalid input detected at '^' marker.
transport input ssh
                 ^
% Invalid input detected at '^' marker.
aaa new-model
^
% Invalid input detected at '^' marker.
aaa authentication login default enable local none
^
% Invalid input detected at '^' marker.
o
^
% Invalid input detected at '^' marker.
Press RETURN to get started!
*Mar 1 00:00:05.442: %LINK-3-UPDOWN: Interface FastEthernet0, changed state to up
*Mar 1 00:00:06.473: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to up
*Mar 1 00:00:07.817: %SYS-5-RESTART: System restarted --
Cisco IOS Software, C1310 Software (C1310-RCVK9W8-M), Version 12.4(10b)JA3, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Wed 19-Mar-08 19:09 by prod_rel_team
Translating "CISCO-LWAPP-CONTROLLER"...domain server (255.255.255.255)
transport input ssh
                 ^
% Invalid input detected at '^' marker.
*Mar 1 00:00:33.860: %LWAPP-3-CLIENTEVENTLOG: Performing DNS resolution for CISCO-LWAPP-CONTROLLER
*Mar 1 00:00:33.860: %LWAPP-3-CLIENTERRORLOG: DNS Name Lookup: could not resolve CISCO-LWAPP-CONTROLLER
*Mar 1 00:00:33.861: %LWAPP-5-CHANGED: LWAPP changed state to DISCOVERY
logging origin-id string AP:001d.4513.dd68
         ^
% Invalid input detected at '^' marker.
logging 255.255.255.255
        ^
% Invalid input detected at '^' marker.
logging trap 3
        ^
% Invalid input detected at '^' marker.
*Mar 1 00:00:37.440: Logging LWAPP message to 255.255.255.255.
AP001d.4513.dd68>
%LWAPP-3-CLIENTEVENTLOG: Forcing AP to obtain IP address using DHCP
%DHCP-6-ADDRESS_ASSIGN: Interface FastEthernet0 assigned DHCP address 10.10.10.46, mask 255.255.255.0, hostname AP001d.4513.dd68
Translating "CISCO-LWAPP-CONTROLLER.CISCO-LWAPP-CONTROLLER.mydomain.com"...domain server (10.10.10.5)
%LWAPP-3-CLIENTEVENTLOG: Did not get vendor specific options from DHCP.
%LWAPP-3-CLIENTEVENTLOG: Did not get log server settings from DHCP.
%LWAPP-3-CLIENTEVENTLOG: Performing DNS resolution for CISCO-LWAPP-CONTROLLER.CISCO-LWAPP-CONTROLLER.mydomain.com
%LWAPP-3-CLIENTERRORLOG: DNS Name Lookup: could not resolve CISCO-LWAPP-CONTROLLER.CISCO-LWAPP-CONTROLLER.mydomain.com
AP001d.4513.dd68>

Your debug is very telling ..
AP001d.4513.dd68>
%LWAPP-3-CLIENTEVENTLOG: Forcing AP to obtain IP address using DHCP
%DHCP-6-ADDRESS_ASSIGN: Interface FastEthernet0 assigned DHCP address 10.10.10.46, mask 255.255.255.0, hostname AP001d.4513.dd68
Translating "CISCO-LWAPP-CONTROLLER.CISCO-LWAPP-CONTROLLER.mydomain.com"...domain server (10.10.10.5)
%LWAPP-3-CLIENTEVENTLOG: Did not get vendor specific options from DHCP.
%LWAPP-3-CLIENTEVENTLOG: Did not get log server settings from DHCP.
%LWAPP-3-CLIENTEVENTLOG: Performing DNS resolution for CISCO-LWAPP-CONTROLLER.CISCO-LWAPP-CONTROLLER.mydomain.com
%LWAPP-3-CLIENTERRORLOG: DNS Name Lookup: could not resolve CISCO-LWAPP-CONTROLLER.CISCO-LWAPP-CONTROLLER.mydomain.com
AP001d.4513.dd68>
What are you using to tell the AP where the contoller lives ? Since you are consoled into the ap you can use the -> capwap ap controller ip address
This will point the ap to your controller
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Is it OK to have two SBS Servers with same name, on different subnets but connected over a VPN?

Hi Everyone,
I'm just about to connect up two SBS 2011 Servers with the same server name but on different subnets & domains over a VPN.
So for example both servers will have the name Server01, one would have an ip address of 192.168.85.5, the other 192.168.86.5, they both then would be connected over a VPN.
Can anyone foresee any issues with this configuration, like DNS & DHCP requests, adding new machines to the domain, mapping drives etc.
Many thanks,
Nick

Hi Larry & Strike First,
Thank you for your responses. I understand that this is an unusual situation. Basically I've recently taken over the IT support for this client. The client has just had a new phone system installed
& are asking if they can speak to each office internally, which can easily be done once I setup the VPN.
However I noticed whilst looking at this further that the Server names are the same, hence my question?
Am I right in saying that providing the workstations have a trust relationship with their own domain controllers through their individual domains on separate subnets, that hopefully there shouldn't be any DNS issues between the two domains and Servers?
I could build a new VM if you feel it would be better practice to do so?
Many thanks for your assistance,
Nick

How can I copy a PSK from one WLAN Controller to another

I'm trying to replace a WLAN controller with a new one. One WLAN is configured with WPA-PSK. Nobody seems to know the key that was used.
Anyone know if there is a way to extract the encrypted key out of a controller and put it into the new WLAN Controller?
Thanks in advance.

No can do ...
https://supportforums.cisco.com/discussion/11364566/view-psks-wlans-wlc
However, if any users are on a MAC Book and has iCloud enabled you can see the key under the "keys". If you have a windows 7 box and uses the native supplicant you can expose the key on the supplicant ..

WAP4410N Access point and 4404 WLAN Controller.

Hello to all,
I am planning to setup a new WLAN using WAP4410N Wireless N Access Point. Is it possible to manage the AP using 4404 WLAN controller ?
I need to buy arround 42 AP for covering the entire building.
Regards,
Aslam

leolaohoo
Could u please tell me which series can be used with 4404 WLANC ?
Also the AP Should support Bridging or Mesh.

WLAN controller redundancy over IP VPN

Similar Messages

Maybe you are looking for