topic Re: Ask the Experts: Configuring, Troubleshooting and Monitoring in Wireless

Ask the Experts: Configuring, Troubleshooting and Monitoring Wireless Security Policies with Saravanan Lakshmanan

ciscomoderator — Sun, 04 Jul 2021 06:51:27 GMT

With Saravanan Lakshmanan

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about how to monitor, troubleshoot and configure Wireless Networks using Security Protection Policies. It includes Rogue Detection, Rogue Location Discovery Protocol (RLDP), Rogue Detector, Rogue Rules, wireless intrusion detection services (wIDS), Rogue Containment, AP Authentication, client exclusion features that touches Mobility, RF grouping from wireless LAN controller.

Saravanan Lakshmanan is a Customer Support Engineer in Cisco's Technical Assistance Center (TAC) specializing in Wireless Technologies. He is an expert in debugging and troubleshooting Cisco Wireless LAN Controllers (WLANs), wireless LAN services, unified access points, wireless LAN security, autonomous APs, VoWifi, authentication authorization accounting (AAA), and radio frequency (RF). Lakshmanan helps solve high severity and critical wireless issues for Cisco's customers and partners.

Remember to use the rating system to let Saravanan know if you have received an adequate response.

Saravanan might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Wireless sub-community Security and Network Management shortly after the event. This event lasts through Friday April 19, 2013. Visit this forum often to view responses to your questions and the questions of other community members.

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

Saravanan Lakshmanan — Mon, 08 Apr 2013 07:07:44 GMT

Adding doc link for reference:

Rogue AP:

Rogue Management in a Unified Wireless Network

http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080b40901.shtml

Rogue Detection under Unified Wireless Networks

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a0080722d8c.shtml

Rule Based Rogue Classification in Wireless LAN Controllers (WLC) and Wireless Control System (WCS)

http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080ad6b8d.shtml

Classifying Rogue Access Points

http://www.cisco.com/en/US/docs/wireless/controller/7.4/configuration/guides/security_solution/config_security_chapter_010100.html

Managing Rogue Devices

http://www.cisco.com/en/US/docs/wireless/controller/7.4/configuration/guides/security_solution/config_security_chapter_010011.html

Trusted AP Policies on a Wireless LAN Controller

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a0080921cc2.shtml

wIDS:

Configuring IDS Signatures

http://www.cisco.com/en/US/docs/wireless/controller/7.3/configuration/guide/b_wlc-cg_chapter_0110.html#d115989e11090a1635

AP Authentication:

Infrastructure Management Frame Protection (MFP) with WLC and LAP Configuration Example

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008080dc8c.shtml

Configuring Management Frame Protection

http://www.cisco.com/en/US/docs/wireless/controller/7.3/configuration/guide/b_wlc-cg_chapter_0110.html#d115989e7135a1635

Configuring Client Exclusion Policies

http://www.cisco.com/en/US/docs/wireless/controller/7.3/configuration/guide/b_wlc-cg_chapter_0110.html#d115989e7541a1635

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

Robert1478 — Mon, 08 Apr 2013 20:27:12 GMT

Hello Saravanan

trying to find rogue on wire using rldp technique but unable to find so far. how long does it take the trigger to detect, using linksys ap as rogue. just like the doc mentioned having similar setup. enabled those rldp debugs but no glimpse of the wlc finding rogue on wire.

Thanks

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

Saravanan Lakshmanan — Mon, 08 Apr 2013 22:43:15 GMT

Hi Robert, what's the wlc code, AP model used, if possible share the debug output.

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

Robert1478 — Mon, 08 Apr 2013 23:32:44 GMT

5500 running 7.0.240.0, 3500 on local. linksys using open auth, getting debug

Re: Ask the Experts: Configuring, Troubleshooting and Monitoring

Saravanan Lakshmanan — Mon, 08 Apr 2013 23:36:18 GMT

unsure if debug not showing anything or getting debug output with no reference to find rogue on wire.

be sure to run this on wlc.

(Cisco Controller) > debug dot11 rldp enable

what's the config on security>> wps>> general>> Rogue Location Discovery Protocol >> drop down. Since you're using local mode ap for rldp, it should be selected as "All APs" option. there is no option to say local mode/monitor/mesh/hreap mode AP only. it has to be either monitor for monitor mode only and AllAPs for the rest of the AP modes or it can be disabled.

Re: Ask the Experts: Configuring, Troubleshooting and Monitoring

Robert1478 — Mon, 08 Apr 2013 23:52:01 GMT

wow!! thanks started working when set to all

would like to excercise rogue detector feature

Re: Ask the Experts: Configuring, Troubleshooting and Monitoring

Robert1478 — Tue, 09 Apr 2013 01:23:54 GMT

3500 as RD and monitor ap, been long enough and couldn't find wire rogue flag enabled on controller

this time guess got everything right. debug showing got wired mac and sure cisco seeing the linksys. power cycling linksys to force arp

Re: Ask the Experts: Configuring, Troubleshooting and Monitoring

Saravanan Lakshmanan — Tue, 09 Apr 2013 02:07:25 GMT

Well, unfortunatlely there are two bugs with Rogue Detector feature, use the code that has fix on it.

Rogue AP detection on wire fails if radio mac is +/- 1 of ethernet mac

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCub75472

Fixed-In 7.4(100.0).

Cant find rogue on wire, if rogue ap on non native vlan of RD's trunk

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCue09354

Fixed-In 7.4MR(yet to release).

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

black.robber — Wed, 10 Apr 2013 18:19:28 GMT

hi everyone is there any one would like to help me

i got following situation

how to share router one fastethernet port (e.g fa0/0) with different network addresses(e.g 192.168.1.1 and 192.168.2.1 and 192.168.3.1) when using them as a gateway using RIP or static routing?

any one please help me..

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

Saravanan Lakshmanan — Wed, 10 Apr 2013 18:48:32 GMT

Hi Muhammad

Please post your question to LAN - Switching, Routing section.

https://supportforums.cisco.com/community/netpro/network-infrastructure/switching?view=discussions

Thanks

Saravanan

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

jmprats — Thu, 11 Apr 2013 07:02:47 GMT

Hello,

What am I supposed to do with unclassified rogue AP?

I understand that if they don't look a thread I can mark them as "Friendly External" to no receive more alarms about them. Is it ok?

The problem is what happens if this external Friendly AP change the SSID for a Managed SSID (an SSID is using our controller). Then, this AP is a threat, but is not longer detected for the controller as Malicious

Is it a bug?

or am I not managing unclassified Rogue correctly?

Thanks

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

goncalo.girao — Thu, 11 Apr 2013 19:52:10 GMT

Hi there,

I have installed about 2 days ago one Cisco WCS 2504 and 11 APs. Everything is doing well regarding to WPA authentication. But I have a Radius Server that is also running with some issues on wireless:

- Unless I open network settings and click connect on that config I cannot obtain a valid IP Address;

- Roaming is not working also;

I'm still getting issues regarding Radius;

- WPA2 Wlan still ok (144Mbit), but dont know when roaming works (how can I know/change these settings?);

- Radius autenticated with 802.11 Data Encryption on 40 bits Key size connects always at 54Mbps (g) and auto authenticate but dont know when roaming works (how can I know/change these settings?);

- Radius with 802.11 Data Encryption with none key size, doesnt authenticate connects 144Mbit but doesnt acquire IP Address

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

Saravanan Lakshmanan — Thu, 11 Apr 2013 22:52:20 GMT

What am I supposed to do with unclassified rogue AP?

//You can classify them using rogue rules. Ex: Managed ssid, any AP that are not joined to WLC and broadcasting your ssid will be classified under the rogue rule.

I understand that if they don't look a thread I can mark them as "Friendly External" to no receive more alarms about them. Is it ok?

//Yes, if it found to be legitimate AP then mark it is Friendly.

//Mostly, have seen deployment that admin configure the SSID that's not similar to their neighbor, However have seen giving common name like 'wallstreet' for ex: and later they change it to different one for their guest wlan. So there is intentional and accidental, if its your neighbor company you can always talk to their admin about it.

Is it a bug?

//No.

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

Saravanan Lakshmanan — Thu, 11 Apr 2013 22:59:57 GMT

Get debug client output when the wireless client seeing the issue.

WLC>debug client

If the client doesn't get an ip then it can't join wlc and success roaming is not possible.

To achieve N datarate using N AP and Client follow this doc:

Configure 802.11n on the WLC

http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080a3443f.shtml

802.11n requires AES encryption to be enabled on WLANs used by 802.11n clients. You can use a WLAN with NONE as Layer 2 Security. However, if you configure any Layer 2 security, 802.11n requires WPA2 AES enabled to operate at 11n rates. Ensure that WMM is set to Allowed on the WLAN profile in order to achieve 802.11n rates.

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

Robert1478 — Thu, 11 Apr 2013 23:10:11 GMT

Thank you.

are rldp scalable to work across mobility tunnel. both wlc1 & 2 added as mobility member with tunnels up, wired mac found on wlc1 and wireless mac identified by wlc2, with rldp enabled on both wlc.

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

goncalo.girao — Thu, 11 Apr 2013 23:28:34 GMT

Saravanan Lakshmanan wrote:

Get debug client output when the wireless client seeing the issue.

WLC>debug client

GG -> Cant do it right now, not at the office.

If the client doesn't get an ip then it can't join wlc and success roaming is not possible.

GG-> I'm only not getting valid IP Address when the key is set to none (see attch image)

To achieve N datarate using N AP and Client follow this doc:

Configure 802.11n on the WLC

http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080a3443f.shtml

GG-> WMM is set to Allowed. I'm using Mac os X Free open radius. Not sure how can I see encryption Type.

Ask the Experts: Configuring, Troubleshooting and Monitoring Wir

goncalo.girao — Fri, 12 Apr 2013 08:33:17 GMT

*apfReceiveTask: Apr 12 10:26:06.994: mac_address_client apfMsExpireMobileStation (apf_ms.c:5009) Changing state for mobile mac_address_client on AP f0:29:29:xx:xx:xx from Associated to Disassociated

*apfReceiveTask: Apr 12 10:26:06.994: mac_address_client Scheduling deletion of Mobile Station: (callerId: 45) in 10 seconds

*apfMsConnTask_7: Apr 12 10:26:12.114: mac_address_client Reassociation received from mobile on AP f0:29:29:a9:16:20

*apfMsConnTask_7: Apr 12 10:26:12.114: mac_address_client 192.168.3.200 8021X_REQD (3) Changing ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1626)

*apfMsConnTask_7: Apr 12 10:26:12.114: mac_address_client Applying site-specific IPv6 override for station mac_address_client - vapId 2, site 'default-group', interface 'management'

*apfMsConnTask_7: Apr 12 10:26:12.114: mac_address_client Applying IPv6 Interface Policy for station mac_address_client - vlan 0, interface id 0, interface 'management'

*apfMsConnTask_7: Apr 12 10:26:12.114: mac_address_client STA - rates (8): 130 132 139 150 36 48 72 108 12 18 24 96 0 0 0 0

*apfMsConnTask_7: Apr 12 10:26:12.114: mac_address_client STA - rates (12): 130 132 139 150 36 48 72 108 12 18 24 96 0 0 0 0

*apfMsConnTask_7: Apr 12 10:26:12.114: mac_address_client 192.168.3.200 8021X_REQD (3) Deleted mobile LWAPP rule on AP [f0:29:29:a9:1e:50]

*apfMsConnTask_7: Apr 12 10:26:12.114: mac_address_client Updated location for station old AP f0:29:29:a9:1e:50-0, new AP f0:29:29:a9:16:20-0

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client 192.168.3.200 8021X_REQD (3) Initializing policy

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client 192.168.3.200 8021X_REQD (3) Change state to AUTHCHECK (2) last state RUN (20)

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client 192.168.3.200 AUTHCHECK (2) Change state to 8021X_REQD (3) last state RUN (20)

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client 192.168.3.200 8021X_REQD (3) DHCP required on AP f0:29:29:a9:16:20 vapId 2 apVapId 2for this client

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client Not Using WMM Compliance code qosCap 00

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client 192.168.3.200 8021X_REQD (3) Plumbed mobile LWAPP rule on AP f0:29:29:a9:16:20 vapId 2 apVapId 2

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client apfMsAssoStateInc

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client apfPemAddUser2 (apf_policy.c:223) Changing state for mobile mac_address_client on AP f0:29:29:a9:16:20 from Disassociated to Associated

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client Stopping deletion of Mobile Station: (callerId: 48)

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client Sending Assoc Response to station on BSSID f0:29:29:a9:16:20 (status 0) ApVapId 2 Slot 0

*apfMsConnTask_7: Apr 12 10:26:12.115: mac_address_client apfProcessAssocReq (apf_80211.c:5237) Changing state for mobile mac_address_client on AP f0:29:29:xx:xx:xx from Associated to Associated

*dot1xMsgTask: Apr 12 10:26:12.118: mac_address_client Station mac_address_client setting dot1x reauth timeout = 1800

*dot1xMsgTask: Apr 12 10:26:12.118: mac_address_client dot1x - moving mobile mac_address_client into Connecting state

*dot1xMsgTask: Apr 12 10:26:12.118: mac_address_client Sending EAP-Request/Identity to mobile mac_address_client (EAP Id 1)

*osapiBsnTimer: Apr 12 10:26:41.994: mac_address_client 802.1x 'txWhen' Timer expired for station mac_address_client and for message = M0

*dot1xMsgTask: Apr 12 10:26:41.994: mac_address_client dot1x - moving mobile mac_address_client into Connecting state

*dot1xMsgTask: Apr 12 10:26:41.994: mac_address_client Sending EAP-Request/Identity to mobile mac_address_client (EAP Id

Re: Ask the Experts: Configuring, Troubleshooting and Monitoring

Saravanan Lakshmanan — Tue, 16 Apr 2013 01:05:34 GMT

Please attach complete debug output to a file, this one not showing why client couldn't connect back to the roamed AP.

Re: Ask the Experts: Configuring, Troubleshooting and Monitoring

goncalo.girao — Tue, 16 Apr 2013 06:07:55 GMT

Everything ok. Was the encription has you said. Ty

Sent from Cisco Technical Support iPhone App