topic Cisco WLC 5508 WebGui and SSH not available in routed network in Wireless

Cisco WLC 5508 WebGui and SSH not available in routed network

markus.bock — Mon, 05 Jul 2021 18:30:32 GMT

Hello,

we have moved internal vlan routing from core switch to cisco asa.

Since the routing is moved I cannot access the web gui and ssh of our wireless controller 5508 over the management interface which is placed in another vlan where my client is.

I can ping it and in the internal firewall (ASA5545X) in the log a SSL or SSH session has been created successfully. But in my webbrowser is shown that the webinterface is not reachable.

When I put my client in the management VLAN where the wlan controller is pleaced in, I can access the controller via web or ssh.

Does anybody know a solution for this?

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

Mark Elsen — Wed, 08 Jan 2020 11:59:15 GMT

- Well clearly you need to review the ASA policy so that the client can get access to the management VLAN and or the controller-only if you want to narrow things down. All routing tables should be correct too.

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

Jaderson Pessoa — Wed, 08 Jan 2020 12:06:09 GMT

Well,

If just trough ASA it doesnt work.. certainly it is a policy that need be reviewed.

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

markus.bock — Wed, 08 Jan 2020 12:30:59 GMT

I have tried it with an ANY rule but it still does not work.

In the management vlan i have several switches and the access is working via https and ssh.

Routing should be ok because I got response via icmp and the gateway is correctly configured on the wlc.

I have configured the service ports on the wlc cluster and I can access the service ports, which are configured in other vlans too, without problem. But I need webGUI access on the management interface

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

Jaderson Pessoa — Wed, 08 Jan 2020 12:35:26 GMT

please, share here the configuration of wlc.

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

markus.bock — Wed, 08 Jan 2020 12:54:00 GMT

Here is the config

Thanks and kind regards

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

Jaderson Pessoa — Wed, 08 Jan 2020 13:13:57 GMT

config interface address management 192.168.0.120 255.255.0.0 192.168.0.1 this is the management network used to access your controller.

if you is connected directly to this network, works.. right? but when you want access it trough an other network using your ASA, it doesn't work, right?

share asa configuration here... please.

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

markus.bock — Wed, 08 Jan 2020 13:18:20 GMT

Yes, 192.168.0.120 is the management IP Address

It could not be a problem or config missmatch on the asa because all Switches in 192.168.0.0 network using the same gateway and access via https and ssh is working.

The problem must be by the controller because I have enabled telnet and it does not work too.

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

Jaderson Pessoa — Wed, 08 Jan 2020 13:37:51 GMT

well.. i cant see any problem in your wlc configuration.. if you can post asa configuration.. certainly it will help us.

from controller, please... ping it own gateway 192.168.0.1 and trace route to a device from where you are trying accesst web gui.

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

markus.bock — Wed, 08 Jan 2020 13:41:52 GMT

In the screenshot attached you can see from asa log the successful https connection to the controller

Ping and traceroute are shown correctly. Same like a traceroute to a switch

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

markus.bock — Wed, 08 Jan 2020 13:44:22 GMT

I can ping the gateway from controller cli.

But when I do a ping to another network, the controller uses his service ports ip address

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

Scott Fella — Wed, 08 Jan 2020 15:07:42 GMT

The service port should not be connected to the network. If it is connected to the network, then there should be no routing between the service port and the management interface of the controller. It does seem like the issue is with the asa as that was the only change.

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

Jaderson Pessoa — Wed, 08 Jan 2020 16:06:46 GMT

you need put your service port in other network "non routeable" or different network from your corporate network. as our friend said @Scott Fella

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

patoberli — Fri, 10 Jan 2020 15:12:41 GMT

If all of this doesn't help, you don't do any NAT on the ASA, right?

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

David Ritter — Fri, 10 Jan 2020 22:06:22 GMT

Where, how do you create that version of the 5508 config?

All I get from mine with a show run-config looks more like this:

(Cisco Controller) >show run-config no-ap

Press Enter to continue...

System Inventory
NAME: "Chassis" , DESCR: "Cisco 5500 Series Wireless LAN Controller"
PID: AIR-CT5508-K9, VID: V02, SN: FCW1549L0GL

Burned-in MAC Address............................ CC:EF:48:B3:D5:20
Power Supply 1................................... Present, OK
Power Supply 2................................... Present, OK
Maximum number of APs supported.................. 500
Press Enter to continue or <ctrl-z> to abort

System Information
Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 8.5.151.0
Bootloader Version............................... 1.0.20
Field Recovery Image Version..................... 7.6.101.1
Firmware Version................................. FPGA 1.7, Env 1.8, USB console 2.2
OUI File Last Update Time........................ Sun Sep 07 10:44:07 IST 2014

Build Type....................................... DATA + WPS

System Name...................................... NAClab
System Location.................................. GP DC R10-28
System Contact...................................
System ObjectID.................................. 1.3.6.1.4.1.9.1.1069
Redundancy Mode.................................. Disabled
IP Address....................................... 172.22.10.15
IPv6 Address..................................... ::
Last Reset....................................... Software reset
System Up Time................................... 22 days 1 hrs 7 mins 11 secs
System Timezone Location......................... (GMT -8:00) Pacific Time (US and Canada)

--More or (q)uit current module or <ctrl-z> to abort
System Stats Realtime Interval................... 5
System Stats Normal Interval..................... 180

Configured Country............................... US - United States
Operating Environment............................ Commercial (0 to 40 C)
Internal Temp Alarm Limits....................... 0 to 65 C
Internal Temperature............................. +34 C
External Temperature............................. +18 C
Fan Status....................................... OK

State of 802.11b Network......................... Enabled
State of 802.11a Network......................... Enabled
Number of WLANs.................................. 14
Number of Active Clients......................... 0

OUI Classification Failure Count................. 121

Memory Current Usage............................. 50
Memory Average Usage............................. 50
CPU Current Usage................................ 0
CPU Average Usage................................ 0

Flash Type....................................... Compact Flash Card

--More or (q)uit current module or <ctrl-z> to abort

I did not see a Service Port or virtual interface entry.

and the management port ip a /16 spans all the other interface addresses.

Re: Cisco WLC 5508 WebGui and SSH not available in routed network

markus.bock — Sat, 11 Jan 2020 19:45:25 GMT

As far as I know it is not possible to put the service port into the same network as the management port.

My service port is in a different network and I do no NAT between the networks