topic I configured the switch via in Wireless

5508 WLC config: can't access GUI on management int

raul saurez — Mon, 05 Jul 2021 08:58:54 GMT

I am trying configure a second WLC in my east building that mirrors my North incase the North goes down, traffic can revert to the East. The North is working perfectly and is set up as such.. WLC connected to Switch, Switch connected to Firewall with all the necessary permissions from our security team.

I have the east setup the same and received access from the secuirity team. I can ping the east but when I try to access from the browser it wont let me and then I can no longer ping for maybe another 2 hours than the cycle starts over. I attached the config of the east and north switches also a snip of the north WLC. The only difference in the east is that it is 192.168.199.18. the rest of the config is identical. What am I missing here?? any help will be greatly appreciated.

By default HTTP/HTTPS access

Leo Laohoo — Wed, 19 Nov 2014 20:55:18 GMT

If I remembered correctly, by default, HTTPS access to the WLC is DISABLED.

See what happens if you enter the command "config network webmode enable".

Thank you for your reply. Yes

raul saurez — Wed, 19 Nov 2014 21:12:10 GMT

Thank you for your reply. Yes it is enabled. Still no luck.

Ok, if don't have access via

Leo Laohoo — Wed, 19 Nov 2014 21:46:03 GMT

Ok, if don't have access via the web, how did you access the switch? Is it via console or telnet/SSH?

I configured the switch via

raul saurez — Wed, 19 Nov 2014 22:01:05 GMT

I configured the switch via console. so any changes are via console. But i occasionally can ping from my desktop which is on the otherside of the Firewall but when I attempt to access the browser it wont connect and I can no longer ping. time out

Ok, so if you've configured

Leo Laohoo — Wed, 19 Nov 2014 22:10:20 GMT

Ok, so if you've configured everything via console the you'll need to check if the uplink should be on an access port or Trunk link. If you've configured access port, make sure the link to the switch is on the correct VLAN and the VLAN is present in the VLAN database.

Ok. I am using vlan 1 default

raul saurez — Thu, 20 Nov 2014 14:43:24 GMT

Ok. I am using vlan 1 default. It is on that Vlan so everything is correct in that aspect. I have tried both access and trunk with no success. I am just puzzled at this point..

I think you have some

Rasika Nayanajith — Thu, 20 Nov 2014 22:30:52 GMT

I think you have some connectivity issues,

I noticed two switches have different default (199.1 & 199.2) gateway for the same vlan.

Would you be able to draw a logical topology of your devices connectivity ?

HTH

Rasika

*** Pls rate all useful responses ****

Looking at the file called

Leo Laohoo — Thu, 20 Nov 2014 23:30:14 GMT

Looking at the file called "east_wlc.txt" I am seeing that the port is "untagged" or access port.

Post the interface configuration of your switch port connected to your WLC DP. Also post the output to the command "sh interface <PORT>".

So you can ping the WLC

marc.groenen — Fri, 21 Nov 2014 10:28:51 GMT

So you can ping the WLC occasionally ? I would look deeper in to this perhaps duplicate IP's on youre network ?

I checked for duplicate IP

raul saurez — Fri, 21 Nov 2014 16:56:46 GMT

I checked for duplicate IP and that is not the issue. The .1 is north FW and .2 is the East FW. The two switches are connected now but this issue existed before I connected the switches with fiber. Yes it is untagged just like the north but the north is working perfect. The north sw is set to dynamic on port connected to WLC and to the FW. Weird right? But I did try tagging the WLC to the vlan and trunking the port on sw connected to the WLC but still the same thing for both options. It pings from my PC but when I try to access the browser its no good then I loose the ping for hours and eventually comes back.

Now I removed the FW from the equation this morning and connected my laptop to the sw and I am finally able to access the GUI! The security team told me that the firewall rules where identical to the norths so I would be good but could this be the FW not allowing me to access the GUI??

ps. Sorry about my bad diagram skills...was trying to be quick about it

Keep in mind this is how the north is configured as well
Interface g1/0/1 connected to WLC
Interface g1/0/27 connected to FW

bri-200e-guest-wlc#sho int g1/0/1 status

Port Name Status Vlan Duplex Speed Type
Gi1/0/1 CONNECTION TO GUES connected 1 a-full a-1000 10/100/1000BaseTX
bri-200e-guest-wlc#sho int g1/0/1 switchport
Name: Gi1/0/1
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: static access
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001

Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled

Voice VLAN: none (Inactive)sho i
Appliance trust: 0
bri-200n-guest-wlc#sho int g1/0/1 switchport ?
| Output modifiers

bri-200e-guest-wlc#sho int g1/0/27 switchport
Name: Gi1/0/27
Switchport: Enable dping
Administrative Mode: dynamic auto
Operational Mode: static access
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001

Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled

I checked for duplicate IP

raul saurez — Mon, 24 Nov 2014 14:09:58 GMT

ps. Sorry about my bad diagram skills...was trying to be quick about it

Keep in mind this is how the north is configured as well
Interface g1/0/1 connected to WLC
Interface g1/0/27 connected to FW

bri-200e-guest-wlc#sho int g1/0/1 status

Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled

Voice VLAN: none (Inactive)sho i
Appliance trust: 0
bri-200n-guest-wlc#sho int g1/0/1 switchport ?
| Output modifiers

Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled

The security team told me

Leo Laohoo — Mon, 24 Nov 2014 22:31:55 GMT

The security team told me that the firewall rules where identical to the norths so I would be good but could this be the FW not allowing me to access the GUI??

Sounds like an ARP issue.

I am going to take a very, very, very long shot here but in your network, do you happen to have this command "no ip cef optimize neighbor resolution" anywhere?

Thank you all for your help.

raul saurez — Tue, 25 Nov 2014 15:51:10 GMT

Thank you all for your help. You have been very helpful. I started from scratch and everything is working. not sure what I did wrong cause I configured it the same way but I clearly did something wrong. THANK YOU AGAIN!!!