Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About andrew.brazier
08-01-2018
andrew.brazier
Member since
04-15-2005
Enthusiast
Created by
andrew.brazier
in Wireless and Mobility
in Wireless and Mobility
08-15-2011
02:44 AM
08-15-2011
02:44 AM
We have a customer who wants a wireless bridge/mesh link between two buildings. They want as much throughput as possible, better than 802.11b/g 54Mb for preference. We've identified Cisoc 1552E or I APs as suitable devices but we can't tell from the literature what sort of bandwidth we can expect over the backhaul link, will it use 802.11n speeds or are we stuck with b/g data rates? Any advice would be much appreciated.
... View more
Labels:
Created by
andrew.brazier
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
06-21-2011
07:00 AM
06-21-2011
07:00 AM
External User Database, Database Configuration, Windows Database, Configure. Scroll down to Windows EAP settings and check the "Enable machine access restrictions". It looks like I was slightly incorrect when I said a machine that is blocked by MAR has no access, if the user credentials are valid but the machine would be blocked by MAR then access can be granted by using the Group Map.... drop down to select an ACS group. The access the user then gets is controlled by the access permissions of that group so you should be able to make it pretty granular ad have it so an authenticated user on an authenticated machine = full access, authenticated user on an MAR-blocked machine = limited access. It is also possible to create machine accounts in Windows AD for machines that don't normally have one such as Apple MACs, this then allows them to pass the MAR check. From the ACS help system: Aging time (hours)—The number of hours that Cisco Secure ACS caches a successful machine authentication. For as long as successful machine authentication is retained in the cache, the machine access restrictions feature can use it to determine whether to limit a user to the group specified in the group mapping list, below. Group map for successful user authentication without machine authentication—When the machine access restrictions feature is enabled, this list specifies the user group whose authorizations are applied to an EAP-TLS or Microsoft PEAP user who passes authentication but uses a computer that failed machine authentication.
... View more
Created by
andrew.brazier
in Policy and Access
in Policy and Access
06-21-2011
05:56 AM
06-21-2011
05:56 AM
Good plan, you can get a free trial cert from RapidSSL which will let you test their certs before you buy.
... View more
Created by
andrew.brazier
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
06-21-2011
05:54 AM
06-21-2011
05:54 AM
If you enable PEAP authentication non-domain PCs can authenticate to the network provided they have the correct root cert installed (if you buy a cert from most providers this shouldn't be a problem). Enabling MAR will prevent PCs that are not domain members from authenticating to the network, period.
... View more
06-17-2011
05:22 AM
Max logging: System Configuration, Logging, make sure CSV Failed...., CSV Passed....., CSV RADIUS.... are checked. If not click the log name to enable and make sure the "Log to CSV XXXX" tick box is checked. While there, make sure the relevant logging features are in the Logged Attributes column. If you've done this and nothing appears in the logs it's likely the RADIUS requests from the APC cards aren't reaching the ACS. You could try using the alternative RADIUS ports 1812/1813 or 1645/1646. The other option is to use Wireshark to capture the packets leaving the APC cards and see if it's actually sending any RADIUS requests and if so where they are going. I don't have any example configs for this setup but the above steps should help you identify where it's failing.
... View more
Created by
andrew.brazier
in Policy and Access
in Policy and Access
06-17-2011
03:06 AM
06-17-2011
03:06 AM
Have you tried an alternative SSL provider? I've used RapidSSL for certs on an ACS with no problems: www.rapidssl.com Also, there's a CSR validation tool at this website that you can check to see if your CSR is OK: http://www.sslshopper.com/ssl-certificate-tools.html
... View more
06-17-2011
03:02 AM
I don't think there is a way of getting CLI access on an ACS appliance. If you're not seeing any activity in the ACS logs from your APC cards then either you need to enable more detailed logging on the ACS applicance or the RADIUS requests from the APC cards aren't reaching the ACS applicance. Are there any firewalls, etc between the two devices that might be blocking RADIUS packets?
... View more
Created by
andrew.brazier
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
06-14-2011
07:36 AM
06-14-2011
07:36 AM
One way round this is to enable Machiine Access Restrictions. This will prevent any device that does not have a Windows Domain machine account (non-domain laptops, iPhones, iPads, etc) from authenticating even if it has a valid certificate and user credentials. You can enable this under the External Databases, Windows User Database Configuration. It's a tick box in the Windows EAP Settings section.
... View more
06-10-2011
05:16 AM
You need to install an SSL certificate on the WLC. See the Cisco Wireless LAN Controller Configuration Guide (download from here: http://www.cisco.com/en/US/docs/wireless/controller/6.0/configuration/guide/Controller60CG.html ) Pages 2-18 - 2-20. You will need to create a CSR using a third party tool as there is no facility for this on the WLC itself. You can get a simple tool for this from Digicert: https://www.digicert.com/util/ Once you have your CSR you can obtain a certificate and install it.
... View more
Created by
andrew.brazier
in Wireless and Mobility
in Wireless and Mobility
06-10-2011
05:08 AM
06-10-2011
05:08 AM
Hi, If it's for guest access the SSL123 should be fine. You can also get suitable certificates from RapidSSL (www.rapidssl.com) and they're cheaper than Thawte.
... View more
Created by
andrew.brazier
in IP Telephony and Phones
in IP Telephony and Phones
05-25-2011
06:34 AM
05-25-2011
06:34 AM
I'm trying to install certificates on some CCM7 servers to stop the "certificate warning" messages that you get when browsing to the admin pages. I generated a CSR and submitted it to the CA, got a response and have tried to import/upload it but this fails with the following error: Unable to initialize, java.io.IOException: extra data given to DerValue constructor Can anyone shed any light on this? Also, does CCM 7 support certificates with a 2048 bit key size?
... View more
Labels:
05-17-2011
07:33 AM
I'm working on an RTMT configuration to report alerts on 4 separate CCM clusters. I can get emails from some of the clusters but not others. I've requested our corporate Exchange team to allow SMTP relaying for the publisher in each cluster, do I need to get them to allow relaying for the subscribers as well? I can't find anything in the documentation that explicitly says so although it does seem reasonable, can anyone confirm?
... View more
Labels:
Created by
andrew.brazier
in Wireless and Mobility
in Wireless and Mobility
05-17-2011
05:02 AM
05-17-2011
05:02 AM
The easiest way to deply this is with a Microsoft toolkit, it has everything you need included, manuals, scripts to install and configure server-side components and it's very easy to use. You can get it from here: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=60c5d0a1-9820-480e-aa38-63485eca8b9b&displaylang=en It's based on Win2003 server but I've been advised by MS that it should be OK on Win2008 as well.
... View more
Created by
andrew.brazier
in IP Telephony and Phones
in IP Telephony and Phones
04-22-2011
01:24 AM
04-22-2011
01:24 AM
Hi Craig, Thanks for the tip, RTMT seems able to tell me that a file failed to copy which is a small improvement over the syslog messages as Iat least get a status check for the CCM 6 cluster as well as the CCM 7 ones. Ideally what I'd like is a proper backup tool for CCM, one that does GFS archiving with full logging and notification functions. I can dream. : )
... View more
04-19-2011
04:53 AM
If you've bought LAPs you will need a WLC or they won't work. I believe you can convert them to IOS APs but I think you need a WLC to do so (it holds the IOS image that the APs will upload). Either way, you either need to order IOS based APs or a controller.
... View more
Created by
andrew.brazier
in Wireless and Mobility
08-15-2011 02:44 AM
08-15-2011 02:44 AM
We have a customer who wants a wireless bridge/mesh link between two
buildings. They want as much th...
Created by
andrew.brazier
in Other Wireless - Mobility Subjects
06-21-2011 07:00 AM
06-21-2011 07:00 AM
External User Database, Database Configuration, Windows Database,
Configure. Scroll down to Windows ...
Created by
andrew.brazier
in Policy and Access
06-21-2011 05:56 AM
06-21-2011 05:56 AM
Good plan, you can get a free trial cert from RapidSSL which will let
you test their certs before yo...
Created by
andrew.brazier
in Other Wireless - Mobility Subjects
06-21-2011 05:54 AM
06-21-2011 05:54 AM
If you enable PEAP authentication non-domain PCs can authenticate to the
network provided they have ...
06-17-2011 05:22 AM
Max logging: System Configuration, Logging, make sure CSV Failed....,
CSV Passed....., CSV RADIUS......
Created by
andrew.brazier
in Policy and Access
06-17-2011 03:06 AM
06-17-2011 03:06 AM
Have you tried an alternative SSL provider? I've used RapidSSL for certs
on an ACS with no problems:...
06-17-2011 03:02 AM
I don't think there is a way of getting CLI access on an ACS appliance.
If you're not seeing any act...
Created by
andrew.brazier
in Other Wireless - Mobility Subjects
06-14-2011 07:36 AM
06-14-2011 07:36 AM
One way round this is to enable Machiine Access Restrictions. This will
prevent any device that does...
06-10-2011 05:16 AM
You need to install an SSL certificate on the WLC. See the Cisco
Wireless LAN Controller Configurati...
Created by
andrew.brazier
in Wireless and Mobility
06-10-2011 05:08 AM
06-10-2011 05:08 AM
Hi,If it's for guest access the SSL123 should be fine. You can also get
suitable certificates from R...
05-25-2011 06:34 AM
I'm trying to install certificates on some CCM7 servers to stop the
"certificate warning" messages t...
05-17-2011 07:33 AM
I'm working on an RTMT configuration to report alerts on 4 separate CCM
clusters. I can get emails f...
Created by
andrew.brazier
in Wireless and Mobility
05-17-2011 05:02 AM
05-17-2011 05:02 AM
The easiest way to deply this is with a Microsoft toolkit, it has
everything you need included, manu...
Created by
andrew.brazier
in IP Telephony and Phones
04-22-2011 01:24 AM
04-22-2011 01:24 AM
Hi Craig,Thanks for the tip, RTMT seems able to tell me that a file
failed to copy which is a small ...
Public Statistics
| Date Registered | 04-15-2005 07:24 AM |
| Date Last Visited | 08-01-2018 02:27 AM |
| Total Messages Posted | 269 |
| Total Helpful Votes Received | 90 |
Helpful Votes From
