Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Tiago Antunes
04-29-2019
Stats
Member since
03-16-2008
475
Posts
1131
Helpful
95
Solutions
06-03-2016
12:11 AM
Bom dia Christopher ,
Sim é possível, basta ativar a opção "https redirection" em Management -» HTTP-HTTPs.
Cumps,
Tiago
... View more
06-02-2016
12:38 AM
Ola Marcelo!
Em Local Web Authentication, o SSID é configurado com segurança de Nível 3 no WLC e será o WLC a apresentar a página de login ou a redireccionar para um URL externo predefinido no WLC. O utilizador recebe a página de login, e as credenciais são verificadas pelo WLC utilizando a base de dados local, ou externa usando RADIUS ou LDAP.
Em Central Web Authentication, o SSID é configurado com segurança de Nível 2 no WLC, utilizando Mac Filtering e Radius NAC. Quando o utilizador se liga na rede wireless, o WLC envia o endereço MAC da máquina do utilizador para o ISE e o ISE retorna um endereço e ACL de redireccionamento para o WLC applicar à máquina do utilizador. O utilizador fará de seguida o login na página de login do ISE, e após autenticação bem sucedida, o ISE enviará RADIUS CoA (Change of Authorization) para o WLC permitindo a ligação do utilizador.
Cumps,
Tiago
... View more
Created by
Tiago Antunes
in Wireless
in Wireless
04-12-2016
06:48 AM
04-12-2016
06:48 AM
Nos dias que correm a maioria de empresas possuem uma rede wireless e desejam permitir acesso a visitantes. Neste sentido surgiu o modelo the Central Web Authentication onde qualquer visitante pode ligar o seu dispositivo pessoal a rede Wireless e obter uma pagina de login central num servidor RADIUS onde se autenticara com as credencias de visitante.
Neste "Pergunte ao Especialista", o Tiago estará respondendo as perguntas relacionadas com CWA com WLC e ISE.
Faça suas perguntas de segunda-feira, 23 de Maio a sexta-feira 03 de Junho de 2016
Especialista em Destaque
Tiago Antunes é Engenheiro de supporte na equipa do TAC Wireless da Europa. É formado em Engenharia Electrotecnica e das TeleComunicações pelo Instituto Politecnico de Castelo Branco e possui as seguintes certificações: CCIE R&S e CCIE Wireless.
Tiago pode não ser capaz de responder a cada pergunta, devido ao volume esperado durante este evento. Lembre-se que você pode esclarecer suas dúvidas também em nossa sub-comunidade de Wireless.
** Classificações incentivam a participação! ** Por favor assegurar-se de classificar as respostas as perguntas!
... View more
- Tags:
- CWA;WLC;ISE
Labels:
06-18-2011
01:02 AM
Ok, so you had missed to include the VLAN 5 in the allowed VLANs of the trunk? Please note that in this kind of setup when you have multiple VLANs in an interface, it is a trunk and only the allowed VLANs are able to pass traffic through it. I am not sure what you mean by "dot1 with a different IP address when I put a PC in August vlan vlan works"...? BR, Tiago
... View more
Created by
Tiago Antunes
in Wireless and Mobility
in Wireless and Mobility
06-17-2011
06:46 AM
06-17-2011
06:46 AM
Indeed, AP config looks ok so most likely the VLAN 5 is not allowed in the trunk... Can you check the switchport configuration or share it with us and we can check. BR, Tiago
... View more
Created by
Tiago Antunes
in Wireless and Mobility
in Wireless and Mobility
06-17-2011
02:35 AM
06-17-2011
02:35 AM
Hi, Can you send us the complete sh run from the AP and the switch where the AP is connected? Where is the DHCP server located? Do you have a DHCP pool created for the VLAN assigned to the SSID testing? If you connect a PC in the switch and place the switchport in the same VLAN, does it get IP address? HTH, Tiago -- If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.
... View more
CISCO Aironet accesspoint - not able to...
in Wireless and Mobility
06-16-2011
08:18 AM
06-16-2011
08:18 AM
Hi, From those logs, we can see that your SSID requires authentication and this authentication is against a RADIUS server which is configured on the AP with RADIUS server ip address 20.33.100.11. However, this RADIUS server is not replying to the RADIUS Access-Request packets that the AP is sending. So after 5 tries, the AP gives up and reports that the authentication is failed. I would check if the RADIUS server is running and if properly configured to accept connections from this AP. HTH, Tiago -- If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.
... View more
06-16-2011
08:12 AM
Hi, Can you please be more clear with "not working"? What exactly is not working? What do you see in the SSIDs that work that you do not see in the SSID that does not work? Which one does "not work"? The configuration you attached is not complete... however in the dot11 radio configuration i can see: ssid CISCO_2.4GHZ_Guest ! ssid CISCO2.4GHZ_Private ! ssid CISCO_2.4GHZ_Study ! ssid CISCO_2.4GHZ_Testing Shouldn't it be "ssid CISCO_2.4GHZ_Private" instead of "ssid CISCO2.4GHZ_Private"? Please note the missing underscore compared with the other SSIDs. HTH, Tiago -- If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.
... View more
Created by
Tiago Antunes
in Wireless Security and Network Management
in Wireless Security and Network Management
06-16-2011
08:07 AM
06-16-2011
08:07 AM
Hi Wagas, Can you please clarify exactly what will be the relation with NAc and the Wireless network? Do you which to make the wireless users to go through NAC before accessing the network? Are you looking for an InBand or Out Of Band setup? I would advise you to take a look into this chapter of the configuration guide where you can see a comparison between the diferent kinds of deployemnts for Wireless NAC: http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/48/cam/m_woob.html#wp1040103 . HTH, Tiago -- If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.
... View more
Created by
Tiago Antunes
in Other Security Subjects
in Other Security Subjects
06-07-2011
11:07 PM
06-07-2011
11:07 PM
Hi Bryan, From the log messages: 2011-06-06 09:37:21.832 -0400 ERROR com.perfigo.wlan.jmx.adsso.GSSServer - Unable to start server ... Password has expired - change password to reset (23) It looks like the password has expired... I would check if indeed the password has expired, or simply change the passowrd, mark the checkbox to "password never expires" and re-run ktpass. HTH, Tiago -- If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.
... View more
06-03-2011
12:13 AM
Hi Bruce, I am afraid there are some arguments missing in your db command. To manually add the OID of Cat4507R+E to CAM's database here is the procedure to do this. [root@cca-3140-cam ~]# psql -h localhost -U postgres controlsmartdb -c "INSERT INTO supported_switch VALUES ('1.3.6.1.4.1.9.1.1286', '4', 'Cisco Catalyst 4507 R+E')" INSERT 0 1 psql: warning: extra command-line argument "INSERT" ignored psql: warning: extra command-line argument "0" ignored psql: warning: extra command-line argument "1" ignored INSERT 0 1 Then to make sure it is there: [root@cca-3140-cam ~]# psql -h localhost -U postgres controlsmartdb -c "SELECT * FROM supported_switch" | grep 1286 The output should be: 1.3.6.1.4.1.9.1.1286 | 4 | Cisco Catalyst 4507 R+E Restart perfigo service on NAC Manager and try to manage the switch using the model used by the above command. HTH, Tiago -- If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.
... View more
Created by
Tiago Antunes
in Other Security Subjects
in Other Security Subjects
06-01-2011
11:05 PM
06-01-2011
11:05 PM
Hi Bruce, Thanks for your post. 4507E switches is already supported as we can see in Table 11 "Supported Cisco Catalyst 4000/4500 Switches". So you should not need to do any DB change... We surelly can help you but i kindly ask you to create a new discussion out of this one which is meant for AD SSO setups. When creating the new discussion, please let us know what exactly happens when you are trying to add the switch to the CAM. What error messages you get and what is the switch and CAM snmp configuration. Thanks, Tiago
... View more
Created by
Tiago Antunes
in Policy and Access
in Policy and Access
04-20-2011
04:46 AM
04-20-2011
04:46 AM
Hi, Well, the failed attempts and auth ok are for different users... So I am not sure what is the relation between these different users, but one thing for sure is that the "badcrew" either does not exist in the External DB or you are entering the worng password... HTH, Tiago
... View more
Created by
Tiago Antunes
in Policy and Access
in Policy and Access
04-20-2011
03:51 AM
04-20-2011
03:51 AM
Hi, It would be great if you could post the real csv files here, both of them to verify the timestamps. BR, Tiago
... View more
Created by
Tiago Antunes
in Other Security Subjects
in Other Security Subjects
04-20-2011
01:33 AM
04-20-2011
01:33 AM
Hi again, The troubleshooting tips i gave you are the ones you should follow. With the sniffer traces (and not those cli outputs) you will be sure if the DHCP packets are or not on the untrusted/trusted interfaces. These are the troubleshooting steps you should follow... Good luck. Tiago
... View more
06-03-2016
Bom dia Christopher, Sim é possível, basta ativar a opção "https
redirection" em Management -» HTTP-...
06-02-2016
Ola Marcelo! Em Local Web Authentication, o SSID é configurado com
segurança de Nível 3 no WLC e ser...
Created by
Tiago Antunes
in Wireless
04-12-2016
04-12-2016
Nos dias que correm a maioria de empresas possuem uma rede wireless e
desejam permitir acesso a visi...
06-18-2011
Ok, so you had missed to include the VLAN 5 in the allowed VLANs of the
trunk?Please note that in th...
06-17-2011
Indeed,AP config looks ok so most likely the VLAN 5 is not allowed in
the trunk...Can you check the ...
06-17-2011
Hi,Can you send us the complete sh run from the AP and the switch where
the AP is connected?Where is...
Created by
Tiago Antunes
in Wireless and Mobility
06-16-2011
06-16-2011
Hi,From those logs, we can see that your SSID requires authentication
and this authentication is aga...
06-16-2011
Hi,Can you please be more clear with "not working"?What exactly is not
working?What do you see in th...
06-16-2011
Hi Wagas,Can you please clarify exactly what will be the relation with
NAc and the Wireless network?...
Created by
Tiago Antunes
in Other Security Subjects
06-07-2011
06-07-2011
Hi Bryan,From the log messages:2011-06-06 09:37:21.832 -0400 ERROR
com.perfigo.wlan.jmx.adsso.GSSSer...
06-03-2011
Hi Bruce,I am afraid there are some arguments missing in your db
command.To manually add the OID of ...
Created by
Tiago Antunes
in Other Security Subjects
06-01-2011
06-01-2011
Hi Bruce,Thanks for your post.4507E switches is already supported as we
can see in Table 11 "Support...
Created by
Tiago Antunes
in Policy and Access
04-20-2011
04-20-2011
Hi,Well, the failed attempts and auth ok are for different users...So I
am not sure what is the rela...
Created by
Tiago Antunes
in Policy and Access
04-20-2011
04-20-2011
Hi,It would be great if you could post the real csv files here, both of
them to verify the timestamp...
Created by
Tiago Antunes
in Other Security Subjects
04-20-2011
04-20-2011
Hi again,The troubleshooting tips i gave you are the ones you should
follow.With the sniffer traces ...
Public Statistics
| Date Registered | 03-16-2008 01:58 PM |
| Date Last Visited | 04-29-2019 01:20 AM |
| Total Messages Posted | 475 |
| Total Helpful Votes Received | 1131 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 30 | |
| 1 | |
| 5 | |
| 1 | |
| 2 |
Helpful Votes From
