Referring to below two documents, my bet goes to –N I see your post is 5yrs old. Did you make it work with "-N" ? >>> Refer this guide, page 31, Lists the countries that belong to each regulatory domain. http://www.net130.com/attestation/ccip/jc/Cisco%20Aironet%20Wireless%20LAN%20Fundamentals%20AWLF%203.1.pdf PNG falls under Americas region which also includes Australia/India etc, whereas, Indonesia falls under EMEA’s regulatory domain. I also referred your link http://www.cisco.com/c/en/us/products/collateral/wireless/access-points/product_data_sheet0900aecd80537b6a.html#Table280211abgnac ... View more

Please refer my previous response :- "Also note, It is not possible to access the standby-hot controller through the controller GUI, Cisco Prime Infrastructure, or Telnet. You can access the standby-hot controller only on its console." Glad i could help. Please don't forget to rate this post and share/like video :) ... View more

1. Yes, SP can be in different VLAN than management and it should be configured that ways irrespective of HA or standalone 2. ICMP packets are generated from the Redundancy Management Interface to check the default gateway reachability of controllers in the Active and Standby states. Gw reachability is one of the deciding factors in role change under HA environment. Hence, RMI IP address should be pingable from GW i.e RMI does respond to ICMP when ping is sourced from Gw *GW=Gateway Also note that the RMI is also used to send notifications from the active controller to the standby controller if a failure or manual reset occurs. The standby controller uses the Redundancy Management Interface to communicate to the syslog, NTP server, and TFTP server to upload any configuration. ... View more

Yeah, If the controllers cannot reach each other through the redundant port and the RMI, the primary controller becomes active and the standby-hot controller goes into the maintenance mode. The WLC should be rebooted in order to bring it out of Maintenance Mode. Only the Console and Service Port is active in Maintenance Mode. Since in your case, both went into maintenance, please ensure:- 1. same hardware and software version in place 2. proper gateway reachability from both wlcs independently 3. RMI and the redundancy port should be in two separate Layer2 VLANs, which is a mandatory configuration.   4. NOT SUPPORTED SCENARIO :  The primary controller has the management address and the redundancy management address in the same VLAN, and the secondary controller has the management address in the same VLAN as the primary one, and the redundancy management address in a different VLAN. When HA is enabled, the standby controller always uses RMI and all the other interfaces, dynamic and management, are invalid. A ping must only accept RMI as source and not other interfaces. Also note, It is not possible to access the standby-hot controller through the controller GUI, Cisco Prime Infrastructure, or Telnet. You can access the standby-hot controller only on its console. ... View more

1. Try AIR-CT5500-K9-8-0-121-0.aes Release Notes 8.0.121.0 http://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn80mr2.html Release notes 8.0 http://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/wlcrn80.html#pgfId-1254764 2. A redundancy VLAN should be a nonroutable VLAN in which a Layer 3 interface should not be created for the VLAN, and the interface should be allowed on the trunk port to extend an HA setup between multiple chassis. Redundancy VLAN should be created like any other data VLAN on Cisco IOS-based switching software.  No, just keep Management and RMI on same subnet. In case of RP, it will auto-assign IP using last two octets of RMI and first two octets are always 169.254. ... View more

1. You may lose out on WLC's configuration which you intend to make secondary. Primary WLC's config will remain intact. However, i would recommend you to take backup of both WLCs in advance so it is easy to restore later. 2. Not more than 15mins to set up HA completely. You can keep 15mins for rollback and 5-10mins for config backup. Overall, 45mins-1hr should be your maintenance window. ... View more

Yeah RPs need to have L2 adjacency. Right, since RMI intf is created as part of the mgmt subnet, you would need to keep them in same vlan as you also suggested above. Configuration sync and keepalives will be sent across RP. Don't miss to keep below into consideration :- 1. RTT Latency on the redundancy link is 80 milliseconds by default. The RTT should be 80% of the Keepalive timer which is configurable in the range 100-400 milliseconds. 2. Failure detection time is 3*100 + 60 + jitter (12 msec) = ~400 msec 3. Bandwidth: 60 Mbps or more 4. MTU: 1500 Hope this helps... Good luck! ... View more

yes, keep it in layer 2. However, recommended would be to connect them back to back. ... View more

Hi Manny, Glad you liked the information shared in this video. 1. Yes, the RMI is pingable. Because RMI has to verify the management gateway reachability as it is a critical decision making factor for controllers to trigger failover & take up roles (active/standby) accordingly. 2. There is no way to identify the RP status. Max. you can try is to ping the RP IP address of peer as they are pingable ONLY between peer controllers and not on infra. 3. No, you can't merge licenses. True, the requirement to have 0 or minimum 50 AP license count is there to make the unit as secondary. The number of APs will be served by the paired up controllers based on the AP count you have on Primary controller. For instance, if Primary has 12 AP license and Secondary is with bare minimum 50 AP count. Once you pair up the controllers, the total AP count serve will be 12. HTH Regards, Mohit Please do keep positing your comments/feedback/doubts and dont forget to rate the video and solution to your questions/comment ... View more

Hi Daniel, Unfortunately, ethically dont have any other option than to purchase a Cisco Smartnet contract. Even if you google to download an IOS image for your AP to convert it to Autonmous, chances are the downloaded image is corrupt & can dysfunction your AP. HTH Mohit Paul CCIE-Security 35496 P.S Please do rate this post if you find it helpful to make it easier for others seeking answers to similar queries ... View more

Hi Johnny, Firstly, you have landed yourself up in wireless tech zone. This question deserves a posting in the security zone. Secondly, for the logs you posted above, here are my two cents:- A duplicate TCP SYN was received during the three-way-handshake that has a different initial sequence number than the SYN that opened the embryonic connection. This could indicate that SYNs are being spoofed. You may like to do some config as sample below to prevent your network from SYN Flood attack Create an acl with source any and destination specific to the TO-IP-ADDRESS that you see in the logs above access-list 100 permit tcp any host access-list 100 permit tcp any host class-map c-inside-machine match access-list 100 policy-map p-inside-machine class c-inside-machine set connection conn-max 100 set connection embryonic-conn-max 200 set connection per-client-embryonic-max 7 set connection per-client-max 5 set connection random-sequence-number enable set connection timeout embryonic 0:0:45 service-policy p-inside-machine interface inside you can also refer the config below for more details and deeper understanding on the suggested config http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00809763ea.shtml Regards, Mo P.S Please do rate good posts that answers your question to help others finding the similar solution in less time and to avoid duplicacy. ... View more

It won't be nice to say in first place that you may be hitting some bug on 8.2.4.1. But i recall there was similar SQL issue on forum while ago and it turned to be a bug on 8.2.4.1 which was fixed in 8.2.4.2. Unfortunately i don't have that bug id handy else would have referred and shared with you. Since you would be going through a change control and second chance won't be too soon for you. I would like to place a generic recommendation. Do upgrade the code to 8.2.4.2 or later (as you mentioned 8.2.5.22)? At the same time see if you can upgrade the code on SSL ASA too, as 8.2.1 is not a reliable code, has lots of bugs carried from 7.x and 8.0 release. With the upgrade your issue may get resolve. Still suggest you to take a second opinion from TAC as they might have seen this issue with other customers too. ... View more