Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About rcoote5902_2
rcoote5902_2
Explorer
Born and raised in Canada, currently in Edmonton Alberta by way of Winnipeg, Manitoba and briefly in Salt Lake City, Utah, USA. I've been involved in networking since around 2000 when I was a Sr. Operations Manager working with AT&T's Managed Internet Services. I am presently a systems administrator for a rural public school division dealing mostly with our wired, wireless and voice network services.
Born and raised in Canada, currently in Edmonton Alberta by way of Winnipeg, Manitoba and briefly in Salt Lake City, Utah, USA. I've been involved in networking since around 2000 when I was a Sr. Operations Manager working with AT&T's Managed Internet Services. I am presently a systems administrator for a rural public school division dealing mostly with our wir
Recent Badges
Stats
Member since
08-13-2008
273
Posts
30
Helpful
1
Solution
Created by
rcoote5902_2
in Small Business Switches
in Small Business Switches
07-22-2014
10:01 AM
07-22-2014
10:01 AM
Can anyone tell me if there is an equivalent CLI command to reset an interface configuration to default? In IOS it is "default interface <interface>" which removes all configuration from that switch port. I don't seem to be able to find the same in the SG series CLI. Thanks, Rob
... View more
Labels:
Created by
rcoote5902_2
in IP Telephony and Phones
in IP Telephony and Phones
04-15-2013
08:32 AM
04-15-2013
08:32 AM
Hi Chris, I just came across this issue on my own workstation. IP Communicator was working fine on Friday but this morning it crashed when I answered a call and then would not re-launch, it just came up with a black screen. I completely uninstalled it, including deleting the folder: C:\Program Files (x86)\Cisco Systems\Cisco IP Communicator\ (your drive letter may vary...) I then reinstalled the same version (8.6.1) and it is now working again. I hope this helps. Rob
... View more
Created by
rcoote5902_2
in IP Telephony and Phones
in IP Telephony and Phones
03-11-2013
07:12 AM
03-11-2013
07:12 AM
Any time I have seen the "Auth Fail" message is due to the wrong phone model being selected in CUCM. I have a mix of phones and sometimes clone the wrong model, this will cause the Auth Fail message.
... View more
11-15-2012
11:06 AM
Hello, We have an ASA for our IPSec VPN service that has been up and running for some time. We ran into an issue at a trade show this week in which we could connect to our VPN using the trade show wifi but could not access anything behind our firewall (computers, servers, etc.) yet simply tethered to a cell phone, and using the VPN we could then access what we needed. I suspect some sort of conflict with the local trade show wifi subnet and our internal subnet behind the firewall, although both connections are using NAT. The trade show DHCP is handing out 172.16.0.0/16 addresses and the subnet we're trying to access behind the VPN is 172.16.128.0/22. VPN connections are assigned addresses from a separate pool (10.4.99.0/24). When using the wifi and VPN I am able to connect, and ping the gateway interface of the ASA, but nothing beyond. When using cellular and VPN I am able to ping the gateway and pass traffic to services behind it. Any thoughts on how this might be resolved? We have not run into this before and the VPN has been in use for several years. Thanks, Rob
... View more
Labels:
10-09-2012
08:04 AM
Hello, No this was never resolved. We're also in the process of migrating to a different firewall vendor. Thanks, Rob
... View more
Created by
rcoote5902_2
in Network Access Control
in Network Access Control
09-05-2012
02:57 PM
09-05-2012
02:57 PM
That has helped a bit, it seems there are fewer of those messages but there are still quite a few EAP session timed out being recorded.
... View more
Created by
rcoote5902_2
in Network Access Control
in Network Access Control
09-04-2012
11:53 AM
09-04-2012
11:53 AM
Ah I forgot about that pesky 2 second timeout in the WLC. Thanks, I'll definitely try that and monitor the ACS. Thanks!
... View more
Created by
rcoote5902_2
in Network Access Control
in Network Access Control
09-04-2012
11:32 AM
09-04-2012
11:32 AM
Here is an example: Sep 4,12 11:49:46.113 AM Sep 4,12 11:49:46.093 AM 10-40-f3-ab-f5-ca Domain Wireless PEAP (EAP-MSCHAPv2) co-srvr-wlc01 172.16.131.100 co-srvr-acs Sep 4,12 11:49:03.910 AM Sep 4,12 11:49:03.890 AM 10-40-f3-ab-f5-ca Domain Wireless PEAP 172.16.131.100 co-srvr-acs 5411 EAP session timed out
... View more
Created by
rcoote5902_2
in Network Access Control
in Network Access Control
09-04-2012
11:24 AM
09-04-2012
11:24 AM
I've got ACS currently authenticating wireless users - using EAP-MSCHAPv2. There are a large number of failures being reported as: 5411 EAP session timed out Description This may be due to EAP misconfiguration on ACS or Network Device. Resolution Steps Please contact TAC. However there does not appear to be any impact to the users as they appear to be authenticating normally shortly after any of these errors. At this point it's more of an inconvenience but I'd like to see if I can't resolve the issue. The error says to contact TAC but we don't have a support contract for ACS at this time. Any help is appreciated.
... View more
Labels:
Created by
rcoote5902_2
in Network Access Control
in Network Access Control
08-30-2012
12:18 PM
08-30-2012
12:18 PM
Thanks Tarik, I had considered using that method and tweaking the timers but this was a recommended alternative in some of the Cisco white papers. I'll certainly try it out. I am running 5.3.0.40.6 in VMware. Current port config is as follows: interface FastEthernet0/14 description 802.1X Test Port switchport mode access switchport block unicast switchport voice vlan 100 srr-queue bandwidth share 10 10 60 20 priority-queue out authentication event fail action next-method authentication host-mode multi-auth authentication order mab dot1x authentication priority dot1x mab authentication port-control auto authentication violation restrict mab mls qos trust device cisco-phone mls qos trust cos dot1x pae authenticator auto qos voip cisco-phone spanning-tree portfast spanning-tree bpduguard enable service-policy input AutoQoS-Police-CiscoPhone The switch is a 2960 with 12.2(50)SE1 Lan Base
... View more
Created by
rcoote5902_2
in Network Access Control
in Network Access Control
08-30-2012
11:47 AM
08-30-2012
11:47 AM
Hello, We are in the process if deploying ACS for several scenarios. It will be taking over from Microsoft's built in NPS for wireless authentication as well as providing authentication for VPN users and ultimately wired 802.1x services as well. With respect to the wired access - I've attended a number of sessions at Cisco Live over the past couple of years regarding 802.1x deployment and the initial "monitor mode" to prevent impact to users. I'm currently configuring a very basic set of rules for the wired deployment and testing. I've run into some issue with client's connecting behind VoIP phones. I have a fairly basic set of Service Selection Rules matching on the NAS-Port-Type. One for Ethernet and one for IEEE-802.11. From there I have two Access Services configured. The Wireless policy is working and does not appear to have any issues. It is using Active Directory and authorizing against AD group memberships. The Wired policy has two rules, the first matching Auth-method for Lookup and uses the Internal Hosts, the second for MSCHAPv2 which uses Active Directory. The idea being when mab-auth fails for an 801.x capable client behind a Cisco phone, the next rule in place then authenticates against AD. I have set the "continue" action for a failed host lookup but it doesn't appear to work: Logged At: August 30,2012 11:59:26.213 AM RADIUS Status: Authentication failed : 15039 Selected Authorization Profile is DenyAccess NAS Failure: Username: 00-15-C5-86-07-D4 MAC/IP Address: 00-15-C5-86-07-D4 Network Device: Test Switch : 172.16.128.35 : FastEthernet0/14 Access Service: Domain Wired Identity Store: Authorization Profiles: DenyAccess CTS Security Group: Authentication Method: Lookup Then the second auth request is a success: Logged At: August 30,2012 11:59:26.873 AM RADIUS Status: Authentication succeeded NAS Failure: Username: host/Facemelter7.ssd.local MAC/IP Address: 00-15-C5-86-07-D4 Network Device: Test Switch : 172.16.128.35 : FastEthernet0/14 Access Service: Domain Wired Identity Store: AD1 Authorization Profiles: Permit Access CTS Security Group: Authentication Method: PEAP(EAP-MSCHAPv2) As you can see the failure and then success are about 5 tenths of a second apart so there's no impact really. But my question is this: Is this a good way to structure the rules? Every client behind a phone records an auth-failure and then an auth-success in ACS, so it gives the appearance of a lot of failures. Is there a better way to do MAB? Thanks! Rob
... View more
Labels:
Created by
rcoote5902_2
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
08-09-2012
06:26 AM
08-09-2012
06:26 AM
It looks like DHCP is working for controller discovery but the controller or AP is failing the config process. There should be a log on the controller as well, does it provide any more details? Sent from Cisco Technical Support iPhone App
... View more
Created by
rcoote5902_2
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
08-08-2012
09:01 PM
08-08-2012
09:01 PM
Hi Chandra, Switching to using DNS for discovery became a much better solution for us overall as we have now also mixed in some AP's from another vendor (Ruckus) and they also use a DNS discovery. From this guide: http://www.cisco.com/en/US/docs/wireless/controller/5.2/configuration/guide/Controller52CG.html "DNS discovery—The access point can discover controllers through your domain name server (DNS). For the access point to do so, you must configure your DNS to return controller IP addresses in response to CISCO-LWAPP-CONTROLLER.localdomain, where localdomain is the access point domain name. When an access point receives an IP address and DNS information from a DHCP server, it contacts the DNS to resolve CISCO-LWAPP-CONTROLLER.localdomain. When the DNS sends a list of controller IP addresses, the access point sends discovery requests to the controllers. " This example uses LWAPP but it's the same for CAPWAP. All you need to do is add an A record to your domain DNS server for "cisco-capwap-controller.localdomain" (using whatever your local domain actually is) and the AP's will use this for discovery. We also added an A record for "zonedirector.localdomain" which the Ruckus AP's use for discovery so regardless of which AP's we use where, they always contact the correct controller. I hope this helps! Rob
... View more
Created by
rcoote5902_2
in IP Telephony and Phones
in IP Telephony and Phones
08-07-2012
03:31 PM
08-07-2012
03:31 PM
Ok I assumed that if I changed the default firmware in CUCM the default load would reflect that. I guess not. Interestingly enough it seems this is a known bug because the 8.5.2 firmware is the only version that doesn't require a service contract to download. So I downloaded the package, and unzipped all of the files including the term62.default.loads into my tftp folder and fired up Tftpd32. Rebooted the phone and bingo, the phone started requesting the files. It still had a blank screen mind you, which was unnerving but it reset itself after the download and the wonderful Cisco splash screen appeared once again. I re-adjusted my option 150 to point back at the CUCM tftp server and the phone happily upgraded itself to 8-5-2S and is back up and running. That's a slick fix I'm going to have to remember. Stars all around.
... View more
Created by
rcoote5902_2
in Small Business Switches
07-22-2014
07-22-2014
Can anyone tell me if there is an equivalent CLI command to reset an
interface configuration to defa...
04-15-2013
Hi Chris,I just came across this issue on my own workstation. IP
Communicator was working fine on Fr...
Created by
rcoote5902_2
in IP Telephony and Phones
03-11-2013
03-11-2013
Any time I have seen the "Auth Fail" message is due to the wrong phone
model being selected in CUCM....
11-15-2012
Hello,We have an ASA for our IPSec VPN service that has been up and
running for some time. We ran in...
10-09-2012
Hello,No this was never resolved. We're also in the process of migrating
to a different firewall ven...
09-05-2012
That has helped a bit, it seems there are fewer of those messages but
there are still quite a few EA...
09-04-2012
Ah I forgot about that pesky 2 second timeout in the WLC. Thanks, I'll
definitely try that and monit...
09-04-2012
Here is an example:Sep 4,12 11:49:46.113 AM Sep 4,12 11:49:46.093 AM
10-40-f3-ab-f5-ca Domain Wirele...
09-04-2012
I've got ACS currently authenticating wireless users - using
EAP-MSCHAPv2. There are a large number ...
Created by
rcoote5902_2
in Network Access Control
08-30-2012
08-30-2012
Thanks Tarik,I had considered using that method and tweaking the timers
but this was a recommended a...
Created by
rcoote5902_2
in Network Access Control
08-30-2012
08-30-2012
Hello,We are in the process if deploying ACS for several scenarios. It
will be taking over from Micr...
Created by
rcoote5902_2
in Other Wireless - Mobility Subjects
08-09-2012
08-09-2012
It looks like DHCP is working for controller discovery but the
controller or AP is failing the confi...
Created by
rcoote5902_2
in Other Wireless - Mobility Subjects
08-08-2012
08-08-2012
Hi Chandra,Switching to using DNS for discovery became a much better
solution for us overall as we h...
Created by
rcoote5902_2
in IP Telephony and Phones
08-07-2012
08-07-2012
Ok I assumed that if I changed the default firmware in CUCM the default
load would reflect that. I g...
Public Statistics
| Date Registered | 08-13-2008 06:08 AM |
| Date Last Visited | 10-09-2017 02:03 PM |
| Total Messages Posted | 273 |
| Total Helpful Votes Received | 30 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 10 | |
| 10 | |
| 3 | |
| 5 | |
| 3 |
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
