Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About varma10
Stats
Member since
07-28-2015
22
Posts
5
Helpful
3
Solutions
Created by
varma10
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-25-2019
08:52 AM
09-25-2019
08:52 AM
Make sure you have route reach ability from AP to WLC. Try to ping the WLC from the same subnet on the switch where AP is connected. If you have network reachability and still cannot join WLC, please post show ap join stats to look into it.
... View more
Created by
varma10
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-25-2019
07:34 AM
09-25-2019
07:34 AM
Should I be using the native VLAN on the bridge link for the third AP that is connected to the switch? Can I use a different VLAN for it to form a CAPWAP with WLC. Also, do I have to configure the Root and Non-Root APs in Autonomous or LWAPP mode?
... View more
Created by
varma10
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-25-2019
07:32 AM
09-25-2019
07:32 AM
I do not think I am looking for a Mesh network here. A mesh network will have a RAP and MAP right, but I have Root Bridge, non-root Bridge networks. Also, I am connecting the third AP on the wired network. This will not transfer data wireless as the mesh network does.
... View more
09-24-2019
06:15 PM
Can I configure APs to work via CAPWAP over another CAPWAP link? I am using point-to-point bridge network as circuit between two buildings and would like to traverse multiple VLANs on switch network and do CAPWAP with APs behind L2 switch. I have attached the image. Please let me know if the design works good.
... View more
Labels:
Created by
varma10
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
08-06-2019
09:12 AM
08-06-2019
09:12 AM
We are using 3.4 version of Prime. I found that there is an option through TAC but do not have necessary commands to enable SFTP on cisco prime.
... View more
Created by
varma10
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
07-31-2019
01:16 PM
07-31-2019
01:16 PM
I found this on cisco portal where you can create an sftp user, but I could not get it working. I am getting an error that says permission denied. I tried to gain root access by issuing "sudo su" and then it doesn't find the directory when I try to issue "./sftpconfig.sh"
... View more
Created by
varma10
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
07-31-2019
11:34 AM
07-31-2019
11:34 AM
I would like to copy file from local machine disk to Cisco prime disk. I have sftp client on my machine. How can I enable SFTP server on Cisco prime to transfer the file from client to server.
... View more
Labels:
01-18-2019
04:32 PM
Below are few suggestions you can look at:
1. You can look at WLC by looking if all the ports are up or not? Use commands "show port summary" on WLC.
2. Verify if all ports are bundled into port channel for better performance.
3. Also, verify if there any drops on the interface where WLC is connected.
... View more
01-16-2019
08:59 AM
Can we form HA SSO pair with different FUS images on 5508 WLCs?
... View more
Labels:
Re: Central WebAuth - unable to get the...
in Wireless Security and Network Management
04-26-2018
09:02 AM
04-26-2018
09:02 AM
With ISE NAC or Radius NAC, WLC will not use virtual IP for redirection. ISE will provide the redirection portal using ACL on WLC.
I had the same issue with my anchor and foreign setup. TAC suggested me to disable Radius accounting and it worked. So please give it a try.
... View more
Created by
varma10
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
03-01-2018
09:28 AM
03-01-2018
09:28 AM
I have the same problem now with 8540 WLC and 3800 APs in flex connect. I can see a timeout even occurring during M2 event in the handshake process.
The issue got resolved once I restarted the AP which client was connected to. I do not see a bug associated with this issue. Any permanent fix would be encouraged.
Client debug log:
*apfMsConnTask_3: Mar 01 17:09:47.219: [PA] xx:xx:xx:xx:xx:xx Sending assoc-resp with status 0 station:xx:xx:xx:xx:xx:xx AP:28:6f:7f:18:b3:8f-01 on apVapId 1 *apfMsConnTask_3: Mar 01 17:09:47.219: [PA] xx:xx:xx:xx:xx:xx VHT Operation IE: width 40/0 ch 157 freq0 0 freq1 0 msc0 0x3f msc1 0x3f *apfMsConnTask_3: Mar 01 17:09:47.219: [PA] xx:xx:xx:xx:xx:xx Including FT Mobility Domain IE (length 5) in Initial assoc Resp to mobile *apfMsConnTask_3: Mar 01 17:09:47.219: [PA] xx:xx:xx:xx:xx:xx Sending R1KH-ID as 84:3d:c6:0f:a6:e5 *apfMsConnTask_3: Mar 01 17:09:47.219: [PA] xx:xx:xx:xx:xx:xx Sending R0KH-ID as:10.29.22.81 *apfMsConnTask_3: Mar 01 17:09:47.219: [PA] xx:xx:xx:xx:xx:xx Including FT IE (length 98) in Initial Assoc Resp to mobile *apfMsConnTask_3: Mar 01 17:09:47.219: [PA] xx:xx:xx:xx:xx:xx Clearing the existing FT session data for mobile as we received a fresh Association. *apfMsConnTask_3: Mar 01 17:09:47.219: [PA] xx:xx:xx:xx:xx:xx Sending Assoc Response (status: '0') to station on AP SAP21B55H-2-16 on BSSID 28:6f:7f:18:b3:8f ApVapId 1 Slot 1, mobility role 0 *apfMsConnTask_3: Mar 01 17:09:47.219: [PA] xx:xx:xx:xx:xx:xx apfProcessAssocReq (apf_80211.c:10966) Changing state for mobile xx:xx:xx:xx:xx:xx on AP 28:6f:7f:18:b3:80 from Associated to Associated
*spamApTask5: Mar 01 17:09:47.219: [PA] xx:xx:xx:xx:xx:xx Successful transmission of LWAPP Add-Mobile to AP 28:6f:7f:18:b3:80 *spamApTask5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Received ADD_MOBILE ack - Initiating 1x to STA xx:xx:xx:xx:xx:xx (idx 62) *spamApTask5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Sent dot1x auth initiate message for mobile xx:xx:xx:xx:xx:xx *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx reauth_sm state transition 0 ---> 1 for mobile xx:xx:xx:xx:xx:xx at 1x_reauth_sm.c:47 *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Creating a PKC PMKID Cache entry for station xx:xx:xx:xx:xx:xx (RSN 2) *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Resetting MSCB PMK Cache Entry 0 for station xx:xx:xx:xx:xx:xx *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Setting active key cache index 8 ---> 8 *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Setting active key cache index 8 ---> 0 *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Adding BSSID 28:6f:7f:18:b3:8f to PMKID cache at index 0 for station xx:xx:xx:xx:xx:xx *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] New PMKID: (16)
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] [0000] dd de 46 77 7d 39 5d 69 7c b0 98 05 dd 5b a7 ec
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Creating global PMK cache for this TGr client *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Created PMK Cache Entry for TGr AKM:PSK xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx R0KH-ID:10.29.22.81 R1KH-ID:84:3d:c6:0f:a6:e5 MSK Len:48 pmkValidTime:86398
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx apfCreatePmkCacheEntry: added a new pmk cache entry for xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Adding Audit session ID payload in Mobility handoff
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx 4 PMK-update groupcast messages sent *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Initiating RSN PSK to mobile xx:xx:xx:xx:xx:xx *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx EAP-PARAM Debug - eap-params for Wlan-Id :1 is disabled - applying Global eap timers and retries *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Disable re-auth, use PMK lifetime. *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx dot1x - moving mobile xx:xx:xx:xx:xx:xx into Force Auth state *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Skipping EAP-Success to mobile xx:xx:xx:xx:xx:xx (encryptBit:0) *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx key Desc Version FT - 1
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Found an cache entry for BSSID 28:6f:7f:18:b3:8f in PMKID cache at index 0 of station xx:xx:xx:xx:xx:xx *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Found an cache entry for BSSID 28:6f:7f:18:b3:8f in PMKID cache at index 0 of station xx:xx:xx:xx:xx:xx *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] Including PMKID in M1 (16)
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] [0000] dd de 46 77 7d 39 5d 69 7c b0 98 05 dd 5b a7 ec
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] M1 - Key Data: (22)
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] [0000] dd 14 00 0f ac 04 dd de 46 77 7d 39 5d 69 7c b0
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] [0016] 98 05 dd 5b a7 ec
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Starting key exchange to mobile xx:xx:xx:xx:xx:xx, data packets will be dropped *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Sending EAPOL-Key Message to mobile xx:xx:xx:xx:xx:xx state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00 *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.222: [PA] xx:xx:xx:xx:xx:xx Allocating EAP Pkt for retransmission to mobile xx:xx:xx:xx:xx:xx *dot1xSocketTask: Mar 01 17:09:47.224: [PA] xx:xx:xx:xx:xx:xx validating eapol pkt: key version = 3 *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.224: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-Key from mobile xx:xx:xx:xx:xx:xx *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.224: [PA] xx:xx:xx:xx:xx:xx key Desc Version FT - 1
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.224: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-key in PTK_START state (message 2) from mobile xx:xx:xx:xx:xx:xx *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.224: [PA] xx:xx:xx:xx:xx:xx Encryption Policy: 4, PTK Key Length: 48 *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.224: [PA] R1KHID+S1KHID: (12)
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.224: [PA] [0000] 84 3d c6 0f a6 e5 d0 c5 f3 26 6c ed
*Dot1x_NW_MsgTask_5: Mar 01 17:09:47.224: [PA] xx:xx:xx:xx:xx:xx Successfully computed PTK from PMK!!! *Dot1x_NW_MsgTask_5: Mar 01 17:09:47.224: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-key M2 with invalid MIC from mobile xx:xx:xx:xx:xx:xx version 3 *osapiBsnTimer: Mar 01 17:09:48.335: [PA] xx:xx:xx:xx:xx:xx 802.1x 'timeoutEvt' Timer expired for station xx:xx:xx:xx:xx:xx and for message = M2 *Dot1x_NW_MsgTask_5: Mar 01 17:09:48.335: [PA] xx:xx:xx:xx:xx:xx Retransmit 1 of EAPOL-Key M1 (length 121) for mobile xx:xx:xx:xx:xx:xx *dot1xSocketTask: Mar 01 17:09:48.336: [PA] xx:xx:xx:xx:xx:xx validating eapol pkt: key version = 3 *Dot1x_NW_MsgTask_5: Mar 01 17:09:48.336: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-Key from mobile xx:xx:xx:xx:xx:xx *Dot1x_NW_MsgTask_5: Mar 01 17:09:48.336: [PA] xx:xx:xx:xx:xx:xx key Desc Version FT - 1
*Dot1x_NW_MsgTask_5: Mar 01 17:09:48.336: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-key in PTK_START state (message 2) from mobile xx:xx:xx:xx:xx:xx *Dot1x_NW_MsgTask_5: Mar 01 17:09:48.336: [PA] xx:xx:xx:xx:xx:xx Encryption Policy: 4, PTK Key Length: 48 *Dot1x_NW_MsgTask_5: Mar 01 17:09:48.336: [PA] R1KHID+S1KHID: (12)
*Dot1x_NW_MsgTask_5: Mar 01 17:09:48.336: [PA] [0000] 84 3d c6 0f a6 e5 d0 c5 f3 26 6c ed
*Dot1x_NW_MsgTask_5: Mar 01 17:09:48.336: [PA] xx:xx:xx:xx:xx:xx Successfully computed PTK from PMK!!! *Dot1x_NW_MsgTask_5: Mar 01 17:09:48.336: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-key M2 with invalid MIC from mobile xx:xx:xx:xx:xx:xx version 3
... View more
07-10-2017
02:09 PM
Hi Gregorio310,
Please check if the IP that you got for AP is incorrect VLAN and that VLAN is allowed on the port connected to WLC.
If you have IP from the correct subnet, that subnet has option dhcp 43 configured and if that subnet is reachable by WLC, then AP shouldn't have any problem to join WLC.
... View more
07-10-2017
02:01 PM
Hi Gregorio,
I am happy to see that you got your issue resolved. But I would like to comment on the below statement.
" Firts of all I have to change the SSID that I want to use on diferent site with diferent vlans to use flexconnect local switches enable on advanced TAB"
I don't think you need two different SSIDs configured on the WLC for local and flex connect APs. You can have single SSID with local interface on the WLC. But when you do vlan mapping on the flex connect tab in APs , the local vlans at remote sites takes over the vlans on WLC.
... View more
07-07-2017
08:10 AM
Hi Gregorio310,
The answer is YES, you should select flexconnect local switch on the same WLAN that is being broadcasted in the local site.
Also, the document mentioned in the above link is pretty straight forward. You can refer it, but if you want to use the same WLAN at local and remote site, then don't configure management interface on the WLAN.
Configure WLAN similar to how you configure in local site and select flexconnect local switching option. For remote site, once you configure the VLAN mappings on AP, client will get IP address from the mapped VLAN instead of the local VLAN.
Sorry if I confused you a lot. I don't have a test environment to post you screen shot with examples.
... View more
Created by
varma10
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
07-06-2017
01:46 PM
07-06-2017
01:46 PM
You don't have to add subnets to the interface in WLC. You just have to add the subnets for local mode APs.
To make it clear lets take below example:
WLC1 - 5508
APs (2) - 2702 - Local mode
APs (2) - 2802 - Flex mode
SSID - Corpwifi
Local VLAN - 10
Remote site VLAN - 20
Remote site native VLAN - 30
For local mode APs you just configure it as usual.
For Flex mode,
1. Create an AP group, broadcast Corpwifi in that group and add 2 2802 APs in the group.
2. Go to AP ( Home page -> Wireless -> Select AP) and select flex mode.
3. Go to flexconnect tab enter native VLAN (30) and select VLAN mappings and enter VLAN (20) for the respective SSID.
I hope that is clear enough. Please let me know if you have any questions.
... View more
09-25-2019
Make sure you have route reach ability from AP to WLC. Try to ping the
WLC from the same subnet on t...
09-25-2019
Should I be using the native VLAN on the bridge link for the third AP
that is connected to the switc...
09-25-2019
I do not think I am looking for a Mesh network here. A mesh network will
have a RAP and MAP right, b...
09-24-2019
Can I configure APs to work via CAPWAP over another CAPWAP link? I am
using point-to-point bridge ne...
08-06-2019
We are using 3.4 version of Prime. I found that there is an option
through TAC but do not have neces...
07-31-2019
I found this on cisco portal where you can create an sftp user, but I
could not get it working. I am...
07-31-2019
I would like to copy file from local machine disk to Cisco prime disk. I
have sftp client on my mach...
01-18-2019
Below are few suggestions you can look at: 1. You can look at WLC by
looking if all the ports are up...
04-26-2018
With ISE NAC or Radius NAC, WLC will not use virtual IP for redirection.
ISE will provide the redire...
Created by
varma10
in Other Wireless - Mobility Subjects
03-01-2018
03-01-2018
I have the same problem now with 8540 WLC and 3800 APs in flex connect.
I can see a timeout even occ...
07-10-2017
Hi Gregorio310, Please check if the IP that you got for AP is incorrect
VLAN and that VLAN is allowe...
07-10-2017
Hi Gregorio, I am happy to see that you got your issue resolved. But I
would like to comment on the ...
07-07-2017
Hi Gregorio310, The answer is YES, you should select flexconnect local
switch on the same WLAN that ...
Public Statistics
| Date Registered | 07-28-2015 10:08 PM |
| Date Last Visited | 10-04-2019 03:08 PM |
| Total Messages Posted | 22 |
| Total Helpful Votes Received | 5 |
