I am trying to setup round robin to multiple out of band (not inline) proxy servers via PBR.  Here is what I have... route-map websense permit 11 match ip address WSS set ip next-hop 10.36.60.54 10.36.60.22                   Will this allow for Round Robin?  If not what do I need to do? ... View more

We are in the process of adding an additional ISP to our corporate network.  When we do so the ASA we use will connect with our WAN sites (Cisco 2811's and I know we need to upgrade!) with the current NAT'd IP (7.7.7.7 for this question) and also the new one (8.8.8.8).  I need to know a way to add the additional ISP Ip into our WAN site routers so it will accept either the existing IP or the new one.  Here is our WAN site router current setup.... ! crypto isakmp policy 10 encr aes 256 authentication pre-share group 5 crypto isakmp key examplekey1! address 7.7.7.7 crypto isakmp keepalive 10 5 periodic ! ! crypto ipsec transform-set aptset esp-aes 256 esp-sha-hmac ! crypto map aptmap 10 ipsec-isakmp set peer 7.7.7.7 set transform-set aptset set pfs group5 match address IPSec ! ! ip access-list extended IPSec permit ip 10.2.2.0 0.0.0.255 any (Site IP range) What would I add for the additional NAT'd IP (8.8.8.8)??? Note: the ASA that has all of our tunnels will be behind a load balancer so all it will be looking for is the tunnel coming into one of its interfaces.                    Thanks in advance! ... View more

Is there a good document on setting up Port Channels??  Specfically is there a way to optimize them so I know that they are capable of pushing traffic on more than one interface if the traffic exceeds its capability??? We have a backup device that is setup on a 4 port (all 4 ports are set to gig speed) etherchannel.  When the device sends out traffic it maxes out one link and one link only and sends no traffic on the rest of the ports.  I am trying to verify that this is not a switch issue. The port configuration on the channel group is mode active. channel-group 17 mode active interface GigabitEthernet10/8 description HO-NB5 Backup switchport switchport access vlan 213 no ip address speed 1000 duplex full spanning-tree portfast channel-group 17 mode active ... View more

We are trying to setup an SSID where our Mobile Device users (IPAD, IPHONE, etc..) can get on and have limited access to the internal network. I was able to limit access using an ACL on the VLAN we assign the devices on but I can't find a good way to setup the controller where they are strictly using LDAP.  I've seen the OU setup but that doesn't work in our environment because users could only be in that specific OU and would lose some group policies.  Cisco doesn't allow LDAP group access unfortunately. That's not that big of an issue.  My question is what are some good ways to setup a secure SSID that only allows specific wireless users to authenticate on it?  I've thought about machine authentication.  I don't know much about certificates but think that wouldn't work because anyone could get onto it and get a certificate (I think).  I'm just looking for ideas... ... View more

Is there any way on an LDAP server to create an LDAP group that can be tied to the WLC for LDAP authentication.  I have this url that explains local authentication and LDAP...  http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a008093f1b9.shtml .  That helps with local authentication but one thing I don't see is any guidance on how to create a group in a DC to communicate with anything on WLC.  Any ideas? ... View more

We are running IPSec inside of a GRE tunnel.  The question was brought to me as to how to actually show the GRE tunnel itself.  I know that I can do a show crypto isakmp sa and it will show the IPSec.  I know that I can show int tunnel0 and it will show me the status of the tunnel interface.  How do I do GRE specifically? ... View more

I have created an SSID that I am planning to use WPA2-AES on.  This SSID will be for specific people who have company approved mobile devices (IPAD,  IPHONE, etc..).  The best way I can think to control that is to assign these users usernames created on the WLC.  First I believe I know where to create them (AAA/LOCAL NET USERS) but I need a little help past that. 1) Would I setup local authentication on the WLAN?  2)  Can I use WPA2 if I'm planning on doing this?  3)  If this is possible is there a good document showing how to do it? ... View more

Is there a way on WLC or WCS to set up an SSID that would specifically cater to Mobile Devices (IPhone, Droid, IPad)?  Also if one were setup how could I go about policing this to be sure mobile devices only got to that SSID and no other ones? ... View more

I have several routers with HWIC-3G-CDMA- V cards in them.  One is in an RV we use for our DR.  Currently it only has a duck paddle antenna that it uses.  However we've recently found that the RV has an cell antenna attached to the roof that we could potentially use.  The antenna is attached to an amplifier in the RV that we would actually put in the cable from 3G card.  The amplifier is a Pentalink MPLK-DF. I was wondering if anyone has tried attaching one the 3G cards to anything like this and if they had any issues?  I haven't attached it yet.  I want to verify here first...  ... View more

After I try to add/edit a profile for wIPS it gives me the following error "Unable to apply profile.   Reason: Error while assigning the profile 'AP' (profile name) to the controller on MSE 'mse" (mse name).   Error:" Any ideas?  My licensing and everything are up to date.  I have an AP added to monitor.  ... View more