Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Jim Blake
Stats
Member since
06-08-2011
107
Posts
9
Helpful
3
Solutions
Created by
Jim Blake
in Wireless and Mobility
in Wireless and Mobility
03-19-2020
04:40 AM
03-19-2020
04:40 AM
I have to debug a Cisco vWLC (version 8.8.125.0) supporting a number of Cisco AIR-AP2802I-E-K9 APs), managed by Cisco Prime Infrastructure version 3.5.0.0.550 and CMX version 10.6.1-47 is deployed. All compatible according to Cisco. The vWLC reports wireless clients correctly. Prime sees the APs and vWLC and gives information on them, but has no information on the Client devices, despite it being reported by the vWLC. CMX shows the clients and their locations in the activity maps (red unassociated, green associated, MAC addresses reported) but in "Connect" it reports no visitors at all. The configuration in Prime looks OK, it is seeing the WLC, and the WLC is seeing the clients, but there is no client information apparently getting from vWLC to Prime or CMX. Anyone seen anything like this before...before I just do a full rebuild :) ? Thanks Jim
... View more
Created by
Jim Blake
in Network Access Control
in Network Access Control
08-31-2019
12:09 PM
08-31-2019
12:09 PM
Further info that may help: I think I've accommodated all the requirements and caveats in https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_010.html and my VM Host is giving the ISE 16Gb and 8 cores of a Xeon, so I think I'm OK for resources
... View more
Created by
Jim Blake
in Network Access Control
in Network Access Control
08-31-2019
08:42 AM
08-31-2019
08:42 AM
I watched Jason Kunst's video on You Tube, and it inspired me to try SAW for myself. I loaded up my VM host with vWLC, version 8.8.120.0, and got ISE version 2.3 (ISE-2.3.0.298-virtual-eval) and gave it a shot: I'm running a clean install of vWLC, and a clean install of ISE. I joined the ISE with AD, running off Win2K12R2. All the diagnostics show that ISE was properly joined with AD, so then ensured that the WLC was supporting just 1 SSID, that was configured at install time, and ran up SAW. It all looked good, it asked for the WLC IP address, the user name and password and the shared secret. This is a clean new install, so the WLC has no shared secret yet, so gave it one to use, and hit the button. Unfortunately, all I got back was "Failed to Configure WLC: WlcConnectionSetupFailed". OK, so I've done something wrong, so looked in the ISE logs and the WLC logs....nothing. ISE can ping WLC, and vice versa. So I google about a bit, and find some notices incriminating ISE 2.3. Didn't look too serious, but I thought I'd try ISE 2.4 to be sure, and got hold of ISE-2.4.0.357-6.5OVA-Eval and loaded that up. However, that made no change: I still got "Failed to Configure WLC: WlcConnectionSetupFailed". Is this maybe down to doing this on a low-powered Lab VMware 6.0 host? or are there other things I should look at.....and why is there NOTHING in the logs at either end??? Jason, give me some hints, you make it seem so simple in your excellent video :) Thanks guys for any suggestions Jim
... View more
06-01-2019
11:48 AM
Well, that was fun....NOT! I eventually found a community message at https://community.cisco.com/t5/wireless-mobility-documents/access-point-rommon-recovery-ap-prompt-recovery-example/ta-p/3119495 which I adapted and followed, having downloaded the file c3700-k9w8-tar.153-3.JJ.tar. Notice the file name....it starts with "c3700", whereas the other files provided for the 3700 series of APs were named with the prefix " ap3g2" . That worked! I got the file tftp'ed across, booted from it and the AP came up, and joined the WLC. The change of name seemed to fix it Thanks to all contributors, its been an interesting one :) Jim
... View more
05-30-2019
12:06 PM
It looks like I've bricked the AP :( All I get now is: ap: ap: ap: boot Loading ""...: permission denied Error loading "" Interrupt within 5 seconds to abort boot process. Boot process failed... ap: I've managed to do something unpleasant, so I'll go away and google some more, see if I can bring the thing back to life I'm sure there must be a way....tftp a file or something. Whatever, I'm learning a lot about APs :) Jim
... View more
05-27-2019
12:25 PM
Hi Leo, Here it is: Directory of flash:/ 2 -rwx 287 Jan 1 1970 00:06:43 +00:00 info 3 -rwx 69953 May 25 2019 18:45:34 +00:00 event.log 38 drwx 576 Mar 1 1993 00:05:02 +00:00 ap3g2-rcvk9w8-mx 5 -rwx 146 May 19 2019 15:10:49 +00:00 capwap-saved-config-bak 6 -rwx 11288 Mar 1 1993 00:00:20 +00:00 private-multiple-fs 17 drwx 2496 Apr 30 2019 21:32:03 +00:00 ap3g2-k9w8-mx.153-3.JD5 86 -rwx 64 May 11 2019 20:36:37 +00:00 sensord_CSPRNG0 75 drwx 512 Nov 28 2016 15:36:04 +00:00 configs 7 -rwx 174 Mar 1 1993 00:00:20 +00:00 env_vars 8 -rwx 0 Mar 1 1993 00:00:39 +00:00 config.txt 83 -rwx 71528 May 16 2019 19:28:28 +00:00 event.capwap 87 -rwx 64 May 11 2019 20:36:37 +00:00 sensord_CSPRNG1 89 -rwx 0 May 11 2019 19:37:52 +00:00 ce 14 -rwx 114 Nov 28 2016 15:51:44 +00:00 pnp-saved-config 15 -rwx 95008 May 19 2019 15:06:14 +00:00 lwapp_reap.cfg.bak 40900608 bytes total (19257856 bytes free)
... View more
05-26-2019
01:05 PM
I did some more digging, and while the AP is apparently looking for a file called ap3g2, I found in the "sho runn" output that to support 3700 APs, the vWLC wants to use a file called c3700, as shown below: AP Bundle Information Primary AP Image Size Supported AP's ---------------- ---- ------------ ap1g1 13572 AP700 ap1g3 15392 AP1530 ap1g4 28816 AP1850/1810 ap1g5 29336 AP1815,1540,AP1840 ap3g3 45792 AP2800,3800,4800,1560 c1570 13060 AP1570 c3700 14380 AP1700,2700,3700 When I try to get the AP to associate, the console output of the AP during boot cycles round the following: *May 26 19:56:49.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.100.95 peer_port: 5246 *May 26 19:56:49.227: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 192.168.100.95 peer_port: 5246 *May 26 19:56:49.227: %CAPWAP-5-SENDJOIN: sending Join Request to 192.168.100.95perform archive download capwap:/ap3g2 tar file *May 26 19:56:49.251: %CAPWAP-6-AP_IMG_DWNLD: Required image not found on AP. Downloading image from Controller. *May 26 19:57:13.263: %CDP_PD-4-POWER_OK: 15.4 W power - NEGOTIATED inline power source while the controller log cycles around the lines below: *spamApTask6: May 26 19:57:47.984: %CAPWAP-3-TX_ERR: capwap_ac_sm.c:6045 The system has failed to transmit image data request to AP 00:fe:c8:e8:e3:04 *spamApTask6: May 26 19:57:47.984: %CAPWAP-3-ENCODE_ERR: capwap_ac_sm.c:3364 The system has failed to encode Image data request (Requested Ap Image not found) to AP 00:fe:c8:e8:e3:04 *spamApTask6: May 26 19:57:47.984: %CAPWAP-3-IMAGE_DOWNLOAD_ERR3: capwap_ac_platform.c:1545 Refusing image download request from Unsupported AP 00:fe:c8:e8:e3:04 - unable to open image file /bsn/ap//ap3g2 *spamApTask6: May 26 19:57:37.733: %CAPWAP-3-DTLS_CLOSED_ERR: capwap_ac_sm.c:7331 00:fe:c8:e8:e3:04: DTLS connection closed forAP 10:0:10:10 (36401), Controller: 192:168:100:95 (5246) Echo Timer Expiry Hope this extra info is useful....This looks like a filename error, but of course, I can't get into the Linux underpinning the vWLC to sort it out :( Jim
... View more
05-26-2019
09:40 AM
Thanks Leo, I should have said before I posted, I had already rebooted the controller....and also rebuilt the controller from scratch from the OVA....still the same issue. The OVA must be OK or it wouldn't build (would it?) Thanks anyway :) Jim
... View more
05-25-2019
12:50 PM
I have put up a vWLC on VMware 6.0, running 8.8.120.0. Enabled evaluation licences (it's in my Lab), built interfaces and WLANs to use them and now I'm trying to get a 3702i AP to join it. The AP comes up, gets DHCP address OK, gets option 43 OK, goes to the Controller, establishes DTLS OK, but then the controller says it can't find the file to download to update the AP (it was running 5.5 before). The vWLC logs show this: *spamApTask5: May 25 19:40:23.708: %CAPWAP-3-DTLS_CLOSED_ERR: capwap_ac_sm.c:7331 00:fe:c8:e8:e3:04: DTLS connection closed forAP 10:0:10:10 (36401), Controller: 192:168:100:95 (5246) Echo Timer Expiry *spamApTask5: May 25 19:39:35.692: %CAPWAP-3-TX_ERR: capwap_ac_sm.c:6045 The system has failed to transmit image data request to AP 00:fe:c8:e8:e3:04 *spamApTask5: May 25 19:39:35.692: %CAPWAP-3-ENCODE_ERR: capwap_ac_sm.c:3364 The system has failed to encode Image data request (Requested Ap Image not found) to AP 00:fe:c8:e8:e3:04 *spamApTask5: May 25 19:39:35.691: %CAPWAP-3-IMAGE_DOWNLOAD_ERR3: capwap_ac_platform.c:1545 Refusing image download request from Unsupported AP 00:fe:c8:e8:e3:04 - unable to open image file /bsn/ap//ap3g2 That same sequence of messages just cycles, the AP keeps retrying but of course, nothing happens. I checked compatibility and WLC 8.8 is reckoned compatible with the AP version. I've done this hundreds of times before, with no problem, so I'm familiar with the process I guess I'm doing some thing silly....any suggestions? Thanks Jim
... View more
Labels:
Created by
Jim Blake
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
04-02-2019
12:55 AM
04-02-2019
12:55 AM
I'm familiar with using PI/CMX with 3702 APs and Halos for Hyperlocation, but there seems to be no documentation on using 2800 APs and Fastlocate. I'm not sure what positioning info is needed: I expect I will need x/y/z axis positioning within the building, but do I also need to concern myself about azimuth? Are there any good documents that provide information on this subject...google has let me down so far... Thanks Jim
... View more
Created by
Jim Blake
in Wireless and Mobility
in Wireless and Mobility
03-22-2019
03:49 AM
03-22-2019
03:49 AM
You wrote "Are there any different requirements per site for the corp/ BYOD and Guest subsets?" No, on the contrary, the requirement is identical across the estate...if it were not, then using site-specific subnets my have been an answer, though I'm not convinced thats the best way to deliver differences. However, your comments chime pretty much exactly with my thoughts, so thanks for confirming my original thoughts. Thanks Jim
... View more
Created by
Jim Blake
in Wireless and Mobility
in Wireless and Mobility
03-21-2019
11:55 PM
03-21-2019
11:55 PM
I have built a few wireless networks, based upon the 5500-series WLCs, and have made it my practice to provide a single interface on the WLC for "Corp", another single interface for "Guest", and possibly a third for "BYOD", depending on requirements. These interfaces have each been associated with a single SSID, so for example, I have all "Corp" users associating with the "Corp" SSID, and their traffic emerging from the WLC on the "Corp" interface, using a single large subnet for all users. I find this makes for simpler operation, and better address space utilisation. Now I have encountered a situation where I'm upgrading an existing Wireless network, in which the architect before me gave each site its own "Corp" "Guest" and "BYOD" interfaces, associated with their own (small) subnet. The sites all use the same set of SSIDs. Is there any benefit from doing this? From my experience (but I could be wrong!) a single subnet per SSID delivers better address utilisation, and is a whole lot simpler, both to build and to debug. You could argue that fragmenting the subnets so that each site has its own could improve user authentication and accounting, but I would dispute that: the Authentication mechanism does not rely on the IP address, so although you could say from the IP address of a user what site they were on, you are still reliant on other information to fully identify the user. Any comments or shared experience would be very welcome. Thanks Jim
... View more
- Tags:
- interfaces
- subnets
Labels:
Re: AP/Antennae for Secure Establishmen...
in Other Wireless - Mobility Subjects
05-18-2018
07:36 AM
05-18-2018
07:36 AM
Same sort of room size, but with bars on the window. I was hoping to make something that didn't advertise its presence at all, but looke like part of the wall. Also, it has to work with a 5508 WLC.
... View more
09-06-2017
12:12 PM
Hey Marce Thanks for spotting my newbie error, you got it in one! The PC was reusing its earlier leased address...a change of test sequence and the behaviour was as expected. Just shows, there's no fool like and old fool! Jim
... View more
09-05-2017
12:19 PM
I have a network with a collapsed core/distribution layer and an access layer. If I connect a PC with DHCP client enabled onto the collapsed core, it gets a lease, so I know my DHCP server, helper addresses, etc are all working OK. If I connect a trunk between Core/distribution and access, and configure an access port correctly, as expected I get a lease, so that proves the acces switch and the trunk. OK, now the weird part. If I set up DHCP snooping on the access switch ONLY, trust the port on the access switch that supports the trunk, then I still get a lease, but if I move the trunk to another port, correctly configured, but without DHCP trust, I STILL get a lease, when I expexted to get none... Config details: Core/Dist switch: no DHCP snooping config at all access switch: ! Global Config ! ip dhcp snooping vlan 10 ip dhcp snooping ! ! Per Port configuration ! interface GigabitEthernet0/1 description ##correctly configured trunk port - should support DHCP## switchport trunk encapsulation dot1q switchport trunk native vlan 20 switchport trunk allowed vlan 10,20 switchport mode trunk ip dhcp snooping trust ! interface GigabitEthernet0/2 description ##correctly configured access port - should support DHCP## switchport access vlan 10 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/3 description ## incorrectly configured trunk port - should NOT support DHCP## switchport trunk encapsulation dot1q switchport trunk native vlan 20 switchport trunk allowed vlan 10,20 switchport mode trunk ! What am I doing wrong? the setup seems to comply with all requirements, but DHCP snooping is not blocking DHCP info from the wrongly-configured trunk port Thanks Jim
... View more
Labels:
Created by
Jim Blake
in Wireless and Mobility
03-19-2020
03-19-2020
I have to debug a Cisco vWLC (version 8.8.125.0) supporting a number of
Cisco AIR-AP2802I-E-K9 APs),...
Created by
Jim Blake
in Network Access Control
08-31-2019
08-31-2019
Further info that may help: I think I've accommodated all the
requirements and caveats in
https://ww...
Created by
Jim Blake
in Network Access Control
08-31-2019
08-31-2019
I watched Jason Kunst's video on You Tube, and it inspired me to try SAW
for myself. I loaded up my ...
06-01-2019
Well, that was fun....NOT! I eventually found a community message at
https://community.cisco.com/t5/...
05-30-2019
It looks like I've bricked the AP :(All I get now is: ap:ap:ap:
bootLoading ""...: permission denied...
05-27-2019
Hi Leo,Here it is: Directory of flash:/2 -rwx 287 Jan 1 1970 00:06:43
+00:00 info3 -rwx 69953 May 25...
05-26-2019
I did some more digging, and while the AP is apparently looking for a
file called ap3g2, I found in ...
05-26-2019
Thanks Leo, I should have said before I posted, I had already rebooted
the controller....and also re...
05-25-2019
I have put up a vWLC on VMware 6.0, running 8.8.120.0. Enabled
evaluation licences (it's in my Lab),...
04-02-2019
I'm familiar with using PI/CMX with 3702 APs and Halos for
Hyperlocation, but there seems to be no d...
Created by
Jim Blake
in Wireless and Mobility
03-22-2019
03-22-2019
You wrote "Are there any different requirements per site for the corp/
BYOD and Guest subsets?"No, o...
Created by
Jim Blake
in Wireless and Mobility
03-21-2019
03-21-2019
I have built a few wireless networks, based upon the 5500-series WLCs,
and have made it my practice ...
Created by
Jim Blake
in Other Wireless - Mobility Subjects
05-18-2018
05-18-2018
Same sort of room size, but with bars on the window. I was hoping to
make something that didn't adve...
09-06-2017
Hey Marce Thanks for spotting my newbie error, you got it in one!The PC
was reusing its earlier leas...
Public Statistics
| Date Registered | 06-08-2011 11:46 AM |
| Date Last Visited | 03-20-2020 12:07 AM |
| Total Messages Posted | 107 |
| Total Helpful Votes Received | 9 |
Helpful Votes Given To
.jpg "VIP Rising star"){kind=icon}
