Guys, I've read the documents provided by Cisco here, but none have really given me the direct answer I am looking for.  Was hoping that you guys could possibly shed some light. Do the CPU ACLs have to contain permit entries for Mobility traffic (WLC-WLC) and CAPWAP/LWAPP (WLC-AP) traffic? Are the CPU ACLs applied to the service-port interface? ... View more

Hey Wireless Team Members! I have a quick question on what is the best option for setting up some form of HA for a small setup I am running into.  Before we even proceed further - I KNOW the code is soooo old!  But that is not an option due to the situation at the present moment. So no upgrades can be done or modifications to existing WiFi Setup!  The company is completely aware of the non-synchronization and overall administrative overhead this is going to take to manage. The existing setup is that of a single WLC 2504 running 7.0.220.0 and supporting less than 6 Access Points.  I am unsure if the AP's are setup in Local or H-REAP mode, but for the moment I am going to assume H-REAP; I will know sooner than later. The company is purchasing an additional WLC 2504, which will act as a Secondary WLC.  The purpose of this Secondary WLC is solely meant for immediate replacement/swap for the Primary WLC in the event the Primary a major malfunction, crash, or problem.   So with that being said, I figured my only real options are as followed. But please, correct me if I am wrong! Option#1 - Just setup and configure the Secondary WLC to replicate everything in the existing Primary today.  Once the current running configurations are loaded onto the Secondary WLC, put it aside (not physically connected to the network) and if the day ever comes where it will need to be used - just take out the Primary and rack/cable up the Secondary.  In this case, I am assuming the Secondary WLC would configured identically to that of the Primary, correct?  Meaning same interfaces, same IP Addressees, same hostname, and etc.  Option#2 - Setup and configure the Secondary WLC as a "Backup Controller".  Have this racked and cabled permanently on the network. This way if there is ever an issue with the Primary WLC, failover to the Secondary WLC will be automatic (in the sense) and not contain any downtime for the physical setup portion of the Secondary WLC. This seems like the preferred setup to me. My only question is, how would the Secondary WLC be configured for its role as the replacement? Unlike Option#1 above, would all of the configurations need to be different than that of the Primary WLC? Meaning the interface (MGMT/Dynamic) configurations on this type of setup require different IP Addresses, different hostnames, and etc? What configurations would need to be different from that of the Primary WLC in going with Option#2?   With all this being said, please respond accordingly and/or let me know of any recommends the Wireless Experts out there may have!  As always, your help is greatly appreciated and I will certainly use the rating system!   ... View more

Hey guys-   We are starting to stand up ACS 5.6 into our network for network access.  When a user initially logs in, ACS will make a RADIUS call out to CyberArk/SecureNet (cloud based two-factor) and then receive a token, which the user uses to login. A question comes to mind, looking for some recommendations/suggestions.   With ACS, how can we handle service accounts?  Service accounts such as Cisco Prime and Orion Monitoring, which are appliances used to search the network.  These accounts cannot obtain a token obviously, so is there a way to setup ACS to enforce something like this on network devices (mainly IOS/NX-OS): -  If a regular user - authenticate via SecureNet -  If a service account - utilize X to login (something to avoid having to get a token)     ... View more