Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Stephan Spittaler
Stats
Member since
12-29-2009
10
Posts
13
Helpful
1
Solution
Created by
Stephan Spittaler
in Network Management
in Network Management
07-17-2019
07:34 AM
07-17-2019
07:34 AM
Thanks. I was also struggling with the not working identity detector. In fact, your applet has become the base for mine that checks for dynamically assigned VLANs and configures it as static access vlan for the critical authorization case when the RADIUS servers are not reachable after suffering from a power outage, where cached re-authentication is not working. Attached is my applet, perhaps it is of help for somebody. event manager applet AUTOMATION-CRITICAL-AUTHZ authorization bypass event syslog severity-notification pattern "MGR-5-SUCCESS" maxrun 60 action 00.00 cli command "enable" action 00.01 regexp "Authorization succeeded for client.*on Interface ([A-Za-z]+)([\/0-9]+)" "$_syslog_msg" match type int action 00.02 while 1 eq 1 action 00.03 wait 2 action 00.04 cli command "show interface $type$int switchport | inc Access Mode VLAN" action 00.05 regexp "Access Mode VLAN:\ ([0-9]+)" "$_cli_result" match assignedvlan action 00.06 if $_regexp_result eq "1" goto 01.00 action 00.07 end action 01.00 while 1 eq 1 action 01.01 wait 2 action 01.02 cli command "show run interface $type$int | i switchport access vlan" action 01.03 regexp "switchport access vlan\ +([0-9]+)" "$_cli_result" match configuredvlan action 01.04 if $_regexp_result eq "1" goto 02.00 action 01.05 end action 02.00 while 1 eq 1 action 02.01 wait 2 action 02.02 cli command "show vlan group group-name highsecure" action 02.03 regexp "vlan group highsecure \:([0-9]+)" "$_cli_result" match highsecurevlan action 02.04 if $_regexp_result eq "1" goto 99.00 action 02.05 end action 99.00 if $assignedvlan ne "$highsecurevlan" action 99.01 if $assignedvlan ne "$configuredvlan" action 99.02 syslog priority warnings msg "Configured access vlan of interface $type$int updated from $configuredvlan to $assignedvlan" action 99.03 cli command "enable" action 99.04 cli command "configure terminal" action 99.05 cli command "int $type$int" action 99.06 cli command "switchport access vlan $assignedvlan" action 99.07 cli command "end" action 99.08 cli command "write memory" action 99.09 end action 99.10 end
... View more
Created by
Stephan Spittaler
in Routing
in Routing
07-28-2016
12:15 PM
07-28-2016
12:15 PM
Hi there,
I was wondering if there is any elegant solution that allows to share the available download bandwidth (hub to spoke) of a spoke site between multiple VRFs on a DMVPN spoke router.
The scenario is as follows:
Each of my spoke routers implements multiple VRFs that should share the available site bandwidth.
In the upload direction this can be easily* achieved by binding the QoS policy to the physical interface towards the provider the DMVPN tunnels are built over.
However, in the other direction, namely hub-to-spoke, it get's more complicated.
If the per-tunnel QoS for DMVPN feature is implemented on a per tunnel basis, I would either have to allocate the overall spoke bandwidth between the different VRFs or potentially oversubscribe by instructing the hub that the available bandwidth of each of the VRF-specific tunnels towards the spoke equals to the whole spoke bandwidth.
It seems that the only possible way to achieve the utilization of the per-tunnel QoS feature so that the spokes bandwidth is shared between multiple VRFs is to build an additional "underlay" DMVPN that acts as the transport for the other VRF-specific DMVPNs.
Simplified illustration:
Provider Transport {
Underlay DMVPN (Transport for VRF-specific DMVPNs) {
VRFa-DMVPN
VRFb-DMVPN
VRFc-DMVPN
}
}
I'm also wondering if IWAN (PfR) would work in such a scenario, i.e. DMVPN (VRF-specific, PfR controlled) over DMVPN (transport).
Any feedback or ideas are highly appreciated :-)
Bfn,
Stephan
*There is also no means of control for spoke-to-spoke traffic not to potentially oversubscribe other spokes with lower access bandwidths.
... View more
Labels:
Created by
Stephan Spittaler
in Policy and Access
in Policy and Access
07-09-2015
07:02 AM
07-09-2015
07:02 AM
Dear all, I'm struggling to enforce role-based permissions between endpoints of the same SGT group when the mapping of the source endpoint is learned through SXP (non-continues SGT support between source and destination). While seeing the SGT mapping from the speaker (3560G, network ingress point) on the listener instance (3560X, network egress point), it seems that the mappings are not taken into account for actual enforcement. The enforcement is working as expected with endpoints connected to either 3560X (continues Trustsec domain). Attached is an overview of the test setup. The SGT used is 10 for both source and destination endpoint. ACL1 (SGACL) is blocking ICMP traffic and permitting all other IP. As can be seen, the mappings are learned from the 3560G on both 3560X via SXP. SXP-speaker#show cts role-based sgt-map all Active IP-SGT Bindings Information IP Address SGT Source ============================================ 172.28.135.152 10 LOCAL 172.28.135.157 10 LOCAL 172.28.135.158 10 LOCAL 172.28.135.159 10 LOCAL 172.28.135.160 10 LOCAL 172.28.135.167 10 LOCAL 172.28.135.171 10 LOCAL 172.28.135.174 10 LOCAL 172.28.135.176 10 LOCAL 172.28.135.183 10 LOCAL IP-SGT Active Bindings Summary ============================================ Total number of LOCAL bindings = 10 Total number of active bindings = 10 SXP-listener1#sh cts role-based sgt-map all Active IP-SGT Bindings Information IP Address SGT Source ============================================ 172.28.135.152 10 SXP 172.28.135.157 10 SXP 172.28.135.158 10 SXP 172.28.135.159 10 SXP 172.28.135.160 10 SXP 172.28.135.167 10 SXP 172.28.135.171 10 SXP 172.28.135.174 10 SXP 172.28.135.176 10 SXP 172.28.135.183 10 SXP IP-SGT Active Bindings Summary ============================================ Total number of SXP bindings = 10 Total number of active bindings = 10 SXP-listener2#sh cts role-based sgt-map all Active IP-SGT Bindings Information IP Address SGT Source ============================================ 172.28.135.152 10 SXP 172.28.135.157 10 SXP 172.28.135.158 10 SXP 172.28.135.159 10 SXP 172.28.135.160 10 SXP 172.28.135.167 10 SXP 172.28.135.170 10 LOCAL 172.28.135.171 10 SXP 172.28.135.174 10 SXP 172.28.135.176 10 SXP 172.28.135.183 10 SXP IP-SGT Active Bindings Summary ============================================ Total number of SXP bindings = 10 Total number of LOCAL bindings = 1 Total number of active bindings = 11 Is there anything obvious that I might be missing or has anybody already had a similar issue? Any feedback is really appreciated. Thank you and kind regards!
... View more
Labels:
Created by
Stephan Spittaler
in Wireless Security and Network Management
in Wireless Security and Network Management
12-05-2012
03:34 AM
12-05-2012
03:34 AM
Hi there, Please have a look to this post: https://supportforums.cisco.com/message/3683444. It explains how you can change the password to directly access the WCS DB. HTH --- Stephan
... View more
Created by
Stephan Spittaler
in Wireless Security and Network Management
in Wireless Security and Network Management
11-09-2012
08:33 AM
11-09-2012
08:33 AM
Hi there, We have lately come accross a limitation in the WCS search function about historical client IP address data. Background information { We have been trying to identify a specific wireless client by a its dynamic IP address at a given time. The DHCP lease time for the scope is set to 2 hours. The client connected to the wireless network multiple times throughout a day; getting three different IP addresses assigned. WCS version used is 7.0.230.0. } Now, if we try to search for any of these three IP addresses, that is not the latest IP address the client got assigned, no result is provided. There is no difference if using the Simple or Advanced Search. By running a direct query against the solidDB of the WCS we could then identify the MAC address of the client. select C.CLIENTUSERNAME, C.CLIENTMACADDRESS, C.CLIENTIPADDRESS, C.SSID, C.PROFILENAME, C.SESSIONSTARTTIME, C.SESSIONTIME from WCSDB.MODB.CLIENTSESSIONINFO C where C.CLIENTIPADDRESS = '172.26.123.4' and C.SESSIONSTARTTIME > 1352160000000; Trying to search with the MAC address of the client, now yields a result. As can be seen below, the IP address of the client altered over time, being 172.26.123.4 not the latest. Is this an expected behavior or considered a bug? (At least we could not find any known one using the bug toolkit). We would expect to not only be able to search for the latest IP address of a client but any that exists in the DB. Any comments are appreciated! Thank you and best regards, --- Stephan
... View more
Created by
Stephan Spittaler
in Policy and Access
in Policy and Access
10-04-2012
10:05 AM
10-04-2012
10:05 AM
Hi Toni, I believe you do not see any Access-Requests with the 'test-radius' on your primary ISE PDP server at all. The reason is simply that this server is already known as alive due to the regular Access-Requests for user authentication, so there is really no reason for checking its availability. Obviously this does not explain the behavior why the test request is failing. Anyhow,sniffing the RADIUS request packets from your switch towards the ISE should bring light into the darkness. If you are having a switch with software version 12.2X (Test switch: WS-C3560G-48PS, C3560-IPBASEK9-M, 12.2(53)SE2) the encrypted password contained does not match the one that you have locally configured on the switch (You may want to use Wireshark as proof). On the other hand, if you are having a switch with software version 15.0X (Test switch: WS-C3560X-48P, C3560E-UNIVERSALK9-M, 15.0(1)SE3) the encrypted password contained does match the one that you have locally configured. Side node: It will not work with an MD5 encrypted password, so you have to use ' username test-radius password '. However, this whole behavior does not affect user authentication at all and is hence only cosmetic. For the switches itself it only matters if it gets a response from the ISE (RADIUS) to know if it is alive or not. Hi Tarik, Testing with the ' test aaa... ' command does not result in the 'Authentication Failure', that Toni had mentioned. Kind regards and hth, Stephan *Please rate helpful posts*
... View more
Re: Custom DB password in WCS 7.0.220.0
in Wireless Security and Network Management
07-25-2012
01:09 AM
07-25-2012
01:09 AM
Hi Amjad, No, I'm afraid it won't. This was also my first approach, but replacing the dbadmin.sh file will not help as the script itself is the same for both versions and only links to other resources. You really have to change the encrypted password in the dbopts.db file using the dbadmin utility under version 6.x and copy the file over to the version 7.x directory. -- Stephan
... View more
Re: Custom DB password in WCS 7.0.220.0
in Wireless Security and Network Management
07-25-2012
12:02 AM
07-25-2012
12:02 AM
Hi all, I hope not too many have followed my approach yet as it comprises a problem. That is leaving the dbopts.db file (that contains the encrypted password for the 'dba' user) in the directory /WCS7.0.230.0/webnms/db/eval_kit/standalone unmodified which will no longer allow to start the database server if the WCS service is re-started due to invalid credentials or mismatch between database user record and the password in dbopts.db file. You would find similar messages as shown below in the logfile solmsg.out [root@WCS standalone]$ more solmsg.out 23.07 14:36:52 User 'DBA' was disconnected abnormally, user id 39, machine id WCS. 23.07 14:36:52 User 'DBA' was disconnected abnormally, user id 53, machine id WCS. 23.07 14:36:52 Memory allocation size has fallen below 1483MB. Current size: 1483647331 bytes. Number of allocations: 12465. 23.07 14:36:56 User 'DBA' tried to connect from WCS with an illegal username or password. 23.07 14:38:04 User 'DBA' tried to connect from WCS with an illegal username or password. 23.07 14:46:17 User 'DBA' tried to connect from WCS with an illegal username or password. 23.07 14:49:52 User 'DBA' tried to connect from WCS with an illegal username or password. 23.07 15:03:56 Server shut down by either ALT+F4 or kill command ------------------------------------------------------------ Mon Jul 23 15:09:36 2012 Version: 04.50.0184 Operating system: Linux 2.6.18 ix86 MT Solid BoostEngine - v.04.50.0184 (Linux 2.6.18 ix86 MT) (C) Copyright Solid Information Technology Ltd 1993-2010 Using license file /data/WCS/WCS7.0.220.0/webnms/db/eval_kit/standalone/solid.lic License for Solid BoostEngine 4.x, Standard Edition Development license Serial number: 416000266 4 processors 100 concurrent connections 25 threads SmartFlow option HotStandBy option 1 master databases 5 replica databases Accelerator option Diskless replica option Licensed to: Cisco Systems WCS WNBU Current working directory changed to /data/WCS/WCS7.0.220.0/webnms/db/eval_kit/standalone Using configuration file /data/WCS/WCS7.0.220.0/webnms/db/eval_kit/standalone/solid.ini Starting roll-forward recovery, please wait ... Recovery of 2242 transactions successfully completed 23.07 15:09:57 Listening of 'TCP/IP localhost 1315' started. 23.07 15:09:58 Solid BoostEngine started at Mon Jul 23 15:09:58 2012 23.07 15:09:58 Database started. 23.07 15:09:58 Memory allocation size has exceeded 1102MB. Current size: 1102911836 bytes. Number of allocations: 738. 23.07 15:09:58 User 'DBA' tried to connect from WCS with an illegal username or password. 23.07 15:14:58 User 'DBA' tried to connect from WCS with an illegal username or password. 23.07 15:19:58 User 'DBA' tried to connect from WCS with an illegal username or password. 23.07 15:24:58 User 'DBA' tried to connect from WCS with an illegal username or password. 23.07 15:29:58 User 'DBA' tried to connect from WCS with an illegal username or password. 23.07 15:34:58 User 'DBA' tried to connect from WCS with an illegal username or password. In order to avoid that problem please follow the steps below: Please note, that the first two steps are only necessary if you did already change the 'dba' user password with the SQL statement ''ALTER USER dba IDENTIFIED BY ") and only replacing the dbopts.db file does not resolve the issue of mismatching credentials. 1) Uninstall the WCS 7.0.220.0 installation 2) Conduct a fresh installation of WCS 7.0.220.0 (or successor version 7.0.230.0). Restore from an existing database backup (http://www.cisco.com/en/US/docs/wireless/wcs/7.0/configuration/guide/7_0main.html#wp1077207). 3) Stop the WCS 7.0.220.0 (or 7.0.230.0) service Update (2012/07/25, 08:18 UTC): If the database server cannot be stopped by using the /opt/WCS7.0.30.0/StopWCS script, navigate to the /WCS7.0.230.0/webnms/db/bin directory and connect to the database server with the command "./solcon 'tcp localhost 1315' dba ". Issue the command "shutdown" in order to stop the database service. You will be automatically disconnected from the database server. Stopping the WCS service by using the /opt/WCS7.0.30.0/StopWCS script will now work and you can proceed with the next step. 4) Conduct a fresh installation of WCS 6.0.202.0. Start the WCS 6.0.202.0 service. Run the dbadmin.sh utility and change the database password for the user 'dba' (./dbadmin.sh password ). This will update both the corresponding user record in the database itself as well as the dbopts.db file. 5) Stop the WCS 6.0.202.0 service. Start the WCS 7.0.220.0 (or 7.0.230.0) service. 6) Run the SQL statement as described in my previous post. 7) Make a backup of the dbopts.db file of the v7 installation and replace it with the one of the v6 installation. [root@WCSstandalone]# pwd /data/WCS/WCS7.0.230.0/webnms/db/eval_kit/standalone [root@WCS standalone]# cp dbopts.db dbopts.db.backup-v7 [root@WCS standalone]# rm -rf dbopts.db [root@WCS standalone]# cp /data/WCS/WCS6.0.202.0/webnms/db/eval_kit/standalone/dbopts.db . 8) Restart (Stop and start) the WCS 7.0.220.0 (or 7.0.230.0) service. By doing so, the WCS will continue working without any problems and direct database access is possible. [root@WCS bin]# /opt/WCS7.0.230.0/WCSStatus Health Monitor is running. WCS is running. Database server is running Apache server is running [root@WCS bin]# ./solsql -e "select * from SYS_USERS" 'tcp localhost 1315' dba Solid SQL Editor (teletype) v.04.50.0188 (C) Copyright Solid Information Technology Ltd 1993-2010 Connected to 'tcp localhost 1315'. ID NAME TYPE PRIV PASSW PRIORITY PRIVATE LOGIN_CATALOG -- ---- ---- ---- ----- -------- ------- ------------- 1 DBA USER 1 NULL 0 WEBNMSDB 1 rows fetched. SOLID SQL Editor exiting. Please apologize my delayed update to this post! HTH --- Stephan
... View more
Created by
Stephan Spittaler
in Wireless Security and Network Management
in Wireless Security and Network Management
07-13-2012
10:27 AM
07-13-2012
10:27 AM
Hi Patrick, Update (2012/07/26, 13:07 UTC): Please mind my add-on to this post below. For a properly working WCS service it is also required to update the dbopts.db file, that contains the password for the user dba in encrypted format. Otherwise the WCS service will fail connecting to the solidDB. Fortune favors the brave! The password for the DB user 'dba' can be easily changed by using the "Diagnostics" of the WCS, that are accessible through " https:// /webacs/wcsDiag.do". Choose "DB Update" or use the direct link " https:// /webacs/dbUpdateAction.do" and enter the SQL statement ''ALTER USER dba IDENTIFIED BY ". Then click on "Run Update" to have the password changed. After doing so, you can run any queries directly from the server CLI (See below). [root@WCS bin]# more /ftproot/sqlquery.txt select * from WCSDB.MODB.MACVENDOR where MACOUI = '00:00:01'; [root@WCS bin]# pwd /data/WCS/WCS7.0.220.0/webnms/db/bin [root@WCS bin]# ./solsql 'tcp localhost 1315' dba dba /ftproot/sqlquery.txt Solid SQL Editor (teletype) v.04.50.0184 (C) Copyright Solid Information Technology Ltd 1993-2010 Connected to 'tcp localhost 1315'. select * from WCSDB.MODB.MACVENDOR where MACOUI = '00:00:01' MACOUI COMPANY_ID ------ ---------- 00:00:01 XEROX CORPORATION 1 rows fetched. SOLID SQL Editor exiting. Please note that the table 'WCSDB.MODB.MACVENDOR' is a custom table but obviously queries can be run for any other table in the WCS DB as well. HTH --- Stephan
... View more
Re: Help with WLC 4402 and Ap 1242AG
in Wireless and Mobility
12-29-2009
05:50 AM
12-29-2009
05:50 AM
I had a similar issue with an AP not joining a controller which has recently been upgraded to version 6.0.182.0. While debugging I realized the message "Discarding discovery request in LWAPP from AP supporting CAPWAP" on the controller... While converting to autonomous mode and back to lightweight would resolve the issue, probably the easier way is to boot the AP with no network connection and sourced through an external power supply, deleting the lightweight images from the flash (leaving the recovery image on) and reloading the AP from the console - Clearing all the LWAPP config and setting the params manually - é voilà: registering at the controller and downloading its new lightweight image... Still, this is no solution for many, possible remote, APs, but as a workaround it's good enough.
... View more
Created by
Stephan Spittaler
in Network Management
07-17-2019
07-17-2019
Thanks. I was also struggling with the not working identity detector. In
fact, your applet has becom...
Created by
Stephan Spittaler
in Routing
07-28-2016
07-28-2016
Hi there, I was wondering if there is any elegant solution that allows
to share the available downlo...
Created by
Stephan Spittaler
in Policy and Access
07-09-2015
07-09-2015
Dear all,I'm struggling to enforce role-based permissions between
endpoints of the same SGT group wh...
Created by
Stephan Spittaler
in Wireless Security and Network Management
12-05-2012
12-05-2012
Hi there,Please have a look to this post:
https://supportforums.cisco.com/message/3683444.It explain...
11-09-2012
Hi there,We have lately come accross a limitation in the WCS search
function about historical client...
10-04-2012
Hi Toni,I believe you do not see any Access-Requests with the
'test-radius' on your primary ISE PDP ...
Created by
Stephan Spittaler
in Wireless Security and Network Management
07-25-2012
07-25-2012
Hi Amjad,No, I'm afraid it won't. This was also my first approach, but
replacing the dbadmin.sh file...
Created by
Stephan Spittaler
in Wireless Security and Network Management
07-25-2012
07-25-2012
Hi all,I hope not too many have followed my approach yet as it comprises
a problem. That is leaving ...
Created by
Stephan Spittaler
in Wireless Security and Network Management
07-13-2012
07-13-2012
Hi Patrick,Update (2012/07/26, 13:07 UTC):Please mind my add-on to this
post below.For a properly wo...
Created by
Stephan Spittaler
in Wireless and Mobility
12-29-2009
12-29-2009
I had a similar issue with an AP not joining a controller which has
recently been upgraded to versio...
Public Statistics
| Date Registered | 12-29-2009 04:57 AM |
| Date Last Visited | 07-24-2019 06:25 AM |
| Total Messages Posted | 10 |
| Total Helpful Votes Received | 13 |
