Hi guys. I have ACS migrated to ISE 2.7.0.356 Everything works corerctly. Now. I'm trying to setup ISE to assign static IP to VPN session whenever particular user connected. (this was working well @ EOL ACS). I've done following steps @ISE: - policy - results - authorization - authorization profiles - create new policy - "Permit Access - STATIC IP RA VPN" - type - ACCEPT - Access Type = ACCESS_ACCEPT, Framed-IP-Address = Radius:Framed-IP-Address - administration - groups - user identity groups - create new group "STATIC IP RA VPN group" - description "group for client who need IP assigned by AAA" - assign user ID who needs static IP assigned (my VPN ID for test) to group "STATIC IP RA VPN group" - administration - identity management - settings - new (+) - Atribute name "StaticIP" - description "static IP assigned by AAA" - type - IP - save - administration - identity - "my VPN ID" double check that "STATIC IP RA VPN group" is topgroup from "user groups" - setup desired IP for user's (my account) session. finnaly, whenever session connected I see RA VPN up and running but I got IP from DHCP pool but not static one I assigned to my ISE account. Could you suggest what could be wrong? Thank you. ... View more

Hi guys.   Just general question. Could somebody explain why dynamic routing OSPF, EGRP, BGP works w/ problem via route base s2s VPN but not via policy base firewall?   Thank you. ... View more

Hi guys.   I have following schema: cisco router as DHCP server - vlan12 (guest wifi) <-> - dot11 0.70 - dot11 0 - bvi70- client cisco 881w client got IP address 192.168.172.52 from server. DHCP lease expires in 1:41 PM (13:41) Current time 11:41:21 +++++++++++++++++ gate#sh clo 11:41:21.714 EST Thu Sep 4 2019 gate# gate#sh ip dhcp bin | i 172.5 192.168.172.52 0164.00f1.77b7.4a Sep 04 2019 1:41 PM Automatic gate# +++++++++++++++++   from router ARP cache I see ARP entry for 192.168.172.52 will expire in 32 minutes unless renewal (red bellow):    +++++++++++++++++ gate#sh arp detail | s ARP entry for 192.168.172.5 ARP entry for 192.168.172.52, link type IP. Dynamic, via Vlan12, last updated 1 minute ago. Encap type is ARPA, hardware address is 6400.f177.b74a, 6 bytes long. ARP subblocks: * Dynamic ARP Subblock Entry will be refreshed in 33 minutes and 37 seconds. It has 2 chances to be refreshed before it is purged. Entry is complete. * IP ARP Adjacency Adjacency (for 192.168.172.52 on Vlan12) was installed. ++++++++++++++++++++++ in 30 minutes router clear was trying to refresh arp and in to unsuccessfull attempts ++++++++++++++++++++++ gate#sh arp detail | s ARP entry for 192.168.172.5 ARP entry for 192.168.172.52, link type IP. Dynamic, via Vlan12, last updated 36 minutes ago. Encap type is ARPA, hardware address is 6400.f177.b74a, 6 bytes long. ARP subblocks: * Dynamic ARP Subblock Entry will be purged in 0 minute and 1 second. Entry is complete. * IP ARP Adjacency Adjacency (for 192.168.172.52 on Vlan12) was installed. gate# gate# gate# gate#sh arp detail | s ARP entry for 192.168.172.5 ARP entry for 192.168.172.52, link type IP. Incomplete, via Vlan12, last updated 0 minute ago. Encap type is ARPA, hardware address is 0000.0000.0000, 0 bytes long. ARP subblocks: * Dynamic ARP Subblock Entry is incomplete. gate# gate#sh arp | i 172.5 Internet 192.168.172.52 0 Incomplete ARPA gate# ++++++++++++++++++++++ how to syncronize DHCP lease with ARP cache? Lease still ok for 2 hours but arp entry just for 32 minutes. Could you guys suggest? Thank you. ... View more

Hi guys. My schemma looks like: cisco router (DHCP ---- non cisco wireless AP -- cisco wireless AP) I'm configureing cisco wireless access point (ap801) to get IP from DHCP server (cisco router) via non-cisco AP. This non cisco AP perworming just WPA2&PSK and no filtering: ++++++++++++++++++++ root@ap:/home/sam# iptables -vnL Chain INPUT (policy ACCEPT 73 packets, 5877 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 59 packets, 7184 bytes) pkts bytes target prot opt in out source destination root@ ++++++++++++++++++++ from this non-cisco AP (MAC c24a.0040.9f36) I see cisco wireless AP (MAC 2c54.2dba.136e) successfully joined: ++++++++++++++++++++ root@ap:/home/sam# iwinfo wlan0-1 ass 2C:54:2D:BA:13:6E -38 dBm / -95 dBm (SNR 57) 300 ms ago RX: 144.4 MBit/s, MCS 15, 20MHz 896 Pkts. TX: 1.0 MBit/s 4 Pkts. expected throughput: unknown root@ap:/home/sam# ++++++++++++++++++++ I see same from cisco cisco wireless AP ++++++++++++++++++++ ap#sh dot11 ass all | i State|c24a|Strength Address : c24a.0040.9f36 Name : NONE State : Assoc Parent : - Signal Strength : -36 dBm Connected for : 1268 seconds ap# ++++++++++++++++++++ Cisco AP config looks like: ++++++++++++++++++++ dot11 ssid a81m-guest vlan 20 authentication open authentication key-management wpa version 2 wpa-psk ascii 0 siper-puper-password ! bridge irb ! interface Dot11Radio0 no ip address ! encryption vlan 20 mode ciphers aes-ccm ! ssid a81m-guest ! antenna gain 0 station-role workgroup-bridge universal c24a.0040.9f36 ! interface Dot11Radio0.20 encapsulation dot1Q 20 native bridge-group 1 ! interface GigabitEthernet0 description the embedded AP GigabitEthernet 0 is an internal interface connecting AP with the host router no ip address ! interface GigabitEthernet0.20 encapsulation dot1Q 20 native bridge-group 1 ! interface BVI1 mac-address 00ed.b184.2174 ip address dhcp ++++++++++++++++++++ finnally cisco wireless AP int bvi 1 not assigned IP from cisco router DHCP ++++++++++++++++++++ ap#sh ip int bri | i bvi BVI1 unassigned YES DHCP up up ap# ++++++++++++++++++++ but I see IP has been assigned by cisco router DHCP server: ++++++++++++++++++++ gate#sh ip dhcp bin -= ommited for briefly=- 192.168.172.50 0063.6973.636f.2d30. Aug 27 2019 01:07 PM Automatic 3065.642e.6231.3834. 2e32.3137.342d.4256. 31 gate# ++++++++++++++++++++ whenever run debug dhcp at cisco wireles AP and debug ip dhcp packets at cisco DHCP server I've fount DHCP serverr got discover and sent offer messages proposing IP 192.168.172.50 in this case ++++++++++++++++++++ Aug 27 13:33:14 gate.sidko.org 070013: Aug 27 13:33:14.078: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d30.3065.642e.6231.3834.2e32.3137.342d.4256.31 on interface Vlan12. Aug 27 13:33:14 gate.sidko.org 070020: Aug 27 13:33:14.078: DHCPD: Sending DHCPOFFER to client 0063.6973.636f.2d30.3065.642e.6231.3834.2e32.3137.342d.4256.31 (192.168.172.50).DHCPD: Setting only requested parameters ++++++++++++++++++++ but cisco wireless client doesn't get them and sending discover again ++++++++++++++++++++ *Mar 1 00:41:32.687: DHCP: SDiscover attempt # 3 for entry: *Mar 1 00:41:32.687: Temp IP addr: 0.0.0.0 for peer on Interface: BVI1 *Mar 1 00:41:32.687: Temp sub net mask: 0.0.0.0 *Mar 1 00:41:32.687: DHCP Lease server: 0.0.0.0, state: 3 Selecting *Mar 1 00:41:32.687: DHCP transaction id: 124F *Mar 1 00:41:32.687: Lease: 0 secs, Renewal: 0 secs, Rebind: 0 secs *Mar 1 00:41:32.687: Next timer fires after: 00:00:04 *Mar 1 00:41:32.687: Retry count: 3 Client-ID: cisco-00ed.b184.2174-BV1 *Mar 1 00:41:32.687: Client-ID hex dump: 636973636F2D303065642E623138342E *Mar 1 00:41:32.687: 323137342D425631 ap# *Mar 1 00:41:32.687: Hostname: ap *Mar 1 00:41:32.687: DHCP: SDiscover placed class-id option: 436973636F204150383031 *Mar 1 00:41:32.687: DHCP: SDiscover: sending 302 byte length DHCP packet *Mar 1 00:41:32.687: DHCP: SDiscover 302 bytes *Mar 1 00:41:32.687: B'cast on BVI1 interface from 0.0.0.0 ap# *Mar 1 00:41:36.687: DHCP: QScan: Timed out Selecting state ap#%Unknown DHCP problem.. No allocation possible ++++++++++++++++++++ Could you guys help? Thank you. ... View more

Hi guys. I'm configuring uWGB at cisco 891W. AP module successfully connected to remote AP:   ++++++++++++++++++++ ap(config)#do sh dot11 ass all | i State|Connected State : Assoc Parent : - Signal Strength : -37 dBm Connected for : 1863 seconds ap(config)# ++++++++++++++++++++   int bvi 1 configured to get IP from DHCP   ++++++++++++++++++++ ap(config-if)#do sh runn int bvi 1 Building configuration... Current configuration : 89 bytes ! interface BVI1 mac-address 00ed.b184.2174 ip address dhcp client-id Dot11Radio0 end ++++++++++++++++++++   however IP has not assigned to interface BVI1   ++++++++++++++++++++ ap(config-if)#do sh ip int bri | i BVI BVI1 unassigned YES DHCP up up ap(config-if)#end ++++++++++++++++++++   same time I've found right IP 192.168.172.50 assigned to client w/ MAC 00ed.b184.2174 (this is ap's BVI1. see above)   ++++++++++++++++++++ gate-dhcp#sh ip dhcp bin | i ed Bindings from all pools not associated with VRF: 192.168.172.50 0100.edb1.8421.74 Aug 25 2019 03:03 AM Automatic gate-dhcp# ++++++++++++++++++++   Could somebody explain why? wireless link works correctly because whenever I assigned same IP 192.168.172.50 I got from DHCP server manually at access point interface BVI1 ++++++++++++++++++++ ap(config)#do sh runn int bvi1 interface BVI1 mac-address 00ed.b184.2174 ip address 192.168.172.50 255.255.255.248 end ++++++++++++++++++++   I can reach stations behind uWBG (bellow). ++++++++++++++++++++ ap(config)#do pin 192.168.172.197 re 10 Type escape sequence to abort. Sending 10, 100-byte ICMP Echos to 192.168.172.197, timeout is 2 seconds: !!!!!!!!!! Success rate is 100 percent (10/10), round-trip min/avg/max = 1/3/4 ms ap(config)# ++++++++++++++++++++   complete ap configuration attached.   Thank you in advance. ... View more

Hi guys. I'm configuring cisco 891w universal workgroup group bridge mode to non-cisco access point (MAC c24a.0040.9f36). This non-cisco access point has no filtering or other limitations. (it just performing WPA2/PSK)   c891w access point module successfully associated & authenticated with non-cisco access point ++++++++++++++++++++ gate-ap(config-if)#int do 0 gate-ap(config-if)#do sh ip int bri gate-ap(config-if)# no ssid a81m-guest gate-ap(config-if)# gate-ap(config-if)# ssid a81m-guest gate-ap(config-if)# *Mar 1 00:17:06.903: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up *Mar 1 00:17:06.907: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP c24a.0040.9f36 [None WPAv2 PSK] *Mar 1 00:17:07.903: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up *Mar 1 00:17:13.179: %DHCP-6-ADDRESS_ASSIGN: Interface BVI70 assigned DHCP address 192.168.172.54, mask 255.255.255.248, hostname gate-ap gate-ap(config-if)# ++++++++++++++++++++ leased IP assigned to access point int bvi70 ++++++++++++++++++++ gate-ap#sh ip int bri Interface IP-Address OK? Method Status Protocol BVI1 10.2.2.2 YES NVRAM up up BVI70 192.168.172.54 YES DHCP up up Dot11Radio0 unassigned YES NVRAM up up Dot11Radio0.70 unassigned YES unset up up Dot11Radio1 unassigned YES NVRAM administratively down down GigabitEthernet0 unassigned YES NVRAM up up GigabitEthernet0.70 unassigned YES unset up up Virtual-Dot11Radio0 unassigned YES unset up up Virtual-Dot11Radio0.70 unassigned YES unset up up gate-ap# ++++++++++++++++++++ from router module I see embedded access point MACs have been learned via interface wlan-g 0, native vlan70 ++++++++++++++++++++ gate#sh mac-address-table Destination Address Address Type VLAN Destination Port ------------------- ------------ ---- -------------------- 7426.ac22.7930 Self 1 Vlan1 7426.ac22.7930 Self 10 Vlan10 7426.ac22.7930 Self 60 Vlan60 0000.0ce0.cff4 Dynamic 70 Wlan-GigabitEthernet0 00ed.b184.2174 Dynamic 70 Wlan-GigabitEthernet0 2c54.2dba.136e Dynamic 70 Wlan-GigabitEthernet0 7426.ac22.7930 Self 70 Vlan70 74a2.e6fd.dfe0 Dynamic 70 Wlan-GigabitEthernet0 gate# ++++++++++++++++++++ where MAC 00ed.b184.2174 is access point BVI70 ++++++++++++++++++++ gate-ap#sh int bvi70 | i up|bia BVI70 is up, line protocol is up Hardware is BVI, address is 00ed.b184.2174 (bia 2c54.2dba.136e) gate-ap# ++++++++++++++++++++ So, I assume. logical interconnection between router and access point modules setup correctly. from router module I see same subnet IP (192.168.172.50) assigned to interface vlan 70 (because c891w access point module interface bvi 70 has ip helper pointing to DHCP server behing non-cisco DHCP access point) ++++++++++++++++++++ 000039: *Jun 14 08:29:37: %DHCP-6-ADDRESS_ASSIGN: Interface Vlan70 assigned DHCP address 192.168.172.50, mask 255.255.255.248, hostname gate gate# ++++++++++++++++++++ from access point module I can ping dfault gateway (192.168.172.49) ++++++++++++++++++++ gate-ap#ping 192.168.172.49 re 10 Type escape sequence to abort. Sending 10, 100-byte ICMP Echos to 192.168.172.49, timeout is 2 seconds: !!!!!!!!!! Success rate is 100 percent (10/10), round-trip min/avg/max = 1/2/4 ms gate-ap# ++++++++++++++++++++ but from router module I cannot ping default gateway 192.168.172.49 but I can ping access point module 192.168.172.54 ++++++++++++++++++++ gate#p 192.168.172.49 re 4 Type escape sequence to abort. Sending 4, 100-byte ICMP Echos to 192.168.172.49, timeout is 2 seconds: .... Success rate is 0 percent (0/4) gate#p 192.168.172.54 re 4 Type escape sequence to abort. Sending 4, 100-byte ICMP Echos to 192.168.172.54, timeout is 2 seconds: !!!! Success rate is 100 percent (4/4), round-trip min/avg/max = 1/1/4 ms gate# ++++++++++++++++++++   even adding static arp entry to access point module bridge 70 for router module vlan 70 (and same static arp from vla70 toward to bvi70) doesen't work. I still cannot ping default gateway from 891w router interface   ++++++++++++++++++++ gate#sh int vlan 70 | i bia Hardware is EtherSVI, address is 7426.ac22.7930 (bia 7426.ac22.7930) gate# gate-ap(config)#bridge 70 address 7426.ac22.7930 forward gi 0 gate-ap(config)# gate-ap(config)#do sh ip arp | i 49 Internet 192.168.172.49 128 74a2.e6fd.dfe0 ARPA BVI70 gate-ap(config)# gate-ap(config)#do sh ip arp | i 49 Internet 192.168.172.49 128 74a2.e6fd.dfe0 ARPA BVI70 gate-ap(config)# gate(config)#arp 192.168.172.49 7426.ac22.7948 arpa gate(config)# gate(config)#do pin 192.168.172.49 re 4 Type escape sequence to abort. Sending 4, 100-byte ICMP Echos to 192.168.172.49, timeout is 2 seconds: .... Success rate is 0 percent (0/4) gate(config)# ++++++++++++++++++++ Could somebody suggest what I'm doing wrong or how to fix it? c891w router and access point modules configuration attached. Thank you. ... View more