Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Andriy Sidko
Stats
Member since
04-06-2010
77
Posts
5
Helpful
1
Solution
Created by
Andriy Sidko
in Other Network Architecture Subjects
in Other Network Architecture Subjects
09-05-2019
09:25 AM
09-05-2019
09:25 AM
Hi guys. I have following schema: cisco router as DHCP server - vlan12 (guest wifi) <-> - dot11 0.70 - dot11 0 - bvi70- client cisco 881w client got IP address 192.168.172.52 from server. DHCP lease expires in 1:41 PM (13:41) Current time 11:41:21 +++++++++++++++++ gate#sh clo 11:41:21.714 EST Thu Sep 4 2019 gate# gate#sh ip dhcp bin | i 172.5 192.168.172.52 0164.00f1.77b7.4a Sep 04 2019 1:41 PM Automatic gate# +++++++++++++++++ from router ARP cache I see ARP entry for 192.168.172.52 will expire in 32 minutes unless renewal (red bellow): +++++++++++++++++ gate#sh arp detail | s ARP entry for 192.168.172.5 ARP entry for 192.168.172.52, link type IP. Dynamic, via Vlan12, last updated 1 minute ago. Encap type is ARPA, hardware address is 6400.f177.b74a, 6 bytes long. ARP subblocks: * Dynamic ARP Subblock Entry will be refreshed in 33 minutes and 37 seconds. It has 2 chances to be refreshed before it is purged. Entry is complete. * IP ARP Adjacency Adjacency (for 192.168.172.52 on Vlan12) was installed. ++++++++++++++++++++++ in 30 minutes router clear was trying to refresh arp and in to unsuccessfull attempts ++++++++++++++++++++++ gate#sh arp detail | s ARP entry for 192.168.172.5 ARP entry for 192.168.172.52, link type IP. Dynamic, via Vlan12, last updated 36 minutes ago. Encap type is ARPA, hardware address is 6400.f177.b74a, 6 bytes long. ARP subblocks: * Dynamic ARP Subblock Entry will be purged in 0 minute and 1 second. Entry is complete. * IP ARP Adjacency Adjacency (for 192.168.172.52 on Vlan12) was installed. gate# gate# gate# gate#sh arp detail | s ARP entry for 192.168.172.5 ARP entry for 192.168.172.52, link type IP. Incomplete, via Vlan12, last updated 0 minute ago. Encap type is ARPA, hardware address is 0000.0000.0000, 0 bytes long. ARP subblocks: * Dynamic ARP Subblock Entry is incomplete. gate# gate#sh arp | i 172.5 Internet 192.168.172.52 0 Incomplete ARPA gate# ++++++++++++++++++++++ how to syncronize DHCP lease with ARP cache? Lease still ok for 2 hours but arp entry just for 32 minutes. Could you guys suggest? Thank you.
... View more
- Tags:
- ARP cache DHCP
Labels:
Created by
Andriy Sidko
in Switching
in Switching
08-28-2019
07:11 PM
08-28-2019
07:11 PM
Hi Giuseppe. Thank you for your email. iptables is nor filtering any packets because it's it flush (permit any) state. All chains (input, output, forward, pre&post routing in ACCEPT state for all tables: filter, nat and mangle Moreover, whenever I'm connecting my android phone to "a81m-guest" SSID I got right IP, wireshark screenshot attached. (attachment name DHCP-client-android-phone) Just regular DHCP process: discover, offer, request, acknowledgment. But.... Cisco 891W router acting as uWGB to thirst party AP and requesting IP from DHCP server (cisco 2921) got in stack in offer, no request (attachment file name: DHCP-client-cisco-891w) Anyway, do you have fresh idea what it could be? p.s. LAB is need to do unusual things no well known ones. :) Actually I just need to connect nearest building to corporate network by using universal WBG. Thank you Giuseppe
... View more
Created by
Andriy Sidko
in Switching
in Switching
08-27-2019
10:43 AM
08-27-2019
10:43 AM
Hi guys. My schemma looks like: cisco router (DHCP ---- non cisco wireless AP -- cisco wireless AP) I'm configureing cisco wireless access point (ap801) to get IP from DHCP server (cisco router) via non-cisco AP. This non cisco AP perworming just WPA2&PSK and no filtering: ++++++++++++++++++++ root@ap:/home/sam# iptables -vnL Chain INPUT (policy ACCEPT 73 packets, 5877 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 59 packets, 7184 bytes) pkts bytes target prot opt in out source destination root@ ++++++++++++++++++++ from this non-cisco AP (MAC c24a.0040.9f36) I see cisco wireless AP (MAC 2c54.2dba.136e) successfully joined: ++++++++++++++++++++ root@ap:/home/sam# iwinfo wlan0-1 ass 2C:54:2D:BA:13:6E -38 dBm / -95 dBm (SNR 57) 300 ms ago RX: 144.4 MBit/s, MCS 15, 20MHz 896 Pkts. TX: 1.0 MBit/s 4 Pkts. expected throughput: unknown root@ap:/home/sam# ++++++++++++++++++++ I see same from cisco cisco wireless AP ++++++++++++++++++++ ap#sh dot11 ass all | i State|c24a|Strength Address : c24a.0040.9f36 Name : NONE State : Assoc Parent : - Signal Strength : -36 dBm Connected for : 1268 seconds ap# ++++++++++++++++++++ Cisco AP config looks like: ++++++++++++++++++++ dot11 ssid a81m-guest vlan 20 authentication open authentication key-management wpa version 2 wpa-psk ascii 0 siper-puper-password ! bridge irb ! interface Dot11Radio0 no ip address ! encryption vlan 20 mode ciphers aes-ccm ! ssid a81m-guest ! antenna gain 0 station-role workgroup-bridge universal c24a.0040.9f36 ! interface Dot11Radio0.20 encapsulation dot1Q 20 native bridge-group 1 ! interface GigabitEthernet0 description the embedded AP GigabitEthernet 0 is an internal interface connecting AP with the host router no ip address ! interface GigabitEthernet0.20 encapsulation dot1Q 20 native bridge-group 1 ! interface BVI1 mac-address 00ed.b184.2174 ip address dhcp ++++++++++++++++++++ finnally cisco wireless AP int bvi 1 not assigned IP from cisco router DHCP ++++++++++++++++++++ ap#sh ip int bri | i bvi BVI1 unassigned YES DHCP up up ap# ++++++++++++++++++++ but I see IP has been assigned by cisco router DHCP server: ++++++++++++++++++++ gate#sh ip dhcp bin -= ommited for briefly=- 192.168.172.50 0063.6973.636f.2d30. Aug 27 2019 01:07 PM Automatic 3065.642e.6231.3834. 2e32.3137.342d.4256. 31 gate# ++++++++++++++++++++ whenever run debug dhcp at cisco wireles AP and debug ip dhcp packets at cisco DHCP server I've fount DHCP serverr got discover and sent offer messages proposing IP 192.168.172.50 in this case ++++++++++++++++++++ Aug 27 13:33:14 gate.sidko.org 070013: Aug 27 13:33:14.078: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d30.3065.642e.6231.3834.2e32.3137.342d.4256.31 on interface Vlan12. Aug 27 13:33:14 gate.sidko.org 070020: Aug 27 13:33:14.078: DHCPD: Sending DHCPOFFER to client 0063.6973.636f.2d30.3065.642e.6231.3834.2e32.3137.342d.4256.31 (192.168.172.50).DHCPD: Setting only requested parameters ++++++++++++++++++++ but cisco wireless client doesn't get them and sending discover again ++++++++++++++++++++ *Mar 1 00:41:32.687: DHCP: SDiscover attempt # 3 for entry: *Mar 1 00:41:32.687: Temp IP addr: 0.0.0.0 for peer on Interface: BVI1 *Mar 1 00:41:32.687: Temp sub net mask: 0.0.0.0 *Mar 1 00:41:32.687: DHCP Lease server: 0.0.0.0, state: 3 Selecting *Mar 1 00:41:32.687: DHCP transaction id: 124F *Mar 1 00:41:32.687: Lease: 0 secs, Renewal: 0 secs, Rebind: 0 secs *Mar 1 00:41:32.687: Next timer fires after: 00:00:04 *Mar 1 00:41:32.687: Retry count: 3 Client-ID: cisco-00ed.b184.2174-BV1 *Mar 1 00:41:32.687: Client-ID hex dump: 636973636F2D303065642E623138342E *Mar 1 00:41:32.687: 323137342D425631 ap# *Mar 1 00:41:32.687: Hostname: ap *Mar 1 00:41:32.687: DHCP: SDiscover placed class-id option: 436973636F204150383031 *Mar 1 00:41:32.687: DHCP: SDiscover: sending 302 byte length DHCP packet *Mar 1 00:41:32.687: DHCP: SDiscover 302 bytes *Mar 1 00:41:32.687: B'cast on BVI1 interface from 0.0.0.0 ap# *Mar 1 00:41:36.687: DHCP: QScan: Timed out Selecting state ap#%Unknown DHCP problem.. No allocation possible ++++++++++++++++++++ Could you guys help? Thank you.
... View more
- Tags:
- bvi dhcp
Labels:
Created by
Andriy Sidko
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
08-26-2019
08:26 AM
08-26-2019
08:26 AM
Thank you Ric. I know this rule. Question in this case why access point's module interface BVI1 is not relaying DHCP packets towards to router module interface vlan 1? (router interface vlan 1 in dhcp mode) ++++++++++++ Router#sh ip int brie | i lan1 Vlan1 unassigned YES DHCP up up Router# ++++++++++++ Link between router and ap modules works. So after assigning same subnet IPs to AP's BVI1 and router VLAN1 I can ping vise versa AP and router modules updated config attached. p.s. changes were: ip address dhcp erased from BVI1 config interface BVI1 mac-address 00ed.b184.2174 no ip address as well as default gateway configuration ip default-gateway 192.168.172.49 Thank you.
... View more
Created by
Andriy Sidko
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
08-26-2019
06:58 AM
08-26-2019
06:58 AM
addition. wireless network reserved for wireless bridges 192.168.172.48/29
... View more
Created by
Andriy Sidko
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
08-26-2019
06:36 AM
08-26-2019
06:36 AM
Hi guys. I'm configuring uWGB at cisco 891W. AP module successfully connected to remote AP: ++++++++++++++++++++ ap(config)#do sh dot11 ass all | i State|Connected State : Assoc Parent : - Signal Strength : -37 dBm Connected for : 1863 seconds ap(config)# ++++++++++++++++++++ int bvi 1 configured to get IP from DHCP ++++++++++++++++++++ ap(config-if)#do sh runn int bvi 1 Building configuration... Current configuration : 89 bytes ! interface BVI1 mac-address 00ed.b184.2174 ip address dhcp client-id Dot11Radio0 end ++++++++++++++++++++ however IP has not assigned to interface BVI1 ++++++++++++++++++++ ap(config-if)#do sh ip int bri | i BVI BVI1 unassigned YES DHCP up up ap(config-if)#end ++++++++++++++++++++ same time I've found right IP 192.168.172.50 assigned to client w/ MAC 00ed.b184.2174 (this is ap's BVI1. see above) ++++++++++++++++++++ gate-dhcp#sh ip dhcp bin | i ed Bindings from all pools not associated with VRF: 192.168.172.50 0100.edb1.8421.74 Aug 25 2019 03:03 AM Automatic gate-dhcp# ++++++++++++++++++++ Could somebody explain why? wireless link works correctly because whenever I assigned same IP 192.168.172.50 I got from DHCP server manually at access point interface BVI1 ++++++++++++++++++++ ap(config)#do sh runn int bvi1 interface BVI1 mac-address 00ed.b184.2174 ip address 192.168.172.50 255.255.255.248 end ++++++++++++++++++++ I can reach stations behind uWBG (bellow). ++++++++++++++++++++ ap(config)#do pin 192.168.172.197 re 10 Type escape sequence to abort. Sending 10, 100-byte ICMP Echos to 192.168.172.197, timeout is 2 seconds: !!!!!!!!!! Success rate is 100 percent (10/10), round-trip min/avg/max = 1/3/4 ms ap(config)# ++++++++++++++++++++ complete ap configuration attached. Thank you in advance.
... View more
Labels:
Created by
Andriy Sidko
in Wireless Security and Network Management
in Wireless Security and Network Management
06-17-2019
10:52 AM
06-17-2019
10:52 AM
Hi guys. I'm configuring cisco 891w universal workgroup group bridge mode to non-cisco access point (MAC c24a.0040.9f36). This non-cisco access point has no filtering or other limitations. (it just performing WPA2/PSK) c891w access point module successfully associated & authenticated with non-cisco access point ++++++++++++++++++++ gate-ap(config-if)#int do 0 gate-ap(config-if)#do sh ip int bri gate-ap(config-if)# no ssid a81m-guest gate-ap(config-if)# gate-ap(config-if)# ssid a81m-guest gate-ap(config-if)# *Mar 1 00:17:06.903: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up *Mar 1 00:17:06.907: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP c24a.0040.9f36 [None WPAv2 PSK] *Mar 1 00:17:07.903: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up *Mar 1 00:17:13.179: %DHCP-6-ADDRESS_ASSIGN: Interface BVI70 assigned DHCP address 192.168.172.54, mask 255.255.255.248, hostname gate-ap gate-ap(config-if)# ++++++++++++++++++++ leased IP assigned to access point int bvi70 ++++++++++++++++++++ gate-ap#sh ip int bri Interface IP-Address OK? Method Status Protocol BVI1 10.2.2.2 YES NVRAM up up BVI70 192.168.172.54 YES DHCP up up Dot11Radio0 unassigned YES NVRAM up up Dot11Radio0.70 unassigned YES unset up up Dot11Radio1 unassigned YES NVRAM administratively down down GigabitEthernet0 unassigned YES NVRAM up up GigabitEthernet0.70 unassigned YES unset up up Virtual-Dot11Radio0 unassigned YES unset up up Virtual-Dot11Radio0.70 unassigned YES unset up up gate-ap# ++++++++++++++++++++ from router module I see embedded access point MACs have been learned via interface wlan-g 0, native vlan70 ++++++++++++++++++++ gate#sh mac-address-table Destination Address Address Type VLAN Destination Port ------------------- ------------ ---- -------------------- 7426.ac22.7930 Self 1 Vlan1 7426.ac22.7930 Self 10 Vlan10 7426.ac22.7930 Self 60 Vlan60 0000.0ce0.cff4 Dynamic 70 Wlan-GigabitEthernet0 00ed.b184.2174 Dynamic 70 Wlan-GigabitEthernet0 2c54.2dba.136e Dynamic 70 Wlan-GigabitEthernet0 7426.ac22.7930 Self 70 Vlan70 74a2.e6fd.dfe0 Dynamic 70 Wlan-GigabitEthernet0 gate# ++++++++++++++++++++ where MAC 00ed.b184.2174 is access point BVI70 ++++++++++++++++++++ gate-ap#sh int bvi70 | i up|bia BVI70 is up, line protocol is up Hardware is BVI, address is 00ed.b184.2174 (bia 2c54.2dba.136e) gate-ap# ++++++++++++++++++++ So, I assume. logical interconnection between router and access point modules setup correctly. from router module I see same subnet IP (192.168.172.50) assigned to interface vlan 70 (because c891w access point module interface bvi 70 has ip helper pointing to DHCP server behing non-cisco DHCP access point) ++++++++++++++++++++ 000039: *Jun 14 08:29:37: %DHCP-6-ADDRESS_ASSIGN: Interface Vlan70 assigned DHCP address 192.168.172.50, mask 255.255.255.248, hostname gate gate# ++++++++++++++++++++ from access point module I can ping dfault gateway (192.168.172.49) ++++++++++++++++++++ gate-ap#ping 192.168.172.49 re 10 Type escape sequence to abort. Sending 10, 100-byte ICMP Echos to 192.168.172.49, timeout is 2 seconds: !!!!!!!!!! Success rate is 100 percent (10/10), round-trip min/avg/max = 1/2/4 ms gate-ap# ++++++++++++++++++++ but from router module I cannot ping default gateway 192.168.172.49 but I can ping access point module 192.168.172.54 ++++++++++++++++++++ gate#p 192.168.172.49 re 4 Type escape sequence to abort. Sending 4, 100-byte ICMP Echos to 192.168.172.49, timeout is 2 seconds: .... Success rate is 0 percent (0/4) gate#p 192.168.172.54 re 4 Type escape sequence to abort. Sending 4, 100-byte ICMP Echos to 192.168.172.54, timeout is 2 seconds: !!!! Success rate is 100 percent (4/4), round-trip min/avg/max = 1/1/4 ms gate# ++++++++++++++++++++ even adding static arp entry to access point module bridge 70 for router module vlan 70 (and same static arp from vla70 toward to bvi70) doesen't work. I still cannot ping default gateway from 891w router interface ++++++++++++++++++++ gate#sh int vlan 70 | i bia Hardware is EtherSVI, address is 7426.ac22.7930 (bia 7426.ac22.7930) gate# gate-ap(config)#bridge 70 address 7426.ac22.7930 forward gi 0 gate-ap(config)# gate-ap(config)#do sh ip arp | i 49 Internet 192.168.172.49 128 74a2.e6fd.dfe0 ARPA BVI70 gate-ap(config)# gate-ap(config)#do sh ip arp | i 49 Internet 192.168.172.49 128 74a2.e6fd.dfe0 ARPA BVI70 gate-ap(config)# gate(config)#arp 192.168.172.49 7426.ac22.7948 arpa gate(config)# gate(config)#do pin 192.168.172.49 re 4 Type escape sequence to abort. Sending 4, 100-byte ICMP Echos to 192.168.172.49, timeout is 2 seconds: .... Success rate is 0 percent (0/4) gate(config)# ++++++++++++++++++++ Could somebody suggest what I'm doing wrong or how to fix it? c891w router and access point modules configuration attached. Thank you.
... View more
Created by
Andriy Sidko
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
06-12-2019
12:51 PM
06-12-2019
12:51 PM
issue has been resolved.
... View more
Created by
Andriy Sidko
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
06-11-2019
12:50 PM
06-11-2019
12:50 PM
Thank you Flavio. Not-cisco AP has assigned IP address to c891w access point module (l2 switch) bvi interface but cannot assign IP to c891w router module l3 interface (vlan 70 in this case) Router schema attached. So do you think access point module configuration preventing DHCP replays from DHCP server behind non-cisco AP and c891w access point module to be forward to c891w router module? is it c891w access point configuration? or something to related to router module? Thank you in advance.
... View more
Created by
Andriy Sidko
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
06-11-2019
10:23 AM
06-11-2019
10:23 AM
Hi guys. I'm configuring cisco 891w universal workgroup group bridge mode to non-cisco access point (MAC c24a.0040.9f36). This non-cisco access point has no filtering or other limitations. (it just performing WPA2/PSK) c891w router and access point module configuration attached. c891w access point module successfully associated & authenticated with non-cisco access point ++++++++++++++++++++ gate-ap(config-if)#int do 0 gate-ap(config-if)#do sh ip int bri gate-ap(config-if)# no ssid a81m-guest gate-ap(config-if)# gate-ap(config-if)# ssid a81m-guest gate-ap(config-if)# *Mar 1 00:17:06.903: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up *Mar 1 00:17:06.907: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP c24a.0040.9f36 [None WPAv2 PSK] *Mar 1 00:17:07.903: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up *Mar 1 00:17:13.179: %DHCP-6-ADDRESS_ASSIGN: Interface BVI70 assigned DHCP address 192.168.172.50, mask 255.255.255.248, hostname gate-ap gate-ap(config-if)# ++++++++++++++++++++ leased IP assigned to access point int bvi70 ++++++++++++++++++++ gate-ap#sh ip int bri Interface IP-Address OK? Method Status Protocol BVI1 10.2.2.2 YES NVRAM up up BVI70 192.168.172.50 YES DHCP up up Dot11Radio0 unassigned YES NVRAM up up Dot11Radio0.70 unassigned YES unset up up Dot11Radio1 unassigned YES NVRAM administratively down down GigabitEthernet0 unassigned YES NVRAM up up GigabitEthernet0.70 unassigned YES unset up up Virtual-Dot11Radio0 unassigned YES unset up up Virtual-Dot11Radio0.70 unassigned YES unset up up gate-ap# ++++++++++++++++++++ from router module I see embedded access point MACs have been learned via interface wlan-g 0, native vlan70 ++++++++++++++++++++ gate#sh mac-address-table Destination Address Address Type VLAN Destination Port ------------------- ------------ ---- -------------------- 7426.ac22.7930 Self 1 Vlan1 7426.ac22.7930 Self 10 Vlan10 7426.ac22.7930 Self 60 Vlan60 0000.0ce0.cff4 Dynamic 70 Wlan-GigabitEthernet0 00ed.b184.2174 Dynamic 70 Wlan-GigabitEthernet0 2c54.2dba.136e Dynamic 70 Wlan-GigabitEthernet0 7426.ac22.7930 Self 70 Vlan70 74a2.e6fd.dfe0 Dynamic 70 Wlan-GigabitEthernet0 gate# ++++++++++++++++++++ where MAC 00ed.b184.2174 is access point BVI70 ++++++++++++++++++++ gate-ap#sh int bvi70 | i up|bia BVI70 is up, line protocol is up Hardware is BVI, address is 00ed.b184.2174 (bia 2c54.2dba.136e) gate-ap# ++++++++++++++++++++ So. I assume. logical interconnection between router and access point modules setup correctly. My goal is: Get assigned IP from non-cisco access point to router module interface vlan 70 but whenever I unassigned bvi70 DHCP IP and hopping to get IP assigned to router module interface vlan70 but unfortunately it did not happen : ++++++++++++++++++++ gate-ap(config)#interface BVI70 gate-ap(config-if)#no ip address gate-ap(config-if)#int do 0 gate-ap(config-if)#no ssid a81m-guest *Mar 1 00:52:09.475: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down *Mar 1 00:52:09.483: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset *Mar 1 00:52:10.475: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down *Mar 1 00:52:10.479: %DOT11-4-NO_SSID_VLAN: No SSID with VLAN configured. Dot11Radio0 not started. gate-ap(config-if)#ssid a81m-guest *Mar 1 00:52:17.995: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up *Mar 1 00:52:17.999: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up *Mar 1 00:52:18.303: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP c24a.0040.9f36 [None WPAv2 PSK] gate-ap(config-if)# ++++++++++++++++++++ router module: ++++++++++++++++++++ gate#sh ip int bri | i lan Vlan1 10.2.2.1 YES NVRAM up up Vlan10 192.168.174.1 YES NVRAM up up Vlan60 192.168.174.33 YES NVRAM up up Vlan70 unassigned YES DHCP up up Wlan-GigabitEthernet0 unassigned YES unset up up wlan-ap0 10.1.1.1 YES NVRAM up up gate# ++++++++++++++++++++ Could somebody suggest what I'm doing wrong? Unfortunately I red I lot of documentations in internet but did not find similar to my issue ones. (support forum has a lot of broken links now?) W implemented similar configuration could you help? Thank you.
... View more
Labels:
Created by
Andriy Sidko
in Wireless Security and Network Management
in Wireless Security and Network Management
05-30-2019
07:54 AM
05-30-2019
07:54 AM
Hi guys. I have setup WGB from cisco 811W to non cisco (openwrt) access point (MAC: c25a.2040.9f36) using c811w following configuration: ++++++++++++++++++++++++++ dot11 vlan-name WIRELESS-UPLINK vlan 70 ! dot11 ssid a81m-guest vlan WIRELESS-UPLINK authentication open authentication key-management wpa version 2 wpa-psk ascii 0 superpupper-password interface Dot11Radio0 encryption vlan WIRELESS-UPLINK mode ciphers aes-ccm ssid a81m-guest station-role workgroup-bridge universal c25a.2040.9f36 interface Dot11Radio0.70 encapsulation dot1Q 70 native no ip route-cache bridge-group 1 interface BVI1 mac-address 00ed.b184.2174 ip address dhcp client-id Dot11Radio0 no ip route-cache ++++++++++++++++++++++++++ session is up: ++++++++++++++++++++++++++ gate881w-2753-ap(config-if)#do sh dot11 ass all Address : c25a.2040.9f36 Name : NONE IP Address : 0.0.0.0 IPv6 Address : :: Gateway Address : 0.0.0.0 Netmask Address : 0.0.0.0 Interface : Dot11Radio 0 Bridge-group : 0 reap_flags_1 : 0x0 ip_learn_type : 0x0 transient_static_i Device : unknown Software Version : NONE CCX Version : NONE Client MFP : Off State : Assoc Parent : - SSID : a81m-guest VLAN : 70 Hops to Infra : -1 Association Id : 1 Tunnel Address : 0.0.0.0 Key Mgmt type : WPAv2 PSK Encryption : AES-CCMP Current Rate : m15- Capability : ShortSlot Supported Rates : 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 m0-2 m1-2 m2-2 m3-2 m4 m13-2 m14-2 m15-2 Voice Rates : disabled Bandwidth : 20 MHz Signal Strength : -44 dBm Connected for : 22045 seconds Signal to Noise : 53 dB Activity Timeout : 13 seconds Power-save : Off Last Activity : 2 seconds ago Apsd DE AC(s) : NONE Packets Input : 6718 Packets Output : 1137 Bytes Input : 1083992 Bytes Output : 91845 gate881w-2753-ap(config-if)# ++++++++++++++++++++++++++ but no IP address assigned to BVI interface: ++++++++++++++++++++++++++ gate881w-2753-ap(config-if)#do sh ip int bri | i BVI BVI1 unassigned YES DHCP up up gate881w-2753-ap(config-if)# gate881w-2753-ap(config-if)#do sh int bvi 1 | i bia Hardware is BVI, address is 00ed.b184.2174 (bia 6400.f177.b74a) gate881w-2753-ap(config-if)# ++++++++++++++++++++++++++ meantime DHCP router behind foreign access point shows IP assigned to c811w int bvi1 ++++++++++++++++++++++++++ edge02(config-if)do sh ip dhcp bin | i edb1 192.168.172.158 0100.edb1.8421.74 May 30 2019 10:38 AM Automatic edge02(config-if)# ++++++++++++++++++++++++++ foreign access point powered by OpenWRT in dump bridge mode and not filtering any flows (it just performing authentication and autorisation using WPA2, aes-ccmp w/ PSK) ++++++++++++++++++++++++++ May 29 14:23:14 ap283.st1.net hostapd: wlan0-13: STA 00:ed:b1:84:21:74 IEEE 802.11: authenticated May 29 14:23:14 ap283.st1.net hostapd: wlan0-13: STA 00:ed:b1:84:21:74 IEEE 802.11: associated (aid 12) May 29 14:23:14 ap283.st1.net hostapd: wlan0-13: AP-STA-CONNECTED 00:ed:b1:84:21:74 May 29 14:23:14 ap283.st1.net hostapd: wlan0-13: STA 00:ed:b1:84:21:74 RADIUS: starting accounting session 37D4323865C52E9C May 29 14:23:14 ap283.st1.net hostapd: wlan0-13: STA 00:ed:b1:84:21:74 WPA: pairwise key handshake completed (RSN) ++++++++++++++++++++++++++ whenever I connect from Windows 7 x64 computer to same SSID a81m-guest using same PSK it gets assigned IP address and unrestricted access to internet. ipconfig /all output from windows 7 computer joined a81m-guest: +++++++++++++++++ Wireless LAN adapter Wi-Fi: Connection-specific DNS Suffix . : st1.net Description . . . . . . . . . . . : Qualcomm Atheros AR9485 Wireless Network Adapter Physical Address. . . . . . . . . : 14-CC-20-2D-E4-49 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.173.132(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.254.0 Lease Obtained. . . . . . . . . . : Monday, May 29, 2019 6:07:44 PM Lease Expires . . . . . . . . . . : Tuesday, May 30, 2019 6:07:44 AM Default Gateway . . . . . . . . . : 192.168.173.254 DHCP Server . . . . . . . . . . . : 192.168.173.254 DNS Servers . . . . . . . . . . . : 192.168.172.9 192.168.172.27 +++++++++++++++++ Could somebody explain what I did wrong? Thank you in advance. p.s. 811w router access point module configuration attached.
... View more
- Tags:
- 881w
Created by
Andriy Sidko
in Wireless Security and Network Management
in Wireless Security and Network Management
05-27-2019
04:14 PM
05-27-2019
04:14 PM
yes I can associate & authenticate to a81m-guest SSID from my windows 7 computer. ipconfig /all output bellow. +++++++++++++++++ Wireless LAN adapter Wi-Fi: Connection-specific DNS Suffix . : sе1.туе Description . . . . . . . . . . . : Qualcomm Atheros AR9485 Wireless Network Adapter Physical Address. . . . . . . . . : 14-CC-20-2D-E4-49 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.173.132(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.254.0 Lease Obtained. . . . . . . . . . : Monday, May 27, 2019 6:07:44 PM Lease Expires . . . . . . . . . . : Tuesday, May 28, 2019 6:07:44 AM Default Gateway . . . . . . . . . : 192.168.173.254 DHCP Server . . . . . . . . . . . : 192.168.173.254 DNS Servers . . . . . . . . . . . : 192.168.172.9 192.168.172.27 +++++++++++++++++ I'm assuming cisco 881w get address from pool 192.168.172.0/23 could you take a look at attached configs and point me at possible misconfiguration? (configurations attached) I took a look at your site https://mrncciew.com/ but unfortunately didn't find any configs related to my scenario. Could you help me Rasika? I successfully configured a lot of cisco 877w using same scenario but never do it at 880W it looks like 881 completely different from 877W Thank you in advance.
... View more
Created by
Andriy Sidko
in Wireless Security and Network Management
in Wireless Security and Network Management
05-27-2019
09:30 AM
05-27-2019
09:30 AM
Thank you very much Rasika! I have successfully joined foreign access point from 881w router: +++++++++ *Mar 1 00:00:28.315: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up *Mar 1 00:00:28.319: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP c24a.0040.9f36 [None WPAv2 PSK] *Mar 1 00:00:29.315: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up gate-ap(config-subif)# +++++++++ one outstanding thing I didn't find where foreign access point providing DHCP service assigned IP address to cisco router? bote ap module interface bvi1 configured for DHCP and router module interface vlan1 configured for DHCP as well don't have IP assigned to them. if it possible could you show configuration if you have similar one. maybe I just misunderstanding conception... Thank you.
... View more
Created by
Andriy Sidko
in Wireless Security and Network Management
in Wireless Security and Network Management
05-24-2019
11:40 AM
05-24-2019
11:40 AM
Hi guys. I'm configuring non root wireless bridge @ cisco 881w as wireless client to non cisco accesspoint (openWRT) I put following configuration to c881w: +++++++++++++++++ ! ! Last configuration change at 02:14:04 UTC Mon Mar 1 1993 by sam version 15.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname gate-cottage-ap ! ! logging rate-limit console 9 ! aaa new-model ! ! aaa authentication login default local aaa authorization exec default local ! ! ! aaa session-id common no ip cef ! ! ! ! dot11 syslog dot11 vlan-name WBR-UPLINK vlan 1 ! dot11 ssid a81m-guest vlan WBR-UPLINK authentication open authentication key-management wpa version 2 mbssid guest-mode wpa-psk ascii 0 yyyyyyyyyyyyy ! ! bridge irb ! ! ! interface Dot11Radio0 no ip address no ip route-cache ip tcp adjust-mss 1360 ! encryption vlan WBR-UPLINK mode ciphers aes-ccm ! ssid a81m-guest ! antenna gain 0 speed basic-1.0 2.0 5.5 11.0 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 m0. m1. m2. m3. m4. m8. m9. m10. m11. m12. m13. m14. m15. power client 20 packet retries 24 drop-packet station-role non-root bridge beacon period 101 beacon dtim-period 1 world-mode dot11d country-code US outdoor infrastructure-client ! interface Dot11Radio0.1 encapsulation dot1Q 1 native no ip route-cache bridge-group 1 bridge-group 1 spanning-disabled ! interface GigabitEthernet0 description -= downlink to the router =- no ip address no ip route-cache ! interface GigabitEthernet0.1 encapsulation dot1Q 1 native no ip route-cache bridge-group 1 bridge-group 1 spanning-disabled ! interface BVI1 no ip address no ip route-cache ! ip forward-protocol nd ip http server no ip http secure-server ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag ! ! ! bridge 1 route ip ! ! ! line con 0 logging synchronous no activation-character line vty 0 4 transport input all ! end +++++++++++++++++ wheneever i shut& no shut dot0 interface I see following: *Mar 1 02:15:39.815: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to administratively down *Mar 1 02:15:43.887: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset *Mar 1 02:15:55.195: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: No Response at openwrt access point I see following in log: May 21 14:17:52 ap.sk1.net hostapd: wlan0-11: STA 00:07:7d:ae:3b:90 IEEE 802.11: authenticated May 21 14:17:52 ap.sk1.net hostapd: wlan0-11: STA 00:07:7d:ae:3b:90 IEEE 802.11: associated (aid 1) May 21 14:18:01 ap.sk1.net hostapd: wlan0-11: STA 00:07:7d:ae:3b:90 IEEE 802.11: deauthenticated due to local deauth request where: 00:07:7d:ae:3b:90 is MAC of c881w dot0.1 interface could somebody explain why and who is iniating deauthention process? is "deauthenticated due to local deauth request" mean opwnwrt access point begins deauth process? Thank you.
... View more
- Tags:
- 881w
05-23-2019
08:40 AM
Hi guys. I have Cisco 881gw w/ embedded wireless access point. I configured two bridges between ap and router modules like: - BVI1 access point control plane link 10.1.1.4/30, where: 10.1.1.5 - router bvi1, 10.1.1.6 - access point bvi1 - BVI7 - data plane link between AP and router modules - 10.1.1.8/30, where: router bvi7, 10.1.1.9 - access point bvi7 - 10.1.1.10 ping ap bvi1 & 7 from router module failed meantime I see arp ently for AP bvi 1 only: +++++++++++ gate(config)#do ping 10.1.1.6 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.1.6, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) gate(config)#do ping 10.1.1.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.1.10, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) gate(config)#do sh ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 10.1.1.5 - 30e4.db20.d3d0 ARPA BVI1 Internet 10.1.1.6 0 6400.f177.b74a ARPA BVI1 Internet 10.1.1.9 - 0000.0cb6.2f28 ARPA BVI7 Internet 10.1.1.10 0 Incomplete ARPA gate(config)# +++++++++++ configurations attached. Could somebody help? Thank you. p.s. attached configuration is very simple. I'm truing to setup two bridge only BVI1 for management link to router module and BVI7 for future wireless link from int do0.7 p.p.s most suspicious (for me) thing is: ping fails from both sides but router see ap mac but not vice versa: router side: ++++++++++++++ gate#pin 10.1.1.6 re 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.6, timeout is 2 seconds: ... Success rate is 0 percent (0/3) gate#pin 10.1.1.10 re 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.10, timeout is 2 seconds: ... Success rate is 0 percent (0/3) gate#sh ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 10.1.1.5 - 30e4.db20.d3d0 ARPA BVI1 Internet 10.1.1.6 0 6400.f177.b74a ARPA BVI1 Internet 10.1.1.9 - 0000.0cb6.2f28 ARPA BVI7 Internet 10.1.1.10 1 6400.f177.b74a ARPA BVI7 gate# ++++++++++++++ AP side: ++++++++++++++ gate-ap(config-subif)#do pin 10.1.1.5 re 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.5, timeout is 2 seconds: ... Success rate is 0 percent (0/3) gate-ap(config-subif)#do pin 10.1.1.9 re 3 Type escape sequence to abort. Sending 3, 100-byte ICMP Echos to 10.1.1.9, timeout is 2 seconds: ... Success rate is 0 percent (0/3) gate-ap(config-subif)#do sh ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 10.1.1.5 0 Incomplete ARPA Internet 10.1.1.6 - 6400.f177.b74a ARPA BVI1 Internet 10.1.1.9 0 Incomplete ARPA Internet 10.1.1.10 - 6400.f177.b74a ARPA BVI7 gate-ap(config-subif)# ++++++++++++++
... View more
- Tags:
- bridge
Labels:
Public Statistics
| Date Registered | 04-06-2010 11:33 AM |
| Date Last Visited | 09-09-2019 01:34 AM |
| Total Messages Posted | 77 |
| Total Helpful Votes Received | 5 |
.jpg "VIP Mentor"){kind=icon}
