Hi, Is it just me or is the link not working? ... View more

What I get from the first lines of your macro is that after the event "LINKUP == yes" you first of all do a shutdown... Which triggers the event "LINKUP == no" and everything starts anew. Not sure if this helps but at a customer site I have the actual macro defined as a text file and stored on the switch flash. I am using ISE with a policy that uses the auto smartport feature (on other servers you will most likely need the av pair for auto smart port). this just calls the trigger on the switch for that one client and executes from flash. The config is similar to this (switch is a 2960X running 15.2(2)E4): ##### ON SWITCH ##### ! Enable auto smartport processing macro auto global processing ! Define shell trigger and description shell trigger TRIGGER TRIGGER-DESCRIPTION ! Copy macro text file to local flash copy tftp://$TFTPSERVER/macro.txt flash: ! map trigger event to execute the macro text file macro auto execute MAB_TEST remote flash:macro.txt ##### macro.txt ##### if [[ $LINKUP == YES ]]; then  conf t   interface $INTERFACE    no ip access-group    macro description $TRIGGER    no dot1x pae authenticator    no mab    authentication open   exit  end fi if [[ $LINKUP == NO ]]; then  conf t   interface $INTERFACE    no macro description $TRIGGER    dot1x pae authenticator    mab    no authentication open   exit  end fi So my macro should, after successfully authenticating a device, remove the dot1x and mab config on that port to avoid clients from authenticating behind that device (it is a 3rd party AP that bridges clients directly onto the network). After the original device disconnects, config is restored and so far this works perfectly. Regards ... View more

Seems to be dead thogh, no updates on this in ages.. Any alternative?   regards, Patrick ... View more

I have the AuthZ Profile configured to have the static IP address of the port I connected to my guest VLAN.  I am running WLC version 8.0.115.0 and ISE 1.4 and my guest clients are put directly into RUN state on the WLC (policy manager state). I see the AAA redirect ACL is applied but no redirect URL in place.  What influence does  config network web-auth captive-bypass enable have on none-iOS devices? I know I need to have this in place to have iOS devices work properly with cisco web redirects but how does it affect windows or Android clients? ... View more

This ACL looks like from a 3850/5760 WLC using IOS XE. These models have a different approach on how to use ACLs. You can use dACLs from ISE on these. This does not work with AireOS WLCs like the 5500/2500 series. They have to use named ACLs and are not stateful, therefore you need to have  inbound AND outbound rules configured.  Also, for AireOS the redirect statements are opposite as they are for IOS based ACLs. in IOS, you would think the ACL to be "anything that is permitted will be redirected" while the AireOS logic is "everything I have denied will be redirected".  Following this logics, your ACL is correct in terms of allowing DHCP and DNS to be directed as wished and everything else redirected to ISE.  If http redirects do not work but https does, check whether you have the ip http server enabled on your device. I happened to configure my first IOS XE controller to have no ip http server enabled and therefore, the controller did not redirect http traffic as it didn't recognize it. So ip http server has to be enabled for http redirect to work.    I hope I didn't confuse anyone and you got my points.  ... View more

You might want to either block TCP 443 to the ISE IP or use a different physical port on ISE with a different IP address for the guest portal. Both works fine with me.  ... View more

Hi I just have a quick question: I have no real experience with these 5760 WLCs but most guides recommend using the gig interface for management which seems quite odd to me given that it is stated to be the service port. Has anyone else wondered about this and is there a reason why cisco documents it that way? Are there maybe issues in using a VLAN on the 10G interfaces for management access? ... View more

Hi, I am having a similiar issue with a 5760 Next-Gen WLC. I have configured a dACL with permit ip any any log and want to push that to the WLC. From the documentations I read so far I assumed that dACLs are supposed to work with the new IOS-XE WLCs but when looking into the traces I set up I get the following:   [03/25/14 13:57:59.429 UTC 13cfd 212] ACCESS-FEATURE-ACL-ERR: dACL xACSACLx-IP-Client_IT_dACL-52b40fe6 download failed [03/25/14 13:57:59.547 UTC 13cfe 181] ACCESS-CORE-CAAA-ERR: Notify invalid mb handle [03/25/14 13:57:59.824 UTC 13cff 22] ACCESS-CORE-CAAA-ERR: Remove session - invalid handle 0x5E000C30 [03/25/14 13:57:59.824 UTC 13d00 22] ACCESS-CORE-CAAA-ERR: Unable to remove wireless session [03/25/14 13:57:59.824 UTC 13d01 22] ACCESS-CORE-CAAA-ERR: Remove wireless session - invalid handle 0x5E000C30 [03/25/14 13:57:59.824 UTC 13d02 22] ACCESS-CORE-EPM-ERR: Error in Deleting wireless session hdl 0x5E000C30 [03/25/14 13:57:59.824 UTC 13d03 213] ACCESS-CORE-EPM-ERR: NULL feature list for client ctx 930EAE44 [03/25/14 13:57:59.826 UTC 13d04 195] ACCESS-CORE-SM-CLIENT-IPDT-ERR: [a082.1f77.4c10, Ca3] No session for MAC a082.1f77.4c10 [03/25/14 13:58:00.023 UTC 13d05 22] ACCESS-CORE-CAAA-ERR: Remove session - invalid handle 0x65000C24 [03/25/14 13:58:00.023 UTC 13d06 22] ACCESS-CORE-CAAA-ERR: Unable to remove wireless session [03/25/14 13:58:00.023 UTC 13d07 22] ACCESS-CORE-CAAA-ERR: Remove wireless session - invalid handle 0x65000C24 [03/25/14 13:58:00.023 UTC 13d08 22] ACCESS-CORE-EPM-ERR: Error in Deleting wireless session hdl 0x65000C24 [03/25/14 13:58:00.024 UTC 13d09 213] ACCESS-FEATURE-ACL-ERR: ACL not found in the AVL tree [03/25/14 13:58:00.025 UTC 13d0a 195] ACCESS-CORE-SM-CLIENT-IPDT-ERR: [6c88.145e.7eac, Ca39] No session for MAC 6c88.145e.7eac [03/25/14 13:58:00.222 UTC 13d0b 210] ACCESS-CORE-EPM-ERR: No Feature has been registered for attribute username [03/25/14 13:58:00.222 UTC 13d0c 210] ACCESS-CORE-EPM-ERR: No Feature has been registered for attribute state [03/25/14 13:58:00.222 UTC 13d0d 210] ACCESS-CORE-EPM-ERR: No Feature has been registered for attribute EAP-session-id [03/25/14 13:58:00.222 UTC 13d0e 210] ACCESS-CORE-EPM-ERR: No Feature has been registered for attribute MS-MPPE-Send-Key [03/25/14 13:58:00.222 UTC 13d0f 210] ACCESS-CORE-EPM-ERR: No Feature has been registered for attribute MS-MPPE-Recv-Key [03/25/14 13:58:00.222 UTC 13d10 212] ACCESS-CORE-EPM-ERR: Received AAA Failed reply for acl download The WLC is running with IOS-XE 3.3.02SE. Any ideas? regards, Patrick Meyer ... View more