Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About nix-patheon
Stats
Member since
07-25-2012
32
Posts
0
Helpful
0
Solutions
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
03-07-2014
06:08 AM
03-07-2014
06:08 AM
Is the correct answer! Correct answer is to Sandeep (the penny dropped after reading his post a couple of times), but thank you for your time Scott, it is very much appreciated.
... View more
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
03-07-2014
06:04 AM
03-07-2014
06:04 AM
I thnk I see where I have went wrong. I need to check both boxes? One to allow the MIC, and the other to authorise against the MAC list?
... View more
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
03-07-2014
05:53 AM
03-07-2014
05:53 AM
Thanks Sandeep. I can join them using the default no problem. However, it is a requirement that I increase security of what AP's can join the controller, and even without adding the MAC to the AP authorisation list, I can join an AP no problem...
... View more
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
03-07-2014
05:49 AM
03-07-2014
05:49 AM
Auth-list below mate: At the moment, the AP is pingable on 10.201.30.203, after an attempted join using authorised list, but it's not downloading the image and I can't configure anything using the gui on the controller. Cheers.
... View more
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
03-07-2014
05:43 AM
03-07-2014
05:43 AM
Apologies, Field Recovery Image Version: 7.0.112.21 (Cisco Controller) >show sysinfo Manufacturer's Name.............................. Cisco Systems Inc. Product Name..................................... Cisco Controller Product Version.................................. 7.5.102.0 Bootloader Version............................... 1.0.16 Field Recovery Image Version..................... 7.0.112.21 Firmware Version................................. FPGA 1.7, Env 1.8, USB console 2.2 Build Type....................................... DATA + WPS System Name...................................... SSC-WLC-02 System Location.................................. Swindon DC Row C System Contact................................... Pete Nixon System ObjectID.................................. 1.3.6.1.4.1.9.1.1069 Redundancy Mode.................................. Disabled IP Address....................................... 10.201.30.129 Last Reset....................................... Software reset System Up Time................................... 24 days 8 hrs 43 mins 9 secs System Timezone Location......................... (GMT) London, Lisbon, Dublin, Edinburgh System Stats Realtime Interval................... 5 System Stats Normal Interval..................... 180 Configured Country............................... GB - United Kingdom Operating Environment............................ Commercial (0 to 40 C) Internal Temp Alarm Limits....................... 0 to 65 C Internal Temperature............................. +39 C External Temperature............................. +22 C Fan Status....................................... OK State of 802.11b Network......................... Enabled State of 802.11a Network......................... Enabled Number of WLANs.................................. 5 Number of Active Clients......................... 700 Burned-in MAC Address............................ E8:B7:48:A1:CD:A0 Power Supply 1................................... Present, OK Power Supply 2................................... Absent Maximum number of APs supported.................. 100
... View more
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
03-07-2014
05:40 AM
03-07-2014
05:40 AM
Just some further information Scott, the output above was when I successfully joined it to the controller a few moments ago using accept MIC policy. The summary stats show the correct IP from the scope (10.201.30.203), as does the AP summary screen in the gui but looking at the AP in further detail it has 0.0.0.0 as its address: I have tried to assign the address as static, but it generates an error message:
... View more
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
03-07-2014
05:30 AM
03-07-2014
05:30 AM
show inv: Burned-in MAC Address............................ E8:B7:48:A1:CD:A0 Power Supply 1................................... Present, OK Power Supply 2................................... Absent Maximum number of APs supported.................. 100 NAME: "Chassis" , DESCR: "Cisco 5500 Series Wireless LAN Controller" PID: AIR-CT5508-K9, VID: V01, SN: xxxxxxxxxx AP sh ver: AP78da.6e42.85ca#sh ver Cisco IOS Software, C3600 Software (AP3G2-K9W8-M), Version 15.2(4)JA1, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2013 by Cisco Systems, Inc. Compiled Tue 30-Jul-13 22:57 by prod_rel_team ROM: Bootstrap program is C3600 boot loader BOOTLDR: C3600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(23c)JY, RELEASE SOFTWARE (fc1) AP78da.6e42.85ca uptime is 22 minutes System returned to ROM by power-on System image file is "flash:/ap3g2-k9w8-mx.152-4.JA1/ap3g2-k9w8-xx.152-4.JA1" Last reload reason: This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com . cisco AIR-CAP3602I-E-K9 (PowerPC) processor (revision A0) with 180214K/81920K bytes of memory. Processor board ID FCZ1749J1KS PowerPC CPU at 800Mhz, revision number 0x2151 Last reset from power-on LWAPP image version 7.5.102.0 1 Gigabit Ethernet interface 2 802.11 Radios 32K bytes of flash-simulated non-volatile configuration memory. Base ethernet MAC Address: 78:DA:6E:42:85:CA Part Number : 73-14521-02 PCA Assembly Number : 800-37501-02 PCA Revision Number : A0 PCB Serial Number : FOC17444F2D Top Assembly Part Number : 800-35852-02 Top Assembly Serial Number : FCZ1749J1KS Top Revision Number : C0 Product/Model Number : AIR-CAP3602I-E-K9 Configuration register is 0x WLC software version: 7.5.102.0 FUS: 7.0.112.21 Thanks again Scott.
... View more
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
03-07-2014
05:01 AM
03-07-2014
05:01 AM
Thanks Scott. AP summary: AP78da.6e42.85ca 2 AIR-CAP3602I-E-K9 78:da:6e:42:85:ca default location 10.201.30.203 0 AP join stats summary: Base Mac AP EthernetMac AP Name IP Address Status c0:7b:bc:76:49:e0 c0:7b:bc:76:49:e0 AP78da.6e42.85ca 10.201.30.203 Not Joined AP join stats detailed: (Cisco Controller) >show ap join stats detailed c0:7b:bc:76:49:e0 Sync phase statistics - Time at sync request received............................ Not applicable - Time at sync completed................................... Not applicable Discovery phase statistics - Discovery requests received.............................. 183 - Successful discovery responses sent...................... 183 - Unsuccessful discovery request processing................ 0 - Reason for last unsuccessful discovery attempt........... Not applicable - Time at last successful discovery attempt................ Mar 07 12:58:56.749 - Time at last unsuccessful discovery attempt.............. Not applicable Join phase statistics - Join requests received................................... 60 - Successful join responses sent........................... 0 - Unsuccessful join request processing..................... 0 - Reason for last unsuccessful join attempt................ Not applicable - Time at last successful join attempt..................... Not applicable - Time at last unsuccessful join attempt................... Not applicable Configuration phase statistics --More-- or (q)uit - Configuration requests received.......................... 0 - Successful configuration responses sent.................. 0 - Unsuccessful configuration request processing............ 0 - Reason for last unsuccessful configuration attempt....... Not applicable - Time at last successful configuration attempt............ Not applicable - Time at last unsuccessful configuration attempt.......... Not applicable Last AP message decryption failure details - Reason for last message decryption failure............... Not applicable Last AP disconnect details - Reason for last AP connection failure.................... Not applicable - Last AP disconnect reason................................ Not applicable Last join error summary - Type of error that occurred last......................... None - Reason for error that occurred last...................... Not applicable - Time at which the last join error occurred............... Not applicable AP disconnect details - Reason for last AP connection failure.................... Not applicable Ethernet Mac : c0:7b:bc:76:49:e0 Ip Address : 10.201.30.203 Gui is still showing as joined however: Thanks.
... View more
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
03-07-2014
04:00 AM
03-07-2014
04:00 AM
Hi guys, I'm havin problems joining an AP (3602I) to my controller (5508) when authorising MIC's against against my auth-list on the controller. I have added the AP MAC address to the auth-list but the AP won't successfully join. The controller occasionally says "joined" and I can view it in the AP list, but the AP status is always UNKNOWN, whereby I will reset the AP and try again. Any ideas? Thanks.
... View more
01-16-2014
04:05 AM
Hi Jaspher, You will need to add your dns server details in the initial config of the ACS. The RSA token server and RADIUS identity servers in your external identity stores require dns lookups. I have just finished configuring an ACS 5.4 for RSA two-factor authentication, if you find yourself stuck at any point just post! Cheers.
... View more
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
01-15-2014
04:55 AM
01-15-2014
04:55 AM
For anyone having the same issue, I found that removing the configuration from the RSA Token Server external identity store and configuring for RADIUS Identity Server solved my problem.
... View more
Created by
nix-patheon
in Wireless Security and Network Management
in Wireless Security and Network Management
01-10-2014
08:03 AM
01-10-2014
08:03 AM
Hi all, I have run into some issues when trying to authenticate wireless users against an RSA SecurID server and would appreciate any input from the community. The RSA server configuration has been verified as correct, and the only real log as such (authentication monitor) shows: User “me” attempted to authenticate using authenticator “SecurID_Native”. The user belongs to security domain “SystemDomain”. Not very helpful. The ACS AAA log shows the following: Jan 10,14 3:43:30.353 PM Radius authentication failed for USER: me MAC: 00-19-7e-88-5a-7b AUTHTYPE: EAP-FAST(EAP-GTC) Radius authentication failed. Detailed log: Authentication Details Logged At: January 10,2014 3:43:30.353 PM ACS Time: January 10,2014 3:43:30.343 PM ACS Instance: wlan-acs-1 Authentication Method: PAP_ASCII EAP Authentication Method : EAP-GTC EAP Tunnel Method : EAP-FAST User ACS Username: me RADIUS Username : Calling Station ID: 00-19-7e-88-5a-7b Framed IP Address: Host Lookup: Network Device Network Device: wlc-02 Network Device Groups: Device Type:All Device Types:5508 Location:All Locations:LAB NAS IP Address: 10.201.30.129 NAS Identifier: NAS Port: NAS Port ID: 13 NAS Port Type: Access Policy Access Service: Default Network Access Identity Store: rsaserver Authorization Profiles: Exception Authorization Profiles: Active Directory Domain: Identity Group: Access Service Selection Matched Rule: Rule-1 Identity Policy Matched Rule: Default Selected Identity Stores: rsaserver Query Identity Stores: Selected Query Identity Stores: Group Mapping Policy Matched Rule: Authorization Policy Matched Rule: Authorization Exception Policy Matched Rule: CTS CTS Security Group: Other ACS Session ID: wlan-acs-1/178729561/86 Audit Session ID: Tunnel Details: H323 Attributes: SSG Attributes: Cisco-AVPairs: Other Attributes: ACSVersion=acs-5.4.0.46-B.221 ConfigVersionId=26 If further information is needed, please let me know. Thanks for your time.
... View more
Created by
nix-patheon
in Policy and Access
in Policy and Access
01-08-2014
05:53 AM
01-08-2014
05:53 AM
Hi Edward, Thank you very much for replying. I have continued to work further on this (turns out there was a rule missing for my RSA access service that generated the EAP timeout) and am now able to get an authentication prompt. However, authentication is failing at the RSA server with: User “x” attempted to authenticate using authenticator “SecurID_Native”. The user belongs to security domain “SystemDomain”. I also see a lot of errors for 11013 RADIUS packet already in the process, which makes me think I should possibly increase the time-out value? The client details are as follows: Client machine: Windows 7 Supplicant: SecureW2 Supplicant Config: PEAP/EAP-GTC Thank you.
... View more
Created by
nix-patheon
in Policy and Access
in Policy and Access
01-08-2014
02:28 AM
01-08-2014
02:28 AM
Hi all, I'm having issues authenticating against an RSA server for token authentication through my ACS 1121 (5.4) using a wireless supplicant. RADIUS authentication log on the ACS shows: 5411 EAP session timed out. I think this may possibly de due to the EAP method used, currently using PEAP & EAP-GTC (tunnel protocol). I have created an access policy for my RSA server and currently allowing the following EAP protocols: PEAP: Allow EAP-GTC EAP-FAST: Allow EAP-GTC I'm not sure (possibly because of the EAP method) that the ACS is even talking to the RSA server as it has yet to download the node secret from it either. Any suggestions would be very helpful! Thanks.
... View more
Labels:
Created by
nix-patheon
in Network Management
in Network Management
11-08-2013
04:38 AM
11-08-2013
04:38 AM
Hi guys, I'm looking for a way to find the ifindex of a given interface on an ASA 5512-X, as well as setting the ifindex persist option? The command reference for this platform does not seem to show any commands related to this, but i'm hoping someone has come across similar or knows a workaround. Thanks.
... View more
Labels:
Public Statistics
| Date Registered | 07-25-2012 02:49 AM |
| Date Last Visited | 08-18-2017 04:00 AM |
| Total Messages Posted | 32 |
