Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About mile.ljepojevic
Stats
Member since
10-24-2007
78
Posts
8
Helpful
3
Solutions
03-23-2017
04:47 AM
Hi,
as I mentioned WLC 8.3 or newer train (if exists) is required for this. Previous releases of WLC code do not support RADIUS NAC and PSK.
... View more
03-22-2017
04:38 AM
You need to configure SSID to use RADIUS NAC.
Also, on L2 security it should be MAC filtering
On L3 security, make sure you add your ISE servers.
Make sure ISE servers have WLC as AAA Client
Make sure pre-shared key is the same.
There could be multiple reasons why you don't see your MAC address in ISE logs, but it should't be related with your policy configuration.
If policy is wrong, you still should see MAC address, but it would be denied or wrong authorization profile would be applied, but 99% chance is that MAC address will be in the logs.
If you do not see MAC address in the ISE Logs, it's either there is no good communication between WLC and ISE, or WLC is not sending RADIUS requests to ISE...
... View more
03-21-2017
10:55 AM
Try using it. I had similar issues for guest SSID when ASA was used as DHCP... For some reason, it works better when WLC is proxy-ing DHCP than through broadcast...
... View more
03-21-2017
05:45 AM
Do you have DHCP relay configured on WLC? If you do, play also with option 82 to see if it will make difference.
And IP DHCP relay on WLC should point to your DHCP server IP (switch IP).
... View more
03-21-2017
05:39 AM
System MTU is on global configuration mode, not on interface, so try it there...
On Interface, try IP MTU ...
Thanks.
... View more
03-21-2017
05:23 AM
Routers are not clever enough to return the traffic same way it came, by using different /30... It will just think there are more paths to the same network and load-balance return traffic...
Easiest way around it is to do NAT on your router or ask your client to do NAT on theirs... That's one of the reasons why I said it should be good to have Firewall in between, so you can only open NTP, NAT your clients, prevent them from accessing each other, etc... In order to make sure there is no IP address overlapp between the clients, someone has to use the NAT, or you can make sure they are accessing it with their public IPs (so they do NAT on whatever edge device they are using).
... View more
03-21-2017
05:14 AM
Again, you are not using CWA. CWA is portal for authentication based on username/password and requires splash-page and user intervention.
You can use Wireless MAB to do MAC filtering and VLAN assignment, no need to use CWA at all.
... View more
03-20-2017
02:19 PM
You are using static service translation, so ports should come up both ways. More is concern that now user will have to change LDAP ports for your servers, plust you would have to NAT only specific ports from your servers to new ports on Public IP... It's messy... Juist use 2 Public IPs, it's not true that you will waste it, you can leave same Public IPs in use for other services outside of VPN.
... View more
03-20-2017
09:42 AM
Lol, yes... I was to slow to reply on previos one...
Here is good Cisco article about BGP and prefix lists...
http://www.cisco.com/c/en/us/td/docs/ios/12_2s/feature/guide/fsbgporf.html
let me know if you still have issues.
... View more
03-20-2017
09:41 AM
Hi,
you don't need:
network 192.168.1.0 mask 255.255.255.252
You don't have to advertise that subnet into BGP (I assume that's directly connected subnet between your router/switch, so router will know about it).
So, you can use prefix list, it's simplest way to limit updates; ip prefix-list NTP-ONLY permit 10.10.0.0/24
Router bgp 65001
neighbot 192.168.1.1 prefix-list NTP-ONLY out
... View more
03-20-2017
08:13 AM
Create prefix-list or route-maps that will allow only subnet with your NTP to be announced out to any BGP peer. It will prevent your clients to learn routes from other clients, and it will allow you to learn all your clients routes and be able to send them NTP traffic back.
It should be fairly scalable, you'll just re-use same prefix list for every BGP peer, in reality, it adds one more command per peer.
... View more
03-20-2017
08:11 AM
Hi, it's very simple:
In your scenario, you will not see anything on the ISE because all authentication is done locally via WLC. Of course ISE will not be aware of that
CWA is using MAC filtering to provide authentication via Web Portal for unknow MACs. You can still use ISE to do mac-filtering, but you create policies to be matched based on known MAC address instead of CWA result.
CWA is used to identify unknown PCs, guest access, etc, but even on wireless, you can "whitelist" all devices that do not have web-browsers, like Printers, Roku and Chrome players, projectors, etc. It's same concept for you.
.
So, you should use PSK on the WLC, then RADIUS NAC and ISE as RADIUS server for MAC address filtering, configure policies for Wireless MAB do not use CWA in your policies, just create policies that will assign specific Endpoint group (pre-filled with known MACs) to specific VLANs.
... View more
03-20-2017
07:58 AM
Routers: "show ip arp"
Hosts (Windows): arp -a
Not sure about linux but fairly sure it can be googled out...
To be honest, I don't think it's an ARP issue, that should just help us determine if something of the above items was not correct. Also, item no 3): can you ping from the router using source command? Like ping 30.30.30.30 source 50.50.50.1 (IP address of the router)?
Then vice versa. Also, from both hosts try to ping both router interfaces... If all that works, I won't be able to help you without really looking into it, since these are "most usual" issues, and if this is all good, then I need to snoop around to see what's there...
... View more
03-17-2017
10:21 AM
Share router config... Any ACLs? Subnets and masks are correct? Can you ping hosts from router? Using both interfaces as source? Default gateway on the hosts? Disable windows firewall if you are using windows hosts. ARP correct on all hosts and router?
... View more
03-17-2017
10:18 AM
Maybe, maybe not.
Still not sure why would anyone pay for NTP from data center, there are atomic and GPS clocks available on the internet for free...
But that's not the point, you didn't specify if IP address of NTP would be private or public. If it's private, you may have IP address overlap with customer's IPs and that's usually not good.
Also, I wouldn't use VLANs since you will be sharing your L2 into other networks (potentional SPT or VTP issues), just use no switchport command on the switch and use port as L3 port. Make sure you prevent your routing leak between customers. You want to make sure they do not use your link to access each other.
For some reason, I am thinking this is a bad idea. You should use firewall between clients and you and clients and clients. Put them in different zones, make sure they cannot access anything except NTP, make sure there is no routing leak between your customers, etc. Potentially, scenario like this can be disastrous...
... View more
03-23-2017
Hi, as I mentioned WLC 8.3 or newer train (if exists) is required for
this. Previous releases of WLC...
03-22-2017
You need to configure SSID to use RADIUS NAC. Also, on L2 security it
should be MAC filtering On L3 ...
03-21-2017
Try using it. I had similar issues for guest SSID when ASA was used as
DHCP... For some reason, it w...
03-21-2017
Do you have DHCP relay configured on WLC? If you do, play also with
option 82 to see if it will make...
03-21-2017
System MTU is on global configuration mode, not on interface, so try it
there... On Interface, try I...
03-21-2017
Routers are not clever enough to return the traffic same way it came, by
using different /30... It w...
03-21-2017
Again, you are not using CWA. CWA is portal for authentication based on
username/password and requir...
03-20-2017
You are using static service translation, so ports should come up both
ways. More is concern that no...
03-20-2017
Lol, yes... I was to slow to reply on previos one... Here is good Cisco
article about BGP and prefix...
03-20-2017
Hi, you don't need: network 192.168.1.0 mask 255.255.255.252 You don't
have to advertise that subnet...
03-20-2017
Create prefix-list or route-maps that will allow only subnet with your
NTP to be announced out to an...
03-20-2017
Hi, it's very simple: In your scenario, you will not see anything on the
ISE because all authenticat...
03-20-2017
Routers: "show ip arp" Hosts (Windows): arp -a Not sure about linux but
fairly sure it can be google...
03-17-2017
Share router config...Any ACLs?Subnets and masks are correct?Can you
ping hosts from router? Using b...
Public Statistics
| Date Registered | 10-24-2007 12:57 AM |
| Date Last Visited | 09-09-2019 01:34 AM |
| Total Messages Posted | 78 |
| Total Helpful Votes Received | 8 |
