The available information is limited and depending on the version of code, but it it correct that you need to use the management IP of the active HA-SSO unit to request information about the standby HA-SSO unit. More information can be found here. For the bigger appliances, based on UCS hardware, we normally use the CIMC interfaces to gather more information. Please rate useful posts... :-) ... View more

Wow, this topic keeps you busy. I still don't have a quick fix, but maybe my story can help you in some way. Since my last reply in November 2017, I have experienced the same behavior as shown in your video myself. This was with both "open" and "PSK" networks and with iOS 11.4. After a few of these events in a short amount of time, the iPhone stopped this behavior and started the "send every 90 second a null frame" routine instead. The only thing that I found out, was that the iPhone reported "d evice idle " as "last disassociation reason" when it connected back to the network. The funny thing is that the battery was fully charged, the Wi-Fi signal was excellent and there were also applications active in the background, so no reason for the iPhone to go idle if you ask me. You can find this specific Apple "last disassociation reason" while performing a "client debug xxxx" or on the GUI of the WLC when the iPhone is associated to the network again. I'm wondering if you see the same and with which iOS version you are testing, since I haven't seen it with iOS 12.3. Please rate useful posts... :-) ... View more

The WLC is not a router of course, but it does have a IP routing table just as your PC for example ("route print" on any Microsoft Windows based system). Most switches and routers these days are using a separate routing table (also called a VRF) for the out-of-band management interface. By doing this, the out-of-band management network is completely isolated from any "production traffic". This is very beneficial from a security point of view, but also from operations since a faulty routing change for example will most likely not result in being lock-out of your own management access. Since the 8540 WLC does not use a VRF for the service-port (which is the traditional out-of-band management interface of a WLC), the WLC will also use this interface and related static routes to handle production related traffic. This might cause the asymmetric routing issue I was referring to earlier. Hope this clarify things :-) Please rate useful posts... :-) ... View more

In addition to Leo: be aware that the WLC only has one routing table. Using the service-port can cause asymmetric routing for traffic initiated by the controller towards hosts on the subnet on the service-port or configured static routes on the WLC itself. The 8540 controller is basically a UCS server, so we only configure the in-band management interface and the CIMC interface for box/hardware monitoring. Please rate useful posts... :-) ... View more

Apple clients (iPhone and iPad) will by default ask the end-user to verify the RADIUS server certificate. This happens during the initial connection and when the certificate has been changed. Using a trusted certificate doesn't change this. The only way to get rid of this, is by using a MDM or on-boarding solution so that the device is informed about which certificate it can expect. That way you will see the green "trusted" icon during the initial connection instead of the "unexpected" red one. Do make sure that all of your RADIUS servers are using the same certificate to start with. When more BYOD devices are going to use your infrastructure it might be a good idea to not use your own PKI for the RADIUS server certificate. Some clients don't allow a RADIUS server certificate signed by an untrusted CA, same goes for using a wildcard certificate (wildcard as SAN is fine in my experience). Last but not least, you might want to inform your end-users about expected client behavior upfront. They should check the serial number of the presented certificate to make sure nobody is performing a men in the middle attack, however that might be wishful thinking depending on your end-users. Please rate useful posts... :-) ... View more

You are searching for CSCvk07479. Based on the bug details, there is no recent 8.3 (engineering) code available in which this issue is fixed. The 8.5 code-train is going to be the next "stable" and depending on your platform it might also be the latest supported code-train as well. My recommendation is to check if your hardware is still supported in 8.5. If this is still the case, I would start preparing for an upgrade. Please regular check this page as well.   In the meantime you might consider to restrict network access towards the management interface of the WLC with a firewall or with a CPU ACL on the controller itself. Please rate useful post... :-) ... View more

Hi Johannes, long time no see.. :-) Funny, if have done some testing with Sonos speakers earlier this year as well based on 8.2 and 2800 series APs. Just found out that the speakers do support mDNS since July this year. I haven't tested this though, so I have no idea if it can work with the mDNS gateway in the WLC and how other communication flows are affected by this new feature. From what I have seen in the past Sonos uses both SSDP based on multicast and broadcast (as fall-back?), did you see this as well in your captures? Also, do you happen to know how the communication flows look like when multiple speakers are involved? I have seen some weird registration and also communication issues once multiple speakers are used in a traditional central switched environment. For example some speakers are randomly dropping from the app or don't obey actions like changing the music while others do. Next step is performing packet captures in multiple places simultaneously to figure out what is going on, but maybe you ran already into this? :-) ... View more

"So config the native vlan on AP is just useless." - This is not correct. The FlexConnect AP needs to be aware of the native VLAN in case a client needs to be bridged to the same VLAN as where the AP itself is located in. This way the AP knows that the outgoing client frames should not be tagged and that incoming frames won't have a VLAN tag either. I recommend to always use separate VLANs, but that is another story :-) Please rate useful posts... :-) ... View more

Wireless unicast frames have to be "acked" by the receiver to make sure that the data actually arrived. In case no ack is being received, the sender will send the same data again which is called a retry. There is a limited amount of attempts before the sender gives up and the transmission is considered "failed". This process comes with a price (overhead), but makes wireless a much more reliable medium. Now, the main question in your case is; what is the reason for the retries and do you experience any problems due to these retries? Enabling RTS/CTS may give better results in case you expect the "hidden node" problem within the RF environment. However, before performing any change, can you share some more details regarding this deployment? Things like AP placement, used antennas, configured channels and power, other APs and clients in the same area and, last but not least, the use-case for this bridge connection are crucial to know to be able to help you further with this. Please rate useful post... :-) ... View more

There are two bugs related to these "CDP duplex mismatch" events, you can find more information about those in this field notice. You should be fine with the latest 8.5.135.0 release, but do read the "open caveats" section of the releases notes carefully before deciding to upgrade. The 8.7 release train is a so called "short-lived" with no further maintenance planned, so I don't expect a high deployment rate to be honest. You can better monitor this forum and this page when it comes to deciding on your next AireOS release. Please rate useful posts... :-) ... View more

You can ignore this, I just saw that you opened a new topic for this question. ... View more

Do you happen to know which specific certification/ guidelines are applicable? Within the EU there is something called ATEX for these kinds of environments which uses different zones. I'm only aware of one Cisco AP which is ATEX compliant which is the 1552H. Please rate useful posts... :-) ... View more

Be aware the the support for central switching is limited with the vWLC. Which version of software are you currently using and with which type of APs? In addition, please post the output of the "debug client <MAC>" command when the client tries to associate with the network. ... View more