Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Brett Verney
Brett Verney
Beginner
Accomplished Network Engineer with experience across a wide range of industry verticals; most notably the Education Sector. A passion for all things WiFi with a vast experience across many different routing, switching and network security technologies.
Currently working for a large integrator specialised in deploying Cisco and HP networking infrastructure.
Recent Badges
Stats
Member since
11-14-2012
144
Posts
69
Helpful
6
Solutions
Certifications
Created by
Brett Verney
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
04-30-2019
06:20 PM
04-30-2019
06:20 PM
Created by
Brett Verney
in Wireless and Mobility
in Wireless and Mobility
04-30-2019
06:09 PM
04-30-2019
06:09 PM
Firstly - Use an address in the RFC5737 Range (192.0.2.0/24 ) for your Virtual Interface. You will need a public CA signed certificate for the host name and domain you choose under the Virtual Interface settings on the WLC. The domain name can be any registered domain name that you own. The DNS host name can be anything, as long as your clients can resolve that address via DNS. I quite often create a DNS server on a dedicated Guest Router, where it forwards all DNS requests to the upstream public DNS servers, except it has a local entry for the virtual interface (resolves wlc.domain.name to 192.0.2.1 in this example).
... View more
Created by
Brett Verney
in Wireless and Mobility
in Wireless and Mobility
04-30-2019
05:46 PM
04-30-2019
05:46 PM
Unfortunately the 7500 series WLCs are one of the few that can't be used as Guest Anchors, as you mentioned. If you cannot easily replace the 7500 I would suggest getting a dedicated Guest Anchor WLC. The 3504 is a great option as it supports: 4-Gbps throughput 3000 clients 1x Multigigabit Ethernet interface (up to 5 Gigabit Ethernet), + 4x 1 Gigabit Ethernet 4096 VLANs
... View more
Created by
Brett Verney
in Wireless Security and Network Management
in Wireless Security and Network Management
02-17-2018
03:49 AM
02-17-2018
03:49 AM
I've just run in to the same issue. Same model AP, same firmware version. Consistant accross 4 seperate batches of APs (running multiple projects at a large International Airport. Not happy!
Have tried rebooting a number of times and can't get any of them to work. Other models and/or versions of code are working fine.
-Brett
... View more
10-12-2017
11:58 PM
Hi all,
I have an ASR router terminating multiple 'guest wireless' VRFs, but the router is using a single ISP connection housed in the Global Routing Table. I require that client subnets within each VRF use the same ISP next hop address within the GRT.
I found the command below that lets me leak the default route from the GRT to the GUEST vrf (for example).
ASR WAN int - 1.1.1.1
ASR-->ISP next hop - 1.1.1.2
Client Subnet in GUEST VRF - 10.10.10.0/24
ip route GUEST 0.0.0.0 0.0.0.0 1.1.1.2 global
When the return traffic from the Internet arrives at the router, how do I route it back to the 10.10.10.0/24 within the GUEST VRF?
Can I simply use;
ip route 10.10.10.0 255.255.255.0 <GUEST_VRF_next_hop>
What if I was using OSPF to advertise the internal client subnets (within each VRF) to the ASR router?
Unfortunately I don't have the ability to test this at the moment, it's still in design stage. I'm looking for the absolute easiest way to implement this. Don't have the ability to run BGP...
Any ideas would be greatly appreciated!
-Brett
... View more
Labels:
Re: Flexconnect with Active Directory s...
in Other Wireless - Mobility Subjects
08-24-2017
04:45 AM
08-24-2017
04:45 AM
Can you show the output of: debug client <mac-address> debug aaa ldap enable Unfortunately the Windows Event Viewer isn't fantastic for LDAP logging (from memory). Have you configured the WLAN for LDAP support?
... View more
Created by
Brett Verney
in Wireless Security and Network Management
in Wireless Security and Network Management
08-24-2017
04:24 AM
08-24-2017
04:24 AM
Using a single OpenSSL command = openssl req -newkey rsa:2048 -nodes -sha256 -keyout privkey.key -out cert.csr -subj "/C=US/ST=New York/L=Brooklyn/O=Acme/OU=IT/CN=server.domain.com/emailAddress=it@acme.com" If you Subject Alternative Names: openssl req -newkey rsa:2048 -nodes -sha256 -keyout privkey.key -out cert.csr -subj "/C=US/ST=New York/L=Brooklyn/O=Acme/OU=IT/CN=server.domain.com/emailAddress=it@domain.com/subjectAltName=DNS.1=server1.domain.com,DNS.2=server2.domain.com,DNS.3=server3.domain.com" If using Subject Alternative Names, ensure that whatever is in the common name field is also present in the SAN fields. You can use a wildcard in CN or SAN field (i.e. *.domain.com) -Brett
... View more
Re: Configuring Wireless Lan Controller...
in Wireless and Mobility
08-24-2017
04:14 AM
08-24-2017
04:14 AM
Do you see anything in the RADIUS live logs for that client in ISE? If not, from the WLC CLI you can run; debug client <mac-address> debug aaa all enable If your laptops are connecting to the wireless before the user logs in, chances are your laptops are authenticating to ISE using computer authentication, regardless of whether you are also using doing user authentication. -Brett
... View more
Created by
Brett Verney
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
08-24-2017
04:05 AM
08-24-2017
04:05 AM
100% agree with Philip. Push down user or computer certificates (or both) to the corporate workstations and ensure your NPS policies only allows; EAP-TLS connections Client certificate signed by your internal PKI Domain Computers BYOD devices will then only be able to access the BYOD SSID. -Brett
... View more
Re: Flexconnect with Active Directory s...
in Other Wireless - Mobility Subjects
08-24-2017
03:55 AM
08-24-2017
03:55 AM
Hi Muhammad , What are you using as your RADIUS server for PEAP authentication? Microsoft NPS? If you have the RADIUS server IP address(es) and shared secret configured configured correctly on the WLC, you could run the following WLC debugs from the CLI. debug client <mac-address> debug aaa all enable You could also check the logs on whatever RADIUS server you are using. -Brett
... View more
Created by
Brett Verney
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
08-24-2017
03:42 AM
08-24-2017
03:42 AM
LollerSkates Ric! Training centres in Brisbane offering instructor lead courses for a cool AU $6700 or all 4 courses for an amazing discounted price of $25,000. Sometime I wish I skipped the CCNP and went straight for the CCIE. It's been 3 years of study, probably be another 2 more unless Study Guides come out sooner.
... View more
Created by
Brett Verney
in Network Security
in Network Security
08-24-2017
03:29 AM
08-24-2017
03:29 AM
Hi Eric, If you think of sub-interfaces the same way you would if they were seperate physical interfaces, it should help visualise the traffic flows. 1 - PC1 will send data 'inbound' to Gi0/0.10. 2 - ASA will send data 'outbound' via Gi0/0.20 (where PC2 is located) You could permit or deny ICMP traffic for your example using the direction listed above. When PC2 does an ICMP reply to PC1, the opposite flow comes in to effect. 1 - PC2 sends traffic 'inbound' to Gi0/0.20 2 - ASA sends traffic 'outbound' via Gi0/0.10 (where PC1 is located) So if you ICMP traffic was being denied from PC1 to PC2, you would have to check both the INBOUND and OUTBOUND ACLs on both interfaces. Check out the image below. Uses a router and it's SVIs as an example but the concept is the same. Also remember there is an order of operations, so if you have NAT, application inspection etc, you will have to take this in to consideration too. Hope this helps -Brett
... View more
Created by
Brett Verney
in Network Access Control
in Network Access Control
08-24-2017
02:55 AM
08-24-2017
02:55 AM
Hi George, Thanks for your assistance. We did exactly as you suggested and works well. Thanks again, Brett Verney
... View more
Created by
Brett Verney
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
08-24-2017
02:48 AM
08-24-2017
02:48 AM
I search for material every 3 months or so hoping there is something better. I was lucky enough to get 3 of the 4 old exams under my belt before the new ones came along. The thing is, I know my stuff as I deploy Cisco Wireless for a living but have no idea what is going to be in that last exam. I refuse to go through the 1000s of pages of study material without knowing what is relevant. I love the Cisco Study Guides and find I can go through them once or twice and pass the exam no problems. Why does the Wireless track always get left behind? -Brett
... View more
Created by
Brett Verney
in Network Access Control
in Network Access Control
07-31-2017
10:09 PM
07-31-2017
10:09 PM
Hi all, I have a customer who currently authenticates approximately 200 Cisco 3G WAN Interfaces to a FreeRADIUS server hosted in their data centre, proxied through through their ISP RADIUS servers. I am looking to migrate this to ISE. Currently the network administrators add the PPP user/password/IP address details in a .conf file in FreeRADIUS and the 3G routers authenticate here - easy stuff! Each WAN interface MUST be assigned the same IP address. However I can't see how I can accomplish this in ISE without creating 200 local identities, 200 matching AuthZ policies, with 200 matching AuthZ profiles. In good old ACS, you could assign an IP address to each of the locally created users, and have a single AuthZ profile that says something like RADIUS:Framed-IP-Address = User-IP-Address. Without the User IP address field available, I have to create individual policies to map an IP address to a user. I was thinking that I could use the IP address field in the NAS and map this to the Framed-IP-Address attribute. However the 3G interfaces are not see on ISE as NAS's, they are users authenticating through the NAS. The only NAS ISE sees is the ISP RADIUS proxy server. I don't care how I achieve this, I just need to assign static IP addresses using the Framed-IP-Address attribute to authenticating PPP sessions. I am OK for the users themselves to be created locally within ISE. Any advice would be greatly appreciated. -Brett Verney
... View more
Labels:
Created by
Brett Verney
in Wireless and Mobility
04-30-2019
04-30-2019
Firstly - Use an address in the RFC5737 Range (192.0.2.0/24 ) for your
Virtual Interface. You will n...
Created by
Brett Verney
in Wireless and Mobility
04-30-2019
04-30-2019
Unfortunately the 7500 series WLCs are one of the few that can't be used
as Guest Anchors, as you me...
02-17-2018
I've just run in to the same issue. Same model AP, same firmware
version. Consistant accross 4 seper...
Created by
Brett Verney
in Routing
10-12-2017
10-12-2017
Hi all, I have an ASR router terminating multiple 'guest wireless' VRFs,
but the router is using a s...
Created by
Brett Verney
in Other Wireless - Mobility Subjects
08-24-2017
08-24-2017
Can you show the output of: debug client debug aaa ldap
enable Unfortunately the Windows Event Viewe...
Created by
Brett Verney
in Wireless Security and Network Management
08-24-2017
08-24-2017
Using a single OpenSSL command = openssl req -newkey rsa:2048 -nodes
-sha256 -keyout privkey.key -ou...
08-24-2017
Do you see anything in the RADIUS live logs for that client in ISE? If
not, from the WLC CLI you can...
Created by
Brett Verney
in Other Wireless - Mobility Subjects
08-24-2017
08-24-2017
100% agree with Philip. Push down user or computer certificates (or
both) to the corporate workstati...
Created by
Brett Verney
in Other Wireless - Mobility Subjects
08-24-2017
08-24-2017
Hi Muhammad, What are you using as your RADIUS server for PEAP
authentication? Microsoft NPS? If you...
Created by
Brett Verney
in Other Wireless - Mobility Subjects
08-24-2017
08-24-2017
LollerSkates Ric! Training centres in Brisbane offering instructor lead
courses for a cool AU $6700 ...
Created by
Brett Verney
in Network Security
08-24-2017
08-24-2017
Hi Eric, If you think of sub-interfaces the same way you would if they
were seperate physical interf...
08-24-2017
Hi George,Thanks for your assistance. We did exactly as you suggested
and works well.Thanks again,Br...
Created by
Brett Verney
in Other Wireless - Mobility Subjects
08-24-2017
08-24-2017
I search for material every 3 months or so hoping there is something
better. I was lucky enough to g...
Public Statistics
| Date Registered | 11-14-2012 10:19 PM |
| Date Last Visited | 06-28-2019 12:02 AM |
| Total Messages Posted | 144 |
| Total Helpful Votes Received | 69 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
