Configuring wlan/ssid using Prime/NCS 1. On the web interface, under Configure > Controller Template Launch Pad > WLANs > WLAN Configuration > New Controller Template Configure the template name along with the profile/ssid name and choose the interface you wish to map to it. 2. To define layer2/layer3 security on the ssid, click on the Security tab. You can define AAA servers to be used for the ssid under "AAA Servers" tab. Similarly, to define QoS and WMM settings, click on QoS tab. Flexconnect settings, session timeout for client connectivity, DHCP address assignment, access control application can be added from the "Advanced" tab. 3. Once the sssid is configured with all the required parameters, click on Save at the bottom of the screen. 4. You can now either save this template for future use or/and push this WLAN template and apply it to the controllers configured on the Prime 5. You have successfully created a ssid and applied it to the controller from prime. To verify the config, go to Configure>Controllers> select a controller. You should be able to view the ssid under Properties > Settings >WLANs > WLAN Configuration 6. Alternately, for this controller alone you can create a ssid from this page by clicking on "create a wlan" from the top right corner on the screen and hit Go. ... View more

  Introduction Many times we see instances where the RMA controller is shipped with an LDPE image. (Cisco Controller) >show sysinfo Manufacturer's Name.............................. Cisco Systems Inc. Product Name..................................... Cisco Controller Product Version.................................. 7.0.116.0 Bootloader Version............................... 1.0.1 Field Recovery Image Version..................... 6.0.182.0 Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27 Build Type....................................... DATA + WPS + LDPE   ERROR: Incompatible SW image An upgrade to an non LDPE code fails with this error- " ERROR: Incompatible SW image.ERROR: Please install the Data Payload Encryption licensed image " The LDPE image is used for Customers who are not legally allowed to use DTLS Data encryption within their regulatory domain (Russia-specific). Conversion from LDPE to a non LDPE image 1)      Upgrade WLC to 7.0.230.0 LDPE image- e.g.  AIR-CT5500-LDPE-K9-7-0-230-0.aes for a 5508 OR 7.2.110.0 LDPE image AIR-CT5500-LDPE-K9-7-2-110-0.aes 2)      Download and install a free DTLS license from Cisco.com (if one is not already installed): To Obtain a Data DTLS License: Step 1 Browse to http://cisco.com/go/license Step 2 Under Get New, choose IPS, Crypto, Other Licenses Step 3 Choose the controller platform, enter the product ID and serial number. Step 4 Complete the remaining steps to generate the license file.  The license will be provided online or via email. Step 5 Copy the license file to your TFTP server. Step 6 Install the license by browsing to the WLC Web Administration Page: Management --> Software Activation --> Commands -->Action: Install License   3)      Once the DTLS license is installed, you will be able to upgrade/downgrade to any WLC code (including Non-LDPE). (Cisco Controller) >show license summary License Store: Primary License Storage StoreIndex: 0 Feature: base Version: 1.0 License Type: Permanent License State: Active, Not in Use License Count: Non-Counted License Priority: Medium License Store: Primary License Storage StoreIndex: 1 Feature: base-ap-count Version: 1.0 License Type: Permanent License State: Active, In Use License Count: 500 /1 (Active/In-use) License Priority: Medium License Store: Primary License Storage StoreIndex: 2 Feature: data_encryption Version: 1.0 License Type: Permanent License State: Active, In Use License Count: Non-Counted License Priority: Medium         If the controller is on 7.0.116.0 LDPE code; you installed the DTLS license and then tried to migrate to non LDPE code version of 7.0.116.0, it would fail with the following error-   *Transfer: Mar 28 11:32:56.609: RESULT_STRING: Transfer failure : Upgrade from LDPE to non LDPE software is not allowed.   So, you will need to get on to 7.0.230.0 LDPE image (e.g.  AIR-CT5500-LDPE-K9-7-0-230-0.aes for a 5508) or 7.2.110.0 LDPE code first before you can move to a non LDPE code.   This capability was introduced via CSCtw78061; meaning after installing the DTLS license you can download normal image from LDPE code just fine. Option to upgrade image from LDPE to non-LDPE image - CSCtw78061 Description If WLC is running LDPE image (License Data Plane Encryption) image, they are not allowed to download normal image and vice-versa. (This is specific to 7.2(0.18)) Shipping non LDPE image to certain countries is not allowed by regulatory and may be illegal. As part of this CDET, we allow the download of normal image from LDPE image. Symptom: No upgrade/downgrade is allowed from LDPE image to NON_LDPE image. Conditions: transfer download of non-ldpe image from ldpe image Workaround: if there is a dtls license installed and active, then upgrade/downgrade of non-ldpe image from a ldpe image is allowed. Known Affected Releases 7.2(0.18) Known Fixed Releases: 7.0(220.10) 7.0(230.0) 7.2(104.24) 7.3(1.40) 7.2(110.0) 7.2(106.3) 7.3(101.0) 7.0.230.0 Source https://tools.cisco.com/bugsearch/bug/CSCtw78061/?referring_site=bugquickviewclick ... View more

Ideally, the LWAPP access points are plug and play devices. Once you plug a LWAPP AP into a switchport, assuming all the other network config is in place (AP and WLC on same vlan, or AP is able to learn WLC via DHCP or DNS), it should register with the controller just fine. "sh version" on the AP will have a "k9w8" in it instead of a "k9w7" which stands for autonomous. Lightweight/controller based/capwap/lwapp image: Cisco IOS Software, C1130 Software (C1130-K9W8-M), Version 12.4(23c)JZ, RELEASE SOFTWARE (fc1) c1130-k9w8-mx.124-23c.JZ Autonomous/IOS/Standalone image: Cisco IOS Software, C1140 Software (C1140-K9W7-M), Version 12.4(21a)JY, RELEASE SOFTWARE (fc1)c1140-k9w7-mx.124-21a.JY You cannot access the light weight AP via telnet, ssh or web directly. You can only make changes to it via the controller once it registers to it. It is sometimes necessary to make config changes statically on the AP before it registers to the controller; e.g. assign static address, an ip gateway or tell it which controller to join to. This can be done with cli commands via the console port, which are unlike the IOS commands that we are used to. 1. To see all static config on the AP: AP0022.9090.e859#sh capwap ip config LWAPP Static IP Configuration 2. Static config - AP0022.9090.e859#capwap ap ip address 192.168.1.2 255.255.255.0 AP0022.9090.e859#capwap ap ip default-gateway 192.168.1.1 Telling the AP the controller to join- AP0022.9090.e859#capwap ap controller ip address 192.168.1.10 AP0022.9090.e859#sh capwap ip config LWAPP Static IP Configuration IP Address         192.168.1.2 IP netmask         255.255.255.0 Default Gateway    192.168.1.1 Primary Controller 192.168.1.10 To view the AP private-config: AP0022.9090.e859#show capwap client config configMagicMark         0xF1E2D3C4 chkSumV2                4204 chkSumV1                33089 swVer                   7.2.110.0 adminState              ADMIN_ENABLED(1) name                    AP0022.9090.e859 location                default location group name mwarName mwarIPAddress           192.168.1.10 mwarName mwarIPAddress           0.0.0.0 mwarName mwarIPAddress           0.0.0.0 ssh status              Disabled Telnet status           Disabled numOfSlots              2 spamRebootOnAssert      1 spamStatTimer           180 randSeed                0x5B3B transport               SPAM_TRANSPORT_L3(2) transportCfg            SPAM_TRANSPORT_DEFAULT(0) initialisation          SPAM_PRODUCTION_DISCOVERY(1) ApMode                  Local ApSubMode               Not Configured AP Rogue Detection Mode Enabled OfficeExtend AP         [0] Disabled OfficeExtend AP JoinMode[0] Standard Discovery Timer         10 secs Heart Beat Timer        30 secs Led State Enabled       1 Primed Interval         0 AP ILP Pre-Standard Switch Support Disabled AP Power Injector Disabled Infrastructure MFP validation Disabled Configured Switch 1 Addr 192.168.75.48 Configured Switch 2 Addr 192.168.75.52 non-occupancy channels: Ethernet (Duplex/Speed) auto/auto 3. To clear the config- AP0022.9090.e859#clear capwap ap ip address AP0022.9090.e859#clear capwap ap ip default-gateway AP0022.9090.e859#clear capwap ap hostname AP0022.9090.e859#clear capwap ap controller ip address To clear the AP private config- AP0022.9090.e859#clear capwap private-config AP0022.9090.e859#show capwap client config 4. Normally, if the AP cannot find a controller to join, it will automatically reboot. To prevent it from rebooting,- AP0022.9090.e859#debug capwap cli no-reload 5. Prior to configuring the AP: Before the Access Point will allow configuration changes, it is first necessary to enter the following debug command: AP0022.9090.e859#debug capwap console cli This command is meant only for debugging/troubleshooting Any configuration change may result in different behavior from centralized configuration. CAPWAP console CLI allow/disallow debugging is on 6.To upgrade the rcv image on the AP- AP0022.9090.e859#debug capwap console cli archive download-sw /overwrite /force-reload t ftp:// <TFTP SERVER>/<file name> e.g- archive download-sw /overwrite /force-reload t ftp://192.168.5.12/ap3g1-rcvk9w8-tar.124-23c.JA3.tar default password: Cisco The AP should boot up with the lightweight code; "sh version" on the AP will have a "k9w8" in it instead of a "k9w7" which stands for autonomous. 6. Debug commands to monitor the discovery process: AP0022.9090.e859#debug ip udp To view the AP detail (controller ip, operational state, software version): AP0022.9090.e859#show capwap client rcb AdminState                  :  ADMIN_ENABLED SwVer                       :  7.2.110.0 NumFilledSlots              :  2 Name                        :  AP0022.9090.e859 Location                    :  default location MwarName                    :  5508-5 MwarApMgrIp                 :  192.168.75.48 MwarHwVer                   :  0.0.0.0 ApMode                      :  Local ApSubMode                   :  Not Configured OperationState              :  UP CAPWAP Path MTU             :  1485 LinkAuditing                :  disabled AP Rogue Detection Mode     :  Enabled AP Tcp Mss Adjust           :  Disabled Band Direct                 :  Enabled Predownload Status          :  None Auto Immune Status          :  Disabled RA Guard Status             :  Enabled Efficient Upgrade State     :  Disabled Efficient Upgrade Role      :  None TFTP Server                 :  Disabled 802.11bg(0) Radio   GPR Period                : 10   Beacon Period             : 100   DTIM Period               : 0   World Mode                : 1   VoceraFix                 : 0   Fragmentation Threshold   : 2346   Current Tx Power Level    : 7   Current Channel           : 6 802.11a(1) Radio   GPR Period                : 10   Beacon Period             : 100   DTIM Period               : 0   World Mode                : 1   VoceraFix                 : 0   Fragmentation Threshold   : 2346   Current Tx Power Level    : 0   Current Channel           : 165 NOTE - For older APs,"capwap" will not work; in that case replace the "capwap" keyword in all the above commands with "lwapp" ... View more

  Introduction There can be various issues why a client (wired or wireless) is unable to reach the controller management interface. Access to the controller can be in the form of telnet, ssh, http or https. Through this document I have tried to list the things to check to troubleshoot such a problem. Configuration 1). Wired Client for WLC Management Access: a. Check controller configuration for network access- (Cisco Controller) > show network summary Web Mode.................................... Enable Secure Web Mode............................. Enable Secure Web Mode Cipher-Option High.......... Enable Secure Web Mode Cipher-Option SSLv2......... Enable Secure Shell (ssh).......................... Enable Telnet...................................... Disable   Telnet is disabled by default. To enable:  (Cisco Controller) > config network telnet enable To enable https to the controller: (Cisco Controller) >config network secureweb enable You must reboot for the change to take effect. b. Service Port addressing issues. "Note  If the service port is in use, the management interface must  be on a different supernet from the service-port interface. " http://www.cisco.com/en/US/customer/docs/wireless/controller/7.0MR1/configuration/guide/cg_ports_interfaces.html Move the service port to a class B or class C address instead of using the same supernet as the management interface (assuming it is on class A address).  c. Make sure there is no CPU acl applied on the controller. (Cisco Controller) >show acl cpu CPU Acl Name................................ NOT CONFIGURED Wireless Traffic............................ Disabled Wired Traffic............................... Disabled   CPU acls regulate traffic to and from the controller. This could definitely block access to the controller mgmt.  d. Web Admin Certificate issues. If invalid site certificate errors are displayed when attempting to access a controller via web browser https, the local Web Admin certificate may need to be regenerated.  (Cisco Controller) config certificate generate webadmin Creating a certificate may take some time. Do you wish to continue? (y/n) y Web Administration certificate has been generated e. Verify Basic IP Connectivity Check basic ip connectivity from the client to the WLC mgmt interface. Ping the wlc mgmt interface. If that fails, check for any access control that may be configured along the path- between the client and the controller mgmt that could be blocking this traffic. Telnet- tcp port 23 ssh- tcp port 22 http- tcp port 80 https- tcp port 443 If the client is on a different vlan than the wlc, check for inter vlan routing. Move the client to the same vlan as the controller and then try to access the WLC to rule out inter vlan routing issues.  f. Capture a Sniffer Trace. Assuming that the controller is attached to a switch, it will likely be necessary to configure a monitor (span) session to capture a sniffer trace of the controller's traffic.  This will tell us what packets are going to the controller and how (if at all) the controller responds. http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml  g. Debug Packet Logging  This debug allows capturing packets coming to the controller: debug packet logging acl ip 1 permit <WLC mgmt ip> any debug packet logging acl ip 2 permit any <WLC mgmt ip> debug packet logging enable all 1-65535 C:\Program Files\Wireshark> C:\Program Files\Wireshark>text2pcap.exe Must specify input and output filename Text2pcap 1.0.99CAPWAP_0.0.1 Generate a capture file from an ASCII hexdump of packets. See http://www.wireshark.org < http://www.wireshark.org/ >  for more information.   Usage: text2pcap [options] <input-filename> <output-filename> h. Check the controller syslog and trap logs for any suspicious behaviour. show msglog show traplog  i. In some corner cases, we did spot only https access broken while ssh and http worked fine. Saw the following in the bootup log- -> "Starting portmap deamon" Warning!!!: You don't seem to have internal USB storage for lic/cert Please request for one and add to the system -> "Starting "VPN-Services" Unable to load system certificate!!! Contact your Cisco Systems Inc. technical support representativeok -> "Starting Management Services:    Web Server: ok    CLI: ok    Secure Web: Web Admin Certificate not found (error).    License Agent: ok   This issue requires hardware replacement for resolution. j. LAG and switch channel distribution method If LAG is enabled on the controller, check the load balancing algorithm enabled on the controller. Use only ip-src or ip-src ip-dst load balancing options in the switch EtherChannel configuration. Some switch models might use incompatible load balancing mechanisms by default, so it is important to verify. This is how to verify the EtherChannel load balancing mechanism: switch#show etherchannel load-balance EtherChannel Load-Balancing Configuration: src-dst-ip EtherChannel Load-Balancing Addresses Used Per-Protocol: Non-IP: Source XOR Destination MAC address IPv4: Source XOR Destination IP address IPv6: Source XOR Destination IP address   This is how to change the switch configuration (IOS):     switch(config)#port-channel load-balance src-dst-ip k. FIPS configuration After FIPS is enabled on a controller, sometimes users are unable to https into the controller when using IE6 or IE7.    Prior to enabling FIPS they did not experience any problems. The issue is specific to IE7 and IE6+, firefox does not appear to have this issue.  l. Management Access Priority Order configuration If Tacacs or Radius is the primary management access method, confirm that the management user credentials are present on the authentication server.  If the Tacacs or Radius server is unavailable or unreachable, the controller will revert to locally configured credentials. (Cisco Controller) >show aaa auth Management authentication server order:     1............................................ radius     2............................................ local   2) Wireless Client for WLC Management Access: a. Access to the controller interface from a wireless client is disabled by default. (Cisco Controller) >show network summary Mgmt Via Wireless Interface................. Disable Mgmt Via Dynamic Interface.................. Disable   To enable: (Cisco Controller) >config network mgmt-via-wireless enable b. Additionally, you can use the following command to access the controller via the dynamic interface mapped to the ssid/wlan the wireless client is connecting on:  (Cisco Controller) > config network mgmt-via-dynamic-interface enable  (Cisco Controller) >show network summary Mgmt Via Wireless Interface................. Disable Mgmt Via Dynamic Interface.................. Enable   c. Verify Basic IP Connectivity Ping the dynamic interface ip from the wireless client. Does that work? Check for any acls along the path. d. Compare with same Vlan Wired Client  Place a WIRED client on the same vlan as the dynamic interface and have that wired client http and/or telnet to the controller both via management and dynamic interface. This will isolate if the problem is with wired or just wireless client.   Telnet /SSH to the WLC management fails if the client from which we are starting the session is in same subnet as of Service port . This is documented in Cisco WLC config guide as well . Service Port Cisco 4400 and Cisco 5500 Series Controllers also have a 10/100/1000  copper Ethernet service port. The service port is controlled by the  service-port interface and is reserved for out-of-band management of the  controller and system recovery and maintenance in the event of a  network failure. It is also the only port that is active when the  controller is in boot mode.. Use of the service port is optional. Caution Do  not configure wired clients in the same VLAN or subnet of the service  port on the network. If you configure wired clients on the same subnet  or VLAN as the service port, you will not be able to access the  management interface. Reference Cisco Wireless LAN Controller Configuration Guide, Release 7.0 - Configuring Ports and Interfaces   ... View more