originally the controller/WLC was a hardware appliance you needed to buy and install in a cabinet. later Cisco developed a virtual controller/vWLC you could run under VMWare (on a Cisco UCS server) with the same functionality and last Cisco developed a technique to run the vWLC AND the access point software on a physical access point the last is called the Mobility Express software image. (For large environments a physical appliance is still prefered.)   So if you have a physical or virtual controller in your company you do not need to download and  run the " CAPWAP controller based software to configure them ", - you connect the AP to your network - the AP registers itself to the controller (if network properly configured) - you login into the existing controller - from the controller you configure the access point.that pushes cthe configuration to the access point.   if you start fresh in a greenfield, then the you need to som more work.     ... View more

look at this discussion for a description what is and what is not possible. look at this document under Rogue Detection – Configuration Steps for configuration steps needed. and this document Rogue Management in an Unified Wireless Network ... View more

look at this discussion for a description what is and what is not possible. look at this document under Rogue Detection – Configuration Steps for configuration steps needed. and this document Rogue Management in an Unified Wireless Network   again be aware of legal implications dennischolmes Rising star   ‎05-14-2008 02:13 PM Re: WLC "rogue containment" - What does it actually do? One other little tid bit I mentioned earlier. Do NOT contain local businesses that are not a direct threat to your network. This is a direct violation of the FCC good neighbor policy. When you send deauth packets all clients attached to the rogue get those and are dropped. Not just your clients. Contain with care my friend. If the local coffee shop is a problem then set your clients to only attach to a particular list of APs by mac address. This will keep them home where they need to stay and will not get the FCC and a bunch of lawyers on your case.   ... View more

check if command below is present in your configuration   network-clock synchronization automatic Enables the network clock selection algorithm. (Note that network clock synchronization is disabled by default.) Disables the Cisco-specific network clock process, and turns on the G.781-based automatic clock selection process. ... View more

I do not tink you really shut down the radio interface, the hardware installation guide  page 1-136 suggests: the AP is not communicating with the wireless controller   you must see the router as having  two additional devices  integrated an access point and a wireless controller,   you may only have shutdown the controller, but the access point may still be active.   t ... View more

I guess not - Public Internet traffic should go directly from the client to the router. would indicate you have a direct L2 connection between the router and the clients (same vlan) - I'd also like to advertise the ULA prefix from the layer 3 switch in RA packets would indicate you have a L2 connection between the clients and the L3 switch ,   both rules combined would mean both the L3 switch and the router are on the same vlan -> the client will receive RA packets from both the router AND the switch.   ... View more

I'm with @Karsten Iwen look at this document table-3: 2. Supported only on the universalk9_npe image.   ... View more

look at this post no route map,  but ip nat portmap check if your IOS version supports this command.   and this post  that says: If you notice on the last command that you are not allowed to use a route-map on an interface so I had to type in the WAN ip address.  ... View more

Hi Dom I'm glad you found the root cause and  thank you for reporting this good luck ... View more

start reading at this link Cisco Wireless Mesh Access Points, Design and Deployment Guide, Release 8.0        ... View more

1) look at this post for some optional causes 2) and this Field Notice: FN - 63916 that says:  Some Wireless Access Points (APs) manufactured between August 2014 and October 2014 might have an incorrectly programmed SHA-2 certificate. 3) check the software version on the 1702 is compatible with the version ME version on the 1832 Cisco Mobility Express Solution Compatibility Matrix   ... View more

do you refer to blocking rogue access points? (access points that are out of your control) the WLC has an option for rogue access point containment.   be aware!!!  there may be legal issues when doing this on the wireless network you cannot block wlans that your neighbor company uses !!! of course you have more rights to block rogue access points to connect to you wired network (you may block those lan ports) ... View more

??? -  10.32.25.126 is the CheckPoint VLAN sub-interface -  The CheckPoint firewall is NOT my DHCP server. -  *DHCP Socket Task: Sep 09 14:11:47.365: 38:ca:da:d9:e4:bb DHCP sending REQUEST to 10.32.25.126 (len 350, port 13, vlan 165)   this information seems inconsistent! in "sending request to..." the DHCP server should be mentioned not the default gateway. unless you somewhere in the controller configured reference to the address  10.32.25.126   and as this is not your DHCP server, the DHCP request will fail.   you mentioned  -  I have configured the DHCP server IP addresses in the dynamic interface configuration (WLC) from very begging. did you also enable dhcp proxy on the interface? or only global? if global, enable proxy mode on the dynamic interface.   Troubleshoot  debug dhcp packet enable The debug shows a controller that receives a DHCP request from a client with MAC address 00:40:96:b4:8c:e1, transmits a DHCP request to the DHCP server, receives a reply from the DHCP server, and sends a DHCP offer to the client. (Cisco Controller) >debug dhcp message enable   ... View more

the network layout is still not clear to me clear: 10.32.25.126 is the CheckPoint VLAN sub-interface but is the checkpoint also the DHCP server? or is the DHCP server behind the checkpoint? if behind the checkpoint you need to configure the DHCP-servers address in the dynamic interface configuration. The unicast destination must be the DHCP-server, and this will be normal routed/forwarded to the destination.   I suggest to first disable dhcp-proxy and see if the checkpoint properly processes the dhcp-request on this vlan ... View more

if it is not the wireless environment..... Chrome OS upgrades happen automatically and quietly, with no annoying delays or notifications. ... View more