Introduction This document describes the steps to correctly perform throughput Wireless speed testing. Testing the maximum speed that can be achieved over Wireless networks will be depending on a variety of factors that will be discussed in this article. Prerequisites Requirements There are no specific requirements for this document. Components Used The information in this document is based on these software and hardware versions: Cisco Wireless LAN Controller 2504 - Version 7.6.130.0 Cisco Wireless Lightweight 3702 Access Point in FlexConnect Local Switching mode. Gigabit Cisco Ethernet Switch - Cisco IOS 12.2.55 MacBook Pro Retina 2014 with Broadcom BCM43xx Chipset - OS X Gigabit Ethernet Wired Laptop - Windows XP The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command. Configure Network Diagram Preparing the test environment The most crucial and important step to obtain accurate and correct Wireless throughput testing is the setup on which you are going to perform the test. There are a lot of things to take into consideration when performing such a test and the variables can influence the results dramatically Before laying out the setup and how to prepare it, let us have a quick look at the different wireless protocols and announced speeds that they can achieve: 802.11b: The 802.11b standard has a maximum raw data rate of 11 Mbit/s. 802.11g: It operates at a maximum physical layer bit rate of 54 Mbit/s exclusive of forward error correction codes, or about 22 Mbit/s average throughput. 802.11a: It operates in the 5 GHz band with a maximum net data rate of 54 Mbit/s, plus error correction code, which yields realistic net achievable throughput in the mid-20 Mbit/s. 802.11n: It operates at a maximum net data rate of 600 Mbit/s. Channel width support of up to 40 Mhz. 802.11ac Wave 1: It operated at a maximum net data rate of 1300 Mbit/s. Channel width support of up to 80Mhz. 802.11ac Wave 2: to be release will be support channel with of up to 160 Mhz. In this document we are going to test 802.11ac Wave1. Below are the steps to correctly setup a Wireless throught test environment: 1) Prepare the Wireless Client: Whether you are going to test with a Laptop, a PC with Wireless NIC or with a Handheld phone or tablet. The first thing that you need to look at is the Wireless chipset. If you want to test 802.11ac, then you need to make sure that the chipset is 802.11ac capable. You need to look at the chipset vendor and ensure you are having the latest drivers installed. Having the latest drivers installed does not mean that you are bug-free. 802.11ac is in Wave 1 and different manufacturers are continuously working towards improving the speeds that their chipsets are able to achieve. In case you are using a USB WIFI 802.11ac NIC card, then you need to make sure that the port on which you have plugged the USB NIC card is USB3. For example: USB 1.0 specified data rates of 1.5 Mbit/s (Low-Bandwidth) and 12 Mbit/s (Full-Bandwidth). USB 2.0 was released in April 2000 (now called "Hi-Speed"), adding higher maximum signaling rate of 480 Mbit/s (due to bus access constraints the effective throughput is limited to 35 MB/s or 280 Mbit/s). While USB 3.0 was released in November 2008. The standard defines a new SuperSpeed mode with a signaling speed of 5 Gbit/s and, due to encoding overhead, usable data rate of up to 4 Gbit/s. So for example, in case you want to test 802.11ac or 802.11n with a USB NIC Card plugged to a USB1 port then your test is invalid because your throughput is going to drop on the USB port itself. 2) Prepare the Access Point and its mode: In this example we are using the Cisco 3700 802.11ac AP. The AP will be connected to a Gigabit Ethernet 1000Mbit/s switchport. This is eventually very important, because if we plug the AP to a 10/100Mbit/s switchport then our 802.11ac test will be invalid. The throughput will drop on the AP switchport connection. AP operational mode is also important. In this guide we have configured the AP in flexConnect Local Switching mode. This is done in order to terminate the Wireless Client traffic against which we will measure the throughput on the local Switch itself. In case the AP is operating in Local Mode, then the obtained throughput will rely on the Network Cloud between the AP and the WLC. In case there is a single point or connection that is congested or rate limiting is applied then our throughput results will return invalid. Make sure that no FlexACL or any other features that could interfere on Packet forwarding is interfering in the test. 3) Prepare the switch: In this example we are using an 8 ports Gigabit Ethernet Cisco Switch on which we have connected our 3700 AP, our 2504 WLC and our Server against which we will be simulating some traffic. All devices are connected via Gigabit Ethernet in Full duplex mode at 1000Mbit/s. There is no ACLs, rate-limiting, policing applied. 4) Prepare the Server: We do see in TAC customers getting wrong speed results because they ran a Wireless speedtest against the internet and reporting issues about the low Wireless throughput results they got. As highlighted previously on this document, throughput is depending on where the traffic is going to travel. In case you are testing 802.11ac against the internet then you need to ensure that between your test Client and test Server (on the internet) you are having 1000 Mit/s connections end to end without any congestion. That is eventually impossible. You will very rarely be able to achieve real 802.11ac results on the internet unless if the Internet server you are testing against has been Fiber connected with you. 5) Choose the WIFI Channel: Since we are testing 802.11ac speeds here, we are going to go with 80 Mhz channel width. We have ran a quick channel scan in our environment to make sure we are using the four least congested channels for this test and we have chosen channels 36, 40, 44 and 48. In Europe these channels are DFS free so that is also a plus to achieve most stability while running the tests. We are going to test in real life office environment and we are not going to test in shielded room to avoid too optimistic results which do not relate with real-life deployments and applications. 6) Choose the SSID: 802.11ac (and 802.11n) are only supported on open or AES encrypted SSIDs. For our test and in order not to compromise any security, we have configured an SSID with WPA2+AES and preshared Key management. WMM is enabled on the SSID. We also checked scan defer for all priorities and not just 4,5,6 under the advanced tab on the SSID to avoid off-channel scanning to interfere and affect our testing results. 7) Choose the IP addressing Layout: In our test we will have everything on a flat VLAN. Meaning the AP, the WLC, the Wireless Client and the Wired Server are all on the same VLAN for simplicity and to avoid any potential routing or switching issues that go beyond the purpose of this document and to keep it simple. We also keep this on a flat VLAN to exclude any NPU related processing on the switch itself outside of the Wireless speed benchmarking. 8) Choose the testing tool: In this test we are making use of IPerf which is a freeware application that can run under a variety of operating systems such as Windows, MAC OS and Linux. The application requires two machines where one acts as a listening Server and one as a sending Client. IPerf generates traffic from the Client side towards the Server side and the results are displayed on how much traffic we were able to send under a specific time window and what throughput was achieved. You might be curious to choose another application like FTP for your testing. Or Windows file sharing. There is an important detail to highlight here. FTP relies on the disk read/write speed as well while Iperf does not since it is traffic handling on the NIC itself. So in case you are having some really old IDE type Hard Drive on your Server side results will be affected in a negative way. Windows file sharing also can have varying speeds depending on Microsoft proprietary file transfer protocol which lower down the speeds in certain cases. So the bottom line for this is to use IPerf for throughput testing. 9) Choose the AP location: Consider a normal distance between your wireless client and the Access Point. Ideally this should be around 2 meters (6 feet) with clear line of sight between the test client and the AP. Avoid having obstacles or metal plates between your wireless Client and your AP. Last but not Least ensure the AP have the correct number of Antennas plugged in and make sure that on the Radio configuration page, all Antennas have been selected 10) Pay attention to cables: Using good ethernet cables would make a lot of difference. So be sure that the cables you are using are in good shape. And ensure the cable is having 8 pins connected and not just 4. 11) Calibrate the switch ports: It is a big plus if you can calibrate and benchmark the switch ports on which you are going to perform the Wireless throughput test. So in case you have your Iperf Server on Gig0/1 and you FlexConnect 802.11ac AP on Gig0/2. Then disconnect the AP from Gig0/2 and plug in another PC with Gigabit connection. Run the Iperf test first of all on Wired end-to-end so you can benchmark the maximum you expect to get without any Wireless being involved. If you see something like 80Mbps then you know there is already something wrong even before making use of Wireless. Begin the test 1) Download IPerf and install it on both the wireless Client and the Wired Server. 2) Connect the Wireless Client to the test SSID and ensure that it has connected with 802.11ac speed .   3) On the Server PC from Command prompt run this command: Iperf ­-s ­w 1024k 4) On the Client run this command: iperf -c <ip address of Server> -w 1024k -t 30 Example: $ ./iperf -c 192.168.1.184 -t 30 -w 1024k -P 5 -------------------------------------------------- ---------- Client connecting to 192.168.1.184, TCP port 5001 TCP window size: 1.00 MByte (WARNING: requested 1.00 MByte) -------------------------------------------------- ---------- [ 4] local 192.168.1.185 port 61778 connected with 192.168.1.184 port 5001 [ 8] local 192.168.1.185 port 61782 connected with 192.168.1.184 port 5001 [ 7] local 192.168.1.185 port 61781 connected with 192.168.1.184 port 5001 [ 5] local 192.168.1.185 port 61779 connected with 192.168.1.184 port 5001 [ 6] local 192.168.1.185 port 61780 connected with 192.168.1.184 port 5001 [ ID] Interval Transfer Bandwidth [ 4] 0.0-30.0 sec 283 MBytes 79.2 Mbits/sec [ 7] 0.0-30.0 sec 265 MBytes 74.0 Mbits/sec [ 6] 0.0-30.0 sec 282 MBytes 78.9 Mbits/sec [ 8] 0.0-30.0 sec 152 MBytes 42.5 Mbits/sec [ 5] 0.0-30.0 sec 262 MBytes 73.2 Mbits/sec [SUM] 0.0-30.0 sec 1.21 GBytes 348 Mbits/sec  5) The results we got in our tests for 802.11ac was around 400Mbit/s ~ 450Mbit/s Below we will highlight some snapshots and pictures form our configuration:     More Information How to Improve Performance Channel utilization—Network analyzers report channel utilization in percentage of time spent transmitting and receiving frames. This helps to measure the potential variance in speed due to distance from an access point. This will help monitor and see for example, if a channel is fully occupied transmitting at 1Mbps under ideal conditions would perform at 0.94Mbps under 100% utilization. The physical medium used in wireless as well dictates the performances. Using 802.11g or 802.11a over 802.11b offers much higher throughputs, often up to 30 mbps over 802.11b where a 6mpbs radio capacity is divided between all the associated stations. Cell Sizes—It is recommended to shrink the cell sizes to have the clients as closer to the APs as possible. This will benefit the data rates at which the client can connect to the AP. This can be done by reducing the power levels on the AP to the lowest. Shrinking cell size also decreases co-channel interference. If using RRM, the APs should pick channels dynamically per the deployment. However, if implementing dynamic channel assignment, ensure that you do not have two APs at high power levels on the same channel right next to each other. Protection also causes throughput hit. Reference Factors that Affect 802.11n Throughput Troubleshoot the Controller for 11n Speeds ... View more

This guide has been tested in TAC LABs. At the end of the guide, the wireless phone 7925 was able to associate to the SSID(s) and place calls. QoS was also working fine by verifying end-to-end tagging.   Introduction   This document covers step by step guide for configuring the cisco 5760 and 3850 WLC(s) to be inline with the voice over wireless requirements. This is an equivalent document for the already existing Voice over WLAN deployment guide applicable for the previous WLC models ex. 5508, WiSM...   The 5760 and 3850 are the new WLC models that have been recently released by Cisco. They run a new set of commands for configuration, thus the requirement for a new voice over wireless LAN deployment guide.   Requirements   This document doesn't cover startup configuration for the 5760 and 3850 WLC(s). For more infomation about this particuar task please visit this the following document on support forums. This document assumes that the wireless access points have already joined the WLC 5760 and/or 3850 This document doesn't cover Call Manager configuration and assumes that it is already correctly configured and ready to host IP phones. This document assumes that you already have a Radius Server in your network ready to authenticate and authorize the Wireless IP phones. This document assumes that all required ports for Skinny, RTP, CAPWAP and other relevant ports have already been opened on your Firewall and allowed in your any Access Lists. This document assumes that an appropriate voice over wireless LAN RF site survey has been done for 5Ghz and that the correct requirements are being met for signal strength, cell overlap, noise level, ap placement and so on... Again refer to the 7925 voice over wireless LAN deployment guide for more information about these requirements.   Recommended software versions   In order to benefit from the most recent and improved scanning algorithm, it is recommended to run code 1.4.4 and above on the Cisco Wireless IP phones. In order to benefit from the GUI on the 5760 and 3850 also to run the most recent code ensure you are on code 03.02.02.SE.150-1.EX2 and above (This is valid on June 25 2013)   LAB devices and software versions in use   Cisco 7925 Wireless IP phone code 1.4.5.3 Cisco 5760 WLC running code 03.03.03SE Cisco lightweight 1142, 3600, 3700 AP ISE code 1.2 CME code 12.4.22.YB4   Configuring Voice Layer 3 Interface and Layer 2  VLAN on the WLC   CLI Example   1- Create the Layer 2 VLAN for Voice. w-5760-3#conf t w-5760-3(config)#vlan 100 w-5760-3(config-vlan)#name VoiceVLAN w-5760-3(config-vlan)#end w-5760-3#write mem 2- Create the Layer 3 interface for the voice VLAN. w-5760-3(config)#interface vlan 100 w-5760-3(config-if)#no shut w-5760-3(config-if)#ip address 10.1.1.20 255.255.255.0 w-5760-3(config-if)#description Voice VLAN w-5760-3(config-if)#ip helper-address 10.1.1.2 w-5760-3(config-if)#end w-5760-3#write mem   3- Add Vlan 100 on the uplink trunk connecting the WLC with the network w-5760-3(config)#interface tenGigabitEthernet 1/0/1 w-5760-3(config-if)#switchport trunk allowed vlan 1,2,100 w-5760-3(config-if)#do sh run int te 1/0/1 interface TenGigabitEthernet1/0/1  switchport trunk allowed vlan 1,2,100  switchport mode trunk  ip dhcp snooping trust     GUI Example   1- Navigate from your browser to http://ipaddress/wireless. Example http://192.168.1.20/wireless 2- Go to Configuration -> Controller 3- Expand System 4- Exand VLAN 5- Click on Layer 2 VLAN 6- Click on New and then fill in the VLAN ID and the name. Ensure it is in Actice state as shown in this example:     7- Click on Apply. 8- Click on Layer 3 Interface 9- Click on New to crate a new interface 10- Insert the VLAN ID, description, ip address and other filed in similar to what has been entered below..   11- Click on Apply and then Save configuration   12- Click on Port Summary under Interfaces and add vlan 100 to the Trunk Vlan [Allowed]     Configuring the 802.11 Radio Band settings    In this document, we are going to use 5Ghz for voice.     If using 5Ghz, these are the recommended settings:           Ensure you set DCA interval to 24hours with midnight anchor time. This is to avoid any DCA channel changes during work hours. Further, for your DCA algorigthm choose to avoid channels with high Load or Interference.   Last, in your channel selection, the least amount of channels you select, the best, this way the channel scan list that the phone has to do in order to find the next best AP is smaller and assures better roaming experiencing.          Ensure you enabled Call Admission Control for Voice.   **Use ap dot11 5ghz exp-bwreq via the CLI to enable Expidited Bandwith for e911 calls**         EDCA has to be wmm-default   Here are the TPC settings.           Here are the roaming parameters:       If you have however decided to use 2.4Ghz for Voice, then make sure you also adapt the data rates and that you are only using channels 1,6 and 11 which are the only non overlapping channels on the 2.4ghz band. The rest should be configured the same way as has been highlighted for the 802.11a band above.         Ensure you enable CleanAir to avoid Interference                   Configuring the QoS Policy   We will show how to do QoS on SSID level for upstream and downstream traffic. The guide will only cover the GUI section.   1- Configuration -> Wireless -> QoS -> QoS-Policy 2- We will create two SSID policies       In order to create these two policies click on "Add new" and configure each one of them as such.   The Ingress Policy (From wireless phone)       The Egress Policy (To Wireless phone) Configuring Controller Settings   If you are going to utilize multicast over the WLC then you need to enable Multicast globally and ensure as well that multicast routing / delivery is correctly configured on your wired infrastructure.           Configuring the voice SSID In this section we are going to cover how to configure the voice SSID that is going to be used by the wireless IP phones. Only two examples are going to be covered while taking into consideration security and fast roaming. We are going to speak about WPA2+AES+CCKM as well as WPA2+AES and Pre-shared key.   Open ssid, Wep, tkip as well as other security modes are not going to be covered due to security and other drawbacks when using them for voice over wireless LANs.   By covering CCKM and PSK we provide the choice of having a AAA server and as well as not having one.   The SSID that we will use will have the name "7925voice". Note ssid name is case sensitive and should be entered exactly in the same manner when configuring it on the wireless IP phone.   Example for configuring WPA2 - AES - Preshared key SSID   CLI Example 1- Ensure your AP(s) have already joined the WLC   w-5760-3#show ap summary Number of APs: 1 Global AP User Name: Not configured Global AP Dot1x User Name: Not configured AP Name                           AP Model  Ethernet MAC    Radio MAC       State          -------------------------------------------------- -------------------------------------- Serge-LAP-3700-2                  3702P     7cad.74ff.2e96  08cc.68b4.4490  Registered         2- Create the SSID by applying the following commands:   w-5760-3(config)#wlan 7925voicePSK 3 7925voicePSK w-5760-3(config-wlan)#shut w-5760-3(config-wlan)#radio dot11a w-5760-3(config-wlan)#dtim dot11 5ghz 2 w-5760-3(config-wlan)#no session-timeout w-5760-3(config-wlan)#broadcast-ssid w-5760-3(config-wlan)#no band-select w-5760-3(config-wlan)#no exclusionlist w-5760-3(config-wlan)#ccx aironet-iesupport w-5760-3(config-wlan)#channel-scan defer-priority 4 w-5760-3(config-wlan)#channel-scan defer-priority 5 w-5760-3(config-wlan)#channel-scan defer-priority 6 w-5760-3(config-wlan)#channel-scan defer-time 100 w-5760-3(config-wlan)#chd w-5760-3(config-wlan)#client vlan 100 w-5760-3(config-wlan)#no ip dhcp required w-5760-3(config-wlan)#no load-balance w-5760-3(config-wlan)#no mac-filtering w-5760-3(config-wlan)#mfp client w-5760-3(config-wlan)#wmm allowed w-5760-3(config-wlan)#no security dot1x w-5760-3(config-wlan)#no security wpa akm cckm w-5760-3(config-wlan)#no security wpa akm dot1x w-5760-3(config-wlan)#no security static-wep-key w-5760-3(config-wlan)#no security web-auth parameter-map global w-5760-3(config-wlan)#no security ft over-the-ds w-5760-3(config-wlan)#no peer-blocking w-5760-3(config-wlan)#ccx aironet-iesupport w-5760-3(config-wlan)#security wpa wpa2 ciphers aes w-5760-3(config-wlan)#security wpa akm psk set-key ascii 0 SecretKey <-- CHOOSE YOUR OWN KEY w-5760-3(config-wlan)#service-policy input voice-from-wifi-phone w-5760-3(config-wlan)#service-policy output voice-to-wifi-phone w-5760-3(config-wlan)#no shut w-5760-3(config-wlan)#end w-5760-3#write memory   GUI Example   1- Navigate from your browser to http://ipaddress/wireless. Example http://192.168.1.20/wireless 2- Go to Configuration -> Wireless 3- Expand WLAN and Click on WLANs 4- Click on New       5- Click on Apply 6- Now click on the newly create SSID by going back to the WLANs page and ensure it is configured as indicated on the following snapshots                                     Example for configuring WPA2 - AES - CCKM SSID   CLI example   1- Ensure your AP(s) have already joined the WLC   w-5760-3#show ap summary Number of APs: 2 Global AP User Name: Not configured Global AP Dot1x User Name: Not configured AP Name                           AP Model  Ethernet MAC    Radio MAC       State -------------------------------------------------- -------------------------------------- LAP1142-3                   1142N     0022.bd18.a97d  0023.eb3a.3320  Registered LAP1142-1                   1142N     0022.bd1a.ce23  0026.cbac.07b0  Registered   2- Create the SSID by applying the following commands:     w-5760-3(config)#wlan 7925voiceCCKM 4 7925voiceCCKM w-5760-3(config-wlan)#shut w-5760-3(config-wlan)#radio dot11a w-5760-3(config-wlan)#dtim dot11 5ghz 2 w-5760-3(config-wlan)#no session-timeout w-5760-3(config-wlan)#broadcast-ssid w-5760-3(config-wlan)#no band-select w-5760-3(config-wlan)#no exclusionlist w-5760-3(config-wlan)#ccx aironet-iesupport w-5760-3(config-wlan)#channel-scan defer-priority 4 w-5760-3(config-wlan)#channel-scan defer-priority 5 w-5760-3(config-wlan)#channel-scan defer-priority 6 w-5760-3(config-wlan)#channel-scan defer-time 100 w-5760-3(config-wlan)#chd w-5760-3(config-wlan)#client vlan 100 w-5760-3(config-wlan)#no ip dhcp required w-5760-3(config-wlan)#no load-balance w-5760-3(config-wlan)#no mac-filtering w-5760-3(config-wlan)#mfp client w-5760-3(config-wlan)#wmm allowed w-5760-3(config-wlan)#no security dot1x w-5760-3(config-wlan)#no security wpa akm psk w-5760-3(config-wlan)#no security wpa akm dot1x w-5760-3(config-wlan)#no security static-wep-key w-5760-3(config-wlan)#no security web-auth parameter-map global w-5760-3(config-wlan)#no security ft over-the-ds w-5760-3(config-wlan)#security wpa akm cckm w-5760-3(config-wlan)#security wpa wpa2 ciphers aes w-5760-3(config-wlan)#security dot1x authentication-list Wireless_Dot1x w-5760-3(config-wlan)#no peer-blocking w-5760-3(config-wlan)#ccx aironet-iesupport w-5760-3(config-wlan)#service-policy input voice-from-wifi-phone w-5760-3(config-wlan)#service-policy output voice-to-wifi-phone w-5760-3(config-wlan)#no shut w-5760-3(config-wlan)#end w-5760-3#write memory       GUI example   1- Navigate from your browser to http://ipaddress/wireless. Example http://192.168.1.20/wireless 2- Go to Configuration -> Wireless 3- Expand WLAN and Click on WLANs 4- Click on New     5- Click on Apply 6- Now click on the newly create SSID by going back to the WLANs page and ensure it is configured as indicated on the following snapshots                                     7- Configure the aaa required configuration part   From the CLI:   aaa new-model ! ! aaa group server radius ISE_Server  server name ISE ! aaa authentication login noauth none aaa authentication dot1x Wireless_Dot1x group ISE_Server aaa authorization network Wireless_Dot1x group ISE_Server   radius server ISE  address ipv4 192.168.1.32 auth-port 1812 acct-port 1813  key cisco   dot1x system-auth-control     From the GUI:   Here is the order via the snapshots   1- Configure the Radius Server.       2- Configure the Radius Group and map it to the radius server.           3- Configure the authentication method and map it to the radius group.         4- Ensure dot1x is enabled globaly on the WLC under the Configure - Controller tab:   ... View more

    Introduction This page provides important alerts from Cisco TAC regarding ISE (Identity Services Engine) To automatically be notified of updates, log in and click "Receive email notifications" on the upper right. Alerts - Firefox upgrade to version 25 stops working with ISE Date entered: 11-November-2013 ISE web GUI stops working correctly after upgrading Firefox to version 25. You get error message: There was an error while parsing and rendering the content. (node.getAttribute is not a function) Error code WAP00008. This is documented in bug CSCuj61976 and is going to be fixed in 1.2 patch 5 and 1.1.3 patch 9. CSCuj61976 Admin UI fails to display certain UI pages when using Firefox 25 This fix addresses an issue where ISE admin UI pages with a tree view were not displayed correctly in Firefox 25.   Patch 3 on 1.2 causes Guest Users login failures Date entered: 19-November-2013 After installing Patch 3 on ISE 1.2 the sponsor timezone defaults to ECT which is a non-recognized Timezone, the guest account will fail to login. Error message on ISE will be "86019 guest user restricted" This is bug CSCuj91050 and will be fixed in Patch 4 for ISE 1.2 If you roll back to Patch 2 the problem will disappear. CSCuj91050 Creating Guest users shows incorrect timezone 'GMT+2 ECT' This fix addresses an issue where Guest user would fail to login with the following error due to an incorrect time zone being assigned to the account: "An internal error occurred. Contact your system administrator for assistance. Contact your system administrator. "   Patch 7 on 1.2 causes Guest Users login failures After installing Patch 7 on ISE 1.2 Guest users created with Sponsor logging in via AD are no longer able to login. This is documented in BUG ID: CSCuo16503 and below are more information about this and the workaround: Date entered: 8-April-2014     Symptom s of Patch 7 on ISE 1.2, not seen prior to Patch 7, Guest users created with Sponsor holding their credentials on AD cannot login. Conditions The below need to match:1- Sponsors logging in via AD to create guest users2- Guest users being put into guest groups and "Awaiting initial Login" Workaround One of the following:1- Create the guest users with internal ISE configured Sponsor account2- Use AD Sponsor Account but place the guest users to the "Activated Guest Group   Patch 8 on 1.2 causes Guest Users login failures with invalid License In case you applied patch 8 on ISE 1.2 and you happen to have only a base license without advanced license or advanced license has expired, then Guest portal will display "no valid system license exists" error message when Guests land on the login page. This is documented in bug CSCuo76078. Workarounds: 1) In case you really need to run Patch 8 due to an affecting bug, then you will need to contact TAC and get a temporary advanced license. 2) Roll back and apply patch 7 and wait for a fix for above bug.   Scenario 2 Problem: Q: Why are the ISE nodes needed to be defined in the web authentication redirect acl that is configured locally on the switch?   A. User has setup 2yr old ISE environment this way and was advised in the beginning to do so. But after thinking the whole authentication process through and then testing out my theories I don't understand why the ISE nodes need to be defined in the switch redirect acl. I am now testing with a simple "redirect www & 443" acl and it is working as expected.   The client connects to the network and, for our environment, is requested to do dot1x until that times out and then it shifts to mab. At which point, I do not have an authz rule defined for my test machine and therefore matches my catch-all authz rule of CWA which sends a CWA DACL. The switch lays the acls on the interface in this order: 1. Redirect 2. DACL 3. PACL.   In my DACL I have access to the ISE nodes allowed (just to be safe) and the redirection still works because my test machine is not sending any www/443 traffic to the ISE nodes that I'm aware of (CWA is 8443).   Can someone explain (in detail) why a client machine would send www/443 traffic to the ISE nodes and therefore need to be defined in the CWA redirect acl local to the switch.  I understand the process and flow of CWA but I still don't see why the ISE nodes need to be defined (as deny statements or at all) in the redirect acl that is locally configured on the switch.    A default PACL is statically applied to an unused interface. For my environment our PACL is a simple "permit ip any any" which allows an open fallback in case communication to ISE fails. A client plugs in and the switch begins talking dot1x to the client. During this time the PACL is the ONLY acl that is applied to the interface/client. The client does not run dot1x and therefore the switch eventually fails over to mab. At this time, the CWA authz rule comes into effect and ISE sends the DACL to the switch via radius and also references which RACL (redirect acl) to use. Not many people seem to understand this part....The switch then rebuilds the ACL that is applied to the interface/user. The switch creates an ACL that consists of ALL THREE ACLs. The first portion of this ACL is the RACL with permit statements (which are the deny RACL statements configured on the switch) and then redirect statements (which are the permit RACL statements configured on the switch) and then the DACL from ISE is the next portion of this new ACL and then the very last portion is the original static PACL that is configured on the port.   Let me give you this example. Say I have the following confgured: CONFIGURED SWITCH INTERFACE ACL (PACL) ip access-list standard ACL-ALLOW permit ip any any CONFIGURED SWITCH REDIRECT ACL (RACL) ip access-list extended ACL-WEBAUTH-REDIRECT permit tcp any any eq www 443 CONFIGURED ISE DOWNLOADABLE ACL (DACL) permit tcp any host <psn01> eq 8443 permit udp any host <dns01> eq 53 deny ip any any   Then the process would look like this: 1. During dot1x negotiation the acl that is used is this: permit ip any any     <<<<<PACL 2. Once CWA is in effect then the acl looks like this: redirect tcp host <host ip> any eq www 443 <<<<<<RACL permit tcp host <host ip> host <psn01 ip> eq 8443 <<<<<<DACL permit udp host <host ip> host <dns01 ip> eq 53 <<<<<<DACL deny ip any any <<<<<<DACL permit ip any any <<<<<<PACL   Solution The traffic must first be allowed in dACL or Port ACL (if dACL is not configured as dACL is optional, configured only if you want to restrict access on switch port based user authenticating the network.i.e per-user based) then only it will hit redirect ACL. This clears the confusion on which ACL got hit first.In fact, dACL will replace the pre-authentication ACL/PACL you have configured on the switchport. Traffic must be first allowed via dACL then it will hit redirect ACL.     You might be aware that in CWA the client is authenticated twice. As per my understanding PACL is the ACL-Default you apply on port manually. When you do First authentication then this ACL will be dynamically replaced by DACL. So now this is the acl that govern what traffic can pass through that port. so in this you need to permit DHCP, DNS,port  80,443 and traffic to ISE on port 8443.   Now when the traffic enters the switch Redirect ACL come in to picture. Here you need to permit only traffic that need to be redirected means port 80 and 443 traffic and you need to deny DHCP,DNS and traffic to ISE on port 8443 to get redirect. So when the user try to access any web page,then first web browser needs to resolve domain name so it will issue a DNS query which dacl is allowing. then it hit redirect acl but it is denying that traffic to get redirected so client will resolve domain name. Now client try to send http traffic to the resolved ip address, http is allowed in DACL, then it hit redirect ACL which is permitting this http traffic to get redirected to ISE on port 8443. so client browser is redirected to new url.   Again DNS query for new url successful. client now send web traffic to ISE on port 8443 which is allowed in DACL, now hit redirect acl where it is denied to get redirected so client will be able to get Guest portal from ISE.   As per my understanding, once the port get authenticated, the order of ACL is 1. dACL 2. Redirect ACL 3. Port ACl. Secondly why the ISE nodes need to be defined (as deny statements or at all) in the redirect acl When redirect acl is applied to the port, any HTTP or HTTPS traffic that the client sends triggers a web redirection. Deny statement in redirect ACL at first place denies the ISE IP address so traffic to the ISE goes to the ISE and does not redirect in a loop. (In this scenario, deny does not block the traffic; it just does not redirect the traffic) Source Discussion Cisco ISE - CWA Redirect   ... View more

    Introduction This document describes the steps needed to successfully install and  get the WLC 5760 and Switch 3850 operational and ready to host Wireless  Access Points, WLANs and Wireless clients. This document only covers initial configuration on both of the platforms. Overview of the Unified Access CT5760 Wireless Controller The CT5760 Wireless LAN Controller (WLC) is the first Cisco IOS®  software-based controller built with smart ASIC intended to be deployed  as a centralized controller in the next generation unified wireless  architecture. CT5760 controllers are specifically designed to function  like the older unified model central wireless controllers. They also  support the newer Mobility functionality with Next Generation Wireless  Controllers 3850 switches in the wireless architecture. CT5760 controllers are deployed behind a core  switch/router. The core switch/router is the only gateway into the  network for the controller. The uplink ports connected to the core  switch are configured as EtherChannel trunk to ensure port redundancy. This new controller is an extensible and high  performance wireless controller, which can scale up to 1000 access  points (AP) and 12,000 clients. The controller has eight 6-10 Gbps data  ports. As a component of the Cisco Unified Wireless  Network, the 5760 series works in conjunction with Cisco Aironet Access  Points, the Cisco Prime Infrastructure, and the Cisco Mobility Services  Engine to support business-critical wireless data, voice, and video  applications.       Overview of the Unified Access Catalyst 3850 Switches The Unified Access Catalyst 3850 switch is a flexible ASIC-based  hardware that can support multiple protocols and has many advantages  over the current hardware platform. The Catalyst 3850 switch has an integrated hardware-based  wireless support with Control and Provisioning of Wireless Access Points  (CAPWAP) and fragmentation. It also has 40 GB of uplink bandwidth when  all ports function at line rate. The Catalyst 3850 switch provides an open service platform. It has a  4-core CPU to leverage the operating system (OS) and to host various  services. The Catalyst 3850 hardware is the next- generation switching  hardware. The UA Catalyst 3850 switch has unified wired and  wireless architecture. The wireless operating system is Cisco IOS®  software-based. UA Catalyst 3850 switch provides uniform wired and  wireless policies. It can house 50 access points (802.11n) and support  2000 clients per stack.   Initial configuration of the 5760 WLC Here are the steps needed to successfully configure your 5760 WLC to start hosting wireless services. Version used :  03.02.02 Setup Script --- System Configuration Dialog --- Enable secret warning ---------------------------------- In order to access the device manager, an enable secret is required If you enter the initial configuration dialog, you will be prompted for the enable secret If you choose not to enter the inital configuration dialog, or if you exit setup without setting the enable secret, please set an enable secret using the following CLI in configuration mode- enable secret 0 <cleartext password> ---------------------------------- Would you like to enter the initial configuration dialog? [yes/no] : yes At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'. Basic management setup configures only enough connectivity for management of the system, extended setup will ask you to configure each interface on the system Would you like to enter basic management setup? [yes/no] : yes Configuring global parameters: Enter host name [Controller]: w-5760-1 The enable secret is a password used to protect access to privileged EXEC and configuration modes. This password, after entered, becomes encrypted in the configuration. Enter enable secret: cisco The enable password is used when you do not specify an enable secret password, with some older software versions, and some boot images. Enter enable password: cisco The virtual terminal password is used to protect access to the router over a network interface. Enter virtual terminal password: cisco Configure a NTP server now? [yes]: Enter ntp server address : 192.168.1.200 Enter a polling interval between 16 and 131072 secs which is power of 2:16 Do you want to configure wireless network? [no] : Setup account for accessing HTTP server? [yes] : Username [admin]: Password [cisco]: Password is UNENCRYPTED. Configure SNMP Network Management? [no]: Current interface summary Any interface listed with OK? value "NO" does not have a valid configuration Interface IP-Address OK? Method Status Protocol Vlan1 unassigned NO unset up up GigabitEthernet0/0 unassigned YES unset up up Te1/0/1 unassigned YES unset up up Te1/0/2 unassigned YES unset down down Te1/0/3 unassigned YES unset down down Te1/0/4 unassigned YES unset down down Te1/0/5 unassigned YES unset down down Te1/0/6 unassigned YES unset down down Enter interface name used to connect to the management network from the above interface summary : vlan1 Configuring interface Vlan1: Configure IP on this interface? [yes]: IP address for this interface: 192.168.1.20 Subnet mask for this interface [255.255.255.0] : Class C network is 192.168.1.0, 24 subnet bits; mask is /24 Wireless management interface needs to be configured at startup It needs to be mapped to an SVI that's not Vlan 1 (default) Enter VLAN No for wireless management interface : 120 Enter IP address : 192.168.120.94 Enter IP address mask: 255.255.255.0 The following configuration command script was created: hostname w-5760-1 enable secret 4 tnhtc92DXBhelxjYk8LWJrPV36S2i4ntXrpb4RFmfqY^Q enable password cisco line vty 0 15 password cisco ntp server 192.168.1.200 maxpoll 4 minpoll 4 username admin privilege 15 password cisco no snmp-server ! no ip routing ! interface Vlan1 no shutdown ip address 192.168.1.20 255.255.255.0 ! interface GigabitEthernet0/0 shutdown no ip address ! interface TenGigabitEthernet1/0/1 ! interface TenGigabitEthernet1/0/2 ! interface TenGigabitEthernet1/0/3 ! interface TenGigabitEthernet1/0/4 ! interface TenGigabitEthernet1/0/5 ! interface TenGigabitEthernet1/0/6 vlan 120 interface vlan 120 ip addr 192.168.120.94 255.255.255.0 exit wireless management interface Vlan120 ! end [0] Go to the IOS command prompt without saving this config. [1] Return back to the setup without saving this config. [2] Save this configuration to nvram and exit. Enter your selection [2]: 2 Building configuration... Compressed configuration from 2729 bytes to 1613 bytes[OK] Use the enabled mode 'configure' command to modify this configuration. Press RETURN to get started! Required Wireless configuration for Access Points to be able to join Important Note: Ensure that your switch is having the right boot command under global  configuration. Depending how you installed the software on the switch.  If it has been extracted on the flash, then the following boot command  is required: w-5760-1(config)#boot system flash:packages.conf Connectivity Configuration connecting to the backbone network and on which your will have CAPWAP traffic      coming in/out. In this document the interface used is TenGigabitEthernet1/0/1. We are allowing on it Vlan1 nd Vlan 120 interface TenGigabitEthernet1/0/1 switchport trunk allowed vlan 1,120 switchport mode trunk ip dhcp relay information trusted ip dhcp snooping trust Configure default route out: ip route 0.0.0.0 0.0.0.0 192.168.1.1 Configure Web Access    The GUI can be accessed via https://<ipaddress>/wireless    The logon credentials are already defined in the initial configuration dialog     username admin privilege 15 password 0 admin   Ensure wireless management interface is correctly configured wireless management interface Vlan120 w-5760-1#sh run int vlan 120 Building configuration... Current configuration : 62 bytes ! interface Vlan120 ip address 192.168.120.94 255.255.255.0 end w-5760-1#sh ip int br Interface IP-Address OK? Method Status Protocol Vlan1 192.168.1.20 YES manual up up Vlan120 192.168.120.94 YES manual up up GigabitEthernet0/0 unassigned YES unset down down Te1/0/1 unassigned YES unset up up Te1/0/2 unassigned YES unset down down Te1/0/3 unassigned YES unset down down Te1/0/4 unassigned YES unset down down Te1/0/5 unassigned YES unset down down Te1/0/6 unassigned YES unset down down Capwap2 unassigned YES unset up up w-5760-1# Ensure you have enabled license with the right ap count Note:   The 5760 does not have activated license levels, the image is already ipservices Note:   5760 acting as MC can support up to 1000 APs w-5760-1#license right-to-use activate apcount <count> slot 1 acceptEULA Country code     Ensure you have configured the correct country code on your WLC in compliance with the regulatory domain of the       country the AP(s) will be servicing in and in compliance with the regulatory domain of the AP(s) w-5760-1#show wireless country configured Configured Country.............................: US - United States Configured Country Codes US - United States : 802.11a Indoor,Outdoor/ 802.11b / 802.11g w-5760-1(config)#ap dot11 24ghz shutdown w-5760-1(config)#ap dot11 5ghz shutdown w-5760-1(config)#ap country BE Changing country code could reset channel and RRM grouping configuration. If running in RRM One-Time mode, reassign channels after this command. Check customized APs for valid channel values after this command. Are you sure you want to continue? (y/n)[y]: y w-5760-1(config)#no ap dot11 24ghz shut w-5760-1(config)#no ap dot11 5ghz shut w-5760-1(config)#end w-5760-1#wr Building configuration... Compressed configuration from 3564 bytes to 2064 bytes[OK] w-5760-1#show wireless country configured Configured Country.............................: BE - Belgium Configured Country Codes BE - Belgium : 802.11a Indoor,Outdoor/ 802.11b / 802.11g AP --------> WLC Connectivity    Ensure that your AP(s) on whatever VLAN,  they are able to learn the IP address of the WLC ( 192.168.120..94 in this example)   via DHCP option 43, DNS, or any other discovery mechanism in CAPWAP. Monitoring and Debugging Ensure that your AP(s) have joined: w-5760-1#show ap summary Number of APs: 1 Global AP User Name: Not configured Global AP Dot1x User Name: Not configured AP Name AP Model Ethernet MAC Radio MAC State -------------------------------------------------------------------------------------- APa493.4cf3.232a 1042N a493.4cf3.232a 10bd.186d.9a40 Registered   Useful debugs for troubleshooting AP join issues w-5760-1#debug capwap ap events capwap/ap/events debugging is on w-5760-1#debug capwap ap error capwap/ap/error debugging is on w-5760-1#debug dtls ap event dtls/ap/event debugging is on DHCP Snooping and Trust Configuration It is recommended to use external DHCP server instead of internal DHCP server. DHCP snooping configuration is required on the controller for proper client join functionality. DHCP snooping must be enabled on each client VLAN including the override VLAN, if override is applied on the WLAN. The following example shows how to configure DHCP snooping. Global DHCP Snooping Configuration: ip dhcp snooping ip dhcp snooping vlan 100, 200 Enable the bootp-broadcast command. This command is used by clients who send DHCP messages with broadcast addresses and the broadcast bit is set in the DHCP message. ip dhcp snooping wireless bootp-broadcast enable On the Interface: Note If upstream is via a port channel, the trust configuration must be configured on the port channel interface as well. interface TenGigabitEthernet1/0/1 description Connection to Core Switch switchport trunk allowed vlan 100, 200 switchport mode trunk ip dhcp relay information trusted ip dhcp snooping trust Note DHCP snooping must be configured on the Guest Anchor controller for guest access similar to the configuration above. If you are using an ip-helper address on the interface, you must modify option 82 behavior: On the DHCP Snooping Device no ip dhcp snooping information option OR On the DHCP Relay Device (per interface) ip dhcp relay information trusted On the DHCP Relay Device (global configuration) ip dhcp relay information trust-all   Initial configuration of the 3850 Switch Here are the steps needed to successfully configure your 3850 Switch to start hosting wireless services. Version used :  03.02.02 Setup script --- System Configuration Dialog --- Enable secret warning ---------------------------------- In order to access the device manager, an enable secret is required If you enter the initial configuration dialog, you will be prompted for the enable secret If you choose not to enter the intial configuration dialog, or if you exit setup without setting the enable secret, please set an enable secret using the following CLI in configuration mode- enable secret 0 <cleartext password> ---------------------------------- Would you like to enter the initial configuration dialog? [yes/no] : yes At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'. Basic management setup configures only enough connectivity for management of the system, extended setup will ask you to configure each interface on the system Would you like to enter basic management setup? [yes/no]: yes Configuring global parameters: Enter host name [Switch]: sw-3850-1 The enable secret is a password used to protect access to privileged EXEC and configuration modes. This password, after entered, becomes encrypted in the configuration. Enter enable secret: Cisco123 The enable password is used when you do not specify an enable secret password, with some older software versions, and some boot images. Enter enable password: Cisco123 The virtual terminal password is used to protect access to the router over a network interface. Enter virtual terminal password: Cisco123 Do you want to configure country code? [no] : yes Enter the country code[US]: BE Note : Enter the country code in which you are installing this 3850 Switch and the AP(s). If your country code is not recognized, enter one that is compliant with the regulatory domain of your own country Setup account for accessing HTTP server? [yes]: Username [admin]: Password [cisco]: Password is UNENCRYPTED. Configure SNMP Network Management? [no]: Current interface summary Any interface listed with OK? value "NO" does not have a valid configuration   Interface IP-Address OK? Method Status Protocol Vlan1 unassigned NO unset up down GigabitEthernet0/0 unassigned YES unset up up GigabitEthernet2/0/1 unassigned YES unset down down GigabitEthernet2/0/2 unassigned YES unset down down GigabitEthernet2/0/3 unassigned YES unset down down GigabitEthernet2/0/4 unassigned YES unset down down GigabitEthernet2/0/5 unassigned YES unset down down GigabitEthernet2/0/6 unassigned YES unset down down GigabitEthernet2/0/7 unassigned YES unset down down GigabitEthernet2/0/8 unassigned YES unset down down GigabitEthernet2/0/9 unassigned YES unset down down GigabitEthernet2/0/10 unassigned YES unset down down GigabitEthernet2/0/11 unassigned YES unset down down GigabitEthernet2/0/12 unassigned YES unset down down GigabitEthernet2/0/13 unassigned YES unset down down GigabitEthernet2/0/14 unassigned YES unset down down GigabitEthernet2/0/15 unassigned YES unset down down GigabitEthernet2/0/16 unassigned YES unset down down GigabitEthernet2/0/17 unassigned YES unset down down GigabitEthernet2/0/18 unassigned YES unset down down GigabitEthernet2/0/19 unassigned YES unset down down GigabitEthernet2/0/20 unassigned YES unset down down GigabitEthernet2/0/21 unassigned YES unset down down GigabitEthernet2/0/22 unassigned YES unset down down GigabitEthernet2/0/23 unassigned YES unset down down GigabitEthernet2/0/24 unassigned YES unset down down GigabitEthernet2/0/25 unassigned YES unset down down GigabitEthernet2/0/26 unassigned YES unset down down GigabitEthernet2/0/27 unassigned YES unset down down GigabitEthernet2/0/28 unassigned YES unset down down GigabitEthernet2/0/29 unassigned YES unset down down GigabitEthernet2/0/30 unassigned YES unset down down GigabitEthernet2/0/31 unassigned YES unset down down GigabitEthernet2/0/32 unassigned YES unset down down GigabitEthernet2/0/33 unassigned YES unset down down GigabitEthernet2/0/34 unassigned YES unset down down GigabitEthernet2/0/35 unassigned YES unset down down GigabitEthernet2/0/36 unassigned YES unset down down GigabitEthernet2/0/37 unassigned YES unset down down GigabitEthernet2/0/38 unassigned YES unset down down GigabitEthernet2/0/39 unassigned YES unset down down GigabitEthernet2/0/40 unassigned YES unset down down GigabitEthernet2/0/41 unassigned YES unset down down GigabitEthernet2/0/42 unassigned YES unset down down GigabitEthernet2/0/43 unassigned YES unset down down GigabitEthernet2/0/44 unassigned YES unset down down GigabitEthernet2/0/45 unassigned YES unset down down GigabitEthernet2/0/46 unassigned YES unset down down GigabitEthernet2/0/47 unassigned YES unset down down GigabitEthernet2/0/48 unassigned YES unset up up GigabitEthernet2/1/1 unassigned YES unset down down GigabitEthernet2/1/2 unassigned YES unset down down GigabitEthernet2/1/3 unassigned YES unset down down GigabitEthernet2/1/4 unassigned YES unset down down Te2/1/1 unassigned YES unset down down Te2/1/2 unassigned YES unset down down Te2/1/3 unassigned YES unset down down Te2/1/4 unassigned YES unset down down Enter interface name used to connect to the management network from the above interface summary: vlan1 Configuring interface Vlan1: Configure IP on this interface? [yes]: IP address for this interface: 192.168.1.2 Subnet mask for this interface [255.255.255.0] : Class C network is 192.168.1.0, 24 subnet bits; mask is /24   The following configuration command script was created: hostname sw-3850-1 enable secret 4 vwcGVdcUZcRMCyxaH2U9Y/PTujsnQWPSbt.LFG8lhTw enable password Cisco123 line vty 0 15 password Cisco123 ap dot11 24ghz shutdown ap dot11 5ghz shutdown ap country BE no ap dot11 24ghz shutdown no ap dot11 5ghz shutdown username admin privilege 15 password 0 cisco no snmp-server ! no ip routing ! interface Vlan1 no shutdown ip address 192.168.1.2 255.255.255.0 ! interface GigabitEthernet0/0 shutdown no ip address ! interface GigabitEthernet2/0/1 ! interface GigabitEthernet2/0/2 ! interface GigabitEthernet2/0/3 ! interface GigabitEthernet2/0/4 ! interface GigabitEthernet2/0/5 ! interface GigabitEthernet2/0/6 ! interface GigabitEthernet2/0/7 ! interface GigabitEthernet2/0/8 ! interface GigabitEthernet2/0/9 ! interface GigabitEthernet2/0/10 ! interface GigabitEthernet2/0/11 ! interface GigabitEthernet2/0/12 ! interface GigabitEthernet2/0/13 ! interface GigabitEthernet2/0/14 ! interface GigabitEthernet2/0/15 ! interface GigabitEthernet2/0/16 ! interface GigabitEthernet2/0/17 ! interface GigabitEthernet2/0/18 ! interface GigabitEthernet2/0/19 ! interface GigabitEthernet2/0/20 ! interface GigabitEthernet2/0/21 ! interface GigabitEthernet2/0/22 ! interface GigabitEthernet2/0/23 ! interface GigabitEthernet2/0/24 ! interface GigabitEthernet2/0/25 ! interface GigabitEthernet2/0/26 ! interface GigabitEthernet2/0/27 ! interface GigabitEthernet2/0/28 ! interface GigabitEthernet2/0/29 ! interface GigabitEthernet2/0/30 ! interface GigabitEthernet2/0/31 ! interface GigabitEthernet2/0/32 ! interface GigabitEthernet2/0/33 ! interface GigabitEthernet2/0/34 ! interface GigabitEthernet2/0/35 ! interface GigabitEthernet2/0/36 ! interface GigabitEthernet2/0/37 ! interface GigabitEthernet2/0/38 ! interface GigabitEthernet2/0/39 ! interface GigabitEthernet2/0/40 ! interface GigabitEthernet2/0/41 ! interface GigabitEthernet2/0/42 ! interface GigabitEthernet2/0/43 ! interface GigabitEthernet2/0/44 ! interface GigabitEthernet2/0/45 ! interface GigabitEthernet2/0/46 ! interface GigabitEthernet2/0/47 ! interface GigabitEthernet2/0/48 ! interface GigabitEthernet2/1/1 ! interface GigabitEthernet2/1/2 ! interface GigabitEthernet2/1/3 ! interface GigabitEthernet2/1/4 ! interface TenGigabitEthernet2/1/1 ! interface TenGigabitEthernet2/1/2 ! interface TenGigabitEthernet2/1/3 ! interface TenGigabitEthernet2/1/4 ! end [0] Go to the IOS command prompt without saving this config. [1] Return back to the setup without saving this config. [2] Save this configuration to nvram and exit. Enter your selection [2]: 2 The enable password you have chosen is the same as your enable secret. This is not recommended. Re-enter the enable password. Changing country code could reset channel and RRM grouping configuration. If running in RRM One-Time mode, reassign channels after this command. Check customized APs for valid channel values after this command. Are you sure you want to continue? (y/n)[y] : y % Generating 1024 bit RSA keys, keys will be non-exportable... [OK] (elapsed time was 1 seconds) Building configuration... Compressed configuration from 4414 bytes to 2038 bytes[OK] Use the enabled mode 'configure' command to modify this configuration. Press RETURN to get started!   Required Wireless configuration for Access Points to be able to join Important Note: Ensure that your switch is having the right boot command under global  configuration. Depending how you installed the software on the switch.  If it has been extracted on the flash, then the following boot command  is required: sw-3850-1(config)#boot system switch all flash:packages.conf Wireless Pre-requisites     To enable wireless services, the 3850 must be running an ipservices or ipbase license. Enable Wireless on the Switch Note : The Access Points will need to be connected to access mode                  switchports in the same VLAN! Enable WIreless Management             sw-3850-1(config)#wireless management interface vlan <1-4095> Define Mobility Controller        A Mobility Controller (MC) must be defined in order to allow Access Points to join.         a. If this 3850 will be the Mobility Controller:            sw-3850-1(config)#wireless mobility controller      Note: This configuration change will require a reboot!         b. If this 3850 will operate as a Mobility Agent (MA), Then please point it to the MC IP address using the following             command:           sw-3850-1(config)#wireless mobility controller ip a.b.c.d            And on the MC:          3850MC(config)#wireless mobility controller peer-group <SPG1>          3850MC(config)#wireless mobility controller peer-group <SPG1> member ip w.x.y.z License Verification Ensure that you have AP Licenses active on the MC (the MA will use the licenses that are activated on the MC): Note: 3850 must run ipservices or ipbase license to enable wireless services on 3850 Note: AP count licenses are applied at the MC, and are automatically provisioned and enforced at the MA Note: 3850 acting as MC can support up to 50 APs sw-3850-1 #show license right-to-use summary License Name Type Count Period left ---------------------------------------------------------------- ipservices permanent N/A Lifetime apcount base 1 Lifetime apcount adder 49 Lifetime ------------------------------------------------------------------- License Level In Use: ipservices License Level on Reboot: ipservices Evaluation AP-Count: Disabled Total AP Count Licenses: 50 AP Count Licenses In-use: 1 AP Count Licenses Remaining: 49   If you do not have apcount licenses installed, see the following article for more information. To activate AP count license on the 3850, please enter this command  with the required AP count. Always on the MC (Mobility Controller): sw-3850-1#license right-to-use activate apcount <count> slot <#> acceptEULA AP------> WLC Connectivity   In order for Access Points to join the controller, the switchport configuration must be set as an access port in the wireless management vlan: If using vlan 100 for wireless management interface: sw-3850-1(config)#interface gigabit1/0/10 sw-3850-1(config-if)#switchport mode access sw-3850-1(config-if)#switchport access vlan 100 Configuring Web Access The GUI can be accessed via https://<ipaddress>/wireless The logon credentials are already defined in the initial configuration dialog username admin privilege 15 password 0 admin ( username for Web access)   Country code     Ensure you have configured the correct country code on your WLC in compliance with the regulatory domain of the       country the AP(s) will be servicing in and in compliance with the regulatory domain of the AP(s) sw-3850-1#show wireless country configured Configured Country.............................: US - United States Configured Country Codes US - United States : 802.11a Indoor,Outdoor/ 802.11b / 802.11g sw-3850-1(config)#ap dot11 24ghz shutdown sw-3850-1(config)#ap dot11 5ghz shutdown sw-3850-1(config)#ap country BE Changing country code could reset channel and RRM grouping configuration. If running in RRM One-Time mode, reassign channels after this command. Check customized APs for valid channel values after this command. Are you sure you want to continue? (y/n)[y]: y sw-3850-1(config)#no ap dot11 24ghz shut sw-3850-1(config)#no ap dot11 5ghz shut sw-3850-1(config)#end sw-3850-1#wr Building configuration... Compressed configuration from 3564 bytes to 2064 bytes[OK] sw-3850-1#show wireless country configured Configured Country.............................: BE - Belgium Configured Country Codes BE - Belgium : 802.11a Indoor,Outdoor/ 802.11b / 802.11g Monitoring and Debugging Ensure that your AP(s) have joined: sw-3850-1#show ap summary Number of APs: 1 Global AP User Name: Not configured Global AP Dot1x User Name: Not configured AP Name AP Model Ethernet MAC Radio MAC State ------------------------------------------------------------------------------------------------------- APa493.4cf3.232a 1042N a493.4cf3.231a 10bd.186e.9a40 Registered DHCP Snooping and Trust Configuration It is recommended to use external DHCP server instead of internal DHCP server. DHCP snooping configuration is required on the controller for proper client join functionality. DHCP snooping must be enabled on each client VLAN including the override VLAN, if override is applied on the WLAN. The following example shows how to configure DHCP snooping. Global DHCP Snooping Configuration: ip dhcp snooping ip dhcp snooping vlan 100, 200 Enable the bootp-broadcast command. This command is used by clients who send DHCP messages with broadcast addresses and the broadcast bit is set in the DHCP message. ip dhcp snooping wireless bootp-broadcast enable On the Interface: Note If upstream is via a port channel, the trust configuration must be configured on the port channel interface as well. interface TenGigabitEthernet1/0/1 description Connection to Core Switch switchport trunk allowed vlan 100, 200 switchport mode trunk ip dhcp relay information trusted ip dhcp snooping trust Note DHCP snooping must be configured on the Guest Anchor controller for guest access similar to the configuration above. If you are using an ip-helper address on the interface, you must modify option 82 behavior: On the DHCP Snooping Device no ip dhcp snooping information option OR On the DHCP Relay Device (per interface) ip dhcp relay information trusted On the DHCP Relay Device (global configuration) ip dhcp relay information trust-all   Useful debugs for troubleshooting AP join issues sw-3850-1#debug capwap ap events capwap/ap/events debugging is on sw-3850-1#debug capwap ap error capwap/ap/error debugging is on sw-3850-1#debug dtls ap event dtls/ap/event debugging is on ... View more

    Introduction     This document summarizes all the software releases that were out on Cisco.com for Cisco Wireless LAN Controllers. Each branch is expanded into maintenance releases and a note about hardware support is made.   This document also gives insights whether a certain branch will still continue to have a maintenance release or not.     Branch 3.0   Note: This release currently doesn't have any upcoming maintenance releases   Release 3.0.100.0 New hardware: 1000 Series AP, 2700 series location appliance, 4400 WLC, 4100 WLC, 2000 WLC.   Branch 3.1   Note: This release currently doesn't have any upcoming maintenance releases   Release 3.1.59.24 New hardware: 1130 series AP, 1200 series AP, 1240 series AP, 1500 Mesh series AP   Branch 3.2   Note: This release currently doesn't have any upcoming maintenance releases   Release 3.2.78.4 New hardware: None   Release 3.2.116.21 New hardware: None   Release 3.2.150.0 New hardware: None   Release 3.2.171.5 New hardware: None   Release 3.2.171.6 New hardware: None   Release 3.2.193.5 New hardware: None   Release 3.2.195.10 New hardware: None   Release 3.2.195.13 New hardware: None   Release 3.2.202.0 New hardware: None   Release 3.2.210.0 New hardware: None   Release 3.2.215.0 New hardware: None   Branch 4.0   Note: This release currently doesn't have any upcoming maintenance releases   Release 4.0.155.5 New hardware: 3750 switch integrated WLC   Release 4.0.179.8 New hardware: None   Release 4.0.179.11 New hardware: None   Release 4.0.206.0 New hardware: 2100 WLC, 3201 WMIC card, 1300 Wireless Bridges   Release 4.0.217.0 New hardware: None   Release 4.0.217.204 New hardware: None   Release 4.0.219.0 New hardware: None   Branch 4.1   Note: This release currently doesn't have any upcoming maintenance releases   Release 4.1.171.0 New hardware: None   Release 4.1.181.0 New hardware: None   Release 4.1.185.0 New hardware: 1100 series AP.   Release 4.1.185.10 New hardware: None   Release 4.1.190.5 Mesh release only Supported APs: 1505,1510 mesh APs. 1520 supported in US only. Non supported APs: 1000 series, 1100 series, 1130 series, 1200 series, 1230 series, 1240 series and 1300 series   Release 4.1.191.24 Mesh release only Supported APs: Cisco Aironet 1500 (1505 and 1510) series and 1520 (1522) series outdoor access points Supported APs: Cisco Aironet 1130AG and 1240 AG series indoor access point Supported APs: 1000 series, 1100 series, 1130 series, 1200 series, 1230 series, 1240 series and 1300 series. Non Supported APs: 1250 series access points are not supported on this release.   Release 4.1.192.22 Mesh release only Supported APs: Cisco Aironet 1520 (1522, 1524) series and 1500 (1505 and 1510) series outdoor access points Supported APs: Cisco Aironet 1130AG and 1240 AG series indoor access point Supported APs: 1000 series, 1100 series, 1130 series, 1200 series, 1230 series, 1240 series and 1300 series. Non Supported APs: 1250 series access points are not supported on this release.   Release 4.1.192.35 Mesh release only Supported APs: Cisco Aironet 1520 (1522, 1524) series and 1500 (1505 and 1510) series outdoor access points Supported APs: Cisco Aironet 1130AG and 1240 AG series indoor access point Supported APs: 1000 series, 1100 series, 1130 series, 1200 series, 1230 series, 1240 series and 1300 series. Non Supported APs: 1250 series access points are not supported on this release.   Branch 4.2   Note: This release currently doesn't have any upcoming maintenance releases   Release 4.2.61.0 New hardware: 1250 series AP   Release 4.2.99.0 New hardware: None   Release 4.2.112.0 New hardware: None   Release 4.2.130.0 New hardware: None   Release 4.2.112.0 New hardware: None   Release 4.2.173.0 New hardware: None   Release 4.2.176.0 New hardware: None   Release 4.2.176.51 Mesh release only Supported APs: Cisco Aironet 1500 (1505 and 1510) series outdoor mesh access points Supported APs: Cisco Aironet 1000, 1100, 1130, 1200, 1240, 1250, and 1310 indoor access points. None Supported APs: Release  4.2.176.51M does not support Cisco 1520 (1522, 1524) series mesh access  points. Cisco 1520 series mesh access points are supported in release  5.2 (and later) of the controller mainline release.   Here is a visual aid I found on the 4.2.176.51 Mesh release notes showing AP support       Release 4.2.207.54 Mesh release only Supported APs: Cisco Aironet 1500 (1505 and 1510) series outdoor mesh access points Supported APs: Cisco Aironet 1000, 1100, 1130, 1200, 1240, 1250, and 1310 indoor access points. None  Supported APs: Release  4.2.176.51M does not support Cisco 1520 (1522,  1524) series mesh access  points. Cisco 1520 series mesh access points  are supported in release  5.2 (and later) of the controller mainline  release.   Release 4.2.205.0 New hardware: None   Release 4.2.206.0 New hardware: None   Release 4.2.207.0 New hardware: None   Release 4.2.209.0 New hardware: None   Branch 5.0   Note: This release currently doesn't have any upcoming maintenance releases   Release 5.0.148.0 New hardware: None No longer supported hardware: NM-AIR-WLC6 platform No longer supported hardware: Cisco Aironet 1000 series access  points are not supported for use with controller software release  5.0.148.0 or later.   Release 5.0.148.2 New hardware: None   Branch 5.1   Note: This release currently doesn't have any upcoming maintenance releases   Release 5.1.151.0 New hardware:  MSE3350, AP801   Release 5.1.163.0 New hardware: None     Branch 5.2   Note: This release currently doesn't have any upcoming maintenance releases   Release 5.2.157.0 New hardware: 1522, and 1524 Mesh Access Points (This release does not support Cisco Aironet 1505 and 1510 access points)   Release 5.2.178.0 New hardware: None   Release 5.2.193.0 New hardware: 1524PS Mesh Access Points (This release does not support Cisco Aironet 1505, 1510 and 1524SB access points)     Branch 6.0   Note: This release currently doesn't have any upcoming maintenance releases. This is a Maintenance Deployment release.   Release 6.0.182.0 New hardware: Cisco 5500 Series Wireless LAN Controllers   Release 6.0.188.0 New hardware:  None   Release 6.0.196.0 New hardware:  None   Release 6.0.199.0 New hardware:  None   Release 6.0.199.4 New hardware:  None   Release 6.0.220.0 New hardware:  None   Branch 7.0   Note: This release currently doesn't have any upcoming maintenance releases   Release 7.0.98.0 New hardware:  3310 MSE, 1260 AP, 1040 AP,   Release 7.0.116.0 New hardware: 7500 HREAP Flex WLC, 600 Office Extend AP, AP 802, 1550 Mesh AP, SRE based WLCM, 3500 AP, WiSM2   Release 7.0.220.0 New hardware: None.   Release 7.0.230.0 New hardware: None.   Release 7.0.235.0 New hardware: None.   Release 7.0.235.3 New hardware: None. This release is fixing bug CSCua29504   Release 7.0.240.0 New hardware: None.   Release 7.0.250.0 New hardware: None. Branch 7.1   Note: This release currently doesn't have any upcoming maintenance releases   Release 7.1.91.0 New hardware: 3600.   For Cisco  2500, 5500, WiSM2, WLCM2, and Cisco Flex 7500 Series Wireless LAN  Controllers. 7.1.91.0 is a special release to introduce the Cisco  Aironet 3600 Access Points. Ongoing support for this release will not be  provided and is not supported in any other 7.0 maintenance release. The release 7.1.91.0 for the AP-3600 is a restricted lifetime release,  with no planned maintenance images. For future fix and feature  development, customers are encouraged to migrate to next major release for ongoing support and improvements.   This is the last release to support: WiSM, 4400 and WLCM     Branch 7.2   Note: This release currently doesn't have any upcoming maintenance releases   Caution: This release NO LONGER supports: • Cisco 4400 Series Wireless LAN Controller • Cisco 2100 Series Wireless LAN Controller • Cisco Catalyst 6500 Series/7600 Series Wireless Services Module (WiSM) • Cisco Wireless LAN Controller Module • Cisco Wireless Controller on Cisco Services-Ready Engine (SRE) (WLCM2) running on ISM 300, SM 700, SM 710, SM 900, and SM 910   Release 7.2.103.0 New hardware: None   Release 7.2.110.0 New hardware: The Cisco Wireless  Controller on Service Ready Engine (WLCM2 on SRE) platform running on  ISM 300, SM 700, SM 710, SM 900, and SM 910 is supported in this  release.   Release 7.2.111.13 New hardware: None This release is having two bug fixed CSCty68030 and CSCua29504   Release 7.2.115.1 New hardware: New revision of 7500 WLC   Branch 7.3   Note: This release currently doesn't have any upcoming maintenance releases   Release 7.3.101.0 New hardware: - The virtual wireless LAN controller - Cisco 8500 Series Controllers are introduced with support for local mode, FlexConnect, and mesh modes - The Cisco Aironet 2600 Series Access Points are supported   Release 7.3.102.0 New hardware: AP 1600 [Update: this release later got removed from cisco.com, 7.3.112.0 doesn't support 1600 AP you need to move to 7.4 to get support for 1600 Series AP].   Release 7.3.112.0 New hardware: Hierarchical Mobility (New Mobility)     Branch 7.4   Note: This release still has maintenance releases planned   Release 7.4.100.0 New hardware: - AP 1600 - Read new features on release notes   Release 7.4.100.60 New hardware: None   Release 7.4.110.0 New hardware: None   Release 7.4.121.0 New hardware: None   Release 7.4.130.0 New hardware: None   Branch 7.5   Note: This release currently doesn't have any upcoming maintenance releases   Release 7.5.102.0 New hardware: - The 802.11ac radio module for the Cisco Aironet 3600  Series access points (Cisco AP3600). - New -Z Product IDs are introduced for Cisco 3600  Series access points. The -Z PIDs provide enhanced 5-GHz spectrum  coverage for Australia and New Zealand - Cisco Aironet 700 Series access points - Read other new feature on release notes.   Branch 7.6   Note: This release still has maintenance releases planned   Release 7.6.100.0 New hardware: - Cisco Aironet 3700 Series Access Points - Cisco Aironet 1530 Series Outdoor Access Points - Cisco Universal Small Cell 5310 module for modular Cisco Aironet 3600 Series - Dynamic Frequency Selection (DFS) channels are enabled on Cisco Aironet 700 Series Access Points. - China –H domain support - The 802.11ac configuration is supported in a High Availability environment. - - Read other new feature on release notes.   Release 7.6.110.0 New hardware: None   Release 7.6.120.0 New hardware: - Cisco Aironet 2700 Series Access Points - Cisco Aironet 700W Series Access Point - Cisco WLAN Express Setup for Cisco 2500 Series Wireless Controller   Release 7.6.130.0 New hardware: None   Branch 8.0   Note: This release still has maintenance releases planned   Release 8.0.100.0 New hardware: - Cisco Aironet 1700 Series Access Points - AIR-CAP1552WU-x-K9   Release 8.0.110.0 New hardware: - Cisco Aironet 1570 Series Access Points - Cisco Aironet Universal AP Priming and Cisco AirProvision   Release 8.0.115.0 New hardware: None   Reference   Information on FUS Image: refer to this link Information on LDPE Image: refer to this link ... View more

This document will help you determine whether a hardware replacement is likely to solve the problems you are experiencing with your Cisco 7921, 7925, 7926 Wireless Phones via troubleshooting advices. Some of the below questions refer to the "Diagnostic tool" that is built in to the phone menu. This tool is available to be used as of release 1.3.4. Please refer to this link for more information on the Diagnostic Tool:  "Viewing Hardware Diagnostics" in the Cisco Unified Wireless IP Phone 7925G, 7925G-EX, and 7926G User Guide. 1. 792x Power Issues If the 792x phone will not power on,       may need to hold the red power button down for as much as 10 seconds check with known good AC adapter and/or battery     Replace the defective part (handset, AC adapter or battery) If the 792x battery will not hold a charge, check with known good ac adapter and battery             If the issue is the battery, then need to check to see if the battery is still in the warranty period or not 2. 792x Display Issues If the 792x phone has display issues, remove the battery to power cycle the phone to see if the issue gets resolved or not          If the display issue remains, then replace the 792x phone 3. 792x Keypad Issues If the 792x has keypad issues, test the keypad via the integrated hardware diagnostics tool          If any key fails to respond, then ask for a hardware replacement of the 792x phone If keypad is sluggish, reset the phone to factory default 4. 792x Wireless Issues If the 792x has wireless issues, test the WLAN via the integrated hardware diagnostics tool (need to ensure the SSID is entered in the network profile correctly; case sensitive)          If successful and in range of the configured network, then available access points will be listed - this indicates that the WLAN hardware is working If the SSID is correct, but no access points are visible, and if other client devices in the same vicinity can access the WLAN, then ask for a hardware replacement of the 792x phone 5. 792x Bluetooth Issues If the 792x has Bluetooth issues, test Bluetooth by attempting to pair a known working headset to the 792x phone after Bluetooth is enabled       If the Bluetooth headset works with another 792x phone, then ask for a hardware replacement of the 792x phone 6. 792x Audio Issues If the 792x has audio issues, test the microphone, handset, headset  or speakerphone via the integrated hardware diagnostics tool          If any test fails, then ask for a hardware replacement of the 792x phone Reset the phone to factory default and reconfigure the phone to access the local network - if the audio problems persist, and if other phones in the same location work fine, then ask for a hardware replacement of the 792x phone 7. 792x Headset Issues If the 792x has headset issues, test the headset by disconnecting and re-inserting the headset, then attempt to make a call         If the test fails and the headset works with another 792x phone, then ask for a hardware replacement of the 792x phone For non-hardware related issues, contact the TAC by raising a service request to pursue troubleshooting. Wireless TAC issues typically include: Experiencing voice gaps, 1-way or no way audio, or choppy audio Experiencing roaming failures Experiencing WLAN authentication failures Voice TAC issues typically include: Unable to register to CUCM Unable to upgrade firmware Unable to place or receive a call CUCM feature issues Echo while on call, noise ... View more

On WLC code 7.0.98.0 or 7.0.116.0, you will notice a degraded tracking for RFID tags. In most of the cases there will be missing "hearing access points" for the RFID tags causing non-accurate location. This problem is caused by bug CSCtr20250. Symptom: Location tracking is not working as expected due to WLC code 7.0.116.0 not taking into consideration all hearing access points for a particular tag. The error message that appears on WLC "debug rfid error enable" is: <tag mac address> rfid Aerosct updated by AP <mac address> has invalid rssi -128 Workaround: Dowgrade wlc code to 6.0.202.0 Fix: This bug is going to be fixed in upcoming 7.0 release and onwards. You can also open a TAC Service request and request a special code based on 7.0 in the meantime. You are also invited to read through this document for more information on Location tracking troubleshooting: https://supportforums.cisco.com/docs/DOC-13604 ... View more

The Channel scanning algorithm introduced into the 1.3.4 firmware as part of the interband roaming feature can have an adverse effect on voice performance in certain environments. The scanning algorithm was targeted at open plan environments were coverage cells were large, and the phones would remain in the coverage cell for 5 to 10 seconds or more. This algorithm has worked well in the environments for which it was targeted. But in those environments where cell coverage is small, such as corridors with turns, fire doors and non line of sight, the algorithm has proved not to be optimal in every usage case. The scanning algorithm does not scan the channels aggressively enough in these environments, which can lead to the phones appearing to remain connected to an Ap that is no longer the best candidate as the candidates change rapidly. The AP to which the phone is connected is normally displayed in red in the neighboorlist of the phones. Cisco is preparing a new scanning algorithm to mitigate this behavior and provide more aggressive scanning, which should reduce the incidence of voice drops. The new scanning algorithm should not be considered as an alternative to a voice deployment best practices, the guidelines for which are detailed in the 7921 and 7925 deployment guides. The new code can only be obtained via a TAC case after verifying that the Wireless infrastructure is inline with the voice deployment guidelines and that there is necessary RF coverage. UPDATE January 2013: New algorithm is integrated as of 1.4.2 code. It is recommended to run latest 1.4.3 code. For you refference here are the 7921 and 7925 deployment guides. http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/7921g/6_0/english/deployment/guide/7921dply.pdf http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/7925g/7_0/english/deployment/guide/7925dply.pdf ... View more