I will just use the management port then as that works fine. ... View more

Isn't that the same discussion as this one that you replied to? ... View more

Ah so maybe that is it?  I was trying to connect to the service port with option 43, but it is unroutable (I think I can add a static route to the 5508 WLC).  So using the Management port worked because it is routable? So what is normally used in a production network to find the CAPWAP, Service Port or Management? I can use option 43 in DHCP or DNS and point CISCO-CAPWAP-CONTROLLER to the Service Port or Management Port. Thanks ... View more

On my router (acting as a DNS server) I changed: ip host CISCO-CAPWAP-CONTROLLER 192.168.0.110 (Service Port) to  ip host CISCO-CAPWAP-CONTROLLER 172.16.10.110 (management port) And all is working, so can the service port not be used? ... View more

On the router I added: Router(config)#ip dns server Router(config)#ip host CISCO-CAPWAP-CONTROLLER 192.168.0.110 Now showing as ok, but still no joy. Translating "CISCO-CAPWAP-CONTROLLER"...domain server (172.16.20.1) [OK] *Mar 1 00:49:49.539: %CAPWAP-5-DHCP_OPTION_43: Controller address 192.168.0.110 obtained through DHCP Not in Bound state. *Mar 1 00:50:34.543: %CAPWAP-3-DHCP_RENEW: Could not discover WLC. Either IP address is not assigned or assigned IP is wrong. Renewing DHCP IP. *Mar 1 00:50:39.663: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 172.16.20.102, mask 255.255.255.0, hostname AP1 ... View more

Sure: APs have been used on the controller before (Cisco 3702i's) Hex f104c0a8006e = the service port IP 192.168.0.110 *Mar 1 00:12:15.887: %CAPWAP-3-DHCP_RENEW: Could not discover WLC. Either IP address is not assigned or assigned IP is wrong. Renewing DHCP IP. AP1# *Mar 1 00:12:21.007: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 172.16.20.24, mask 255.255.255.0, hostname AP1 Translating "CISCO-CAPWAP-CONTROLLER"...domain server (172.16.20.1) *Mar 1 00:12:26.887: %CAPWAP-5-DHCP_OPTION_43: Controller address 192.168.0.110 obtained through DHCP Should I build a DNS server and add an A host for  CISCO-CAPWAP-CONTROLLER and point to 192.168.0.110? If the APs are put on the same VLAN as the management ports (LAG) the boot up fine, but want them on a different VLAN. Thanks ... View more

Thanks Scott, yeah this was one of my first question.  I thought abouthis while at work so will test later. I've noticed on our 2 x 5508s at work they don't even use the SP port, is that quite common?  We just use the management port. Question:  How can I find out which port is the management port on our 5508s at work? ... View more

Hi Scott,  I have the SFP modules installed on the 5508, but it goes to a FE trunk on the 3560, not sure if I need to use a Gig port on the 3560. ... View more

interface range FastEthernet 0/23 description Trunk Port to Cisco WLC5508 switchport trunk encapsulation dot1q switchport mode trunk The above goes to port 1/8 on the WLC as seen in my screenshot.  The above port shows as "notconnect" ... View more

why would the Management port (port 1 or the 8) not be flashing green though on the 3560? The port is configured as a Trunk too. ... View more

Hi, They are in different subnets/VLANs.  As mentioned I'm using VLAN 1 and 14. If the WLC is in 1/8 Gig and goes to a fast ethernet port on the 3560 will it negotiate down or has to be a Gig port? Can the service port be a fast ethernet? ... View more

Thanks. So what should be the steps?  At the moment I will have to manually fail over to the backup line I simply do: Change: interface GigabitEthernet0/0  nameif outside  security-level 0  ip address 1.2.3.66 255.255.255.224 standby 1.2.3.66  ospf cost 10 To:  interface GigabitEthernet0/0  nameif outside  security-level 0  ip address x.x.x.x  255.255.255.224 standby  x.x.x.x (Backup ISP IP address)  ospf cost 10 !    No route outside 0.0.0.0 0.0.0.0 1.2.3.66 1   Then   route outside 0.0.0.0 0.0.0.0 x.x.x.x 1 (Backup ISP IP router) I was thinking of using a script to do this as we have Prime as I don't feel confident enough to do this myself. Or changing the configs, something like this? Steps: Configure 2 new ports on switches Conf t vlan 1999 Name PrimaryISP vlan 1998 name backupISP interface GigabitEthernet1/0/4 description Trunk to ASA1 Outside switchport trunk allowed vlan 1998-1999 switchport mode trunk spanning-tree portfast spanning-tree bpduguard enable interface GigabitEthernet2/0/4 description Trunk to ASA2 Outside switchport trunk allowed vlan 1998-1999 switchport mode trunk spanning-tree portfast spanning-tree bpduguard enable Then the ASAs Current config (not real IPs): interface GigabitEthernet0/0 nameif outside security-level 0 ip address 1.2.3.66 255.255.255.224 standby 1.2.3.67 ospf cost 10 My steps interface GigabitEthernet0/0 no nameif no security-level no ip address interface GigabitEthernet0/2.1999 vlan 1999 nameif outside security-level 0 ip address 1.2.3.66 255.255.224.0 standby 1.2.3.67 interface GigabitEthernet0/2.1998 vlan 1998 nameif outside security-level 0 ip address x.x.x.x 255.255.224.0 standby x.x.x.x Move cables from gig 0/0 on each ASA into 1/0/4 & 2/0/4 Add route outside 0.0.0.0 0.0.0.0 1.2.3.66 1 I have ann access list called access-list outside_access_in will this change? As you mentioned the NATs too as below, do they all get removed? nat (inside,outside) source static any any destination static NETWORK_OBJ_172.29.11.0_24 NETWORK_OBJ_172.29.11.0_24 no-proxy-arp route-lookup nat (inside,outside) dynamic interface nat (DMZ2,outside) dynamic interface nat (DMZ3,outside) dynamic interface nat (DMZ4,outside) dynamic interface nat (outside,outside) dynamic interface nat (DMZ1,outside) dynamic interface nat (DMZ1,outside) static x.x.x.x access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 1.2.3.66 1 http x.x.40.0 255.255.255.0 outside ssh x.x.40.0 255.255.255.0 outside ssl trust-point Corp-TrustPoint-SSLVPN-AW outside enable outside ... View more

Hmm sounds a bit scary. The other option is to get a second router on the same public IP range from our ISP and use HSRP on the routers. Or automate my manual process through something like Cisco Prime, I do this at the moment: ASA Conf t   interface GigabitEthernet0/0  ip address 1.2.3.66 255.255.255.224 standby 1.2.3.67     route outside 0.0.0.0 0.0.0.0 1.2.3.66 1 ... View more

Thanks - I was just hoping to call one of the new sub interfaces the same (outside) so little would be changed for the primary line and VPN and then look at the 'backup' nameif after. ... View more