The script onboard will only add 2 drives (for a total of 3).  Adding a drive is intended as a workaround to an undersized system.  If space continues to be a problem, one should probably look at deploying the next size larger .ova. ... View more

Jaaazman777: Please be aware of a new bug:  CSCuj84053 PI Update.4-16 cannot be installed on a secondary The Primary can/should/must have the Update-4 patch on it, and still be able to sync with a Secondary that only has the Update-1 patch.  Might want to go to the Bug Search Tool and sign up for updates on it. ... View more

Rob: What version of MSE software and Prime Infrastructure are you using?  Is this a new installation, or an upgrade?  If upgrade, from what to what?  ... View more

What's getting confused is the difference between AUTHENTICation (who are you?) and AUTHORIZation (what are you allowed to do?).  Clearly FreeRADIUS is saying that the AUTHENTICation passed--the credentials were correct--but it's not passing the correct AUTHORIZation information back.  Your IOS devices may bow to "shell:priv-lvl=15", but Prime Infrastructure isn't an IOS device, and has no idea what to do with that.  As well, the login failure mechanism isn't complicated enough yet to reflect to a user the difference between a failed AUTHENTICation or a failed AUTHORIZation. There's a sample configuration document about NCS here in the Support Forum: Freeradius for NCS config All the correct AUTHORIZation attributes--the lines 'cisco-avpair += "NCS:task0=View Alerts and Events",'--from that sample are what you're missing.  The attributes are listed under Administration >  Users, Roles & AAA > User Groups > select a group > Task List hotlink for each group of user.  Remember that there HAS to be a VIRTUAL-DOMAIN attribute, a ROLE attribute and *ALL* of the TASK attributes associated with that group.  The attributes are going to be different from NCS to Prime Infrastructure, and tend to be different from version to version of each product, so you have to use the ones that are listed in whatever version of whatever product you're using right now. Once you have FreeRADIUS configured to send the right attributes, to diagnose this full on, go to Administration > Logging, and set the logging level to Trace for the modules AAA, GUI and System, and click Save.  Then change your AAA settings and make a login attempt, allowing it to fail.  When it does, please return to Administration > Logging, and click the Download button to retrieve the logs.zip file.  Look in the ncs-0-0.log file and you'll see the transaction to FreeRADIUS, what Prime Infrastructure has to say to it, what FreeRADIUS says back, and what Prime Infrastructure does with the responses. ... View more

Mark: Complaints about the performance of Switchport Tracing are pretty common.  The best way to build this out is to start with your planted rogue AP is connected to the same switch that your Prime Infrastructure server connects to--or the first wired switch that ESX/ESXi host connects to--and validate that it works there, make whatever changes you need to get it working, then move the planted rogue AP to the next switch and so on.  The logging modules Configuration, General, Monitor, GUI, System and Tools should cover everything you need to know why Switchport Tracing isn't giving the results you expect.  This "start small and work your way up" helps you learn lessons about what needs to be configured on all your switches to have it working the way you want it to. Configuring Switchport Tracing ... View more

Hi Josh: This would really be more of a wireless LAN controller/mobility anchor question than a Prime Infrastructure question.  Prime Infrastructure is just the management station, and is only emailing notifications because the wireless LAN controller is sending it [Prime Infrastructure] SNMP traps about the tunnel being up and down.  The wireless LAN controllers use eping and mping to determine reachability between the anchor and foreign controllers.  If one of those tests fail, the wireless LAN controller will send the tunnel down trap.  Once they start passing again, the wireless LAN controller will send the tunnel up trap.  What this means is that something in the network is causing the eping and mping to fail.  You may want to open a TAC service request against the anchor controller to have someone look at the mobility anchor status flipping. ... View more

Hi Cristian: Hot Standby in Prime Infrastructure is done at the Oracle level.  At the time the Primary's Oracle database commits a transaction, a copy of that transaction is sent to the Secondary and committed immediately, keeping the two in sync automatically.  In the event of a Primary failure, once a failover [Primary to Secondary] completes (can be either manually activated or automatic), the Secondary becomes active and all the inputs from the controllers are committed there on the Secondary.  Transactions the Secondary commits are stored separately to be committed back to the Primary once it comes back online. The failback [Secondary back to Primary] process is manually initiated, and it starts by the Secondary checking with the Primary to see how far out of sync the Primary's database is.  If it's too far, the Secondary will just push it's whole database back to the Primary.  If it's not far, the Secondary will just send those stored commits to get the Primary caught up.  Once the two are in sync, the Primary takes control, and reinitializes HA to the Secondary. Hope this explains it;  if not, please feel free to ask again. ... View more