Hi Diego, I dont think there is any solution to this issue since there is no problem. We are trying to stop an HTTPS connection and presenting our page having certificate tied up to the virtual interface of the WLC. When client did DNS initially for goofle.com , it also noted its ip address. Now when HTTPS connection is hijacked , and WLC or some other page is presented , it doesnt have the ip address which it resolved for google, hence the error. This is because of come clients having high security and is by normal process. ... View more

  Hi, Can you please explain the IOS XE images naming convention and how to   identify what is the current version running on my switch?Is there any difference while we run the show commands on IOS and IOS-XE?   Regards Dhiresh ... View more

Hi, Thanks for raising this question. This is where Converged access difference comes in to picture as compared to normal IOS. In WiSM module , although we insert the module inside the 6500 switch but the IOS is still different which means that module still works on AireOS while rest of the switch on IOS. On converged access/NGWC , the wireless is integrated inside the IOS-XE package. So the command line used to access switch or wireless is same. The ability to host different software packages on the linux kernal in CA solution makes this possible. So if you do "sh flash" on the CA box , you will see all the Software packages inside the XE platform. For example if IOS-XE version is 3.6.2 , then you will see wireless controller module package as 10.2.102.0 while it would be different for IOSd module which would carry out wired functions. Let me know if you have any further doubt. Regards Dhiresh   ... View more

Hi John, I think your requirement matches exactly the way , topology 3 is configured in th e link I shared except ISE Posture assessment. But let me just try to break that in to few parts so that you understand that better and also the fact that you would need to consult combination of documents to finish your task. Wireless controllers: MA(3850)..Guest SSID will be configured here as per the shared document. It will be mac filter based with Radius NAC.The MA will be in sync with its MC i.e 5508 as verified by "Sh wireless mobility summary". No need of its sync up with the Anchor.In the SSID configuration , we will mention the Anchor IP address. MC(5508)..No configuration for the SSID needed here.I just needs to be in sync with the MA (3850) via switch peer configuration  command. Anchor (5508)..Here we again need Guest configuration as it is acting like anchor.Also it should be in the Mobility configuration of MC (5508) and the Mobility tunnel should be up between the Anchor (5508) and MC (5508). The traffic for this ssid will be routed from the MA to MC and then to Anchor.Follow that document which is shared already to configure Guest SSID and ISE CWA side configuration. For the other basic configuration like mobility tunnel ,Switch peer group to sync the MC and MA, or in general SSID configuration,AP joining to 3850 (MA), interfaces configuration on 3850 etc, Please refer to the following document:   Every topic like making ssid , Syncing MC to MA , Mobility group configuration is covered in topic wise chapters. http://www.cisco.com/c/en/us/td/docs/wireless/technology/5760_deploy/CT5760_Controller_Deployment_Guide/Supported_Features.html   http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3850-series-switches/deployment_guide_c07-727067.html ISE side. Here it is a bit more easy: CWA : You need to follow few simple steps to make ISE ready for CWA and to serve the client sent by the controllers.CWA steps are covered under the same document ,topology 3. Posture assessment: This is also possible along with the CWA but since I am from wireless and not from security , I might not be able to give in depth steps for that but implementation is possible via this document: http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116143-config-cise-posture-00.html#anc5   There is no one document which will have all that information as per your requirement but the combination of these documents will definitely help  you in accomplishing your task.   Hope this clarifies.   Regards Dhiresh **Rating encourage participation** ... View more

Hi Rasika,   Sorry for the two replies . I thought first one never got posted.   Regards Dhiresh ... View more

Hi Rasika, Thanks for the question. Link local multicast inside the vlan would be supported irrespective of the wired or wireless. For wireless , it is supported inside the local vlan of locally switched wlan: http://www.cisco.com/c/en/us/td/docs/wireless/technology/bonjour/Bonjour74/Bonjour_Deployment.html About the configuration guide , Normally when they talk about any mDNS configuration or discussion with respect to any Wireless device they mean learning the mDNS services which is not possible if the client traffic is locally switched and possible only in the central switch scenario , hence the statement .With in the subnet functioning of the Bonjour services doesnt need any mDNS configuration/discussion for the contrller/AP. If you still think that the statement is not very clear and is confusing , Please go ahead and raise a TAC case for a documentation bug but chances that they would accept it are very less given the context.   Hope this clarifies. Regards Dhiresh   ... View more

Hi Rasik,   Thanks for the question. Link local multicast will always work in the same vlan irrespective of Wired or wireless. It is clearly written here http://www.cisco.com/c/en/us/td/docs/wireless/technology/bonjour/Bonjour74/Bonjour_Deployment.html Looks like there is misunderstanding of words. Whenever they talk about  mDNS configuration on the wireless device , they normally mean learning the services and for that client traffic should be sent to the controller , which is not possible in the lcoal switched wlan but possible in central switch wlan. SO they have mentioned it will not work on flex connect local switched wlan. To work in the same vlan , you even dont need any mDNS configuration/discussion from the wireless device perspective. Hope this clarifies.   Regards Dhiresh     ... View more

Hi Arvind, Thanks for asking this question. Yes , NGWC supports multicast , the same way it is supported in CUWN today i.e Multicast unicast and multicast multicast. Multicast to Multicast is same but Multicast to unicast is handled in better way on Converged access, Instead of doing unicast of multicast packet to each AP like in CUWN , converged access controllers , forwards to APs having clients for the multicast group instead of all the APs. For the flex connect mode AP , this mDNS and DNS-SD depends upon the central switch vs locak switching and here is the behavior: For centrally switched WLANs, the behavior for Bonjour is the same as if the AP was in local mode. > Bonjour queries from the client are sent to the controller and Bonjour responses from the controller are sent back to the AP in the unicast CAPWAP tunnel. > FlexConnect APs do not require the Multicast‐Unicast mode to support Bonjour. Local switched WLan > For locally switched WLANs, Bonjour continues to work in a single subnet only.This is any way by default supported since day 1 in mDNS. This link will provide a bit more information on this: https://supportforums.cisco.com/document/12068926/common-apple-bonjour-and-cisco-wireless-related-issues Let me know if I answered your query. Regards Dhiresh ... View more

Hi , Thanks for raising this question. This is where Converged access difference comes in to picture as compared to normal IOS. In WiSM module , although we insert the module inside the 6500 switch but the IOS is still different which means that module still works on AireOS while rest of the switch on IOS. On converged access/NGWC , the wireless is integrated inside the IOS-XE package. So the command line used to access switch or wireless is same. The ability to host different software packages on the linux kernal in CA solution makes this possible. So if you do "sh flash" on the CA box , you will see all the Software packages inside the XE platform. For example if IOS-XE version is 3.6.2 , then you will see wireless controller module package as 10.2.102.0 while it would be different for IOSd module which would carry out wired functions. Let me know if you have any further doubt. Regards Dhiresh ... View more

Hi , Thanks for the. With 4 5508 , you can have CUWN implementation also..:) For implementing the way you said..yes it looks alright.Let me answer the question. > here my question is for guest ssid and its vlan... do i configure it here or on anchor controller??? Again topology 3..it is configured only on MA which means 3850 (foreign controller) and the DMZ (Anchor controller). There is no need to do any configuration on the 5508 pair which is acting like MC. > i want ISE to be integrated with wireless for employee 802.1x and for guest web Auth. so, how i will integrate ISE with wireless. i mean weather i will integrate it anchor controller or with each 3850 MA??? For 802.1x a nd if corporate ..there should not be any DMZ anchor and the traffic will hit MA (3850) and then aaa request to ISE and data forwarding will start. Guest..It has different meaning these days. Traditionally it is a layer 3 security configured on the controller which is using local web server of the wlc. Another is CWA and the advanced version is BYOD and both require ISE. We you are looking at advanced versions then again as per the document shared , Only foreign wlc should be integrated with the ISE as this is a layer 2 kind of web-authentication taking place with the help of Mac authentication bypass. > where shall place ISE in my network, in DMZ or with Core switch? This can be placed anywhere if the proper ports are open and again depends on Webauth type. If using CWA/BYOD, the Foreign wlc will interact with the ISE for authentication while redirect url traffic will hit anchor wlc and redirection to ise portal will happen,. so communication should be allowed accordingly.Again , i will request to follow the 3rd toplogy. > my target for guest users to do not have access to any corporate network sources ? Map the SSID to some DMZ vlan on the Anchor. > can i use both wips and context aware on the single MSE box? No. Since 7.5 onwards we have clearly recommended to use separate MSE for WiPS and location. or else there are many MSE crashes. > are each 3850 MA will be added in MSE? Yes.   Regards Dhiresh **Ratings encourage participation** ... View more

Hi , Thanks for the. With 4 5508 , you can have CUWN implementation also..:) For implementing the way you said..yes it looks alright.Let me answer the question. > here my question is for guest ssid and its vlan... do i configure it here or on anchor controller??? Again topology 3..it is configured only on MA which means 3850 (foreign controller) and the DMZ (Anchor controller). There is no need to do any configuration on the 5508 pair which is acting like MC. > i want ISE to be integrated with wireless for employee 802.1x and for guest web Auth. so, how i will integrate ISE with wireless. i mean weather i will integrate it anchor controller or with each 3850 MA??? For 802.1x a nd if corporate ..there should not be any DMZ anchor and the traffic will hit MA (3850) and then aaa request to ISE and data forwarding will start. Guest..It has different meaning these days. Traditionally it is a layer 3 security configured on the controller which is using local web server of the wlc. Another is CWA and the advanced version is BYOD and both require ISE. We you are looking at advanced versions then again as per the document shared , Only foreign wlc should be integrated with the ISE as this is a layer 2 kind of web-authentication taking place with the help of Mac authentication bypass. > where shall place ISE in my network, in DMZ or with Core switch? This can be placed anywhere if the proper ports are open and again depends on Webauth type. If using CWA/BYOD, the Foreign wlc will interact with the ISE for authentication while redirect url traffic will hit anchor wlc and redirection to ise portal will happen,. so communication should be allowed accordingly.Again , i will request to follow the 3rd toplogy. > my target for guest users to do not have access to any corporate network sources ? Map the SSID to some DMZ vlan on the Anchor. > can i use both wips and context aware on the single MSE box? No. Since 7.5 onwards we have clearly recommended to use separate MSE for WiPS and location. or else there are many MSE crashes. > are each 3850 MA will be added in MSE? Yes.   Regards Dhiresh **Ratings encourage participation** ... View more

Hi Rasik, Thanks for the comment. I will provide that feedback to the moderator.   Regards Dhiresh ... View more

Hi John,   Thanks for putting those questions. Please find the answers below: 1) Wlan and interfaces will be configured on the MA (3850) and not on the MC. 2) Please find the below document  which describes all the possible topologies, configuration briefly. http://www.cisco.com/c/en/us/support/docs/wireless/5700-series-wireless-lan-controllers/117717-config-wlc-00.html I think Topology 3 of this document describes your scenario. Basically Anchor sitting in the DMZ and the MA (3850) only needs to be configured. No configuration needed on the MC. 3) Individual controller will be added in the MSE for Wips/Context aware. So 3850 will be added in the MSE and the NMSP connection will terminate at the 3850. Let me know if you have any other query. Regards Dhiresh **Ratings encourage participation**   ... View more

Hi Rasika, ok..So this Universal mode AP support is present in 3.7.0 code already on CCO. I could not find that in the Release notes..but it is given here: http://www.cisco.com/c/en/us/td/docs/wireless/access_point/ux-ap/guide/uxap-mobapp-g.html#pgfId-105133   see FAQ section on the last page of this link.   Regards Dhiresh   **Ratings encourage participation** ... View more

Hi Rasika, Thanks for the question and I will try to answer this in general. Can I request you to limit the questions based on the images/hardware which is already on CCO/market ? Few reasons: > There is be a big team of BU developers and TMEs which might have participated actively in deciding and developing and testing the 8.1 features but it is not appropriate to disclose that untill the features are finalized and released. For example this 8.1 feature, Aireos not MC of MA , there must be definitely some intention to do that but the information is only limited to BU at the moment. > As we said that we (TAC) dont pay much attention to coming attractions untill it hits CCO. Another major factor is that there is no guarantee that a feature would be present/absent when the actual  code hits the CCO.It might hit but in a changed way, So in a way its outside the policy also to discuss something in detail which might or might not be true. Hope you understand this TAC limitation. Just trying to answer this question in general , if the feature is really going to hit the CCO , I  think  roaming would be possible.If the AireOS WLCs support hierarchical mobility and  PMK might be shared among mobility controllers (5760 and 5508 for eample ) then 4 way handshake would happen.(security, avc profile, qos,etc) configuration for the SSID will have to be consistent between both the controllers.If there is some parameter which can not be passed to the target controller then that should be ignored. This problem is sometime present even when  roaming between two CA controllers and controllers dont have consistent configuration. For example some acl , say test, configured differently on two CA controllers. The client will roam and work according to the new controller policy configured for that wlan. To come out of these situations ,you have "Sticky anchoring/roaming" .If enabled on the wlan , there off course the question of QOS ,security etc doesnt arise at all even if the configuration is not consistent/compatible as Point of presence will be at anchor while Point of attachment will only move to Foriegn. I am not sure if the 8.1 on the WLC side will have feature. "What would be the advice to customers who are using AireOS WLC as MC in their network ?" If they have decided to remove AireOS wlc as MC ..then only option is to configure 5760 and 3850 as MC. Again as I said , currently people involved in developing and deciding the feature (BU , TME making announcements ) can answer the intentions officially. I would be able to answer all type of questions till 8.0.115.0 currently and about 8.1 which is a major release laden with dozens of features, at CCO. Hope this make sense. Regards Dhiresh ... View more