I have heard about positron some time back I had a confusion if the NGS is same as positron .I initially thought positron to be  the replacement for Cisco ACS and never imagined the guest access features to be there . Regarding WCS merging with wired network management was the work involved in getting a unified NMS for NGWC(Next Generation wiring closet) . There was code name I think was lumous or so, not able to recollect the same. ... View more

Nicolas - You are right, all my requirements can be met by the NAC Guest server . I had been going through the documentation of this product for the past few days. Couple of thoughts   that came into my mind is that all the features that i was looking at is all software based , it has no dependency on hardware . Since we already use WCS for lobby ambassador, why did Cisco not integrate the same features on WCS and went and put it in the NAC . I agree there is a strong correlation between NAC and Guest access  But Iam not able to justify in getting a new product /Hardware for doing advanced Guest access . We bought the WCS primarily for the Guest access and guest account management and controller management was secondary . I don't understand Cisco strategy as to putting pieces of the same feature in multiple devices and customer having to purchase different hardware for the different features of the same technology. I understand that this is not a forum to comment but just thought of penning down my views .However i will have a talk with the Cisco SE on the same. Thanks for your help- Regards ... View more

Nicolas , What you are mentioning is about the bind method "Authenticated or Anonymous”, irrespective of the bind the packet is plain text  and how do i ensure that to be encrypted  . Thinking about it i thought of doing IPSEC to the LDAP server, but the WLC would only support IPSEC for Radius servers and not LDAP. The link below tells it was supported and new releases stopped supporting it . Searched how the other vendors do the same and it seems Aruba does supports secure LDAP. Clearly a limitation on the product ... View more

Friends , I have a requirement where I deny access to systems that is not part of the domain. Our current environment is dot1x (PEAP) based on username and it doesn’t check if the machine is valid machine on a domain. I was thinking about machine auth and when checked I find that you need certs on the machines to do machine auth. Currently we don’t have a PKI infrastructure in place to have certs issues to machine. The other option would be do NAC, but that is not an easy solution. Need some quick solution to prevent machines not in domain to access the corporate network. The problem that we face is people come to the office with the Iphones/Ipads/Blackberries and join the corporate network based on the user name, though this devices are not of corporate standard. ... View more

Stephen - Are you sure about all the controllers - I happen to see that the 2016 has a limitation on the multicat forwarding . After the network starts sending multicast packets the controller forwards the multicast packets for a few minutes and after that it refuses to forward . I happen to see some mbuff getting full in logs . There was a bug for the same which said multicast not supported on 2106 platforms . ... View more

Thanks Thibault. Can you help me in matching the string "www.sandjose.com/dir2/content2.aspx" I have tried the SSL URL rewrite and it didn't work , I think i was trying to match the entire path and made some mistakes in matching it . Can you please help inthis regards . I think the regex  i tried was www\.sandjose\.com\/dir2\/content2\.aspx ... View more

One of the reasons that the user gets a page when he changes the https to http on the address bar of the broswer is because we use ssl offload and the SSL is between the client and the ACE and from the ACE to the server it is clear text . Once the user changes from https to http it hits the ACE on 80 and is redirected to the real server as any other HTTP packet . let me give an example for better understanding i have a site by name www.sandjose.com www.sandjose.com request goes through http and it has many directories listed under it serving different pages www.sandjose/dir1/content1.aspx www.sandjose/dir2/content2.aspx .... .... .... .... www.sandjose/dirn/contentn.aspx. Out of  above directories i want certain URL's e.g "www.sandjose/dir2/content2.aspx" to always use HTTPS and even if the user comes via HTTP . I need to redirect him to HTTPS if the request come from http. Hope my example makes it clear. ... View more

  sh run Generating configuration.... crypto chaingroup IBECHAINGRP   cert fly1.xxxxxxxx.com.cer   cert GTE_Cyber.pem   cert Comtrust_Root.pem   cert Comtrust_Server.pem crypto csr-params CSR_IBEPARAMS_1   country xx   state xxxxx   locality xxx   organization-name xxxxxxxxAirlines   organization-unit xxxxxxxxAirlines   common-name fly1.xxxxxxxx.com   serial-number 1010 access-list ANY line 8 extended permit ip any any access-list ANY line 16 extended permit icmp any any access-list ICMP-ONLY line 8 extended permit icmp any any access-list xx-fly1 line 8 extended permit ip host 94.203.119.222 any probe http HTTP_Probe   interval 30   faildetect 2   passdetect count 1   expect status 200 399   expect status 401 401 parameter-map type connection MSS_1200   set tcp mss min 536 max 1172 rserver host xxxegww57   ip address 10.22.52.20   probe HTTP_Probe   inservice rserver host xxxegww58   ip address 10.22.52.21   probe HTTP_Probe   inservice rserver host xxxegww59   ip address 10.22.52.22   probe HTTP_Probe   inservice rserver host xxxegww60   ip address 10.22.52.23   probe HTTP_Probe   inservice ssl-proxy service SSL-PSERVICE-SERVER   key ibersakey.pem   cert fly1.xxxxxxxx.com.cer   chaingroup IBECHAINGRP serverfarm host IBE-HTTP   rserver xxxegww57 80     inservice   rserver xxxegww58 80     inservice   rserver xxxegww59 80     inservice   rserver xxxegww60 80     inservice sticky ip-netmask 255.255.255.0 address both IBE-STICKY-GRP1   timeout 720   replicate sticky   serverfarm IBE-HTTP class-map match-any ICMP-TRAFFIC   2 match access-list ICMP-ONLY class-map match-all VIP-IBE-HTTP   2 match virtual-address 10.22.52.10 tcp eq www class-map match-all VIP-IBE-HTTPS   2 match virtual-address 10.22.52.10 tcp eq https class-map type management match-any mgmt   10 match protocol icmp any   20 match protocol telnet any policy-map type management first-match mgmt   class mgmt     permit policy-map type loadbalance first-match IBE-HTTP   class class-default     sticky-serverfarm IBE-STICKY-GRP1 policy-map type loadbalance first-match IBE-HTTPS   class class-default     sticky-serverfarm IBE-STICKY-GRP1 policy-map multi-match ICMP-INSPECT   class ICMP-TRAFFIC     inspect icmp error policy-map multi-match VIP-HTTP   class VIP-IBE-HTTP     loadbalance vip inservice     loadbalance policy IBE-HTTP     loadbalance vip icmp-reply policy-map multi-match VIP-HTTPS   class VIP-IBE-HTTPS     loadbalance vip inservice     loadbalance policy IBE-HTTPS     loadbalance vip icmp-reply     ssl-proxy server SSL-PSERVICE-SERVER     connection advanced-options MSS_1200 interface vlan 950   description *** Server Side VLAN ***   bridge-group 1   mtu 9216   access-group input ANY   access-group output ANY   service-policy input mgmt   no shutdown interface vlan 951   description *** Client Side VLAN ***   bridge-group 1   ip df clear   mtu 9216   mac-sticky enable   access-group input ANY   access-group output ANY   service-policy input mgmt   service-policy input VIP-HTTP   service-policy input VIP-HTTPS   service-policy input ICMP-INSPECT   no shutdown interface bvi 1   ip address 10.22.52.4 255.255.255.128   peer ip address 10.22.52.5 255.255.255.128   no shutdown ip route 0.0.0.0 0.0.0.0 10.22.52.1 ... View more

There are couple of things here. 1) First you need to have a self signed certificate on the AP . See the debug messages your AP didn't have a SSC . 2) Debug pm pki enable on the controller will give you the hash key for certificate. Just take the ouput in a notepad and search for the hash key . ... View more

Karl , The AP manager and the management can be on different vlans , but from the AP both the management and the ap-manager should be reachable . The AP intiall tries to contacts the management interface in the lwapp discovery request and the discovery response from the mgmt intf carries the AP-manager int address.Now the AP sends the join req to the ap-manager intf. Regarding the ports that are used for LWAPP protocol 12223,12222,12224,16666 UDP ports ... View more

Could you console into the NM-WLC6 from the router and see what image it is loading .There was a problem with the NM_WLC cards when it got shipped with a caching software instead of the wireless software . ... View more