Ask the Expert: Cisco Wireless LAN Controllers (WLCs)

[ciscomoderator]

with Cisco Expert Nicolas Darchis

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about how to trobuleshoot, configure and deploy any Cisco Wireless LAN controller with Cisco subject matter expert Nicolas Darchis.

Nicolas Darchis is a wireless and authentication, authorization, and accounting expert for the Technical Assistance Center at Cisco Europe. He has been troubleshooting wireless networks, wireless management tools, and security products, including Cisco Secure Access Control Server since 2007. He also focuses on filing technical and documentation bugs. Nicolas Darchis holds a bachelor's degree in computer networking from the Haute Ecole Rennequin Sualem and a master's degree in computer science from the University of Liege. He also holds CCIE Wireless certification number 25344.

Remember to use the rating system to let Nicolas know if you have received an adequate response.

Nicolas might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Wireless sub-community, Getting Started with Wireless discussion forum shortly after the event.

This event last through Friday June 28, 2013. Visit the community often to view responses to youe questions of other community members.

[salilai01]

Hi again Nicolas,

We want to buy ISE for VM but our commercial has proposed to us only a price with an advanced license and said that he has no proposition with basic license because with wireless we have to buy directly advanced one!

Could you please tell me why we have no proposition of pricing with basic license?

Thanks

[Nicolas Darchis]

I'm not a commercial, so I do not have all answers.

But there is a wireless specific ISE license (that only works with WLCs, so you can't add switches for example) and that is cheaper.

Otherwise I'm not aware of any limitation to WLCs requires an advanced license

[salilai01]

1-  I added the wlc on the radius, but with iphone it display the webpage and I entred my radius login then I had the google page. I walked away from the access point, and when I come back he asked me to put my login again, knowing that with the laptop even if I walk away when I come back it is always connected

2-  Furthermore with another laptop, the web page is requested and then login radius is entered but the cisco web page appears just after my web page which I customized. and if I try to display google page it work Correctly, very strang!!

[salilai01]

VM is for virtual appliance :-)

[janomegvw]

Hi Nicholas,

I have recently changed ISP and subsequently had to change the IP of the ASA.  Today when I gave guest-access via my WLC, he could authenticate after connecting, but had no internet access after authentication.

I am an absolute beginner and do not know what the problem might be and where to even start looking.

Thanks,

Janome

[Nicolas Darchis]

Is it the public internet ip of the ASA you had to change or the internal ip ?

If you changed the internal ip, then probably the clients are not given the right default gateway for internet access anymore (check on the DHCP pool for clients and also check what are the gateways of the interfaces in the WLC).

If it's just the internet ip that changed, then it's absolutely transparent for the clients normally. I would say it's an ASA config problem then.

[MILAN CHANDRA]

Hi,

Can LAP be configured in local mode, centrally switched over the WAN ? Consider this design 5yrs old. Still this is running and working.

Per me over the WAN only REAP / HREAP / Flexconnect mode will work , not the local mode.

Thanks.

[Nicolas Darchis]

There is always a different between "should" and "will work or not".

Over a WAN, an AP should be configured as Flex because the Flex state machine tolerates some delay and losses.

But if the WAN is fast and reliable, local mode could be working without a problem yes.

[sambavenigalla1]

Hi Nicholas

we are the SI,while disigning the flex /hreap access points ,my customers are frequently asking the one question

Question

What is the mnimum bandwidth requied for capwap signaling for flex /hreap access points.

Thanks &regards

Samba siva rao

[Nicolas Darchis]

128kbps per AP

[Stavros Zannikos]

Nicolas,

I am currently allowing my guest users to create their own guest accounts via self-service using the Cisco NAC Guest Server.  I am currently looking at the ISE solution for securing our wireless infrastructure even further.  In reading the ISE documentation, I didn't notice guest self-service capabilities.  Is this possible with the ISE (so that I can get away from the NGS), and if so, would you know where I can find further documenation on guest self-service for the ISE? 

Secondly, would you happen to know when the 7.5 code might be gold released?  Thanks!

[Nicolas Darchis]

7.5 is planned for July. There is no precise date because it was postponed due to critical issues ongoing with 7.4, so it will be out when it's ready :-)

ISE has exactly the same capabilities as Guest Server (that it kind of replaces) and even more. Guest can create their account but also add mac addresses of their personal devices (laptop,smartphone, etc ...) so that all those are bound to the guest account.

Regards,

Nicolas