5 wireless controller and roaming security

[ahmedalshami]

i want to connect 5 wlan controller to core switch with 470 ap . client must roaming and dont have disconnect. what security must configured

[magress · Accepted solution]

Hello,

As long as all wlan controllers are configured with the same virtual ip address and placed within the same mobility group a client will be able to roam regardless of the security method being used. The WLAN must also be configured on all controllers.

Thanks,

Mark

[ahmedalshami]

can you send how to configure mobility groub ?

[Stephen Rodriguez · Accepted solution]

Ahmed,

Here is a link to the Configuration guide for the 4400 controller, and how to configure mobility groups. This doc is relevant for all controller mobility group configurations.

http://www.cisco.com/en/US/products/ps6366/products_configuration_guide_chapter09186a008076cf0a.html

[wififofum]

Stephen,

I dropped these questions in the Ask the Expert forum, but they are relevant here:

Our intention is to use the Mobility Group to distribute AP connections among many controllers on several campuses for redundancy in the event of catastrophic failure. With this in mind, several questions arise as to how this can be achieved:

1. What is the formula by which an AP, once it has a list of candidate controllers to join, chooses a specific controller? We understand it has something to do with the number of APs and clients a controller is managing, but what are the quantitative criteria/tiebreakers in the AP decision process? What are the relative/absolute values?

2. If we use DHCP Option 43 to point to the APs to a Master Controller, and subsequently re-assign via the controller GUI the APs Primary, Secondary, and Tertiary controllers, will the APs automatically join the Primary, or do they have to be rebooted? And if rebooted, will these WLC assignments override the DHCP Option 43 if not changed?

3. In the above setup, will the AP stop searching for available controllers if the Pri/Sec/Ter WLC assignments fail? Can other, unassigned controllers in the Mobility Group provide a connection for an AP? Or is N + 1 + 1 the limit?

4. Assuming the AP tries them in sequential order, can we place all WLCs in a Mobility Group inside Option 43, or is it limited to 3 entries like the controller-based assignment?

Thanks for any assistance,

[ahmedalshami]

Dear

i configured ACS SE 1116 and the wireless security is PEAP . i regenerate the certificate from self install . when install the certificate on the laptob i can connect with certificate and without it .

i dont know how to make it just with certificate and not be able to connect without certificate. Please help.

[ahmedalshami]

dear,

I was installed the (remote agent) in the PC (also the Cisco works installed in this PC)first, its work but when the IT manager regenerate the certificate in the ACS and install it on the client its not work .just I can established connection to the internal database but the external database(windows ACTIVE Directory )its not connected and the ACS report its INTERNAL ERROR ,the Microsoft flag in the remote agent its appear on the ACS ,please advice me.

[ahmedalshami]

Dear

i configure the wireless LAN controller and install the ACS server the problem is when i try to connect to the active directry its not connect its just connect to the internal data base in the ACS( the remote agent was installed on the computer on the domain )am using PEAP security but its not connect to the ACTIVE DIR. just to the internal data base in the ACS please advice and telle me how to configure .

[ahmedalshami]

dear,

I was installed the (remote agent) in the PC (also the Cisco works installed in this PC)first, its work but when the IT manager regenerate the certificate in the ACS and install it on the client its not work .just I can established connection to the internal database but the external database(windows ACTIVE Directory )its not connected and the ACS report its INTERNAL ERROR ,the Microsoft flag in the remote agent its appear on the ACS ,please advice me.