06-06-2011 02:00 PM - edited 07-03-2021 08:17 PM
With Nael Mohammad
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn about how to manage, configure, and troubleshoot your wireless networks using Cisco network management products like Wireless Control System (WCS), Mobility Service Engine (MSE), Location Appliance with Cisco expert . Nael is a customer support engineer at Cisco. He specializes in supporting Cisco Network Management products and technologies which includes WCS, MSE, Location Appliance, as well as Cisco Network Registrar (CNR), and CiscoWorks LAN Management Solution (LMS). Nael graduated from San Francisco State University with a B.S. in Business Administration and holds a CCNA certification.
Remember to use the rating system to let Nael know if you have received an adequate response.
Nael might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security and Network Management discussion forum shortly after the event. This event lasts through June 17th, 2011. Visit this forum often to view responses to your questions and the questions of other community members.
06-07-2011 06:00 AM
I configured WCS + CleanAir (ELM enabled) + MSE, but I do not see on WCS the icon on AP to get the spectrum expert data. Do you know what might be wrong?
When will ISE be released? If I trade an ACS appliance with ISE, what do I get on this trade including license and other products?
06-07-2011 10:09 AM
For the WCS/Clean Air issue with spectrum experts, verify that you have it added to WCS.
To add a Spectrum Expert, follow these steps:
As this discussion is only related to WCS/MSE/Location Appliance, please post the question for ISE in the correct forum with respects to ACS/ISE. For the trade up program, you will need to contact your reseller about current promotions.
Below are a few links that talk about ISE, Downloading ISO to install on your existing ACS appliance, and migration path from ACS.
For more info on ISE:
http://www.cisco.com/en/US/products/ps11640/index.html
Release notes:
http://www.cisco.com/en/US/docs/security/ise/1.0/release_notes/ise10_rn.html#wp96296
Downloading ISE:
Migrating from ACS to ISE:
http://www.cisco.com/en/US/docs/security/ise/1.0/migration_guide/ise10_mig_overview.html
06-08-2011 04:02 AM
HI
My question is regarding Radius Server Fallback.
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a008098987e.shtml
Active mode - If the server does not repond to the WLC authentication request, the WLC marks the server as dead.
Part for clarification, is how does it see if it is dead? If it can no longer ping the server, or the services on the ACS have failed?
We've currenlty got 1 * 4.2 ACS Appliance and 1 * 4.2 ACS on Windows. Does the Active mode take in account the agent for the appliance on a AD box is not reponding?
Cheers
Craig
06-08-2011 05:16 AM
Hi Nael,
i have a Problem with the cisco-av-pair string on the Cisco ACS and a SSID.
We have here some SSID and some AD Groups. It was no Problem with the old Cisco ACS 4.2. I have here configured the string: cisco-av-pair ssid=myssid. The Clients have only rights to this ssid. It works without Problems.
On the new ACS 5.2. I have here Problem to configure this.
My Configuration is a new Identity Policy.
Compound Condition:
Radius-Cisco -->cisco-av-pair-->equals-->myssid
But this string works not.
Did you have any ideas about this Problem.
Thanks
regards
Andreas
06-08-2011 12:29 PM
@Andrea
First off ACS is not my area of expertise and this discussion should focus on WCS/MSE/Location Appliance, but I will try my best to assist you.
What protocol are you using to authenticate the wireless users?
What version of WCS are you using?
What version of WLC are you using?
What errors appear on the ACS?
Do a “debug aaa all enable” and “debug aaa local-auth” and capture the outputs and post it for review. Keep in mind the data will be available for all to view whatever is posted on the forums if that is ok with you.
06-08-2011 11:15 AM
@Craig: How does WLC determine if the acs/radius server is dead?
WLC uses standard radius traffic to probe the authenticating server to determine if it’s up or not. It uses one of the three statuses:
“OFF” states if the radius server fails, move to the next radius server in a round robin fashion until you get a response.
“PASSIVE” states treat the list in an orderly fashion based on radius preferences. From the top, if one fails, mark it down for a period of time and move on to the next in the list. Each acs/radius attempts to start from the top of the order and continue to that last and skips acs/radius servers if still in dead timer mode.
“ACTIVE” mode sends a probe packet (radius traffic and requests based on RFC http://www.faqs.org/rfcs/rfc2865.html access-request) to see if the radius server responds by checking the username configured in the active mode settings of WLC. The user does not have to exist on the acs/radius, it just needs to respond to the probe coming from WLC to determine if it’s up or down.
06-11-2011 02:13 AM
Hi Nael
Thank for reply, but stil missing the answer.
Heres what happend, 2 ACS, 1 is on a VM box. The VM session failed, no clients where authenticating, couldn't connect to ACS on the box, only thing could do is ping the box. But it didn't fail over. Had to restart the VM session, then every thing came back..
How does WCS probe the ACS to see if it is authenticating?
Cheers
Craig
06-13-2011 11:02 PM
WCS uses a round robin fashion to probe the ACS server based on the settings you have configured under WCS --> Administration --> AAA --> TACACS+. Post screenshot of this page.
1. What version of WCS are you running?
2. Enable tracing from Administration --> Logging --> Change message level to Trace.
3. Duplicate the problem.
4. Download and attach the WCS logs from Administration --> Logging --> Download Log.
Keep in mind this is a WCS discussion so any issues with the ACS server itself, it would be best to post that in the respective forums as to why the ACS session froze.
https://supportforums.cisco.com/community/netpro/security/aaa
06-09-2011 11:15 AM
Nael.
Our existing setup is a WLC526 with 6 LAP521G units. This setup is 4 years old and is still going ok.
We do have some issues with coverage but it's been rock solid.
Our office building is 55K sq ft over 3 floors and our sanctuary is 45K sq ft (lots of open space)
What do you recommend to move to a wireless N solution.
I have been paying attention to the 2500 controller series and they look sweet.
We have about 40 people on staff but lots of access to our guest wifi during the week and when we hold conferences.
Sometimes these are 200 up to 500 people. Of course not all of these are needing the wifi but with smartphones and iPads and such more and more people are expecting it.
Thoughts?
Thanks,
Steve
06-09-2011 02:53 PM
@Steve, thanks for the great questions.
For the WLC 2500 series, there is a 50 AP max, 500 clients, and 500 tags limitation. If you don’t need to scale beyond those limits, then 2500 series controller should suit your needs.
In addition, it supports 802.11N, Clean Air, and Mesh AP along with other features. The following AP’s are supported with the 2500 series:
You mentioned that you occupy a 55k square foot building with 3 floors and outdoor space of 45k. I’d recommend you do a site survey to determine your needs to get an idea of how many AP’s is needed, placement location, antenna type, coverage area, power consideration, wiring requirements, and extra capacity if needed.
The goal of the site survey should be high availability, scalability, manageability, and interoperability. In WCS, you can use the planning mode option from WCS --> Monitor Maps --> System Campus --> Building --> Floor --> From select command chooses “Planning Mode”. Use the generate proposal option and this will detail the amount of AP’s needed based on the location and size.
More info can be found here to use this feature:
http://www.cisco.com/en/US/docs/wireless/wcs/7.0MR1/configuration/guide/maps.html#wp1179446
This is assuming you have WCS installed and configured to manage your wireless network environment.
06-09-2011 11:26 AM
Hello,
What is the best way to 'decode' the meaning of debug messages on controllers when troubleshooting client connection issues? I have seem multiple messages and I was looking for some kind of documentation/guide that goes into more detail.
Here are some examples:
- APF-4-ASSOCREQ_PROC_FAILED: Failed to process an association request from0. WLAN:3, SSID: mobile in database timed out.
-DOT1X-3-MAX_EAPOL_KEY_RETRANS: Max EAPOL-key M5 retransmissions exceeded for client
-APF-4-REGISTER_IPADD_ON_MSCB_FAILED: Could not Register IP Add on MSCB. MSCB still in init state. Address
- usmdb_registry.c:140 USMDB-6-MSGTAG007: Error on call to sysapiRegistryGet routine with keyUDI_PID.
-RUN (20) State Update from Mobility-Complete to Mobility-Incomplete
-apfMsExpireCallback (apf_ms.c:433) Expiring Mobile!
-Received EAPOL-key in REKEYNEGOTIATING state (message 6) from mobile
-%APF-3-ASSOCREQ: apf_utils.c:1033 0.0.0.0 START (0) Rejecting association attempt - privacy bit set on WLAN not requiring security
- %DOT1X-3-INVALID_WPA_KEY_MSG_STATE: 1x_eapkey.c:708 Received invalid EAPOL-key M2 msg in START state - invalid secure bit; len 24, key type 1, client
Thanks! Ana
06-09-2011 03:58 PM
@Ana,
Here is some docs for debug and show commands and understanding debugs on the WLC:
Understanding Debug Client on WLC:
http://www.cisco.com/en/US/products/hw/wireless/ps430/products_tech_note09186a008091b08b.shtml
WLC Debug and Show Commands:
http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080b3e118.shtml
Use the Bug Toolkit to decode the errors to see if existing bugs are impacting the WLC:
http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs
Copy the error messages and paste it into the keyword search.
06-09-2011 12:25 PM
I have a WCS and (2) 4404-100 controllers with 131 1252 APs. I am going to convert to (2) 5508 controllers and add 125 3502 APs as well as the MSE. I want to know if I can back up ther configs from the 4404 controllers and restore them to the 5508 controllers or do I ahve to configure the 5508 controllers from the ground up.
06-09-2011 06:32 PM
@ evarmer, Thanks for the great questions. The steps below will outline how to backup and restore your AP, controllers, and MSE configuration using the WCS 7.0.x.x or later. Note when backing up the WLC, it will take care of saving your AP configuration for you so no additional steps are needed unless you have custom AP templates.
Backup Configuration from Controller
You have two options to backup the configuration from the WLC to WCS.
Option 1: WCS → Configure → Controller → Select IP address of controller and from the select command menu, choose “refresh config from menu” and go. You will be presented with two options, one that ask to retain configuration in the WCS database or use the configuration on the controller currently. Most likely the second option is what you want when backing up.
Option 2: Choose Administration > Background Tasks, then click Controller Configuration Backup to access this page.
From the Administration > Background Tasks page, you can execute, enable, or disable this task. To execute, enable, or disable this task from the Administration > Background Tasks page, follow these steps:
Restore Configuration to Controller
Backing Up Mobility Services Engine Historical Data
To back up mobility services engine data, follow these steps:
Restoring Mobility Services Engine Historical Data
To restore a file back into the mobility service, follow these steps:
When restoration is completed, WCS displays a message to that effect.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide