About WLC 4402 LDAP client authentication

Similar Questions

• Cisco VCS and LDAP for authentication of users

  I have a question about setting up LDAP for authentication of the user on the VCS. I want to have redundancy in my LDAP link. I believe that this is possible by setting a FULL domain name to the address of the LDAP server, then selecting a type of SRV resolution. What I'm not clear on is what the value for the server address would be if I used actually as SRV type of resolution. I should also add that I am looking to use TLS

  To clarify, if my AD domain name is myad.netcraftsmen.net. I have set the field as server address:

  myad.netcraftsmen.NET: assuming that VCS properly interrogate the DNS for the _service._proto correct parameters?

  or would I need to create an SRV record to that effect and set the field server address with the address (including the fields of _service._proto)

  or I need to specify one of the SRV records formats used by MS AD areas (there are several).

  If the latter, then what SRV record for TLS. I don't see records with port 389 (non-secure).

  My intuition tells me that this is probably the first option, but I could be far away.

  Anyway, thanks in advance for any input.

  Kind regards

  Bill

  Hi William,.

  I just checked it on a X6.1 VCS, and it seems that VCS searches SRV _ldap._tcp.domain (where 'domain' has been entered as the server address), both when the encryption is set to 'None' and 'TLS '.

  Hope this helps,

  Andreas

• WLC 4402 impossible to authenticate correctly with ACS 5.2

  For some reason, I can't WLC to authenticate correctly with ACS 5.2. It's very strange in the sense that when I checked the log. ACS authenticates and authorizes the WLC 4402, but I can't log on the WLC. login screen appears, if I typed the username that he jumped

  Controller of >

  user:

  password:

  No matter what I typed (internal or external users), nothing seems to work.

  It comes to my frustration, I have no problem with authentication of routers and switches except WLC 4402.

  Hello

  Please delete privilege on the ACS level settings.

  Elements of strategy > authorization and permissions > peripheral Administration > Shell profiles > common tasks

  By default the privilege - do not use.

  Maximum privilege - not in use

  I hope this helps.

  Kind regards

  Anisha

  P.S.: Please mark this thread as answered if you feel that your query is resolved. Note the useful messages

• Management user for WLC via LDAP Possible?

  Hi guys, just like the title suggests

  Correct me if wrong Im:

  The two GANYMEDE + and RADIUS can be used to access right management WLC?
  Well how about you for LDAP? (In fact my answer to this is 'not possible', but I just want you to)

  so is LDAP for managing the access to WLC supported?

  If you look at the options when adding a RADIUS or radius server on a WLC is a checkbox for managing it to the admins to log on to each server radius or Ganymede, it has no option to do this with LDAP. When an administrator connects to a WLC using radius or Ganymede wil server sends a specific response saying that the admin can do (read only, read/write), LDAP does not as far as I know do that.

  Hope this helps

• Windows XP Home Edition on WLC 4402

  Hello

  I have a WLC 4402 Wireless LAN Controller with several 1231 AP on LWAPP. WLAN security setting a WPA + WPA2 with PSK share key. All computers in the domain are fine, wireless connections are stable. I have a group of students use Netbook under Windows XP Home SP3 got connection and drop situation. On XP event IDS has continuous case 4201 and 4202 and journal WLC I also continuous newspaper in the form

  * Apr 19 10:35:44.046: % DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:407 Max EAPOL - Key M1 broadcasts exceeded for client 00:26:5e:eb:fd:0 has

  I understand that XP Home has no certificate of domain environment so I didn't install any server AAA service. How can this problem be solved? Keep trying on the combination of security, but no luck. Help, please. Thank you.

  Attachment is WLC configuration file without encryption.

  Bill,

  Is it chance ASUS EeePC Netbook 1005 HA?

  If so, check the drivers.

• HOWTO to Setup wpa2 + aes + psk with mac-filter WLC 4402 (RADIUS)

  Hello

  I'm trying to Setup wpa2 + aes + psk with mac-filter (RADIUS) on WLC 4402 (6.0.182), with Lap - 1142

  on security, the value L2 security wpa + wpa2 and make sure MAC filtering

  Uncheck the WPA

  check the WPA2, AES, TKIP to unckeck

  Mgmt PSK auth key

  PSK ASCII marker

  L3 no

  Uncheck the political web

  AAA servers

  Select enable accounting radius server server

  It's work fine, when I use WEP with mac-filter (radius)

  but when I select WPA2 is it fail and no newspaper both WLC server and RADIUS

  Is this limitation or bug...

  Thanks in advance for your help

  This sounds like it should work.  Maybe your client likes not wpa2/aes or does not match the PSK.  I would try to associate with this same configuration, but without enabled mac filtering to try to identify the problem.

  -John

• SSL VPN client authentication

  Currently our ASA is configured to use LDAP for authentication of VPN clients.  I have read several books that show how to set the ASA to LDAP, RADIUS and LOCAL authentication.  I want to make use of LDAP and LOCAL authentication.  So that if a client connects, it would check for local authentication before check LDAP.  Has anyone successful cela and could share an example config?

  Thank you!

  Looks like double authentication is not what you are looking for.  Based on the above condition, you will be better of setting up a tunnel for your closed user group that uses local authentication exclusively.  You can then present the user with a drop-down menu on the auth portal where they choose their desired tunnel group.  You can also configure the group URL to direct users to the correct tunnel group.  For example, you might have https://vpn.vpn.com/employee and https://vpn.vpn.com/vendor where it used TG uses LDAP and the TG seller will use local auth.

• problem with the guest in WLC 4402 account

  I created a single guest in WLC 4402 version 4.2 account and distribute to every visitor that comes in our society. However, when we receive a lot of visitors, the WLC end authenticate. Anyone know if there is a limit using a guest account?

  Properly refuse authentication? Or the page of connection stop appearing or something?

  There was a bug with the webauth die under a heavy load, regardless of the number of accounts used the same.

  A good way for you to check, if problem, would be to create a second user backup comments and see if that has started to work. If not, the account is not the problem.

  I'm not aware of any use of the same account maximum.

  4.2 what exactly are you running?

• WLC 4402 is rejection of applications for converted LWAPP 1131 AG AP

  WLC does not show the AP.

  WLC 4402 is configured using lwapp-L3. Management interface is in vlan 20 and interface ap - manager is in vlan 100. AP is in vlan 50. AP is getting dhcp ip. option 43 and 60 have been configured.

  debugging shows

  activate the debug lwapp events on WLC

  (Cisco Controller) > Fri 25 Jul 20:51:57 2008: received 00:19:55:5f:cb:52 LWAPP DISCOVERY REQUEST of AP 00:19:55:5f:cb:52 to c 00:1f:9e:9 b: 8:03 on port "1"

  Fri Jul 25 20:51:57 2008: throw L3 Mode LWAPP DISCOVERY REQUEST on intf '1', vlan = "100", management vlan = "20".

  debugging access point

  debug events customer lwapp

  1 00:58:16.716: LWAPP_CLIENT_EVENT: spamHandleDiscoveryTimer: could not find any MWAR

  1 00:58:16.716: LWAPP_CLIENT_EVENT: spamResolveStaticGateway - bridge found

  Debug ip udp

  1 00:58:16.716: UDP: sent src = 172.16.50.151 (64693), dst = 172.16.100.100 (12223), length = 69

  Can correct a pl guide where can I do wrong?

  Try to put the AP Manager interface in the same vlan as the management interface. Also look at the date and time on the controller to ensure that the certificates are validated correctly on the APs.

• WLC 4402

  I have a WLC 4402 and reading it says that it can handle 12, 25 or 50 AP how do I know how my camera will actually controll?

  On the page of monitor in the user interface at the top to right above the picture of the controller, you will see the number of supported access points. (at least in 4.2.207.0 anyway). Or you can do a 'show sysinfo' of the CLI.

  -John

• Problem AP1522 with WLC 4402

  Hello

  I have a problem installing a 1522 AP to the WLC 4402, it is not recognized, what can be? Check all connections and all is well

  thank me for help

  For MESH AP, you need to add the mac address of the MAC filter on the Security tab.  To RAP, you can use the mac ethernet, a map layer, you must use the mac of 5 GHz radio

• How to add additional capacity for WLC-4402-12-K9-V02

  Hello

  End-user has a WLC-4402-12-K9-V02 with 8 towers is currently working, in short time will need to add more towers that will be more than 12.

  How we can increase capacity to support 25 laps.

  concerning

  Hello

  The WLC we currently supports maximum 12 APs, if you want to support more then to buy a WLC that supports several APs...

  http://www.Cisco.com/en/us/prod/collateral/wireless/ps6302/ps8322/ps6307/product_data_sheet0900aecd802570b0_ps6366_Products_Data_Sheet.html

  Let me know if this answers your question!

  Concerning

  Surendra

• Cisco AIR-LAP1041N-E-K9 does not not with WLC 4402 version 7.0.116.0

  Hi all

  appreciate your support for a problem I started to deal with today. I have a Cisco WLC 4402 running the 7.0.116.0 version and it's great to work with 25 Cisco 1252 access points. We received a new 20 Cisco 1041N APs today and I installed one in our site, but it does not work. He well worked and loaded the flash image and obtained WLC ip through DHCP option address and began to show the below error:

  * 00:00:10.021 Mar 1: % SOAP_FIPS-2-SELF_TEST_IOS_SUCCESS: crypto IOS FIPS self-test passed

  * 00:00:10.033 Mar 1: * CRASH_LOG = YES

  * 00:00:10.333 Mar 1: 1 Port is not presentSecurity base.

  MAC Ethernet address of base: C8:9 C: 1 D: 53:57:5E

  * 00:00:11.373 Mar 1: % SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: crypto RADIO FIPS self-test passed on Dot11Radio interface 0

  * 00:00:11.465 Mar 1: % LWAPP-3-CLIENTEVENTLOG: reading and initialized AP event log (contains, 1088 messages)

  * 00:00:11.494 Mar 1: State of the voice_diag_test of WLC is false

  * 00:00:12.526 Mar 1: % LINK-3-UPDOWN: Interface GigabitEthernet0, changed State to

  * 00:00:13.594 Mar 1: % LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed State to

  * 00:00:13.647 Mar 1: % SYS-5-RESTART: System restarted.

  Cisco IOS software, software C1040 (C1140-K9W8-M), Version 12.4 (23 c) JA2, VERSION of the SOFTWARE (fc3)

  Technical support: http://www.cisco.com/techsupport

  Copyright (c) 1986-2011 by Cisco Systems, Inc.

  Updated Thursday, April 13, 11 12:50 by prod_rel_team

  * 00:00:13.647 Mar 1: % SNMP-5-start COLD: SNMP agent on host APc89c.1d53.575e knows a cold start

  * 00:08:59.062 Mar 1: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 1 Mar 00:08:59.062: bsnInitRcbSlot: slot 1 has NO radio

  * 00:08:59.138 Mar 1: % LINK-5-CHANGED: Interface Dot11Radio0, changed State to reset

  * 00:08:59.837 Mar 1: % SSH-5-ACTIVATED: SSH 2.0 has been activated

  * 00:09:00.145 Mar 1: % LINEPROTO-5-UPDOWN: Line protocol on the Interface Dot11Radio0, state change downstairs

  * 00:09:09.136 Mar 1: % ADDRESS_ASSIGN-6-DHCP: Interface GigabitEthernet0 assigned address DHCP 172.16.26.81, mask 255.255.255.0, hostname APc89c.1d53.575e

  * 00:09:17.912 Mar 1: % PARSER-4-BADCFG: unexpected end of the configuration file.

  * 00:09:17.912 Mar 1: State of the voice_diag_test of WLC is false

  * 00:09:17.984 Mar 1: message logging LWAPP to 255.255.255.255.

  * 00:09:19.865 Mar 1: % CDP_PD-4-POWER_OK: full power - supply NEGOTIATED online

  * 00:09:19.886 Mar 1: % LINK-3-UPDOWN: Interface Dot11Radio0, changed State to

  * 00:09:20.873 Mar 1: % LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed State to

  * 00:09:20.874 Mar 1: % SYS-6-LOGGINGHOST_STARTSTOP: logging to host started 255.255.255.255 - initiated CLI

  Translate "CISCO-CAPWAP - CONTROLLER.atheertele.com"... the domain server (172.16.40.240)

  * 00:09:29.029 Mar 1: % CAPWAP-5-DHCP_OPTION_43: the 172.16.100.102 drive address obtained by DHCP

  * 08:27:02.000 may 25: % CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 172.16.100.101 peer_port: 5246

  * 08:27:02.001 may 25: % CAPWAP-5-CHANGED: CAPWAP changed State to

  * 08:27:03.175 may 25: % CAPWAP-5-DTLSREQSUCC: DTLS connection created successfully peer_ip: 172.16.100.101 peer_port: 5246

  * 08:27:03.177 may 25: % CAPWAP-5-SENDJOIN: send request to join 172.16.100.101

  * 08:27:03.177 may 25: % CAPWAP-5-CHANGED: CAPWAP changed State to ADHERE

  * 08:27:03.329 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state CFG

  * 08:27:03.333 may 25: % DTLS-5-ALERT: WARNING received: close notify alert from 172.16.100.101

  * 25 May 08:27:03.333: % PEER_DISCONNECT-5-DTLS: Peer 172.16.100.101 has closed the connection.

  * 08:27:03.333 may 25: % DTLS-5-SEND_ALERT: send FATAL: close notify alert at 172.16.100.101:5246

  * 08:27:03.378 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 08:27:03.378 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 25 May 08:27:03.378: bsnInitRcbSlot: slot 1 has NO radio

  * 25 May 08:27:03.448: State of the voice_diag_test of WLC is false

  * 08:27:14.000 may 25: % CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 172.16.100.101 peer_port: 5246

  * 08:27:14.001 may 25: % CAPWAP-5-CHANGED: CAPWAP changed State to

  * 08:27:15.185 may 25: % CAPWAP-5-DTLSREQSUCC: DTLS connection created successfully peer_ip: 172.16.100.101 peer_port: 5246

  * 08:27:15.186 may 25: % CAPWAP-5-SENDJOIN: send request to join 172.16.100.101

  * 08:27:15.186 may 25: % CAPWAP-5-CHANGED: CAPWAP changed State to ADHERE

  * 08:27:15.330 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state CFG

  * 08:27:15.333 may 25: % DTLS-5-ALERT: WARNING received: close notify alert from 172.16.100.101

  * 25 May 08:27:15.334: % PEER_DISCONNECT-5-DTLS: Peer 172.16.100.101 has closed the connection.

  * 08:27:15.334 may 25: % DTLS-5-SEND_ALERT: send FATAL: close notify alert at 172.16.100.101:5246

  * 08:27:15.379 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 08:27:15.379 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 25 May 08:27:15.379: bsnInitRcbSlot: slot 1 has NO radio

  * 25 May 08:27:15.450: State of the voice_diag_test of WLC is false

  * 08:27:26.000 may 25: % CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 172.16.100.101 peer_port: 5246

  * 08:27:26.001 may 25: % CAPWAP-5-CHANGED: CAPWAP changed State to

  * 08:27:27.182 may 25: % CAPWAP-5-DTLSREQSUCC: DTLS connection created successfully peer_ip: 172.16.100.101 peer_port: 5246

  * 08:27:27.183 may 25: % CAPWAP-5-SENDJOIN: send request to join 172.16.100.101

  * 08:27:27.184 may 25: % CAPWAP-5-CHANGED: CAPWAP changed State to ADHERE

  * 08:27:27.329 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state CFG

  * 08:27:27.333 may 25: % DTLS-5-ALERT: WARNING received: close notify alert from 172.16.100.101

  * 25 May 08:27:27.333: % PEER_DISCONNECT-5-DTLS: Peer 172.16.100.101 has closed the connection.

  * 08:27:27.333 may 25: % DTLS-5-SEND_ALERT: send FATAL: close notify alert at 172.16.100.101:5246

  * 08:27:27.377 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 08:27:27.377 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 25 May 08:27:27.377: bsnInitRcbSlot: slot 1 has NO radio

  * 08:27:27.433 may 25: % LINK-5-CHANGED: Interface Dot11Radio0, changed state down administratively

  * 08:27:27.446 may 25: % PARSER-4-BADCFG: unexpected end of the configuration file.

  * 25 May 08:27:27.447: State of the voice_diag_test of WLC is false

  * 08:27:27.448 may 25: % LINK-3-UPDOWN: Interface Dot11Radio0, changed State to

  * 08:27:27.456 may 25: % LINK-5-CHANGED: Interface Dot11Radio0, changed State to reset

  * 08:27:38.000 may 25: % CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 172.16.100.101 peer_port: 5246

  * 08:27:38.001 may 25: % CAPWAP-5-CHANGED: CAPWAP changed State to

  * 08:27:39.183 may 25: % CAPWAP-5-DTLSREQSUCC: DTLS connection created successfully peer_ip: 172.16.100.101 peer_port: 5246

  * 08:27:39.184 may 25: % CAPWAP-5-SENDJOIN: send request to join 172.16.100.101

  * 08:27:39.184 may 25: % CAPWAP-5-CHANGED: CAPWAP changed State to ADHERE

  * 08:27:39.326 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state CFG

  * 08:27:39.329 may 25: % DTLS-5-ALERT: WARNING received: close notify alert from 172.16.100.101

  * 25 May 08:27:39.329: % PEER_DISCONNECT-5-DTLS: Peer 172.16.100.101 has closed the connection.

  * 08:27:39.330 may 25: % DTLS-5-SEND_ALERT: send FATAL: close notify alert at 172.16.100.101:5246

  * 08:27:39.375 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 08:27:39.375 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 25 May 08:27:39.375: bsnInitRcbSlot: slot 1 has NO radio

  * 25 May 08:27:39.446: State of the voice_diag_test of WLC is false

  * 08:27:49.000 may 25: % CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 172.16.100.101 peer_port: 5246

  * 08:27:49.001 may 25: % CAPWAP-5-CHANGED: CAPWAP changed State to

  * 08:27:50.179 may 25: % CAPWAP-5-DTLSREQSUCC: DTLS connection created successfully peer_ip: 172.16.100.101 peer_port: 5246

  * 08:27:50.180 may 25: % CAPWAP-5-SENDJOIN: send request to join 172.16.100.101

  * 08:27:50.180 may 25: % CAPWAP-5-CHANGED: CAPWAP changed State to ADHERE

  * 08:27:50.323 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state CFG

  * 08:27:50.326 may 25: % DTLS-5-ALERT: WARNING received: close notify alert from 172.16.100.101

  * 25 May 08:27:50.326: % PEER_DISCONNECT-5-DTLS: Peer 172.16.100.101 has closed the connection.

  * 08:27:50.326 may 25: % DTLS-5-SEND_ALERT: send FATAL: close notify alert at 172.16.100.101:5246

  * 08:27:50.370 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 08:27:50.370 may 25: % CAPWAP-5-CHANGED: CAPWAP changed state of DISCOVERY

  * 25 May 08:27:50.370: bsnInitRcbSlot: slot 1 has NO radio

  * 08:27:50.425 may 25: % LINK-5-CHANGED: Interface Dot11Radio0, changed state down administratively

  * 08:27:50.438 may 25: % PARSER-4-BADCFG: unexpected end of the configuration file.

  I searched the difference in regulatory areas between AIR-LAP1041N -E- K9 and AIR-LAP1041N -A- K9 and no difference was found which may affect the operation of this access point.
  to cite our WLC configuration for regulatory areas is:
  Country set AR codes

   

  Area of regulation 802. 11A:-A

  802.11bg:-a

  My question is should I just include my country in the WLC (IQ) add the field of requlatry (-E) to solve this problem? or change the country will affect the operation of all APs workers?

  Appreciate your kind support,

  Patrick Q.

  Try adding a European country to your regulatory domain.

• LDAP - conditional authentication

  Hi all
  I wanted to implement LDAP authentication to my request.
  I am quite new to LDAP for authentication type

  Condition is:
  1. in the user interface, an additional element (element of the selection list) must be added to the login page (say P101_ID)
  for example: the item values
  ID a.EMP
  b.app id
  2. based on the value selected in the element, the authentication must be done.

  For each value of the element, there is another unique string Name (DN)
  for example: id %LDAP_USER%@empid.test.local---emp
  ID %LDAP_USER%@AppID.local---App

  If I use it with a single string DN, it works well.

  But my question is, how to make conditional based on a value of element from the login page.
  That is to say, if the user selects IDs of PMC in P101_ID, then %LDAP_USER%@empid.test.local should be run.
  If the user selects the application id in P101_ID, then %LDAP_USER%@appid.local must be run.

  Is it possible to do this?

  Hope I am fairly clear in my question

  Pls help me...

  Thanks in advance

  Hi Kanishkaa,

  instead of '% LDAP_USER %', you must use the: USERNAME variable. Your code also use double quotes that are not valid and I think that you pasted by mistake '% LDAP_USER%@extra.dna.local' in back channels. The code block should be a function body, not a top-level function object. I would use like this:

  return apex_escape.ldap_dn(:USERNAME)||
      '@'||
      case :P101_ID
      when 'empid' then 'empid.test.local'
      else 'appid.local'
      end;
  

  Kind regards

  Christian

• 4.0.1 4.1.1 - LDAP Directory authentication scheme fails

  Using out of the box of LDAP Directory authentication scheme that has worked well in v. 4.0.1 fails to v. 4.1.1. User authentication fails with "Invalid Login Credentials". Debugging shows that the user "nobody". Watching v 4.0.1 user shows "Admin". In addition, the "test LDAP connection" is no longer available in 4.1.1 - that's a bummer.
  
  Example 4.1 bug .1:
  4161 426774014496602 person 103 101 50 6 hours ago 0.8562
  
  Example 4.0 bug .1:
  661 3340172823117775 ADMIN 130 101 57 36 seconds ago 0.3298
  
  Anyone know if something has changed with the standard LDAP Directory schema? Or am I missing some configuration?

  Hi Julie: I suspected that maybe the question earlier and actually run PL/SQL anonymous block of doc you referenced to create ACL previously but that it either did not run as user SYS or has not committed or something. In any event, afer re-running as SYS and making sure to commit it, I now see expected line returned after you select in dba_network_acl_privileges. I run apxremov.sql to remove the recent installation of 4.1 for go ahead and execute basic install for 4.1.1 as opposed to the application of the hotfix to upgrade 4.1 in point 4.1.1. ACL entry is deleted as a result of execution of script apxremov.sql... so the block pl/sql to create the ACL entry had to be run again. Thank you, Glenn