Cisco 877W - white SSID

Similar Questions

• PIX IPSec VPN with Cisco 877W

  Hi all

  I am trying to create a VPN between a PIX and a Cisco 877W tunnel but can't seem to get the tunnel. When I do a 'sho crypto session"on the Cisco 877, I get, he said session state is declining, then changed to NEGOTIATE DOWN, but it is now down again... Please find attached the configs for both ends... Are there commands to confirm that the tunnel is up other than to try to ping the remote end? I would greatly appreciate any help lift this tunnel.

  Kind regards

  REDA

  Hello

  Based on the configurations of joined, to do some changes. For example:

  1. the isakmp policies do not match on the router and the pix. Make sure the hash group Diffie-Hellman and life correspond on the 877 and pix.

  2. the access list for the ipsec traffic must be images of mirror of the other.

  3. make sure life of ipsec on the two peers.

  I hope it helps.

  Kind regards

  Arul

  Rate if this can help.

• Cisco 877W DHCP does not automatically fill the Windows/Mac customers with DNS server entries

  I have a 877W which was operational on Verizon for about 5 years. It never automatically distributed info DNS server for customers who get DHCP issued IP address. I have to manually enter the DNS entries to each client.  What happened to other sites where I've got installed on AT & T as well as 877 unified communications.

  Here is the config. Thanks in advance for the help.

  Building configuration...

  Current configuration: 7987 bytes
  !
  version 12.4
  no service button
  tcp KeepAlive-component snap-in service
  a tcp-KeepAlive-quick service
  horodateurs service debug datetime localtime show-timezone msec
  Log service timestamps datetime localtime show-timezone msec
  encryption password service
  sequence numbers service
  !
  Cod of hostname
  !
  boot-start-marker
  boot-end-marker
  !
  logging buffered debugging 51200
  recording console critical
  enable secret 5 jSwA $1$ $ 3B5lJNqm0ewh
  !
  AAA new-model
  !
  !
  AAA authentication local-to-remote login
  local remote of the AAA authorization network
  !
  AAA - the id of the joint session
  !
  resources policy
  !
  PCTime-6 timezone clock
  PCTime of summer time clock day April 6, 2003 02:00 October 26, 2003 02:00
  IP subnet zero
  IP cef
  No dhcp use connected vrf ip
  DHCP excluded-address IP 192.168.7.1 192.168.7.19
  DHCP excluded-address IP 192.168.7.70 192.168.7.254
  !
  IP dhcp pool sdm-pool1
  import all
  network 192.168.7.0 255.255.255.0
  router by default - 192.168.7.1
  DNS-server 68.238.96.12 68.238.112.12
  !
  !
  inspect the IP name DEFAULT100 cuseeme
  inspect the IP name DEFAULT100 ftp
  inspect the IP h323 DEFAULT100 name
  inspect the IP icmp DEFAULT100 name
  inspect the IP name DEFAULT100 netshow
  inspect the IP rcmd DEFAULT100 name
  inspect the IP name DEFAULT100 realaudio
  inspect the name DEFAULT100 rtsp IP
  inspect the IP name DEFAULT100 esmtp
  inspect the IP name DEFAULT100 sqlnet
  inspect the name DEFAULT100 streamworks IP
  inspect the name DEFAULT100 tftp IP
  inspect the tcp IP DEFAULT100 name
  inspect the IP udp DEFAULT100 name
  inspect the name DEFAULT100 vdolive IP
  synwait-time of tcp IP 10
  IP domain name cods.com
  name of the IP-server 68.238.96.12
  name of the IP-server 68.238.112.12
  property intellectual ssh time 60
  property intellectual ssh authentication-2 retries
  !
  !
  Crypto pki trustpoint TP-self-signed-437228204
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 437228204
  revocation checking no
  rsakeypair TP-self-signed-437228204
  !
  !
  TP-self-signed-437228204 crypto pki certificate chain
  certificate self-signed 01
  30820254 308201BD A0030201 02992101 300 D 0609 2A 864886 F70D0101 04050030
  2 060355 04031325 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 30312E30
  69666963 34333732 32383230 34301E17 303731 30313632 33333131 0D 6174652D
  395A170D 2E302C06 1325494F 03550403 32303031 30313030 30303030 5A 303031
  532D 5365 6C662D53 69676E65 4365 72746966 69636174 652 3433 37323238 642D
  06092A 86 4886F70D 01010105 32303430 819F300D 00308189 02818100 0003818D
  BF73E16C 24A3FB0B A44C83C8 45ACEC75 163C2F0A 87836F7F A43FEB72 0EF26AFA
  C7F35ED6 CBCC6853 5E82B0A6 1FD8020B F3630023 AB30B870 B3155EE6 86988910
  4ACF5121 1CBFF4DC B705DF1E 5D0D698F 06493 D 3DD8D036 42 FE450D21 E26A4DAF
  CE6BA806 81A9F451 0246698E DA7B49E3 160F115C E1104FA9 31FA3C15 CD 782 279
  02030100 01A37E30 7C300F06 03551 D 13 0101FF04 05300301 01FF3029 0603551D
  20821E63 11042230 6F64732E 6F666472 63697479 6E677370 69707069 72696E67
  732E636F 6D301F06 23 04183016 24 D 77493 80142FA3 03551D 52CF7094 B847B6EB
  1385E2E5 0F3A301D 0603551D 0E041604 142FA324 D7749352 CF7094B8 47B6EB13
  85E2E50F 3A300D06 092 HAS 8648 01040500 03818100 076EE499 12F46D79 86F70D01
  375B7EA6 C9279DA4 B32723B5 908C9FB8 D42CB978 BB24A8FE 73579A3D CA 5130, 87
  B7716644 7E13710D C6E6360C D0A36F7B F62540E2 0C33523B E50396B9 2EF66FA7
  56519E62 E55EAF3C E1D9BEC9 3AE67B59 75E61F06 B649E90A 2798F755 7A020F0A
  F8BDABFA 1EE37B6A A918560D DA45AD70 801BC66E 94D1468E
  quit smoking
  username privilege 15 secret $5 1jgO$sGD@#l4yTtLtYoEZbh/Wl steal551.
  !
  !
  door-key crypto vpn_ddaus
  pre-shared key address 0.0.0.0 0.0.0.0 - key stealthfortyfor5
  door-key crypto vpn_rmlfk
  address of pre-shared-key 205.30.134.22 key stealthfortyfor5
  !
  crypto ISAKMP policy 10
  md5 hash
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 30
  BA 3des
  preshared authentication
  Group 2
  invalid-spi-recovery crypto ISAKMP
  ISAKMP crypto keepalive 20
  !
  Configuration group isakmp crypto VPNRemote client
  key ConnectNow45
  pool ippool
  ISAKMP crypto vpnclient profile
  VPNRemote identity group match
  client authentication list for / remote
  Remote ISAKMP authorization list
  client configuration address respond
  Crypto isakmp CODS_DDAUS profile
  key ring vpn_ddaus
  function identity address 0.0.0.0
  Crypto isakmp CODS_RMLFK profile
  key ring vpn_rmlfk
  function identity address 205.30.134.22 255.255.255.255
  !
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
  !
  Crypto-map dynamic dynmap 10
  Set transform-set RIGHT
  vpnclient Set isakmp-profile
  Crypto-map dynamic dynmap 12
  Set transform-set RIGHT
  CODS_DDAUS Set isakmp-profile
  !
  !
  MYmap 1 ipsec-isakmp crypto map
  defined by peer 205.30.134.22
  Set transform-set RIGHT
  CODS_RMLFK Set isakmp-profile
  match address CODS_to_RMFLK
  map mymap 65535-isakmp ipsec crypto dynamic dynmap
  !
  Bridge IRB
  !
  !
  interface Loopback10
  IP 1.1.1.1 255.255.255.0
  !
  ATM0 interface
  no ip address
  route IP cache flow
  No atm ilmi-keepalive
  DSL-automatic operation mode
  !
  point-to-point interface ATM0.1
  Description $FW_OUTSIDE$ $ES_WAN$
  Check IP unicast reverse path
  inspect the DEFAULT100 over IP
  NAT outside IP
  IP virtual-reassembly
  PVC 0/35
  aal5snap encapsulation
  !
  Bridge-Group 2
  !
  interface FastEthernet0
  !
  interface FastEthernet1
  !
  interface FastEthernet2
  !
  interface FastEthernet3
  !
  interface Dot11Radio0
  no ip address
  no ip-cache cef route
  no ip route cache
  !
  encryption vlan 1 tkip encryption mode
  !
  SSID tsunami
  VLAN 1
  open authentication
  authentication wpa key management
  Comments-mode
  WPA - psk ascii 7 14231A0E01053324363F363B36150E050B08585E
  !
  base speed - 1.0 2.0 basic basic-5, 5 6.0 9.0 basic-11, 0 12.0 18.0 24.0 36.0 48.0 54.0
  root of station-role
  !
  interface Dot11Radio0.1
  encapsulation dot1Q 1 native
  no ip route cache
  no link-status of snmp trap
  No cdp enable
  Bridge-Group 1
  Bridge-group subscriber-loop-control 1
  Bridge-Group 1 covering-disabled people
  Bridge-Group 1 block-unknown-source
  No source of bridge-Group 1-learning
  unicast bridge-Group 1-floods
  !
  interface Vlan1
  Description $ETH - SW - LAUNCH, INTF-INFO-HWIC $$ $4ESW $FW_INSIDE$
  no ip address
  IP tcp adjust-mss 1452
  Bridge-Group 1
  !
  interface BVI1
  Description $ES_LAN$ $FW_INSIDE$
  192.168.7.1 IP address 255.255.255.0
  IP nat inside
  IP virtual-reassembly
  route IP cache flow
  IP tcp adjust-mss 1412
  !
  interface control2
  IP 70.14.49.134 255.255.255.0
  NAT outside IP
  IP virtual-reassembly
  crypto mymap map
  !
  local pool IP 10.10.10.1 ippool 10.10.10.254
  IP classless
  IP route 0.0.0.0 0.0.0.0 70.14.49.1
  !
  IP http server
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  overload of IP nat inside source list 133 interface control2
  !
  CODS_to_RMFLK extended IP access list
  IP 192.168.7.0 allow 0.0.0.255 192.168.1.0 0.0.0.255
  !
  recording of debug trap
  access-list 1 permit 192.168.7.0 0.0.0.255
  access-list 100 remark self-generated by the configuration of the firewall Cisco SDM Express
  Access-list 100 = 1 SDM_ACL category note
  access-list 100 deny ip 70.14.49.0 0.0.0.255 any
  access-list 100 deny ip 255.255.255.255 host everything
  access-list 100 deny ip 127.0.0.0 0.255.255.255 everything
  access ip-list 100 permit a whole
  access-list 101 permit ip 192.168.7.0 0.0.0.255 192.168.3.0 0.0.0.255
  access-list 133 deny ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255
  access-list 133 deny ip 192.168.7.0 0.0.0.255 10.10.10.0 0.0.0.255
  access-list 133 deny ip 192.168.7.0 0.0.0.255 192.168.10.0 0.0.0.255
  access-list 133 deny ip 192.168.7.0 0.0.0.255 192.168.3.0 0.0.0.255
  access-list 133 allow ip 192.168.7.0 0.0.0.255 any
  not run cdp
  mymap permit 10 route map
  corresponds to the IP 111
  set ip next-hop 1.1.1.2
  !
  !
  control plan
  !
  Bridge Protocol ieee 1
  1 channel ip bridge
  Bridge Protocol ieee 2
  IP road bridge 2
  connection of the banner ^ CAuthorized access only!
  Unplug IMMEDIATELY if you are not an authorized user. ^ C
  !
  Line con 0
  no activation of the modem
  telnet output transport
  line to 0
  telnet output transport
  line vty 0 4
  privilege level 15
  transport input telnet ssh
  !
  max-task-time 5000 Planner
  Scheduler allocate 4000 1000
  Scheduler interval 500
  end

  Hello

  Can you try to remove the IMPORT ALL of the dhcp pool

  RES
  Paul

  Sent by Cisco Support technique iPad App

• Cisco 877W router + wireless WPA

  Hi all.

  I configured the part my 877W router wireless. Right now I use WEP only, but I want to configure WPA (with shared key before) for more secure access. I'm a noob with wireless and I don't have much knowledge about this configuration process / options.

  Please can someone me the correct procedure to configure a work of authenticated with a simple key WPA - PSK WPA Wireless LAN (no beam)?

  I was working with Web interface (option Express Wireless the wireless WEB application security) for setting commands not IOS CLI.

  Thank you very much.

  Set security | encryption | TKIP + AES encryption algorithm

  Set security | SSID Manager | Methods for 'Open' (only)

  Check the 'required' box for key management

  Check the box for WPA

  Enter a key

  As with WEP, keys on the AP and the keys on the clients must match exactly (case, spaces, everything).

  Good luck

  Scott

• Cisco ISE white lists

  Hi all

  I have to switch from monitor for wired devices faster than expected. I have tested/prepared for standard DOT1x computers laptop/desktops etc but not for all the other legacy/s MAB devices still policy. Then I was asked to activate the policies I tested and lower, but mostly the default policy create a tote policy to use a list of all currently known to the network mac address.

  The reason is that it allows to avoid any new unauthorized peripheral access and we will then have time to sort the policies for those currently connected. There is NO cable access comments service (Wireless is not under control of the ISE yet) and there is acceptance that this list may contain currently illegal devices. Here are the questions:

  1. you can export Administration\Identity Management\Identities\Endpoints all the MAC addresses known to ISE. It is a massive list in my case.

  2. I don't see anywhere how to import into the new whitelist other than individually by MAC address. No there is no way to do this?

  3. If I receive on this issue, political ISE can handle a whitelist of several thousands of devices?

  4. we accept that in this interim period, white list management will be a royal pain in the neck!

  Thanks in advance

  Unfortunately I have not any plu ISE 1.3 in production or laboratory. I remember purge of endpoint as we point 1.3 is available in the 1.2 roadmap. But I do not remember this is the version from the hotfix.

  Regarding the importation, joint screenshot for your reference. You have the option to import the settings to a .csv file. Inside the file, one line sets up the endpoint group will be. You weren't looking in the right place, imho.

• The SSID on Cisco WLC support no.

  Hi all

  Can you please help me to provide details on the following Cisco wireless controller?

  1. no support SSID on Cisco WLC

  2. is it possible to limit the SSID on the access point (for example, I have 10 SSID configured on the controller, I want 10 first access points using SSID (SSID 1-5) and rest of the AP SSID 6-10)

  Thank you

  Jamal

  Hi Jamal,.

  Just to add to the great info of Robert (+ 5 points Robert)

  The feature you're looking for is called WLAN substitute in versions 4.x WLC.

  Allowing substitution WLAN

  By default, all defined WLAN transmission on the controller access points. However, you can use WLAN editable to select WLAN is transmitted and who are not on a per access point basis. For example, you can use WLAN to control override goes where in the guest WLAN network or you can use it to disable a specific WLAN in a certain area of the network.

  This doc.

  http://www.Cisco.com/en/us/docs/wireless/controller/4.0/Configuration/Guide/c40wlan.html#wp1114777

  Once you create a new WLAN, WLAN > page edition for the new WLAN. In this page, you can set various parameters specific to this general policy, RADIUS servers, political security WLAN key, and 802.1 x settings.

  * Check Admin status under general strategies to activate the WLAN. If you want AP broadcast the SSID in beacon frames, check the SSID broadcast.

  Note: You can configure up to 16 WLAN on the controller. The Cisco WLAN Solution can control up to sixteen WLAN for Lightweight APs. Each WLAN has an ID separated from WLAN (1 to 16), a WLAN SSID (name of the WLAN) separate and can be assigned to single security policies. Lightweight APs broadcast all Cisco WIFI WLAN SSID Solution assets and apply the policies that you set for each WLAN.

  The good doc.

  http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a0080665d18.shtml#C3

  In versions 5.x, you will use AP groups, because in versions 5.x WLC, WLAN substitute has been replaced by the "Groups of AP" feature;

  Creation of groups access Point

  After all the access points have joined the controller, you can create up to 150 groups of access point and assign up to 16 local wireless networks in each group. Each access point announces that the WLAN enabled that belong to his group of access point. The access point no announcement not disabled WLAN in its access point group or WLAN that belong to another group.

  http://www.Cisco.com/en/us/docs/wireless/controller/5.2/configuration/guide/c52wlan.html#wp1128591

  To learn more about George video AP discover excellent groups

  http://www.my80211.com/Cisco-Labs/2009/3/22/Cisco-AP-group-nugget.html

  I hope this helps!

  Rob

• 877W wireless dhcp configuration

  Hello friends,

  I am facing a problem in trying to configure a cisco 877w wireless function. More precise, I can connect wireless but dhcp assigns IP addresses.

  I did two pools dhcp for wireline (local VLANs 1 - native) and a second for wireless (vlan 20). The first dhcp is the allocation of ownership intellectual customers but the second does not. Here is the output of the configuration.

  Please, for ideas or suggestions?

  dot11 syslog
  !
  dot11 ssid HomeNet
  VLAN 20
  open authentication
  authentication wpa key management
  Comments-mode
  WPA - psk ascii password 0
  !
  IP cef
  No dhcp use connected vrf ip
  DHCP excluded-address 192.168.2.21 IP 192.168.2.254
  DHCP excluded-address IP 192.168.2.1
  DHCP excluded-address IP 192.168.10.1
  !
  dhcp IP local pool
  import all
  network 192.168.0.0 255.255.255.0
  default router 192.168.0.1
  194.219.227.2 DNS server
  !
  IP dhcp pool wifi
  import all
  network 192.168.10.0 255.255.255.0
  194.219.227.2 DNS server
  default router 192.168.10.1
  !
  !
  username privilege 15 secret 5 xxxx $1$ BqfW$ seJaq5e7S0N4J1DWzS74f.
  !
  Archives
  The config log
  hidekeys
  !
  ATM0 interface
  no ip address
  No atm ilmi-keepalive
  DSL-automatic operation mode
  !
  point-to-point interface ATM0.1
  PVC 8/35
  aal5mux encapsulation ppp Dialer
  Dialer pool-member 1
  !
  !
  interface FastEthernet0
  !
  interface FastEthernet1
  !
  interface FastEthernet2
  !
  interface FastEthernet3
  !
  interface Dot11Radio0
  no ip address
  IP nat inside
  IP virtual-reassembly
  No dot11 extensions aironet
  !
  encryption vlan 20 tkip encryption mode
  !
  SSID HomeNet
  !
  base speed - 1.0 2.0 basic basic-5, 5 6.0 9.0 basic-11, 0 12.0 18.0 24.0 36.0 48.0 54.0
  root of station-role
  No cdp enable
  !
  interface Dot11Radio0.1
  Wifi VLAN20 description
  encapsulation dot1Q 20
  IP nat inside
  IP virtual-reassembly
  No cdp enable
  !
  interface Vlan1
  LAN description
  the IP 192.168.0.1 255.255.255.0
  IP nat inside
  IP virtual-reassembly
  route IP cache flow
  !
  interface Vlan20
  Wifi description $ ES_LAN$
  no ip address
  !
  !

  Ok.. It's nice to hear that customers get the IP address! It's average, the main problem is resolved... Let me see the config and help you get access to the internet...

  Let me know if that answers your question...

  Concerning
  Surendra
  ====
  Please do not forget to note positions that answered your question and mark as answer or was useful

• Of diferent ssid

  Hello

  I have two in my WLC and an enterprise wlan and other interfaces for access by the public in parks and squares. I wish that my public aps model 1242, broadcast just my ssid public. Someone knows how to do?

  Thank you

  Hi Rafael,.

  It is no longer possible :) The feature you're looking for is called WLAN substitute :)

  Allowing substitution WLAN

  By default, all defined WLAN transmission on the controller access points. However, you can use WLAN editable to select WLAN is transmitted and who are not on a per access point basis. For example, you can use WLAN to control override goes where in the guest WLAN network or you can use it to disable a specific WLAN in a certain area of the network.

  This doc.

  http://www.Cisco.com/en/us/products/ps6366/products_configuration_guide_chapter09186a008076cbfd.html#wp1114777

  Once you create a new WLAN, WLAN > page edition for the new WLAN. In this page, you can set various parameters specific to this general policy, RADIUS servers, political security WLAN key, and 802.1 x settings.

  * Check Admin status under general strategies to activate the WLAN. If you want AP broadcast the SSID in beacon frames, check the SSID broadcast.

  Note: You can configure up to 16 WLAN on the controller. The Cisco WLAN Solution can control up to sixteen WLAN for Lightweight APs. Each WLAN has an ID separated from WLAN (1 to 16), a WLAN SSID (name of the WLAN) separate and can be assigned to single security policies. Lightweight APs broadcast all Cisco WIFI WLAN SSID Solution assets and apply the policies that you set for each WLAN.

  The good doc.

  http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a0080665d18.shtml#C3

  The more widely to mitigate the problem of having to access each AP individually (when using WLAN substitute) is to use templates for common requirement of AP in this way the WLAN function of WCS substitute can be applied at the level of the model and then eliminated different groups.

  http://www.Cisco.com/en/us/docs/wireless/WCS/4.0/Configuration/Guide/wcstemp.html#wp1072198

  I hope this helps!

  Rob

• Client VPN will travel not connected via 877w

  Hello

  I've implemented a Cisco 877w and it works very well for web access

  Client VPN on my laptop connects via the 877w and authenticates on my remote work ASA5510 firewall.

  Problem is after you connect to the ASA, I can not connect anything internally work network (10.0.0.0/24), ping, etc. RDP is back with no answer.

  I've attached the config, can someone tell me what I am missing, might access a list?

  Thanks for your help

  Chris

  This router is made PAT/NAT, Ipsec blocking.

  Activate Nat on the ASA course remote.

  ISAKMP nat - t or crypto isakmp nat - t

  HTH

  Sangaré

  Pls rate helpful messages

• ACS 5.2 problem Cisco-AV-pair

  Hi all

  I have a problem with the chain of cisco-av-pair on the Cisco ACS and a SSID.

  We have here some SSID and some ad groups. It was no problem with the old Cisco ACS 4.2. I've set up here the chain: cisco-av-pair ssid = myssid. Customers only have the rights to this ssid. It works without problem.

  On the new 5.2 ACS. I have problem to configure this.

  My setup is a new political identity.

  Compound to Condition:

  RADIUS - Cisco--> cisco-av - pair--> is equal to--> myssid

  But this channel doesn't work.

  Do you have any ideas on this problem.

  My system:

  Cisco ACS 5.2 with all new patches

  New Version of Cisco WLC

  Thank you

  concerning

  Andreas

  You could try a condition:

  Called-Station-ID ends - with ": 0FFEN".

• Windows 7 wireless isn't renew IP automatically.

  I am facing the same issue. When windows 7 laptop moves from network A to network B, the computer laptop windows 7 connects to network B, but laptop access point retains the IP address of the network A. Windows 7 isn't release and renew the IP automatically. If I do ipconfig/release and renew, the customer gains new Ip network B.

  I have Intel Centrino Advanced - N 6200 AGN on computer laptop windows 7. The access point is cisco. The SSID is the same and is hidden. I tried to upgrade the driver for the wireless adapter, updated IOS access point, but without success.

  Windows XP does not have this issue, it automatically gets the IP address of the new network. Please help solve this problem.

  We discovered the cause of the problem.  Symantec Endpoint Protection 11 RU6, CC7 or 12.1 solves the problem... Or remove completely :)

• Cannot access internet connected pc

  Hi all

  I will have questions, how to get to the internet from the PC. It is currently connected to the cisco 877w via FE0.

  The PC is able to enter the correct IP address. Even when I entered dns [8.8.8.8], I'm still not able to access the internet.

  Joined the config-

  ================================

  !

  version 12.4

  no service button

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  encryption password service

  !

  router host name

  !

  boot-start-marker

  boot-end-marker

  !

  !

  No aaa new-model

  !

  !

  dot11 syslog

  IP cef

  No dhcp use connected vrf ip

  DHCP excluded-address IP 192.168.1.254

  !

  IP dhcp pool HOME-DHCP

  import all

  network 192.168.1.0 255.255.255.0

  by default-router 192.168.1.254

  Server DNS 8.8.8.8

  !

  !

  no ip bootp Server

  8.8.8.8 IP name-server

  name of the IP-server 165.21.100.88

  !

  !

  !

  !

  !

  Archives

  The config log

  hidekeys

  !

  !

  !

  !

  !

  ATM0 interface

  no ip address

  No atm ilmi-keepalive

  DSL-automatic operation mode

  !

  point-to-point interface ATM0.1

  Description $ES_WAN$ $FW_OUTSIDE$

  penetration of the IP stream

  PVC 0/100

  aal5snap encapsulation

  Protocol ppp Dialer

  Dialer pool-member 1

  !

  !

  interface FastEthernet0

  !

  interface FastEthernet1

  !

  interface FastEthernet2

  !

  interface FastEthernet3

  !

  interface Dot11Radio0

  no ip address

  Shutdown

  base speed - 1.0 2.0 basic basic-5, 5 6.0 9.0 basic-11, 0 12.0 18.0 24.0 36.0 48.0 54.0

  root of station-role

  !

  interface Vlan1

  Description $ETH - SW - LAUNCH$ $INTF - INFO - HWIC-$4ESW $ES_LAN$ $FW_INSIDE$

  IP 192.168.1.254 255.255.255.0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  penetration of the IP stream

  IP nat inside

  IP virtual-reassembly

  IP tcp adjust-mss 1452

  !

  interface Dialer0

  the negotiated IP address

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  penetration of the IP stream

  NAT outside IP

  IP virtual-reassembly

  encapsulation ppp

  Dialer pool 1

  Dialer-Group 1

  No cdp enable

  PPP authentication pap callin

  PPP pap sent-username [email protected] / * / 7 130 44185206173829 password

  !

  IP forward-Protocol ND

  IP route 0.0.0.0 0.0.0.0 Dialer0

  !

  no ip address of the http server

  no ip http secure server

  !

  !

  !

  !

  control plan

  !

  !

  Line con 0

  no activation of the modem

  line to 0

  line vty 0 4

  !

  max-task-time 5000 Planner

  end

  Can you ping your router 8.8.8.8? If so, you'll need is to configure the nat on the router:

  access-list 100 permit ip 192.168.1.0 0.0.0.255 any

  IP nat inside source list 100 interfaces dialer0 overload

  int vlan 1

  IP nat inside

  int dial0

  NAT outside IP

  HTH,
  John

  Please note all useful messages *.

• Filtering of local networks without WIRE of APs

  Hello

  Is is possible to filter a WLAN of 1 or several APs? We have an obligation to add a wlan open to our network but don't want it available on all of our access points.

  Hi Joseph,.

  There is an excellent article that can help this requirement;

  Take a look at this info;

  Allowing substitution WLAN

  By default, all defined WLAN transmission on the controller access points. However, you can use WLAN editable to select WLAN is transmitted and who are not on a per access point basis. For example, you can use WLAN to control override goes where in the guest WLAN network or you can use it to disable a specific WLAN in a certain area of the network.

  This doc.

  http://www.Cisco.com/en/us/products/ps6366/products_configuration_guide_chapter09186a008076cbfd.html#wp1114777

  Once you create a new WLAN, WLAN > page edition for the new WLAN. In this page, you can set various parameters specific to this general policy, RADIUS servers, political security WLAN key, and 802.1 x settings.

  * Check Admin status under general strategies to activate the WLAN. If you want AP broadcast the SSID in beacon frames, check the SSID broadcast.

  Note: You can configure up to 16 WLAN on the controller. The Cisco WLAN Solution can control up to sixteen WLAN for Lightweight APs. Each WLAN has an ID separated from WLAN (1 to 16), a WLAN SSID (name of the WLAN) separate and can be assigned to single security policies. Lightweight APs broadcast all Cisco WIFI WLAN SSID Solution assets and apply the policies that you set for each WLAN.

  The good doc.

  http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a0080665d18.shtml#C3

  I hope this helps!

  Rob

• 2106, 2nd add WLAN

  There is a thread here somewhere that has helped me get my 2106 implemented with a WLAN a WLAN guest. Now, I'm putting in place a 2nd WLAN on the same WLC. I have created a new dynamic interface, WLAN and corresponding AP group VLAN. However, the lone AP in the new WLAN grows on two local wireless networks, even if it is configured as being only in the second. I must be missing a step in config here, but what?

  Hi Jeff,

  The feature you're looking for is called WLAN substitute :)

  Allowing substitution WLAN

  By default, all defined WLAN transmission on the controller access points. However, you can use WLAN editable to select WLAN is transmitted and who are not on a per access point basis. For example, you can use WLAN to control override goes where in the guest WLAN network or you can use it to disable a specific WLAN in a certain area of the network.

  This doc.

  http://www.Cisco.com/en/us/docs/wireless/controller/4.0/Configuration/Guide/c40wlan.html#wp1114777

  Once you create a new WLAN, WLAN > page edition for the new WLAN. In this page, you can set various parameters specific to this general policy, RADIUS servers, political security WLAN key, and 802.1 x settings.

  * Check Admin status under general strategies to activate the WLAN. If you want AP broadcast the SSID in beacon frames, check the SSID broadcast.

  Note: You can configure up to 16 WLAN on the controller. The Cisco WLAN Solution can control up to sixteen WLAN for Lightweight APs. Each WLAN has an ID separated from WLAN (1 to 16), a WLAN SSID (name of the WLAN) separate and can be assigned to single security policies. Lightweight APs broadcast all Cisco WIFI WLAN SSID Solution assets and apply the policies that you set for each WLAN.

  The good doc.

  http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a0080665d18.shtml#C3

  I hope this helps!

  Rob

• ISE / Active Directory: question to get the users group

  Hello

  There is a strange problem:

  -Patch 1.2 ISE 8

  -No WLC, autonomous AP

  In authentication, we check wireless IEEE 802.11 (RADIUS) and cisco-av-pair (ssid), then we use AD.

  We have 3 SSID, so 3 rules, a GIVEN, one INVITED, one for the INTERNET.

  In a settlement more than grant permission of APs to save to WDS authentication: user in the local database.

  In the authorization, we check cisco-av-pair (ssid) and the Group of users AD, then we allow access.

  (so 3 rules) and a more to allow the basic internal for WDS.

  We have something strange:

  -Sometimes users can connect, but later they can't: the newspaper permission rejects the user because the ad group is not seen.

  Example:

  1 OK:

  Details of authentication

  Timestamp of source	2014-05-15 11:43:19.064
  Receipt of timestamp	2014-05-15 11:43:19.065
  Policy Server	RADIUS
  Event	5200 successful authentication

  All user GROUPS are observed:

  	fake
  AD ExternalGroups	XX/users/admexch
  AD ExternalGroups	XX/users/glkdp
  AD ExternalGroups	x/users/gl journal writing
  AD ExternalGroups	XX/users/pcanywhere
  AD ExternalGroups	XX/users/wifidata
  AD ExternalGroups	XX/computer/campus/recipients/aa computer
  AD ExternalGroups	XX/computer/campus/recipients/aa business and cited
  AD ExternalGroups	campus of XX/computer/campus/recipients/aa
  AD ExternalGroups	XX/users/aiga_creches
  AD ExternalGroups	XX/users/domain admins
  AD ExternalGroups	XX/users/used. the domain
  AD ExternalGroups	XX/users/replication group does the rodc password is denied
  AD ExternalGroups	XX/microsoft exchange security groups/exchange view only administrators
  AD ExternalGroups	Directors of XX/microsoft exchange security groups Exchange public folders
  AD ExternalGroups	XX/users/certsvc_dcom_access
  AD ExternalGroups	XX/builtin/Administrators
  AD ExternalGroups	XX/builtin/users
  AD ExternalGroups	XX/builtin/account operators
  AD ExternalGroups	XX/builtin/server operators
  AD ExternalGroups	distance of XX/builtin/users of the office to
  AD ExternalGroups	XX/builtin/access dcom certificate service
  RADIUS user name	xx\cennelin
  IP address of the device	172.25.2.87
  Called-Station-ID	00: 3A: 98:A5:3E:20
  CiscoAVPair	SSID = CAMPUS
  SSID	campus of

  2 NO OK no later than:

  Details of authentication

  Timestamp of source	2014-05-15 16:17:35.69
  Receipt of timestamp	2014-05-15 16:17:35.69
  Policy Server	RADIUS
  Event	Endpoint 5434 conducted several failed authentications of the same scenario
  Reason for failure	15039 rejected by authorization profile
  Resolution	Authorization with the attribute ACCESS_REJECT profile was chosen due to the corresponding authorization rule. Check the appropriate rule political authorization results.
  First cause	Selected authorization profile contains ACCESS_REJECT attribute

  .../...

  Only 3 user groups are observed:

  Other attributes

  ConfigVersionId	5
  Port of the device	1645
  DestinationPort	1812
  RadiusPacketType	AccessRequest
  Username	host/xxxxxxxxxxxx
  Protocol	RADIUS
  NAS-IP-Address	172.25.2.80
  NAS-Port	51517
  Framed-MTU	1400
  State	37CPMSessionID = b0140a6f0000C2E15374CC7F; 32SessionID = RADIUS/189518899/49890;
  Cisco-nas-port	51517
  IsEndpointInRejectMode	fake
  AcsSessionID	RADIUS/189518899/49890
  DetailedInfo	Successful authentication
  SelectedAuthenticationIdentityStores	CDs
  DomaineAD	XXXXXXXXXXX
  AuthorizationPolicyMatchedRule	By default
  CPMSessionID	b0140a6f0000C2E15374CC7F
  EndPointMACAddress	00-xxxxxxxxxxxx
  ISEPolicySetName	By default
  AllowedProtocolMatchedRule	CDM-PC-PEAP
  IdentitySelectionMatchedRule	By default
  HostIdentityGroup	Endpoint identity groups: profile: workstation
  Model name	Cisco
  Location	Location #All locations #Site - CDM
  Type of device	Device Type #All type #Cisco - terminals
  IdentityAccessRestricted	fake
  AD ExternalGroups	XX/users/computers in the domain
  AD ExternalGroups	XX/users/certsvc_dcom_access
  AD ExternalGroups	XX/builtin/access dcom certificate service
  Called-Station-ID	54:75:D0:DC:5 B: 7 C
  CiscoAVPair	SSID = CAMPUS

  If you have an idea, thank you very much,

  Kind regards

  Eventually, the AD he loses connectivity with ISE