Parameters of QOS in WLC

Similar Questions

• QoS in WLC 2504 for Skype and Lync

  Hi all...

  My clients said that the quality of the videocalls are poor. What can I to improve this.

  I have little idea... Please help me...

  Yes, enable QoS on wireless is much more of a QoS profile on a WLAN configuration. Please understand these guidelines QoS to design & develop your network.

  http://www.Cisco.com/c/en/us/TD/docs/solutions/enterprise/mobility/emob73dg/emob73/ch5_QoS.html

  Once implemented, you must check-to-end QoS is preserve, so it's QoS config/check on your cable as well.

  You can check out some of my blog posts related to this topic. It will help you better understand what it implies the QoS configuration

  http://mrncciew.com/2012/11/28/understanding-wireless-QoS-part-1/

  HTH

  Rasika

  Pls note all useful responses *.

• problem with the connectivity of customers after mixing several models with WLC 5508 Setup WLAN ap

  Hello

  I have 2 5508 wlc and AP 1130 and 1200 in my test harness.

  Currently, WLAN set is in place and works very well but the customer become a frequent problem with the power of the weak signal same AP is installed very near the place of the customer.

  I have my doubts, if I have a question because I use several models of AP in my set-up?

  How to rectify the same question?

  Some time customer gets limited connectivity, means that they usually get IP also.

  What are all the parameters to check in WLC?

  (1) very difficult for a person on a forum to respond. Check if your AAA server was indeed seen as inactive at the same time for other devices.

  If this is not the case, check the network connectivity between the 2. Maybe packets are lost between wlc and aaa server...

  (2) as I mentioned, it may have nothing to do with clent near or far from the AP. What happens if your DHCP server is not responding to the client? What happens if the dhcp request never reaches the level of the DHCP server for some reason any?

  You must investigate all along path to find out why the customer is not getting an ip address.

  Troubleshooting involves trace of sniffer, debug, client, etc...

• Linksys RE1000 unstable

  I had problems with this range extender for several days now, and it's very frustrating.

  I have a router Sagemcom F@st 2864 (connection Hub) with Bell Canada. The diffuse Router 2.4 GHz with Auto B/G/N, channel 11, 20 Mhz bandwidth, be able to pass 100% compatible WMM, WMM Powersave active, WPA2-PSK (AES).

  I have my RE1000 set to a static IP (192.168.2.100), all the parameters of QoS by default, etc.. It also has the latest firmware.

  I have two laptops Wireless N, a Blackberry Torch (N), iPad (N), office (N), Blu - Ray player (N), iPod Touch (G) and WES610N access point (using the static IP 192.168.2.12; Xbox360, Wii, connected Blu - Ray player), all connected wireless. I have an another desktop connected directly to the router using an Ethernet cable.

  The RE1000 is stable for several hours (10 hours today) and then all the wireless devices will go haywire. My computer laptop will constantly connect and disconnect and the WES610N will do the same.

  I tried different channels, affecting both the router only N G only, but the issue continue to be.

  The RE1000 has 4 bars (green) strength and the quality of 3 bars (yellow).

  My product is defective? Why did is stable for a limited period of time? The iPad or iTouch has anything to do with this problem?

  Installed the E3200, packed my * beep * ty modem from Bell and my network now works great! The RE1000 never falls. In fact, I may not be no need it because the range on the E3200 is far superior to the modem provided by Bell!

• Questions about my SG-300-10MP switch Setup

  Hello world

  Thank you very much for your help in advance. I was never in this town before.

  I just got the new SG - 300 switches. My manager has ordered for me. I didn't know how it works so far... not a based IOS. I don't really know how to set it up.

  In any case, I have a switch configured 3750 already in a new site. It has two VLANs, a vlan 11 for PC, and one is for vlan VOIP 320. It has automatic qos works as well. I have installation just a trunk for the new SG - 300 switch.

  Now on the new small switch 300 SG... I have a few questions:

  (1.) I also created two VLAN, it is VLAN11 (for PC), and a 320 VLAN. For this one, I go to the Web-GUI and assign the 320 to the VOICE Vlan. I also changed the CoS at 5 (of 6). Are these ok?

  2.) on port number 9, it's the default trunk, so I add two 11 and 320 to the trunk and leave the other default settings. It's too well ok?

  3.) on a #1 access port, which will be an IP phone, attached with a PC to connect. What I did is to change the mode to Interface Vlan on "GENERAL." Is this fair? I also 'SEE' the box belonging to a VLAN auto voice. And let the Voice VLAN QoS mode such as telephone company Source MAC ADDRESS. I did all these right?

  4.) Finally, for the part of the QoS... Let them default all untouchables - which is the default QoS of Basic... I don't know if it will be fine. I know that the company switch can assign an Auto-QOS command and that he would do all the config itself. Or maybe you mind if you would share your QoS configuration settings?

  I'm more concerned about the parameters in QoS here. Hope you can help.

  Thank you very much.

  Takami Chiro

  Hello

  In the case of the Cisco 7961 (and other phones that support LLDP-MED), you can assign VIRTUAL local network for the phone settings using the LLDP-MED on the switch.

  You have to

  -allow to the vlan VoIP

  -Add MAC YES

  -set the port on vlan automatic voice

  -activate LLDP-MED in the world

  -create a network policy to assign VLAN320

  -assign this policy network on port, the phone is connected to

  Hope this helps,

  Kind regards

  Nico

• Intel wifi link 1000 bgn on Hp laptop connection only to 65 Mbps or Mbps even 58, then 130 for 1 second then back to slow speed.

  I recently bought a computer hp laptop and enjoy wireless n to my house.  I have an another hp laptop which connects to 130 Mbps and never changes.  This laptop however changes constantly and never stays in 130.  It is generally about 58 or 65 and then change during 1 second to 117 or 130 then back to slow speed.  I noticed on the laptop properly configured, it says:
  IPv4 Internet connectivity
  local IPv6 connectivity
  active state media
  130 Mbps speed

  On slow computer, he States:

  IPv4 Internet connectivity
  IPv6 connectivity no internet no access
  active state media
  65 Mbps speed

  I don't know if this means anything, but I guess for this.  Is there something misconfigured on laptop #2 or what?  I can't understand this.  I would like to be sure that this adapter in this laptop is also able to maintain 130 Mbit/s, but there are no at that speed.  Any help would be greatly appreciated.
  Thank you

  I had the same problem with the same Intel adapter WiFi 1000 BGN.  Two things fixed.  My router by default, the band of 2.4 Ghz to a maximum of 130 Mbps for backward compatibility.  Change this 300 Mbps.  Second if your router allows you to set the parameters for QoS make you that WMM is enabled.  Thirdly, map properties network by default to the following on the old card NETWORK interface:

  Channel 802.11n for 2.4 band width = 20 Mhz only

  802.11n mode = disabled

  Ad Hoc QoS = WMM disabled

  The default values have the capacity "N" disabled, because when the card shipped first Wireless N routers were rare, and it has improved the flow of 'G '.  Change them to 'Auto', 'Enabled' and 'active WMM.  The last of them allows the priority to multimedia for the peer-to-peer network data local transfers (i.e. - video streaming, music between two computers in the same House).  Hope that helps.

  Shane

• QOS parameters were not set to R6400

  I'll put up my R6400 I just bought and all will lose but it does not appear that the upstream QOS parameter I want to phone IP is to stay together. I go through the Advanced menu and click on the button in front of IP phone, and then click turn on, but when I go back to look at the settings of the IP phone button is again disabled. What should I do to get the rotor to accept QOS for IP phone?

  Hi @MSRadell,

  Once you have checked the box to enable QoS upstream all QoS rules will be applied. The light in the radio button will be highlighted only if you select to change or remove a given rule.

  Kind regards

  Dexter

  The community team

• J HT 202068 recommended parameters of the Wi - Fi routers

  Hi all

  I'm reviewing settings on my AirPort Extreme A1521. How do I provide feedback on the following?

  (a) 2.4 GHz Radio Mode the value 802.11/b/g/n

  (b) 5 GHz Radio set to 802. 11A / n

  (c) 2.4 GHz 20 MHz channel width

  (d) the 5 GHz channel width set according to the recommendations

  (e) active set (Wi - Fi Multimedia) WWM.

  It may well be that these are default settings. Please enlighten me!

  Thank you very much.

  When you look at these parameters...

  In the airport utility v6 is no longer a setting for the wireless mode. It disappeared completely for AC models.

  Only v5 utility will show you the details and they are wrong and do not work in all cases.

  Apple has set almost all of it and it cannot be changed.

  (a) 2.4 GHz Radio Mode the value 802.11/b/g/n

  preset (it is correct... that it works with clients B G or N).

  (b) 5 GHz Radio set to 802. 11A / n

  predefined (but that's it)

  (c) 2.4 GHz 20 MHz channel width

  preset. Apple have always limited the speed to 2.4 ghz.

  (d) the 5 GHz channel width set according to the recommendations

  preset... 80 mhz to AC it's depends on the region.

  (e) active set (Wi - Fi Multimedia) WWM.

  I'm not sure on this one... It is a QoS function and I'm not sure it's relevant... in any case, you cannot set it.

• EA2700 problems installing QoS

  I have an EA2700, which has updated the firmware fo the 1.0.14 (not Cisco Cloud Connect), and the window of QoS parameters on the installation of Web does not seem to work. All fields are gray'ed out, and the installation link does not work.  The original on the configuration firmware 1.0.12 box seemed to work.  I tried to revert to the previous firmware without success.  I would take some uplink of my VOIP (VONAGE) interface priority but had no chance. Is there a problem with the new firmware?

  davidmeyer wrote:

  I have an EA2700, which has updated the firmware fo the 1.0.14 (not Cisco Cloud Connect), and the window of QoS parameters on the installation of Web does not seem to work. All fields are gray'ed out, and the installation link does not work.  The original on the configuration firmware 1.0.12 box seemed to work.  I tried to revert to the previous firmware without success.  I would take some uplink of my VOIP (VONAGE) interface priority but had no chance. Is there a problem with the new firmware?

  Why not upgrade to Cisco Connect cloud, it is easy for you to give priority to the VOIP interface since it just drag and drop! But if you're not really comfortable with it. You can powercycle the router for 10-30 seconds if not work still then reset and reconfigure the router

• QoS EA4500

  I bought the EA45500 specifically to configure QoS on specific devices by MAC address.  I would like to give preference to the PS3 for online games.  The first time I went to the QoS to the interface of the browser tab, I could start to put in the settings, then after the second or third recorded, the QoS tab has nothing of my settings and accept all the entries or save the settings (see image inserted here)

  

  I now notice that as soon as I put on the EA4500, he had the v2.0.36.126507 firmware.  During the installation (before the QoS setting), I tried (without success) load new firmware that has been identified.  Today, I see that the new firmware is loaded v2.0.37.131047.

  Anyone can shed some light on this?  Can I restore the firmware manually? If Yes, where can I find it?

  

  Thank you hiptechboy.  Factory setting reset indeed QoS page, so it was functional, however, I learned a little more I started to restore the configuration.  Given that I had saved configuration settings at various times during the initial installation, I restored it with the last save point which included the 'bad' QoS and the QoS page was in fact still bad. So everything he does gets saved to the backup / restore configuration file.

  As I said, I had several backups, so I took one earlier (before the adjustment of QoS page).  This restoration has a functional QoS page after restoring the configuration. So, I added my first priority QoS settings on QoS page and saved a backup of the configuration.  I added the second priority QoS, recorded on the page of the QoS parameters and save a configuration to the top.  When I added the third QoS parameter and registered on the page of QoS, all my settings have disappeared and the page was more functional.  I must have got the third entry of the QoS the other night, when he 'stop working '.

  This time, I have simply restored from the last save point and again had a functional QoS page.

  

  So I guess that the quality of service is limited to 2 items.  Add a third and once settings makes this useless page and as I said, it is recorded like this in the configuration backup.  I would like to put the iPod Touch, iPhone and iPad on a lower priority for streaming video is not interfering with the online game of the PS3 (i.e. CoD MW3).

• Limit my bandwidth downloading the applications using the API to control traffic and QoS

  I used QoS and Traffic Control API as TcAddFlow and TcAddFilter to control my bandwidth usage download applications.

  We manipulate TC_GEN_FLOW, to send and receive FLOWSPEC parameters.

  Now, I want to set the exact limit to 5 Mbps, what are the value that I need to set for TokenBucketSize and TokenRate to limit bandwidth to 5 Mbps FLOWSPEC structure?

  Code snippet:

  newFlow-> ReceivingFlowspec.DelayVariation = QOS_NOT_SPECIFIED;
  newFlow-> ReceivingFlowspec.Latency = QOS_NOT_SPECIFIED;
  newFlow-> ReceivingFlowspec.MaxSduSize = QOS_NOT_SPECIFIED;
  newFlow-> ReceivingFlowspec.MinimumPolicedSize = QOS_NOT_SPECIFIED;
  newFlow-> ReceivingFlowspec.PeakBandwidth = POSITIVE_INFINITY_RATE;
  newFlow-> ReceivingFlowspec.ServiceType = SERVICETYPE_NETWORK_CONTROL;
  newFlow-> ReceivingFlowspec.TokenBucketSize = ?;
  newFlow-> ReceivingFlowspec.TokenRate =?;

  newFlow-> SendingFlowspec.DelayVariation = QOS_NOT_SPECIFIED;
  newFlow-> SendingFlowspec.Latency = QOS_NOT_SPECIFIED;
  newFlow-> SendingFlowspec.MaxSduSize = QOS_NOT_SPECIFIED;
  newFlow-> SendingFlowspec.MinimumPolicedSize = QOS_NOT_SPECIFIED;
  newFlow-> SendingFlowspec.PeakBandwidth = POSITIVE_INFINITY_RATE;
  newFlow-> SendingFlowspec.ServiceType = SERVICETYPE_NETWORK_CONTROL;
  newFlow-> SendingFlowspec.TokenBucketSize =?;
  newFlow-> SendingFlowspec.TokenRate =?;

  Thank you & best regards

  This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)
  http://social.technet.Microsoft.com/forums/en-us/home s/fr-U.S./Accueil
  http://social.msdn.Microsoft.com/Forum
  
  
  If you give us a link to the new thread we can point to some resources it

• Differences of router QoS and ASA

  Hi, I recently tested the QoS on an aid and 876 IPSEC tunnel and managed to limit participation effective and output rates using QoS on the router between two hosts.

  This made me think to try it on a SAA. I tried this on a SAA without success, but he also says in aid, it cannot be applied to the 'exit '. Is there a difference in the implementation of QoS between a router and ASA?

  Update - I had it at work but only when I use it all the traffic everything. If I select say 192.168.55.20-> all IT does rate limit.

  outside_mpc list extended access permit ip host 192.168.55.20 all

  class-map ROB_QOS (does not work)

  corresponds to the outside_mpc access list

  Class-map ROB_QOS (works)

  match any

  class-map inspection_default

  match default-inspection-traffic

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Policy-map Rob_Policy

  class ROB_QOS

  Police output fall in line-action 2000-100000

  global service-policy global_policy

  Rob_Policy service-policy inside interface

  Rob_Policy service-policy to the outside interface

  Maybe its not working now because you have NAT on this 192.168.55.0 IP range? You use any NAT for this subnet?

  Concerning

  Farrukh

• 3560 form/sharing of bandwidth QoS SRR

  I have the following Setup

  Core Stack (3750) - devices of Distribution range battery (3750) - access switches (3560).

  I want to implement bandwidth shape/share srr-queue on interface

  My question is

  1 - on which of your interfaces, I should implement the command and on what boxes?

  Hi Asus,

  Here's my recommendation & given you some post as well to understand the logic behind it for reference.

  Switch-Switch: Trust DSCP

  Switch-AP: Trust DSCP (if APs are local mode & switch port is configured as access ports)

  Switch-AP: Trust CoS (if your APs are in local switching FlexConnect mode & switch port is configured as a Trunk Port)

  http://mrncciew.com/2013/07/23/QoS-for-h-reap/

  also examine the underside as well.

  Switch - VoIP: Trust CoS (with trust cisco-phone device)

  http://mrncciew.com/2013/07/26/VoIP-phone-switchport-config/

  Switch - WLC: Trust CoS

  http://mrncciew.com/2013/02/24/best-practice-QoS-config/

  SRR orders must configure all interfaces with the priority queue if you want to do the voice traffic prioratization (DSCP EF traffic).

  http://mrncciew.com/2012/11/26/375035602960-wired-QoS/

  Take note that the QoS controls are specific hareware & always refer to the specific product configuration guide during Setup.

  HTH

  Rasika

  Pls note all useful responese *.

• ISE with WLC AND switches

  Hello

  We run 3xWLC controller with 800 AP using ISE 1.2 for authentication wireless 802. 1 x. I was looking in the config of the ISE and notice of 400 edge cheating only 2x2960s are configured with 802. 1 x (ISE RADIUS config) and SNMP and only 2 of the port is 2 ap tie with swtich remaining ports.and the 3XWLC in network devices.

  I do not understand how an access point is to do this work (802.1 x) because it is location on different site and people are connecting to various different locations. ISE almost run/do 11 876 profiled ends.

  version 12.2
  !
  boot-start-marker
  boot-end-marker
  !
  enable secret 5 $1$ fokm$ lesIWAaceFFs.SpNdJi7t.
  !
  Test-RADIUS username password 7 07233544471A1C5445415F
  AAA new-model
  Group AAA dot1x default authentication RADIUS
  Group AAA authorization network default RADIUS
  Group AAA authorization auth-proxy default RADIUS
  start-stop radius group AAA accounting dot1x default
  start-stop radius group AAA accounting system by default
  !
  !
  !
  !
  AAA server RADIUS Dynamics-author
  Client 10.178.5.152 server-key 7 151E1F040D392E
  Client 10.178.5.153 server-key 7 060A1B29455D0C
  !
  AAA - the id of the joint session
  switch 1 supply ws-c2960s-48 i/s-l
  cooldown critical authentication 1000
  !
  !
  IP dhcp snooping vlan 29,320,401
  no ip dhcp snooping option information
  IP dhcp snooping
  no ip domain-lookup
  analysis of IP device
  !
  logging of the EMP
  !
  Crypto pki trustpoint TP-self-signed-364377856
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 364377856
  revocation checking no
  rsakeypair TP-self-signed-364377856
  !
  !
  TP-self-signed-364377856 crypto pki certificate chain
  certificate self-signed 01
  30820247 308201B 0 A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030
  2 060355 04031325 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 30312E30
  69666963 33363433 37373835 36301E17 393330 33303130 30303331 0D 6174652D
  305A170D 2E302C06 1325494F 03550403 32303031 30313030 30303030 5A 303031
  532D 5365 6C662D53 69676E65 642D 4365 72746966 69636174 652 3336 34333737
  06092A 86 4886F70D 01010105 38353630 819F300D 00308189 02818100 0003818D
  B09F8205 9DD44616 858B1F49 A27F94E4 9E9C3504 F56E18EB 6D1A1309 15C20A3D
  31FCE168 5A8C610B 7F77E7FC D9AD3856 E4BABDD1 DFB28F54 6C24229D 97756ED4
  975E2222 939CF878 48D7F894 618279CF 2F9C4AD5 4008AFBB 19733DDB 92BDF73E
  B43E0071 C7DC51C6 B9A43C6A FF035C63 B53E26E2 C0522D40 3F850F0B 734DADED
  02030100 01A 37130 03551 D 13 6F300F06 0101FF04 05300301 01FF301C 0603551D
  11041530 13821150 5F494D2B 545F5374 61636B5F 322D312E 301F0603 551D 2304
  18301680 1456F3D9 23759254 57BA0966 7C6C3A71 FFF07CE0 A2301D06 03551D0E
  04160414 56F3D923 75925457 BA09667C 6C3A71FF F07CE0A2 2A 864886 300 D 0609
  F70D0101 5B1CA52E B38AC231 E45F3AF6 12764661 04050003 81810062 819657B 5
  F08D258E EAA2762F F90FBB7F F6E3AA8C 3EE98DB0 842E82E2 F88E60E0 80C1CF27
  DE9D9AC7 04649AEA 51C49BD7 7BCE9C5A 67093FB5 09495971 926542 4 5A7C7022
  8D9A8C2B 794D99B2 3B92B936 526216E0 79 D 80425 12B 33847 30F9A3F6 9CAC4D3C
  7C96AA15 CC4CC1C0 5FAD3B
  quit smoking
  control-dot1x system-auth
  dot1x critical eapol
  !
  pvst spanning-tree mode
  spanning tree extend id-system
  No vlan spanning tree 294-312,314-319,321-335,337-345,400,480,484-493,499,950
  !
  !
  !
  errdisable recovery cause Uni-directional
  errdisable recovery cause bpduguard
  errdisable recovery cause of security breach
  errdisable recovery cause channel-misconfig (STP)
  errdisable recovery cause pagp-flap
  errdisable recovery cause dtp-flap
  errdisable recovery cause link-flap
  errdisable recovery cause FPS-config-incompatibility
  errdisable recovery cause gbic-invalid
  errdisable recovery cause psecure-violation
  errdisable cause of port-mode-failure recovery
  errdisable recovery cause dhcp-rate-limit
  errdisable recovery cause pppoe-AI-rate-limit
  errdisable recovery cause mac-limit
  errdisable recovery cause vmps
  errdisable recovery cause storm-control
  errdisable recovery cause inline-power
  errdisable recovery cause arp-inspection
  errdisable recovery cause loopback
  errdisable recovery cause small-frame
  errdisable recovery cause psp
  !
  internal allocation policy of VLAN ascendant
  !
  !
  interface GigabitEthernet1/0/10
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard

  interface GigabitEthernet1/0/16
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard
   
  interface GigabitEthernet1/0/24
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard
   
  !
  interface GigabitEthernet1/0/33
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard
   
  interface GigabitEthernet1/0/34
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface GigabitEthernet1/0/44
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard

  !
  interface GigabitEthernet1/0/46
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard

  interface GigabitEthernet1/0/48
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface GigabitEthernet1/0/49
  Description link GH
  switchport trunk allowed vlan 1,2,320,350,351,401
  switchport mode trunk
  MLS qos trust dscp
  IP dhcp snooping trust
  !

  interface GigabitEthernet1/0/52
  Description link CORE1
  switchport trunk allowed vlan 1,2,29,277,278,314,320,401
  switchport mode trunk
  MLS qos trust dscp
  IP dhcp snooping trust
  !
  !
  interface Vlan320
  IP 10.178.61.5 255.255.255.128
  no ip-cache cef route
  no ip route cache
  !
  default IP gateway - 10.178.61.1
  IP http server
  IP http secure server
  IP http secure-active-session-modules no
  active session modules IP http no
  !
  !
  Access IP extended ACL-AGENT-REDIRECT list
  deny udp any any domain eq bootps
  permit tcp any any eq www
  permit any any eq 443 tcp
  IP extended ACL-ALLOW access list
  allow an ip
  IP access-list extended by DEFAULT ACL
  allow udp any eq bootpc any eq bootps
  allow udp any any eq field
  allow icmp a whole
  allow any host 10.178.5.152 eq 8443 tcp
  permit tcp any host 10.178.5.152 eq 8905
  allow any host 10.178.5.152 eq 8905 udp
  permit tcp any host 10.178.5.152 eq 8906
  allow any host 10.178.5.152 eq 8906 udp
  allow any host 10.178.5.152 eq 8909 tcp
  allow any host 10.178.5.152 eq 8909 udp
  allow any host 10.178.5.153 eq 8443 tcp
  permit tcp any host 10.178.5.153 eq 8905
  allow any host 10.178.5.153 eq 8905 udp
  permit tcp any host 10.178.5.153 eq 8906
  allow any host 10.178.5.153 eq 8906 udp
  allow any host 10.178.5.153 eq 8909 tcp
  allow any host 10.178.5.153 eq 8909 udp
  refuse an entire ip
  Access IP extended ACL-WEBAUTH-REDIRECT list
  deny ip any host 10.178.5.152
  deny ip any host 10.178.5.153
  permit tcp any any eq www
  permit any any eq 443 tcp

  radius of the IP source-interface Vlan320
  exploitation forest esm config
  logging trap alerts
  logging Source ip id
  connection interface-source Vlan320
  record 192.168.6.31
  host 10.178.5.150 record transport udp port 20514
  host 10.178.5.151 record transport udp port 20514
  access-list 10 permit 10.178.5.117
  access-list 10 permit 10.178.61.100
  Server SNMP engineID local 800000090300000A8AF5F181
  SNMP - server RO W143L355 community
  w143l355 RW SNMP-server community
  SNMP-Server RO community lthpublic
  SNMP-Server RO community lthise
  Server SNMP trap-source Vlan320
  Server SNMP informed source-interface Vlan320
  Server enable SNMP traps snmp authentication linkdown, linkup cold start
  SNMP-Server enable traps cluster
  config SNMP-server enable traps
  entity of traps activate SNMP Server
  Server enable SNMP traps ipsla
  Server enable SNMP traps syslog
  Server enable SNMP traps vtp
  SNMP Server enable traps mac-notification change move threshold
  Server SNMP enable traps belonging to a vlan
  SNMP-server host 10.178.5.152 version 2 c lthise mac-notification
  SNMP-server host 10.178.5.153 version 2 c lthise mac-notification
  !
  RADIUS attribute 6 sur-pour-login-auth server
  Server RADIUS attribute 8 include-in-access-req
  RADIUS attribute 25-application access server include
  dead-criteria 5 tent 3 times RADIUS server
  test the server RADIUS host 10.178.5.152 auth-port 1812 acct-port 1813 username test-RADIUS 7 key 03084F030F1C24
  test the server RADIUS host 10.178.5.153 auth-port 1812 acct-port 1813 username test-RADIUS 7 key 141B060305172F
  RADIUS vsa server send accounting
  RADIUS vsa server send authentication

  any help would be really appreciated.

  I'm not sure that completely understand the question; But if LSE is only political wireless, then none of the wired switches need any configuration of ISE.

  Access points tunnel all wireless traffic to the WLC on CAPWAP (unless you use FlexConnect). This is the configuration 802. 1 x on the WLC that implements policies defined in ISE.

  Switches wired never need to act as an access network (n) device and so do not need to be defined in ISE unless or until you want to apply policies of ISE for wired devices...

• WLC v4.2.112.0 - IDS Signatures - Deauth/Auth and flooding of the Assoc

  Hi all

  My apologies if this has already asked. There seems to be several posts with people getting critical alarms and they are due to bugs in Cisco?

  Couple of points.

  I am under the above version and I'm getting a lot of IDS Deauth Auth and Assoc alarms on WLCs/WCS.

  How can I find out if these are some releated bug or not?

  Also, does anyone know how these three and the other signature attack work? IE, a deauth is a number of deauth messages sent to an access point, but how much is sent before the WLC reports on them? That is to say, what are the criteria to generate the IDS alarms. Also for other signature attacks?

  It doesn't seem to be too docs on the web?

  Many thx and sincere friendships,

  Ken

  Ken:

  It is a region that has been a bit murky documentation. There have been a number of requests for better documentation, but we are still waiting to see.

  Surprisingly, one of the best forms of

  "documentation" is by examining the signature file wireless IDS which has a few comments and explains how settings work. You can see what a little enlightening.

  In addition, when it comes to false alarms, we have seen a number of them in various flavors. Here are a few thoughts:

  If you run "containment" or rogue APs, wireless ID system currently interprets its own messages of containment as a false-positive/attack. This is a known bug ( CSCsj06015 ) that says: it is fixed, but to my knowledge continues to be a problem.

  Here is a link to the bug:

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsj06015

  Also, when some brands of customers go out of scope, a string of messages disassociation is sent via the Russia Federation to ensure that the RF connection is broken. However, the number of these legitimate trusts sometimes exceeds the allowed value in the signature CODES of Cisco Wireless file and the WLC erroneously interprets as a false positive / attack, whereas in fact, it's a normal approval. The number of detections per second value can be adjusted (in fact, the proposed TAC make some changes here - but this really needs to be better set at the factory to prevent them to ancestral). One of the links below explains the methodology to change wireless IDs. The most recent versions of the WCS/WLC are supposed to allow a change of parameter/GUI based these parameters vs export/edition/download the signature file wireless IDS on/in each WLC.

  For your reading pleasure, here are some links that you might find useful who discuss various wrinkles in wireless IDs:

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.1ddf672c/0#selected_message

  http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Expert%20Archive&topic=Wireless%20-%20Mobility&topicID=.ee7f999&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cbf522e/16#selected_message

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.2cbf520e/1#selected_message

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.2cbeccbc/0#selected_message

  http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.1ddfaecb/1#selected_message

  Thank you

  John

  (Don't forget to rate helpful messages)