Cisco WLC

-

Configure Packet Captures on AireOS WLC

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/211342-packet-captures-on-aireos-wlc.html


Ports and Interfaces

A port is a physical entity, two types of ports: distribution system ports and a service port.


Controller

Service Ports

Distribution System Ethernet Ports

Serial Console Port

2100 series
None
8 (6 + 2 PoE ports)
1
4402
1
2
1
4404
1
4
1
5508
1
8 (ports 1–8)
1
Cisco WiSM
2 (ports 9 and 10)
8 (ports 1–8)
2
Controller Network Module within the Cisco 28/37/38xx Series Integrated Services Routers
None
1
12
Catalyst 3750G Integrated Wireless LAN Controller Switch
1
2 (ports 27 and 28)
1
  
A distribution system port connects the controller to a neighbor switch and serves as the data path between these two devices.




The service port is controlled by the service-port interface and is reserved for out-of-band management of the controller and system recovery and maintenance in the event of a network failure. Use of the service port is optional.




An interface is a logical entity on the controller.
  • Management interface (static and configured at setup time; mandatory)
  • AP-manager interface (static and configured at setup time; mandatory)   
Note You are not required to configure an AP-manager interface on Cisco 5500 Series Controllers.
 
  • Virtual interface (static and configured at setup time; mandatory)
  • Service-port interface (static and configured at setup time; optional)
  • Dynamic interface (user-defined)
The management interface is the default interface for in-band management of the controller and connectivity to enterprise services such as AAA servers. It is also used for communications between the controller and access points

For CAPWAP, the controller requires one management interface to control all inter-controller communications and one AP-manager interface to control all controller-to-access point communications,

A controller has one or more AP-manager interfaces, which are used for all Layer 3 communications between the controller and lightweight access points after the access points have joined the controller. The AP-manager IP address is used as the tunnel source for CAPWAP packets from the controller to the access point and as the destination for CAPWAP packets from the access point to the controller.

The virtual interface is used to support mobility management, Dynamic Host Configuration Protocol (DHCP) relay, and embedded Layer 3 security such as guest web authentication and VPN termination. It also maintains the DNS gateway host name used by Layer 3 security and mobility managers to verify the source of certificates when Layer 3 web authorization is enabled.

Dynamic interfaces, also known as VLAN interfaces, are created by users and designed to be analogous to VLANs for wireless LAN clients





DHCP

DHCP proxy mode  -  DHCP helper function

DHCP bridging mode - Transparent in DHCP Transaction.




















https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/110865-dhcp-wlc.html


==================

Virtual WLC

optional access port for the Service Port  - vNIC1
trunk for Dataport                                     - vNIC2



===========================


(Cisco Controller) >show debug

MAC Addr 1.................................. 4A:C3:B5:7B:21:FA

Flex-AP Client Debugging ................... disabled
Flex-Group Client Debugging ................ disabled

Debug Flags Enabled:


(Cisco Controller) >
(Cisco Controller) >
(Cisco Controller) >debug mobility handoff enable

(Cisco Controller) >
(Cisco Controller) >show debug

MAC Addr 1.................................. 4A:C3:B5:7B:21:FA

Flex-AP Client Debugging ................... disabled
Flex-Group Client Debugging ................ disabled

Debug Flags Enabled:
  dhcp packet enabled.
  Client Event enabled.
  dot11 mobile enabled.
  dot11 state enabled
  dot1x events enabled.
  dot1x states enabled.
  mobility global handoff enabled.
  mobility client handoff enabled.
  pem events enabled.
  pem state enabled.
  802.11r event debug enabled.
  802.11w event debug enabled.
  CCKM client debug enabled.


(Cisco Controller) >
(Cisco Controller) >
(Cisco Controller) >debug client ?

<MAC addr1>    Enter MAC address

(Cisco Controller) >debug client 4A:C3:B5:7B:21:FA


=====


https://community.cisco.com/t5/security-knowledge-base/top-six-important-cisco-wlc-settings-for-ise-integration/ta-p/3643795

Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more