Clearing CAPWAP AP config

Got multiple disks failure in my lab yesterday and fortunately not a lot of crucial VMs are affected.  One of those is the vWLC that I've used for my home AP.  As I've configured FlexConnect, the AP still works fine without the presence of the controller, however I still want to fix it otherwise I can't make changes in the future.

After rebuilding the vWLC with the same IP address, the AP failed to register to the new vWLC.

*Jul  5 10:56:02.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.24.70 peer_port: 5246
*Jul  5 10:56:02.015: %CAPWAP-1-SSC_CERT_AUTH_FAILED: Failed to authorize controller, SSC certificate validation failed.Peer certificate verification failed FFFFFFFF
*Jul  5 10:56:02.015: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:509 Certificate verified failed!
*Jul  5 10:56:02.015: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 192.168.24.70:5246
*Jul  5 10:56:02.015: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.24.70:5246

It didn't look right to me, and after trying a few things, this error didn't go away.  So what I have to do is to remove write erase the AP.  You can do it from console or telnet, if telnet is enabled.  I have got telnet enabled so I telnet to my AP, and use the following commands:

! This command is the most important, without this you can't use the clear capwap commands
debug capwap console cli

then

clear capwap private-config

Or you can also simply write erase the AP.  After that, configure option 43 hex in the dhcp pool.  I've only one controller so the prefix to add is f104, follows by the hex of my controller IP address 192.168.24.70.

option 43 hex f104.c0a8.1846

Too lazy to convert it manually, I just used the calculator here:

http://networkguy.de/?page_id=903

And now all works great!  Everything back to normal!

New Wireless phone 8821 is now available

After a prolonged wait, the next generation of 7925 is released.  A few things noted from the datasheet, including hardened design with IP67 and MIL-STD-810G compliant, security enhancement by supporting SHA2 and SCEP, and better wireless radio by supporting 11ac.

8821 datasheet:
http://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/wireless-ip-phone-8821/datasheet-c78-737346.html?cachemode=refresh

8821-EX datasheet:
http://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/wireless-ip-phone-8821-ex/datasheet-c78-737347.html?cachemode=refresh

Virtual Wireless LAN Controller now supports AVC

Just upgraded my vWLC to 8.1.102 and now it supports AVC in Virtual Wireless LAN Controller in FlexConnect Mode.  The configuration is simple and the graph looks cool!

All you need to do is check this checkbox under your WLAN, this is the FlexConnect enabled WLAN for my home:

At the Monitor > Summary page you can see the top applications statistics:

You can see the detail if you click "View All" with some nice graphs~

ISE 1.3 + vWLC 7.6 - Basic 802.1x Configuration for Wireless Devices

I have setup ISE 1.3 + vWLC 7.6 in my lab virtually on my UCS server.  Good thing is now ISE 1.3 comes with a OVA, which you can deploy and use immediately without lengthy installation.  It still needs to go through a wizard and need some time to initialize the database, but comparatively easier than pervious release.  vWLC also comes with a evaluation license that you can test things out after you accept the EULA.  Here is a step-by-step guide to configure basic 802.1x authentication for wireless devices using ISE local DB.

1.  Add ISE as Authentication Server, 192.168.24.71 is my ISE IP address.

2. Add ISE as Accounting Server

3. Add a WLAN, the SSID of my testing WLAN is DW-BYOD

Remember to enable AAA Override, choose Radius NAC under NAC state and check DHCP Profiling (this is just used to feed info to my ISE for device profiling).  In my lab I am using FlexConnect local switching therefore you can see I have checked that checkbox.

4.  Create Users on ISE, now I am going to use the ISE local database.

Done!  You should now able to access your SSID using the user credentials that you have created in ISE local database.  

The next post we will go a step further, to configure BYOD with EAP-TLS and self on-boarding capability.

Meraki Facebook Wifi

Just got a chance to test out an interesting Meraki feature – Facebook wifi.  That is basically used for say for example a wireless hotspot, instead of showing a boring, standard splash page, now you are redirected to a Facebook page and you are required to "Check-in" before you can access Internet.  Meraki's management portal is very easy to use, basically you don't need any guides / manual to set things up.

This is the Facebook Wifi help page, currently only Meraki and CMX supports this type of integration:

https://www.facebook.com/help/facebookwifi

On the Facebook side, you need to make your page in the "Local Business" category, and provide a street address so that people can Check in to your place.  You can also configure the bypass mode, so that for people who do not have Facebook account, or don't want to use their Facebook account to check in, to either use a pre-shared code or even click through the splash page.

On Meraki you need to choose the splash page of your SSID to use Facebook Wifi:

Then it is all done!  You can now try to access Internet, you will be redirected to the Facebook check-in page before you can continue browsing the Internet.

Home Energy Control - On / Off AP via IP Phone

I have done this little trick at home and reason is to save energy and doesn't want to have my wireless network always on at home.  With this little trick, now I am managed to on / off my IOS AP with a single click.  :)

Demo Video (English)

Demo Video (Cantonese)

Using your MacBook as wireless access point

I am using a MBP and I don't want to setup a permanent wireless access point at home for some reason, so the easiest way for me to create a home wireless network occasionally is to using my MBP to share my wired connection with wifi.

To do it, first go to System Preferences, choose Sharing:


Then turn on the Internet Sharing.  Share your connection from:  "Ethernet", and To computers using "Wifi"



Your wireless icon on the top menu bar should change to:


You can optionally config security for your wireless network, however only WEP is supported  :(


My current OS Version when I write this post:  OS X Lion 10.7.3

Script to Turn off Cisco Autonomous Access Point radio interface

My environment: Cisco 861W

You can turn off the radio interface of the autonomous AP when you don’t use it to save power.

#!/usr/bin/expect

set timeout 5
log_user 1
set hostlist "pandaap01"
foreach host $hostlist {
set prompt [append $host "#"]
set promptcfg [append $prompt "(config)#"]
spawn telnet $host
expect $prompt
send "conf t\r"
expect $promptcfg
send "int dot11radio0\r"
expect $promptcfg
send "shut\r"
expect $promptcfg
send "end\r"
}

Cisco vs Aruba – 60-client High Density Test

Connect to a WPA-PSK wireless network on Slax

My environment: IBM Thinkpad T60 Centrino + SLAX 6.0.7 on my USB flash disk

Slax is a very lightweight and portable linux OS and I have just tried it on my USB flash disk, it is so easy to use that I can build it from stretch and connect to my home wifi within half an hour. Here is a short tutorial in how to connect it to my WPA-PSK protected wireless network.

1. Get your Slax here:
http://www.slax.org/get_slax.php

You can either burn it on your CD or download and extract the tarball to your USB flash disk. Run the bootinst.bat or bootinst.sh to make it bootable.

2. Download wpa_supplicant from http://www.slax.org/modules.php?action=detail&id=533. Move this module into /mnt/sdb1/modules, where sdb1 is the USB flash disk in my case.

3. Create the wpa_supplicant.conf config file in /mnt/sdb1/rootcopy/etc. Here is an example:

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
eapol_version=1
#ap_scan=0
#fast_reauth=1

network={
ssid="pandassid"
key_mgmt=WPA-PSK
proto=WPA
pairwise=TKIP
group=TKIP
psk="ilovethisblog"
}

4. Reboot it and then run this in your terminal:
wpa_supplicant -d -iwlan0 -c/etc/wpa_supplicant.conf -Dwext

5. You should receive confirmation on the terminal saying your key is accepted. Open another terminal and run the following:

iwconfig wlan0 essid pandassid
dhcpcd -G 192.168.1.0 wlan0

6. Done!!

Enable World Mode

I have a -W 7921 wireless phone and -N 1242 autonomous wireless access point, it takes me some time to troubleshoot why it can't get connected. The answer is world mode. When you enable world mode, the AP adds channel carrier set information to its beacon. Client devices with world mode enabled receive the carrier set information and automatically adjust their settings.

Example
int dot11radio 0
world dot11d country-code US both

LWAPP Join-Request does not include valid certificate CERTIFICATE_PAYLOAD

If you get this message, 90% of chance you've got the wireless lan controller date wrong. Do a "show time" and you will suprise! I saw that I am in the year of 2029 when I do a "show time" on WLC. Fix it and it will work.

Erase Lightweight access points configuration

Once your lightweight Aironet access points register with the Cisco wireless lan controller, you can't change the ip address and controller information via console. So if you want to move the LWAP from one controller to the other, and if you have static address configured. You will have trouble. To clear the LWAP configuration, you can console to the access point and do the following:

1. Disconnect the ethernet connections
2. "clear lwapp private-config"
3. If you see the errors "ERROR!!! Command is disabled", you still have another way. Do a "debug lwapp console cli"
4. write erase
5. reload

Linksys WUSB54G v4 driver on 64-bit Vista

It takes me some time to find it on net, eventually got it from the Linksys forum.

http://forums.linksys.com/linksys/board/message?board.id=Wireless_Adapters&message.id=2371

You can download the driver directly from here.

Still figuring out how to get it working on my RH FC8 partition, tried the rt2570 driver but seems can't get it working yet. If anybody tried it before, feel free to leave a message here :)

Linksys WVC 200 Snapshots

Linksys WVC200 wireless surveillance camera gives you a way to take snapshots and you can then show or store it.

Take snapshots
http://cam-ip/img/snapshot.cgi?size=640x480
http://cam-ip/img/snapshot.cgi?size=320x240
http://cam-ip/img/snapshot.cgi?size=160x128

Return low quality image
http://cam-ip/img/mobile.htm

Query cam configuration
http://cam-ip/util/query.cgi

Mobile Telepresence on Cisco NERV

Cisco has installed mobile TelePresence on the Network Emergency Response Vehicle.

The Network Emergency Response Vehicle (NERV). Basically, a mobile communications vehicle that can act as a command center for your on-the-ground disaster management, as well as a central processing center for all the communications going on for that effort. Through Cisco's IPICS technology, which allows disparate radio systems to communicate with each other via IP translation, police, who are on one radio system, can talk with fire professionals who are on another radio system, who can talk with the National Guard, who are on another radio system. The NERV also has TelePresence, video surveillance, Wi-Fi, satellite communications, and IP telephony on-board.

In this short video, Bob Browning, Senior Manager of Tactical Operations Support at Cisco, gives us a tour of the NERV's technology and capabilities. This vehicle just returned from the Harris Fire and is exactly why interoperable communications systems are essential to successful disaster response and recovery.

Upgrading Cisco Aironet AP from autonomous to lightweight

If you are using 1130AG or 1240AG access points, congratulations you can upgrade from autonomous to lightweight.

For all IOS-based 1200 series modular access point (1200/1220 Cisco IOS Software Upgrade, 1210 and 1230 AP) platforms, it depends on the radio:

–if 802.11G, MP21G and MP31G are supported

–if 802.11A, RM21A and RM22A are supported

The 1200 series access points can be upgraded with any combination of supported radios: G only, A only, or both G and A.

Do a "show controllers" command to see which radio chipset you are using.

http://www.cisco.com/en/US/docs/wireless/access_point/conversion/lwapp/upgrade/guide/lwapnote.html