Autonomous: Multiple SSID With Multiple VLANs configuration example on Cisco Aironet APs

Cisco's Wireless TAC teams is one of the best around. Their group is small when compared to other groups like r/s and security. Ive had the pleasure to work with most if not all of them over the years by simply opening a TAC case and shooting the breeze. In most cases when I open a ticket the guys know me by name. Hey if you pay for TAC use it !

This video is by Surendra. Surendra is not only a bad ass Cisco TAC enigneer but he also leads the pack on Cisco Wireless Support forum. He is by far one of the most active Cisco Wireless TAC engineer contributors who gives back to the community.

In this video Surendra shows how to configure multiple SSIDs with multiple VLANs.

Guest Access with Mobility Anchor Chalk Talk

If you are new to Cisco Guest Access with Anchor controllers this is a good video to get the fundamentals down.

This video walks you through the anchor process. It also includes decodes which are boken down step by step.

https://supportforums.cisco.com/videos/1212

Sample:

(Cisco Controller) >

(Cisco Controller) >

(Cisco Controller) >Sat Sep 27 10:45:15 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68

Sat Sep 27 10:45:20 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 Adding mobile on Remote AP 00:00:00:00:00:00(0)

The anchor controller is informed of the association request from the client by the foreign controller. However, the anchor is not aware of the AP to which the client is associating, since the L1 and L2 parts of the connection are managed by the foreign controller.

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 START (0) Initializing policy

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state AUTHCHECK (2)

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 AUTHCHECK (2) Change state to L2AUTHCOMPLETE (4) last state L2AUTHCOMPLETE (4)

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 L2AUTHCOMPLETE (4) Change state to DHCP_REQD (7) last state DHCP_REQD (7)

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 Stopping deletion of Mobile Station: (callerId: 53)

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 DHCP_REQD (7) State Update from Mobility-Incomplete to Mobility-Complete, mobility role=ExpAnchor

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 DHCP_REQD (7) Change state to DHCP_REQD (7) last state DHCP_REQD (7)

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 DHCP_REQD (7) pemAdvanceState2 3949, Adding TMP rule

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 DHCP_REQD (7) Adding Fast Path rule

  type = Airespace AP - Learn IP address

  on AP 00:00:00:00:00:00, slot 0, interface = 1, QOS = 0

  ACL Id = 255, Jumbo Frames = NO, 802.1P = 0, DSCP = 0, TokenID = 5006

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 DHCP_REQD (7) Successfully plumbed mobile rule (ACL ID 255)

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 Set bi-dir guest tunnel for 00:0e:35:f3:60:53 as in Export Anchor role

The anchor controller is being informed that the client passed the L2 authentication and that, after successful association, it is now going into the DHCP_REQD state.

Also, the controller is updating its status to be the Export Anchor for this client.

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 Added NPU entry of type 9

The client entry is added to the Network Processing Unit (NPU) of the controller with an IP address of 0.0.0.0: this means that the client is successfully associated, but it does not have an IP address yet.

Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 Sent an XID frame

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP received op BOOTREQUEST (1) (len 308, port 1, encap 0xec00)

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option len (including the magic cookie) 72

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: message type = DHCP DISCOVER

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: 116 (len 1) - skipping

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: 61 (len 7) - skipping

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: 12 (len 7) - skipping

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: vendor class id = MSFT 5.0 (len 8)

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: 55 (len 11) - skipping

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP options end, len 72, actual 64

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP selecting relay 1 - control block settings:

                        dhcpServer: 0.0.0.0, dhcpNetmask: 0.0.0.0,

                        dhcpGateway: 0.0.0.0, dhcpRelay: 0.0.0.0  VLAN: 0

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP selected relay 1 - 192.168.51.1 (local address 192.168.51.203, gateway 192.168.51.1, VLAN 601, port 1)

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP transmitting DHCP DISCOVER (1)

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP   op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 1

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP   xid: 0xd5771135 (3581350197), secs: 0, flags: 0

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP   chaddr: 00:0e:35:f3:60:53

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP   ciaddr: 0.0.0.0,  yiaddr: 0.0.0.0

Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP   siaddr: 0.0.0.0,  giaddr: 192.168.51.203

Cisco - "Don't Forget Spectrum" - DFS Testing

Cisco's short video on DFS and their wireless controller solution. Its a quick video on DFS and client capacity testing taking advantage of DFS UNII-2 Extended. 

 They also take a poke @ Aruba in the process... :P

Cisco - Cisco CleanAir 3500 vs Aruba’s ARM Video

  

Cisco demonstrates their latest access point offering the Cisco CleanAir 3500 access point / spectrum analyzer vs Aruba's ARM.

It was no secret when Cisco purchased Cognio their intentions were to integrate the spectrum chip technology on the board of a Cisco access point. In fact shortly after the purchase of Cognio we met with Cisco Engineering for a large deployment we were working on outside of San Jose. A Cisco Wireless engineer in the "know" commented, "With our recent purchase of Cognio we will bring spectrum analysis never seen before in the enterprise -- On each AP -- just give it a little time and you wait and see". Fast forward to today --- behold the CleanAir 3500. 

Cisco brings to the table a technology offering other vendors can't come close to and at a price point that makes it affordable for full scale deployments (if you have a little bigger wallet of course)! Cisco's RRM like Aruba’s ARM leverages WiFi chip technology whereby analyzing a noise floor via channel scanning. I’m not sold on RRM and ARM technology; however I'm "drinking" Cisco CleanAir. Call me old school I suppose! I've done my own testing introducing interference on channel and observed mixed results of dynamic channel allocation with both Cisco RRM and ARM. 

Marcus Burton from CWNP did a great evaluation of the 3500. Read more about it here:

http://www.cisco.com/en/US/solutions/collateral/ns340/ns394/ns348/ns1070/Cisco_Premium_final.pdf 

"While other vendors have previously claimed spectrum-level visibility in their APs, they suffer from the unfortunate effect of ill-advised marketing. What is billed by some as “spectrum analysis” is nothing more than 802.11 Wi-Fi utilization analysis, or very, very minimal spectrum data. A good feature, but it’s not true, useful spectrum analysis." - Marcus Burton / CWNP

NOTE: (From Jim Jim Florwick @ Cisco)

Launch details are located here:

http://www.cisco.com/en/US/partner/netsol/ns1070/networking_solutions_package.html

Licensing is based on system compomnents and levels.  At the base level - a Cisco 3500 AP and a controller running version 7.0 code wil provide full view of current CleanAir information and supports the full mitigation features as well as Spectrum expert connect feature.

Adding WCS will allow historical reporting of AirQuality metrics and monitoring of security related IDR's (Interference Device Reports).  As well as inclusion of a CleanAir Dashboard and trending information with regards to AirQuality.  This is available with the WCS base license.

Adding the MSE to the system provides a great deal of functionality including historic Interference specific reports, and location (current and historical) of interference devices.  The MSE requires that WCS have a plus license - and will also require CAS (Context Aware Sevice) license seats for the individual interference targets.

At present there will be free CAS licenses offered with bundles of 3500 series AP's, up to 100 seats for 20 AP's.  Release date of the 7.0 software is targeted for the end of May as well. 

NOTE: Cisco CleanAir Technology At A Glance

http://www.cisco.com/en/US/solutions/collateral/ns340/ns394/ns348/ns1070/aag_c22-594304.pdf

Cisco – Cisco vs Aruba Client Density test with 802.11n

 

Cisco released another video on youtube.com. Where they conducted client density testing with a Cisco 1142 against Aruba's AP-105 and AP-125. The test was conducted with 2.4 GHz non-bonded and 5 GHz with channel bonding. Although, I would have liked more details on how the test were conducted and were the results consistent.

This video explains competitive WLAN high density test results assessing Cisco's AP1140, Aruba's AP-105 and AP-125 in the area of bandwidth fairness. For this test, each 802.11n Access Point was loaded up with 60 Intel 802.11n clients all attempting to download data simultaneously. Throughput per client was assessed using VeriWave's WaveAgent software which generated downstream TCP traffic.

Link: http://www.youtube.com/watch?v=Z5LLg6aky6A