Wireless Tech Field Day Starts today @ San jose #WFD3

I am very humbled to be asked back to participate as a delegate in WFD3, presented and hosted by GESTALT IT.  WFD3 <Wireless Field Day 3> brings some new vendors and new delegates together for yet another event filled wireless geek gathering.  “ GESTALT IT Independent Experts United “ 

WFD is an event where industry users <experts in some cases> come together with wireless vendors to discuss wireless, technology road map and issues and features with the respected vendors. This allows vendors first hand experience with users who may be using their product already, whereby providing valuable feedback or in some cases introducing their product to users for the first time.

WFD is also a large social media event. WFD has hundreds and sometimes thousands of like minded folks who will follow along and sometime paticpate in twitter feeds from each event. 

This particular WFD3 brings together both hardware and software vendors. 

Sponsoring Vendors 

I would like to personally thank Aerohive, Aruba, Cisco, Meraki , Metageek and Ruckus for their repeated support and sponsorship of WFD. I would also like to thank and welcome Tabaza, Wildpackets and Juniper who are new sponsors.

                         

        

WFD3 Delegates

WFD brings together like minded individuals who share common interest in technology, in the case of WFD, lets just say, it’s wireless geek week at its best! Each delegate brings a unique real world experience and perspective. Some delegates work for VARS, others are independent consultants or end users. 

WFD3 delegate notables:

Blake Krone - CCIE Wireless

Keith Parsons -  CWNE, Wifi Industry Expert and mentor to many of us 

Gregor Vucanjnk - CWNE, Recently minted <like last week recent -CONGRATS>

Tom Carpenter - CWNP 

Jennifer Huber - CWNE

Below are all attending delegates:

	Blake Krone	@BlakeKrone
	Chris Lyttle	@WiFiKiwi
	Daniel Cybulskie	@SimplyWiFi
	George Stefanick	@WirelesssGuru
	Gregor Vučajnk	@GregorVucajnk
	Jennifer Huber	@JenniferLucille
	Keith R. Parsons	@KeithRParsons
	Rocky Gregory	@BionicRocky
	Ryan Adzima	@RAdzima
	Sam Clements	@Samuel_Clements
	Scott Stapleton	@ScottpStapleton
	Sean Rynearson	@SRynearson
	Tom Carpenter	@CarpenterTom

Vendor Questions and Perspective

As a wireless architect for a large and world renown healthcare system I will be focusing my questions and comments around healthcare specific WiFi. WiFi in healthcare presents very unique challenges. Real time applications requiring wire like connectivity and reliability. Large HC systems can have thousands of WiFi devices from COWs, mobile desktops, tablets, handhelds, scanners, RFID tags and the list goes on. 

I am interested in how each hardware vendor is handling 802.11u, 802.11w, BYOD, MESH, 802.11ac, 802.11r and especially the APPLE explosion in Healthcare. These are hot buttons on my plate as well as many other Healthcare WiFi professionals.   

• Healthcare is facing tighter budgets due to recent reform. Health Systems need to be cost aware when making purchases and get more bang for the buck. How are vendors positioning their product to compete in the current Healthcare market.
• BYOD and on boarding challenges and cost associated. Healthcare is leading the charge with BYOD. The sheer volume of WiFi devices contained within most hospital systems is larger than the population of some towns!
• How does Cisco’s new HA license and vWLC change the game ?
• Built in Rogue and wIPS systems - most are clunky and dont work well and have a cloud of mystery behind them.  
• How are vendors supporting the APPLE explosion. Any new features or roadmap to better support troubleshooting and making up for APPLE deficiencies. 
• Are vendors partnering with Apple to provider a better WiFi user experience. Looking for vendor perspective on the Apple road map, what are they doing with Apple to make our life easier
• PCI and HIPAA any new or existing features that allow admins to pull relevant data. Does this cost extra ?
• Vendors take on controller vs. controllerless  platforms<We know where Aerohive stands :) >
• How secure is WiFi “cloud” computing - Vendor perspective?
• Remote Office Solutions - Vendor perspective ?
• 802.11ac roadmap 

I am a BIG fan of Wildpackets. There is no better wireless sniffer in the world. Excited to meet the wildpackets team. 

Never used Tanaza, very interested to hear about their offerings. 

My friends, we are in a middle of a compelling wifi convergence. Never before has WiFi seen the attention or the publicity like it has in recent years. WiFi is a moving force like no other, you cant stop it nor can you contain it. Most of the population on planet earth knows what WiFi is. Just grab on and enjoy the ride!

WTD3 Schedule:

Wed, Sep 12	15:00-17:00	WildPackets Presents at Wireless Field Day 3
Wed, Sep 12	16:30-17:00	Dinner with Aerohive at Wireless Field Day 3
Thu, Sep 13	08:00-10:00	MetaGeek Presents at Wireless Field Day 3
Thu, Sep 13	10:30-12:30	Ruckus Presents at Wireless Field Day 3
Thu, Sep 13	13:30-14:30	Tanaza Presents at Wireless Field Day 3
Thu, Sep 13	16:00-18:00	Meraki Presents at Wireless Field Day 3
Fri, Sep 14	08:00-12:00	Aruba Presents at Wireless Field Day 3
Fri, Sep 14	13:30-15:30	Cisco Presents at Wireless Field Day 3
Fri, Sep 14	16:00-18:00	Juniper Presents at Wireless Field Day 3

WFD3 will be broadcasted LIVE at the following link at the above scheduled times:

http://techfieldday.com/event/wfd3/  

EVENT STAFF

A big thank you to Stephen Foskett for putting up with "us" wireless geeks and hosting another great event!

	Benjamin Freedman	@PrimeImageBen
	Scott D. Lowe	@OtherScottLowe
	Scott Sexauer
	Stephen Foskett	@SFoskett

High Availability (HA) Feature <7.3> Deployment Guide

There has been lots of questions about the new 7.3 HA mode. This document will answer most of your questions. Just released by Cisco 

LINK BELOW:

http://www.my80211.com/storage/online-pdf-downloads/high-availability-dg-00.pdf

Cisco Office Extends: Wired Side (LAN) Bug CSCtq76431

Cisco Office Extends bug -- What you should know if you're having wired side (LAN) connectivty issues.

If you configure your OfficeExtends for the LAN and you arent getting an IP address and no connectivity on the wired I might suggest you check your WIRELESS PHY RATES. You should have atleast one 802.11b mandatory rate 1,2,5.5 or 11. 

CSCtq76431            Bug Details

Evora:Remote LAN client fails association w/ 802.11b rates not mandatory.

Symptom: Remote LAN client(s) fail association to wired remote LAN tunneled to WLC.  On OEAP 602 event log: *Jun 03 17:01:39.066: (Re)Assoc-Req from 48:5b:39:13:99:bd forwarded to WLC, wired: yes *Jun 03 17:01:39.082: received assoc-rsp for idx=3, status=18 From WLC debug client: *apfMsConnTask_3: Jun 03 13:01:31.832: 48:5b:39:13:99:bd Sending Assoc Response to station on BSSID ec:c8:82:c0:25:20 (status 18) Ap VapId 2 Slot 0 Conditions: WLC that supports OEAP 602 running 7.0.116.0 with 802.11g data rate configured as MANDATORY (6,9,12,18,24,36,48,54). Workaround: Do not set 802.11g datarates to Mandatory. CISCO BUG TOOL KIT UPDATE  Status   Fixed  Severity   3 - moderate  Last Modified   In Last Year  Product   Cisco IOS software  Technology   Wireless, LAN (WLAN)  1st Found-In   7.0(116.0)  Fixed-In   7.2(1.55) 7.2(103.0)

Cisco 7.3 Release Notes: WLC, MSE and NCS

Links to 7.3 Release Notes

WLC : http://www.cisco.com/en/US/products/ps10315/prod_release_notes_list.html

NCS :  http://www.cisco.com/en/US/products/ps12239/prod_release_notes_list.html

MSE : http://www.cisco.com/en/US/products/ps9806/prod_release_notes_list.html

Autonomous IOS Support for 3500, 3600 and 1550 (Mesh) Series Access Points 15.2(2)JA

The long awaited code that will allow engineers everywhere to survey with 3500, 3600 and 1550 access points!

Site-Survey Only Mode for 3600, 3500, and 1550 Access Points

You can install Cisco IOS Release 15.2(2)JA on Cisco Aironet 3600 and 3500 Series access points and

on 1550 series outdoor access points to perform site surveys. This release runs on these access points

with limited functionality. You can manually adjust these settings on the site-survey access points:

• Channel on each radio

• Transmit power on each radio

• Enable and disable the radios

• Manually set basic and supported transmit rates

• Enable advertised cell power in beacons to client to enable DTPC for doing active surveys

• Enable and disable SSID broadcast in beacons

• Enable open authentication

Enhanced Support for Workgroup Bridges

This release provides additional support for access points in workgroup bridge mode:

• PEAP support for WGB: An access point configured as a workgroup bridge can now associate to a

root access point using PEAP

• Roaming improvements (for client workgroup bridges):

– This release improves the reliability of fast roaming on workgroup bridges by allowing the unit

an additional retry when it needs to reassociate to the root access point.

– This release also improves the method that workgroup bridges use to select the “best parent”

access point. Workgroup bridges can share association histories with rot access points, which

can build and share a list of best root access points among workgroup bridges. This method

improves helps workgroup bridges select the best root access point when roaming.

• VideoStream support on workgroup bridges (when used as a client): VideoStream improves the

reliability of an IP multicast stream by converting the multicast frame, over the air, to a unicast

frame. VideoStream was not supported for workgroup bridge clients in previous releases because a

workgroup bridge’s wired clients cannot be added to the controller (WLC) multicast table. In this

release, the workgroup bridge is added to the WLC multicast table, and the workgroup bridge

converts the VideoStream unicast frame into an Ethernet multicast frame and sends it out to its wired

clients.

Enter this command on the controller to enable VideoStream for workgroup bridges:

config media-stream wired-client enable

RELEASE NOTES ATTACHED: http://www.my80211.com/storage/release-notes/15_2_2_JA2.pdf

Converting a LDPE controller image to non LDPE

From Cisco's Kangupta

Many times we see instances where the RMA controller is shipped with an LDPE image.

 (Cisco Controller) >show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.Product Name..................................... Cisco Controller
Product Version.................................. 7.0.116.0
Bootloader Version............................... 1.0.1
Field Recovery Image Version..................... 6.0.182.0
Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27
Build Type....................................... DATA + WPS + LDPE

An upgrade to an non LDPE code fails with this error-

"ERROR: Incompatible SW image.ERROR: Please install the Data Payload Encryption licensed image"

The LDPE image is used for Customers who are not legally allowed to use DTLS Data encryption within their regulatory domain (Russia-specific).

Conversion from LDPE to a non LDPE image

1)      Upgrade WLC to 7.0.230.0 LDPE image- e.g.  AIR-CT5500-LDPE-K9-7-0-230-0.aes for a 5508

2)      Download and install a free DTLS license from Cisco.com (if one is not already installed):

To Obtain a Data DTLS License:

Step 1 Browse to http://cisco.com/go/license

Step 2 Under Get New, choose IPS, Crypto, Other Licenses

Step 3 Choose the controller platform, enter the product ID and serial number.

Step 4 Complete the remaining steps to generate the license file.  The license will be provided online or via email.

Step 5 Copy the license file to your TFTP server.

Step 6 Install the license by browsing to the WLC Web Administration Page:

Management --> Software Activation --> Commands -->Action: Install License

3)      Once the DTLS license is installed, you will be able to upgrade/downgrade to any WLC code (including Non-LDPE).

(Cisco Controller) >show license summary 

License Store: Primary License Storage
StoreIndex:  0  Feature: base                              Version: 1.0
License Type: Permanent
License State: Active, Not in Use
License Count: Non-Counted
License Priority: Medium

License Store: Primary License Storage

StoreIndex:  1  Feature: base-ap-count                     Version: 1.0
License Type: Permanent
License State: Active, In Use
License Count: 500 /1 (Active/In-use)
License Priority: Medium
License Store: Primary License Storage

StoreIndex:  2  Feature: data_encryption                   Version: 1.0

        License Type: Permanent

       License State: Active, In Use

        License Count: Non-Counted

        License Priority: Medium

If the controller is on 7.0.116.0 LDPE code; you installed the DTLS license and then try to migrate to non LDPE code version of 7.0.116.0, it would fail with the following error-

*Transfer: Mar 28 11:32:56.609: RESULT_STRING: Transfer failure :

Upgrade from LDPE to non LDPE software is not allowed.

So, you will need to get on to 7.0.230.0 LDPE image (e.g.  AIR-CT5500-LDPE-K9-7-0-116-0.aes for a 5508) first before you can move to a non LDPE code.

This capability was introduced via CSCtw78061; meaning after installing the DTLS license you can download normal image from LDPE code just fine.

Symptom: No upgrade/downgrade is allowed from LDPE image to NON_LDPE image.

Conditions: transfer download of non-ldpe image from ldpe image

Workaround: if there is a dtls license installed and active, then upgrade/downgrade of non-ldpe image from a ldpe image is allowed.

This is addressed in 7.0.230.0 and 7.2.104.24

Cisco Wireless Phone Deployment Guide Update 1.4(2) - 8/14/2012

UPDATED Cisco Wireless Handset Deployment Guide

7921G Deployment Guide – 1.4(2) Update

http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/7921g/6_0/english/deployment/guide/7921dply.pdf


7925G, 7925G-EX, and 7926G Deployment Guide – 1.4(2) Update

http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/7925g/7_0/english/deployment/guide/7925dply.pdf

Click to read more ...

Web auth (redirect) doesn't work when client uses a https url: CSCar04580 Bug

Issues with your Cisco Wireless Guest Network not doing a web redirect ?

This is very good to know, incase you get calls that your wireless guest network is broken. The WLC will not redirect HTTPS urls.

Assume for a moment your guest has a browser home page that is https:// (443) or he / she attempts to open a https:// page, prior to the AUP. The user is expecting to get redirected, but nothing happens.

The Guest will sit and spin giving the impression the guest network is not working properly, but in fact the WLC is not redirecting HTTPS traffic, only HTTP traffic to the AUP.

CSCar04580 Bug Details

web auth (redirect) doesn't work when client users a https url
Symptom: A client whose home page is an HTTPS (HTTP over SSL, port 443) one will never be redirected by Web Auth to the web authentication dialog. Therefore, such a client will not know to authenticate, and will fail to connect to the network. Workaround: The client should attempt to open any HTTP (port 80) web page.	Status Terminated Severity 2 - severe Last Modified In Last Year Product Cisco 5500 Series Wireless Controllers Technology 1st Found-In 3.2(78.0) 6.0(182.0) 7.0(98.0)
Related Bug Information Webauth redirection doesn't happen with HTTPS URL Symptom: Redirect of https traffic on webauth does not work in any version of code. The 'network web-auth-port #' does nothing. Workaround: The business unit considers this an enhancement.

ACS 5 gives alert after 20,000 radius probes: Bug CSCtj69797

Ive been meaning to blog about this bug on the ACS 5.x platform, but forgot until this week when the alert surfaced again.

This bug is cosmetic only and doesn't impact performance. ACS sends a nice orange alert when 250,000 cached sessions are cumulated and should delete 20,000 sessions. I was worried at first, when I think “sessions” I think EAP.

I opened up a TAC case and got a rockstar ACS TAC engineer.  Sorry, but I cant share his name, somethings need to be kept confidential, especially a great resource !  In short, a “probe” counts as a session.

Say for example a device wants to authenticate it will send a probe and sometimes it will send multiple probes. Not to be confused with 802.11 probe request / response frames.  Rather, its a radius probe.

A wireless example would be a client that doesn't support PMK cache / OKC. Every time this client would roam, he would probe the radius server again to re-authenticate. So you can see, you could rack up the session pretty quickly in a large environment.

What happens is that every time a user tries to authenticate using radius the device will send a probe in order to see if the ACS is up and running we can also have this configured to happen even if there is no authentication going by doing radius-server retransmit command. So if for example 20 user try to authenticate using radius than 20 radius probes are send to the ACS. It is not dependent on the amount of devices it more with the amount of user and the amount of authentication request they generate.
 
Remember that the reason you are receiving the alarm is because the ACS doesn’t delete the 20000 sessions which he should do automatically therefore the bug was opened.

                                                                                                                          -TAC

CSCtj69797 Bug Details

ACS 5 gives alert after 20000 radius probes

Symptom:

ACS View giving alert when 20 000 sessions are reached.
The problem is that it seems to be triggered also with "radius probes", i.e. authentication packets with no accounting done.
So for example with several ACE appliances doing radius probes, this alert is reached very quickly

Conditions:

Radius authentication packets with no accounting happening in a frequent way

Workaround:

Only an alert.

**** There is another work around whereby you make a filter so that you no longer get the alerts. Consult TAC *** - George

Status  
Terminated

Severity  
3 - moderate

Last Modified  
In Last month

Product  
Cisco Secure Access Control Server Solution Engine

Technology  

1st Found-In  
5.1(0.44)

VOCERA B2000 MANUFACTURER DISCONTINUATION ANNOUNCEMENT

Received this in the mail box today!

Correction Notice:

In a previous email, the Vocera B2000 Discontinuation Notice below contained a typo which incorrectly stated the last date of purchase for the B2000 1-year warranty extension. The date is June 30th, 2013 and the information has been corrected below. We apologize for any inconvenience.

VOCERA B2000 MANUFACTURER DISCONTINUATION ANNOUNCEMENT

With the introduction of the B3000 Communication Badge in October 2011, we feel it is appropriate to ensure our customers understand the plan for the discontinuation of the B2000 Communication Badge and support. Our goal is to provide you with the information necessary to ensure you continue to enjoy the value of the Vocera solution and allow you ample opportunity to plan for the transition to our latest technology.

Note: This discontinuation notice does not apply to the FIPS 140-2 certified Vocera badge designed specifically for Federal or DoD customers.

The following are the key milestone dates:

B2000 orders/shipments

• June 30, 2013; Final date to order a B2000
• September 30, 2013; Customers must take shipment no later than September 30, 2013.

Extended warranty

• December 31, 2012; Final date to purchase a 2 year extended warranty with a B2000
  purchase
• June 30, 2013; Final date to purchase a 1 year extended warranty with a B2000 purchase

Batteries, chargers, lanyards & universal clips

December 31, 2015; last date to order B2000 accessories, batteries, chargers, lanyards and universal clips

Firmware support

June 30, 2016; last date for firmware support, this will only include bug fixes related to overall Badge stability or network interoperability. Beyond June 30, 2016, Vocera will make a best effort to address firmware issues but may be limited by the engineering support we receive from component manufacturers.

Hopefully you have had a chance to discuss the B3000 with your local sales or support representatives. The B3000 introduces significant enhancements to the B2000 based on direct feedback from customers such as you. These include a highly ruggedized design, acoustic noise reduction technology, smart battery to just name a few. Additionally, we have introduced a number of programs to help you more easily transition to the B3000 Communication Badge. We would encourage you to contact your local Vocera sales representatives or call 1-877-790-4190 to discuss which options would best support your goals to continue to provide the best possible experience for your patients and staff.

Sincerely,

Debashis Pramanik
Director, Hardware Product Management

Cisco Guest Anchoring and Office Extends (PORTS)

Quick visual ~ Cisco Guest Anchoring and Office Extends Ports

Let me know if I missed any!

ENJOY!

DOWNLOAD

Passing the CWSP (Certified Wireless Security Professional) - My 2 cents

Last week I sat the CWSP exam and passed on my first attempt. My overall score was 91%. I want to share my insight into the exam and what I used to prepare.

CWSP VALUE

The CWSP study material sets the foundation of 802.11 security. Its the building blocks to understanding how 802.11 security works from encryption, EAP, dynamic key generation, security policy, roaming and the 802.11 standard. For anyone who  troubleshoots, designs, deploys or debugs 802.11, the CWSP compliments your abilities.

There is a tremendous amount of value contained in the CWSP study guide, should you choose not to actually go for the certification itself. I can not tell you how many times, over and over again where I referenced martial in the CWSP for colleagues and customers. There is instant creditability when you can speak confidently in great detail about the inner workings of 802.11.  

FOUNDATION LEARNING

If I can offer one valuable piece of advice. Never skimp on foundation learning. Understanding, in detail, how the different 802.11 security components and mechanics work are critical. Cause, as you will learn, may of the new and future standards are almost always applied to the existing mechanics. A solid foundation lends to better comprehension of future advancements in 802.11.

CWSP EXAM OBJECTIVES

Taking any exam, its importance to read the exam objectives. Objectives are the clear definition of what you will be tested on. There should be no surprises, if your study efforts are inline with the objectives. Also, don’t start carving up the objectives and think that this section is only worth 5% and not give it your all, when it comes to studying. All objectives should be studied.

It is also important to take these objectives, break them out and reference other authored material for a different perspective on the subject. I used the following:

802.11-2007 Standard

Cisco Wireless LAN Security ISBN: 1-58705-154-0

CWNP White Papers

- 802.11i Authentication and Key Management (AKM) White Paper
http://www.my80211.com/storage/online-pdf-downloads/Chicken_Egg.pdf

Robust Security Network (RSN) Fast BSS Transition (FT) White Paper
http://www.my80211.com/storage/online-pdf-downloads/802.11_RSN_FT.pdf

CWNP Website - CWSP
http://www.cwnp.com/certifications/cwsp

CWNP Forums - CWSP
http://www.cwnp.com/bbpress/forum.php?id=10

CWNP Self Study Material - CWSP
http://www.cwnp.com/training/selfstudy

TAP RESOURCES

If you’re studying a topic and something just doesn't make sense, tap a knowledgeable source. I always enjoy talking geek details with my friends to get a different spin on things.

TAKE NOTES

Its simple, to pass the CWSP, it requires a great deal of attention to detail. Take notes often and frequently on all subjects. I used mental case and flashcardexchange.com to store and reference my notes.

You can find a few of my notes here for reference:
http://www.my80211.com/8021x/
http://www.my80211.com/security-labs/
http://www.my80211.com/cwsp-george-stefanick/

READ READ READ

You probably will not believe me when I tell you I read the CWSP study guide over 20 times, cover to cover, but I did. Read a book over and over is much like watching a move a number of times. You catch little things you missed the first, second or third time around. I got into a habit of reading a chapter a night.

PRACTICE EXAMS

CWNP.COM has a number of CWSP practice exams. The CWSP study guide includes a CD with exam questions as well. Do them often and pay very close attention to the questions being asked. Don't study the questions, rather study the content of the question being asked.

MULTIPLE CHOICE

The CWSP exam is multiple choice. In almost all cases, if you are confident in your studies, you can quickly exclude one or more possible answers from your choices.

 

REAL WOLD EXPERIENCE

If you have experience with radius server configuration, 802.11 captures, and exposure to wireless equipment you will certainly improve your odds of passing. It would be a stretch to say, you NEED this hands on in order to pass, but it certainly helps!

Exam Score Card - Break Down

Note passing is 70% Overall

• Wireless Network Attacks and Threat Assessment 85%
• Monitoring & Management 85%
• Security Design and Architecture 93%
• Security Policy 100%
• Fast Secure Roaming 100%

Thank you CWNP

I want to thank all the good folks at CWNP for putting together a great exam and study guide. Also the fine authors - Coleman, Westcott, Harkins and Jackman for a job well done on great material.

CWSP is by far my personal best 802.11 security book ever read. Ive read it over 20+ times. Great read ...

I also want to mention --- thanks to Marcus for answering my, "HUH" questions and letting me bounce  random and sometimes confusing thoughts off of him. I really appreciate it.

I also want to thank Kevin for keeping CWNP relevant and restructuring the certification path and keeping the exam material relevant and up to date. I appreciate your dedication to the WiFi community.

Wireless Notification to Alaris Server and Cisco Systems Customers

This notice is from May 11, 2010. 

A little aged, yes. But if you're upgrading your wireless network and you have older Carefusion (Alaris) pumps take note of this notification, as it could impact you. Ask your Biomed group what code rev your pumps are on. Code revs prior to 9.5 may not be supported. You should contact your Carefusion rep for a firmware upgrade.

Features Not Supported on Cisco Flex 7500 Controller

These features are not supported on Cisco Flex 7500 Series Controllers code 7.0.116.0, it could change in future versions:

•Local mode AP (However AP joins 7500 initially as local mode and should be converted to Flex Connect mode)

•Mesh

•LAG

•Client and RFID tag location

•CCX CAC

•STP

•7500 as guest anchor

•L3 Roaming (Centrally switched wlan -> same and inter-controller)

•Multicast (Multicast - Multicast and Multicast - Unicast). (ignore - 7500 gui interface may still show multicast-multicast config.)

•VideoStream

•TrustSec SXP

•IPv6/Dual Stack client Support

•WGB

•OEAP

•HotSpot2.0 (802.11u)

•Client rate limiting for centrally switched clients

Cisco Flex 7500 Series Controller does not support the 802.1x security variants on a centrally switched WLAN. For example, the following configurations are not allowed(and TAC does not support) on a centrally switched WLAN

•WPA1/WPA2 with 802.1x AKM

•WPA1/WPA2 with CCKM

•Dynamic-WEP

•Conditional webauth

•Splash WEB page redirect

If you want to configure your WLAN in any of the above combinations, the WLAN must be configured to use local switching.

Note:

•Flex7500 supports 1Gbps central switched data throughput for guest access

•Only Flex connect mode AP is supported for data traffic

•Static AP-manager interface

(Note: For Cisco 7500 Series controllers, it is not necessary to  configure an AP-manager interface. The management interface acts like an  AP-manager interface by default, and the access points can join on this  interface.)

•AP joined on local mode should be converted to Flex/Monitor, TAC does not support local mode AP services.

7.2.103.0 supports 802.1X on Centrally switched wlan unlike 7.0.116.0.

From: Saravanan Lakshmanan - Cisco CSC

https://supportforums.cisco.com/docs/DOC-23474

End-of-Sale and End-of-Life Announcement for the Cisco Unified Wireless IP Phone 7921G Power Supplies

End-of-Sale and End-of-Life Announcement for the Cisco Unified Wireless IP Phone 7921G Power Supplies

Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco Unified Wireless IP Phone 7921G Power Supplies. The last day to order the affected product(s) is October 19, 2012. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.

Date: 2012-04-20 15:41:00.0

Url: http://www.cisco.com/en/US/prod/collateral/voicesw/ps6788/phones/ps379/ps7071/end_of_life_notice_c51-706105.html

Cisco WISM 2 Part Numbers: Quick Reference

I wanted to reference these part numbers as a quick reference for anyone that is looking for this information.

WISM 2 HARDWARE w/ SMARTNET

The WISM 2 hardware can be purchased in the available license sizes. They start at 100 and can be maxed out at 1000.  You receive the physical blade and license with the purchase of the below part numbers.

WS-SVC-WISM2-1-K9          100 access point       - CON-SNT-WSM2100 8x5xNBD
WS-SVC-WISM2-3-K9          300 access point       - CON-SNT-WSM2300 8x5xNBD
WS-SVC-WISM2-5-K9          500 access point       - CON-SNT-WSM2500 8x5xNBD
WS-SVC-WISM2-K-K9          1000 access point     - CON-SNT-WSM21K   8x5xNBD
 

WISM 2 ADDER LICENSES w/ SMARTNET

You can purchase additional licenses as you grow in 100 and 200 increments.

L-LIC-WISM2-100A              100 access point       - CON-SNT-LWSM21A 8x5xNBD
L-LIC-WISM2-200A              200 access point       - CON-SNT-LWSM22A 8x5xNBD

CICSO WISM 1 BUY BACK

Cisco has a great incentive program to purchase back your old WISMs. I would ask your Cisco sales representative for details.

Cisco 1130/1131 AP Crashes: Bug CSCtw56233 (7.0.220.0)

We recently upgraded from 7.0.116.0 to 7.0.220.0 to resolve a bug we were experiencing with connectivity. After upgrading, we hit a new bug in 7.0.220.0. This new bug only became apparent, because we have WCS Email alerts configured.

After we upgraded to 7.0.220.0 we almost immediately started to receive the following WCS Email alerts. We had random access points going offline. After closer inspection, the access points showed the "AP Crashed Due To Software Failure"

Message: Access Point 'AA-1131' associated to controller 'xx.xx.xx.xx' on port number '0'. Reason for association 'AP Crashed Due To Software Failure '.
Message: Access Point 'AB-1131' associated to controller 'XX.XX.XX.XX' on port number '0'. Reason for association 'AP Crashed Due To Software Failure '.
Message: Access Point 'AC-1131' associated to controller 'XX.XX.XX.XX' on port number '0'. Reason for association 'AP Crashed Due To Software Failure '.
Message: Access Point 'AD-1131' associated to controller 'XX.XX.XX.XX' on port number '0'. Reason for association 'AP Crashed Due To Software Failure '.

We opened a ticket only to learn 7.0.220.0 has a bug specific to Cisco 1130/1131 access points. TAC mentioned this bug is resolved in 7.0.230.0.

Fast Lane CUWN Release 7.2 Delta Webinar

Webinar Dates & Times - Click the date and time you prefer to register:

• Tuesday, Mar 27, 2012 from 4:00pm - 7:00pm, Eastern
• Wednesday, Mar 28, 2012 from 7:00am - 10:00am, Eastern
• Wednesday, Mar 28, 2012 from 4:00pm - 7:00pm, Eastern
• Thursday, Mar 29, 2012 from 7:00am - 10:00am, Eastern
• Thursday, Mar 29, 2012 from 4:00pm - 7:00pm, Eastern

Description:
Please join us for this 1/2 day virtual webinar covering the latest Cisco Unified Wireless LAN Release 7.2 code. This webinar will provide participants an overview of the key new features and enhancements, implementation considerations, and high-level configuration information.

You will learn:
An overview of the key new features and enhancements, implementation considerations, and high-level configuration information, including RRM enhancements, Alloy QoS, FlexConnect enhancements, Wi-Fi Direct, WebAuth scalability enhancements, MSE Virtual Appliance and High Availability, and 802.11u Hotspot and MSAP.

The primary intended audience is customers considering upgrading their network to WLC 7.2/NCS 1.1, and the technical staff responsible for implementing this latest WLAN code.

End-of-Sale and End-of-Life Announcement for the Cisco 2100 Series Wireless LAN Controllers

Title: End-of-Sale and End-of-Life Announcement for the Cisco 2100 Series Wireless LAN Controllers
Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps7206/ps7221/end_of_life_notice_c51-691053.html
Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco 2100 Series Wireless LAN Controllers. The last day to order the affected product(s) is May 2, 2012. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2012-03-14 11:40:00.0

Cisco AP VCI 60 – “ServiceProvider”

I was helping another engineer troubleshoot a Cisco access point join problem. To my surprise I discovered the VCI was “Cisco AP c3500-ServiceProvider”

I can appreciate when I end a day with a quick reflection. Did I learn anything new today?

Yesterday was one of those days! I was assisting an engineer with an access point join problem. Of course, I took this opportunity to explain the access point join process and what to look for and how to troubleshoot.

We use DHCP option 43 as our means of joining Cisco access points to our network. After peeking at the DHCP configuration, more specifically the option 43 and VCI string, everything looked good. Other 3500s were joining fine, just these handful of access points were not joining.

I do the typical console into the AP. I see nothing of interest. The access point is not getting the controller IP from DHCP. So we span the switch port of the access point to sniff the access point traffic. I am curious as to what the access point is sending in the DHCP request packet.

To my surprise, the VCI 60 is showing “Cisco AP c3500-ServiceProvider”. Oh, there is my problem! Mistakenly a number of “ServiceProvider” access points were mixed in our access point shipment.

If you have access points not joining, just something to add to your troubleshooting check list!