msgbartop
msgbarbottom

09 Apr 15 ip nat outside

IP NAT Outside

NAT – Network Address Translation, at times can be a complicated process depending on what you are trying to do and how it gets configured on a Cisco Router vs Cisco ASA’s is a bit different as well. This post is about recent NAT – Network Address Translation on a Cisco Router configuration that I had to do. Need was to translate an Outside IP address that belonged to a server in our Data Center (Outside Global) into another IP address at a branch location as an Outside Local. Example Network scenario:

Local Subnet at Branch = 172.16.1.0/24
Server IP at Data Center = 10.10.10.250
NAT IP for the server = 2.2.2.2

Basically the need was to translate 10.10.10.250 to 2.2.2.2 at the local branch. Usually it is the other way around where we NAT all the internal IP Addresses going out. However in this case we were trying to do the reverse. Following commands were used:

ip nat outside source static 10.10.10.250 2.2.2.2
!
Interface fa0/0
description ### WAN ###
ip nat outside
!
interface fa0/1
description ### LAN ###
ip nat inside

Now when the clients from 172.16.1.0/24 network attempted to connect to 2.2.2.2, branch router would translate that to 10.10.10.250 and route it to the Data Center server. Return packet would come from 10.10.10.250 and would get translated to 2.2.2.2 and then to the client(s) on the 172.16.1.0/24 network.

Tags: , ,

09 Mar 15 SNMP Communication issue between Cisco Prime and Cisco WLC

Cisco Prime 1.2 Unable to communicate via SNMP with Cisco Wireless LAN Controller

Recently had an issue with where Cisco Prime 1.2 started to show one of our Cisco Wireless LAN Controllers as Unreachable. I looked at the SNMP settings on Cisco Prime as well as the Controller and nothing changed. I even deleted the settings and tried to re add the Cisco WLC in Cisco Prime same results. After testing different things it ended up being an issue with a new dynamic interface that was added on the Cisco WLC for testing. This dynamic interface was on the same VLAN as the Cisco Prime’s interface.

So it looks like since there was an interface on the WLC that was on the same Subnet as Cisco Primes interface. SNMP requests were hitting that interface. But since Cisco WLC does not do Inter VLAN Routing like a L3 Switch. Those packets from the new dynamic Interface were not reaching the Management Interface. As soon as I deleted that new dynamic interface from Cisco WLC, SNMP started to work successfully.

By reading this site/post(s) you are agreeing to the Terms and Conditions of using this website

Tags: ,

05 Mar 15 Configure Primary and Secondary WLC on Cisco Light Weight Access Points

How to configure Primary and Secondary Wireless LAN Controller IP’s on Cisco Light Weight Access Points

I use this method to specify Primary and Secondary Wireless LAN Controller’s IP and Name on Cisco Light Weight Access Points. This can also be used if you want some Access Points on one Wireless LAN Controller and some on the other. This is strictly via controllers command line. It can be done via Controllers GUI as well but that will take forever especially if you are configuring multiple Access Points. Because you will need to put that information in one by one. Using Cisco Wireless LAN Controllers command line interface I can usually get this done faster.

config ap primary-base WLC-01 AP-01 10.10.10.10
config ap secondary-base WLC-02 AP-01 10.10.10.11
config ap primary-base WLC-01 AP-02 10.10.10.10
config ap secondary-base WLC-02 AP-02 10.10.10.11
|
|
| and so on….

There is one more easy way to do this is via Cisco Prime I will write a separate post on that. But this method can be used quickly if there is no Cisco Prime

By reading this site/post(s) you are agreeing to the Terms and Conditions of this website.

Tags: , , ,

26 Feb 15 Rename Access Points Cisco WLC – Wireless LAN Controller

How to rename Cisco Light Weight Access Points on Cisco Wireless LAN Controller

When I am configuring a Cisco Wireless LAN Controller and Access Points are added to it, I have to rename them to something meaningful from their default naming convention of APabcd.fghi.1234. Now I have been accomplishing this task via GUI by going to the Wireless Tab –> All APs and then renaming them one by one. It is really no big deal if you have to rename few of them. However if you are standing up a new site and there are like 30, 50, 100 etc Cisco light weight access points on that Cisco Wireless LAN Controller, it can take forever to do this via Controllers GUI. I like/try my best to work smarter and optimize the way I do things, so I decided to start using the CLI of the Cisco WLC to rename the Access Points.

First and most important thing is to make sure we have the inventory of the AP’s or get a list of their names from Prime. Then using Excel I simply created CLI configuration lines to rename the Cisco light weight access points.

config ap name AP-01 APtttt.abcd.1111
config ap name AP-02 APffff.1234.0asd
config ap name AP-03 APgggg.1234.uut7
config ap name AP-04 APhhhh.1234.6688
config ap name AP-05 APiiii.1234.9999

Now you can utilize this simple method to rename all the AP’s real quick. Here is a quick break down of the syntax:

config ap name NEW-NAME OLD-AP-NAME or Ethernet MAC or SerialNumber

Note: AP names are case sensitive

By reading this site/post(s) you are agreeing to the Terms and Conditions of this website.

Tags: , , ,

24 Feb 15 DHCP options for Cisco 2600 Series Access Points

Configuring DHCP Options for Cisco 2600 Series Access Points

I do not have to do this much so when I do I have to always look it up hence I decided to write it in my own words for my reference. Normally when I put Cisco Access Points on the same VLAN as the Wireless LAN Controllers Management Interface. Access Points have no issue joining the controller. However if the Cisco light weight access Points are on a different VLAN, they will not be able to join the controller initially and that usually requires DHCP Options 43 and 60. Below is an overview of how to configure DHCP Options 43 and 60 for Cisco light weight access points on a Cisco IOS Router.

I will use 192.168.10.0/24 network as an example where all the Cisco light weight access points will reside. Controller IP would be lets say 192.168.1.11. So now since the Cisco Access Points and the Wireless LAN Controller are on two different subnets. I would need to configure DHCP Options 43 and 60

ip dhcp pool AP_POOL
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
option 60 ascii “Cisco AP c2600″ (I found this from Cisco website and is considered as the VCI String – Vendor Class Identifier)
option 43 hex f104c0a8010b

Note: Option 60 is not required when using Cisco IOS DHCP Server. But having that option will basically not send option 43 to clients that do not require it

Now getting the option 60 part is easy. DHCP Option 43 calculation requires further explanation:

  • Option 43 is basically Type(f1) + Length(Number of Controller Management IP’s x 4) + Value (IP Address in Hex)
  • Type = Will always be f1
  • Length = This value comes from taking the number of Controllers Management IP’s and multiplying it with 4. So if there is a single controller then 1 X 4, if there are two then 2 X 4. so in our cause it would be 1 X 4 = 04
  • Value = This is basically the IP address of the Controllers management interface into Hex so 192.168.10.11 = c0.a8.01.0b

Tags: , ,

11 Feb 15 EEM Script to shut and no shut BGP Neighbor – Cisco IOS

I am loving EEM Scripting so far. Had a need recently to accomplish the following with a script:
EEM Script 1 – Shutdown BGP Neighbor

  • Shut down BGP Neighbor
  • Add a static Route
  • Shutdown Multilink Interface
  • Save Config

EEM Script 2 – Re Enable BGP Neighbor

  • Un shut BGP Neighbor
  • Remove static route
  • Re enable Multilink Interface
  • Save Config

In order to accomplish these two tasks I created two separate scripts.

event manager applet bgp_shut
event none
action 1.0 cli command “enable”
action 1.1 cli command “conf t”
action 1.2 cli command “router bgp 65081″
action 1.3 cli command “neighbor 10.138.128.130 shutdown”
action 1.4 cli command “exit”
action 1.5 cli command “ip route 0.0.0.0 0.0.0.0 10.255.255.105″
action 1.6 cli command “int multi 1″
action 1.7 cli command “shut”
action 1.8 cli command “end”
action 1.9 cli command “wr mem”

event manager applet bgp_noshut
event none
action 1.0 cli command “enable”
action 1.1 cli command “conf t”
action 1.2 cli command “router bgp 65081″
action 1.3 cli command “no neighbor 10.138.128.130 shutdown”
action 1.4 cli command “exit”
action 1.5 cli command “no ip route 0.0.0.0 0.0.0.0 10.255.255.105″
action 1.6 cli command “int multi 1″
action 1.7 cli command “no shut”
action 1.8 cli command “end”
action 1.9 cli command “wr mem”

By visiting this website and reading the content you are agreeing to the Terms and Conditions of this website

Tags: , , ,

26 Aug 14 Cisco IOS ACL logging with Port numbers

Cisco IOS logging with source and destination ports

Recently I had to do some troubleshooting on a Cisco 2911 Router in order to find out if traffic is going from a certain IP address to another. So I did the usual created an extended Access List and then applied it to the interface like this:

ip access-list extended test
permit ip any any log
!
interface gi0/0
ip access-group test in
end

Now that is great and I was seeing the logs and traffic however what I also needed to know was the source and destination port numbers. This configuration was giving me the following:
Aug 25 08:24:28.608: %SEC-6-IPACCESSLOGP: list test permitted tcp 172.20.32.200(0) -> 10.202.106.15(0), 1 packet
Aug 25 08:24:29.612: %SEC-6-IPACCESSLOGP: list test permitted tcp 172.20.32.200(0) -> 10.202.106.15(0), 1 packet
Aug 25 08:24:30.700: %SEC-6-IPACCESSLOGP: list test permitted tcp 172.20.32.200(0) -> 10.202.106.15(0), 1 packet
As you can see instead of getting the port number I am just getting a “0” in there. I needed to know the port numbers as well. Now the issue is if the access list line does not have the port numbers listed (Layer 4) it will not show them. So here is what I did to get it working:

ip access-list extended test
permit ip tcp any gt 1024 any gt 1024 log
!
interface gi0/0
ip access-group test in
end

When I did that I got the following results :)
Aug 25 08:24:28.608: %SEC-6-IPACCESSLOGP: list test permitted tcp 172.20.32.200(9053) -> 10.202.106.15(12302), 1 packet
Aug 25 08:24:29.612: %SEC-6-IPACCESSLOGP: list test permitted tcp 172.20.32.200(9052) -> 10.202.106.15(39817), 1 packet
Aug 25 08:24:30.700: %SEC-6-IPACCESSLOGP: list test permitted tcp 172.20.32.200(9055) -> 10.202.106.15(12302), 1 packet

Tags: , ,

26 Mar 14 Broadcast multiple SSID’s – Cisco Standalone Access Points

How to broadcast multiple SSID’s on Cisco Access Points

Usually using the command guest-mode under the SSID configuration on a Cisco Access Point you can broadcast a single SSID. I needed to actually broadcast multiple SSID’s on Cisco 1240 Access Points running the following code: Version 12.4(10b)JDA3. In that case I used the following configuration options.

interface dot11radio #
mbssid
!
dot11 ssid CORP
mbssid guest-mode
!
dot11 ssid GUEST
mbssid guest-mode

I used the following two links during my research.

  • http://www.cisco.com/c/en/us/td/docs/wireless/access_point/12-3_7_JA/configuration/guide/i1237sc/s37ssid.html#wp1050170
  • http://www.cisco.com/c/en/us/td/docs/wireless/access_point/12-_3g_JA/configuration/guide/ios1243gjaconfigguide/s43ssid.html#wp1035858

[sz-gplus-one size=”medium” annotation=”bubble”/]

Tags: , ,

07 Feb 14 EEM Script for clearing – Cisco IOS

EEM Script example to clear stuff in Cisco IOS

I had to recently clear the DHCP Conflict log from a Cisco Router as it was filling up and not allowing devices to get back on the network in a specific situation. Well instead of doing it manually I just decided to give Cisco EEM Script a try. And it worked out pretty good :). Another scenario I used was clearing DHCP bindings and arp.

EEM Script – Clear DHCP Conflict Log

event manager applet CLEAR_DHCP_CONFLICT (This is applets name)
event timer watchdog time 172800 (Using the watchdog option I allowed it to run every 48 hours)
action 1.0 cli command “enable”
action 2.0 cli command “clear ip dhcp conflict *”
action 3.0 syslog msg “IP DHCP Conflict log has been cleared successfully” (syslog msg enabled me to trigger a syslog message)

EEM Script – Clear DHCP Bindings and Arp Cache

event manager applet CLEAR_DHCP_CONFLICT
event timer watchdog time 172800
action 1.0 cli command “enable”
action 2.0 cli command “clear ip dhcp binding *”
action 3.0 cli command “clear arp”
action 4.0 syslog msg “IP DHCP bindings and Arp Cache have been cleared”

So Cisco EEM Scripting is pretty cool. Possibilities are endless.

Tags: , ,

26 Dec 13 Cisco WLC2504 Boot loader Failure

Cisco WLC2504 Boot Loader Failure Error

So today I had a Cisco WLC 2504 crash and it would not come back online after a reboot. So I gained access to it via Cisco Console cable to see what is going on with it. And I was presented with the following screen/error:

WLCNG Boot Loader Version 1.0.16 (Built on Feb 28 2011 at 13:14:54 by cisco)
Board Revision 0.0 (SN: PSZ17xxxxx, Type: AIR-CT2504-K9) (P)
Verifying boot loader integrity…
##########################################
### IMPROPER SYSTEM OPERATION DETECTED ###
### ———————————- ###
### System has been halted because: ###
### 1. Boot loader failed verification ###

WLC 2504 BootLoad Failure

I was hoping that this is something that can be recovered and we can bring the Cisco 2504 WLC back online. After some searching and talking to Cisco TAC, basically it just needed to be RMAed. Thank God to Cisco Smartnet :), was able to get it back up and running in a couple of hours.

Tags: , ,

WordPress SEO