Friday, March 17, 2017

Configuring Local Admin Users and NTP on a WLC via CLI

When designing and deploying a WLAN, you will always be concerned about both coverage and capacity. Various factors can affect the coverage range of a wireless cell, and just as many factors can affect the aggregate throughput in an 802.11 WLAN. The following variables can affect the range of a WLAN:

Transmission Power Rates - The original transmission amplitude (power) will have an impact on the range of an RF cell. An access poit transmitting at 30 mW will have a larger coverage zone than an access point transmitting at 1 mW if the same antenna is used. APs with too much transmission amplitude can cause many problems, as already discussed in this chapter.

Antenna Gain - Antennas are passive-gain devices that focus the original signal. An access point transmitting at 30 mW with a 6 dBi antenna will have greater range than it would if it used only a 3 dBi antenna. If you want to increase the range for the clients, the best solution is to increase the antenna gain of the access point.

Antenna Type  - Antennas have different coverage patterns. Using the right antenna will give the proper coverage and reduce multipath and nearby interference.

Wavelength - Higher frequency signals have a smaller wavelength property and will attenuate faster than a lower-frequency signal with a larger wavelength. All things being equal, 2.4 GHz access points have a greater range than 5 GHz access points due to the difference in the length of their waves.

Free Space Path Loss - In any RF environment, free space path loss (FSPL) attenuates the signal as a function of distance and frequency.

Physical Environment - Walls and other obstacles will attenuate an RF signal because of absorption and other RF propagation behaviors. A building with concrete walls will require more access points than a building with drywall because concrete is denser and attenuates the signal faster than drywall.


Capacity performance considerations are equally as important as range considerations. Please remember that 802.11 data rates are considered data bandwidth and not throughput. The following are among many variables that can affect the throughput of a WLAN:

Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) - The medium access method that uses interframe spacing, physical carrier sense, virtual carrier sense, and the random back-off timer creates overhead and consumes bandiwidth. The overhead due to medium contention usually is 50 percent or greater in legacy 802.11a/b/g networks. Medium contention overhead is usually 35 percent to 40 percent in 802.11n/ac networks.

Encryption - Extra overhead is added to the body of an 802.11 data fame whenever encryption is implemented. WEP/RC4 encryption adds an extra 8 bytes of overhead per frame, TKIP/RC4 encryption adds an extra 20 bytes of overhead per frame, and CCP/AES encryption adds an extra 16 bytes of overhead per frame. Layer 3 VPNs often use DES or 3DES encrytion, both of which also consume significant bandwith. Recent gains in processing capabilities and 802.11n/ac data rates have made encryption overhead much less of an issue in recent years.

Application Use - Different types of applications have variable effects on bandwith consumption. VoWiFi and data collection scanning typically do no require a lot of bandwidth. Other applications that require file transfers or database access are often more bandwidth intensive. High definition video streaming is also bandwidth intensive.

Number of Clients - Remember that the WLAN is a shared medium. All throughput is aggregate, and all available bandwidth is shared.

Layer 2 Retransmissions - As we have discussed throughout this chapter, various problems can cause frames to become corrupted. If frames are corrupted, they will need to be retransmitted and throughput will be affected.


I've configured the wrong admin account (named it wlc01) on a new WLC during the initial wizard configuration tool. So I added a new admin account and deleted old one via CLI. I also configured an NTP server on the WLC so it will automatically synchronize the time (and digital certificate) with the AP when building its CAPWAP (DTLS) tunnel.


(Cisco Controller)

Enter User Name (or 'Recover-Config' this one-time only to reset configuration to factory defaults)

User:  wlc01
Password:*************
(Cisco Controller) >config ?
             
802.11-a49     Configures 802.11a 4.9 subband parameters.
802.11-a58     Configures 802.11a 5.8 subband parameters.
802.11-abgn    Configures 802.11-abgn parameters.
802.11a        Configures 802.11a parameters.
802.11b        Configures 802.11b parameters.
802.11h        Configures 802.11h parameters.
aaa            Configures AAA related items.
acl            Configures Access Control Lists.
advanced       Advanced Configuration.
ap             Configures Cisco APs
assisted-roaming Configures Assisted Roaming Global Parameters.
auth-list      Configures ap authorization list.
auto-configure Single command to auto-configure.
avc            Configures AVC (Application Visibility and Control).
band-select    Configures Band Select.
boot           Configures the default boot image.
ccx-lite       Enable or disable CCX-lite feature
cdp            Configure Cisco Discovery Protocol
certificate    Configures SSL Certificates.
client         Configures a client.
coredump       Configures the Core Dump Setting

--More-- or (q)uit
country        Configure the countries of operation.
cts            Configure Cisco TrustSec SXP Protocol
custom-web     Configures the custom web authentication page.
database       Configures the local database
dhcp           Configures system dhcp server.
exclusionlist  Manages exclusion-list.
flexconnect    Configure controller flexconnect parameters.
flow           Configure flow.
guest-lan      Configures the Wireless LAN Network.
icons          Configures the ICON details.
interface      Configures system interfaces.
ipv6           Configure IPv6 related parameters.
lag            Enables/Disables Link Aggregation (LAG)
ldap           Configures LDAP servers (ipv4 or ipv6).
license        Configure software license parameters.
linktest       Configures linktest frame size and number of frames to send.
load-balancing Configures Aggressive Load Balancing.
local-auth     Configures Local EAP Authentication.
location       Configure Location parameters
logging        Configures Logger parameters.
loginsession   Manage User Connections to the Switch.
macfilter      Configure static MAC filtering.
mdns           Configures mDNS Services/Profiles

--More-- or (q)uit
media-stream   Configure Media Stream
memory          Configures memory monitoring for certain types of errors/leaks.
mesh           Config mesh ap parameters.
mgmtuser       Manages local management user accounts.
mobility       Configures the Inter-Switch Mobility Manager
msglog         Configures the system msglog parameters.
netuser        Configures network user policies and local network user accounts.
network        Configuration for inband connectivity.
nmheartbeat    Configures the network manager heartbeat Setting
nmsp           Configure NMSP parameters.
oeap-acl       Configures Access Control Lists for OEAP Split Tunnel.
paging         enable or disable scrolling the page.
passwd-cleartext Enable or Disable the showing of passwd in cleartext
policy         Configure native profiling policy.
port           Configures port mode and physical settings.
profiling      Enabling Local profiling update
prompt         Change the system prompt.
qos            Configure qos parameter.
radius         Configures RADIUS Servers.
redundancy     Configure WLC redundancy parameters
remote-lan     Configures Remote LAN Connections.
rf-profile     Configures RF Profile parameters.
rfid           Configure options for RFID tag tracking

--More-- or (q)uit
rogue          Configures rogue devices.
serial         EIA-232 parameters and serial port inactivity timeout.
service        Modify network based services.
sessions       Configure CLI session parameters.
slot           Configures the slot
snmp           Configures SNMP.
split-tunnel-network-list Configure split tunnel network lists. Only become active in split tunnel mode 2.
stats-timer    Configures system stats timer.
switchconfig   Configure parameters that apply to the switch.
sys-nas        Configures the system nas id.
syslog         Configures the system syslog mode.
sysname        Configures the system name.
tacacs         Configures TACACS+ Servers.
time           Configures system time or servers.
trapflags      Enable or Disable trap flags that apply to the switch.
wgb            Configure WGB related parameters
wlan           Configures the Wireless LAN Network.
wps            Configures WPS settings.

(Cisco Controller) >config mgmtuser ?

add            Creates a local management user.
delete         Delete an existing management user.
description    Sets the description for a management user.
password       Configures a password for a management user.
telnet         Configures telnet privilege for a management user.

(Cisco Controller) >config mgmtuser add ?

<username>     Enter name up to 24 alphanumeric characters.

(Cisco Controller) >config mgmtuser add admin ?

<password>     Enter password up to 24 alphanumeric characters.

(Cisco Controller) >config mgmtuser add admin Mypassword123 ?

lobby-admin    Creates a management user with lobby ambassador privileges.
read-only      Creates a management user with read-only access.
read-write     Creates a management user with read-write access.

(Cisco Controller) >config mgmtuser add admin Mypassword123 read-write

(Cisco Controller) >show mgmtuser

User Name                 Permissions    Description            Password Strength   Telnet Capable
-----------------------   ------------   ---------------------  ------------------  ----------
admin                     read-write                                      Strong         Yes
wlc01                     read-write                                      Strong         Yes

(Cisco Controller) >config mgmtuser delete wlc01

Deleted user wlc01

(Cisco Controller) >config ?

802.11-a49     Configures 802.11a 4.9 subband parameters.
802.11-a58     Configures 802.11a 5.8 subband parameters.
802.11-abgn    Configures 802.11-abgn parameters.
802.11a        Configures 802.11a parameters.
802.11b        Configures 802.11b parameters.
802.11h        Configures 802.11h parameters.
aaa            Configures AAA related items.
acl            Configures Access Control Lists.
advanced       Advanced Configuration.
ap             Configures Cisco APs
assisted-roaming Configures Assisted Roaming Global Parameters.
auth-list      Configures ap authorization list.
auto-configure Single command to auto-configure.
avc            Configures AVC (Application Visibility and Control).
band-select    Configures Band Select.
boot           Configures the default boot image.
ccx-lite       Enable or disable CCX-lite feature
cdp            Configure Cisco Discovery Protocol
certificate    Configures SSL Certificates.
client         Configures a client.
coredump       Configures the Core Dump Setting

--More-- or (q)uit
country        Configure the countries of operation.
cts            Configure Cisco TrustSec SXP Protocol
custom-web     Configures the custom web authentication page.
database       Configures the local database
dhcp           Configures system dhcp server.
exclusionlist  Manages exclusion-list.
flexconnect    Configure controller flexconnect parameters.
flow           Configure flow.
guest-lan      Configures the Wireless LAN Network.
icons          Configures the ICON details.
interface      Configures system interfaces.
ipv6           Configure IPv6 related parameters.
lag            Enables/Disables Link Aggregation (LAG)
ldap           Configures LDAP servers (ipv4 or ipv6).
license        Configure software license parameters.
linktest       Configures linktest frame size and number of frames to send.
load-balancing Configures Aggressive Load Balancing.
local-auth     Configures Local EAP Authentication.
location       Configure Location parameters
logging        Configures Logger parameters.
loginsession   Manage User Connections to the Switch.
macfilter      Configure static MAC filtering.
mdns           Configures mDNS Services/Profiles

--More-- or (q)uit
media-stream   Configure Media Stream
memory          Configures memory monitoring for certain types of errors/leaks.
mesh           Config mesh ap parameters.
mgmtuser       Manages local management user accounts.
mobility       Configures the Inter-Switch Mobility Manager
msglog         Configures the system msglog parameters.
netuser        Configures network user policies and local network user accounts.
network        Configuration for inband connectivity.
nmheartbeat    Configures the network manager heartbeat Setting
nmsp           Configure NMSP parameters.
oeap-acl       Configures Access Control Lists for OEAP Split Tunnel.
paging         enable or disable scrolling the page.
passwd-cleartext Enable or Disable the showing of passwd in cleartext
policy         Configure native profiling policy.
port           Configures port mode and physical settings.
profiling      Enabling Local profiling update
prompt         Change the system prompt.
qos            Configure qos parameter.
radius         Configures RADIUS Servers.
redundancy     Configure WLC redundancy parameters
remote-lan     Configures Remote LAN Connections.
rf-profile     Configures RF Profile parameters.
rfid           Configure options for RFID tag tracking

--More-- or (q)uit
rogue          Configures rogue devices.
serial         EIA-232 parameters and serial port inactivity timeout.
service        Modify network based services.
sessions       Configure CLI session parameters.
slot           Configures the slot
snmp           Configures SNMP.
split-tunnel-network-list Configure split tunnel network lists. Only become active in split tunnel mode 2.
stats-timer    Configures system stats timer.
switchconfig   Configure parameters that apply to the switch.
sys-nas        Configures the system nas id.
syslog         Configures the system syslog mode.
sysname        Configures the system name.
tacacs         Configures TACACS+ Servers.
time           Configures system time or servers.
trapflags      Enable or Disable trap flags that apply to the switch.
wgb            Configure WGB related parameters
wlan           Configures the Wireless LAN Network.
wps            Configures WPS settings.

(Cisco Controller) >config time ?

manual         Configures the system time.
ntp            Configures the Network Time Protocol.
timezone       Configures the system's timezone.

(Cisco Controller) >config time ntp ?

auth           Configures the NTP authentication
interval       Configures the Network Time Protocol Polling Interval.
key-auth       Configures the NTP authentication key.
server         Configures the Network Time Protocol Servers.

(Cisco Controller) >config time ntp server ?

<index>        Enter NTP server index.

(Cisco Controller) >config time ntp server 1 ?

<IP Address>   Enter NTP server's IP address. Use 0.0.0.0  or :: to delete entry

(Cisco Controller) >config time ntp server 1 123.1.3.2

(Cisco Controller) >show time

Time............................................. Mon Dec 12 15:47:14 2016

Timezone delta................................... 0:0
Timezone location................................

NTP Servers
    NTP Polling Interval.........................     86400

     Index     NTP Key Index                  NTP Server                  NTP Msg Auth Status
    -------  ----------------------------------------------------------------------------------
       1              0                                
   123.1.3.2       AUTH DISABLED


The remote site has around 20 lightweight APs, so I've also verified if the WLC AP license would be able to support it. 

(Cisco Controller) >show license summary

License Store: Primary License Storage
StoreIndex:  0  Feature: base                              Version: 1.0
        License Type: Permanent
        License State: Active, Not in Use
        License Count: Non-Counted
        License Priority: Medium
License Store: Primary License Storage
StoreIndex:  1  Feature: base-ap-count                     Version: 1.0
        License Type: Permanent
        License State: Active, In Use
        License Count: 25 /25 (Active/In-use)
        License Priority: Medium

License Store: Evaluation License Storage
StoreIndex:  0  Feature: base-ap-count                     Version: 1.0
        License Type: Evaluation
        License State: Inactive
            Evaluation total period: 12 weeks  6 days
            Evaluation period left: 12 weeks  6 days
        License Count: 75 / 0 (Active/In-use)
        License Priority: None

(Cisco Controller) >save config

Are you sure you want to save? (y/n) y

Configuration Saved!


After the faulty WLC was replaced and the APs got registered, the APs retained its hostname and static IP addresses. So I just re-configured the SSID and its security policies.

No comments:

Post a Comment