FlexConnect (formerly known as Hybrid Remote Edge Access Point or H-REAP) is a wireless solution that enables the deployment of AP to a remote or branch office without using a local WLC. A central WLC is used to configure and control FlexConnect AP over a WAN link. The FlexConnect AP can perform standalone client authentication and switch VLAN traffic locally even when it's disconnected to the WLC (Local Switched). FlexConnect AP can also tunnel (via CAPWAP) both user wireless data and control traffic to a centralized WLC (Central Switched).
Here's a nice Cisco Live doc and Lab Minutes video about FlexConnect design and configuration. There are some caveats when using FlexConnect and it's recommended to allocate a bandwidth of 24 kbps per AP with round trip latency no greater than 300 ms. Below is my lab topology which uses a FlexConnect AP (AIR-CAP-2602I) in the Branch office and a Central WLC 2504 in HQ.
You'll see the Branch AP join the WLC in HQ. Make sure the WLC has NTP or manual time/clock correctly configured.
Below are console logs captured on the FlexConnect AP.
IOS Bootloader - Starting system.
flash is writable
FLASH CHIP: Numonyx Mirrorbit (0089)
Xmodem file system is available.
flashfs[0]: 123 files, 15 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 31997952
flashfs[0]: Bytes used: 22632960
flashfs[0]: Bytes available: 9364992
flashfs[0]: flashfs fsck took 22 seconds.
Reading cookie from SEEPROM
Base Ethernet MAC address: f8:72:ea:a6:e2:03
Ethernet speed is 100 Mb - FULL Duplex
Loading "flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-mx.153-3.JA8"...#########################
File "flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-mx.153-3.JA8" uncompressed and installed, entry point: 0x2003000
executing...
Secondary Bootloader - Starting system.
Tide MB - 32MB of flash
Xmodem file system is available.
flashfs[0]: 123 files, 15 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 31997952
flashfs[0]: Bytes used: 22632960
flashfs[0]: Bytes available: 9364992
flashfs[0]: flashfs fsck took 9 seconds.
flashfs[1]: 0 files, 1 directories
flashfs[1]: 0 orphaned files, 0 orphaned directories
flashfs[1]: Total bytes: 12257280
flashfs[1]: Bytes used: 1024
flashfs[1]: Bytes available: 12256256
flashfs[1]: flashfs fsck took 1 seconds.
Base Ethernet MAC address: f8:72:ea:a6:e2:03
2600/3600 AP, PID: 'AIR-CAP2602I-S-K9 '. Checking for BL upgrade...
BL: C2600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JAY, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Compiled Thu 03-Oct-13 03:35 by sdcunha
BL Build year: 13
Boot CMD: 'boot flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-xx.153-3.JA8;flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-xx.153-3.JA8'
Loading "flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-xx.153-3.JA8"...###############################################
File "flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-xx.153-3.JA8" uncompressed and installed, entry point: 0x1003000
executing...
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Cisco IOS Software, C2600 Software (AP3G2-K9W8-M), Version 15.3(3)JA8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Fri 22-Apr-16 05:48 by prod_rel_team
Tide MB - 32MB of flash
Initializing flashfs...
flashfs[2]: 123 files, 15 directories
flashfs[2]: 0 orphaned files, 0 orphaned directories
flashfs[2]: Total bytes: 31739904
flashfs[2]: Bytes used: 22632960
flashfs[2]: Bytes available: 9106944
flashfs[2]: flashfs fsck took 9 seconds.
flashfs[2]: Initialization complete.
flashfs[4]: 0 files, 1 directories
flashfs[4]: 0 orphaned files, 0 orphaned directories
flashfs[4]: Total bytes: 11999232
flashfs[4]: Bytes used: 1024
flashfs[4]: Bytes available: 11998208
flashfs[4]: flashfs fsck took 0 seconds.
flashfs[4]: Initialization complete.
Copying radio files from flash: to ram:
Copy in progress...CCCCC
Copy in progress...CCC
Copy in progress...CCCC
Copy in progress...CCCC
Copy in progress...CC
Copy in progress...CCCC
Copy in progress...CC
Copy in progress...CCCCCC
Copy in progress...CCCC
Copy in progress...CC
Uncompressing radio files...
...done Initializing flashfs.
Radio0 present 8764 8000 0 A8000000 A8010000 0
Rate table has 650 entries (20 legacy/224 11n/406 11ac)
POWER TABLE FILENAME = ram:/Y2.bin
Radio1 present 8764 8000 0 88000000 88010000 4
POWER TABLE FILENAME = ram:/Y5.bin
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
export@cisco.com.
cisco AIR-CAP2602I-S-K9 (PowerPC) processor (revision A0) with 188398K/60928K bytes of memory.
Processor board ID FGL1724W123
PowerPC CPU at 800Mhz, revision number 0x2151
Last reset from power-on
LWAPP image version 8.0.133.0
1 Gigabit Ethernet interface
2 802.11 Radios
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: F8:72:EA:A6:12:34
Part Number : 73-14588-02
PCA Assembly Number : 800-37899-01
PCA Revision Number : A0
PCB Serial Number : FOC17230ABC
Top Assembly Part Number : 800-38356-01
Top Assembly Serial Number : FGL1724WXYZ
Top Revision Number : A0
Product/Model Number : AIR-CAP2602I-S-K9
% Please define a domain-name first.
Press RETURN to get started!
*Mar 1 00:00:14.447: %SOAP_FIPS-2-SELF_TEST_IOS_SUCCESS: IOS crypto FIPS self test passed (15)
*Mar 1 00:00:14.903: Registering HW DTLS
*Mar 1 00:00:14.911: APAVC: Initial WLAN Buffers Given to System is 2500
*Mar 1 00:00:14.963: APAVC: WlanPAKs 18174 RadioPaks 17566
*Mar 1 00:00:17.275: %LINK-6-UPDOWN: Interface GigabitEthernet0, changed state to up
*Mar 1 00:00:21.231: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 0 (4)
*Mar 1 00:00:21.347: loading Power Tables from ram:/Y2.bin. Class = E
*Mar 1 00:00:21.347: record size of 3ss: 1168 read_ptr: 4B5642E
*Mar 1 00:00:27.711: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 1 (4)
*Mar 1 00:00:27.755: loading Power Tables from ram:/Y5.bin. Class = S
*Mar 1 00:00:27.755: record size of 3ss: 1168 read_ptr: 4B5642E
*Mar 1 00:00:27.915: Wait until the stile protocol list is initialized.
*Mar 1 00:00:29.099: Start STILE Activation
*Mar 1 00:00:31.031: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to down
*Mar 1 00:00:32.111: %SYS-5-RESTART: System restarted --
Cisco IOS Software, C2600 Software (AP3G2-K9W8-M), Version 15.3(3)JA8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Fri 22-Apr-16 05:48 by prod_rel_team
*Mar 1 00:00:32.111: %SNMP-5-COLDSTART: SNMP agent on host APf872.eaa6.e203 is undergoing a cold start
*Jun 6 03:12:26.083: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
*Jun 6 03:12:27.111: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Jun 6 03:12:27.123: Starting Ethernet promiscuous modelwapp_crypto_init: MIC Present and Parsed Successfully
*Jun 6 03:12:27.271: %SSH-5-ENABLED: SSH 2.0 has been enabled
*Jun 6 03:12:27.271: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Jun 6 03:12:28.115: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Jun 6 03:12:28.327: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down
*Jun 6 03:12:37.159: %LINK-6-UPDOWN: Interface BVI1, changed state to down
*Jun 6 03:12:38.287: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to down
*Jun 6 03:12:40.071: %SOAP_FIPS-2-SELF_TEST_HW_SUCCESS: HW crypto FIPS self test passed (2-16)
*Jun 6 03:12:40.071: DPAA Initialization Complete
*Jun 6 03:12:40.071: %SYS-3-HARIKARI: Process DPAA INIT top-level routine exited
*Jun 6 03:12:41.075: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up
*Jun 6 03:12:43.075: %LINK-6-UPDOWN: Interface BVI1, changed state to up
*Jun 6 03:12:43.507: Currently running a Release Image
validate_sha2_block: Failed to get certificate chain
*Jun 6 03:12:43.931: Using SHA-1 signed certificate for image signing validation.
*Jun 6 03:12:44.219: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
*Jun 6 03:12:44.619: %LWAPP-3-LWAPP_INTERFACE_GOT_IP_ADDRESS: Interface BVI1 obtained IP from DHCP...
*Jun 6 03:12:44.619: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 172.16.1.6, mask 255.255.255.0, hostname APf872.eaa6.1234
*Jun 6 03:12:44.619: %LWAPP-3-LWAPP_INTERFACE_GOT_IP_ADDRESS: Interface BVI1 obtained IP from DHCP...
*Jun 6 03:12:50.223: APAVC: Succeeded to activate all the STILE protocols.
*Jun 6 03:12:50.223: APAVC: Registering with CFT
*Jun 6 03:12:50.223: APAVC: CFT registration of delete callback succeeded
*Jun 6 03:12:50.223: APAVC: Reattaching Original Buffer pool for system use
*Jun 6 03:12:50.223: Pool-ReAtach: paks 18174 radio17566
%Default route without gateway, if not a point-to-point interface, may impact performance
*Jun 6 03:12:57.095: AP image integrity check PASSED
*Jun 6 03:12:57.167: validate_sha2_block:No SHA2 Block present on this AP.
*Jun 6 03:12:57.199:
Note: A random mac address of 0000.0cf2.fb4c
has been chosen for BVI in bridge group 3 since the selected mac address
is already being used by Bridge Group 2.
*Jun 6 03:12:57.199: Ensure that this address is unique.
*Jun 6 03:12:57.203: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Jun 6 03:12:57.203: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset
*Jun 6 03:12:59.203: %LINK-6-UPDOWN: Interface BVI2, changed state to down
*Jun 6 03:12:59.203: %LINK-6-UPDOWN: Interface BVI3, changed state to down
*Jun 6 03:13:07.211: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 255.255.255.255 port 0 CLI Request Triggered
*Jun 6 03:13:12.583: %CDP_PD-4-POWER_OK: Full power - NEGOTIATED inline power source
*Jun 6 03:13:13.683: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Jun 6 03:13:14.683: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Jun 6 03:13:14.783: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Jun 6 03:13:15.683: %LINK-6-UPDOWN: Interface BVI2, changed state to up
*Jun 6 03:13:15.783: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up
*Jun 6 03:13:16.683: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI2, changed state to up
*Jun 6 03:13:16.783: %LINK-6-UPDOWN: Interface BVI3, changed state to up
*Jun 6 03:13:17.783: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI3, changed state to up Translating "CISCO-CAPWAP-CONTROLLER"...domain server (255.255.255.255)
*Aug 24 13:47:09.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.1.1.100 peer_port: 5246
*Aug 24 13:47:09.427: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 10.1.1.100 peer_port: 5246
*Aug 24 13:47:09.427: %CAPWAP-5-SENDJOIN: sending Join Request to 10.1.1.100
*Aug 24 13:47:09.707: %LWAPP-4-CLIENTEVENTLOG:
Checksum required saved version = 8.0.133.0, file flash:/lwapp_reap.cfg
*Aug 24 13:47:10.171: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 24 13:47:10.239: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to administratively down
*Aug 24 13:47:10.239: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 24 13:47:10.859: %LWAPP-4-CLIENTEVENTLOG: OfficeExtend Localssid saved in AP flash
*Aug 24 13:47:11.043: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 24 13:47:11.043: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Aug 24 13:47:11.243: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 24 13:47:11.263: %CAPWAP-5-JOINEDCONTROLLER: AP has joined controller WLC1
*Aug 24 13:47:11.323: %LWAPP-4-CLIENTEVENTLOG: No Flex ACL map configuration file to load. Connect to controller to get configuration file
*Aug 24 13:47:11.323: %LWAPP-4-CLIENTEVENTLOG: No Flex ACL map configuration file to load. Connect to controller to get configuration file
*Aug 24 13:47:11.323: %LWAPP-4-CLIENTEVENTLOG: No LS Flex ACL map configuration file to load. Connect to controller to get configuration file
*Aug 24 13:47:11.323: %LWAPP-4-CLIENTEVENTLOG: No Central Dhcp map configuration file to load. Connect to controller to get configuration fileWLAN id 1, SSID FLEX-WIFI, L2ACL , L2ACL AP capwap_delete_all_l2Acls_in_nacl_list:336. Deleting all L2Acls in AP config
*Aug 24 13:47:11.539: %DOT11-4-NO_HT: Interface Dot11Radio0, Mcs rates disabled on wlan 1 due to not using AES encryption or encryption is not disabled
*Aug 24 13:47:11.543: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to down
*Aug 24 13:47:11.555: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset
*Aug 24 13:47:12.531: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 24 13:47:12.543: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down
*Aug 24 13:47:12.559: %DOT11-4-NO_HT: Interface Dot11Radio1, Mcs rates disabled on wlan 1 due to not using AES encryption or encryption is not disabled
*Aug 24 13:47:12.579: %DOT11-6-DFS_SCAN_START: DFS: Scanning frequency 5300 MHz for 60 seconds.
*Aug 24 13:47:12.583: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Aug 24 13:47:12.591: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 24 13:47:12.599: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 24 13:47:13.595: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up
*Aug 24 13:47:13.595: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 24 13:47:13.623: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 24 13:47:13.631: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to down
*Aug 24 13:47:13.639: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset
*Aug 24 13:47:14.675: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 24 13:47:14.675: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down
*Aug 24 13:47:14.695: %WIDS-6-ENABLED: IDS Signature is loaded and enabled
*Aug 24 13:47:14.699: %DOT11-6-DFS_SCAN_START: DFS: Scanning frequency 5300 MHz for 60 seconds.
*Aug 24 13:47:14.703: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Aug 24 13:47:14.775: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 24 13:47:14.783: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 24 13:47:15.703: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up
*Aug 24 13:47:15.779: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 24 13:47:15.799: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 24 13:47:16.799: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 24 13:47:34.891: %CLEANAIR-6-STATE: Slot 0 disabled
*Aug 24 13:47:34.891: %CLEANAIR-6-STATE: Slot 1 disabled
*Aug 24 13:47:35.379: %CDP_PD-4-POWER_OK: Full power - NEGOTIATED inline power source
*Aug 24 13:48:15.851: %DOT11-6-DFS_SCAN_COMPLETE: DFS scan complete on frequency 5300 MHz
*Aug 24 13:51:26.851: %WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:2 Channel:1 Source MAC:0432.f41b.490d
*Aug 24 14:01:45.723: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:2 Channel:1
Below are some useful WLC CLI commands to verify successfully joined AP.
(Cisco Controller) >show ap summary
Number of APs.................................... 1
Global AP User Name.............................. Not Configured
Global AP Dot1x User Name........................ Not Configured
AP Name Slots AP Model Ethernet MAC Location Country IP Address Clients
------------------ ----- -------------------- ----------------- ---------------- ------- --------------- -------
APf872.eaa6.1234 2 AIR-CAP2602I-S-K9 f8:72:ea:a6:12:34 default location SG 172.16.1.6 1
(Cisco Controller) >show ap join stats summary all
Number of APs.............................................. 1
Base Mac AP EthernetMac AP Name IP Address Status
0c:68:03:d7:ab:cd f8:72:ea:a6:12:34 APf872.eaa6.1234 172.16.1.6 Joined
Create the WLAN SSID and the Layer 2 and Layer 3 security policy.
Tick Enabled under Status and Broadcast SSID.
Select a Layer 2 security policy. In this case, I chose Static WEP which is insecure and good for lab purpose only. I've used 40 bits WEP key size. Below are the equivalent number of HEX and ASCII characters when choosing the WEP key size:
Allow local switching (for VLANs) on the FlexConnect AP under WLAN > Advanced tab > tick Enable on FlexConnect Local Switching and Learn Client IP Address > Apply.
I've used my iPhone to join FLEX-WIFI SSID which is scanned on the Branch AP.
You can check the wireless clients on the WLC under Monitor > Clients.
Click on a specific client MAC address to view more details.
To test FlexConnect AP local switching, I've shutdown the WLC port and my iPhone wifi was still connected locally.
HQ#show cdp neighbor
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
BRANCH Fas 0/8 171 R S I WS-C3560- Fas 0/24
WLC1 Fas 0/1 138 H AIR-CT250 Gig 0/0/1
HQ#conf t
Enter configuration commands, one per line. End with CNTL/Z.
HQ(config)#interface f0/1
HQ(config-if)#shut
HQ(config-if)#do ping 172.16.1.5 // IPHONE IP ADDRESS
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/15/59 ms
BRANCH#
BRANCH#ping 10.1.1.100 // HQ WLC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.100, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
I've just used two Cisco 3560 L3 switches for this lab and below are the running-config.
HQ#show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
SW1 Fas 0/8 179 R S I WS-C3560- Fas 0/24
WLC1 Fas 0/1 147 H AIR-CT250 Gig 0/0/1
HQ#show run
Building configuration...
Current configuration : 949 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname HQ
!
!
no aaa new-model
system mtu routing 1500
ip subnet-zero
ip routing
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0/1
description ### WLC - 10.1.1.100 ###
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
description ### MGMT PC - 10.1.1.50 ###
!
interface FastEthernet0/8
description ### WAN LINK TO BRANCH ###
no switchport
ip address 200.1.1.2 255.255.255.252
!
interface GigabitEthernet0/1
!
interface Vlan1
ip address 10.1.1.1 255.255.255.0
!
ip classless
ip route 172.16.1.0 255.255.255.0 200.1.1.1
ip http server
!
!
control-plane
!
!
line con 0
line vty 0 4
login
line vty 5 15
login
!
end
HQ#ping 200.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 200.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms
BRANCH#show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
HQ Fas 0/24 153 R S I WS-C3560- Fas 0/8
APf872.eaa6.e203 Fas 0/23 166 T B I AIR-CAP26 Gig 0
BRANCH#ping 200.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 200.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/8 ms
BRANCH#show run
Building configuration...
Current configuration : 1596 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname BRANCH
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
system mtu routing 1500
ip subnet-zero
ip routing
ip dhcp excluded-address 172.16.1.1
!
ip dhcp pool LAN
network 172.16.1.0 255.255.255.0
default-router 172.16.1.1
option 43 hex f014.0a01.0164
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
description ### FLEXCONNECT AP ###
!
interface FastEthernet0/24
description ## WAN Link to HQ ###
no switchport
ip address 200.1.1.1 255.255.255.252
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
ip address 172.16.1.1 255.255.255.0
!
ip classless
ip route 10.1.1.0 255.255.255.0 200.1.1.2
ip http server
ip http secure-server
!
!
!
control-plane
!
!
line con 0
line vty 5 15
!
end
Here's a nice Cisco Live doc and Lab Minutes video about FlexConnect design and configuration. There are some caveats when using FlexConnect and it's recommended to allocate a bandwidth of 24 kbps per AP with round trip latency no greater than 300 ms. Below is my lab topology which uses a FlexConnect AP (AIR-CAP-2602I) in the Branch office and a Central WLC 2504 in HQ.
You need the AP to join a local WLC in order change the AP
Mode to FlexConnect.
Change the AP Mode (default is local) to FlexConnect on each AP, click on the AP >
General > AP Mode > FlexConnect > Apply.
Click on the new FlexConnect
tab > tick VLAN Support > change Native VLAN ID as necessary > Apply. Note VLAN Mappings is initially grayed out. Native VLAN must match the switch native VLAN configuration (default is native
VLAN 1). Mapping of SSID to 802.1Q VLAN is done per FlexConnect AP.
Click VLAN Mappings
> change the VLAN ID for the SSID to use as necessary > Apply.
Hardcode the HQ Primary and Secondary WLC (if using high availability), go under High
Availability tab > type the Primary Controller Name (mandatory) > type Management
IP address > optionally type a Secondary Controller IP address > Apply.
You'll see the Branch AP join the WLC in HQ. Make sure the WLC has NTP or manual time/clock correctly configured.
Below are console logs captured on the FlexConnect AP.
IOS Bootloader - Starting system.
flash is writable
FLASH CHIP: Numonyx Mirrorbit (0089)
Xmodem file system is available.
flashfs[0]: 123 files, 15 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 31997952
flashfs[0]: Bytes used: 22632960
flashfs[0]: Bytes available: 9364992
flashfs[0]: flashfs fsck took 22 seconds.
Reading cookie from SEEPROM
Base Ethernet MAC address: f8:72:ea:a6:e2:03
Ethernet speed is 100 Mb - FULL Duplex
Loading "flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-mx.153-3.JA8"...#########################
File "flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-mx.153-3.JA8" uncompressed and installed, entry point: 0x2003000
executing...
Secondary Bootloader - Starting system.
Tide MB - 32MB of flash
Xmodem file system is available.
flashfs[0]: 123 files, 15 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 31997952
flashfs[0]: Bytes used: 22632960
flashfs[0]: Bytes available: 9364992
flashfs[0]: flashfs fsck took 9 seconds.
flashfs[1]: 0 files, 1 directories
flashfs[1]: 0 orphaned files, 0 orphaned directories
flashfs[1]: Total bytes: 12257280
flashfs[1]: Bytes used: 1024
flashfs[1]: Bytes available: 12256256
flashfs[1]: flashfs fsck took 1 seconds.
Base Ethernet MAC address: f8:72:ea:a6:e2:03
2600/3600 AP, PID: 'AIR-CAP2602I-S-K9 '. Checking for BL upgrade...
BL: C2600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JAY, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Compiled Thu 03-Oct-13 03:35 by sdcunha
BL Build year: 13
Boot CMD: 'boot flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-xx.153-3.JA8;flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-xx.153-3.JA8'
Loading "flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-xx.153-3.JA8"...###############################################
File "flash:/ap3g2-k9w8-mx.153-3.JA8/ap3g2-k9w8-xx.153-3.JA8" uncompressed and installed, entry point: 0x1003000
executing...
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Cisco IOS Software, C2600 Software (AP3G2-K9W8-M), Version 15.3(3)JA8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Fri 22-Apr-16 05:48 by prod_rel_team
Tide MB - 32MB of flash
Initializing flashfs...
flashfs[2]: 123 files, 15 directories
flashfs[2]: 0 orphaned files, 0 orphaned directories
flashfs[2]: Total bytes: 31739904
flashfs[2]: Bytes used: 22632960
flashfs[2]: Bytes available: 9106944
flashfs[2]: flashfs fsck took 9 seconds.
flashfs[2]: Initialization complete.
flashfs[4]: 0 files, 1 directories
flashfs[4]: 0 orphaned files, 0 orphaned directories
flashfs[4]: Total bytes: 11999232
flashfs[4]: Bytes used: 1024
flashfs[4]: Bytes available: 11998208
flashfs[4]: flashfs fsck took 0 seconds.
flashfs[4]: Initialization complete.
Copying radio files from flash: to ram:
Copy in progress...CCCCC
Copy in progress...CCC
Copy in progress...CCCC
Copy in progress...CCCC
Copy in progress...CC
Copy in progress...CCCC
Copy in progress...CC
Copy in progress...CCCCCC
Copy in progress...CCCC
Copy in progress...CC
Uncompressing radio files...
...done Initializing flashfs.
Radio0 present 8764 8000 0 A8000000 A8010000 0
Rate table has 650 entries (20 legacy/224 11n/406 11ac)
POWER TABLE FILENAME = ram:/Y2.bin
Radio1 present 8764 8000 0 88000000 88010000 4
POWER TABLE FILENAME = ram:/Y5.bin
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
export@cisco.com.
cisco AIR-CAP2602I-S-K9 (PowerPC) processor (revision A0) with 188398K/60928K bytes of memory.
Processor board ID FGL1724W123
PowerPC CPU at 800Mhz, revision number 0x2151
Last reset from power-on
LWAPP image version 8.0.133.0
1 Gigabit Ethernet interface
2 802.11 Radios
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: F8:72:EA:A6:12:34
Part Number : 73-14588-02
PCA Assembly Number : 800-37899-01
PCA Revision Number : A0
PCB Serial Number : FOC17230ABC
Top Assembly Part Number : 800-38356-01
Top Assembly Serial Number : FGL1724WXYZ
Top Revision Number : A0
Product/Model Number : AIR-CAP2602I-S-K9
% Please define a domain-name first.
Press RETURN to get started!
*Mar 1 00:00:14.447: %SOAP_FIPS-2-SELF_TEST_IOS_SUCCESS: IOS crypto FIPS self test passed (15)
*Mar 1 00:00:14.903: Registering HW DTLS
*Mar 1 00:00:14.911: APAVC: Initial WLAN Buffers Given to System is 2500
*Mar 1 00:00:14.963: APAVC: WlanPAKs 18174 RadioPaks 17566
*Mar 1 00:00:17.275: %LINK-6-UPDOWN: Interface GigabitEthernet0, changed state to up
*Mar 1 00:00:21.231: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 0 (4)
*Mar 1 00:00:21.347: loading Power Tables from ram:/Y2.bin. Class = E
*Mar 1 00:00:21.347: record size of 3ss: 1168 read_ptr: 4B5642E
*Mar 1 00:00:27.711: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 1 (4)
*Mar 1 00:00:27.755: loading Power Tables from ram:/Y5.bin. Class = S
*Mar 1 00:00:27.755: record size of 3ss: 1168 read_ptr: 4B5642E
*Mar 1 00:00:27.915: Wait until the stile protocol list is initialized.
*Mar 1 00:00:29.099: Start STILE Activation
*Mar 1 00:00:31.031: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to down
*Mar 1 00:00:32.111: %SYS-5-RESTART: System restarted --
Cisco IOS Software, C2600 Software (AP3G2-K9W8-M), Version 15.3(3)JA8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Fri 22-Apr-16 05:48 by prod_rel_team
*Mar 1 00:00:32.111: %SNMP-5-COLDSTART: SNMP agent on host APf872.eaa6.e203 is undergoing a cold start
*Jun 6 03:12:26.083: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
*Jun 6 03:12:27.111: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Jun 6 03:12:27.123: Starting Ethernet promiscuous modelwapp_crypto_init: MIC Present and Parsed Successfully
*Jun 6 03:12:27.271: %SSH-5-ENABLED: SSH 2.0 has been enabled
*Jun 6 03:12:27.271: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Jun 6 03:12:28.115: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Jun 6 03:12:28.327: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down
*Jun 6 03:12:37.159: %LINK-6-UPDOWN: Interface BVI1, changed state to down
*Jun 6 03:12:38.287: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to down
*Jun 6 03:12:40.071: %SOAP_FIPS-2-SELF_TEST_HW_SUCCESS: HW crypto FIPS self test passed (2-16)
*Jun 6 03:12:40.071: DPAA Initialization Complete
*Jun 6 03:12:40.071: %SYS-3-HARIKARI: Process DPAA INIT top-level routine exited
*Jun 6 03:12:41.075: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up
*Jun 6 03:12:43.075: %LINK-6-UPDOWN: Interface BVI1, changed state to up
*Jun 6 03:12:43.507: Currently running a Release Image
validate_sha2_block: Failed to get certificate chain
*Jun 6 03:12:43.931: Using SHA-1 signed certificate for image signing validation.
*Jun 6 03:12:44.219: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
*Jun 6 03:12:44.619: %LWAPP-3-LWAPP_INTERFACE_GOT_IP_ADDRESS: Interface BVI1 obtained IP from DHCP...
*Jun 6 03:12:44.619: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 172.16.1.6, mask 255.255.255.0, hostname APf872.eaa6.1234
*Jun 6 03:12:44.619: %LWAPP-3-LWAPP_INTERFACE_GOT_IP_ADDRESS: Interface BVI1 obtained IP from DHCP...
*Jun 6 03:12:50.223: APAVC: Succeeded to activate all the STILE protocols.
*Jun 6 03:12:50.223: APAVC: Registering with CFT
*Jun 6 03:12:50.223: APAVC: CFT registration of delete callback succeeded
*Jun 6 03:12:50.223: APAVC: Reattaching Original Buffer pool for system use
*Jun 6 03:12:50.223: Pool-ReAtach: paks 18174 radio17566
%Default route without gateway, if not a point-to-point interface, may impact performance
*Jun 6 03:12:57.095: AP image integrity check PASSED
*Jun 6 03:12:57.167: validate_sha2_block:No SHA2 Block present on this AP.
*Jun 6 03:12:57.199:
Note: A random mac address of 0000.0cf2.fb4c
has been chosen for BVI in bridge group 3 since the selected mac address
is already being used by Bridge Group 2.
*Jun 6 03:12:57.199: Ensure that this address is unique.
*Jun 6 03:12:57.203: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Jun 6 03:12:57.203: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset
*Jun 6 03:12:59.203: %LINK-6-UPDOWN: Interface BVI2, changed state to down
*Jun 6 03:12:59.203: %LINK-6-UPDOWN: Interface BVI3, changed state to down
*Jun 6 03:13:07.211: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 255.255.255.255 port 0 CLI Request Triggered
*Jun 6 03:13:12.583: %CDP_PD-4-POWER_OK: Full power - NEGOTIATED inline power source
*Jun 6 03:13:13.683: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Jun 6 03:13:14.683: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Jun 6 03:13:14.783: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Jun 6 03:13:15.683: %LINK-6-UPDOWN: Interface BVI2, changed state to up
*Jun 6 03:13:15.783: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up
*Jun 6 03:13:16.683: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI2, changed state to up
*Jun 6 03:13:16.783: %LINK-6-UPDOWN: Interface BVI3, changed state to up
*Jun 6 03:13:17.783: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI3, changed state to up Translating "CISCO-CAPWAP-CONTROLLER"...domain server (255.255.255.255)
*Aug 24 13:47:09.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.1.1.100 peer_port: 5246
*Aug 24 13:47:09.427: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 10.1.1.100 peer_port: 5246
*Aug 24 13:47:09.427: %CAPWAP-5-SENDJOIN: sending Join Request to 10.1.1.100
*Aug 24 13:47:09.707: %LWAPP-4-CLIENTEVENTLOG:
Checksum required saved version = 8.0.133.0, file flash:/lwapp_reap.cfg
*Aug 24 13:47:10.171: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 24 13:47:10.239: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to administratively down
*Aug 24 13:47:10.239: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 24 13:47:10.859: %LWAPP-4-CLIENTEVENTLOG: OfficeExtend Localssid saved in AP flash
*Aug 24 13:47:11.043: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 24 13:47:11.043: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Aug 24 13:47:11.243: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 24 13:47:11.263: %CAPWAP-5-JOINEDCONTROLLER: AP has joined controller WLC1
*Aug 24 13:47:11.323: %LWAPP-4-CLIENTEVENTLOG: No Flex ACL map configuration file to load. Connect to controller to get configuration file
*Aug 24 13:47:11.323: %LWAPP-4-CLIENTEVENTLOG: No Flex ACL map configuration file to load. Connect to controller to get configuration file
*Aug 24 13:47:11.323: %LWAPP-4-CLIENTEVENTLOG: No LS Flex ACL map configuration file to load. Connect to controller to get configuration file
*Aug 24 13:47:11.323: %LWAPP-4-CLIENTEVENTLOG: No Central Dhcp map configuration file to load. Connect to controller to get configuration fileWLAN id 1, SSID FLEX-WIFI, L2ACL , L2ACL AP capwap_delete_all_l2Acls_in_nacl_list:336. Deleting all L2Acls in AP config
*Aug 24 13:47:11.539: %DOT11-4-NO_HT: Interface Dot11Radio0, Mcs rates disabled on wlan 1 due to not using AES encryption or encryption is not disabled
*Aug 24 13:47:11.543: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to down
*Aug 24 13:47:11.555: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset
*Aug 24 13:47:12.531: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 24 13:47:12.543: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down
*Aug 24 13:47:12.559: %DOT11-4-NO_HT: Interface Dot11Radio1, Mcs rates disabled on wlan 1 due to not using AES encryption or encryption is not disabled
*Aug 24 13:47:12.579: %DOT11-6-DFS_SCAN_START: DFS: Scanning frequency 5300 MHz for 60 seconds.
*Aug 24 13:47:12.583: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Aug 24 13:47:12.591: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 24 13:47:12.599: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 24 13:47:13.595: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up
*Aug 24 13:47:13.595: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 24 13:47:13.623: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 24 13:47:13.631: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to down
*Aug 24 13:47:13.639: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset
*Aug 24 13:47:14.675: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 24 13:47:14.675: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down
*Aug 24 13:47:14.695: %WIDS-6-ENABLED: IDS Signature is loaded and enabled
*Aug 24 13:47:14.699: %DOT11-6-DFS_SCAN_START: DFS: Scanning frequency 5300 MHz for 60 seconds.
*Aug 24 13:47:14.703: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Aug 24 13:47:14.775: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 24 13:47:14.783: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 24 13:47:15.703: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up
*Aug 24 13:47:15.779: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 24 13:47:15.799: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 24 13:47:16.799: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 24 13:47:34.891: %CLEANAIR-6-STATE: Slot 0 disabled
*Aug 24 13:47:34.891: %CLEANAIR-6-STATE: Slot 1 disabled
*Aug 24 13:47:35.379: %CDP_PD-4-POWER_OK: Full power - NEGOTIATED inline power source
*Aug 24 13:48:15.851: %DOT11-6-DFS_SCAN_COMPLETE: DFS scan complete on frequency 5300 MHz
*Aug 24 13:51:26.851: %WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:2 Channel:1 Source MAC:0432.f41b.490d
*Aug 24 14:01:45.723: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:2 Channel:1
Below are some useful WLC CLI commands to verify successfully joined AP.
(Cisco Controller) >show ap summary
Number of APs.................................... 1
Global AP User Name.............................. Not Configured
Global AP Dot1x User Name........................ Not Configured
AP Name Slots AP Model Ethernet MAC Location Country IP Address Clients
------------------ ----- -------------------- ----------------- ---------------- ------- --------------- -------
APf872.eaa6.1234 2 AIR-CAP2602I-S-K9 f8:72:ea:a6:12:34 default location SG 172.16.1.6 1
(Cisco Controller) >show ap join stats summary all
Number of APs.............................................. 1
Base Mac AP EthernetMac AP Name IP Address Status
0c:68:03:d7:ab:cd f8:72:ea:a6:12:34 APf872.eaa6.1234 172.16.1.6 Joined
Create the WLAN SSID and the Layer 2 and Layer 3 security policy.
Tick Enabled under Status and Broadcast SSID.
Select a Layer 2 security policy. In this case, I chose Static WEP which is insecure and good for lab purpose only. I've used 40 bits WEP key size. Below are the equivalent number of HEX and ASCII characters when choosing the WEP key size:
104 bits = 26 HEX characters or 13 ASCII characters
Allow local switching (for VLANs) on the FlexConnect AP under WLAN > Advanced tab > tick Enable on FlexConnect Local Switching and Learn Client IP Address > Apply.
I've used my iPhone to join FLEX-WIFI SSID which is scanned on the Branch AP.
You can check the wireless clients on the WLC under Monitor > Clients.
Click on a specific client MAC address to view more details.
To test FlexConnect AP local switching, I've shutdown the WLC port and my iPhone wifi was still connected locally.
HQ#show cdp neighbor
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
BRANCH Fas 0/8 171 R S I WS-C3560- Fas 0/24
WLC1 Fas 0/1 138 H AIR-CT250 Gig 0/0/1
HQ#conf t
Enter configuration commands, one per line. End with CNTL/Z.
HQ(config)#interface f0/1
HQ(config-if)#shut
HQ(config-if)#do ping 172.16.1.5 // IPHONE IP ADDRESS
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/15/59 ms
BRANCH#
BRANCH#ping 10.1.1.100 // HQ WLC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.100, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
I've just used two Cisco 3560 L3 switches for this lab and below are the running-config.
HQ#show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
SW1 Fas 0/8 179 R S I WS-C3560- Fas 0/24
WLC1 Fas 0/1 147 H AIR-CT250 Gig 0/0/1
HQ#show run
Building configuration...
Current configuration : 949 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname HQ
!
!
no aaa new-model
system mtu routing 1500
ip subnet-zero
ip routing
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0/1
description ### WLC - 10.1.1.100 ###
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
description ### MGMT PC - 10.1.1.50 ###
!
interface FastEthernet0/8
description ### WAN LINK TO BRANCH ###
no switchport
ip address 200.1.1.2 255.255.255.252
!
interface GigabitEthernet0/1
!
interface Vlan1
ip address 10.1.1.1 255.255.255.0
!
ip classless
ip route 172.16.1.0 255.255.255.0 200.1.1.1
ip http server
!
!
control-plane
!
!
line con 0
line vty 0 4
login
line vty 5 15
login
!
end
HQ#ping 200.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 200.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms
BRANCH#show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Device ID Local Intrfce Holdtme Capability Platform Port ID
HQ Fas 0/24 153 R S I WS-C3560- Fas 0/8
APf872.eaa6.e203 Fas 0/23 166 T B I AIR-CAP26 Gig 0
BRANCH#ping 200.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 200.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/8 ms
BRANCH#show run
Building configuration...
Current configuration : 1596 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname BRANCH
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
system mtu routing 1500
ip subnet-zero
ip routing
ip dhcp excluded-address 172.16.1.1
!
ip dhcp pool LAN
network 172.16.1.0 255.255.255.0
default-router 172.16.1.1
option 43 hex f014.0a01.0164
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
description ### FLEXCONNECT AP ###
!
interface FastEthernet0/24
description ## WAN Link to HQ ###
no switchport
ip address 200.1.1.1 255.255.255.252
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
ip address 172.16.1.1 255.255.255.0
!
ip classless
ip route 10.1.1.0 255.255.255.0 200.1.1.2
ip http server
ip http secure-server
!
!
!
control-plane
!
!
line con 0
line vty 5 15
!
end
