IOS Access Point ACL Filters

I've been trying to find the right commands for enabling ACLs on 1242s.  I think I've found the right document - this one references commands that *acutally* work on code version 12.4(13d)JA (lab software list)  Excerpt below of ACL Filter Configuration document:

• Filters that use standard ACLs
  
  
  • In Cisco IOS® Software Release 12.3(7)JA, the ACL number can be any number from 1 to 99. Standard ACLs can also use the extended range of 1300 to 1999. These additional numbers are expanded IP ACLs.
  • When a standard ACL is configured to deny access to a client, the client still associates to the AP. However, there is no data communication between the AP and the client.
  
  
  
  • The command syntax format of a standard ACL is access-list access-list-number {permit | deny} {host ip-address | source-ip source-wildcard | any}.
  
  
  
  • AP#access-list 25 deny host 10.0.0.2
        !--- Create a standard ACL 25 to deny access to the
        !--- client with IP address 10.0.0.2.
    AP#access-list 25 permit any
        !--- Allow all other hosts to access the network.
    AP#interface Dot11Radio 0
    AP#ip access-group 25 in
        !--- Apply the standard ACL to the radio interface 0.
   
• Filters that use extended ACLs
  
  
  •  In Cisco IOS Software Release 12.3(7)JA, extended ACLs can use numbers in the range of 100 to 199. Extended ACLs can also use numbers in the range of 2000 to 2699. This is the expanded range for extended ACLs.
  • Extended ACLs compare the source and destination addresses of the IP packets to the addresses that are configured in the ACL in order to control traffic. Extended ACLs also provide a means to filter traffic based on specific protocols. This provides a more granular control for the implementation of filters on a WLAN network.
  • Extended ACLs allow a client to access some resources on the network while the client cannot access the other resources. For example, you can implement a filter that allows DHCP and Telnet traffic to the client while it restricts all other traffic
  
  
  
  •  This is the command syntax of extended ACLs: Note: This command is wrapped to four lines because of spatial considerations.
    
    
    

    access-list access-list-number [dynamic dynamic-name [timeout minutes]]
    {deny | permit} protocol source source-wildcard
    destination destination-wildcard [precedence precedence] 
    [tos tos] [log | log-input] [time-range time-range-name]

  •  AP#ip access-list extended 100
        !--- Create an extended ACL 100 to allow Telnet and DHCP.
    AP#permit tcp any any eq telnet
        !--- Allow Telnet traffic.
    AP#permit udp any any eq bootpc
        !--- Allow DHCP traffic.
    AP#permit udp any any eq bootps
        !--- Allow DHCP traffic.
    AP#deny ip any any
        !--- Deny all other traffic types.
    AP#exit
        !--- Return to global configuration mode.
   
  
• Filters that use MAC address ACLs
  
  
  •  In Cisco IOS Software Release 12.3(7)JA, MAC address ACLs can use numbers in the range of 700 to 799 as the ACL number. They can also use numbers in the expanded range of 1100 to 1199. 
  •  You can use MAC address-based filters in order to filter client devices based on the hard coded MAC address. When a client is denied access through a MAC-based filter, the client cannot associate with the AP. MAC address filters allow or disallow the forwarding of unicast and multicast packets either sent from or addressed to specific MAC addresses.
  
  
  
  • This is the command syntax to create a MAC address-based ACL on the AP:
    Note: This command has been wrapped to two lines because of spatial considerations.
        access-list access-list-number {permit | deny}
        48-bit-hardware-address 48-bit-hardware-address-mask 
   
  • AP#configure terminal
    AP#access-list 700 deny 0040.96a5.b5d4 0000.0000.0000
        !--- This ACL denies all traffic to and from
        !--- the client with MAC address 0040.96a5.b5d4.
    AP#dot11 association mac-list 700
        !--- Apply the MAC-based ACL.
    After you configure this filter on the AP, the client with this MAC address, which was previously associated to the AP, is disassociated. The AP console sends this message:
    AP# *Mar 1 01:42:36.743: %DOT11-6-DISASSOC: Interface
             Dot11Radio0, Deauthenticating Station 0040.96a5.b5d4
   
• Filters Using Time-Based ACLs
• Time-based ACLs are ACLs that can be enabled or disabled for a specific period of time. This capability provides robustness and the flexibility to define access control policies that either permit or deny certain kinds of traffic..
• Note: A time-based ACL can be defined either on the Fast Ethernet port or on the Radio port of the Aironet AP, based on your requirements. It is never applied on the Bridge Group Virtual Interface (BVI).

•  AP#configure terminal
  AP#time-range Test
      !--- Create a time-range with name Test.
  AP(config-time-range)# periodic weekdays 7:00 to 19:00
      !--- Allows access to users during weekdays from 7:00 to 19:00 hrs.
  AP# ip access-list extended 101
  AP#permit tcp 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range Test
      !--- This ACL permits Telnet traffic to and from
      !--- the network for the specified time-range Test.
  Issue this command in order to apply this time-based ACL to the Ethernet interface:
  AP#interface FastEthernet0
  AP#ip address 10.1.1.1 255.255.255.0
  AP#ip access-group 101 in
      !--- Apply the time-based ACL.

 Avoid the use of both the CLI and the web-browser interfaces to configure the wireless device. If you configure the wireless device with the CLI, the web-browser interface can display an inaccurate interpretation of the configuration. However, the inaccuracy does not necessarily mean that the wireless device is misconfigured. For example, if you configure ACLs with the CLI, the web-browser interface can display this message: 

WARNING:
Filter 700 was configured on interface Dot11Radio0.1 using CLI.
It must be cleared via CLI to ensure proper operation of the web interface.

Lab attempt 02/02/2010 - first go round with the lab

Well, I suppose I should put a few words together about my first experience at sitting for a Cisco CCIE Lab.  I didn't expect to pass, considering that there isn't any formalized training available for the wireless lab like there is for all the other CCIE tracks.  I scored a 60, and needed an 80 to pass.  I signed up for the next exam right after checking my score, and the earliest available date is was in August, so I booked the date.

I was glad that someone recommended that I bring ear plugs - they were a godsend since the CCIE Pod 01 I had was right next to the racks of equipment.  I had originally thought the ear plugs were so you didn't hear any one elses' freak out..  I couldn't hear anything over the noise of the rack w/o them & was glad for the quiet they provided.

I lost some time trying to figure out which shortcut on the desktop led to the PC that would let me web into the controllers once I'd gotten them initially configured.. I guess I should have asked about that sooner instead of waiting till after lunch.  I really didn't like the way the tasks were laid out in the book.  I felt that the information I needed was scattered around within the text, and the key pieces of information could have been laid out more clearly.  I guess that is part of the point of the lab though - and I need to come up with a way to lay out the information I'll need for all the configuration before I start.  I spent a lot of time flipping back and forth through the diagrams and scenarios looking for naming conventions and vlan numbers when if I had made my own "spreadsheet" it would have been one stop shopping.

Now that I know what I'm up against, I have drawn up a better plan of attack.  I have to be *much* quicker at the CLI of IOS APs and for WLCs.  I couldn't have anticipated how little time I'd have to complete each task correctly within the 8 hours allotted for the lab.

RF Group Leader Election - GROUPIES and HELLOs

[notes]

Initially, every controller assumes that it is the RF group leader for its configured RF group.  It creates its unique group ID and adds itself to the group.  After this, the controller sends a HELLO packet to all the controllers it knows about every 10 seconds.

In addition to the HELLO message, the controller colleges neighbor messages from its APs.  These collected neighbor messages are used to determine if another controller has a higher group ID.  If that is the case, the controller joins the RF group and becomes a GROUPIE.  After a controller finds another controller with a group ID larger than itself, it triggers a 60 second timer to make sure the current leader is still active.


If the GROUPIE controller does not receive a HELLO response within the allotted time, the controller considers the RF group leader down and the election process begins again.

Deploying and Troubleshooting Cisco Wireless LAN Controllers ISBN # 1587058146

[notes]

Multicast is not supported on APs that are connected directly to the local port of a 2000 or 2100 series controller

Not supported on 2000, 2100 or NMC:

• spanning tree
• L2 transport 
• VPN termination
• External Web Authentication web server list
• Port Mirroring
• Cranite, Fortress, AppleTalk
• QoS per-user bandwidth
• IPv6 pass-through
• LAG or Ether channel
• Multicast Unicast Replication Mode

The load balancing algorithm is src-dst-ip

• switch(config)# port-channel load-balance src-dst-ip

The Cisco WiSM requires software release SWISMK9-32 or later
The SUP720 12.2(18)SXF2 supports the WiSM software release 3.2.78 or later
The SUP72012.2(18)SXF5 supports the WiSM software release 4.0.155.5
WiSMs in the 7609 or 7613? both routers must be running 12.2(18)SXF5 or later

The WLC Network Module is supported on Cisco 28/37/38xx Series Integrated Services Routers running Cisco IOS 12.4(11)T2, 12.4(11)T3, and 12.5


Want to put a WLC Network Module in a Catalyst 3750G switch? it must be running 12.2(25)FZ or 12.2(25)SEE.

REAP Mode Features:

From ccie(w)

LWAP and CAPWAP Comparison Chart:

From ccie(w)

Manual Dissection of the Discovery Response

From ccie(w)

 

The best wireless security cross reference EVAR.

I'd been looking for a concise wireless security cross reference graphic for ages now - and I found it a couple of evenings ago.  Turns out it was in the 2005 book Cisco 802.11 Wireless Networking Quick Reference.

Here it is, in all its glory:

From ccie(w)

Gilbert 1995 - 2009

Gilbert

1995 - 2009

We've never loved a pet so much.  He was a central part of our lives for thirteen years. He was a wonderful little guy.  He went through so much in is little cat life - burned his foot on the stove, suffered from a blocked bladder, had monthly seizures until they were suppressed with Phenobarbitol, and finally suffered acute renal failure and his one partially working kidney was not filtering the IV fluids he was being given.  He could no longer be a self-sufficient cat, and we had to put him to sleep on January 2nd 2009. All of the doctors he saw in his last week alive all said that his case wasn't brought on by the food he ate on Monday December 27th, but I know he was acting A-OK before I bought a new bag of Iams.  He had been eating Iams Multi-Cat formula for years, and that Sunday I bought a bag of ProActive Health Active Maturity Formula.  His first meal out of this bag was breakfast on Monday.  I had to leave town on business that day after feeding him breakfast, but Greg told me that he had vomited shortly after eating.  Greg gave him some soft food that we had in the house (also Iams) and Gilbert seemed a little better Tuesday morning.  I had not put 2 and 2 together that the new bag of food was really making him sick, and fed him breakfast out of the new bag on Tuesday december 28th.  He vomited much later in the day, around 6pm.  I took the bag of Iams back to the store and bought him some Newman's Own Organic cat food.  He ate some of this food late Tuesday evening and he began drinking water much later that night. On Wednesday morning his condition seemed worse, and he was not walking around or meowing for breakfast.  I offered him some organic soft food and he licked it a little but, but could not eat.  I took him to the vet, and the thought he had another blockage, put him on IV fluids and a catheter, and referred me to a 24 Emergency Clinic for further treatment.  In just 5 short days he would be gone.  It just isn't fair that little Gilbert got such a raw deal, and that no other alternatives to euthanasia are available to a cat suffering from renal failure.  His kidney ultrasound showed that one kidney was very small, had a lot of tissue damage and was most likely not working at all.  His right kidney was over sized in order to compensate for the smaller left kidney.  How long he had had this problem is anyone's guess.  I just wish I had listened to the vet when he had his Phenobarb levels checked in October.  She recommended soft food for him since it has a higher moisture content than the dry food.  I don't know why I didn't listen. A cat shouldn't have to go through such things.  If he hadn't been neutered, he probably wouldn't have had the urinary tract problems that he did.  If only I had know these things, a lot of his pain could have been avoided.  If I could go back and do it all over again, I wouldn't have had him neutered and I would have made sure he ate the best cat food that was available.  I didn't know that Cat Chow was not good for cats to eat.  I didn't know that Eukanuba and Iams were part of the same food provider, and were most likely poisoning my cat ever so slowly. He lived thirteen years, but I wish there could have been with us longer, and not had to endure so much while he was alive.  Gilbert was such a great cat and constant companion, I should have had a tribute to him while he was alive.

Generate CSR for Third-Party Certificates and Download Unchained Certificates to the WLC

I have never used OpenSSL to generate a certificate for a controller.  I was watching Jerome's video about the steps needed to do this & he mentioned that the version of OpenSSL that he has used that worked was 0.98k.  It was quite difficult to find this version online - it seems to be a few revs old.
--update-- I'd really like to be able to setup a CA on the laptop that is running the VM of ACS & WCS, but the laptop is not a domain member and I'm having difficulties getting the CA and IIS to operate as detailed in MS documentation.  I'm guessing it is because the laptop is in a workgroup.--update--


Here is a link to where I downloaded Win32OpenSSL-0_9_8k.exe
You will most likely need to install MS Visual C++ 2008 Redistribuables as well as the SP1.

The direct link to the Cisco documentation that describes the steps needed to generate a certificate on behalf of a controller is here: LINK  
You should be familiar with navigating to the Cisco documentation by starting out at the main documentation page: LINK

Jerome's video demonstrating the process is on YouTube in two parts: