1.1   General Facts

• CDP version 2 is supported on 2X00 and 440X series (not in integrated WLCs such as WiSM, WLCM etc)

• Virtual Interface used by layer 3 security, DHCP relay, and Mobility Managers

• up to 17 Radius Servers per WLAN.

• RFID timeout on WLC should be 8-10 times the tag beacon rate.

• Max 512 VLANs

• ESM - 1 for 4402, 2 for 4404, 1 Gbit and 1000 clients per ESM.

• Can control up to 16 WLANs for each 10X0 series AP and 8 WLANs for the 1130/1200/1230 and 1240 series AP

• Radius server index -> priority

• Up to 3 rogues can be concurrently contained by a single AP with a maximum of 4 APs one rouge can be contained

• All Multicast packets are send at the lowest QoS level.

• AP Power level settings:

  • 1= Max
  • 2= 50%
  • 3= 25%
  • 4= 6.25% to 12.5%
  • 5= 0.195% to 6.25%

• The WLC keeps up to 5 controller crash files.

• An Access List (ACL) can be applied either on a VLAN interface or on a specific WLAN:

  config wlan acl [<Wlan id>] [<ACL name> | none]
  

  The same is true with MAC filters.

• Maximum 256 message logs are stored locally (FIFO). Use external syslog server!

1.2   Etherchannel - Link Aggregation

When a WLC (4404 or WiSM) LAG port is connected to a Catalyst 6500 channel group (or Cat 3750G) then note the following rules:

• Without LAG, each WLC port only supports 48 LAPs. With LAG enabled the total LAP capacity is available to all interfaces! That is if on a 4404 e. g. three interfaces fail the remaining can handle up to 100 LAPs. With LAG only one functional physical port is needed to maintain connectivity!

• LAG requires the Etherchannel to be configured for the "on" mode on both the WLC and the switch. There is not negotiation protocol supported on the WLC.

• Therefore it does not matter if the switch is configured with either Link Aggregation Control Protocol (LACP) or the Cisco Port Aggregation Protocol (PAgP). Both LACP and PAgP are not supported on the controllers.

• On the switch a load-balancing method must be chosen that terminates all IP datagram fragments on a single WLC port pair. On the 4404 there is one Network Processing Unit (NPU) for fragment reassembly for ports 1+2 and another NPU for ports 3+4. (On the 4402 there is only a single NPU for ports 1+2 so there is no problem with load balancing.)

  • The recommended load-balancing method for Catalyst switches is port-channel load-balance src-dest-ip.

• All WLC ports must belong to the same LAG group! Only one LAG group is supported, therefore the WLC can only be attached to one switch (otherwise disable LAG mode). However it is recommended to terminate the links on different modules on a modular switch. Terminating on two different modules within a single Catalyst 6500 switch provides redundancy and ensures that connectivity between the switch and the controller is maintained when one module fails.

• HSRP is NOT supported!

• Any change to the LAG configuration requires a controller reboot.

• When enabling LAG:

  1. Mgmt and AP-Mgr interfaces move to the LAG port
  2. All dynamic AP-Mgr interfaces are deleted
  3. VLAN interfaces are moved to LAG port
  4. WLANs are disabled and mapped to the Mgmt interface - you need to reassign them to the VLANs!
  5. You can only create interfaces on the LAG logical port 29.

  All packets are transmitted over that physical ports where the packets were received.

• When disabling LAG:

  1. Mgmt and AP-Mgr interfaces as well as VLAN interfaces move to port 1
  2. You should define secondary ports for all interfaces (for backup)
  3. You must assign AP-Mgr interfaces to each port

  Packets can be forwarded over any port no matter where it originally came in.

• LAG is enabled per default and cannot be disabled on the WiSM and on the integrated WLC inside the Catalyst 3750G.

PAgP switchover takes at least 30 seconds, which is too slow to maintain certain traffic (for example, TCP) when switching from port to the other. There is no workaround for this limitation.

LAG configuration on the switch:

interface GigabitEthernet1/0/18
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 30 mode on !!! specifying a channel group number forces LAG without PAgP or LACP
!
interface GigabitEthernet1/0/20
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 30 mode on !!! specifying a channel group number forces LAG without PAgP or LACP

1.3   LWAPP Protocol Issues

• Destination ports:

  • Data: 12222
  • Control: 12223

  For each tunnel the AP is the client and uses a random source port.

  That means a firewall must permit:

  • UDP traffic with destination port 12223 for the Ḿanagement interface
  • UDP traffic with destination port 12223 and 12223 for the AP Manager interface
  • And of course TCP 443 and TCP 22 on the Management port

• Observed (FYI):

  • From SP=12221 (AP) to DP=12222 (WLC-Data)
  • From SP=12223 (WLC-Control) to DP=52799

• Inter-controller messages

  • 16666 to 16666 and 16667 to 166667 (mobility traffic)
  • WLCs must not be separated by NAT because the WLC's IP address is also carried inside the (encrypted) packets and compared with the header source address. See Controller Hunt Algorithm for further details.

• LWAPP discovery response contains:

  • controller name
  • controller type
  • current number of APs (load)
  • AP capacity
  • AP Manager ip address
  • Master Controller status

• L2 LWAPP uses Ethertype 0xbbbb

1.4   DHCP Issues

ip dhcp pool POOL-1000er
  network 10.1.1.0 /24
  default-router 10.1.1.254
  ...
  option 60 ascii "Airespace.AP1200" ! identifies 1000 series
  option 43 ascii "192.168.10.9,172.26.12.89"
!
ip dhcp pool POOL-1200er
  network 10.2.2.0 /24
  default-router 10.2.2.254
  ...
  option 60 ascii "Cisco AP c1200"
  option 43 hex f108ac1a0c59c0a80a09

1.5   Controller Hunt Algorithm

When a LAP boots up it performs three steps:

1. Get an IP address (DHCP)

2. Create a List of reachable WLCs. The reachability is verified via an LWAPP discovery request/response mechanism. In order to find valid WLC IP addresses, the LAP does the following:

   1. The LAP sends a L3-LWAPP discovery message to 255.255.255.255 (if L2-LWAPP is configured then only a L2 broadcast is used)
   2. The LAP checks whether IP addresses of any previously joined WLCs are stored in its flash
   3. The LAP asks other LAPs using its radio interface and the Over the Air Provisioning (OTAP) protocol
   4. The LAP checks whether a DHCP server sent WLC addresses via DHCP option 43
   5. The LAP tries a DNS name resolution for the name CISCO-LWAPP-CONTROLLER@local-domain

3. Select one WLC based on a priority scheme:

   1. Prefer WLCs that are already stored in the flash. (The primary is tried first, the tertiary last.)
   2. Prefer the WLC with the Master Controller Flag set. This flag is included in the header of a discovery response.
   3. Prefer the least loaded WLC. Every WLC announces the number of already connected LAPs via the discovery response.

Note that the Master Controller Mode is disabled after reboot or SW upgrade.

• On the WLC's AP pages enter the names of the primary, secondary, and tertiary WLC. Do NOT enter their IP addresses! Use the same names as can be seen on the monitor general page.

  When a LAP associates to the primary WLC, this WLC will automatically send the IP addresses of the secondary and tertiary WLCs to the LAP.

• After a LAP joins a WLC, the LAP learns the IP addresses of other WLCs in that mobility group from its joined WLC.

• Subsequently, the AP sends LWAPP primary discovery requests to each of the WLCs in the mobility group.

• The WLCs respond with a primary discovery response to the LAP. This message includes information about the WLC type, the total capacity, and current AP load.

• As long as the WLC has the AP Fallback parameter enabled, the AP can decide to change over to a less-loaded WLC.

1.6   LAP Failover

• Place WLCs in the same Mobility Group, then the LAP failover is "seamless" (typically 30-80 seconds switchover delay to the other WLC).

• What happens when you power down the primary WLC:

  1. Each associated LAP waits for the heartbeat timeout (30 seconds)
  2. Then each LAP sends 7 heartbeats (one per second) to the WLC
  3. Then each LAP searches another WLC using the default process

• Optionally the heartbeat can be reduced down to 1 second

1.7   REAP

Note: max WAN RTT is 100 ms, the minimum datarate is 128 kbit/s.

Between the access point and the controller, a minimum of a 500 byte MTU is supported.

1.8   RF-Groups and Auto-RF

• If APs on different WLCs hear validated (same RF group name) neighbors at -80 dBm or stronger they form dynamically an RF group
• RRM algorithms run at 600 seconds interval by default
• WLAN status message every 15 seconds 3x is dead timer

• Up to 20 WLCs can be member of one RF group.
• Up to 1000 LAPs may be used in total.
• You need at least 4 LAPs so that Auto-RF (Radio Resource Management, RRM) can work.
• Every 10 minutes one WLC (the Group Leader) decides if a channel/power adjustment is necessary.

The Group Leader is dynamically elected and cannot be chosen by an administrator. The RF group leader analyzes the real-time radio data collected by the group and calculates a master power and channel plan with -65 dBm on the cell borders.

1.9   Mobility and Mobility Groups

• Up to 24 WLCs can be member of one mobility group (or up to 12 WiSMs = 3600 LAPs).
• Traffic to Client (roamed) via the Anchor system and via EoIP to Foreign
• Traffic from Client via the Foreign System.
• Uses ports 16666 and 16667

Normal Mobility Event (Roam)

'Client Announce', 'No handoff'

Mobility Anchor Event

'Anchor Export Request', 'Anchor Export Request ACK', 'Export Foreign', 'Export Anchor'

1.10   WLAN Override

• If not all SSIDs should be visible from every AP
• Simply select all SSIDs that should be supported by one or more selected APs
• Either from the WLC: Wireless > Radios 802.11b/g/n enable WLAN Override and selet the desired SSIDs from the list
• Easier: From the WCS configure an appropriate AP Configuration Template

1.11   AP Groups

• Idea: when you have multiple locations, want to support the same SSID everywhere, but map that SSID in different (typically location-specific) VLANs.

• Configuration from the Controller:

  1. Controller > Interfaces - Add your desired VLAN interface for that location.
  2. WLANs - Select your WLAN and assign a default VLAN interface or a dummy VLAN interface which is not assigned in any switch's VLAN database (so it will not provide connectivity)
  3. WLANs > Advanced - Create a new AP Group and an associated SSID to VLAN mapping
  4. Wireless > All APs - Select your APs in that locations, and under the Advanced tab, add this AP to your AP Group.

1.12   Aggressive load balancing

• Normally (without Aggressive Load Balancing) clients automatically prefer another AP when the current AP has already 12 clients associated. This leads to an automatic load balancing.
• Aggressive Load Balancing tries to evenly distribute all clients of one WLC. By default the threshold is 3 clients per LAP.
• Requires client to be 'heard' for at least 5 seconds
• WLC monitors acceptable RSSI and SNR value
• Controller will list up to 8 possible APs per client
• Association response contains status code=17 to prevent the client to associate
• A Window value can be used to configure a tolerance. A client is only denied from association if the desired AP has more clients associated than the best alternative AP has plus this window value. Default: 0.

Note: The WLC only uses the user timeout and session timeout settings to terminate client sessions if aggressive load balancing is disabled.

1.13   Standard IDS Signatures on WLC

• Bcast Deauth
• NULL probe resp
• Floods of Assoc, Reassoc, Probe, Disassoc, Deauth, EAPoL, Mgmt Frame
• Res mgmt 6&7, D, E&F
• Netstumbler 3.2.0, 3.2.3, 3.3.0, generic
• Wellenreiter
• FakeAP
• AP impersonation
• Spoofed deauth frame
• FATA Jack
• Honeypot AP
• Monkey Jack
• MITM
• Broadcast deauth frame
• Valid stations, invalid SSID
• Invalid OUIs
• WEP Weak IV detection

1.14   Web Authentication

• The maximum number of local users in the local database:

  • Absolute maximum: 2048
  • Default-maximum: 512 [Security>General]

The configured datavase size is shared by local management users (including lobby ambassadors), net users (including guest users), MAC filter entries, and disabled clients.

1.15   Client exclusion policy, number of trials

Excessive 802.11 Association Failures

Clients are excluded on the sixth 802.11 association attempt, after five consecutive failures.

Excessive 802.11 Authentication Failures

Clients are excluded on the sixth 802.11 authentication attempt, after five consecutive failures.

Excessive 802.1X Authentication Failures

Clients are excluded on the fourth 802.1X authentication attempt, after three consecutive failures.

IP Theft or IP Reuse

Clients are excluded if the IP address is already assigned to another device.

Excessive Web Authentication Failures

Clients are excluded on the fourth web authentication attempt, after three consecutive failures.

1.16   Rogue AP/Client Containment

• Up to 4 APs can be used for containment of a rogue
• Using more AP for containment
• Only up to 3 rogues to be concurrently contained by any single access point

1.17   Quality of Service (QoS)

2.1   Disable Mode Button

When autonomous APs are upgraded into lightweight mode the WLC can tell them to disable the Mode button:

config ap reset-button {enable | disable} {ap-name | all}

The reset button on converted APs is enabled by default.

2.2   Check Certificate Issues

Especially to troubleshoot upgraded APs (i. e. from autonomous to lightweight) sometimes the Discovery and Join handshake must be observed:

debug lwapp errors enable
debug pm pki enable           !!! This shows certificate problems in detail (also the signature!)

show auth-list