wireless clients connected to wired network

WILLIAM STEGMAN · ‎12-03-2009

I have WLC 2112, and I want to be able to identify clients who are connected to our external wireless network while simultaneously connected to the wired internal LAN. APs that are wired and also emitting RF are recognizable by the WLC, but apparently not client who are wired and connected to an unclassified or rogue AP. Is there a way to find these clients with wired and wireless connections?

thank you,

Bill

Leo Laohoo · ‎12-03-2009

Some network cards or BIOS have disabled LAN switching.

If you look at your switch logs you should see something like MAC addressing flapping between ports and . That's a give-away.

Another is to look at your main console under "Rogue on Wired Network".

WILLIAM STEGMAN · ‎12-03-2009

I set logging to informational but don't see any messages related to clients MAC addresses flapping. If I go to Monitor, Rogues, Rogue Clients, it shows a client connected to an unclassified AP as Rogue. That AP is one of ours outside our LAN. If I connect my laptop to the outside AP, it shows me as a rogue client even if I am not simultaneously wired to the LAN.

thx

j-mccarthy · ‎12-07-2009

ethernet nic and wireless nic will have different mac addresses

windows should prefer the ethernic nic over the wireless as it'll have a lower metric

do a route print on a client connected to wired and wireless networks and you should see the wired network is the preferred interface. there should be no "flapping" between interfaces.

Richard Atkin · ‎12-16-2009

Hi Bill,

Unfortunately there's no easy way to achieve this in most situations.

The Wired & Wireless Interfaces will have different MAC Addresses, so there's nothing clever you can do at L2.

If you run 802.1x on the LAN & WLAN you could probably limit the number of concurrent session for a given username to 1, which would mean that which ever NIC came up first would be the one that stays active for the client. This is a bit messy and I've never tried it, but it should work.

The only sure-fire way I know of resolving this problem is by deploying CiscoSecure Services Client ('CSSC') which has the ability to force the Client to only use one NIC at a time, and you can prioritise the NIC's so if they are both plugged in / turned on, you can say which should have priority.

Rgds,

Richard

WILLIAM STEGMAN · ‎12-16-2009

Thank you Richard. I was afraid it wasn't really possible with the APs and WLC alone. I

think a sales rep and pre sales engineer were a bit overzeolous in their claims.

Leo Laohoo · ‎12-16-2009

wstegman wrote:

Thank you Richard. I was afraid it wasn't really possible with the APs and WLC alone. I

think a sales rep and pre sales engineer were a bit overzeolous in their claims.

I am soooooooooooooooo not going to make a swipe at this. He he he ...

.
.
.
.

I'm sooooooooooooooooooo tempted. But I just won't.
.
.
.
.
.
.
.
.
.
.
.
.
Let's just say that some Sales people make promises the company won't keep. (There I said it! Oh what a relief it is!)