Solved: Issue in installing Lightweight AP's in network environment of Autonomous AP's

LAN NMC · ‎03-31-2015

Hello All,

In My organization scenario, we are using Autonomous AP's. Every floor has couple of them installed to cover the network of an entire floor.

Now company purchased one WLC 5508 and Light weight AP's.

I have assigned this project to remove one Autonomous AP and replace with this Light wight AP's on each floor. So that in new scenario each floor has one Autonomous AP and one Lightweight AP.

Please note: Autonomous AP's are not connected to WLC.

Current Scenario: Current Autonomous AP's are configured on WPA-TKIP

I have configured the WLC and Installed the Lightweight AP's on same WPA-TKIP with same SSID however I am now facing the below issue.

- User/Laptop are unable to connect on Lightweight AP with WPA-TKIP however when I configured this User/Laptop with WPA2enterprise users are able to connect it.

Could you please suggest what should I do to get both this AP's with same WPA-TKIP.

I have one solution that I can configure the Autonomous AP's with WPA2Enterprise but that will be hectic for me to go and reconfigure the Clients/User's Machine.

Can you all suggest any alternative method please ?

Thanks.

Scott Fella · ‎04-07-2015

Are you 100% sure that the clients are configured for WPA/TKIP? If they were, they shouldn't be able to connect to WPA2/TKIP. If you have a Windows XP or Win 7 machine, you should be able to look at the configuration.

Now if you the users work fine on WPA2/TKIP, why not just leave that? You should anyways look at using WPA2/AES for security reasons.

As far as the autonomous AP's, what does the config look like for that? Can you get a device that is setup for WPA2/TKIP to connect to one of those access points?

-Scott

-Scott
*** Please rate helpful posts ***

View solution in original post

Scott Fella · ‎03-31-2015

Post a screen shot of your WLAN layer 2 configuration. Seems like if users are connecting with WPA2, then you have that enabled on the WLAN. From the CLI, you can also post the show WLAN <wlan id>

-Scott

-Scott
*** Please rate helpful posts ***

LAN NMC · ‎04-07-2015

Hi Scott,

Thanks for the reply.

Please find the below snapshot of the WLAN Layer 2 and SH WLAN from CLI of WLC.

Concern here is I want my users to connect it to the WLC on WPA/TKIP which is not happening.

I can see Machine is trying to connect to WLC in WLC GUI but unfortunately it is not getting IP.

However As soon as I changed the WLC configuration to WPA2/TKIP its connecting.

Could you please suggest and help to understand why it is not connecting to WPA/TKIP.

Thanks,

PS: CLI "sh wlan" command is run when I set WLC to WPA2 / AES

(Cisco Controller) show> wlan 1

WLAN Identifier.................................. 1
Profile Name..................................... cisco
Network Name (SSID).............................. cisco
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Disabled
AAA Policy Override.............................. Enabled
Network Admission Control
Client Profiling Status ....................... Disabled
DHCP ......................................... Disabled
HTTP ......................................... Disabled
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Maximum number of Clients per AP Radio........... 200
Number of Active Clients......................... 1
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 86400 seconds
User Idle Timeout................................ Disabled

User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... Cisco
CHD per WLAN..................................... Disabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ management
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
mDNS Status...................................... Disabled
mDNS Profile Name................................ unconfigured
DHCP Server...................................... 172.24.1.5
DHCP Address Assignment Required................. Enabled
Static IP client tunneling....................... Disabled
PMIPv6 Mobility Type............................. none
Quality of Service............................... Silver
Per-SSID Rate Limits............................. Upstream   Downstream
Average Data Rate................................   0          0
Average Realtime Data Rate.......................   0          0
Burst Data Rate..................................   0          0
Burst Realtime Data Rate.........................   0          0
Per-Client Rate Limits........................... Upstream   Downstream
Average Data Rate................................   0          0
Average Realtime Data Rate.......................   0          0

Burst Data Rate..................................   0          0
Burst Realtime Data Rate.........................   0          0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
   Authentication................................ 172.24.2.15 1812
   Accounting.................................... 172.24.2.15 1813
      Interim Update............................. Disabled
   Dynamic Interface............................. Disabled
   Dynamic Interface Priority.................... wlan

Local EAP Authentication......................... Disabled
Security

   802.11 Authentication:........................ Open System
   FT Support.................................... Disabled
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Disabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
      Auth Key Management
         802.1x.................................. Enabled
         PSK..................................... Disabled
         CCKM.................................... Disabled
         FT-1X(802.11r).......................... Disabled
         FT-PSK(802.11r)......................... Disabled
         PMF-1X(802.11w)......................... Disabled
         PMF-PSK(802.11w)........................ Disabled
      FT Reassociation Timeout................... 20
      FT Over-The-DS mode........................ Disabled
      GTK Randomization.......................... Disabled

      SKC Cache Support.......................... Disabled
      CCKM TSF Tolerance......................... 1000
   WAPI.......................................... Disabled
   Wi-Fi Direct policy configured................ Disabled
   EAP-Passthrough............................... Disabled
   CKIP ......................................... Disabled
   Web Based Authentication...................... Disabled
   Web-Passthrough............................... Disabled
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   FlexConnect Local Switching................... Enabled
   flexconnect Central Dhcp Flag................. Disabled
   flexconnect nat-pat Flag...................... Disabled
   flexconnect Dns Override Flag................. Disabled
   FlexConnect Vlan based Central Switching ..... Disabled
   FlexConnect Local Authentication.............. Disabled
   FlexConnect Learn IP Address.................. Disabled
   Client MFP.................................... Optional
   PMF........................................... Disabled
   PMF Association Comeback Time................. 1
   PMF SA Query RetryTimeout..................... 200
   Tkip MIC Countermeasure Hold-down Timer....... 60

AVC Visibilty.................................... Disabled
AVC Profile Name................................. None
Flow Monitor Name................................ None
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Disabled
802.11k Neighbor List Dual Band.................. Disabled
Band Select...................................... Disabled
Load Balancing................................... Disabled
Multicast Buffer................................. Disabled

Mobility Anchor List
WLAN ID IP Address Status
------- --------------- ------

802.11u........................................ Disabled

MSAP Services.................................. Disabled

Scott Fella · ‎04-07-2015

Are you 100% sure that the clients are configured for WPA/TKIP? If they were, they shouldn't be able to connect to WPA2/TKIP. If you have a Windows XP or Win 7 machine, you should be able to look at the configuration.

Now if you the users work fine on WPA2/TKIP, why not just leave that? You should anyways look at using WPA2/AES for security reasons.

As far as the autonomous AP's, what does the config look like for that? Can you get a device that is setup for WPA2/TKIP to connect to one of those access points?

-Scott

-Scott
*** Please rate helpful posts ***