How to check OTAP is disabled or not.

[kkonuru123]

Dear Tech Gurus,

Could you let me know how to check whether OTAP is disabled or not in WLC 5508.

If not disabled, how to disable it.

Regards,

KK

[Leo Laohoo]

Depends on the version of the firmware.  In 6.X, OTAP can be disabled using the command "config network otap disable".

If I remembered correctly, OTAP is no longer available in 7.X and later.

[George Stefanick]

Yea you shouldn't be using OTAP and if you're on code that supports it its time. Time to upgrade that is :)

Funny thing happen. I found a way to use OTAP to get the controller IP and then you could join the WLC to WCS. 

http://www.networkworld.com/article/2231987/cisco-subnet/are-you-vulnerable-.html

******************************************************************************

HTH

Please rate helpful post! 

www.my80211.com - Blog by a WiFi engineer for WiFi engineers

www.wifitraining.com/about-wifi/ - WiFi Training by hands on WiFi Engineers, Experts and Cisco Wireless VIPs 

[mohanak]

The OTAP feature is enabled on the controller GUI from the controller General page or through the CLI with the config network otap-mode {enable | disable} command.

Note: This feature is disabled by default and should remain disabled when all access points are installed.

OTAP is no longer supported on the controllers with 6.0.196 code and above.

http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/100516-ustnd-otap.html

[kkonuru123]

Thanks for replying. Auditor is asking to show whether the OTAP is disabled or not. 

How to check whether it is disabled or not.

Auditors need proof, so how ?

[Leo Laohoo]

Thanks for replying. Auditor is asking to show whether the OTAP is disabled or not. 

How to check whether it is disabled or not.

Auditors need proof, so how ?

What firmware is the controller running on?

[sbhadrav@cisco.com]

The traffic MAY be encrypted as the APs have a factory cert installed. It has been a while and I cannot find any info to support the above statement, but I believe it is encrypted.

On the other hand, OTAP should be turned off in an established production environment per:

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a00806c9e51.shtml

"You should have OTAP enabled only during AP provisioning intervals. After APs are deployed, disable OTAP as a deployment best practice. Also, Cisco Aironet LAPs (1130 AG, 1200, and 1240 AG series) ship from the factory with a stripped-down version of lightweight Cisco IOS® Software that is called the LWAPP Recovery Cisco IOS image. OTAP is not supported on those APs out-of-the-box that run LWAPP Cisco IOS Software. When you upgrade Cisco Aironet APs from autonomous Cisco IOS Software to lightweight mode, the LWAPP Recovery Cisco IOS image is the software that is loaded. The LWAPP Recovery Cisco IOS image does not support OTAP. In order to support OTAP, Aironet LAPs must first join a WLC in order to download a full LWAPP Cisco IOS image."