Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

MAC Filtering template

When I apply my MAC Filtering template to my new controller from Prime Server, I get the following error:

Operation Status - Failure

Reason - Selected Interface does no exists on the Controller

The new controller can be successfully Audited by Prime and can retrieve the config directly from the controller.

WLAN Layer 2 MAC Filtering is applied. The correct controller interface is applied to WLAN

Under Security>MAC FIltering I've used the same setting as my old controllers that can recieve a MAC Filtering template from Prime:

Radius Compatibility Mode 'Other' MAC Delimiter 'Colon'

NB: Prime Server manages all my controllers via their service port.

5 REPLIES
Cisco Employee

MAC Filtering template

Hi stephendrkw:

The error message is pretty explicit, it's the Interface that's in question, not necessarily anything about the WLAN that this filter might eventually apply to.

All wireless LAN controllers have a management interface and a virtual interface;  many have service-port interfaces.  There can be other dynamic interfaces on the controller, as well. 

(loaner-2504) >show interface summary

Number of Interfaces.......................... 2

Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest

-------------------------------- ---- -------- --------------- ------- ------ -----

management                       1    untagged 172.18.254.29   Static  Yes    No

virtual                          N/A  N/A      1.1.1.1         Static  No     No

(loaner-2504) >

(nms-ct5508) >show interface summary

Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest

-------------------------------- ---- -------- --------------- ------- ------ -----

management                       LAG  untagged 14.32.70.10     Static  Yes    No

service-port                     N/A  N/A      3.3.3.3         Static  No     No

virtual                          N/A  N/A      1.1.1.1         Static  No     No

(nms-ct5508) >

(WiSM-slot3-1) >show interface summary

Number of Interfaces.......................... 5

Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest

-------------------------------- ---- -------- --------------- ------- ------ -----

management                       LAG  untagged 14.32.70.43     Static  Yes    No

redundancy-management            LAG  untagged 0.0.0.0         Static  No     No

redundancy-port                  -    untagged 0.0.0.0         Static  No     No

service-port                     N/A  N/A      192.168.199.3   DHCP    No     No

virtual                          N/A  N/A      1.1.1.1         Static  No     No

(WiSM-slot3-1) >

Prime Infrastructure is going to have a list of the interfaces on all the controllers it knows about, but apparently the one in the template isn't on the controller you're trying to apply it to. 

As well, I'd suggest consulting with a wireless LAN controller authority about that connecting Prime Infrastructure to the service-port interface.  The Configuring the Management Interface section of the wireless LAN controller Configuration Guide says that the Management interface is the one that is "for in-band management of the controller and connectivity to enterprise services such as AAA servers."  There may be limitations on the types of traffic that can go over the Service-port interface.

New Member

MAC Filtering template

I have 2 other controllers in Prime (old 4404's) that are managed by Servie Port and MAC filtering templates are successfully applied when needed. The difference is the problem controller is a 5508 with much newer code. I'm trying to get hold of a sniffer at both ends and see what's going on, yes I think SP should be out of band and management should be probably the interface that Prime controls, however I'm interested in why this is failing. There is not reason why SP shouldn't be able to apply a template like my old 4404 controllers.

maybe it is a port restriction of some sort, I would to see how Prime applies the filter.

New Member

MAC Filtering template

My issue is now with TAC, will update this discussion with the outcome. In regards to SP or mgmt port, TAC engineer said there is not significance in regards to which port you use, SP can be used to apply MAC filtering and to manage from PI

New Member

MAC Filtering template

I should of seen this; a simple solution.

My MAC filter template had a different interface name used on my old WLC's.

Created a separate template with the new interface name, applied the template successfully to my new WLC's.

I confirmed with the TAC guy in Belgium, the Service Port can be used for management purposes like SNMP, MAC templates, TACACS etc. There is no reason why this interface can't be used you don't have to use management interface. There are no underlying ACL's or port filtering on the SP.

New Member

MAC Filtering template

Configuring a MAC Filter Template

This page allows you to add a MAC filter template or make modifications to an existing MAC filter template.

Step 1 Choose Configure > Controller Template Launch Pad.

Step 2 Click MAC Filtering or choose Security > MAC Filtering from the left sidebar menu. The Security > MAC Filtering page appears.

Step 3 If you want to add a new template, choose Add Template from the Select a command drop-down list, and click Go. To modify an existing template, click the template name. The MAC Filtering template page appears.

Step 4 If you keep Import From File enabled, you must enter a file path or click Browse to navigate to the file path. The import file must be a CSV file with MAC address, profile name, interface, and description (such as 00:11:22:33:44:55, Profile1, management, test filter). If you unselect the Import from File check box, continue to Step 5. Otherwise, skip to Step 8.

The client MAC address appears.

Step 5 Choose the profile name to which this MAC filter is applied or choose the any Profile option.

Step 6 Use the drop-down list to choose from the available interface names.

Step 7 Enter a user-defined description of this interface. Skip to Step 9.

Step 8 If you want to override the existing template, select the Override existing templates check box.

Step 9 Click Save.

Note You cannot use MAC address in the broadcast range.


For more Information : http://www.cisco.com/en/US/docs/wireless/prime_infrastructure/1.2/configuration/guide/temp.html#wp1129794

747
Views
0
Helpful
5
Replies
CreatePlease login to create content