Converting Autonomous Access Point to Lightweight Access Point

If you have lot of Access Points to be converted, then you definitely need to use the conversion tool which is available on the Cisco Website. But if it is only a single Access Point you could do it with a TFTP Server and an Autonomous To Lightweight Mode Upgrade Image (downloadable from the Cisco Website).

Connect a Console to the Access Point and power up the Access Point either using a Power Adapter or a Power Injector. If the Access Point is new out of the Box, it is pre-configured to obtain an IP Address from a DHCP Server. If you don't have a DHCP server, assign a static IP Address.

AP(config)#interface bvi 1

AP(config-if)#ip address <ip address> <subnet mask>

Open your TFTP Server, with the Autonomous To Lightweight Mode Upgrade Image copied to its root directory. From the Access Point CLI issue the command

AP#archive download-sw /overwrite /reload tftp://<ip address of the tftp server>/<upgrade image file>

The Access Point will download the file and overwrite the existing image file (/overwrite) in the flash and then reboot (/reload) into LWAPP mode. If the reload does not happen, enter the reload command manually.

Once the Access Point is converted, connect it to your network. The Switch port to which it is connected should be configured in the Access Point Management VLAN, so that the Access Point can communicate with the Wireless LAN Controller. Hold down the mode button on the Access Point before you power up the Access Point and release it once the LED turns amber (approx 10 seconds). This is required to delete the existing configuration on the access point and return it to the factory defaults.

CS-MARS authentication with Cisco Secure ACS

First on the ACS, to add the CS-MARS device, go to Network Configuration > Add Entry, then add the CS-MARS hostname, IP Address & Shared Secret Key. From the Authenticate Using drop down list select RADIUS (IETF) and click Submit + Apply. Create a user account on the ACS for the user who wants access to the CS-MARS (Go to User Setup to create a user on the ACS).

On the CS-MARS also we need to create an account for the same user. Go to MANAGEMENT > User Management, click Add to create a new user. Enter the Role and the Login (username) of the user and click Submit.

Log into the CS-MARS as pnadmin and go to ADMIN > System Setup > Authentication Configuration. From the AAA Server Configuration: box click Add. Here you define your ACS Server and how MARS should communicate with it. Select whether to configure the ACS server on an existing host that MARS is aware of or on a new host. After entering basic IP address and interface information, click Next and on the Reporting Applications window select Generic AAA Server and click Add. On the AAA Server Configuration Window, enter the Name, Shared Secret Key (as given in the ACS), the Authentication Port (1812) and Accounting Port (1813). You should use the Test Connectivity button to verify that CS-MARS can communicate with the radius server and also to verify that user accounts can be authenticated against. Lastly go to the Authentication Configuration screen again and select AAA Server for Authentication method and select the server you just defined. You can add a secondary AAA Server in the same way.

If, for any reason, you need to change authentications back to Local, you will need to recreate a password for each user. Once the authentication method is changed to radius, all local passwords on the MARS appliance (except the pnadmin user) are deleted.

ATA 188 Duplex and Speed Change

Cisco ATA 188 Ethernet port duplexity and speed can be configured from the Cisco ATA web configuration page (http://<ATA-IP-Address>), provided the hardware version number on Cisco ATA is 0x0009 or above (version can be checked from the Device information page, http://<ATA-IP-Address>/DeviceInfo). The ATA 188 has two Ethernet RJ-45 10/100 BASE-T ports, both with configurable duplex and speed. One is used as an uplink connecting to the switch and the other as a data port for connecting to a PC. The IP Address of the ATA device (ATA-IP-Address) can be obtained from the connected switch using show cdp neighbors <interface_type> <module/port> detail command.

The speed & duplex of the Ethernet ports can be configured by changing the values of Switchports parameter on the http://<ATA-IP-Address>/NetCfg page.

Applicable Bits

• Bits 0-3 are for the PC port

• Bits 4-7 are for the uplink port

Bit Values

• 0=10 Mbps, half duplex

• 1=10 Mbps, full duplex

• 2=100 Mbps, half duplex

• 3=100 Mbps, full duplex

• 4 = AUTO detect

• Other bit values are not valid

By default the ATA works in 10Mbps, half duplex (0x00000000). The Switchports parameter can be changed to 0x000000FF for 100Mbps, full duplex & 0x00000022 for 100Mbps, half-duplex. After the value has been entered, click on apply. Switch OFF the ATA power and then switch it back ON for the configuration to complete. After switching ON, the Function button on top of the ATA blinks quickly indicating that the ATA is upgrading the configuration.

ATA 188 is past End-of-Life and probably out of most networks, but it could perform auto-negotiation for duplexity and speed and is capable of 10/100 Mbps, full-duplex operation. The Cisco ATA 186 on the other hand is fixed at 10 Mbps, half-duplex operation.

CS-MARS Upgrade

The thought of upgrading the CS-MARS software is a pain for most MARS Administrators, mainly because of the time it consumes to upgrade to the latest version. The upgrading of the MARS software can only be done sequentially, version by version. The recommended method of upgrading a CS-MARS device is through the CLI using the pnupgrade command. The most reliable and easiest pnupgrade method is using a CD-ROM. The software can be downloaded from the Cisco site and burned on to a CD.

pnupgrade cdrom://csmars-6.1.1.3445.zip

Other pnupgrade methods are ftp, http & https. MARS requires that the upgrade server enforces user authentication.

pnupgrade -u username:password ftp://ftpserver/csmars-version.zip

Most people prefer GUI for doing the upgradation, but could end up facing lot of issues. One of the most common errors GUI users face is, Upgrade csmars-6.1.1.3445.zip failed. Failed to pass the version dependency test. Chances are the data versions do not match even though you upgrade the software, version by version. The MARS appliance can screw up the data version numbers giving you this error. You can check this via CLI by typing in the commands.

[pnadmin]$ version

6.0.8 (3428) 36

[pnadmin]$ pnupgrade

CSMARS Upgrade...........[14033]

------------------------------------------------

Package Name Type Version URL

------------------------------------------------

csmars-6.1.1.3445.zip BD 6.1.1.3445.38 N/A

csmars-6.0.8.3428.zip BD 6.0.8.3428.37 N/A

csmars-6.0.7.3404.zip BD 6.0.7.3404.36 N/A

csmars-6.0.6.3368.zip BD 6.0.6.3368.35 N/A

csmars-6.0.5.3358.zip BD 6.0.5.3358.34 N/A

csmars-6.0.4.3229.zip BD 6.0.4.3229.33 N/A

csmars-6.0.3.3190.zip B 6.0.3.3190 N/A

csmars-6.0.3.3188.zip BD 6.0.3.3188.32 N/A

csmars-6.0.2.3102.zip BD 6.0.2.3102.31 N/A

(data version number is highlighted), CS-MARS obtains this upgrade order from the MARSCatalog.xml file embedded in the zip file.

In the above case, 6.1.1 will not get installed because the data version of the previous upgraded software version 6.0.8.3428.36 does not match with the MARSCatalog version 6/0/8/3428/37. To get 6.0.8 (3428) 37, again install 6.0.8 via CLI (It wouldn't run from the GUI). This should resolve the issue.

If your CS-MARS has connectivity to internet, the upgradation could be done directly from the Cisco Website. But you will have to have a valid CCO ID with to ability to download software.

Configuring your Home Gateway for Qtel ADSL

As a network engineer in Qatar, I do get frequently asked by people to help them with configuring their Home ADSL Gateways (linksys, speedtouch, netgear, D-link...etc.,). Qtel usually provides a Thomson TG585 ADSL Gateway, but sometimes people opt for a different ADSL Gateway to get more features for their home network. Configuring an ADSL gateway can turnout to be a somewhat complicated matter for a non-techie and you will need to know the right values to configure your Gateway so that your ADSL connection works. You could always call Qtel helpline 111, to get the right parameters to configure your home ADSL. Different brands of ADSL gateways will have different configuration web interfaces, I will be using a Linksys WAG200G to explain the configuration. The ADSL Gateway device can be accessed by typing the Gateway IP address in your browser url box (e.g., http://192.168.1.254, varies for device to device) after connecting the gateway to your PC via an Ethernet cable.

VC Settings

• Encapsulation: Qtel uses both PPPoE and PPPoA type of encapsulation, it depends on the settings on the local DSLAM to which your home is connected to. You could get this information from Qtel or if you are not sure you could try both the settings, it should work in either of these modes. On a Linksys WAG200G Gateway select RFC 2516 PPPoE or RFC 2364 PPPoA from the drop down list.

• Multiplexing: Select the VC radio button. ADSL/ATM links operates using Virtual Circuits (VC) for traffic flow.

• QoS Type: Select VBR from the drop down list. Qtel uses Variable Bit Rate (VBR) traffic class which ensures QoS. More specifically the non-real time variant is used, so you might have to configure vbr-nrt on some gateways.

• Pcr Rate: Peak Cell Rate is a traffic parameter which maximum allowed data rate on an ATM connection. This can be in kbps or cps (cells per second). On the Linksys WAG200G Gateway configure PCR as 2358 cps.

• Scr Rate: Sustainable Cell Rate is a traffic parameter which limits the average data rate on an ATM connection. This can be in kbps or cps (cells per second). Cells may be dropped if the SCR is violated. On the Linksys WAG200G Gateway configure SCR as 2358 cps(cells per second).

Note: Usually Service Providers give PCR and SCR rate values in kbps, which you might have to convert to cps if your gateway takes these values in cps. Since an ATM cell is 53 bytes i.e., 424 bits, to convert kbps value divide by 424 to get value in cps. eg: 1000kbps = 1000000/424 = 2358cps (round down to a whole number).

• Autodetect: Select Enable radio button if you want the Gateway to automatically detect the Virtual Circuit VPI and VCI values. Select Disable if you want to enter the Virtual Circuit values manually.

• Virtual Circuit: Qtel uses the Virtual Circuit 8/35, where VPI is 8 and VCI is 35. Enter this if you have have selected Autodetect as Diable. Virtual Path Identifier (VPI) & Virtual Circuit Identifier together identify the virtual circuit used by the connection.

• DSL Modulation: Select ADSL2+ from the drop down list.

PPPoE Settings

• Username: the username is usually a 'p' or 's' followed by your ADSL telephone number. e.g.: p4765432. This information can obtained from Qtel.

• Password: the default password is qatar12. If you are not sure as to what your password is, call Qtel 111 from your ADSL telephone line and ask Qtel to reset your password which will be qatar12.

Network Address Server Settings (DHCP)

• DHCP Server: Select the Enable radio button, so that DHCP is enabled and all connected PC's can automatically get an IP address.

• Static DNS1: 212.77.192.59, this is Qtel DNS Server

• Static DNS2: 212.77.192.60, this is another Qtel DNS Server

The Static DNS should be enabled so that the connected PC's know where to resolve domain names. DNS is important to resolve website url's to their IP addresses and crucial for your internet to work. If your Gateway requires NAT configuration, go ahead and do it. This is important for translating your single public IP address to multiple private IP addresses.

This is the basic configuration for the ADSL to work. The rest of the configuration is optional and dependent on user requirements.

Implementing Wake-on-LAN in a Cisco Network

Wake-on-LAN or WoL is a clever way of turning on a computer or group of computers by sending a Broadcast Magic Frame over the LAN. The magic frame is send by a WoL Server which runs an application that generates the Magic frame. The computer can be woken up from sleeping, standby, hibernation and shutdown modes as long as the power cable is connected and some power is reserved for the network card to be partly on. The magic packet contains 6 bytes of ones followed by sixteen repetitions of the target computers's 48-bit MAC address. It is typically sent as a UDP datagram on port 1,7 or 9. A Magic packet can originate from the same LAN or over a VPN or even from internet if properly routed.

For WoL to work the computer should support Wake-on-LAN, which is implemented on the motherboard and hence usually set via the BIOS. Some Operating Systems can also control Wake-on-LAN behaviour. Lately laptops powered by the latest Intel chipset allow waking up the machine over wireless also, called Wake-on-Wireless LAN (WoWLAN).

If the WoL Server and the computer to be waken up are on the same LAN, i.e., in the same broadcast domain, no configuration is needed as the WoL Server will broadcast the Magic packet to all the devices in the LAN. If your computers are on a different VLAN from the one on which the WoL Server is sitting, then you need to use the ip helper-address command on the VLAN interface or the Server interface on the switch. The ip helper-address command lets the router interface know that it will be receiving a UDP broadcast from a directly connected client and that it should repackage it as either a directed broadcast to a specific subnet or a unicast to a specific machine.

int fa 1/0/48

description --- Connected to WoL Server ---

ip helper-address 10.10.255.255

switchport mode access

switchport access vlan 20

The ip helper-address helps in fowarding of UDP broadcasts. By default very few number of application ports (like DHCP, TACACS, etc.) are fowarded. Therefore you will need to use the ip forward-protocol global command to specify exactly which types of broadcast packets you would like to have forwarded.

ip forward-protocol udp 7

An ip directed-broadcast command should be applied to the VLAN interface that is expected to receive the directed broadcast from the WoL Server (assuming IP address: 10.11.1.254 for the below example). You should be cautious when ip directed-broadcast is applied on any interface because an incoming unicast packet with a broadcast destination address can explode as broadcast once it reaches the interface. For security concerns ip directed-broadcast command is usually adviced to be used with an access-list so that only the WoL server can send a directed broadcast to the VLAN, using otherwise could make your Cisco devices a target for Smurf and Denial of Service attacks, or maybe even inhibit Smurf attacks on to other networks.

access-list 10 permit 10.11.1.254

int vlan 30

description --- Connected to PCs ---

ip address 10.10.1.1 255.255.0.0

ip directed-broadcast 10

Some WoL Servers are smart enough to send directed broadcasts, then you only have to configure ip directed-broadcast on the VLAN connected to the target PC. Some WoL Servers can unicast magic packets to a specific layer 3 IP address, enabling to execute Wake-on-LAN from an external network like the Internet.

Also note that Cisco VMPS and WoL cannot work together on Cisco devices because unused ports according to Cisco VMPS does not belong to any VLAN as the PC is inactive and hence no Magic packets can reach the PC port.

Enabling NetFlow on a Cisco Catalyst 6500 Switch

NetFlow can be enabled on Catalyst 6500 Switches with a Supervisor Engine 32, RSP 720 or a Supervisor Engine 720. NetFlow cache on the Multilayer Switch Feature Card (MSFC) captures statistics for flows routed in software and the NetFlow cache on the Policy Feature Card (PFC) captures statistics for flows routed in hardware. The configuration of Netflow neither disrupts the traffic nor disables the configured interface.

To start first install NetFlow Analyzer (or similar tool) on your PC so that your PC becomes a NetFlow Collector. Do note the port number (e.g.: 9996) used by you NetFlow Analyzer Application. With the data obtained NetFlow Collectors can generate reports and statistics of traffic flowing through the switch or router.

Next on the Catalyst 6500 configure NetFlow to enable NetFlow on both the MSFC and PFC, so that it can send the Netflow information to the NetFlow Collector. You also need to configure the NetFlow Data Export (NDE) on the switch in order to export the NetFlow statistics to the NetFlow collector. Assuming the NetFlow Collector IP Address is 172.16.16.1, the following configuration has to be made

ip flow-export destination 172.16.16.1 9996

ip flow-export source Loopback 0

ip flow-export version 5

To avoid spikes in the traffic report, use the ip flow-cache time active N command (where N can be from 1 to 60 minutes). The default is 30 minutes, which can lead to having spikes in your traffic report. It is important to set this value to 1 minute to generate alerts and view troubleshooting data.

ip flow-cache timeout active 1

On interfaces that need to be monitored, enter the ip route-cache command. Enabling ip route-cache on the interface enables NetFlow on the MFSC. On 6500 12.2SXH Release, NetFlow is enable on the Layer 3 interface using ip flow ingress command on the interface.

To enable NetFlow & NDE for Layer 2

interface vlan 10

ip route-cache

!

interace GigabitEthernet 1/1

ip route-cache

To enable NetFlow on the PFC, enter the mls netflow command and to configure flow mask on the PFC, configure mls flow ip interface-full. Apply ip flow ingress layer2-switched vlan 10,20 command to enables NetFlow and NDE for Layer 2-switched traffic (for ingress-bridged traffic) on the PFC. Should note that NetFlow does not show statistics of traffic that goes across the same VLAN and hence cannot be configured on a layer 2 interface.

Once configured, the interfaces in the NetFlow tool will be shown as ifindex instead of the actual interface name. To obtain the actual interface names the NetFlow tool will have to pull it from the switch SNMP MIB values, therefore you will have to configure SNMP on the NetFlow Collector as well as on the Catalyst 6500 Switch.

access-list 99 permit 172.16.16.1

!

snmp-server group GRPName v3 auth

snmp-server user snmp_username GRPName v3 auth md5 user_authpwd

snmp-server user snmp_username GRPName remote 172.16.16.1 v3 auth md5 user_authpwd access 99

snmp-server host 172.16.16.1 traps version 3 auth snmp_username