Archive for the ‘CISCO’ Category


Ref : http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008084f13b.shtml

MAC Address Filter (MAC Authentication) on WLCs

When you create a MAC address filter on WLCs, users are granted or denied access to the WLAN network based on the MAC address of the client they use.

There are two types of MAC authentication that are supported on WLCs:

  • Local MAC authentication
  • MAC authentication using a RADIUS server

With local MAC authentication, user MAC addresses are stored in a database on the WLC. When a user tries to access the WLAN that is configured for MAC filtering, the client MAC address is validated against the local database on the WLC, and the client is granted access to the WLAN if the authentication is successful.

By default, the WLC local database supports up to 512 user entries.

The local user database is limited to a maximum of 2048 entries. The local database stores entries for these items:

  • Local management users, which includes lobby ambassadors
  • Local network users, which includes guest users
  • MAC filter entries
  • Exclusion list entries
  • Access point authorization list entries

Together, all of these types of users cannot exceed the configured database size.

In order to increase the local database, use this command from the CLI:

<Cisco Controller>config database size ?
<count>        Enter the maximum number of entries (512-2048)

Alternatively, MAC address authentication can also be performed using a RADIUS server. The only difference is that the users MAC address database is stored in the RADIUS server instead of the WLC. When a user database is stored on a RADIUS server the WLC forwards the MAC address of the client to the RADIUS server for client validation. Then, the RADIUS server validates the MAC address based on the database it has. If the client authentication is successful, the client is granted access to the WLAN. Any RADIUS server which supports MAC address authentication can be used.

Configure Local MAC Authentication on WLCs

Complete these steps in order to configure local MAC authentication on the WLCs:

  1. Configure a WLAN and Enable MAC Filtering
  2. Configure the Local Database on the WLC with Client MAC AddressesNote: Before you configure MAC authentication, you must configure the WLC for basic operation and register the LAPs to the WLC. This document assumes that the WLC is already configured for basic operation and that the LAPs are registered to the WLC. If you are a new user trying to set up the WLC for basic operation with LAPs, refer to Lightweight AP (LAP) Registration to a Wireless LAN Controller (WLC).

    Note: There is no special configuration needed on the wireless client in order to support MAC authentication.

Configure a WLAN and Enable MAC Filtering

Complete these steps in order to configure a WLAN with MAC filtering:

  1. Click WLANs from the controller GUI in order to create a WLAN.The WLANs window appears. This window lists the WLANs configured on the controller.
  2. Click New in order to configure a new WLAN.In this example, the WLAN is named MAC-WLAN and the WLAN ID is 1.

    mac-filters-wlcs-config-01.gif

  3. Click Apply.
  4. In the WLAN > Edit window, define the parameters specific to the WLAN.mac-filters-wlcs-config-02.gif
    1. Under Security Policies > Layer 2 Security, check the MAC Filtering check box.This enables MAC authentication for the WLAN.
    2. Under General Policies > Interface Name, select the interface to which the WLAN is mapped.In this example, the WLAN is mapped to the management interface.
    3. Select the other parameters, which depend on the design requirements of the WLAN.
    4. Click Apply.mac-filters-wlcs-config-03.gif

The next step is to configure the local database on the WLC with the client MAC addresses.

Refer to VLANs on Wireless LAN Controllers Configuration Example for information on how to configure dynamic interfaces (VLANs) on WLCs.

Configure the Local Database on the WLC with Client MAC Addresses

Complete these steps in order to configure the local database with a client MAC address on the WLC:

  1. Click Security from the controller GUI, and then click MAC Filtering from the left side menu.The MAC Filtering window appears.

    mac-filters-wlcs-config-04.gif

  2. Click New in order to create a local database MAC address entry on the WLC.
  3. In the MAC Filters > New window, enter the MAC address, Profile Name, Description and the Interface Name for the client.Here is an example:

    mac-filters-wlcs-config-05.gif

  4. Click Apply.
  5. Repeat steps 2-4 in order to add more clients to the local database.Now, when clients connect to this WLAN, the WLC validates the clients MAC address against the local database and if the validation is successful, the client is granted access to the network.

    Note: In this example, only a MAC address filter without any other Layer 2 Security mechanism was used. Cisco recommends that MAC address authentication should be used along with other Layer 2 or Layer 3 security methods. It is not advisable to use only MAC address authentication to secure your WLAN network because it does not provide a strong security mechanism.

Configure MAC Authentication using a RADIUS Server

Complete these steps in order to configure MAC authentication using a RADIUS server. In this example, the Cisco Secure ACS server is used as the RADIUS server.

  1. Configure a WLAN and Enable MAC Filtering
  2. Configure the RADIUS Server with Client MAC Addresses

Configure a WLAN and Enable MAC Filtering

Complete these steps in order to configure a WLAN with MAC filtering:

  1. Click WLANs from the controller GUI in order to create a WLAN.The WLANs window appears. This window lists the WLANs configured on the controller.
  2. Click New in order to configure a new WLAN.In this example, the WLAN is named MAC-ACS-WLAN and the WLAN ID is 2.

    mac-filters-wlcs-config-06.gif

  3. Click Apply.
  4. In the WLAN > Edit window, define the parameters specific to the WLAN.
    1. Under Security Policies > Layer 2 Security, check the MAC Filtering check box.This enables MAC authentication for the WLAN.
    2. Under General Policies > Interface Name, select the interface to which the WLAN is mapped.
    3. Under RADIUS servers, select the RADIUS server that will be used for MAC authentication.mac-filters-wlcs-config-07.gif

      Note: Before you can select the RADIUS server from the WLAN > Edit window, you should define the RADIUS server in the Security > Radius Authentication window and enable the RADIUS server.

      mac-filters-wlcs-config-08.gif

    4. Select the other parameters, which depend on the design requirements of the WLAN.
    5. Click Apply.mac-filters-wlcs-config-09.gif
  5. Click Security > MAC Filtering.
  6. In the MAC Filtering window, choose the type of RADIUS server under RADIUS Compatibility Mode.This example uses Cisco ACS.
  7. From the MAC Delimiter pull down menu, choose the MAC delimiter.This example uses Colon.
  8. Click Apply.mac-filters-wlcs-config-10.gif

The next step is to configure the ACS server with the client MAC addresses.

Configure the RADIUS Server with Client MAC Addresses

Complete these steps in order to add a MAC address to the ACS:

  1. Define the WLC as an AAA client on the ACS server. Click Network Configuration from the ACS GUI.
  2. When the Network Configuration window appears, define the name of the WLC, the IP address, the shared secret and the authentication method (RADIUS Cisco Aironet or RADIUS Airespace).Refer to the documentation from the manufacturer for other non-ACS authentication servers.

    mac-filters-wlcs-config-11.gif

    Note: The shared secret key that you configure on the WLC and the ACS server must match. The shared secret is case sensitive.

  3. From the ACS main menu, click User Setup.
  4. In the User text box, enter the MAC address in order to add to the user database.mac-filters-wlcs-config-12.gif

    Note: The MAC address must be exactly as it is sent by the WLC for both the username and the password. If authentication fails, check the failed attempts log to see how the MAC is reported by the WLC. Do not cut and paste the MAC address, as this can introduce phantom characters.

  5. In the User Setup window, enter the MAC address in the Secure-PAP password text box.mac-filters-wlcs-config-13.gif

    Note: The MAC address must be exactly as it is sent by the WLC for both the username and the password. If authentication fails, check the failed attempts log to see how the MAC is reported by the AP. Do not cut and paste the MAC address, as this can introduce phantom characters.

  6. Click Submit.
  7. Repeat steps 2-5 in order to add more users to the ACS database.Now, when clients connect to this WLAN, the WLC passes the credentials to the ACS server. The ACS server validates the credentials against the ACS database. If the client MAC address is present in the database, the ACS RADIUS server returns an authentication success to the WLC and the client will be granted access to the WLAN.

Use the CLI to Configure the MAC Filter on WLC

This document previously discussed how to use the WLC GUI to configure MAC filters. You can also use the CLI in order to configure MAC filters on the WLC. You can use these commands in order to configure the MAC filter on WLC:

  • Issue the config wlan mac-filtering enable wlan_id command in order to enable MAC filtering. bEnter the show wlancommand in order to verify that you have MAC filtering enabled for the WLAN.
  • config macfilter add command:The config macfilter add command lets you add a macfilter, interface, description, and so forth.

    Use the config macfilter add command in order to create a MAC filter entry on the Cisco Wireless LAN controller. Use this command in order to add a client locally to a wireless LAN on the Cisco Wireless LAN controller. This filter bypasses the RADIUS authentication process.

    config macfilter add MAC_address wlan_id [interface_name] 
    [description] [IP address]

    Example:

    Enter a static MAC-to-IP address mapping. This can be done to support a passive client, that is, one that does not use DHCP and does not transmit unsolicited IP packets.

    >config macfilter add 00:E0:77:31:A3:55 1 lab02 "labconnect" 10.92.125.51
  • config macfilter ip-address commandThe config macfilter ip-address command lets you map an existing MAC-filter to an IP address. Use this command in order to configure an IP address into the local MAC filter database:
    config macfilter ip-address 
    	 MAC_address IP address

    Example:

    >config macfilter add 00:E0:77:31:A3:55 1 lab02 "labconnect" 10.92.125.51

Configure a Timeout for Disabled Clients

You can configure a timeout for disabled clients. Clients who fail to authenticate three times during attempts to associate are automatically disabled from further association attempts. After the timeout period expires, the client is allowed to retry authentication until it associates or fails authentication and is excluded again.

Enter the config wlan exclusionlist wlan_id timeout command in order to configure the timeout for disabled clients. The timeout value can be from 1 to 65535 seconds, or you can enter 0 in order to permanently disable the client.

Verify

Use these commands in order to verify if the MAC filter is configured correctly:

The Output Interpreter Tool (registered customers only) (OIT) supports certain show commands. Use the OIT to view an analysis ofshow command output.

  • show macfilter summary—Displays a summary of all MAC filter entries.
  • show macfilter detail <client MAC Address>—Detailed display of a MAC filter entry.

Here is an example of the show macfilter summary command:

(Cisco Controller) >show macfilter summary

MAC Filter RADIUS Compatibility mode............. Cisco ACS
MAC Filter Delimiter............................. None

Local Mac Filter Table

MAC Address               WLAN Id          Description
-----------------------   --------------   --------------------------------
00:40:96:ac:e6:57           1              Guest

(Cisco Controller) >show macfilter detail 00:40:96:ac:e6:57

Here is an example of the show macfilter detail command:

(Cisco Controller) >show macfilter detail 00:40:96:ac:e6:57

MAC Address...................................... 00:40:96:ac:e6:57
WLAN Identifier.................................. 1
Interface Name................................... mac-client
Description...................................... Guest
Advertisements

1 – Allow the vlan to the physical interface on Cisco core switch ( Find out what ports and port channel are use for uplink from Blade switch ) ( eg gi3/45,gi4/45,gi5/45 )

– switchport trunk allowed vlan add XXX

-Add it to the port-channel that the interface is in (same command as above)

2 – Create the VLAN on blade switch ( if not already exists ). Exam ple below to add vlan 110 :

– (AUGS-PCHAS02-SW07)#conf

(AUGS-PCHAS02-SW07)(Config)#vlan dat

(AUGS-PCHAS02-SW07)(Vlan)#vlan 110

(AUGS-PCHAS02-SW07)(Vlan)#vlan name 110 User110

(AUGS-PCHAS02-SW07)(Vlan)#exit

3 – Allow the VLAN  on interface range

-(AUGS-PCHAS02-SW07)(Config)#int range 0/1 – 0/48
(AUGS-PCHAS02-SW07)(if-range)#sw allowed vlan add 110
(AUGS-PCHAS02-SW07)(if-range)#sw tagg 110
(AUGS-PCHAS02-SW07)(if-range)#exit

 

4 – Allow and tag the vlan on port channel .

(AUGS-PCHAS02-SW07)(Config)#int 1/1

(AUGS-PCHAS02-SW07)(Interface AUGS-PCHAS02-SW07/1/1)#sw allowed vlan add 110

(AUGS-PCHAS02-SW07)(Interface AUGS-PCHAS02-SW07/1/1)#sw tagg 110

(AUGS-PCHAS02-SW07)(Interface AUGS-PCHAS02-SW07/1/1)#exit

(AUGS-PCHAS02-SW07)(Config)#exit

5- Copy the config


(AUGS-PCHAS02-SW07)#copy run start
Configuration Saved!

 

Find the Port in switch associated with IP

Posted: September 6, 2010 in CISCO

With this we are trying to find what Cisco switch port the IP 10.80.1.145 Binds.Log in to Pcore01 switch. Then do the following.

=====================================================================

PCORE01#ping 10.80.1.145

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.80.1.145, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/5/20 ms
PCORE01#sho
PCORE01#show mac
PCORE01#show arp
PCORE01#show arp | inclu
PCORE01#show arp | include 10.80.1.145
Internet 10.80.1.145 0 0023.26ac.e43c ARPA Vlan101
PCORE01#sho
PCORE01#show mac
PCORE01#show mac add
PCORE01#show mac address-table add
PCORE01#show mac address-table address 0023.26ac.e43c
Unicast Entries
vlan mac address type protocols port
——-+—————+——–+———————+——————–
101 0023.26ac.e43c dynamic ip,ipx,assigned,other Port-channel64 — > This is Uplink to Pcore02, means the IP is on some port on Pcore02
Telnet to Pcore02 >

PCORE01#telnet 10.80.0.172
Trying 10.80.0.172 … Open

User Access Verification

Password:
PCORE02>ena
PCORE02>enable
Password:
PCORE02#sho
PCORE02#show mac
PCORE02#show mac add
PCORE02#show mac address-table add
PCORE02#show mac address-table address 0023.26ac.e43c
Unicast Entries
vlan mac address type protocols port
——-+—————+——–+———————+——————–
101 0023.26ac.e43c dynamic ip,ipx,assigned,other GigabitEthernet6/10 —- > This is the Port Number , The IP is connected.


This can only be done with with L3 switches.

Run CLI command “show mac address-table”, you will get list with Vlan ID, mac address and port info.

Find your port in the list and take mac address which associates with this port. Then run “show arp” command and find the record with mentioned above mac address. You have ip you looking for.

for example:

PCORE02#show mac address-table | include 3/40
110    0017.4284.ef16   dynamic ip,ipx,assigned,other GigabitEthernet3/40   [Some time just put the port number like 3/40]

you have output:
110    0017.4284.ef16   dynamic ip,ipx,assigned,other GigabitEthernet3/40

sh arp | include 0017.4284.ef16

result:
Internet  10.80.10.140            4   0017.4284.ef16  ARPA   Vlan110

So you will get the IP address.


The enable password is similar to the superuser or Administrator password and protects your router. Only after authenticating with this password can you make changes to your device.
To change or set the enable password to p4ssw0rd:

config t
enable secret p4ssw0rd

The enable pasword p4ssw0rd command will also set the enable password, but will leave the password in plain text and visible in the router configuration. This is not affected by the service password-encryption setting.


1) Backup image to TFTP server
Router>enable
Router#copy flash:{your IOS image filename} tftp://{TFTP server IP address}

2) Download image from TFTP server
Router>enable
Router#copy tftp://{TFTP server IP address} flash:

Example :

SW-AU-G3#cop flash: tftp
Source filename []? flash:c3560-ipbase-mz.122-25.SEE3/c3560-ipbase-mz.122-25.SEE3.bin
Address or name of remote host []? 10.80.0.102
Destination filename [c3560-ipbase-mz.122-25.SEE3.bin]?
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!…!!!!!
6427865 bytes copied in 56.624 secs (113518 bytes/sec)