From Cisco's Kangupta

Many times we see instances where the RMA controller is shipped with an LDPE image.

 (Cisco Controller) >show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.Product Name..................................... Cisco Controller
Product Version.................................. 7.0.116.0
Bootloader Version............................... 1.0.1
Field Recovery Image Version..................... 6.0.182.0
Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27
Build Type....................................... DATA + WPS + LDPE

An upgrade to an non LDPE code fails with this error-

"ERROR: Incompatible SW image.ERROR: Please install the Data Payload Encryption licensed image"

The LDPE image is used for Customers who are not legally allowed to use DTLS Data encryption within their regulatory domain (Russia-specific).

Conversion from LDPE to a non LDPE image

1)      Upgrade WLC to 7.0.230.0 LDPE image- e.g.  AIR-CT5500-LDPE-K9-7-0-230-0.aes for a 5508

2)      Download and install a free DTLS license from Cisco.com (if one is not already installed):

To Obtain a Data DTLS License:

Step 1 Browse to http://cisco.com/go/license

Step 2 Under Get New, choose IPS, Crypto, Other Licenses

Step 3 Choose the controller platform, enter the product ID and serial number.

Step 4 Complete the remaining steps to generate the license file.  The license will be provided online or via email.

Step 5 Copy the license file to your TFTP server.

Step 6 Install the license by browsing to the WLC Web Administration Page:

Management --> Software Activation --> Commands -->Action: Install License

3)      Once the DTLS license is installed, you will be able to upgrade/downgrade to any WLC code (including Non-LDPE).

(Cisco Controller) >show license summary 

License Store: Primary License Storage
StoreIndex:  0  Feature: base                              Version: 1.0
License Type: Permanent
License State: Active, Not in Use
License Count: Non-Counted
License Priority: Medium

License Store: Primary License Storage

StoreIndex:  1  Feature: base-ap-count                     Version: 1.0
License Type: Permanent
License State: Active, In Use
License Count: 500 /1 (Active/In-use)
License Priority: Medium
License Store: Primary License Storage

 

StoreIndex:  2  Feature: data_encryption                   Version: 1.0

 

        License Type: Permanent

 

       License State: Active, In Use

 

        License Count: Non-Counted

 

        License Priority: Medium

If the controller is on 7.0.116.0 LDPE code; you installed the DTLS license and then try to migrate to non LDPE code version of 7.0.116.0, it would fail with the following error-

*Transfer: Mar 28 11:32:56.609: RESULT_STRING: Transfer failure :

Upgrade from LDPE to non LDPE software is not allowed.

So, you will need to get on to 7.0.230.0 LDPE image (e.g.  AIR-CT5500-LDPE-K9-7-0-116-0.aes for a 5508) first before you can move to a non LDPE code.

This capability was introduced via CSCtw78061; meaning after installing the DTLS license you can download normal image from LDPE code just fine.

Symptom: No upgrade/downgrade is allowed from LDPE image to NON_LDPE image.

Conditions: transfer download of non-ldpe image from ldpe image

Workaround: if there is a dtls license installed and active, then upgrade/downgrade of non-ldpe image from a ldpe image is allowed.

This is addressed in 7.0.230.0 and 7.2.104.24

The long awaited code that will allow engineers everywhere to survey with 3500, 3600 and 1550 access points!

Site-Survey Only Mode for 3600, 3500, and 1550 Access Points

You can install Cisco IOS Release 15.2(2)JA on Cisco Aironet 3600 and 3500 Series access points and

on 1550 series outdoor access points to perform site surveys. This release runs on these access points

with limited functionality. You can manually adjust these settings on the site-survey access points:

• Channel on each radio

• Transmit power on each radio

• Enable and disable the radios

• Manually set basic and supported transmit rates

• Enable advertised cell power in beacons to client to enable DTPC for doing active surveys

• Enable and disable SSID broadcast in beacons

• Enable open authentication

Enhanced Support for Workgroup Bridges

This release provides additional support for access points in workgroup bridge mode:

• PEAP support for WGB: An access point configured as a workgroup bridge can now associate to a

root access point using PEAP

• Roaming improvements (for client workgroup bridges):

– This release improves the reliability of fast roaming on workgroup bridges by allowing the unit

an additional retry when it needs to reassociate to the root access point.

– This release also improves the method that workgroup bridges use to select the “best parent”

access point. Workgroup bridges can share association histories with rot access points, which

can build and share a list of best root access points among workgroup bridges. This method

improves helps workgroup bridges select the best root access point when roaming.

• VideoStream support on workgroup bridges (when used as a client): VideoStream improves the

reliability of an IP multicast stream by converting the multicast frame, over the air, to a unicast

frame. VideoStream was not supported for workgroup bridge clients in previous releases because a

workgroup bridge’s wired clients cannot be added to the controller (WLC) multicast table. In this

release, the workgroup bridge is added to the WLC multicast table, and the workgroup bridge

converts the VideoStream unicast frame into an Ethernet multicast frame and sends it out to its wired

clients.

Enter this command on the controller to enable VideoStream for workgroup bridges:

config media-stream wired-client enable

RELEASE NOTES ATTACHED: http://www.my80211.com/storage/release-notes/15_2_2_JA2.pdf

Links to 7.3 Release Notes

WLC : http://www.cisco.com/en/US/products/ps10315/prod_release_notes_list.html

NCS :  http://www.cisco.com/en/US/products/ps12239/prod_release_notes_list.html

MSE : http://www.cisco.com/en/US/products/ps9806/prod_release_notes_list.html

Cisco Office Extends bug -- What you should know if you're having wired side (LAN) connectivty issues.

If you configure your OfficeExtends for the LAN and you arent getting an IP address and no connectivity on the wired I might suggest you check your WIRELESS PHY RATES. You should have atleast one 802.11b mandatory rate 1,2,5.5 or 11. 

CSCtq76431            Bug Details

There has been lots of questions about the new 7.3 HA mode. This document will answer most of your questions. Just released by Cisco 

LINK BELOW:

http://www.my80211.com/storage/online-pdf-downloads/high-availability-dg-00.pdf

I am a BIG fan of Wildpackets. There is no better wireless sniffer in the world. Excited to meet the wildpackets team. 

Never used Tanaza, very interested to hear about their offerings. 

When attending a field day event it’s a challenge to listen, take good notes, tweet and do a blog post all in a matter of 2 hours. Sorry, I’m good, just not that good! 

Wildpackets

My interest was peaked when I heard Wildpackets was a sponsor for #WFD3. Wildpackets was one of the first commercially supported wireless sniffier products available. Lets face it, most engineers didn’t understand the 802.11 frame structure back in 2002. A lot of the captures were greek to many engineers, including myself. I was an early adopter and used what was then called, Airopeek. 

Wildpackets offers a suite of application software (and appliances) that focus around layer 2 packet analysis, both on wired (802.3) and wireless (802.11). Our WFD event focused on and what I believe is their most important product, OMNIPEEK. 

Omnipeek can be very intimidating at first, but once you get comfortable with the interface the other bells and whistles await you. And let me just tell you, there is a wealth of bells and whistles.

The Wildpackets team shared with the WFD delegates their humble beginnings and later a video about a fiery blaze that destroy their office in 2002.  We then moved on to the tech stuff!

Jay Botelho did an overview of Omnipeek. Jay shared with the delegates how to use Omnipeek, put it into sniffer mode and how to conduct a multi channel capture. We then walked through a wireless capture briefly and discussed other rich features (watch the below video to get your Omnipeek fix). Jay also shared some of the other robust features like reporting, graphs and analysis tools, which are built into Omnipeek. We also looked at our first 802.11ac capture. It was my first peek at 802.11ac. 

I understand, Omnipeek support for 802.11ac will be in released in its next release in coming weeks. 

You can read an article about the Wildpackets fire here: http://www.internetnews.com/wireless/article.php/1433881/WildPackets+Survives+Fire.htm

Wildpackets Advantage

The Wildpacket advantage is simple.

Coming from my personal experience, Willpackets’ Omnipeek is the best commercially offered wireless sniffer on the market today. It is well developed, packed with features and well supported. It drives information to the wireless engineer and displays it in a manner that is intuitive and accurate. A wireless engineer can capture 2,3,4 or more channels simultaneously aiding in quicker fact gathering. To the untrained eye, Omnipeek has built reports and graphs that will bring blaring issues to the surface. 

All of these features do come at a cost. And if you are a consultant or work for a large enterprise it can easily be justified. 

If you ever need customer feedback and or justification for Omnipeek in a large enterprise, email me I will be happy to share my experience. 

My take away

Next time you’re troubleshooting a wireless issue at the frame layer and you’re using something other than Omnipeek you’re missing out on all the other rich features that only Omnipeek offers.

Also, take notice next time you are reading a 802.11 technical book or looking at published material that displays a 802.11 capture. Pay very close attention, its very likely you are looking at a capture done in Omnipeek.  

In closing, one other important take away I learned at Wildpackets is just how much they value their employees. Thats a company I want to do business with. 

Captures

Wildpackets provided us 802.11ac and 802.11u captures. Links to these captures are below:

http://www.my80211.com/storage/wfd3/WFD3.WILDPACKETS.CAPTURE.zip

Video

If you missed the event you can watch it here: 

An introduction to WildPackets from Stephen Foskett on Vimeo.

Wildpackets 

Website: http://www.wildpackets.com 

Twitter: @wildpackets

Heads up if you're having wireless voice issues with 7925 handsets with WPA2/PSK. Problems with roaming, gap in voice bug.

7925 sometimes takes 1+ second to respond to WPA M1 key message

Symptom: A wireless phone call may experience a voice gap of 1.5 - 2 seconds when it roams if using WPA2-PSK. Conditions: 7925G is configured to use WPA2/AES PSK. Workaround: Configure some key management method to avoid performing a full WPA2 key exchange at each roam time. For example, EAP with CCKM, or static WEP. If using PSK, then reducing the WPA key retransmission timeout (e.g., on a WLC, via "config advanced eap eapol-key-timeout 250", may ameliorate the problem somewhat (e.g. bring the outage duration down from 2.5 to 1.7 seconds.) 1.4.3ES.1 containing the fix for CSCtz48689 may be helpful as well. Further Problem Description: A wireless packet capture, or a "debug client" on the WLC, will show that the WLC/AP transmit the M1 key message to the phone (and the capture shows that the phone ACKs it), but the phone does not send its M2 key. So the WLC/AP have to retransmit the M1 key, till finally the phone responds.

Status   Terminated  Severity   3 - moderate  Last Modified   In Last 2 weeks  Product   Cisco Unified IP Phone 7900 Series  Technology   Wireless, Mobile  1st Found-In   1.4(2) 1.4(1.1.1.7)

Title: End-of-Sale and End-of-Life Announcement for the Cisco 3310 Mobility Services Engine

Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps9733/ps9742/ps10093/end_of_life_notice_c51-716505.html

Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco 3310 Mobility Services Engine. The last day to order the affected product(s) is March 19, 2013. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2012-09-18 16:45:00.0

This is a bug I discovered and I understand another customer is reporting the same issue. Still providing TAC config info and testing. 

CSCuc32335 Bug Details

Local Mode Aps on 7.0.220.0 lose configs and get defaulted.
Symptom: Local mode Aps on wlc lose config and get defaulted Conditions: when Local when it loses power or shut no- shut is done to the POE port. Workaround: Reconfigure or rename the AP	Status   Open  Severity   3 - moderate  Last Modified   In Last 3 Days  Product   Cisco 5500 Series Wireless Controllers Technology   1st Found-In   7.0(220.0)

This is from Cisco CSC 

Microsoft will launch Windows 8 in late October. Along with a slew of other features, it will be among the first to support the 802.11w standard to protect Management Frames for client devices on Wi-Fi networks.

Customers running old Cisco unified releases (between 4.2 to 7.2) in local, Flex or mesh mode will run into an interoperability bug (CSCua29504, to be exact) that prevents 802.11w enabled clients from connecting to a Cisco WLAN with Management Frame Protection (MFP) enabled. This bug does not affect customers running autonomous access point deployments or customers running Cisco unified releases older than 4.2.

What are the possible solutions for you?

1. Please upgrade your production environment to one of the following releases, which will interoperate with Windows 8.

• 7.3.101.0
• 7.2.111.3
• 7.0.235.3

2. Roll back to pre-windows 8 drivers as identified in the Microsoft Knowledge Base article.
3. Fall back to TKIP
4. Sign up for a beta release for Cisco’s upcoming feature release 7.4 (beta available now!) that supports the 802.11w feature in local mode.

What is 802.11w ?

 802.11w is an IEEE standard based on Cisco’s Management Frame Protection(MFP), a feature that was first supported on autonomous access points in release 12.3(8)JA in 2006 and in the unified release 4.0.155.5 in 2008. 802.11w isn’t a new standard. IEEE ratified the 802.11w standard in 2009, however the adoption has been slow to date, but that is expected to change with Windows 8.

The WFA has announced that it will position the Protected Management Frame interoperability certification program as a feature update to its Wi-Fi Protected Access(WPA2) program.

Why do I care about 802.11w ?

I joined Cisco Wireless Networking Business Unit (WNBU) early 2006 as a Product Manager for Autonomous Access Points and the first software release that I managed was the 12.3(8)JA. One of the coolest features in that release was a Cisco innovation around protecting management frames. As many of you may know, 802.11 frames such as Authenticate, De-authenticate, Associate, Dis-associate are sent in the clear (a.k.a. in an unsecured manner). This could allow a potential attacker to spoof management frames from a valid device and run Denial of Service (DOS) attack by sending de-authenticate/disassociate frames.

When MFP is enabled, the sending device adds a cryptographic hash to create a message integrity check (MIC) and embeds that within the Information Element (IE) of every management frame. Thus when another device in the network receives the frame, it is able to verify that the authenticity of the source. In case a single invalid frame is received on the network, it will be dropped, as well as, an Intrusion Detection System alert will be received -this means zero day protection!

What about clients that don’t support 802.11w ?

There are two components to Management Frame Protection:

-         Infrastructure MFP: When the wireless Controller and Access point infrastructure support the 802.11w capability, any frames from a hacker masquerading as an infrastructure AP and attempting to communicate with other APs will be dropped.

-         Client MFP: When a client ALSO supports this feature; it is able to secure communications with the infrastructure. This means any frames from a hacker masquerading as an infrastructure AP and sending disconnect messages to the clients will be dropped.

So what’s the bottom-line?

To enable that your network is ready for 802.11w and Windows 8 ensure that you are running the latest Cisco Unified releases in your wireless controller network.

For more information, visit https://supportforums.cisco.com/docs/DOC-27213

Cisco ISE Application <GUI> default login change.

Previous ISE versions the application <GUI> login/password was <admin> <cisco>. However, with version ISE 1.1.1, the application login is setup during the initial installation under APPLICATION. 

ISE DEPLOYMENT GUIDE 1.1.1

You must configure the Cisco ISE Admin password at the time you install the Cisco ISE. The previous Cisco ISE Admin default login credentials (admin/cisco) are no longer valid.

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_dis_deploy.html

Need to reset the Application <GUI> Login / Password 

Should you forget or need to reset this login and password you can via the CLI with the following command:

ise111/admin# application reset-psswd ise admin 

Title: End-of-Sale and End-of-Life Announcement for the Cisco Wireless Controller Software for ISM 300 and SRE 700, 710, 900, and 910

Url: http://www.cisco.com/en/US/prod/collateral/modules/ps2706/end_of_life_notice_c51-722050.html

 Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco Wireless Controller Software for ISM 300 and SRE 700, 710, 900, and 910. The last day to order the affected product(s) is May 31, 2013. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.

Date: 2012-11-30 15:25:15.0

Title: End-of-Sale and End-of-Life Announcement for the Cisco Unified Wireless Network Software Release 6.0

Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps5755/ps6301/ps7305/end_of_life_notice_c51-722058.html

Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco Unified Wireless Network Software Release 6.0. The last day to order the affected product(s) is May 31, 2013. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2012-11-30 15:28:30.0

NOTE: March 30, 2013: The last date that Cisco Engineering may release any final software maintenance releases or bug fixes. After this date, Cisco Engineering will no longer develop, repair, maintain, or test the product software.

I received 2 emails from colleagues who were hit by this bug while using the Ascom i62. 

Apparently there is a BA ack issue, as noted in the bug. Its not clear if this is only impacting Ascom as the bug id references 802.11n handsets. I asked for frame captures and will post the result when I have them. 

CSCud65237 Bug Details

Encryption key corruption on BA ack with wrong ID
Symptom: Voice disruption after roaming Conditions: Third party 11n phone This is triggered by wrong TID sent on Block ACK by client. AP is incorrectly handling the invalid frame Workaround: roam to another AP	Status   Open  (More)  Severity   2 - severe  Last Modified   In Last 3 Days  Product   Cisco IOS software  Technology   Wireless, LAN (WLAN)  1st Found-In   7.0(230.0) 7.4(1.54)  Component(s)   ap-ampdu

Did you miss the Cisco WLC Multicast Ask The Expert Session? 

After reviewing the video it covers an overview of topics on basic muticast-multicast, multicast-unicast and broadcast forwarding. It includes both wired and wireless config examples. 

Video  

https://supportforums.cisco.com/videos/5147

Slides

https://supportforums.cisco.com/docs/DOC-28753

It has come to my attention that code 7.0.98.0 was moved to "deferred status".

This is pretty relevant information as customers are still on this revision. Perhaps it may be because of the number of related bugs in this release ? Please comment if you have any details .. Thanks

http://software.cisco.com/download/release.html?mdfid=282600534&flowid=7012&softwareid=280926587&release=7.4.100.0&relind=AVAILABLE&rellifecycle=ED&reltype=latest