Category Archives: Cisco

01 Feb

How to register lightweight AP in WLC using DNS records

Wireless networks

So you have your brand new shiny lightweight AP from Cisco and wireless controller. The beauty of the managed wireless solution is that it requires almost no effort to add a new access point to existing local network. There are multiple ways how lightweight AP can discover the WLC – I will show you, in my opinion, the easiest one.

Access Point registration

The WLC has two essential ports – management and service. The second one we use mostly for recovery procedure on physical appliances and is not that important when you use vWLC. The Management Port is the one you use to connect to WLC GUI. But by default, it is also used to register access point. You can always change this by selecting the “Enable Dynamic AP Management” option in other port configuration.

There are multiple options how lightweight access point can discover the controller. I think one of the most known is by using DHCP option 43, but that usually requires quite a lot of work and may not be supported by all DHCP server software. In my opinion, the easiest way to let AP discover the controller is via DNS discovery. There are two requirements for this solution to work:

  • The DHCP server must provide DNS servers IP addresses and the domain name in response
  • You need to configure CISCO-LWAPP-CONTROLLER.localdomain or CISCO-CAPWAP-CONTROLLER.localdomain where the ‘localdomain’ is the access point domain provided by DHCP.

So the whole required configuration is limited to setting up DHCP like for any other host you have in a network (no unique attributes), adding DNS entry and configure switch port in proper VLAN.

Before AP can register at WLC, we must configure the WLC itself as the master controller for the wireless network. To do that go to Controller -> Advanced -> Master Controller Mode, click the checkbox and apply the change.

When you boot up the AP, it should obtain its IP address from DHCP server. You should also see logs as below on AP console which means access point is trying to join the controller provided in DNS configuration.

*Dec 16 23:19:42.015: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Dec 16 23:19:42.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 172.16.1.205 peer_port: 5246
*Dec 16 23:19:42.223: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 172.16.1.205 peer_port: 5246
*Dec 16 23:19:42.223: %CAPWAP-5-SENDJOIN: sending Join Request to 172.16.1.205
*Dec 16 23:19:47.223: %CAPWAP-5-SENDJOIN: sending Join Request to 172.16.1.205

It takes 1-2 minute for AP to join the controller, even more, to be operational. Usually new AP first require firmware upgrade which takes time (unless you are needed do to it manually because it is too old compared to WLC firmware which I explained in Manual firmware upgrade of lightweight access point post). When registration process completes, you will see the access point on the list in the Wireless section.

 

09 Jan

Setting up vWLC controller in 10 minutes

Wireless networks

Those are not my first steps with wireless controllers or wireless networking. I had my first touch of enterprise-class wireless networks like 7-8 years ago when Cisco WLC controllers hit the market and lead the evolving world of wireless networking. Working for Cisco Gold Partner back then gave me the opportunity to configure few both autonomous and centrally managed wireless networks at different scale. I also performed a security audit of one quite big installation. Back then there was no virtual vWLC controller back then.

Why am I getting back to the Cisco wireless solutions now? I got Cisco AIR-CAP3702 access point lately, so it was excellent opportunity to refresh my knowledge and look at the past few years changes. It is a popular enterprise model that can work either as an autonomous access point or managed via a controller. So this model is for tests and PoC labs for me, so I decided to check what has changed in Cisco wireless world.

Read More →

03 Jan

Manual firmware upgrade of lightweight access point

Wireless networks

The Cisco lightweight access point managed by the wireless controller is not a new product. It has been on the market for years, evolved from LWAPP to CAPWAP model, is supporting a wide range of access point models. The idea is that access point upgrades its firmware when it registers to WLC. Sounds easy? Yes. Is it working? Yes, usually, but not always. Sometimes you need to perform a manual lightweight access point firmware upgrade procedure which is not well documented. And you need to know a hidden command. I will show you how.

 

Read More →

23 Nov

Dynamic VIRL inventory for Ansible playbooks

Ansible is one of the powerful tools providing us an automation of recurring tasks. In the current world, it is impossible to manage infrastructure manually efficiently. Many people still do this but the world has already changed and we need to progress otherwise our business will be cost ineffective. You can provide static inventory – list of the devices where you want to execute the playbook. But in dynamic environments, such as Cisco VIRL simulations you don’t want to edit inventory file manually. That is why I use Python script that will generate Dynamic VIRL inventory for Ansible playbook for me.

Read More →

03 Nov

IOx and guestshell on IOS XE

Most of the recent firmware on Cisco devices run on top of Linux operating system. Yout IOS XE or NX-OS is just a Linux process! It is nothing new; Juniper does it for years. However, it does not mean you can access the operating system directly; this is reserved just for Cisco TAC and developers in case the base operating system might be the source of the problems. However, you can use the IOx and the guestshell container introduced in IOS XE Everest 16.5.1 release.

Read More →

17 Oct

When your ISP sends you BPDU frames…

As an end-user, you should never receive STP BPDU frames from the ISP. The workstation in enterprise networks should not either. It is always a result of misconfiguration or lack of knowledge from network engineers about basics of network security. BPDU can reveal information about your network that can be later used to compromise it. In the worst case, an attacker can impact your system by changing the spanning-tree topology and perform a Man-In-The-Middle attack.

I noticed that my ISP is sending me BPDU frames. Let’s see, using this case real-life scenario, what we can tell about his network.

Read More →

13 Oct

How to install multiple ASAv firmwares on Cisco VIRL

Cisco VIRL

Cisco VIRL is powerful network simulation tool. There are weeks when I run simulations 24/7 because of some projects or learning are ongoing. With VIRL you get almost the latest firmware for supported platforms. Almost – sometimes you have to wait for next release for a new firmware to be available. I experienced it a few months ago when with ASA 9.7(1) release Cisco introduced the route-based VPNs (VTIs). At this point VIRL users got the 9.6(2) release bundled into latest simulator release. In other simulation, you may want to use different ASAv firmware versions for various nodes, so your simulation is more similar to your production network.

Cisco VIRL uses real firmware in the simulations. I will show you how you can add different ASAv firmware and use it in parallel with the software available on VIRL repository.

Read More →

24 Aug

IGMP Snooping on single switch

The IGMP Snooping is a nice feature to limit propagation of multicast traffic in Layer 2 Ethernet network. It listens to IGMP (Internet Group Management Protocol) messages traversing the network to learn about source and receivers. Using this information switch builds a map of links where it replicates the multicast frames. What if we do not have this feature enabled? The switch will treat multicast frames as an unknown type and will broadcast over all active ports no matter is there is receiver interested in frames from the particular multicast group or not.

IGMP Snooping on a single switch is useful to limit propagation of multicast frames when source and receivers are in same layer 2 broadcast domain, in the same VLAN. IGMP Snooping is enabled on Cisco switches by default, but it does not mean it will work out-of-box.

Read More →

18 Aug

Generate multicast​ traffic in VIRL using Ostinato

Cisco and VIRL logos

Ostinato is a traffic generator. You can use it to craft packets and send flow into your network. You can even send multiple streams if required. It is a tool that network admins and developers should use for testing the system or application against various scenarios. Ostinato is by default available on Cisco VIRL so we can use it as a packet generator in our simulations.

Ostinato consists of two components – the LXC image run in a simulation that generates the traffic and GUI frontend. In this article, I will show you how to use it to generate a multicast stream in VIRL simulation.

Read More →

08 Aug

Cisco Firepower NGIPSv on ESXi

Secure Your Network

Cisco Firepower NGIPS is available on multiple platforms. One of deployment option you have is virtual appliance running on top of ESXi hypervisor. This product is called NGIPSv in Cisco documentation.

Using a single physical machine with ESXi hypervisor in an isolated network is one of the best ways to perform Proof of Concept (PoC) labs for IPS solution. You cannot evaluate the product without testing it in a sandbox where you can try to hack it, infect it or do any other nasty things. This way, you can in single ESXi run NGIPSv, Firepower Management Center (FMCv) and one or more VMs in the back.

Here is a quick step-by-step guide how to deploy NGIPSv in transparent mode on single ESXi host. What we want to accomplish is having NGIPSv in front of other virtual machines. In this scenario, there is no firewall, just NGIPSv sensor. It is of course not the safest, the best practice and the most flexible way to deploy sensor. You should not use it just like that in your production network. I use this setup only for quick demo purposes when I want to show how Cisco Firepower NGIPS solution is working, get network discovery working, some IPS policy and get the end host infected by malware.

Read More →