There is another CCIE Wireless Techtorial is happening during next week CiscoLive 2013-Orlando. In my opinion this is the best opportunity to any CCIE wireless candidate could get (though I haven’t being to any of those mainly due to its only available in US-Ciscolive) to clarify your doubts. I have being to past 3 Ciscolive event in Melbourne & none of them had this session.

Here are the presenters of this session & you should be lucky if you could meet four of them at same time & clarify your questions.

If any one of you going for this session please share some of valuable inputs given by these people. Here are few generic questions I have.

1. When will be the CCIEv3.0 announce ? (or How long do we have time to do v2.0 exam)
2. CCIE Wireless statistics (How many wireless CCIEs are there ?)
3. What is the current passing mark based on the success rate of candidates (I know general pass mark is 80% & it is a variable as well)
4. How wireless lab task are graded ? Specially voice calls, etc
5. How deep we need to dig in QoS (Prioritizing, Queuing )
6. Is there known technical issues in this lab which we need to go to proctor (SSID not seen, etc)
7. Why slow GUI response to Sydney Lab location (if anyone going from APAC who did wireless lab in Sydney)

Related Posts

1. Do you know enough about CCIEW v2.0

Worldwide wireless CCIE count listed as 64 in a one of CCIE-Service Provider (BRKCCIE-9163-CCIE Service Provider) breakout session during CiscoLive US (June 2013). According to this stats are updated as of March 2013.

Interesting question is how wireless CCIE count drops (93 to 64) from 2012 to 2013 ? I DO NOT believe this is accurate. Only possibility is this latest figures shows only active CCIEs & 29 of wireless CCIEs status become inactive within last year ( I seriously doubted this could happen)

Here is the similar information given in 2012.

Here is the statistics given in 2011 Feb

Only Cisco can clarify these figures & I have asked the question in a support forum. Hope someone clarify this for us.

Declining Wireless CCIE Count ?

Update @2nd July: Cisco has deleted this thread since they are not made these certification numbers public any longer.

Related Posts

1. How many CCIEs are in the world ?
2.

Let’s consider the following scenario.

A WGB is connected to a root AP (AAP1) using EAP-FAST as security method. AAP1 is having 192.168.20.99 (Vlan20) management IP.  A Printer (Passive Client) connected to WGB should get an IP from 192.168.7.0/24 (Vlan7) which is different to AAP management VLAN.

Here are few basic rules to remember when configuring WGB

1. WGB will associate to root AP using bridge-group 1 (native vlan)
2. If WGB to support multiple VLANs then it should be in “infrastructure” mode (in Unified Wirelss or WLC based WGB, this is not required)
3. If WGB itself require an IP (for mgmt purposes) it should be on native VLAN (of WGB)

Based on the above rules, Here are the two different valid options to fulfill this requirement.

Option 1:
Configure WGB to support multiple VLAN & assign all clients behind WGB to vlan 7. In this case WGB itself will take an IP from VLAN20 which is native vlan on WGB.

Option 2:
Make VLAN 7 as native on WGB while keeping AAP native VLAN to 20. In this way WGB & clients get IP from VLAN7 & no multiple VLAN support on WGB.

Since I have written a post on how to configure EAP-FAST, I will not describe the steps here simply use the configuration required, please read that post if you require more information.

Here how you could configure Option 1 as a solution for this.
In AAP1 “infrastructure-client” command under dot11 radio 0 interface make WGB “infrastructure” mode which is required to support multiple vlan on WGB.

hostname AAP1
!
aaa new-model
aaa group server radius RAD-GROUP
 server 192.168.20.99 auth-port 1812 acct-port 1813
!
aaa authentication login EAP-METHODS group RAD-GROUP
!
radius-server local
  nas 192.168.20.99 key Cisco123
  user wgb password Cisco123
!
radius-server host 192.168.20.99 auth-port 1812 acct-port 1813 key Cisco123
!
dot11 ssid MRN-WGB
   vlan 20
   authentication open eap EAP-METHODS 
   authentication network-eap EAP-METHODS 
   authentication key-management wpa version 2
!
interface Dot11Radio0
 encryption vlan 20 mode ciphers aes-ccm 
 ssid MRN-WGB
 station-role root
 infrastructure-client
!
interface Dot11Radio0.7
 encapsulation dot1Q 7
 bridge-group 7
!
interface Dot11Radio0.20
 encapsulation dot1Q 20 native
 bridge-group 1
!
interface GigabitEthernet0.7
 encapsulation dot1Q 7
 bridge-group 7
!
interface GigabitEthernet0.20
 encapsulation dot1Q 20 native
 bridge-group 1
!
interface BVI1
 ip address 192.168.20.99 255.255.255.0     
ip default-gateway 192.168.20.254
sntp server 10.10.205.20

Here is the WGB configuration looks like.”workgroup-bridge client-vlan 7” command will enforce client behind WGB to be on vlan 7. “ip address dhcp” under BVI1 interface will ensure WGB will get an IP from native vlan which is 20 to manage WGB itself. “bridge 7 address 0018.fea5.dc3e forward GigabitEthernet0.7” ensure if WGB client is “passive-client” (Printer in my case) with MAC address 0018.fea5.dc3e remain in WGB bridge table without aging-out.

hostname WGB
!
dot11 ssid MRN-WGB
   vlan 20
   authentication open eap EAP-METHODS 
   authentication network-eap EAP-METHODS 
   authentication key-management wpa version 2
   dot1x credentials FAST
   dot1x eap profile FAST
!
eap profile FAST
 method fast
!
dot1x credentials FAST
 username wgb
 password Cisco1123
!
interface Dot11Radio0
 encryption vlan 20 mode ciphers aes-ccm 
 ssid MRN-WGB
 station-role workgroup-bridge
!
interface Dot11Radio0.7
 encapsulation dot1Q 7
 bridge-group 7
!
interface Dot11Radio0.20
 encapsulation dot1Q 20 native
 bridge-group 1
!
interface GigabitEthernet0.7
 encapsulation dot1Q 7
 bridge-group 7
!
interface GigabitEthernet0.20
 encapsulation dot1Q 20 native
 bridge-group 1
!
interface BVI1
 ip address dhcp
sntp server 10.10.205.20
!
bridge 7 address 0018.fea5.dc3e forward GigabitEthernet0.7 
workgroup-bridge client-vlan 7

If you do this you can see your printer will get an IP in the range of 192.168.7.x/24 where as WGB itself will get an IP 192.168.20.x/24 range. I have configured DHCP on CAT2 for these two VLAN. Here is the CAT2 config for this example.

interface FastEthernet1/0/13
 description TEMP-AAP1-1142
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 20
 switchport mode trunk
!
ip dhcp excluded-address 192.168.20.1 192.168.20.99
ip dhcp excluded-address 192.168.7.1 192.168.7.99
!
ip dhcp pool VLAN7
   network 192.168.7.0 255.255.255.0
   default-router 192.168.7.1 
   domain-name mrn.com
   dns-server 192.168.200.1
!
ip dhcp pool vlan20
   network 192.168.20.0 255.255.255.0
   default-router 192.168.20.254 
   dns-server 192.168.200.1  
   domain-name mrn.com

You can verify this “show dot11 association” output on AAP1 & then ping these IP from CAT2

AAP1#sh dot11 ass
802.11 Client Stations on Dot11Radio0: 
SSID [MRN-WGB] : 
MAC Address    IP address      Device        Name            Parent         State     
0018.fea5.dc3e 192.168.7.109   WGB-client    -               44d3.caaf.4343 Assoc    
44d3.caaf.4343 192.168.20.143  WGB           WGB             self           EAP-Assoc

CAT2#ping 192.168.7.109
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.7.109, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms

CAT2#ping 192.168.20.143
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.143, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms

Now let’s see how to configure this in Option 2 to achieve the same outcome. In this case we will make Vlan7 on WGB as native vlan. In this way WGB clients (including WGB itself) get vlan 7 IPs. Since AAP1 has to be on vlan 20, native vlan should be 20 for the AAP1.

Here is the AAP1 configuration.

hostname AAP1
!
aaa new-model
!
aaa group server radius RAD-GROUP
 server 192.168.20.99 auth-port 1812 acct-port 1813
!
aaa authentication login EAP-METHODS group RAD-GROUP
!
radius-server local
  nas 192.168.20.99 key Cisco123
  user wgb password Cisco123
!
radius-server host 192.168.20.99 auth-port 1812 acct-port 1813 key Cisco123
!
dot11 ssid MRN-WGB
   vlan 7
   authentication open eap EAP-METHODS 
   authentication network-eap EAP-METHODS 
   authentication key-management wpa version 2
!
interface Dot11Radio0
 encryption vlan 7 mode ciphers aes-ccm 
 ssid MRN-WGB
 station-role root
!
interface Dot11Radio0.7
 encapsulation dot1Q 7
 bridge-group 7
!
interface Dot11Radio0.20
 encapsulation dot1Q 20 native
 bridge-group 1
!
interface GigabitEthernet0.7
 encapsulation dot1Q 7
 bridge-group 7
!
interface GigabitEthernet0.20
 encapsulation dot1Q 20 native
 bridge-group 1
!
interface BVI1
 ip address 192.168.20.99 255.255.255.0
!
ip default-gateway 192.168.20.254
sntp server 10.10.205.20

Here is the WGB configuration.

hostname WGB
!
dot11 ssid MRN-WGB
   vlan 7 
   authentication open eap EAP-METHODS 
   authentication network-eap EAP-METHODS 
   authentication key-management wpa version 2
   dot1x credentials FAST
   dot1x eap profile FAST
!
eap profile FAST
 method fast
!
dot1x credentials FAST
 username wgb
 password Cisco123
!
interface Dot11Radio0
 encryption vlan 7 mode ciphers aes-ccm 
 ssid MRN-WGB
 station-role workgroup-bridge
!
interface Dot11Radio0.7
 encapsulation dot1Q 7 native
 bridge-group 1
!
interface GigabitEthernet0.7
 encapsulation dot1Q 7 native
 bridge-group 1
!
interface BVI1
 ip address dhcp
!
bridge 1 address 0018.fea5.dc3e forward GigabitEthernet0.7 
!
sntp server 10.10.205.20

You can verify the Printer & WGB IP details & connectivity to rest of the network as follows.

AAP1#show dot11 associations 
802.11 Client Stations on Dot11Radio0: 
SSID [MRN-WGB] : 
MAC Address    IP address      Device        Name            Parent         State     
0018.fea5.dc3e 192.168.7.109   WGB-client    -               44d3.caaf.4343 Assoc    
44d3.caaf.4343 192.168.7.112   WGB           WGB             self           EAP-Assoc

CAT2#ping 192.168.7.109 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.7.109, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms

CAT2#ping 192.168.7.112
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.7.112, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms

.

Related Posts

1. WGB Configuration
2. WGB with EAP-FAST
3. WGB with CAPWAP
4. WGB with PSK
5. WGB Roaming
6. IOS AP-WGB with Multiple VLAN
7. Unified AP-WGB with Multiple VLAN
8. Packet Retries & Max-Retries
9.

In this post we will see how to manipulate STP root port selection in a given topology. We will use the VLAN 10 (management vlan) STP instance to see which ports will be Root Port in each switch. Any given switch Bridge ID consist of Bridge Priority (default 32768 + system extend ID) & MAC address. Since we are taking vlan10 as example default bridge priority will be 32778.

Here are the basic rules of STP

1. Lowest bridge ID (Priority:MAC Address) switch becomes the Root-Bridge
2. Each non-root bridge should have ONE root port (RP) which is the port having lowest path-cost to Root Bridge.
3. All ports in Root Bridge become Designated Ports (DP)
4. Each segment should have one Designated Port (DP)
5. All RP/DPs will be in FORWARDING state & all other ports will be in BLOCKING state.

According to the topology CAT1 is having lowest MAC address (hence lowest bridge  ID) & will become the Root Bridge. Butif you do not want to rely on MAC addreses you can lower priority of a given switch to make them as the Root Bridge for all VLANs. In my case will make priority for all Vlans to lowest value( which is 0) in CAT1.

CAT1(config)#spanning-tree vlan 1-4094 priority ?
  <0-61440>  bridge priority in increments of 4096

CAT1(config)#spanning-tree vlan 1-4094 priority 0
CAT1#sh spanning-tree vlan 10
VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    10
             Address     0017.94ba.bc80
             This bridge is the root
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    10     (priority 0 sys-id-ext 10)
             Address     0017.94ba.bc80
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Now we will look at which port become Root Port in each non-root bridges (CAT2,CAT3,CAT4). Root Port selection is based on the port having lowest cost to the Root Bridge (CAT1). For PVST (Per VLAN Spanning Tree) path cost will depend on bandwidth of links and cost value is as shown below for most commonly used links.

10Gbps -> 2
1 Gbps -> 4
100 Mbps -> 19
10 Mbps -> 100

Also it is important to understand how path cost calculate. From Root Bridge it will send BPDU with cost to Root Bridge as “0″. When this BPDU receive by any other switch it will add its own port cost (according to the above mentioned value). So if BPDU receive by a Fast Ethernet port (100 Mbps) it will calculate path cost to root as 19 (0+19). 

For CAT3, it has 3 different option (label b,t,p). Here Root Port choice is obvious, only via Fa 0/22 (b) is having lowest path cost to Root Bridge. So that will become the Root Port.

For CAT2′s it has 4 different ports (label d,f,u,r). Out of which two ports (d & f) are having same path cost (19) to Root Bridge. Via port “u” it is having path cost of 38 & via port “r” it is having path cost of 57. Since we have two equal cost paths, you need to know tie breaking rules in this scenario. Here they are,

1. Lowest Sending Bridge ID
2. Lowest Port Priority (of sender)
3. Lowest Interface number (of sender)

In our case both port “d” & “f” receiving BPDU from same bridge (CAT1) which suggest “lowest port priority of sender” will be the tie breaker. By default each port is having priority value of 128 (can be 0-256 multiplier of 16). This makes “lowest interface number of sender” it tie breaker. In our case CAT1′s fa1/0/23 is having lower interface number & therefore that BPDU received by CAT2′s fa1/0/24 will become root port.

CAT2#sh spanning-tree vlan 10
VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    10
             Address     0017.94ba.bc80
             Cost        19
             Port        26 (FastEthernet1/0/24)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     001a.e3a7.ff00
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  15  sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa1/0/2             Desg FWD 19        128.4    P2p 
Fa1/0/21            Desg FWD 19        128.23   P2p 
Fa1/0/23            Altn BLK 19        128.25   P2p 
Fa1/0/24            Root FWD 19        128.26   P2p

Now let’s see what will happen if you change CAT1′s fa1/0/24 port priority.

CAT1(config-if)#spanning-tree vlan 10 port-priority ?
  <0-240>  port priority in increments of 16

CAT1(config-if)#spanning-tree vlan 10 port-priority 0

CAT1(config-if)#do sh span vlan 10
Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa1/0/22            Desg FWD 19        128.24   P2p 
Fa1/0/23            Desg FWD 19        128.25   P2p 
Fa1/0/24            Desg FWD 19          0.26   P2p

Now if you look in CAT2 you would see Fa1/0/23 (connected to CAT1′s fa1/0/24) will become root port because of the lower port priority of sender.

CAT2#sh spanning-tree vlan 10
VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    10
             Address     0017.94ba.bc80
             Cost        19
             Port        25 (FastEthernet1/0/23)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     001a.e3a7.ff00
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  15  sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa1/0/2             Desg FWD 19        128.4    P2p 
Fa1/0/21            Desg FWD 19        128.23   P2p 
Fa1/0/23            Root FWD 19        128.25   P2p 
Fa1/0/24            Altn BLK 19        128.26   P2p

For CAT4, both port G0/3 “q” & G0/2 “s” are having equal path cost(38) to root bridge(CAT1). But in this case port “s” is getting BPDU from a lower bridge id switch CAT2 (32778: 001a.e3a7.ff00) comparison to port “q” from CAT3 (32778: 0024.137b.5a00). In this case Port “s” – G0/2 become root port & Port Priority or Interface ID won’t come into play.

CAT4#sh span vlan 10
VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    10
             Address     0017.94ba.bc80
             Cost        38
             Port        2 (GigabitEthernet0/2)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     58bf.ea59.f800
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  15  sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/2               Root FWD 19        128.2    P2p 
Gi0/3               Altn BLK 19        128.3    P2p

But in here if you want to make G0/3 as root port you can change it’s port cost to a lower value which results lower path cost to root. In this example I will change it to cost of 1 which  resulting path cost to root is 20 via that port. So that will become root port.

CAT5(config-if)#spanning-tree vlan 10 cost ?
  <1-200000000>  Change an interface's per VLAN spanning tree path cost 

CAT5(config-if)#spanning-tree vlan 10 cost 1

CAT5#sh spanning-tree vlan 10
VLAN0010
  Spanning tree enabled protocol ieee
  Root ID    Priority    10
             Address     0017.94ba.bc80
             Cost        20
             Port        3 (GigabitEthernet0/3)
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)
             Address     58bf.ea59.f800
             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/2               Altn BLK 19        128.2    P2p 
Gi0/3               Root FWD 1         128.3    P2p

Now you know which port becomes a root port in each non-root switches. So  Port “b”, “f” & “q” will become root port in this topology. If you want to identify which ports become Designated Ports (DP) you can follow below rules.

1. All ports in Root Bridge will become Designated Ports
2. Each segment (link) will have ONE Designated Port.

If a given link does not have a Root Port, either of them could be a designated port. But lower bridge ID switch port wins in this situation (“u” in “t-u” link & “r” in “r-s” link ) become a DP.  In this way ports other than “d”, “t” & “s” will become either DP or RP. Hence those will become “FORWARDING” ports & others (d,t,s) become  “BLOCKING” Ports as shown in the below diagram.

Here is “show spanning tree vlan 10″ output to verify the above.

CAT2#sh spanning-tree vlan 10
Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa1/0/2             Desg FWD 19        128.4    P2p 
Fa1/0/21            Desg FWD 19        128.23   P2p 
Fa1/0/23            Root FWD 19        128.25   P2p 
Fa1/0/24            Altn BLK 19        128.26   P2p <- "port d"

CAT3#sh spanning-tree vlan 10
Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/3               Desg FWD 19        128.3    P2p 
Fa0/21              Altn BLK 19        128.21   P2p <- "Port t"
Fa0/22              Root FWD 19        128.22   P2p 

CAT4#sh spanning-tree vlan 10
Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/2               Altn BLK 19        128.2    P2p <- "port S"
Gi0/3               Root FWD 1         128.3    P2p

In this way you can manipulate the Root Port selection of your network.

References:
1. VLAN Load Balancing between Trunk link
2. Understanding Rapid Spanning Tree Protocol (802.1w)

As per the RFC3580 (IEEE 802.1X RADIUS Usage Guidelines) here are the definition of two terms “Called Station ID” & “Calling Station ID“. As you can see if your wireless deployment is RFC3580 compliant, you should get AP Radio MAC & SSID information as “Called Station ID” where as supplicant mac address as “Calling Station ID”. These are useful to enforce policies to your wireless traffic based on SSID information.

Called Station ID:
For IEEE 802.1X Authenticators, this attribute is used to store the
bridge or Access Point MAC address in ASCII format (upper case only),
with octet values separated by a "-".  Example: "00-10-A4-23-19-C0".
In IEEE 802.11, where the SSID is known, it SHOULD be appended to the
Access Point MAC address, separated from the MAC address with a ":".
Example "00-10-A4-23-19-C0:AP1".

Calling Station ID:
For IEEE 802.1X Authenticators, this attribute is used to store the
Supplicant MAC address in ASCII format (upper case only), with octet
values separated by a "-".  Example: "00-10-A4-23-19-C0".

We will see how this works in Cisco Local & H-REAP mode deployment. Here is the basic topology where I have two APs, WLC & ACS.

Here is the L1130-1 (Local Mode) AP information.

Here is the L1250-1 (H-REAP Mode) AP information.

I have configured WLAN called “RFC-3580″ to test this out & configured for WAP2/AES & 802.1x for RADIUS authentication. Below picture shows the few important settings (H-REAP local switching) while most of others kept its default.

First of all we will test Local Mode AP (L1130-1) connection by connecting to this SSID & then go to ACS Monitoring logs. You would see something like this. As you can see “Called Station ID” is coming as “AP Radio MAC: SSID” which is comply to RFC3580. Also calling station ID appear as supplicant MAC address separated by “-” which is comply to the standard.

Now will test this with H-REAP mode. In H-REAP there will be two scenarios as “Connected” & “Standalone” mode. In connected mode, WLC will be sending authentication request to radius server where as in Standalone mode AP itself sending authentication request.

Here is the similar output when client is associated to H-REAP in Connected Mode. As you can see both parameters information is comply with RFC3580. Note that this time L1250-1 Radio MAC (54:75:d0:cd:05:70) is part of called station ID.

Finally we will test this in “H-REAP Standalone” mode. You can do this by shutdown the switchport connect to WLC.  You can verify this by using “show capwap reap status” on AP CLI.

L1250-1#show capwap reap status 
 AP Mode:         REAP, Standalone
 Radar detected on:

Here is the ACS log information this time. You can see clearly this time both Calling Station ID &  Called Station ID is not RFC3580 compliant (No SSID info in Called station ID & MAC info is not separated by “-”). If you looked carefully Called Station MAC address is not Radio MAC address (54:75:d0:cd:05:70) but BSSID which is derived from the base radio MAC address. Since my WLAN ID is 10, If you increment base MAC by 10 you will end up with 54:75:d0:cd:05:79 which is BSSID in this case.

Can you change this default behavior in H-REAP standalone mode ? Since AP config is controlled by WLC, unless it is configurable from WLC there is no permanent fix (unless Cisco Change this bbehavior to comply with RFC 3580). But if you really want you can modify AP config locally (but would not prevail if AP reboots)

If you configure “radius-server vsa send authentication” you can send the SSID information to ACS.

L1250-1#debug capwap console cli
This command is meant only for debugging/troubleshooting 
Any configuration change may result in different
behavior from centralized configuration. 

CAPWAP console CLI allow/disallow debugging is on
L1250-1#conf t
Enter configuration commands, one per line.  End with CNTL/Z

L1250-1(config)#radius-server vsa send ?
  accounting      Send in accounting requests
  authentication  Send in access requests
  cisco-nas-port  Send cisco-nas-port VSA(2)
  <cr>

L1250-1(config)#radius-server vsa send authentication ?
  3gpp2  Send 3GPP2 VSAs in accounting requests
  <cr>

L1250-1(config)#radius-server vsa send authentication

Here is the output once configure this on the AP locally. SSID information coming under “Cisco-AVPair” as you can see below.

Looks like there are commands to change the radius attribute on the AP CLI, but none of this make information send is RFC 3580 compliant in this scenario.

L1250-1(config)#radius-server attribute ?
  11        Filter-Id attribute configuration
  188       Num-In-Multilink attribute configuration
  218       Address-Pool attribute
  25        Class attribute
  30        DNIS attribute
  31        Calling Station ID
  32        NAS-Identifier attribute
  4         NAS IP address attribute
  44        Acct-Session-Id attribute
  55        Event-Timestamp attribute
  6         Service-Type attribute
  69        Tunnel-Password attribute
  77        Connect-Info attribute
  8         Framed IP address attribute
  list      List of Attribute Types
  nas-port  NAS-Port attribute configuration

L1250-1(config)#radius-server attribute 31 mac format 
  default      format ex: 0000.4096.3e4a
  ietf         format ex: 00-00-40-96-3E-4A
  unformatted  format ex: 000040963e4a

L1250-1(config)#radius-server attribute 31 mac format  ietf

There is a support forum question related to this, Hopefully Cisco will answer to this when this available in WLC/H-REAP.

WLC Problem with append SSID in Called Station ID in H-REAP

Related Posts

1. EAP Overview
2. AAA Basics – Part 1
3. PEAP & EAP-FAST with ACS 5.2
4. AAA Override with ACS 5.2
5.

In this post we will look at how to configure QoS for a switch port where H-REAP is connected. In this example we are considering H-REAP local switching scenario &  normally a switch port is configured as Trunk port to facilitate this. Here is the basic set up for this post.

Here is the switch port configuration of H-REAP & Wireshark PC.

R3750#
interface FastEthernet1/0/4
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 50
 switchport trunk allowed vlan 50,146
 switchport mode trunk
 spanning-tree portfast trunk
!
interface FastEthernet1/0/7
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
monitor session 1 source interface Fa1/0/4
monitor session 1 destination interface Fa1/0/7 encapsulation replicate

So what should you trust to give better QoS, CoS or DSCP ? Let’s see what’s best suit in this scenario by looking at the packet capture of H-REAP connected switch port (Fa 1/0/4). Let’s look at two different traffic type (management & user traffic).

Here is CAPWAP control (udp 5246) traffic coming from H-REAP. As you can see there is no layer 2 tag (as Vlan 50 is native vlan on the trunk link) & hence no QoS information in the layer 2 header packet coming from H-REAP (192.168.50.52), though original IP packet is having CS6 DSCP value.

Here is a data packet coming from wireless phone. As you can see that packet include layer 2 tag (VLAN 146) which include CoS (or priority) value for QoS. In this case RTP traffic marked to CoS value 5.

Now, if you considering trusting CoS value for the switch port (Fa 1/0/4) connected to H-REAP all you control traffic marked with default CoS 0 (as no QoS value comes in layer 2). All other tagged vlan traffic will trust CoS value coming in those frames.

On the other hand if you trusting DSCP for Fa 1/0/4, then both management traffic & user traffic will get prioritized based on original packets DSCP value (ignoring AP imposed CoS value for tagged frame).

Therefore you have to trust DSCP if you want to provide QoS for ALL traffic coming from H-REAP which include management traffic & user traffic.

R3750(config-if)#do sh run int fa1/0/4
 interface FastEthernet1/0/4
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 50
 switchport trunk allowed vlan 50,146
 switchport mode trunk
 mls qos trust dscp
 spanning-tree portfast trunk

Now we will look how a packet capture with different QoS profile (Platinum, Gold, Silver, Bronze). In the above RFC-3580 WLAN QoS profile was set to Platinum. Let’s change it to Silver & see a packet capture. As expected in this time layer 2 CoS value is capped as per the Silver Profile, even though layer 3  DSCP is EF.

Since we are trusting DSCP packet will get the EF priority irrespective of the layer2  CoS value. So it is very important to understand we cannot keep AP imposed QoS (based on QoS-Profile) preserved in this scenario (trust DSCP) unless you trust CoS on that switch port. If you trust CoS then no way of giving required QoS for management traffic coming from H-REAP(since those are un-tagged).

If you consider H-REAP central switching scenario, still you have to trust DSCP in order to preserve outer CAPWAP information for H-REAP to WLC communication.

So in conclusion what should you trust in H-REAP deployment, answer is IT DEPENDS.

1. If you want to classify ALL traffic (management & user traffic) based on the packet DSCP value then you have to trust DSCP at the switch port.

2. If you are considering only user traffic & you want to preserve the QoS value impose by AP then you have to trust CoS. In this scenario ONLY user traffic will be classified correctly where 802.1q tag comes with the frame.

Related Posts

1. Understanding Wireless QoS – Part 1
2. Understanding Wireless QoS – Part 2
3. Understanding Wireless QoS – Part 3
4. Understanding Wireless QoS – Part 4
5. Understanding Wireless QoS – Part 5
6. 3750/3560/2960 Wired QoS
7. Who do you trust ? (DSCP or CoS)
8. BYOD with QoS

WGB Roaming time is the time taken by a WGB radio role to disassociate from one AP and reassociate to another AP. During this interval there is no data transfer & therefore roaming time is significant to maintain sessions.

Roaming involves two main processes

1. Scanning
2. Reassociation

Scanning:
WGB support two main modes of roaming operation

1. Static mode (default) – Roaming is based on two main vairiables: “Packet retransmissions” or “loss of 8 consecutive beacons”
2. Mobile Station mode – On top of previous variables, the AP can do periodic analysis of signal level drops and data rate shifts.

When any of the above criteria is met, WGB will trigger roaming process, scanning approximately 10-20ms/channel. You can also limit the channels to be scanned through configuration. For example you can set only CH1, CH6 & CH11 to be scan in 2.4GHz radio deployment.

Scanning methodology followed is “Active Scanning“. Instead of listening to beacons from APs, WGB will actively send out  “probe request” packets and waits for 20ms to get a response in every channel. The AP will stop scanning after it receives the first response with satisfying signal. So scanning time may last approximately 40ms & may be shorter depending on radio hardware type.

There are two forms of configuring WGB roaming parameters

1. Use “packet retries” command : This will allow more conservative approach where WGB will not start a roaming process until data loss is detected or 8 consecutive beacons are missed.

int d0 or d1
packet retries <1-128> {drop-packet}

2. Use “mobile station” command : This will start a regular process on WGB to do preemptive roaming, which monitor the signal levels & rate speed changes and force a new roaming before the current AP signal is too low. This scan process will trigger small gaps in radio transmission when the radio is performing the channel scan. Starting from 12.4(25d)JA, minimum data rate can be configured to trigger a roaming event in case of data rate change. If you want to limit the number of channel to scan you can use the “mobile station scan” command.

int d0 or d1
mobile station
mobile station period <1-1000s> threshold <1-100>
mobile station minimum-rate <min-data-rate>
mobile station scan <scanning-channels>

If the WGB starts scanning because of a loss of eight consecutive beacons, the message “Too many missed beacons” is displayed on the console. In this case, the WGB is acting as a Universal Bridge Client, much like any other wireless client in its behavior.

In some situations, it is interesting to use the optional “drop” option in the packet retries, to preserve the association, even on the failure to transmit a data packet. This is useful for challenging RF environments, where the roaming can be also triggered by mobile scan command.

The mobile station algorithm evaluates two variables: data rate shift and signal strength and responds as:
1. If the driver does a long-term down shift in the transmit rate for packets to the parent, the WGB initiates a scan for a new parent (no more than once every configured period).
2. If the driver detect the RSSI from its parent is below the configured threshold, WGB initiates a scan for a new parent (no more than once every configured period).

The data-rate shift can be displayed using this command:

debug dot11 dot11Radio 0 trace print rates
!
*Mar  1 00:33:20.371: 436472AA-0 BBF420 - Set rate: m15.-2s 144 Mbps (20F), Rssi 29 dBm
*Mar  1 00:33:44.379: 44D32696-0 BBF420 - Set rate:    m15. 130 Mbps (10F), Rssi 29 dBm
*Mar  1 00:33:47.380: 4500FD0C-0 BBF420 - Set rate: m15.-2s 144 Mbps (20F), Rssi 29 dBm
*Mar  1 00:34:04.386: 4604BC7B-0 BBF420 - Set rate:    m15. 130 Mbps (10F), Rssi 29 dBm
*Mar  1 00:34:05.386: 461403FF-0 BBF420 - Set rate: m15.-2s 144 Mbps (20F), Rssi 30 dBm

However, this will not show the actual data rate shift algorithm in action, but only the changes in data rate. This determines the time period to scan, depending on how much the data rate was decreased.

The mobile station period should be set depending on the application. The default is 20 seconds. This delay period prevents the WGB from constantly scanning for a better parent if, for example, the threshold is below the configured value.

Some situations may require a faster timer; for example, on high speed trains. The period should not be lower than the time that is required by the AP to complete the authentication process. For example, for 802.1x + CCKM networks, it should not be set below 2 seconds. PSK networks may use one second. The actual period will always have one second added to the timer, product of the AP scheduler resolution for this task.

The threshold sets the level at which the algorithm is triggered to scan for a better parent. This threshold should be set to noise+20dBm but not more than -70dBm (+70 because input for threshold is positive). The default is -70 dBm. The correct threshold will depend on the intended data rate, versus the coverage level offered in the environment where the WGB will operate. Assuming a proper coverage, we should set this threshold to be a little less than then “breaking point” for the needed data rate for the applications in use. Here is the RSSI sensitivity values for a 3502I AP (you can find the full table from AP’s data sheet)

When you enable these settings, the WGB scans for a new parent association when it encounters a poor Received Signal Strength Indicator (RSSI), excessive radio interference, or a high frame-loss percentage. Using this criteria, a WGB configured as a mobile station searches for a new parent association and roams to a new parent before it loses its current association. When the mobile station setting is disabled (the default setting) the WGB does not search for a new association until it loses its current association.

There are 3 types of scans implemented for the WGB
1. Normal Scan
2. Fast Scan
3. Very fast Scan

A normal scan begins on the associated channel & continues to cycle through the rest of the channels. For example if WGB is associated to CH6, then it will start  its scan on CH6, CH7 … CH13, CH1…. CH5. Upon scanning all channels & receiving more than one probe response WGB will do compare function that compares (RSSI, Load, Hops, etc) all responding APs to the one it was previously associated.

WGB perform a fast scan when traffic is between 10-20 packets per second. The WGB scans and associate to first responding AP during fast scan.

During a very fast scan, the WGB does not scan at all and try to associate to the best AP in the adjacent list that is build up with IAPP and CCX.

In certain situations depending the application parent list may have “directionality”. For example a train is traveling to given directions would not have any benefits of the neighbor-list since train is moving away from them. You can configure the following command to ignore neighbor-list.

int d0 or d1
mobile station ignore neighbor-list

We will look at the Reassociation in the next post.

Reference
1. Outdoor Mobility Design Guide
2. https://supportforums.cisco.com/docs/DOC-14944

Related Posts

1. WGB Configuration
2. WGB with EAP-FAST
3. WGB with CAPWAP
4. WGB with PSK
5. IOS AP-WGB with Multiple VLAN
6. Unified AP-WGB with Multiple VLAN
7. Packet Retries & Max-Retries
8. WGB Roaming-Part 2
9.

Let’s see how we can configure a switchport connected to VoIP phone. Here is my setup for this post.

Here is the SPAN configuration.

monitor session 1 source interface Fa1/0/7
monitor session 1 destination interface Fa1/0/9 encapsulation replicate
!
interface FastEthernet1/0/9
 description BACKTRACK

First we will configure as a simple access vlan & see what’s  happen.

interface FastEthernet1/0/7
 description VOIP PHONE
 switchport mode access
 switchport access vlan 130
 spanning-tree portfast

If you look at a packet capture in this scenario, you would see a CDP packets send by both Phone & Switch.

Here is the CDP information send by Switch.

Here is the information send by phone via CDP. As you can see phone will inform power requirement via CDP. Therefore it is very important to have CDP enable on these switch port where you connect VoIP phones (this applies to any cisco PoE devices like AP, Camera, etc)

Then Phone & PC get IP via DHCP on vlan 130 & start normal communication. Here is SCCP & RTP packets coming from 7965 phone in this scenario. Since switchport is access port no vlan-tag is coming in those frames.

Here is a packet coming from PC.

In the above method both Phone & PC would be on the same vlan. In best practice scenario you would like to put phones & PC in two different vlan. By using “switchport voice vlan x” command you can do this. In that scenario switchport is carry two different VLAN traffic even though we have not configured it as a trunk port.

interface FastEthernet1/0/7
 description VOIP PHONE
 switchport access vlan 140
 switchport voice vlan 130
 spanning-tree portfas

As you can see below, switch will inform voice vlan  information to the phone via CDP. Also note that this time layer 2 vlan tagging is available in these frames

Here is a CDP packet coming from Phone is same as previous time.

Here is the SCCP packet coming from Phone this time. Note that it comes with layer2 vlan tag which include priority.

Here is the RTP traffic coming from the phone. You can see phone will set CoS value 5 for this RTP traffic in layer 2 header.

All traffic coming from PC will be on vlan 140 will be un-tagged (as Phone will only tagged it’s own traffic with layer 2 vlan)

But you can see from switch to Phone still traffic will be tagged on vlan 140.

From QoS perspective you wanted to trust priority set by phone for voice traffic. For PC traffic is “untrusted” in normal scenario you do not want to trust DSCP value of those packets. So best option is to trust CoS at the switchport. You can do this trust relationship conditionally  in order to end device directly connect to switchport & sending frame with layer 2 tag. So in this example as long as siwtch detect a Cisco-Phone via CDP it will trust CoS value set by that phone.

C3750-1(config)#int fa1/0/7
C3750-1(config-if)#mls qos trust cos

C3750-1(config-if)#mls qos trust device ?
  cisco-phone  Cisco IP Phone
  cts          Cisco-telepresence
  ip-camera    Cisco video surveillance camera
C3750-1(config-if)#mls qos trust device cisco-phone

If you want to prioritize voice traffic (EF) over any other traffic, you have to enable priority-queue in 3750/3560/2960 switch platforms as it is not ON by default.

C3750-1(config-if)#priority-queue ?
  out  egress priority queue
C3750-1(config-if)#priority-queue out

So final switchport configuration is looks like this.

interface FastEthernet1/0/7
 description VOIP PHONE
 switchport mode access
 switchport access vlan 140
 switchport voice vlan 130
 priority-queue out 
 mls qos trust device cisco-phone
 mls qos trust cos
 spanning-tree portfast

You can verify switch port configured features by using “show interface x switchport” command.

C3750-1#sh interfaces fa1/0/7 switchport 
Name: Fa1/0/7
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 140 (MyHome)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: 130 (Voice)
Administrative private-vlan host-association: none 
Administrative private-vlan mapping: none 
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk associations: none
Administrative private-vlan trunk mappings: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Appliance trust: none

Hope this is useful to understand switch port configuration to be done when it comes to VoIP phone connection.

Here is few reference talk about this voice vlan configuration.

1. Good Explanation of Voice Vlan
2. Switchport Voice Vlan – What does it do ?

Related Posts

1. 3750/3560/2960 Wired QoS
2. Who do you trust ? (DSCP or CoS)
3. QoS for H-REAP
4. Best Practice QoS Config
5.

In my home lab, I have used Cisco 3725 router as my Call Manager Express (CME). Even though it is not expected CME related configuration in your wireless lab exam, it is important to have it in your lab studies to test voice over wireless deployment scenarios.

I found “10 Steps to Configure CCME” document is really helpful for this. Here is the snapshot of this document with its original URL

I had this problem in my home lab’s CME router where it has a faulty fan & every 30s it generates a syslog msg saying “%FAN-3-FAN_FAILED: Fans had a rotation error reported“. This will fill up my logging buffer & come to console every time while I am doing something which annoy me . Here is an sample view of my logging buffer

Jul 27 07:21:42.601: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:22:12.602: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:22:42.604: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:23:12.605: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:23:42.607: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:24:12.609: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:24:42.610: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:25:12.612: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:25:42.613: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:26:12.615: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:26:42.617: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:27:12.618: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:27:42.620: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:28:12.621: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:28:42.623: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:29:12.625: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:29:42.626: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:30:12.628: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:30:42.629: %FAN-3-FAN_FAILED: Fans had a rotation error reported.
Jul 27 07:31:12.631: %FAN-3-FAN_FAILED: Fans had a rotation error reported

I wanted to suppress this message appearing on my console or logging buffer (or even do not want to send it to a syslog server).

What can I do about this ?  Changing the logging severity is one option. Since current syslog message is having severity 3, if you change logging severity to 2 then you won’t see this. But that will drop everything in severity 3 & not suppressing only this message. Also since I want to do debugs (severity 7) time to time this will not be an option for me.

CME(config)#logging buffered ? 
  <0-7>              Logging severity level
  <4096-2147483647>  Logging buffer size
  alerts             Immediate action needed           (severity=1)
  critical           Critical conditions               (severity=2)
  debugging          Debugging messages                (severity=7)
  discriminator      Establish MD-Buffer association
  emergencies        System is unusable                (severity=0)
  errors             Error conditions                  (severity=3)
  filtered           Enable filtered logging
  informational      Informational messages            (severity=6)
  notifications      Normal but significant conditions (severity=5)
  warnings           Warning conditions                (severity=4)
  xml                Enable logging in XML to XML logging buffer

So I posted this question in Cisco support forum & found the answer how to do this. It is “logging discriminator” command. This command introduced to IOS 12.4(11)T software release onwards. Here is the release history of this command.

Here is the command syntax & you can find more detail from the command reference section from here.

Let’s configure a logging discriminator to get rid of this message from my CME router.

CME(config)#logging discriminator ?
  WORD  discriminator name; string; max. 8 characters

CME(config)#logging discriminator FAN-FAIL ?
  facility    Facility pattern for messsage filtering
  mnemonics   Mnemonics pattern for messsage filtering
  msg-body    Msg-body pattern for messsage filtering
  rate-limit  Rate-limit value for messsage rate control
  severity    Severity group for messsage filtering
  <cr>

CME(config)#logging discriminator FAN-FAIL severity ?
  drops     To drop messages including the specified severities
  includes  To deliver messages including the specified severities

CME(config)#logging discriminator FAN-FAIL severity drops ?
  WORD  Specify a severity group delimited by ",", example 0,1,3,6,7 

CME(config)#logging discriminator FAN-FAIL severity drops 3 ?
  facility    Facility pattern for messsage filtering
  mnemonics   Mnemonics pattern for messsage filtering
  msg-body    Msg-body pattern for messsage filtering
  rate-limit  Rate-limit value for messsage rate control
  <cr>

CME(config)#logging discriminator FAN-FAIL severity drops 3 facility ?
  drops     To drop messages including the specified regular expression string
  includes  To deliver messages including the specified regular expression
            string

CME(config)#logging discriminator FAN-FAIL severity drops 3 facility drops ?
  WORD  Specify a regular expression string for message filtering

CME(config)#$criminator FAN-FAIL severity drops 3 facility drops FAN ?       
  mnemonics   Mnemonics pattern for messsage filtering
  msg-body    Msg-body pattern for messsage filtering
  rate-limit  Rate-limit value for messsage rate control
  <cr>

CME(config)#$ FAN-FAIL severity drops 3 facility drops FAN mnemonics drops ?
  WORD  Specify a regular expression string for message filtering

CME(config)#$severity drops 3 facility drops FAN mnemonics drops FAN_FAILED ?
  msg-body    Msg-body pattern for messsage filtering
  rate-limit  Rate-limit value for messsage rate control
  <cr>

CME(config)#$severity drops 3 facility drops FAN mnemonics drops FAN_FAILED 
Specified MD by the name FAN-FAIL is not found.
Adding new MD instance with specified MD attribute values.

CME(config)#do sh logg
Syslog logging: enabled (12 messages dropped, 5 messages rate-limited,
                0 flushes, 0 overruns, xml disabled, filtering disabled)

Inactive Message Discriminator:
FAN-FAIL  severity group drops    3
          facility       drops    FAN
          mnemonics      drops    FAN_FAILED

Once you define your logging discriminator, you can apply it to different logging methods (to make it active). I have applied it to console log, buffered logs, syslog server & monitor logs as shown below.

CME(config)#logging buffered discriminator FAN-FAIL 100000  
CME(config)#logging console discriminator FAN-FAIL
CME(config)#logging monitor discriminator FAN-FAIL
CME(config)#logging host 192.168.100.10 discriminator FAN-FAIL

Now you should not see this message anymore

You can verify this

CME(config)#do sh logg
Syslog logging: enabled (12 messages dropped, 5 messages rate-limited,
                0 flushes, 0 overruns, xml disabled, filtering disabled)

Active Message Discriminator:
FAN-FAIL  severity group drops    3
          facility       drops    FAN
          mnemonics      drops    FAN_FAILED

No Inactive Message Discriminator.
    Console logging: level debugging, 2742 messages logged, xml disabled,
                     filtering disabled, discriminator(FAN-FAIL), 
                     0 messages rate-limited, 1247 messages dropped-by-MD
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled, discriminator(FAN-FAIL), 
                     0 messages rate-limited, 14 messages dropped-by-MD
    Buffer logging:  level debugging, 0 messages logged, xml disabled,
                     filtering disabled, discriminator(FAN-FAIL), 
                     0 messages rate-limited, 15 messages dropped-by-MD
    Logging Exception size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled

No active filter modules.
ESM: 0 messages dropped
    Trap logging: level informational, 3998 message lines logged
        Logging to 192.168.100.10  (udp port 514,  audit disabled,
              authentication disabled, encryption disabled, link up),
              5 message lines logged, 
              0 message lines rate-limited, 
              1255 message lines dropped-by-MD, 
              xml disabled, sequence number disabled
              filtering enabled, discriminator (FAN-FAIL)

Log Buffer (100000 bytes):

This is a very handy command if you want to get rid of specific syslog message flooding your syslog server or console of affected devices as long as it is not an important alert for you.

In this post, we will have a closer look at QoS in Autonomous AP. Primary focus of the QoS in autonomous AP deployment is for radio downstream (arrow B)

I have very basic  configuration in AAP1 as shown below.

hostname AAP1
!
dot11 ssid ONE
  vlan 1
  authentication open
  mbssid guest-mode
!
interface Dot11Radio0
 ssid ONE
 mbssid
 station-role root
!
interface Dot11Radio0.1
 encapsulation dot1Q 1
 bridge-group 10
!
interface Dot11Radio0.999
 encapsulation dot1Q 999 native
 bridge-group 1
!
interface GigabitEthernet0.1
 encapsulation dot1Q 1
 bridge-group 10
!
interface GigabitEthernet0.999
 encapsulation dot1Q 999 native
 bridge-group 1
!
interface BVI1
 ip address 192.168.99.99 255.255.255.0
ip default-gateway 192.168.99.1

C3750 switch port configured as below. (only shown AAP1 & wireshark PC switchport config)

interface Vlan999
 ip address 192.168.99.1 255.255.255.0
!
interface FastEthernet1/0/11
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 1,3,6,999
 switchport mode trunk
!
interface FastEthernet1/0/9
 description BACKTRACK
!
monitor session 1 source interface Fa1/0/11
monitor session 1 destination interface Fa1/0/9 encapsulation replicate

Let’s have a close look at packet captures in this case. We will  analyze traffic between  7921 wireless phone to 7965 wired phone. We will take signalling traffic(SCCP) & voice traffic(RTP) for this analysis.

Here is traffic goes from switch to AP (Ethernet Downstream – Arrow A). SCCP traffic mark with CoS=3 & RTP traffic mark with CoS=5.

Now if you look at Radio Downstream (Arrow B) you will observe the following. As shown below, you would notice AP will not do any mapping AVVID CoS value to 802.11e UP by default. They will pass CoS value as it is onto 802.11UP value.

Here is the wireless traffic coming from 7921 wireless phone to AP (radio upstream – Arrow C). As you can see SCCP traffic comes with 802.11e UP of 4 & RTP traffic comes with 802.11e UP of 6. Note that SCCP traffic coming from 7921 have DSCP of 0, still 802.11e UP of 4. This UP value is the important parameter as it get translated in to CoS value at the AP.

finally if you look at Ethernet Upstream (AP to switch – Arrow D) you will see the following. Note that by default UP value does not convert into appropriate CoS value and all traffic goes as CoS of 0 (Best Effort).

Let’s enable 802.11e to AVVID mapping on AP & see what would be the effect. This would map CoS 5 packet coming from ethernet side on to 802.11e UP of 6 prior to send it to wireless client.

AAP1(config)#dot11 priority-map ?
  avvid  Map priority 5 packets to priority 6

AAP1(config)#dot11 priority-map avvid

Here is the packet capture  (arrow B) after this configuration. You can see this time CoS values correctly map to 802.11e UP values (ie CoS 3 -> UP 4, CoS 5 -> UP 6)

Also this time 802.11e values correctly map onto CoS value before sending it ethernet upstream towards the switch.

From switch port perspective it has to trust CoS value set by AP in order to preserve the correct QoS settings. Again remember that management traffic goes to AP is untagged & do not have CoS value. Therefore switch will apply default CoS=0 for those traffic (Best Effort)

interface FastEthernet1/0/11
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 1,3,6,999
 switchport mode trunk
 priority-queue out 
 mls qos trust cos

Here is few guidelines for AAP QoS. You can refer configuration guide for more detail

The QoS implementation for wireless LANs differs from QoS implementations on other Cisco devices. With QoS enabled, access points perform the following:

• They do not classify packets; they prioritize packets based on DSCP value, client type (such as a wireless phone), or the priority value in the 802.1q or 802.1p tag.
• They do not construct internal DSCP values; they only support mapping by assigning IP DSCP, Precedence, or Protocol values to Layer 2 COS values.
• They carry out EDCF like queuing on the radio egress port only.
• They do only FIFO queueing on the Ethernet egress port.
• They support only 802.1Q/P tagged packets. Access points do not support ISL.
• They support only MQC policy-map set cos action.
• They prioritize the traffic from voice clients (such as Symbol phones) over traffic from other clients when the QoS Element for Wireless Phones feature is enabled.
• They support Spectralink phones using the class-map IP protocol clause with the protocol value set to 119.

Related Posts

1. 3750/3560/2960 Wired QoS
2. Who do you trust ? (DSCP or CoS)
3. QoS for H-REAP
4. Best Practice QoS Config
5. VoIP Phone – Switchport Config
6. Autonomous AP – QoS

In this post we will see the impact of enabling or disabling WMM (Wireless Multi Media) to QoS of wireless traffic in a given WLAN.

WMM setting is based on IEEE 802.11e standard to provide QoS to wireless network. An 802.11e (or WMM) client that obtain medium access must not utilize radio resources for a duration longer than specified limit (called  transmission opportunity or TXOP). Also WMM client will classify their traffic in to four access classes (AC_VO, AC_VI, AC_BE & AC_BK). Below diagram show the difference with legacy system & WMM capable system.

Ref: Analysis of IEEE 802.11e for QoS Support in Wireless LAN

Here is the topology for our post. Wireless Phone is connected to a WLAN configured with Platinum QoS profile. Traffic flow “D” & “E” will be looked at in detail for QoS analysis while WMM is enabled & disabled on this WLAN.

Here is the basic WLAN configuration

(4402-3) >config interface create vlan1 1
(4402-3) >config interface address dynamic-interface vlan1 192.168.2.249 255.255.255.0 192.168.2.250
(4402-3) >config interface dhcp dynamic-interface vlan1 primary 192.168.2.250
(4402-3) >config wlan create 1 ONE ONE
(4402-3) >config wlan interface 1 vlan1
(4402-3) >config wlan radio 1 802.11a-only
(4402-3) >config wlan security wpa disable 1
(4402-3) >config wlan qos 1 platinum 
(4402-3) >config wlan wmm require 1
(4402-3) >config wlan enable 1

Here is the QoS settings in GUI if you are familiar with it than CLI.

In this configuration we have restricted only WMM capable clients can join to this WLAN (by selecting WMM require option). WLAN is configured for Platinum profile where upto CoS =5 (or DSCP EF) QoS is allowed.

When 7921 phone make a call to 7965 phone here are the two different type of traffic (signalling – SCCP & media – RTP) wireless frame captures.

When AP receive these frames it will convert 802.11e priority value to CAPWAP header DSCP values. Since we have configured Platinum profile it will allow upto 802.11e priority value of 6. So in this case Voice traffic CAPWAP header DSCP would be EF & Signalling traffic CAPWAP header DSCP would be AF31 (as per the 802.11e to AVVID 802.1p mapping table). Below captures prove this.

As long as you trust DSCP on AP connected switch port(Fa1/0/4) & CoS on WLC connected switchport (G1/0/1), this traffic will go to wired network with CoS=5 for voice & CoS=3 for signalling traffic.

Now let’s disable WMM on this WLAN & see what impact it would do on the traffic QoS. You can disable it via GUI or CLI & here is the CLI way of doing that.

(4402-3) >config wlan disable 1
(4402-3) >config wlan wmm disable 1
Warning: 802.11n requires WMM to be enabled
(4402-3) >config wlan enable 1

As you see above this will impact the 802.11n functionality. If you disable WMM on a WLAN client won’t get 802.11n data rates.

Once WMM is disabled, AP is not negotiating any WMM settings and client wireless traffic comes without any WMM priority information. You can see both SCCP & RTP traffic wireless frames no WMM information available.

Since no priority values comes in wireless frames ALL traffic will get the QoS profile’s DSCP/CoS value in this time. So both traffic will get DSCP EF in CAPWAP header & translated into CoS of 5 prior to send to to wired network by WLC. So in this time all traffic coming from wireless client will mark as EF. Here is the capture of AP connected switch port.

Therefore it is important to understand this difference when you configuring QoS profile & WMM settings.

When enabling WMM there is another option called “WMM Allowed”. In this scenario it will allow both WMM capable client & non-WMM capable client to join the WLAN. But all non-WMM client traffic will mark as per the configured QoS profile.

Related Posts

1. Understanding Wireless QoS – Part 1
2. Understanding Wireless QoS – Part 2
3. Understanding Wireless QoS – Part 3
4. Understanding Wireless QoS – Part 4
5. Understanding Wireless QoS – Part 5
6. 3750/3560/2960 Wired QoS
7. Who do you trust ? (DSCP or CoS)
8. BYOD with QoS
9. QoS for H-REAP
10. VoIP Phone – Switchport Config
11. Autonomous AP – QoS
12. AAP QoS – A Closer Look

In this post we will look at a wireless bridge configuration with QoS. Here is the topology for this post.

A VoIP phone (vlan 1) and a Laptop (vlan 6) is connected to a 2960 Switch where it is connected to Non-Root Bridge AAP2 (3502). A 3750 switch connected to a Root Bridge AAP1 (1142) where a wireless bridge is setup between AAP1 & AAP2 with native vlan 999 . All SVI, DHCP pools are defined on 3750 switch. A wireless phone is connected to network via a LAP (L1130) controlled by a WLC (4402-3)

I have not used any security  for encryption/authentication (for simplicity). Also only configure 5 GHz (int d1). Here is the Root Bridge (AAP1) configuration looks like.

hostname AAP1
!
dot11 ssid MGMT
  vlan 999
  authentication open
  infrastructure-ssid
!
interface Dot11Radio1
 ssid MGMT
 station-role root bridge
!
interface Dot11Radio1.1
 encapsulation dot1Q 1
 bridge-group 10
!
interface Dot11Radio1.6
 encapsulation dot1Q 6
 bridge-group 60
!
interface Dot11Radio1.999
 encapsulation dot1Q 999 native
 bridge-group 1
!
interface GigabitEthernet0.1
 encapsulation dot1Q 1
 bridge-group 10
!
interface GigabitEthernet0.6
 encapsulation dot1Q 6
 bridge-group 60
!
interface GigabitEthernet0.999
 encapsulation dot1Q 999 native
 bridge-group 1
!
interface BVI1
 ip address 192.168.99.99 255.255.255.0
!
ip default-gateway 192.168.99.1

Here is the Non Root Bridge (AAP2) configuration

hostname AAP2
!
dot11 ssid MGMT
  vlan 999
  authentication open
  infrastructure-ssid
!
interface Dot11Radio1
 ssid MGMT
 station-role non-root bridge
!
interface Dot11Radio1.1
 encapsulation dot1Q 1
 bridge-group 10
!
interface Dot11Radio1.6
 encapsulation dot1Q 6
 bridge-group 60
!
interface Dot11Radio1.999
 encapsulation dot1Q 999 native
 bridge-group 1
!
interface g0.1
 encapsulation dot1Q 1
 bridge-group 10
!
interface g0.6
 encapsulation dot1Q 6
 bridge-group 60
!
interface g0.999
 encapsulation dot1Q 999 native
 bridge-group 1
!
interface BVI1
 ip address 192.168.99.100 255.255.255.0
!
ip default-gateway 192.168.99.1

Once  you configure like above you should see AAP2 is associate to AAP1. Your PC & 7965 phone should get IP from respective vlan via DHCP configured on 3750. You can verify AAP2 association like below.

AAP1#sh dot11 ass

802.11 Client Stations on Dot11Radio1: 

SSID [MGMT] : 

MAC Address    IP address      Device        Name            Parent         State     
64ae.0c91.9420 0.0.0.0         Br-client     -               64ae.0c93.7590 Assoc    
64ae.0c93.7590 192.168.99.100  bridge        AAP2            self           Assoc    

AAP1#show dot11 associations all-client 
Address           : 64ae.0c91.9420     Name             : NONE
IP Address        : 0.0.0.0            Interface        : Dot11Radio 1
Device            : Br-client          Software Version : NONE 
CCX Version       : NONE               Client MFP       : Off
State             : Assoc              Parent           : 64ae.0c93.7590    
SSID              : MGMT                            
VLAN              : 0
Hops to Infra     : 0                  
Clients Associated: 0                  Repeaters associated: 0

Address           : 64ae.0c93.7590     Name             : AAP2
IP Address        : 192.168.99.100     Interface        : Dot11Radio 1
Device            : bridge             Software Version : 12.4
CCX Version       : 5                  Client MFP       : Off
State             : Assoc              Parent           : self               
SSID              : MGMT                            
VLAN              : 999
Hops to Infra     : 1                  Association Id   : 1
Clients Associated: 1                  Repeaters associated: 0
Tunnel Address    : 0.0.0.0
Key Mgmt type     : NONE               Encryption       : Off
Current Rate      : 54.0               Capability       : WMM ShortHdr 11h
Supported Rates   : 54.0
Voice Rates       : disabled           Bandwidth        : 20 MHz 
Signal Strength   : -50  dBm           Connected for    : 137591 seconds
Signal to Noise   : 42  dB            Activity Timeout : 29 seconds
Power-save        : Off                Last Activity    : 1 seconds ago
Apsd DE AC(s)     : NONE

Now if you want to make sure QoS is configured end to end (VoIP phone to wireless phone) you can verify it like this. We will start from the 7965 end.

1. Since Phone is connected to switchport where voice vlan is configured, you have to trust CoS on R2960 G 0/1. You have to ensure QoS is enabled on switch & CoS to DSCP maps 5-> 46 & 3-> 26 for at least these two type of traffic (if you want any other DSCP values you can change this mapping table).

mls qos
mls qos map cos-dscp 0 10 18 26 34 46 48 56

interface GigabitEthernet0/1
 description VOIP+PC
 switchport access vlan 6
 switchport mode access
 switchport voice vlan 1
 priority-queue out 
 mls qos trust device cisco-phone
 mls qos trust cos
 spanning-tree portfast

2. Then AAP2 is connected to R2960 via a trunk port. For the traffic coming from phone already trusted at G0/1, so that configuring QoS on G0/8 won’t impact traffic initiating from 7965. But traffic coming to 7965 is going to be impacted by the QoS config on G 0/8. Since AAP2 translated wireless frame UP value on to CoS value before sending it to R2960, you have to trust CoS in G0/8.

interface GigabitEthernet0/8
 switchport trunk native vlan 999
 switchport trunk allowed vlan 1,6,999
 switchport mode trunk
 priority-queue out 
 mls qos trust cos

3. You need to make sure 802.11e to AVVID mapping happening at the AAP2. This will ensure Priority 6 value converted to CoS 5 for RTP traffic & Priority 4 value converted to CoS 3 for SCCP signalling traffic (vice versa as well). By default radio interfaces is trusting WMM UP values of wireless frames. If not you have to enable it “dot11 qos mode wmm” CLI command under radio interface.

AAP2#
dot11 priority-map avvid

Similar concept applies to AAP1 where you have to enable 802.11e to AVVID mapping.

AAP1#
dot11 priority-map avvid

4. For AAP1 connected switchport, you have to trust CoS as user traffic comes with 802.1q header which include CoS value set by AAP1.

mls qos
mls qos map cos-dscp 0 10 18 26 34 46 48 56

interface FastEthernet1/0/11
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 1,6,999
 switchport mode trunk
 priority-queue out 
 mls qos trust cos

5.  In the unified wireless section, WLC connected port, you have to trust CoS since controller is changing 802.1p value according to QoS configuration of the controller.

interface GigabitEthernet1/0/1
 description 4402-3
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 140,998
 switchport mode trunk
 switchport nonegotiate
 priority-queue out 
 mls qos trust cos
 channel-group 1 mode on
 spanning-tree portfast trunk

5. Finally for the L1130 connected switchport you have to trust DSCP as WLC to AP traffic is always CAPWAP & only DSCP value is in the IP header.

interface FastEthernet1/0/3
 switchport access vlan 20
 switchport mode access
 priority-queue out 
 mls qos trust dscp
 spanning-tree portfast

6.Since SCCP signalling traffic is going between CME & phones (7965 & 7921), you have to trust packet marking of CME on the port fa1/0/14 of 3750. Since this  is access port, only DSCP value exist on the packets coming from CME. So trust DSCP is the only choice.

interface FastEthernet1/0/14
 description CME - INTERNET
 no switchport
 ip address 192.168.128.1 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 mls qos trust dscp

Once you configure like this you could make sure end to end traffic QoS is preserved across you network.

I have taken two packet captures, one by SAPN port G0/8 of R2960 switch & the othe one by sniffing wireless packet in 5 GHz to see what’s going on the bridge.

Here is the SCCP & RTP traffic coming from the 7965 VoIP phone. You can see SCCP traffic comes with CoS of 3 &  Voice traffic comes with CoS of 5.

If you look at the traffic to 7965 VoIP phone it will looks like this. You can see RTP traffic comes with  CoS 5 & SCCP traffic comes with CoS 3. This proves end to end QoS is preserved from wireless phone to wired phone.

Now if you look at a wireless capture it will looks like this. Since AAP1 to AAP2 , it use Cisco proprietary IAPP protocol wireshark capture shows as “Encapsulated Ethernet” in the data section.

But you can verify wireless header information as below. You can verify BSSID of AAP1 & AAP2, then determine packets direction.

AAP1#sh dot11 bssid 
Interface      BSSID         Guest  SSID
Dot11Radio1   a40c.c31a.ee60  No   MGMT

AAP2#sho dot11 bssid 
Interface      BSSID         Guest  SSID
Dot11Radio1   64ae.0c93.7590  No   MGMT

Based on the above information you can see the below frame is from AAP2 to AAP1. Based on the User Priority of wireless frame we can tell it is signalling traffic (SCCP) going from 7965 to CME. Since we configured “dot11 priority-map avvid” on AAP1 these priority value translate to CoS of 3 when it goes to 3750 fa1/0/11.

Here is the return traffic coming from AAP1 to AAP2, as you can see it has the similar priority in wireless frames.

Here is the RTP traffic wireless captures where you can see traffic comes with priority value of 6 in wireless frames.

Related Posts

1. Understanding Wireless QoS – Part 1
2. Understanding Wireless QoS – Part 2
3. Understanding Wireless QoS – Part 3
4. Understanding Wireless QoS – Part 4
5. Understanding Wireless QoS – Part 5
6. 3750/3560/2960 Wired QoS
7. Who do you trust ? (DSCP or CoS)
8. BYOD with QoS
9. QoS for H-REAP
10. VoIP Phone – Switchport Config
11. Autonomous AP – QoS
12. AAP QoS – A Closer Look
13. WMM & QoS Profile

In my R&S CCIE lab exam this is one thing I used all the time. There are multiple verification commands you need to run all the time & “Alias” will help you to execute those commands without typing the full command.

Even in Wireless CCIE exam, you can use these alias configuration for the commands you have to run many times during the exam. Specially if you want to verify the initial configuration this may help you. Here are few of my favourites, you can work it out yourself any other verification requirement you have.

1. “sh archive config differences nvram:startup-config system:running-config“
This will give you the running config & startup config differences, If I configure any given task I would verify using this command to make sure all the commands added/removed is as expected.

Here how you can use “alias config” to run this command in global config mode without exiting from that prompt & without typing the full command syntax. If you want to run this command in “exec” mode, you have to use “alias exec … ” option. If it is an interface configuration you have to use “alias interface ….”

C3750-1(config)#alias ?
  SASL-profile               SASL profile configuration mode
  aaa-attr-list              AAA attribute list config mode
  aaa-user                   AAA user definition
  address-family             Address Family configuration mode
  archive                    Archive the router configuration mode
  arp-nacl                   ARP named ACL configuration mode
  cns-connect-config         CNS Connect Info Mode
  cns-connect-intf-config    CNS Connect Intf Info Mode
  cns-tmpl-connect-config    CNS Template Connect Info Mode
  config-ip-sla-http-rr      IP SLAs HTTP raw request Configuration
  configure                  Global configuration mode
  crypto-ca-cert-chain       Crypto certificate entry mode
  crypto-ca-cert-comm        Certificate query  mode
  crypto-ca-cert-map         Certificate map entry mode
  crypto-ca-profile-enroll   Certificate enrollment profile entry mode
  crypto-ca-root             Certificate authority trusted root entry mode
  crypto-ca-trustpoint       Certificate authority trustpoint entry mode
  crypto-pubkey              Crypto subsystem public key entry mode
  dhcp                       DHCP pool configuration mode
  dhcp-class                 DHCP class configuration mode
  dhcp-pool-class            Per DHCP pool class configuration mode
  dhcp-relay-info            DHCP class relay agent info configuration mode

C3750-1(config)#alias configure ?
  WORD  Alias name

C3750-1(config)#alias configure diff ?
  LINE  New alias

C3750-1(config)#alias configure diff do sh archive config differences nvram:startup-config system:running-config
C3750-1(config)#alias exec diff sh archive config differences nvram:startup-config system:running-config

Now if you issue the “diff” command in config mode it should give the same output as you issue the full “show archive ….” command in exec prompt.

R2960(config)#diff
!
!Contextual Config Diffs:
+mls qos map cos-dscp 0 10 18 26 34 46 48 56
crypto pki certificate chain TP-self-signed-3931764736
 +certificate self-signed 01
  +3082023E 308201A7 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  +31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  +69666963 6174652D 33393331 37363437 3336301E 170D3933 30333031 30303030
  +35395A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  +4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 39333137
  +36343733 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  +8100DA7B 48D89795 A5E15EF8 742210BB 6BC3FDB6 4046F577 21A9A1C3 C3A2A0CB
  +7472DAFF A678D559 6493D779 178516B3 AC7252AF 7FA527B9 63DF34BB ED8EAA7D
  +3B8A137A ADC24C7C 4678053C C625E504 EFA15FF6 E70238BF 12553BB3 C4558705
  +84DB52B5 FEF3D93E 1F34FED9 724CECB5 80F15D07 E35D4D69 B22B1584 2614137A
  +2B510203 010001A3 66306430 0F060355 1D130101 FF040530 030101FF 30110603
  +551D1104 0A300882 06523239 36302E30 1F060355 1D230418 30168014 B0C052AF
  +7C068EA6 E181B1C2 F0D41C9E 7FA9601D 301D0603 551D0E04 160414B0 C052AF7C
  +068EA6E1 81B1C2F0 D41C9E7F A9601D30 0D06092A 864886F7 0D010104 05000381
  +8100AECC F11A0E9F F4CDE08C 7FC01A3B 27E87EFD 3A9EF10F 2B21C933 8259FD62
  +52500E4C 5FDD6F31 25F94933 78F9CE65 E5393E5C 0F380599 1FA5FA99 DFDA7D71
  +5A645893 BB306C04 D417956A 896BD06C D0EE7C02 BB789A00 4FC97AB6 00AD6227
  +D51B9E77 70CF9737 18DF1007 AAE25227 82564078 47846112 A3439EAC B6A7F6EF 0BDD
  +quit   
interface GigabitEthernet0/8
 +priority-queue out
 +mls qos trust cos
+alias configure diff do sh archive config differences nvram:startup-config system:running-config
-mls qos map cos-dscp 0 8 16 24 32 46 48 56
crypto pki certificate chain TP-self-signed-3931764736
 -certificate self-signed 01 nvram:IOS-Self-Sig#3636.cer

2. If you want to verify IP address configuration with subnet mask you could use this “sh run | in (interface|ip add) “. If you want to alias config for this it will look like this.

DSW1(config)#alias exec ipadd sh run | in (interface|ip add)
DSW1(config)#alias configure ipadd do sh run | in (interface|ip add)

DSW1(config)#ipadd
interface GigabitEthernet1/0/1
interface GigabitEthernet1/0/2
interface GigabitEthernet1/0/3
interface GigabitEthernet1/0/4
interface GigabitEthernet1/0/5
interface GigabitEthernet1/0/6
interface GigabitEthernet1/0/7
interface GigabitEthernet1/0/8
interface GigabitEthernet1/0/9
interface GigabitEthernet1/0/10
interface GigabitEthernet1/0/11
interface GigabitEthernet1/0/12
interface GigabitEthernet1/0/13
interface GigabitEthernet1/0/14
interface GigabitEthernet1/0/15
interface GigabitEthernet1/0/16
interface GigabitEthernet1/0/17
interface GigabitEthernet1/0/18
interface GigabitEthernet1/0/19
interface GigabitEthernet1/0/20
interface GigabitEthernet1/0/21
interface GigabitEthernet1/0/22
interface GigabitEthernet1/0/23
interface GigabitEthernet1/0/24
interface GigabitEthernet1/0/25
interface GigabitEthernet1/0/26
interface GigabitEthernet1/0/27
interface GigabitEthernet1/0/28
interface Vlan1
 no ip address
interface Vlan10
 ip address 192.168.10.11 255.255.255.0
interface Vlan20
 ip address 192.168.20.254 255.255.255.0
interface Vlan100
 ip address 192.168.100.254 255.255.255.0
interface Vlan200
 ip address 192.168.200.254 255.255.255.0
alias configure ipadd do sh run | in (interface|ip add)
alias exec ipadd sh run | in (interface|ip add)

3. If you want to verify QoS trust status & any QoS related config in each individual interface you can use “show run | in (interface|mls|queue|srr)“. You can use a alias for this if you need to use these regularly.

DSW1(config)#alias configure qos do sh run | in (inter|mls|srr|queue)
DSW1(config)#alias exec qos sh run | in (inter|mls|srr|queue)        
DSW1(config)#qos
vlan internal allocation policy ascending
interface GigabitEthernet1/0/1
 mls qos trust cos
interface GigabitEthernet1/0/2
 mls qos trust dscp
interface GigabitEthernet1/0/3
 mls qos trust dscp
interface GigabitEthernet1/0/4
 mls qos trust dscp
interface GigabitEthernet1/0/5
 mls qos trust dscp
interface GigabitEthernet1/0/6
 mls qos trust dscp
interface GigabitEthernet1/0/7
 mls qos trust dscp
interface GigabitEthernet1/0/8
 mls qos trust dscp
interface GigabitEthernet1/0/9
 mls qos trust dscp
interface GigabitEthernet1/0/10
 mls qos trust dscp
interface GigabitEthernet1/0/11
 mls qos trust dscp
interface GigabitEthernet1/0/12
 srr-queue bandwidth share 1 30 35 5
 priority-queue out 
 mls qos trust device cisco-phone
 mls qos trust cos

Finally your alias config looks like this. If you intend to use alias during your lab exam better to configure those on IOS devices (mainly switches, autonomous AP)

DSW1(config)#do sh run | in alias
alias configure ipadd do sh run | in (interface|ip add)
alias configure qos do sh run | in (inter|mls|srr|queue)
alias configure diff do sh archive config differences nvram:startup-config system:running-config
alias exec ipadd sh run | in (interface|ip add)
alias exec qos sh run | in (inter|mls|srr|queue)
alias exec diff sh archive config differences nvram:startup-config system:running-config

Once you finish using these it is better to remove it from your network devices. You can use “no alias exec” & “no alias configure” to remove those.

Related Posts

1. “show archive config differences” is your Friend

In this post we will see how multicast can be configured on WGB (workgroup bridge) solution. Here is the topology for this post. WGB (3502I) is connected to Autonomous AP (AAP2- 1131), where a wireled client (multicast receiver) is connected behind WGB. A multicast source is connected to L3 switch where all the SVI & DHCP pool defined.(VLC player is used to simulate multicast streaming & receving it at the other end)

AAP2 is connected to C3750  Fa1/0/12 which is configured as trunk port with native vlan 999.

interface FastEthernet1/0/11
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 1,6,999
 switchport mode trunk
 priority-queue out 
 mls qos trust cos

Here is the config of Root AP (AAP1)

hostname AAP2
!
dot11 ssid WGB
   vlan 999
   authentication open 
!
interface Dot11Radio1
 ssid WGB
 station-role root
!
interface Dot11Radio1.999
 encapsulation dot1Q 999 native
 bridge-group 1
!
interface FastEthernet0.999
 encapsulation dot1Q 999 native
 bridge-group 1
!
interface BVI1
 ip address 192.168.99.199 255.255.255.0
!
ip default-gateway 192.168.99.1

Here is the config of WGB.

hostname WGB
!
dot11 ssid WGB
   authentication open 
!
interface Dot11Radio1
 ssid WGB
 station-role workgroup-bridge
 bridge-group 1
!
interface GigabitEthernet0
 bridge-group 1
!
interface BVI1
 ip address 192.168.99.100 255.255.255.0

Once you configure this you should see the WGB & its client association on AAP1 like below.

AAP2#sh dot11 associations 
802.11 Client Stations on Dot11Radio1: 
SSID [WGB] : 
MAC Address    IP address      Device        Name            Parent         State     
001f.1618.dfec 192.168.99.207  WGB-client    -               44d3.caaf.4343 Assoc    
44d3.caaf.4343 192.168.99.100  WGB           WGB             self           Assoc

Now it is ready to test your multicast, I am streaming a video from PC1 to multicast group address 238.2.3.8 & then from PC2 behind the WGB, joining to this group. Now if you do a wireless packet capture you could see the traffic going to across this link. Here is a sample output of that capture.

If you look at one individual packet in detail it will looks like this

You can see in the wireless frame header there are 4 different address (Receiver, Destination, Transmitter – AAP1 & Source – PC1). But both Receiver address & Destination address is same as the multicast MAC address. In other words these multicast frames are not acknowledged by WGB, so reliability of packet delivery cannot be ensured.

You can improved the reliability of multicast packet delivery by configuring WGB as infrastructure-client instead of normal client. You have to configure “infrastructure-client” command on root AP (AAP2) radio interface.

AAP2
interface Dot11Radio1
 infrastructure-client

Let’s see the difference it makes this time.

This time you can see each multicast frame is acknowledge by WGB. Here is the inside of a multicast packet this time.

You can see this time Receiver address is WGB mac address, so it is a unicast frame where WGB will acknowledge every time. The advantage is that if you have several clients behind the WGB, you send one broadcast (or one multicast), then a second copy of that broadcast/multicast encapsulated into a unicast frame to the WGB and the ACK from the WGB confirms that the frame was received and is going to be relayed to the wired clients. This increases reliability (usually, broadcasts and multicasts are never acknowledged)..

The downside is that it also increases traffic on the radio, as packets that are usually not acknowledged are now acknowledged (and you send as many unicast copies as you have WGBs). So the limitation of this mode is that the AP will not allow more than 20 WGB clients.

Normally in this scenario WGB receive same multicast frame twice. You can configure the workgroup bridge multicast mode to either “client” or “infrastructure” mode. If you configure it as “infrastructure” it will only accept 4 different MAC address frames & drop 3 MAC address frames (where destination & receiver address identical).

WGB(config-if)#station-role workgroup-bridge ?         
  multicast  configure multicast
  universal  Universal Client
  <cr>

WGB(config-if)#station-role workgroup-bridge multicast ?
  mode  configure multicast mode

WGB(config-if)#station-role workgroup-bridge multicast mo
WGB(config-if)#station-role workgroup-bridge multicast mode ?
  client          Client-mode accepts only 3-MAC address header mulitcast
                  packets
  infrastructure  Infrastructure-mode accepts only 4-MAC address header
                  multicast
             packets

WGB(config-if)#station-role workgroup-bridge multicast mode client 
*Jul  6 19:55:34.932: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio1, Associated To AP AAP2 0019.a945.fb00       
*Jul  6 19:55:35.526: %DOT11-6-MCAST_DISCARD: infrastructure mode multicast packets are discarded  in client mode  multicast mode

WGB(config-if)#station-role workgroup-bridge multicast mode infrastructure

In a future post we will see how we can do this when WGB is connected to Light Weight Access point as root.

Related Posts

1. Test Yourself- Basic Multicast
2. Configuring Multicast on WLC
3. Wireless Multicast is not working – Why ?
4. Understanding “VideoStream” feature
5. IGMP Basics
6. Multicast Address Allocation
7. Multicast Deployment Types
8. PIM-SM Static RP Configurations
9. PIM-SM Auto-RP configurations
10. PIM-BSR Bootstrap Router Configurations
11. Anycast with MSDP
12. PIM-SSM Source Specific Multicast

This was my dream blog post I have been waiting to write for last 12 months (since I passed my written exam 30th Aug 2012). After 15 hours of nervous time since finishing my lab exam finally I got my result. Now I have become a CCIE wireless. Yes my lucky day was 20th Aug 2013 .

This sort of satisfaction is hard to come by. You  have to earn it & I had to put enormous number of hours to get it. Wake up 4:00AM & study 2-3 hours before go to work & then study full time over the weekend. That was my life most of past 12 months.

I got a very good support from my company & they really support me during this tough journey. But without the support I got from my family, this was an impossible task. They made great scarification to make my journey success. So I would dedicate my CCIE wireless to my wife Rajika, daughter Dewmi  (4yr) & son Manuka (1yr) for the contribution they made on this. Also through this blog I met lot of colleagues in the same field & that help as well.

Here is some celebration I had when I came home with my exam result from work (Thaththa mean “Dad” in our language)

Time to enjoy this for now & I will write a separate post on my strategy this time.

Related Posts

1. What did I learn from my 1st Attempt ?
2. My winning Strategy
3. How to Become a CCIE Wireless

Prior to go for my 2nd attempt I knew what are my weaknesses through my 1st attempt in May. Here are they.

1. Slow Approach (planned for 30 min, took 1 hr & 15 min )
2. Heavily relied on GUI & GUI was very slow (couldn’t finish task on time, without knowing CLI, stuck in certain tasks)
3. Did not master ACS 5.2 configs
4. Did not know Autonomous advanced config
5. Felt questions was too long…
6. Lack of practice & felt my speed was slow.

This was my winning strategy this time.

Approach: Since it was my 2nd attempt, I was almost familiar with the topology already. Also content was very similar too. So did not have to read to word by word to get what they ask for. In the given A4-rough sheet I did the following while reading the paper in the initial 30 min.

1. Time/Point tracking table (for overall progress tracking)
2. WLAN table (for WLAN creation)
3. Device Connectivity table (for QoS)

Here is a sample rough-sheet which I did during  a practice lab at home. This helped me to measure how I progress with time & then I knew exactly whether I am ok or not during my real exam.

Also if you need to configure QoS for a given network, in this way you do not miss any devices by accident and as long as you know what trusting model you have to use in each types of devices connected interfaces then you are ready for QoS config.

WLAN table helps me to maps all the features into a table where I do not want to read the question again until the final verification done.

Planning: It was obvious I had to improve my speed & should able to finish my exam within 6 hours to give last 2 hours at the end to verification. There are 3 ways to do the same tasks

1. Use WLC GUI
2. Use WCS templates
3. Use CLI

Based on my last lab experience of slow GUI at Sydeny lab, I do not wanted to take any risk this time. So I decided option 3 as my preferred option. So learn almost every thing (include RRM, Mobility, WLAN creation, Clean Air, Video Stream, SNMP, Syslog, Radius, etc) to do via CLI between my 1st attempt & 2nd attempt. This was the biggest success factor which brings the difference for me.

I spent nearly 45 min to complete my notepad with the CLI command required to complete each tasks. Also the CLI verification commands to run each time once the configuration done.  I aggregate configuration tasks (QoS, Media, CleanAir,TPC,DCA, etc) to be done while radio bands disabled. So when configuring it I apply those commands, so every band specific tasks were configured in one go. So did not want to disable/enable radio band multiple times.Make sure you do this right for the first time & that will save time of reworking.

Used following two alias config in all IOS devices. Every time I do a configuration task I would verify it by typing “d” in either config mode or exec mode in order to configuration addition was accurate. I used the other alias to QoS config verification.(I removed those alias config within last 30 min of my lab)

alias exec q sh run | in (inter|mls|srr|wrr|queue)
alias configure q do sh run | in (inter|mls|srr|wrr|queue)

alias exec d sh archive config differences nvram:startup-config system:running-config
alias configure d do sh archive config differences nvram:startup-config system:running-config

Here are some of CLI verification commands I have regularly used.

sh clock
sh ntp association
sh ip route
sh standby brief
sh spanning-tree root
sh etherchannel summary

show ap  summary
show dhcp proxy
show dhcp opt-82
show interface detailed <int-name>
show snmpversion
show snmpcommunity
show snmpv3user
show ap config global
show logging
show ap config general <ap-name>
show radius summary 
show interface summary
show interface detailed <int-name>
show wlan summary 
show wlan <wlan-id>
show client summary 
show client detail <client-mac>
show mobility summary
show network summary
show advanced {802.11b|802.11a} group 
show dot11 ass

End of the day, I have spent 1 hr & 15 min without doing any lab configuration tasks till that point , so what is the difference between the 1st attempt & 2nd attempt ? But this time I was very confident it will take very short time to copy & paste from notepad to CLI. Last time I did not have that comfort…

Executing: This time I had very clear plan what would be the sequence of configuration I have to do. I did not have it last time & followed the flow of the question & I did RRM towards end of my exam. That may not be a very good strategy as those configuration will take ~2 hrs to take effect. So In this time below was my sequence of configuration. In this way by lunch time (I was between task 8-9) I was able to test 1 or 2 WLAN with anyconnect client. I managed to finish ACS related config within 30  mins (as long as you master that, this is easy task) & then I only used it for verification only.

1. Check NTP & reachability to NTP server from all switches & WLC. If not work fix those issues
2. Configure the Mobility groups
3. Configure the RRM requirement
4. Register all LAPs to each controller
5. Configura AP modes as requested (H-REAP & OEAP )
6. Configure the ACS policy & Rules
7. Configure SNMP & add controller to WLC
8. Create SSID
9. Check the connectivity in sequentially.
10. Configure Autonomous AP tasks
11. Add MSE & Maps
12. Configure QoS
13. Verify, Verify & Verify

Verification: 2 hours from lunch, I was able to finish everything in the lab & give 2 hours to verify. When I was configuring I have verified for first time using CLI. But in last 2 hours I was going through GUI of the WLC’s to verify configuration in  different way. This was very effective to finding mistakes you have done.

Since I got enough time, I checked WLANs in each controller (by disabling WLAN in other controllers), make sure AP failover works as expected, Guest Tunneling in each controllers, Voice phone works in different authentication methods, etc. So I was very confident at the end of the lab where I gave my best shot this time. According to my tracking table I got around 85 marks excluding points for all doubtful questions.

What about technical issues this time ? I had couple of issues.

When I created WLANs I could not see it on my anyconnect client. I had to report this issue 2-3 times to proctor during my exam & he had to restart the client PC to fix it.(I utilized that time to do some other task & NOT impacted me negatively)

I still felt WCS/WLC’s GUI were slow, There was certain tasks I had to use GUI (as some constraints of doing it via CLI). Specially it it involve screen pop-up it will take noticeable time to do those tasks. Fortunately my strategy did not involve using any of those GUI for more than  5-10% of lab tasks. Therefore I was not fuzzy about that this time even though last time I complaint about it.

In conclusion, you have to plan to do this lab exam within 6 hours (including the initial ~1 hr planning exercise). Spend last 2 hours for verification, verification & verification. If you are able to do this definitely you will pass this exam & will get this prestigious certification.

PS: I never regret failing this exam 1st time & had to encounter this slow GUI issue at Sydney lab, Unless that happen I never learn these CLI commands & get the confidence level now I am having.

Related Posts

1. 20th Aug – My Lucky Day
2. What did I learn from my 1st Attempt ?
3. How to Become a CCIE Wireless

I started my wireless CCIE journey in July 2012. Like any other CCIE track, most important task was planing the journey. For me I had an additional advantage of going through a similar process in 2008 when I did my R&S lab exam & knew what it looks like. It is not only about your sole sacrifice, but the contribution of your family, your friends & everyone else around you. Therefore first of all I got the permission from my wife to dedicate another 12 months for my wireless journey.It was not an easy task as well, since we are alone in abroad with two young kids, had to organize alternative ways of supporting my family during this time. My mother-in-law & father-in-law agreed to visit us & stay with us 6 months each.

Once environment is ready, I had to come up with a proper study plan. This was the other key element of this journey. While you are studying you should be able to track how you progress & make sure you get the confidence as time goes on. My strategy was 4 hours of study in every week day & 12 hours a day in weekends. Below is a sample of my time tracker in excel. I wanted to ensure not many red cells (actual hours is less than planned)

Your time management skills are really important for this journey. Also you have to have your goals setup with time line against each other. For me I wanted to finish this within year 2013 & I have already planned 3 attempts if needed (you have to be realistic with your targets as well).

Getting start was the hard part for me. Initially I thought doing small scale lab & getting ready for the lab exam would help me to pass written exam on my way. It was very difficult to be focused in that way & finally gave up that idea. Then I focused the written exam & developed a mini-strategy to clear that. In wireless , I did not have any formal certification like CCNA-Wireless, CCNP-Wireless & wanted to challenge myself to go for a CCIE without those. I purchased the below mentioned materials for CCIE-Wireless written exam & went through them.

1. CCNA Wireless (640-722 IUWNE) Quick Reference – by Jerome Henry
2. CCNP-Wirless (642-732 CUWSS) Quick Reference – by Jerome Henry
3. CCNP-Wirless (642-737 IAUWS) Quick Reference – by Jerome Henry
4. CCNP-Wirless (642-747 IUWMS) Quick Reference – by Jerome Henry
5. CCNP-Wirless (642-742 IUWVN) Quick Reference – by Jerome Henry
6. CCIE-Wireless Exam (350-050) Quick Reference – By Roger Nobel, Federico Ziliotto, Federico Lovison, Fabian Riesen, Erik Vangrunderbeek

Written exam is all about theoretical concepts, you are ready to go for the exam as long as you refresh your knowledge about blueprint topics. So I booked my wireless written exam on 30th Aug 2012 & cleared it first time. I started my own blog (www.mrncciew.com) to keep my notes & to stay connected with the world of similar interest. This was a very big + point for my success & it helped me to keep up my enthusiasm on right focus throughout my journey.

Immediately after that I have booked my lab exam on 7th May 2013. This is another important thing to remember in your journey, once you lock down the lab date you won’t be deviating your schedule much. I booked it on May purposely  to leave me 6 months for 2nd & 3rd attempts within 2013. Availability of the CCIE Wireless lab exam at Cisco’s Sydney was one of the crucial point for me. I wanted to sit for the exam under the similar timezone where I studied. Sometimes little things become important matters. It is not easy to adjust to completely different clock to do the exam where your body clock working in a different timezone.

First challenge was to find good study materials for the lab exam. It was the time where CCIE wireless blueprint updated to version 2.0 (done in Nov 2011) & none of the vendors (IPexpert & Fastlane)have updated their full materials. I purchased Fastlane CCIEW workbook & IPexpert Wireless Self Study Bundle since there were not many choices (only volume 1 was ready for v2.0 by that time  & it took nearly 8 months to ready their remote racks for volume 2). Therefore I had to setup my own lab to do my preparations & that was another key success of my journey. I was fortunate to find few equipments for free from my company as we did some refresh in our wireless environment. This was my home lab with 2×4402, 1×2106, 2×3750, 2×2960, 1×3725 (CME) 1×1841 (WAN) & ESX for ACS,WCS,AD,DHCP (Dell Optiplex 745)

You have to assess your strengths & weaknesses & then need to allocate time to your study. For me “L2/L3 network infrastructure” & “Infrastructure Application Services” were two of my strong topics. “Autonomous deployment” & “Unified deployment-specific to network security) were my weak areas. “WCS” &  “WLAN services” are ok, but need some improvement.

I was struggling to get hold a grip of those topics since I have very very limited experience with Autonomous deployments. There aren’t many good documentations about these deployments.So I had to spend lot of hours to get basic understanding while creating basic lab setup for each scenario (like Bridge, Repeater, WGB,etc). Then studied security & advanced configuration with that basic knowledge.

Another tough topic was wireless QoS, I spent many hours to test it by doing sniffers & finally get a proper understanding how it works in wireless environment. This is very important as QoS plays a pivotal role in wireless lab exam. Same goes with Multicast as well.

ACS was another topic of similar nature. I haven’t worked with it in daily basis & had to learn it from scratch. I had a good friend who is a CCIE-Security helped me a lot to get the basic understanding of ACS & how to configure it. Spend 2 hours in every weekend with that friend (via phone & remote sharing) to learn this topic.

I studied almost all the Configuration Examples & Technotes related to lab exam blueprint topics. I had all of them in one excel file, so I can easily refer them when needed.  Below is a part of that excel sheet with respect to 5508 related config examples.

There was a boot camp in Australia  for CCIE wireless in Feb 2013.  I was very hopeful that we can learn from Jerome Henry who was well regarded as No 1 CCIE wireless instructor in the world since it was organized by  Fastlane affiliated company. Unfortunately by the time he has left Fastlane & joined Cisco, so we did not get any positive outcome from that bootcamp. We were given Fastlane workbook again & left us alone to do it.I was disappointing about that & had to fight with them to get additional rack hours due to the poor quality of the bootcamp.

I took 3 weeks off from my work to study for my 1st attempt on 7th May. I spent most of that time with IPexpert rented racks to do some sort of full scale labs. It was difficult to use their racks effectively since racks were not ready for Volume 2 ( 5 mock labs). I wasn’t 100% confident about ACS & Autonomous related advanced topics, but I had the confidence to give a good try.

I went to Sydney on 6th May from Melbourne. A wireless lab is held once a week every Tuesday in Sydney lab. I was the only candidate on that day (normally 4-5 people doing other tracks every day), and was comfortable in the lab environment. After the proctor’s initial briefing started my lab around 8:15AM. Even though I had a plan to finish reading the paper & do the initial planning work within 30-45 min, it was almost 1hr & 15 min once I complete that task. Then started to do pre-config verification & troubleshooting to get basic connectivity working. There were few questions in Autonomous & ACS related, which I did not know the answers, but for ACS I had some workaround & went ahead with zero points. When I reached the Unified deployment section I had the biggest hurdle in my exam. WLC’s GUI was very slow & I was never comfortable with that. Tried to use WCS for some QoS template configuration & encountered some errors. Finally did certain WLAN configs via WLC GUI in one of the controller & took a back up of it via WCS. Then try to derived CLI commands to apply it for other controllers. Time went very fast & I knew I never going to make it this time.  So in last 1-2 hours try to read some of the questions many times which I do not know the answers to better prepared for next time.

Around 4:45PM finished my lab exam & straight after took a taxi back to Airport. By the time I came home around 10:30PM, an email was there in my inbox which I did not want to see. As expected Unified deployment section I have scored very low & then Autonomous section. Even I thought  I did well in L2/L3, I did not score 100%. For the WCS section I got 100% & I was very happy about that.

Without much of thinking I went ahead & booked my 2nd attempt on 20th August. I had to wait 3 months as no other lab dates available in Sydney for wireless. Then re-assessed what happened to my first attempt & below are the weaknesses I found.

1. Slow Approach (planned for 30 min, took 1 hr & 15 min )
2. Heavily rely on GUI & GUI was very slow (couldn’t finish task on time, without knowing CLI, stuck in certain tasks)
3. Did not master ACS 5.2 configs
4. Did not know Autonomous advanced config
5. Felt questions was too long…
6. Lack of practice & felt my speed was too slow.

Between the first attempt & second attempt, I spent my time to fix my weaknesses. Most importantly I did not want to take any risk of being uncomfortable with slow GUI & rely on that to do my config. So decided to learn CLI method of doing things. Initially started with WLAN config via CLI & then move to Mobility, RRM, Video Stream & 802.11 band specific configs, SNMP, Syslog, RADIUS, etc. Once I did this multiple times I felt it was not too hard, as long as you know the commands it will take very little time to configure it on multiple controllers (simple copy & paste exercise).

I revisited Autonomous Config Guide, Config examples & Technotes. Also ACS configurations to see how I can do the same task in different ways. Again I spent time with IPexpert remote racks, by this time their racks were ready to do their mock labs. Once I did few 8 hours labs, I felt my improvements. Then I simulated few exam scenarios & made sure I can do that if it comes again. Also this time I had a very clear plan of sequence of configuration task I would do. In first time I went with the question flows rather my own way of tackling it.

Again went back for the exam on 20th August. This time there were 3 other candidates (for Voice, SP & RS) to do their exam. Exam started around 8:25AM & I started reading. Initial 30 min I did my own time/point tracking table, device connectivity table & WLAN table. Content was very similar to the previous time & did not have to read word by word to get what they asked for. Then started preparing my notepad with CLI commands required to do each task with verification CLI commands as well. By that time all other candidates started hitting their key boards & made environment noisy. I was bit nervous, but I knew I have practiced this routine earlier & need to keep calm & execute my plan. It took me around 45 min to complete my notepad, so again 1 hr & 15 min gone without doing any config task . But I was very comfortable this time knowing that I have answers in my notepad.

I started doing things in following sequence & every time I did some configuration task I have verified it via CLI. I had every thing in my notepad, it was just matter of “Copy & Paste”. By lunch time I was in between step 9-10. I was very confident as I have checked couple of WLANs connectivity before lunch & all worked. I felt everything was going according to my plan this time & did not panic at all.

1. Check NTP & reachability to NTP server from all switches & WLC. If not work fix those issues
2. Configure the Mobility groups
3. Configure the RRM requirement
4. Register all LAPs to each controller
5. Configure AP modes as requested (H-REAP & OEAP )
6. Configure RADIUS in WLCs
7. Configure the ACS policy & Rules
8. Configure SNMP & add controller to WLC
9. Configure WLANs
10. Check the connectivity with Anyconnect.
11. Configure Autonomous AP tasks
12. Add MSE & Maps
13. Configure QoS
14. Verify, Verify & Verify

Within 2 hours after lunch I completely finished my exam. I spent last 2 hours to go through GUI of each controller & see whether I have made any configuration errors. This is another effective way of finding your errors(by doing it in a one way- CLI & verifying it in another way -GUI) This is very important in any CCIE track, you have to have at least 2 hours for final verification. If you get this much of time then you are very close to pass this hurdle. I had couple of doubtful questions, but when I added up my points I got around 85 marks excluding those. So I was very confident that I gave my best this time & should get through it. In CCIE, it is too early to celebrate until you get the confirmation from Cisco.

I thought, I would get my result by the time I go home as last time. This time I could not wait for this email and checked couple of times prior to board onto the flight back to Melbourne, but no emails.I went home around 10:30PM & checked my email again, but nothing was there. I didn’t have a goodnight sleep and woke up around 5:00AM & checked my email, but no mails from Cisco. Then I went to work & checked my mail again. There were no email from Cisco, then I checked my spam folder & finally saw an email from Cisco. It has arrived around 8:00AM (15 hrs from my exam). Nervously opened that email & I found out finally I have become a CCIE Wireless

In conclusion here are my advise to anyone who is willing to go for this journey.

1. Do your written exam early & just focus on that during early stages.
2. Book your lab exam immediately after you pass the written exam allocating sufficient time to study for lab exam.
3. If possible keep a blog running, this help you to connect with the rest of the world of similar interest & motivate yourself to pursuit your goal.
4. Build your home lab & start practicing technology area (not full scale labs)
5. Go through Config Examples & Technotes related to blue print topics/products of CCIE wireless lab exam.
6. If you can afford, buy training materials from a preferred supplier of your choice & practice it.
7. Towards end of your preparation, do full 8 hour labs (by using remote racks) & have your own strategy how to tackle it.
8. Learn about different ways of doing the same thing & select less riskier option better suited to you & practice it many times.
9. Go for the lab exam & try to execute your plan, if unable to succeed re-assess your strategy & go back again within 1-2 months.
10. Until you get below repeat step 9. You will get it one day

Related Posts

1. What Did I learn from my 1st Attempt
2. 20th Aug – My Lucky Day
3. My winning Strategy

WLC 7.5 introduced lots of new features  and you can see the full feature list from WLC 7.5.102.0 Release Notes. From my network environment perspective there are few key features that I would like to have,

1. 802.11ac module support for 3600 AP (if anyone need to play with 802.11ac with Cisco wireless this is the code you should have in your 5508)

2. New Mobility – CAPWAP for Inter-controller mobility instead of EoIP (All Next Gen WLC – 3850,5760 only support CAPWAP, so if you want to have mix of old gen & new gen WLCs with mobility you have to have this enabled). I have 1×5760 & around 50×3850 switches in my access layer. One day I want to use them as WLCs.

3. mDNS enhancements

Even though I like to have these, there are certain points you need to consider before this upgrade.

1. You have to upgrade Prime Infrastructure to 1.4 & MSE to 7.5 to be fully compatible with WLC 7.5.x (PI 1.4 is not a successor release to 1.3, it is an parallel track to 1.3 to support WLC 7.5 code. Next upgrade to 1.3 would be 2.0 where as 1.4 would be upgrade to 2.1 code. It is all confusing & refer this Cisco support forum post for some clarity). There is no downgrade option from 1.4 to 1.3

2. Even with Prime 1.4 you cannot manage next gen WLCs (3850,5760).

3. There are large number of un-resolved bugs (which Cisco known about) listed in the release notes. As always there may be lots of unknown bugs since this code is just released. We went ahead with 7.4.x as they released & found out few bugs which hurts us during last 6-8 months(refer this for more detail) So we do not want to go through a similar pain with 7.5.x unless benefits outweigh drawbacks.

Therefore it is too early & risky for me to go upgrade all my 5508 (x9 of them servicing ~12k concurrent devices) running 7.4.107.0 to this release. But I cannot resist it too long. There was a request from a VIP to have the capability of printing to his home printer while he is connected to corporate SSID at home. Yes it is a feature called “Split Tunneling” only supported in WLC 7.5.x onwards. This is the WLC 7.5.102.0 release note says about this

“You can configure split tunneling for the Cisco OEAP to enable or disable local printer access. You can enable or disable split tunneling on a per WLAN or per remote LAN basis, or you can enable or disable split tunneling globally on the Cisco OEAP themselves.“

Therefore I will be upgrading my DMZ (only that one for the time being) 5508 to 7.5.102.0 shortly to enable this feature for Office Extend Home users. I will not enable “New Mobility” feature, since that will break my guest tunneling without upgrading all other controllers. I hope still I can manage this via PI 1.3 (which is the current prime version) once upgraded to 7.5.102.0 (Even Cisco document says in is not compatible).

Once I read the release notes I found few other cool features as well. Here are they,

1. Output filtering using grep command
You can now use the grep command to print only the lines that match a pattern. This is especially useful when the output of certain show commands is lengthy and you have to scroll multiple times to get to the information that you need. Here are few examples

(WLC) >grep include 'Up Time' 'show sysinfo' 
Press yes to continue(y)y
System Up Time........................0 days 0 hrs 48 mins 35 secs
There are 1 lines matching the pattern Up Time 

(WLC) >grep include 'Split' 'show wlan 2'
Press yes to continue(y)y
Split Tunnel (Printers).......................... Enabled
There are 1 lines matching the pattern Split

2. Client deauthentication by username, IP Adderess instead of MAC address.
You can now deauthenticate a client by specifying the username or the IP address of the client. In the earlier releases, you could do this by specifying only the MAC address of the client. This enhancement allows multiple client sessions with the same username to be deauthenticated

config client deauthenticate {mac-addr | ipv4-addr | ipv6-addr | user-name}

3. Ping from a dynamic interface of your choice. Like source interface in extended ping command in normal IOS devices.
It is now possible to choose the interface name from which you ping:Ping from an interface of your choice by entering this command:

ping ip-addr interface-name

I will do a separate post on this Split Tunneling feature of WLC 7.5.x & how it works once I test it.

When I came to work today I got an envelop on my desk with below message inside it. It is from one of a VP in my organization & it made my day. Even small things like this goes distance in memory lane..

I like it & thanks Natalie for the appreciation.