Network Security Memorandum

Wednesday, July 20, 2016

Recover Cisco Device using TFTP Server or External Card from a Corrupt or Missing Image or in Rommon Mode

Cisco Switch usually is quite robust and not give me hard time. When it happens, it happens. What I met is a situation Cisco 4500 switch got into Rommon mode and I have to find a quickest way to get in back in production before the maintenance window ends.

The related posts in this blog:

1. Why in ROMmon Mode

Here are some reasons why switch could wind up in ROMmon mode from Cisco doc:

A switch reload or crash after the image was corrupted or deleted. See the Recover from a Corrupt or Missing Image section of this document for more information.
The Compact Flash which holds the system image has been removed. See the Recover from a Continuous Reboot section of this document to determine if a valid system image is present in the bootflash:. If there is no file present, see the Recover from a Corrupt or Missing Image section of this document
The configuration register has been changed incorrectly. The configuration register value of 0x0 always brings the switch to ROMmon mode. The typical configuration register is 0x2102, with the boot system flash command pointing to the system image to load. Refer to this document for more information about the configuration register:The Configuring the Software Configuration Register section of Configuring the Catalyst 4000 Family Switch for the First Time.
The boot variable is incorrect, but a valid image is still present. See the Recover from a Continuous Reboot section of this document for more information.

These primary symptoms occur in your network if the switch is in ROMmon mode:

Routing failures occur because ROMmon mode cannot route between VLAN interfaces, and is only designed to recover the switch.
If you try to Telnet to any of the interfaces it fails, and if you are connected to the console port of the Supervisor, you see this prompt:


 *********************************************************
 *                                                       *
 * ROMMON configuration is being initialized to default  *
 * values. This may be because it was never initialized. *
 *                                                       *
 *********************************************************



Verifying FPGA (P) Signature ....................... PASSED
flash0:/codesign/fpga.dat open failure

Verifying ROMMON (P) Signature ......... PASSED
flash0:/codesign/rm1.dat open failure



************************************************************
*                                                          *
* Rom Monitor                                              *
* Copyright (c) 2012-2013 by Cisco Systems, Inc.           *
* All rights reserved.                                     *
*                                                          *
************************************************************

Rom Monitor (P) Version 15.1(1r)SG1
Compiled Wed 14-Aug-13 17:15 [RLS]

System       : WS-X45-SUP8-E  Slot [5]
Chassis      : WS-C4510R*E    Mod  [1][2][3][4][7][8][9][10]
Revision     : CPU 2.0   BOARD 4.0   FPGA 3.15F2.9155
Memory       : 4096 MB
Date         : Sun Jul 17 19:41:37 2016


 Type Control-C to prevent autobooting....
 config-register = 0x102
 Autobooting using BOOT variable specified file.....

 Could not find a valid file in BOOT environment variable.
 BOOT variable can be set from IOS. To find currently set
 Rom Monitor variables, please type 'set' command.

 For help on choosing a boot method,  type 'confreg' command.
rommon 0 >

2. Recover from TFTP Server

2.1 Connect Mgmt port on Cisco 4500 to your machine which Tftp server is running on.
2.2 Configure Mgmt Port on Cisco 4500 with ip address 10.10.10.10. Put right IOS file (for example 4500.bin) under tftp server root folder.
2.3 Configure your machine which TFTP is running on with ip address 10.10.10.1
2.4 Confirm connectivity with ping
2.5 bott tftp://10.10.10.1/4500.bin


rommon 4 >ping 10.10.10.10
Pinging 10.10.10.10
!!!!
10.10.10.10 is alive!
rommon 5 >ping 10.10.10.1
Pinging 10.10.10.1
!!!!
10.10.10.1 is alive!
rommon 6 >boot tftp://10.10.10.1/4500.bin
Link Speed   : 1Gb Full Duplex
Filename     : /4500.bin
IpAddress    : 10.10.10.10
TftpServer   : 10.10.10.1
!!!!!!TFTP: Session Timed Out....

rommon 7 >dir

 usage: dir { [ bootflash: ] | [ slot0: ] | [ usb0: ] }
rommon 8 >set
 PS1=rommon ! >
 RommonVer=15.1(1r)SG1
 ConfigReg=0x0102
 IpAddr=10.10.10.10
 Netmask=255.255.255.0
 BootedFileName=tftp://10.10.10.1/4500.bin

rommon 10 >?
 alias              show/set aliases command
 arp                show arp table
 boot               boot an executable image
 clear              clear misc. configurations
 confreg            configuration register setup
 date               display the current date and time
 dev                list the storage device table
 dir                list files in a storage device
 ethstat            management ethernet packet count
 history            monitor command history
 md5                compute md5 sum of a file
 ping               ping utility for IP/network connectivity
 reset              reset system
 set                show/set rommon/environment variable(s)
 unalias            unset an alias
 unset              unset rommon/environment variable(s)
 version            display rommon version information
rommon 11 >boot ?
 Invalid filename ?. It must begin with device name.
 Type 'boot -help' for details.
rommon 12 >boot tftp ?
Link Speed   : 1Gb Full Duplex
Filename     : tftp
IpAddress    : 10.10.10.10
TftpServer   : 0.0.0.0
 [CTRL-C]
rommon 13 >boot -help
 usage: boot [-adhv] [filename]
 -a display help on autoboot and BOOT variable setup
 -d display detailed help message
 -help display this message
 -v  verbose

Examples:
 boot
   - boots the first file from internal flash.

 boot bootflash:ios
   - boots file "ios" from internal flash device.

 boot slot0:ios
   - boots file "ios" from compact flash device.

 boot tftp://10.1.1.5/tftpboot/ios
   - boots file "/tftpboot/ios" from tftp server
     10.1.1.5 through the management interface (also called
     "fa1 interface") using tftp file transfer protocol.

 Type 'boot -d' for detailed help, including help on
 netload mechanism and BOOTLDR program.

rommon 14 >dev
 No USB storage device detected!
 No SD storage device detected!

 Device Table
 ============
 Logical Physical Partition Status Begin    Size     Drive
 Number  Number   Number           sector   in Kb    Name
 ------- -------- --------- ------ -------- -------- --------
       0        0         0      0        0        0 flash0:
       1        0         1      0        0        0 flash1:
       2        0         2      0        0        0 flash2:
       3        0         3      0        0        0 flash3:
       4        0         4      0        0        0 flash4:
       5        0         5      0        0        0 flash5:
       6        1         0      0        0        0 slot0:
       7        2         0      0        0        0 usb0:
rommon 15 >boot tftp://10.10.10.1/4500.bin
Link Speed   : 1Gb Full Duplex
Filename     : /4500.bin
IpAddress    : 10.10.10.10
TftpServer   : 10.10.10.1
!!!!!TFTP: Session Timed Out....

The boot from TFTP server failed because of session timed out.

3. Recover from SD card in slot0

Cisco Catalyst 4500E Supervisor Engine support external USB and Secure Digital (SD) card for flexible storage options. You wont be able to use new fast speed SD card. Cisco is selling this kind SD for more than $400. But it wont cost you more than $50 if you buy it from eBay or Amazon.

SD-X45-2GB-E	Cisco Catalyst 4500 2GB SD Memory Card for Sup 7-E
USB-X45-4GB-E	Cisco Catalyst 4500 4GB USB device for Sup 7-E

3.1 Copy correct IOS file to SD card

SWTEST#format slot0: FAT16
Format operation may take a while. Continue? [confirm]
Format operation will destroy all data in "slot0:".  Continue? [confirm]
Format of slot0 complete


SWTEST#copy bootflash:?
bootflash:cat4500es8-universalk9.SPA.03.03.00.XO.151-1.XO.bin
bootflash:cat4500es8-universalk9.SPA.03.03.01.XO.151-1.XO1.bin

SWTEST#copy bootflash:cat4500es8-universalk9.SPA.03.03.01.XO.151-1.XO1.bin slot0:
Destination filename [cat4500es8-universalk9.SPA.03.03.01.XO.151-1.XO1.bin]?
Copy in progress...CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
185800924 bytes copied in 46.880 secs (3963330 bytes/sec)
SWTEST#

3.2 Boot Failed device from ROMmon mode with SD card

rommon 0 >boot slot0:cat4500es8-universalk9.SPA.03.03.01.XO.151-1.XO1.bin
Loading image !!!!!!!!!!!!!!!!!!!!

Checking digital signature....
[slot0:cat4500es8-universalk9.SPA.03.03.01.XO.151-1.XO1.bin]
Digitally Signed Release Software with key version A

flash0:/codesign/ios.dat open failure

Rommon reg: 0x00084F80
Reset2Reg: 0x0CB00000

Image load status: 0x00000000
########
Conan controller 0x0498FA9B..0x04C268B4 Size:0x00CAC5EC @
####
Radtrooper controller 0x047F3F00..0x0498FA9A Size:0x00661EDC @
Link: 0x00000080-0x16000000
Program Done!
##############################
Freescale FM module (Jul 31 2013:13:42:18)
Starting System Services
Calculating module dependencies ...
RTNETLINK answers: Invalid argument
Jul 17 19:44:55 %IOSXE-2-PLATFORM: process kernel: Freescale FM module (Jul 31 2 013:13:42:18)
Jul 17 19:44:55 %IOSXE-3-PLATFORM: process kernel: PME2: fsl_pme2_db_init: not o n ctrl-plane
No Mountpoints DefinedJul 17 19:44:58 %IOSXE-3-PLATFORM: process sshd[4657]: err or: Bind to port 22 on :: failed: Address already in use.

diagsk10-post version 6.1.0.0

prod: WS-X45-SUP8-E part: 73-14915-04 serial: CAT1746L7AQ

Power-on-self-test for Module 5: WS-X45-SUP8-E

CPU Subsystem Tests ...
seeprom: Pass

Traffic: L3 Loopback ...
Test Results: Pass

Traffic: L2 Loopback ...
Test Results: Pass
post done
Exiting to ios...
Loading virtuclock as vuclock
Loading gsbu64atomic as gdb64atomic
Loading gsbu64atomic
Starting IOS Services
AIPC Module Loaded...
Platform Manager: acquire hwlock chassis()
Platform Manager: starting in standalone mode

Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706

Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500es 8-UNIVERSALK9-M), Version 03.03.01.XO RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Wed 30-Apr-14 02:55 by prod_rel_team

Cisco IOS-XE software, Copyright (c) 2005-2013 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco WS-C4510R+E (P5040) processor (revision 2) with 4194304K bytes of physical memory.
Processor board ID FXS1749Q1L6
P5040 CPU at 2.2GHz, Supervisor 8-E
Last reset from Reload
1 Virtual Ethernet interface
288 Gigabit Ethernet interfaces
32 Ten Gigabit Ethernet interfaces
511K bytes of non-volatile configuration memory.

ctspPeerPolicyUpdatedNotif notification is disabled.
ctspAuthorizationSgaclFailNotif notification is disabled.

Press RETURN to get started!

User Access Verification

Username:

Reference:
1. Recover a Cisco IOS Catalyst 4500/4000 Series Switch from a Corrupt or Missing Image or in Rommon Mode

Saturday, July 16, 2016

Check Point 1100 Appliance Configuration Step by Step

Check Point 1100 Appliance

A couple of months ago, I received Check Point 600 Appliance and did a post regarding basic configuration for 600. It is used to replace replaces the Save@Office models and cannot be managed centrally by a Check Point SmartCenter Server. 1100 appliance is an all-in-one security appliance that offers robust, multi-layered protection with branch offices in mind, including flexible network interfaces and a compact, desktop form factor, which is used to replace the SG80 and the UTM-1 Edge.

Both 600 and 1100 appliances support local management. The SG600 can be centrally managed by Check Point's SMB Management Cloud service. The SG1100 can be managed by standard Check Point management running R75.46 or above. Neither unit can be managed by the old Sofaware SMP product.

Back panel: 8 LAN ports, 1 WAN port, 1 DMZ port, console port.

Front Panel: there is one usb slot.

Configuration:
1. Connect One of LAN ports with your computer.
Your computer will get a DHCP ip address from 192.168.1.0/24 network.
In my case, my laptop got 192.168.1.126 ip address and gateway is 192.168.1.1 which is 1100 appliance's default LAN interface ip.

Type http://192.168.1.1 or https://192.168.1.1 , the browser will automatically re-direct to https://192.168.1.1:4434 , which is default management interface of Check Point 1100 appliance.

2. First Time Configuration Wizard
It will guide you to complete basic configuration step by step.

3. Log in 1100 Appliance

4. Firewall Access Policy Configuration

4.1 Static NAT Server Configuration

4.2 Outbound Internet Access Rule

4.3 Inbound Access Rule from Internet

In following screenshots, there are three parts:

Red rectangle part is Outgoing access to the Internet which is auto-generated rule from 4.2
Green rectangle part is Incoming rules and VPN rules

Yellow rectangle part is manual rules for inbound traffic
Blue rectangle part is those auto-generated rules from 4.1 by static server NAT configuration.

Reference:

Check Point 1100 Appliance - FAQ

Sunday, June 26, 2016

Cisco Wireless Controller 5508 Configuration Step by Step - Part 3 (Certs Auth and Other Settings)

This post will use a typical WiFi in office environment as an example to present related configuration on WLC, Radius (NPS), DHCP Servers.

1. Topology:

1.1 Network Topology

Relate Posts:

1.2 Device List:

Cisco AP 1702i
Switches
Radius Server - Microsoft NPS
DHCP Server
Cisco WLC5508

1.3 Topology for Wireless Access with Digital Certificate Client Authentication

2. WiFi Access Requirements
This WiFi access is primarily intended for company laptops which already has client certificate installed on the machine through domain group policy. This WiFi network will be on a separate office VLAN from other office VLAN.

Other WiFi connected devices must not be allowed connecting to this office WiFi. They will connect through Company Guest WiFi. Mobile devices such as BYOD, Blackberry or other PDA and smart phones should not be allowed to connect to Office WiFi.

3. NPS Configuration

When using WPA2-Enterprise with 802.1x authentication EAP-TLS can be specified as an authentication method. When EAP-TLS is the chosen authentication method both the wireless client and the RADIUS server use certificates to verify their identities to each other and perform mutual authentication. Below are the steps for configuring policy in Windows Network Policy Server to support EAP-TLS.

Creating a Connection Request Policy to support IEEE 802.11 wireless connections.

Open the Network Policy Server console.
Navigate to NPS(Local)>Policies>Connection Request Policies.
Right click Connection Request Policies and select New.
On Specify Connection Policy Name and Connection Type enter a Policy name: and click Next.
On Specify Conditions click Add.
Select NAS Port Type as a condition.
For NAS Port Type check Wireless - IEEE 802.11 and Wireless - Other click OK.
Click Next.
On Specify Connection Request Forwarding leave the defaults and click Next.
On Specify Authentication Methods leave the defaults and click Next.
On Configure Settings click Next.
Review the settings On Completing Connection Request Policy Wizard and click Finish.
Right click the Connection Policy created and select Move up so its processing order is before any other policies.

Creating a Network Policy to support EAP-TLS as the authentication method for IEEE 802.11 wireless connections.

Right click Network Policies and select New.
On Specify Network Policy Name and Connection Type enter a Policy name: and click Next.
On Specify Conditions click Add.
Select NAS Port Type as a condition.
For NAS Port Type check Wireless - IEEE 802.11 and Wireless - Other click OK.
Click Next.
On Specify Access Permissions make sure Access granted is selected and click Next.
On Configure Authentication Methods click Add and choose Microsoft: Smart Card or other certificate for Add EAP and click OK.
Uncheck any boxes under Less secure authentication methods.
Select Microsoft: Smart Card or other certificate for EAP types and click Edit.
Verify the Certificate issued to: drop down shows the correct certificate and issuer which is the Active Directory CA server. Then click OK.
Click Next.
On Configure Constraints click Next.
On Configure Settings choose NAP Enforcement.
Under Auto-Remediation, uncheck the box Auto-remediation of client computers and click Next.
Review the settings on Completing New Network Policy and Click Finish.
Right click the Network Policy created and select Move up so its processing order is before any other policies.

Here are screenshots for NPS Policy:

4. WLC Configuration

5. DHCP Option 43 configuration

When you are installing a Layer 3 access point on a different subnet than the Cisco wireless LAN controller, be sure that a DHCP server is reachable from the subnet on which you will be installing the access point, and that the subnet has a route back to the Cisco wireless LAN controller. Also be sure that the route back to the Cisco wireless LAN controller has destination UDP ports 5246 and 5247 open for CAPWAP communications. Ensure that the route back to the primary, secondary, and tertiary wireless LAN controller allows IP packet fragments. Finally, be sure that if address translation is used, that the access point and the Cisco wireless LAN controller have a static 1-to-1 NAT to an outside address. (Port Address Translation is not supported.)

You can use DHCP Option 43 to provide a list of controller IP addresses to the access points, enabling them to find and join a controller.

The access point must be able to find the IP address of the controller. This can be resolved by DHCP Option 43's configuration.

option 43 hex <hex string>

The hex string is assembled by concatenating the TLV values shown below:

Type + Length + Value

Type is always f1(hex). Length is the number of controller management IP addresses times 4 in hex. Value is the IP address of the controller listed sequentially in hex.

For example, suppose that there are two controllers with management interface IP addresses, 10.126.126.2 and 10.127.127.2. The type is f1(hex). The length is 2 * 4 = 8 = 08 (hex). The IP addresses translate to 0a7e7e02 and 0a7f7f02. Assembling the string then yields f1080a7e7e020a7f7f02. The resulting Cisco IOS command added to the DHCP scope is option 43 hex f1080a7e7e020a7f7f0

IP Address to Hex Converter has a online converter to help you to convert IP address to Hex.

Reference:

Friday, June 24, 2016

Cisco Wireless Controller 5508 Configuration Step by Step - Part 2 (User/Machine Auth)

RADIUS server has been used on a Cisco® Catalyst switch, router or IOS based wireless controllers in the context of enterprise network access security.

1. 802.1x and EAP
While IEEE 802.1X enables authenticated access to IEEE 802 media, including Ethernet and 802.11 wireless LANs, the RADIUS infrastructure facilitates centralized Authentication, Authorization, and Accounting (AAA) management for users and devices that connect and use network service(s).

Relate Posts:

In an identity based network an endpoint (supplicant) initiates its network access session with a 802.1X authentication. The IEEE 802.1X access control protocol is fundamentally a layer 2 transport protocol that carries the Extensible Authentication Protocol (EAP) payload in it. EAP is an authentication framework that defines the transport and usage of identity credentials. EAP encapsulates the usernames, passwords, certificates, tokens, OTPs, etc. that a client sends for the purpose of authentication. The first hop Network Access Server (NAS) (switch/router/wireless controller), hands off the EAP payload to the authentication server via the RADIUS messaging. The RADIUS server either performs lookups with its internal user database or queries an external identiity store, and responds to the client accordingly with the appropriate authorization permissions. The avaiability and servicability of a RADIUS server is fundamental for an enterprise grade secure access solution to operate.

To make wireless networks really secure you should use a RADIUS server to authenticate your users instead of using a pre-shared key. The RADIUS server will handle the authentication requests and uses EAP (Extensible Authentication Protocol) to communicate with users. There are many EAP types:

EAP (Extensible Authentication Protocol) uses an arbitrary authentication method, such as certificates, smart cards, or credentials.
EAP-TLS (EAP-Transport Layer Security) is an EAP type that is used in certificate-based security environments, and it provides the strongest authentication and key determination method.
EAP-MS-CHAP v2 (EAP-Microsoft Challenge Handshake Authentication Protocol version 2) is a mutual authentication method that supports password-based user or computer authentication.
PEAP (Protected EAP) is an authentication method that uses TLS to enhance the security of other EAP authentication protocols.

and the most popular ones are:

PEAP (Protected EAP)
EAP-TLS

PEAP is normally used to authenticate users by using a username and password. The RADIUS server will show a certificate to the users so that they can verify that they are talking to the correct RADIUS server. EAP-TLS is the most secure form of wireless authentication because it replaces the client username/password with a client certificate.

RADIUS is a distributed client/server system that secures networks against unauthorized access. It’s an open standard protocol that can be customized with vendor specific attributes. In the Cisco implementation, RADIUS clients run on Cisco switches/routers/wireless controllers and send authentication requests to a central RADIUS server that contains all user authentication and network service access information. Cisco supports RADIUS under its AAA security paradigm. RADIUS can be used with other AAA security protocols, such as TACACS+, Kerberos, and local username lookup. RADIUS is supported on all Cisco platforms, but some RADIUS-supported features run only on specified platforms.

2. Configure Local EAP Authentication
Local EAP is an authentication method that allows users and wireless clients to be authenticated locally to WLC. This is useful for a remote branch where it does not have a external RADIUS on-site or do not want to rely on the WAN to connect back to main office RADIUS or even that RADIUS server is gone down. Local EAP supports LEAP, EAP-FAST, EAP-TLS, PEAPv0/MSCHAPv2 and PEAPv1/GTC authentication between the WLC & wireless clients.

If any RADIUS servers are configured on the controller, the controller tries to authenticate the wireless client using the RADIUS servers first. Local EAP is attempted only if no RADIUS servers found (timed out or no RADIUS configured).

2.1 Create local Net Users

2.2 Create a Local EAP Profie - 'localEAP-test'

2.3 Configure a WLAN in the controllers and specify Local EAP as authentication mechanism.

Note that Radius authentication is disabled & only Local EAP selected.

After above steps, your wireless AP should be able to connect through local Net user authentication. You will make sure your this WLAN is in right vlan and on the switch vlan port, proper dhcp server / dhcp relay has been configued. Your connected wireless device will get ip address from your dhcp server.

3. Configure Authentication with AD

3.1 Register NPS server in AD

To enable Network Policy Server (NPS) to read user account information in Active Directory Domain Services (AD DS) during the authentication and authorization processes, you must register the server running NPS in AD.

3.2 Create a new Network Policy

3.3 Add a new condition

3.4 Select Windows Groups Condition

3.5 Choose a pre-defined domain user group

3.6 Choose Authentication methods

3.7 Choose some RADIUS attributes

Notes:
Rather than using user group in step 3.4, you also can choose machine groups. It will require some change at client end. You will have to change it from user or computer authentication to only computer authentication. The issue was caused by the Authentication Mode in the Security Settings for the Wireless Network Connection that we had setup in Group Policy (Computer Configuration > Windows Settings > Security Settings > Wireless Network (802.11) Policies > "Your Network Policy"). Originally the Authentication Mode was set to "User or Computer authentication", when this was changed to "Computer authentication" the Computer Account condition in the Network Policy in NPS was processed correctly and clients could connect. I can only assume that this is a bug as on further testing I found that when the Authentication Mode was set to "User or Computer authentication" NPS would process a User Account condition in the Network Policy correctly, but still refused to process the Computer Account condition properly.

Reference:

Pages